nx_crm_acl.nx
buildroot/runtime/nx_crm_acl.nx
about
nx_crm_acl.nx -- USERS + ROLES + RECORD PERMISSIONS (CRM census E7). The Salesforce-verified layered model,
sovereign + integer-deterministic + DENY-BY-DEFAULT:
1. TENANT WALL first: cross-workspace access is ALWAYS denied -- even for admins (the andelinwest isolation law).
2. OWNER: full access to own records.
3. ADMIN (role 4): full access within the tenant.
4. ORG-WIDE DEFAULT per record: private(0) | read(1) | write(2).
5. ROLE HIERARCHY: the management chain ABOVE the owner gets READ on private records (v1 conservative;
Salesforce grants owner-like via hierarchy -- we start read-only, stated).
6. EXPLICIT SHARES: (record, user, level) grants, level >= action required.
7. FIELD-LEVEL SECURITY: sensitive fields (e.g. giving amounts) need a minimum role.
Pure logic + selftest gate (argless): a 14-check allow/deny matrix incl. the tenant-beats-admin proof.
Persistence rides the relate store next. license_tier: ORIGINAL expect_exit: 0
dependencies 1 imports · 0 importers
imports: nx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 15 | func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: p |
| 16 | func p(s: *u8) -> i64 { sys_write(1, s, slen(s)); return 0 } |
| 17 | func pn(v: i64) -> i64 |
| 23 | func seq(a: *u8, b: *u8) -> i64 |
| 33 | func ac_ufind(un: *i64, n: i64, name: *u8) -> i64 |
| 39 | func ac_above(un: *i64, um: *i64, n: i64, owner: *u8, user: *u8) -> i64 |
| 54 | func ac_can(ctx: *i64, user: *u8, action: i64, rec: *i64) -> i64 |
| 86 | func ac_field(ctx: *i64, user: *u8, minrole: i64) -> i64 |
| 94 | func ac_check(label: *u8, got: i64, want: i64) -> i64 |
| 102 | func main() -> i64 |