code wiki / _hdl_build / nx_mgmt_authz.nx
nx_mgmt_authz.nx
buildroot/runtime/_hdl_build/nx_mgmt_authz.nx
about
nx_mgmt_authz.nx -- the AUTHORIZATION tier of the management plane (closes the documented privilege-escalation:
today ma_authed (nx_mgmt_api.nx:248) = nx_sa_validate ONLY, so ANY valid session -- including a plain library
reader, because the deployed daemon reuses the shared library auth store -- can call /api/deploy|rollback|
reconcile|restart|migrate|update). This adds least-privilege: PUBLIC routes need nothing, READ routes need any
valid session, PRIVILEGED (mutating) routes need a valid session AND an admin handle. PURE logic (mz_*, imports
only nx_syscalls) -> isolation-gateable; it slots into ma_handle in place of the bare ma_authed check (the
deploy-coupled wiring step). Mirrors the hexagonal CORE pattern of nx_mgmt_core. license_tier: ORIGINAL
dependencies 1 imports · 1 importers
imports: nx_syscalls.nx
imported by: nx_mgmt_authz_gate.nx
structs
| none |
consts
| 11 | const MZ_PUBLIC: i64 = 0 // no auth: GET /api, GET /api/login |
| 12 | const MZ_READ: i64 = 1 // any valid session: /api/health, /api/services |
| 13 | const MZ_PRIV: i64 = 2 // valid session AND admin: /api/{deploy,rollback,reconcile,restart,migrate,update} |
functions
| 15 | func mz_starts(path: *u8, pn: i64, s: *u8) -> i64 called by 1: mz_route_class |
| 26 | func mz_route_class(path: *u8, pn: i64) -> i64 |
| 40 | func mz_status(cls: i64, valid: i64, is_admin: i64) -> i64 |
| 49 | func mz_allowed(cls: i64, valid: i64, is_admin: i64) -> i64 { if mz_status(cls, valid, is_admin) == 200 { return 1 } return 0 } calls 1: mz_status |
| 51 | func mz_slice_eq(a: *u8, ao: i64, al: i64, b: *u8, bo: i64, bl: i64) -> i64 called by 1: mz_is_admin_in |
| 60 | func mz_is_admin_in(buf: *u8, n: i64, hbuf: *u8, hoff: i64, hlen: i64) -> i64 |