code wiki / _hdl_build / nx_docportal_admin_daemon.nx

nx_docportal_admin_daemon.nx

buildroot/runtime/_hdl_build/nx_docportal_admin_daemon.nx

47765 B742 linesdepth 17pulls 74 transitivereach 4 importersview sourcekind servicetopic docportal
docsdependenciesstructsconstsfunctions

about

nx_docportal_admin_daemon.nx -- the admin.<domain> DOCUMENT-PORTAL daemon, on the CANONICAL ecosystem auth (the SAME Modern Auth nishifamily.com/status uses: OPAQUE-3DH + Argon2id + NO-COOKIE Ed25519 session). Operator 2026-06-28: "match it to what we have in the nishi ecosystem and team." So this does NOT invent a token scheme -- it COMPOSES nx_status_daemon's proven auth (sd_* request parsing + nx_modern_auth_login + nx_sa_validate) and wraps the proven nx_docportal_admin_lib router da_handle: GET /admin -> the no-cookie login + upload SPA shell (public) POST /admin/login -> handle+passphrase -> nx_modern_auth_login -> 200 {"token":...} | 401 * /admin/* (token) -> X-Nishi-Session validates (nx_sa_validate) ? da_handle at STAFF level : 401 A loopback HTTP daemon the sites daemon reverse-proxies to (behind the SNI router admin.<d> row); the public TLS + cert are the operator-gated deploy step. Pure router dad_handle = bytes-in/bytes-out (the gate drives it in-process, no socket). license_tier: ORIGINAL

dependencies 9 imports · 4 importers

nx_docportal_admin_lib.nx nx_status_daemon.nx nx_modern_auth_flow.nx nx_syscalls.nx nx_invite_token.nx nx_opaque_login.nx nx_docportal_search_serve.nx nx_tool_registry.nx nx_multipart.nx nx_docportal_admin_daemon.nx nx_browser_forms_e2e_gate.nx nx_docportal_admin_daemon_gate.nx nx_docportal_multipart_gate.nx nx_nojs_session_gate.nx

imports: nx_docportal_admin_lib.nxnx_status_daemon.nxnx_modern_auth_flow.nxnx_syscalls.nxnx_invite_token.nxnx_opaque_login.nxnx_docportal_search_serve.nxnx_tool_registry.nxnx_multipart.nx

imported by: nx_browser_forms_e2e_gate.nxnx_docportal_admin_daemon_gate.nxnx_docportal_multipart_gate.nxnx_nojs_session_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_write sd_atoi sd_len sys_mmap nx_uas_server_keys_load_or sys_mmap ↻ sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close _uas_hex_dec _uas_nib nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd ↻ sys_read ↻ sys_close ↻ nx_opq_derive_keypair sys_mmap ↻ _voprf_load_context_string u256_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write ↻ sys_exit sys_mmap ↻ nx_opq_hash_to_scalar sys_mmap ↻ nx_h2c_expand_message_xmd_ sys_mmap ↻ _h2c_i2osp_1 _h2c_i2osp_2 u256_alloc ↻ _opq_reduce_48be_mod_n

structs

none

consts

25const DAD_ACCEPT_BACKOFF_MS: i64 = 50
29const DAD_REFRESH_MIN_SEC: i64 = 10
30const DAD_REQCAP: i64 = 65536
31const DAD_OUTCAP: i64 = 524288
304const DAD_MAXPARTS: i64 = 16

functions

35func dad_shell(out: *u8) -> i64
called by 1: dad_handle calls 3: sys_mmapsd_catsd_catn
67func dad_invite_path(ctx: *NxAuthContext, out: *u8) -> i64
called by 2: dad_handlemain
85func dad_landing(out: *u8, b64: *u8, b64n: i64) -> i64
called by 1: dad_handle calls 4: sys_mmapsd_catnx_sa_tok_urlencsd_catn
106func dad_hex32(src: *u8, out: *u8) -> i64
called by 1: dad_handle
113func dad_uidmap_path(ctx: *NxAuthContext, out: *u8) -> i64
called by 1: dad_handle
123func dad_map_put(path: *u8, hexuid: *u8, h: *u8, hn: i64) -> i64
called by 1: dad_handle calls 5: sys_mmapsd_catsys_openat_appendsys_writesys_close
138func dad_map_get(path: *u8, hexuid: *u8, out: *u8, cap: i64) -> i64
called by 1: dad_handle calls 3: sys_mmapsys_read_filesys_munmap
173func dad_ui_page(out: *u8, handle: *u8, hn: i64, sraw: *u8, sn: i64) -> i64
called by 1: dad_handle calls 3: sys_mmapsd_catsd_catn
200func dad_uploadtext(ctx: *NxAuthContext, req: *u8, req_n: i64, subject: *u8, out: *u8) -> i64
called by 1: dad_handle calls 6: sd_body_offsys_mmapsd_form_fieldsd_urldecodesd_catda_handle
259func dad_ct_boundary(req: *u8, req_n: i64, out: *u8) -> i64
called by 1: dad_uploadfile calls 2: sys_mmapnx_http_header_find
284func dad_cd_extract(body: *u8, hoff: i64, hlen: i64, key: *u8, out: *u8) -> i64
called by 1: dad_uploadfile
308func dad_uploadfile(ctx: *NxAuthContext, req: *u8, req_n: i64, subject: *u8, out: *u8) -> i64
called by 1: dad_handle calls 8: sys_mmapdad_ct_boundarysd_catsd_body_offmultipart_parsedad_cd_extract+2
363func dad_handle(ctx: *NxAuthContext, req: *u8, req_n: i64, out: *u8) -> i64
called by 5: mainmainmainmainmain calls 36: sys_mmapsd_find_pathsd_startsdsv_hostdss_servedsv_doc_serve+30
620func main(argc: i64, argv: *i64) -> i64
calls 21: sys_writesd_atoisd_lensys_mmapnx_uas_server_keys_load_or_initnx_auth_context_init+15