code wiki / _hdl_build / nx_docportal_authz_route_gate.nx

nx_docportal_authz_route_gate.nx

buildroot/runtime/_hdl_build/nx_docportal_authz_route_gate.nx

9050 B155 linesdepth 10pulls 17 transitivereach 0 importersview sourcekind gate/prooftopic docportal
docsdependenciesstructsconstsfunctions

about

nx_docportal_authz_route_gate.nx -- MEASURED end-to-end proof that the P2 wiring fired at the REAL da_handle routes: it drives the pure router with per-session DaCtx (carrying the subject the daemon sets from nx_sa_validate_handle) and inspects the sovereign store + the route responses. Fresh nonce domain per run. T1 session A POST /admin/upload visibility=private -> 200 UPLOADED, and own:<cid> == A (ownership recorded). T2 session A GET /admin/doc?cid= -> 200 + the DECRYPTED plaintext (owner reads through authz + at-rest decrypt). T3 session B GET /admin/doc?cid= (same doc) -> 403 Forbidden (non-owner eyes-only DENY). T4 session A POST /admin/upload visibility=public -> 200 UPLOADED + stored PLAINTEXT (public path unchanged). Print pass=4 + GREEN/RED, append knowledge/status/dp_authz_route_gate.log. STANDALONE -- no socket/daemon/deploy. (nx_chacha20_poly1305_decrypt prints one 'A' to STDERR on first decrypt -- shipped-AEAD marker; harmless.) license_tier: ORIGINAL

dependencies 4 imports · 0 importers

nx_docportal_admin_lib.nx nx_doc_authz.nx nx_doc_at_rest.nx nx_docportal_lib.nx nx_docportal_authz_route_gate.

imports: nx_docportal_admin_lib.nxnx_doc_authz.nxnx_doc_at_rest.nxnx_docportal_lib.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main g_puts sys_now_realtime_sec sys_mmap sys_clock_gettime_real g_cat g_catnum g_slen dp_cid fnv1a_init fnv1a_update da_handle da_pathlen da_prefix da_slen da_text_response da_cat da_numc da_is_post da_eq da_slen ↻ da_query_str da_slen ↻ da_slen ↻ da_body_start da_parse_flags da_query_str ↻ sys_munmap dp_default_policy at_rest_confidential dp_cid ↻ doc_put dp_prefix dp_cat dp_key dp_cat ↻ dp_catn sys_mmap ↻ at_rest_confidential ↻ dek_ensure

structs

none

consts

none

functions

16func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 1: main
17func g_num(v: i64) -> i64
called by 1: main
23func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
called by 1: main
24func g_wn(fd: i64, v: i64) -> i64
called by 1: main
30func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 3: g_startsg_containsmain
31func g_cat(out: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 } return o }
called by 1: main
32func g_catnum(out: *u8, o: i64, v: i64) -> i64
called by 1: main
38func g_eqbytes(a: *u8, b: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
called by 1: main
39func g_starts(buf: *u8, n: i64, s: *u8) -> i64 { let sn: i64 = g_slen(s); if n < sn { return 0 } var i: i64 = 0; while i < sn { if buf[i] != s[i] { return 0 } i = i + 1 } return 1 }
called by 1: main calls 1: g_slen
40func g_contains(hay: *u8, hn: i64, ndl: *u8) -> i64
called by 1: main calls 1: g_slen
53func main() -> i64
calls 20: g_putssys_now_realtime_secg_catg_catnumg_slendp_cid+14