code wiki / _hdl_build / nx_hr_entitle.nx

nx_hr_entitle.nx

buildroot/runtime/_hdl_build/nx_hr_entitle.nx

10073 B163 linesdepth 12pulls 23 transitivereach 9 importersview sourcekind librarytopic hr
docsdependenciesstructsconstsfunctions

about

nx_hr_entitle.nx -- SUPERUSER-BY-CONSTRUCTION entitlement resolution, now on the SOVEREIGN store (operator NO-TSV doctrine [[feedback-no-3rd-party-tsv-sovereign-store]]). Entitlements no longer live in a flat .tsv -- each is a CANON record (key,label,url) in a content-addressed nx_seg_store, enumerated via a count+index ("ent:count" + "ent:<i>"), the proven nx_native_config pattern. Semantics unchanged: * an ACTIVE SUPERADMIN (HR owner, lvl 3) is entitled to EVERY entitlement -- auto-access, zero drift; and * everyone else gets the public ("*") entitlements + the ones keyed to their own handle (deny-by-default). Superadmin status comes from the HR SSOT (hra_is_superadmin, now seg_store-backed). Pure resolver. entitlement record fields: key (a handle, or "*" for everyone), label, url

dependencies 7 imports · 8 importers

nx_hr_admin.nx nx_hr.nx nx_seg_store.nx nx_canon_cid.nx nx_uxf_decode.nx nx_sha256.nx nx_syscalls.nx nx_hr_entitle.nx nx_account_admin_exceed_gate.nx nx_gen_authz_gate.nx nx_gen_gateway.nx nx_gen_gateway_gate.nx nx_gen_live_probe.nx nx_hr_entitle_gate.nx nx_hr_entitle_provision.nx nx_opaque_login_daemon.nx

imports: nx_hr_admin.nxnx_hr.nxnx_seg_store.nxnx_canon_cid.nxnx_uxf_decode.nxnx_sha256.nxnx_syscalls.nx

imported by: nx_account_admin_exceed_gate.nxnx_gen_authz_gate.nxnx_gen_gateway.nxnx_gen_gateway_gate.nxnx_gen_live_probe.nxnx_hr_entitle_gate.nxnx_hr_entitle_provision.nxnx_opaque_login_daemon.nx

structs

none

consts

16const K_MAGIC_1024: i64 = 1024
17const K_MAGIC_4096: i64 = 4096

functions

19func he_memeq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
called by 1: he_include_key
20func he_catb(dst: *u8, off: i64, src: *u8, n: i64) -> i64 { var o: i64=off; var i: i64=0; while i<n { dst[o]=src[i]; o=o+1; i=i+1 } return o }
called by 1: he_emit_super
21func he_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 1: he_include_key
22func he_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while 1==1 { let ca: i64=a[i] as i64; let cb: i64=b[i] as i64; if ca!=cb {return 0} if ca==0 {return 1} i=i+1 } return 1 }
called by 3: he_ent_fieldhe_ent_hashe_has_access
23func he_itoa(v: i64, out: *u8) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{out[i]=t[k-1-i];i=i+1} out[k]=0 as u8; return k }
called by 2: he_idx_keyhe_ent_put calls 1: sys_mmap
24func he_atoi_n(s: *u8, n: i64) -> i64 { var v: i64=0; var i: i64=0; while i<n { let c: i64=s[i] as i64; if c>=48 { if c<=57 { v=v*10+(c-48) } } i=i+1 } return v }
called by 1: he_ent_count
27func he_include_key(super: i64, key: *u8, handle: *u8, hn: i64) -> i64
called by 3: he_count_superhe_has_accesshe_emit_super calls 2: he_slenhe_memeq
35func he_super_of(hr_store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64) -> i64
called by 3: he_count_accesshe_has_access_realmhe_emit_access calls 3: sys_mmaphr_cred_idhra_is_superadmin
42func he_idx_key(i: i64, out: *u8) -> i64 { let p: *u8="ent:" as *u8; var o: i64=0; while p[o]!=(0 as u8){out[o]=p[o];o=o+1} let k: i64=he_itoa(i, (out as i64 + o) as *u8); return o+k }
called by 2: he_ent_puthe_ent_get calls 1: he_itoa
43func he_ent_count(prefix: *u8) -> i64
called by 6: he_ent_puthe_ent_hashe_count_superhe_has_accesshe_emit_supermain calls 4: ss_opensys_mmapss_hgethe_atoi_n
49func he_ent_segid(key: *u8, label: *u8, url: *u8) -> i64
called by 1: he_ent_put calls 2: sys_mmapsha256_digest
59func he_ent_put(prefix: *u8, key: *u8, label: *u8, url: *u8) -> i64
called by 6: mainmainmainmainmainmain calls 10: he_ent_hashe_ent_countsys_mmapcanon_encodehe_idx_keyhe_itoa+4
73func he_ent_get(prefix: *u8, i: i64, ok: *i64, ov: *i64, maxf: i64) -> i64
called by 4: he_ent_hashe_count_superhe_has_accesshe_emit_super calls 5: sys_mmaphe_idx_keyss_openss_hgetcanon_decode
80func he_ent_field(ok: *i64, ov: *i64, nf: i64, name: *u8) -> *u8 { var i: i64=0; while i<nf { if he_streq(ok[i] as *u8, name)==1 { return ov[i] as *u8 } i=i+1 } return 0 as *u8 }
called by 4: he_ent_hashe_count_superhe_has_accesshe_emit_super calls 1: he_streq
82func he_ent_has(prefix: *u8, key: *u8, label: *u8, url: *u8) -> i64
called by 1: he_ent_put calls 5: he_ent_countsys_mmaphe_ent_gethe_ent_fieldhe_streq
99func he_count_super(super: i64, handle: *u8, hn: i64, ent_prefix: *u8) -> i64
called by 2: mainhe_count_access calls 5: he_ent_countsys_mmaphe_ent_gethe_ent_fieldhe_include_key
109func he_count_access(hr_store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, ent_prefix: *u8) -> i64
called by 2: mainmain calls 2: he_count_superhe_super_of
116func he_has_access(super: i64, handle: *u8, hn: i64, ent_prefix: *u8, url: *u8) -> i64
called by 5: maingw_serve_connmainmainhe_has_access_realm calls 6: he_ent_countsys_mmaphe_ent_gethe_ent_fieldhe_include_keyhe_streq
131func he_has_access_realm(hr_store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, ent_prefix: *u8, url: *u8) -> i64
calls 2: he_has_accesshe_super_of
136func he_emit_super(super: i64, handle: *u8, hn: i64, ent_prefix: *u8, out: *u8, cap: i64) -> i64
called by 2: he_emit_accessmain calls 8: hr_putshe_catbhr_putnhe_ent_countsys_mmaphe_ent_get+2
161func he_emit_access(hr_store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, ent_prefix: *u8, out: *u8, cap: i64) -> i64
called by 1: main calls 2: he_emit_superhe_super_of