nx_authz_svc.nx
buildroot/runtime/nx_authz_svc.nx
about
nx_authz_svc.nx -- the SOVEREIGN AUTHORIZATION SERVICE core (the SpiceDB/OpenFGA/Ory-Keto architecture: ONE
daemon owns ONE tuple store and is the SINGLE WRITER; every surface CHECKs and WRITEs through it over a loopback
protocol). This is the architecturally complete endpoint of the ReBAC plane: because all surfaces share one
store, a group defined anywhere grants access everywhere -- BIDIRECTIONALLY (vs the read-only secondary hack).
PURE CORE (no main): az_handle (request -> response) + az_selftest (the offline gate body). Consumers:
_hdl_build/nx_authz_svc_daemon (loopback :8029 accept loop) + nx_authz_client (surfaces call in). Reuses nx_rebac
for the actual engine (rb_check/rb_put/rb_may_grant/rb_list_*). TRUST MODEL: binds 127.0.0.1 ONLY -> the callers
are our own authenticated daemons (rule 12: trust internal service-to-service; the public boundary already
validated the user), so the grantor identity in a /write is trusted. license_tier: ORIGINAL
dependencies 1 imports · 2 importers
imports: nx_rebac.nx
imported by: nx_authz_svc_daemon.nxnx_authz_svc_gate.nx
structs
| none |
consts
| 11 | const K_MAGIC_2048: i64 = 2048 |
| 12 | const K_MAGIC_8192: i64 = 8192 |
| 13 | const K_MAGIC_65536: i64 = 65536 |
functions
| 15 | func az_p(s: *u8) -> i64 { sys_write(1, s, rb_slen(s)); return 0 } |
| 16 | func az_pn(v: i64) -> i64 { rb_pn(v); return 0 } |
| 18 | func az_has(buf: *u8, n: i64, needle: *u8) -> i64 called by 1: az_selftest |
| 30 | func az_hexv(c: i64) -> i64 called by 1: az_param |
| 36 | func az_param(buf: *u8, blen: i64, key: *u8, out: *u8, cap: i64) -> i64 |
| 68 | func az_emit(out: *u8, status: *u8, body: *u8) -> i64 |
| 79 | func az_target(req: *u8, reqlen: i64, path: *u8, pcap: i64, qbuf: *u8, qcap: i64) -> i64 called by 1: az_handle |
| 94 | func az_body(req: *u8, reqlen: i64, szbox: *i64) -> *u8 called by 1: az_handle |
| 105 | func az_json_arr(out: *u8, off: i64, arr: *i64, n: i64) -> i64 |
| 118 | func az_handle(prefix: *u8, req: *u8, reqlen: i64, out: *u8, cap: i64) -> i64 |
| 174 | func az_read_req(fd: i64, buf: *u8, cap: i64) -> i64 calls 1: sys_read |
| 203 | func az_write_all(fd: i64, buf: *u8, n: i64) -> i64 { var w: i64 = 0; while w < n { let k: i64 = sys_write(fd, (buf as i64 + w) as *u8, n - w); if k <= 0 { return 0 - 1 } w = w + k } return 0 } |
| 206 | func az_ck(label: *u8, got: i64, want: i64, okp: *i64) -> i64 |
| 211 | func az_selftest() -> i64 |