code wiki / _hdl_build / nx_authz_gate.nx
nx_authz_gate.nx
buildroot/runtime/_hdl_build/nx_authz_gate.nx
about
nx_authz_gate.nx -- proves per-realm PERMISSION LEVELS (nx_authz): not all authenticated users share the same
access. Two realms with their OWN policy + user tables:
nishifamily: /pub/ (lvl0) < /family/ (lvl1) < /private/ incl NSFW (lvl2); users alice=0, bob=1, carol=2
andelinwest: /portal/ (lvl1 client) < /staff/ (lvl2 lawyer); users clientX=1, lawyerY=2
Proves: NSFW/private is NOT served to public/family users; andelinwest lawyers and clients are on different
levels; policies are REALM-SCOPED (a nishifamily level grants nothing on an andelinwest-style path); deny-by-
default; and handle->level resolution (unknown handle -> -1 -> caller denies). license_tier: ORIGINAL
dependencies 2 imports · 0 importers
imports: nx_authz.nxnx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 11 | func az_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } |
| 12 | func az_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } |
| 13 | func az_row(id: i64, ok: i64, what: *u8) -> i64 { az_w("AZROW " as *u8); let b: *u8=sys_mmap(8); b[0]=(48+id) as u8; sys_write(1,b,1); az_w(" " as *u8); if ok==1 { az_w("PASS " as *u8) } else { az_w("FAIL " as *u8) } az_w(what); az_w("\n" as *u8); return ok } |
| 15 | func az_allow(level: i64, paths: *i64, lens: *i64, lvl: *i64, n: i64, req: *u8) -> i64 |
| 19 | func main() -> i64 |