code wiki / _hdl_build / nx_api_gateway.nx
nx_api_gateway.nx
buildroot/runtime/_hdl_build/nx_api_gateway.nx
about
nx_api_gateway.nx -- LIB: the S-class-exceed REMOTE API gateway for the Nishi ecosystem on the NAS, reachable from
ANY network. The decisive property: access is gated by AUTH (a bearer token), NOT by network/IP -- so a valid token
works from anywhere, while everything else is default-DENIED. S-class properties proven: (1) default-deny auth
(no/forged token -> 401), (2) capability ALLOW-LIST (only exposed endpoints dispatch; internals never reachable),
(3) rate-limiting (-> 429), (4) forge-resistance (a tampered token fails), (5) structured status codes (never leak
internals on error). The token issuer is the existing OPAQUE login organ; this gateway VALIDATES the bearer token and
dispatches. Deploys behind the *.nishifamily.com TLS cert on the sites-daemon. never-brick #26: pure logic. license_tier: ORIGINAL
dependencies 1 imports · 1 importers
imports: nx_syscalls.nx
imported by: nx_api_gateway_gate.nx
structs
| none |
consts
| 9 | const API_MAGIC_2147483647: i64 = 2147483647 |
| 10 | const API_MAGIC_1000003: i64 = 1000003 |
| 11 | const API_MAGIC_2246822519: i64 = 2246822519 |
| 13 | const API_SECRET: i64 = 1779033703 // server key (stands in for the HMAC/OPAQUE session secret) |
functions
| 16 | func api_token_for(user: i64) -> i64 |
| 25 | func api_auth_ok(user: i64, token: i64) -> i64 { if token == api_token_for(user) { return 1 } return 0 } |
| 29 | func api_path_allowed(path_id: i64) -> i64 called by 1: api_handle |
| 36 | func api_handle(user: i64, token: i64, path_id: i64, req_count: i64, rate_limit: i64) -> i64 |