code wiki / _hdl_build / nx_docportal_admin_daemon.nx

nx_docportal_admin_daemon.nx

buildroot/runtime/_hdl_build/nx_docportal_admin_daemon.nx

72720 B1099 linesdepth 17pulls 85 transitivereach 4 importersview sourcekind servicetopic docportal

docs dependencies structs consts functions

about

nx_docportal_admin_daemon.nx -- the admin.<domain> DOCUMENT-PORTAL daemon, on the CANONICAL ecosystem auth (the SAME Modern Auth nishifamily.com/status uses: OPAQUE-3DH + Argon2id + NO-COOKIE Ed25519 session). Operator 2026-06-28: "match it to what we have in the nishi ecosystem and team." So this does NOT invent a token scheme -- it COMPOSES nx_status_daemon's proven auth (sd_* request parsing + nx_modern_auth_login + nx_sa_validate) and wraps the proven nx_docportal_admin_lib router da_handle: GET /admin -> the no-cookie login + upload SPA shell (public) POST /admin/login -> handle+passphrase -> nx_modern_auth_login -> 200 {"token":...} | 401 * /admin/* (token) -> X-Nishi-Session validates (nx_sa_validate) ? da_handle at STAFF level : 401 A loopback HTTP daemon the sites daemon reverse-proxies to (behind the SNI router admin.<d> row); the public TLS + cert are the operator-gated deploy step. Pure router dad_handle = bytes-in/bytes-out (the gate drives it in-process, no socket). license_tier: ORIGINAL

dependencies 11 imports · 4 importers

diagram shows first 10 each side; +1 more imports, +0 more importers in the complete lists below.

imports: nx_docportal_admin_lib.nxnx_status_daemon.nxnx_modern_auth_flow.nxnx_syscalls.nxnx_invite_token.nxnx_opaque_login.nxnx_proxy_route.nxnx_docportal_search_serve.nxnx_tool_registry.nxnx_multipart.nxnx_sysload.nx

imported by: nx_browser_forms_e2e_gate.nxnx_docportal_admin_daemon_gate.nxnx_docportal_multipart_gate.nxnx_nojs_session_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

27	const DAD_ACCEPT_BACKOFF_MS: i64 = 50
43	const DAD_REFRESH_MIN_SEC: i64 = 300
49	const DAD_REFRESH_MAX_SEC: i64 = 3 * DAD_REFRESH_MIN_SEC
50	const DAD_REQCAP: i64 = 65536
51	const DAD_OUTCAP: i64 = 524288
59	const DAD_CPU_RESERVE: i64 = 2
62	const DAD_MIN_WORKERS: i64 = 1
368	const DAD_MAXPARTS: i64 = 16
433	const DAD_EDGE_READ_TMO_S: i64 = 15 // sites.elf NX_SD2_BACKEND_TIMEOUT_S: the per-read window a route gets when proxy_routes.conf carries no timeout= token
434	const DAD_HB_DIV: i64 = 3 // heartbeats at a third of the window
435	const DAD_HB_POLL_MS: i64 = 200 // how often the writer asks whether the search process has finished
436	const DAD_WNOHANG: i64 = 1 // wait4 flag: poll, never block -- the writer must keep breathing
437	const DAD_MS_PER_S: i64 = 1000
438	const DAD_BODY_MODE: i64 = 420 // 0644: the grandchild's per-request body file

functions

67	func dad_reap_done(wst: *i64) -> i64 called by 1: main calls 1: sys_wait4
90	func dad_worker_cap() -> i64 called by 1: main calls 1: sl_ncpu
99	func dad_shell(out: *u8) -> i64 called by 1: dad_handle calls 3: sys_mmap sd_cat sd_catn
131	func dad_invite_path(ctx: NxAuthContext, out: u8) -> i64 called by 2: dad_handle main
149	func dad_landing(out: u8, b64: u8, b64n: i64) -> i64 called by 1: dad_handle calls 4: sys_mmap sd_cat nx_sa_tok_urlenc sd_catn
170	func dad_hex32(src: u8, out: u8) -> i64 called by 1: dad_handle
177	func dad_uidmap_path(ctx: NxAuthContext, out: u8) -> i64 called by 1: dad_handle
187	func dad_map_put(path: u8, hexuid: u8, h: *u8, hn: i64) -> i64 called by 1: dad_handle calls 5: sys_mmap sd_cat sys_openat_append sys_write sys_close
202	func dad_map_get(path: u8, hexuid: u8, out: *u8, cap: i64) -> i64 called by 1: dad_handle calls 3: sys_mmap sys_read_file sys_munmap
237	func dad_ui_page(out: u8, handle: u8, hn: i64, sraw: *u8, sn: i64) -> i64 called by 1: dad_handle calls 3: sys_mmap sd_cat sd_catn
264	func dad_uploadtext(ctx: NxAuthContext, req: u8, req_n: i64, subject: u8, out: u8) -> i64 called by 1: dad_handle calls 6: sd_body_off sys_mmap sd_form_field sd_urldecode sd_cat da_handle
323	func dad_ct_boundary(req: u8, req_n: i64, out: u8) -> i64 called by 1: dad_uploadfile calls 2: sys_mmap nx_http_header_find
348	func dad_cd_extract(body: u8, hoff: i64, hlen: i64, key: u8, out: *u8) -> i64 called by 1: dad_uploadfile
372	func dad_uploadfile(ctx: NxAuthContext, req: u8, req_n: i64, subject: u8, out: u8) -> i64 called by 1: dad_handle calls 8: sys_mmap dad_ct_boundary sd_cat sd_body_off multipart_parse dad_cd_extract+2
441	func dad_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 3: dad_hb_ms dad_early_ok_tab dad_serve_early
443	func dad_is_search(req: *u8, req_n: i64) -> i64 called by 1: main calls 3: sys_mmap sd_find_path sd_starts
453	func dad_hb_ms(host: *u8) -> i64 called by 1: dad_serve_early calls 4: sys_mmap sys_read_file pr_lookup_tmo dad_slen
480	func dad_early_ok_tab(routes: u8, rn: i64, host: u8) -> i64 called by 2: dad_early_ok main calls 3: sys_mmap pr_lookup_tmo dad_slen
494	func dad_early_ok(req: *u8, req_n: i64) -> i64 called by 1: main calls 4: sys_mmap dsv_host sys_read_file dad_early_ok_tab
504	func dad_serve_early(cfd: i64, req: u8, req_n: i64, out: u8) -> i64 called by 1: main calls 24: sys_mmap dsv_host dsv_now_us dsv_serp_parse dsv_serp_prelude dsv_respond_early+18
559	func dad_handle(ctx: NxAuthContext, req: u8, req_n: i64, out: *u8) -> i64 called by 5: main main main main main calls 36: sys_mmap sd_find_path sd_starts dsv_host dss_serve dsv_doc_serve+30
816	func main(argc: i64, argv: *i64) -> i64 calls 32: sys_write sd_atoi sd_len sys_mmap nx_uas_server_keys_load_or_init nx_auth_context_init+26