code wiki / _hdl_build / nx_docportal_admin_daemon_gate.nx
nx_docportal_admin_daemon_gate.nx
buildroot/runtime/_hdl_build/nx_docportal_admin_daemon_gate.nx
about
nx_docportal_admin_daemon_gate.nx -- SOVEREIGN in-process referee for the admin.<domain> document-portal daemon
on the CANONICAL ecosystem Modern Auth (no socket/curl/shell). Arms a realm + registers an admin via the REAL
Modern Auth, then feeds crafted HTTP request BYTES into the pure router dad_handle and asserts the response bytes
AND the real upload side effect in the sovereign store -- proving the document portal is gated by the SAME auth
the rest of the ecosystem uses (not a bespoke scheme):
T1 GET /admin -> 200 + the login/upload SPA shell (public)
T2 POST /admin/login ok -> 200 + {"token":...} (mint a real no-cookie token)
T3 POST /admin/upload +tok -> 200 UPLOADED, the doc is stored, and the owner ai_blog flag took effect
T4 POST /admin/upload NOtok -> 401 (deny-by-default at the daemon, before da_handle)
T5 POST /admin/upload BADtok-> 401 (forged session rejected)
T6 POST /admin/login WRONGpw-> 401
R1 POST /admin/register +invite -> 200 + mnemonic, and the new firm admin can then log in
R2 POST /admin/register garbage-invite -> 403, and the user is NOT registered (login fails)
R3 POST /admin/register replayed (consumed) invite -> 403 (single-use enforced over HTTP)
S1 GET /search?q=... (PUBLIC, no session) -> 200 + the seg_store hit rendered (route matched BEFORE the
/admin chain; Host header -> dp-<host>-pub- shard; case-folded term match through the daemon)
S2 GET /search with an absent-shard Host -> 200 + "0 result(s)" (graceful isolation, never a 500)
S3 GET /doc?cid=<cid> (PUBLIC) -> 200 + the doc text (the SERP click-through, -pub- shard only)
S4 GET /doc with an absent cid -> branded 404 (never a 500)
GREEN iff 20/20 (D001-migrated 2026-09-02 onto nx_gate_verdict; S8..S8c the L2b stream guard, 2026-09-15). Appends knowledge/status/docportal_admin_daemon_gate.log. license_tier: ORIGINAL
dependencies 4 imports · 0 importers
imports: nx_docportal_admin_daemon.nxnx_modern_auth_flow.nxnx_syscalls.nxnx_gate_verdict.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 26 | func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 27 | func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } |
| 28 | func g_lw(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } |
| 29 | func g_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i } called by 1: main |
| 30 | func g_cat_n(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n } called by 1: main |
| 31 | func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 } |
| 32 | func g_starts(buf: *u8, n: i64, s: *u8) -> i64 { let sn: i64 = g_len(s); if n < sn { return 0 } var i: i64 = 0; while i < sn { if (buf[i] as i64) != (s[i] as i64) { return 0 } i = i + 1 } return 1 } |
| 33 | func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 |
| 38 | func g_extract_token(resp: *u8, n: i64, out: *u8) -> i64 called by 1: main |
| 48 | func main() -> i64 |