nx_api_edge.nx

buildroot/runtime/nx_api_edge.nx

16999 B299 linesdepth 9pulls 33 transitivereach 4 importersview sourcekind tooltopic api

docs dependencies structs consts functions

about

nx_api_edge.nx -- the REAL s-class hardening edge for the live agent-facing API (nx_tools_api on :18096, public as <domain>/api/tools + /mcp). WIRES the API-hardening capabilities that existed only as unwired island primitives + a hardcoded-secret DRAFT gateway (nx_api_gateway) into ONE real HTTP middleware that wraps ta_handle. NON-BREAKING by construction: it does NOT touch the cap-token execution auth (capt_verify still guards tools/call) nor block the open read-only catalog -- it ADDS, per request: * CORS deny-by-default (OPTIONS preflight -> 204; Access-Control-* only for allowlisted origins) * security headers on every response (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, HSTS) * a REAL token-bucket rate limit (monotonic-clock refill; 429 problem+json over budget) = DoS guard * RFC 9457 application/problem+json for edge errors (429, 413) This is the composition the apistack gates proved in isolation, now on the LIVE request path. license_tier: ORIGINAL genealogy_id: international-research-sources/ietf/rfc_6454_cors + rfc_9457_problem

dependencies 2 imports · 2 importers

imports: nx_syscalls.nxnx_tools_api.nx

imported by: nx_mcp_edge_boundary_gate.nxnx_tools_api_serve.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const EDGE_MAGIC_1000000000: i64 = 1000000000
15	const EDGE_MAGIC_1000000: i64 = 1000000
17	const EDGE_RESP_CAP: i64 = 1048576
26	const EDGE_REQ_MAX: i64 = EDGE_RESP_CAP
30	const TB_CAP_MILLI: i64 = 300000 // 300 tokens * 1000
31	const TB_RATE_PER_S: i64 = 30 // sustained refill tokens/second

functions

35	func edge_now_ns() -> i64 called by 1: edge_tb_allow calls 1: sys_mmap
42	func edge_tb_allow() -> i64 called by 1: nx_api_edge_handle calls 1: edge_now_ns
56	func edge_cpy(dst: u8, doff: i64, src: u8, n: i64) -> i64 { var i: i64 = 0; while i < n { dst[doff + i] = src[i]; i = i + 1 } return doff + n } called by 2: edge_origin_allowed nx_api_edge_handle
62	func edge_header_lower(c: i64) -> i64 called by 1: edge_find_header
66	func edge_find_header(req: u8, req_n: i64, name: u8, name_len: i64, vo: *i64) -> i64 called by 3: edge_origin_allowed nx_api_edge_handle main calls 1: edge_header_lower
99	func edge_origin_allowed(req: u8, req_n: i64, vo: i64) -> i64 called by 1: nx_api_edge_handle calls 5: edge_find_header ta_streq_n ta_cat ta_catn edge_cpy
110	func edge_sec_headers(out: *u8, o: i64) -> i64
119	func edge_inject(resp: u8, resp_len: i64, out: u8, req: *u8, req_n: i64) -> i64 called by 1: nx_api_edge_handle calls 3: sys_mmap ta_cat ta_catn
139	func edge_problem(out: u8, status_line: u8, ptype: u8, title: u8, status: i64, detail: *u8) -> i64
156	func edge_problem_too_large(out: *u8, declared: i64, limit: i64) -> i64
164	func edge_problem_short_body(out: *u8, got: i64, need: i64) -> i64
173	func nx_api_edge_handle(req: u8, req_n: i64, out: u8) -> i64
238	func edge_w(s: *u8) -> i64 { sys_write(1, s, ta_slen(s)); return 0 }
239	func edge_row(name: u8, ok: i64) -> i64 { if ok == 1 { edge_w(" PASS " as u8) } else { edge_w(" FAIL " as u8) } edge_w(name); edge_w("\n" as u8); return ok }
241	func edge_has(hay: u8, hn: i64, needle: u8) -> i64
254	func main() -> i64