nx_iot_hub_serve_realm.nx
buildroot/runtime/nx_iot_hub_serve_realm.nx
about
nx_iot_hub_serve_realm.nx -- rung-4-LIVE: the IoT hub serve, HR-SESSION-GATED per HOUSE (realm).
Closes the killer-feature loop: a viewer opens GET /<house>/ in the Nishi browser with their
no-cookie OPAQUE session (X-Nishi-Session header); the hub resolves their HR level for that house
THROUGH the shared access spine (hac_session_level -> hra_resolve_level, the SAME SSOT torrent/
gallery use) and serves the house-scoped, tier-gated dashboard:
owner (lvl3) -> OWNER dashboard (control + /home/manage)
family (lvl1) -> FAMILY dashboard (control, no manage)
unenrolled / invalid / suspended / wrong-house -> DENIED (no devices, no controls)
Deny-by-default by construction (authentication != authorization). Composes the proven pieces --
nx_iot_hub_tenant (iot_tenant_render/iot_access_from_level) + nx_hr_access (hac_session_level) --
adding only the request glue: realm-from-path + token-from-header. No new auth/crypto. LAN-only,
zero-JS, no cloud at runtime. license_tier: ORIGINAL
dependencies 2 imports · 1 importers
imports: nx_iot_hub_tenant.nxnx_hr_access.nx
imported by: nx_iot_hub_serve_realm_gate.nx
structs
| none |
consts
| none |
functions
| 18 | func iot_realm_from_path(req: *u8, poff: i64, plen: i64, out: *u8) -> i64 called by 1: main |
| 35 | func iot_token_from_req(req: *u8, n: i64, out: *u8) -> i64 called by 1: main |
| 67 | func iot_hub_resolve_tier(ctx: *NxAuthContext, token: *u8, tn: i64, now: i64, hr_store: *u8) -> i64 |
| 72 | func iot_hub_render_for(ctx: *NxAuthContext, token: *u8, tn: i64, now: i64, |