code wiki / _hdl_build / nx_authz_session_gate.nx

nx_authz_session_gate.nx

buildroot/runtime/_hdl_build/nx_authz_session_gate.nx

8992 B165 linesdepth 16pulls 48 transitivereach 0 importersview sourcekind gate/prooftopic authz
docsdependenciesstructsconstsfunctions

about

nx_authz_session_gate.nx -- proves the FULL per-request authorization chain a daemon runs, end-to-end and sovereign: a real no-cookie OPAQUE session token (X-Nishi-Session) -> nx_sa_validate_handle (authn -> the user's HANDLE) -> authz_level_of (handle -> permission LEVEL) -> authz_level_allow (LEVEL vs the gallery policy) -> the NSFW section is served ONLY to a private-level user. Uses REAL Modern Auth (register + login for genuine 152B tokens) + the gallery policy (/ ->0 public, /gallery/private/ ->2 NSFW). This is exactly what nx_media_server will call per request. license_tier: ORIGINAL

dependencies 5 imports · 0 importers

nx_site_auth.nx nx_authz.nx nx_modern_auth_flow.nx nx_base64.nx nx_syscalls.nx nx_authz_session_gate.nx

imports: nx_site_auth.nxnx_authz.nxnx_modern_auth_flow.nxnx_base64.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sg_w sys_write sg_trunc sys_openat_wr sys_close sys_mmap nx_uas_server_keys_load_or sys_mmap ↻ sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close ↻ _uas_hex_dec _uas_nib nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd ↻ sys_read ↻ sys_close ↻ nx_opq_derive_keypair sys_mmap ↻ _voprf_load_context_string u256_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write ↻ sys_exit sys_mmap ↻ nx_opq_hash_to_scalar sys_mmap ↻ nx_h2c_expand_message_xmd_ sys_mmap ↻ _h2c_i2osp_1 _h2c_i2osp_2

structs

none

consts

none

functions

13func sg_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: sg_rowmain calls 1: sys_write
14func sg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 3: sg_streq_nsg_decidemain
15func sg_row(name: *u8, ok: i64) -> i64 { if ok == 1 { sg_w(" PASS " as *u8) } if ok != 1 { sg_w(" FAIL " as *u8) } sg_w(name); sg_w("\n" as *u8); return ok }
called by 1: main calls 1: sg_w
16func sg_trunc(p: *u8) -> i64 { let fd: i64 = sys_openat_wr(p, 0x180); if fd >= 0 { sys_close(fd) } return 0 }
called by 1: main calls 2: sys_openat_wrsys_close
17func sg_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
called by 2: sg_reqmain
18func sg_catn(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
called by 1: sg_req
19func sg_streq_n(a: *u8, an: i64, b: *u8) -> i64
calls 1: sg_len
27func sg_req(req: *u8, path: *u8, b64: *u8, b64n: i64) -> i64
called by 1: main calls 2: sg_catsg_catn
37func sg_decide(ctx: *NxAuthContext, req: *u8, rl: i64, now_s: i64, hbuf: *u8, hn: *i64, uh: *i64, uhl: *i64, ul: *i64, un: i64, pp: *i64, pl: *i64, pv: *i64, np: i64, path: *u8) -> i64
called by 1: main calls 4: nx_sa_validate_handleauthz_level_ofauthz_level_allowsg_len
44func main() -> i64
calls 21: sg_wsg_truncsys_mmapnx_uas_server_keys_load_or_initsys_exitnx_auth_context_init+15