code wiki / hub / nx_modern_auth_flow.nx

nx_modern_auth_flow.nx

buildroot/runtime/hub/nx_modern_auth_flow.nx

31636 B660 linesdepth 14pulls 42 transitivereach 84 importersview sourcekind library
docsdependenciesstructsconstsfunctions

about

nx_modern_auth_flow.nx -- V-MODAUTH-6: SEALED §8 cross-context API. REPLACES hub/nx_admin_login_flow (V1 cookie+session module). Per NISHI_MODERN_AUTH_CHARTER §1 cardinals C1-C12 + §8 API contract: one hub primitive serves every auth context (admin / staff / clients / API tokens / inter-substrate / future Nishi-IDE) via NxAuthContext config struct. SEALED 5-FUNCTION API (NEVER changes between contexts; per Cardinal 19 API stability): nx_modern_auth_register user creates account; receives recovery mnemonic nx_modern_auth_login user authenticates; receives short-lived session token nx_modern_auth_validate_session per-request session validation (the hot path; called every protected request) nx_modern_auth_refresh_session bump TTL without passphrase re-prompt nx_modern_auth_recover forgot-passphrase via BIP39 mnemonic; sets new passphrase + issues new mnemonic V2 IMPLEMENTATION STATUS (2026-06-10, OPAQUE shipped): ✓ NxAuthContext + nx_auth_context_init IMPLEMENTED ✓ nx_modern_auth_validate_session IMPLEMENTED (composes M5) ✓ nx_modern_auth_refresh_session IMPLEMENTED (composes M5) ✓ nx_modern_auth_register IMPLEMENTED (V-MODAUTH-2 OPAQUE + V-MODAUTH-4 account store; RFC 9807 KAT-gated). Issues a 24-word BIP39 mnemonic when ctx.allow_recovery=1 (M3). ✓ nx_modern_auth_login IMPLEMENTED (OPAQUE-3DH full flow in-process + M5 mint) ✓ nx_modern_auth_recover IMPLEMENTED (V-MODAUTH-3: the mnemonic entropy is a SECOND OPAQUE credential under handle||"|rec"; recover verifies it, sets the new passphrase, and ROTATES the mnemonic). The sealed

dependencies 5 imports · 32 importers

nx_syscalls.nx nx_no_cookie_session.nx nx_opaque_pake.nx nx_user_account_store.nx nx_bip39.nx nx_modern_auth_flow.nx nx_authz_session_gate.nx nx_browser_forms_e2e_gate.nx nx_docportal_admin_daemon.nx nx_docportal_admin_daemon_gate.nx nx_docportal_multipart_gate.nx nx_email_portal_daemon.nx nx_email_portal_gate.nx nx_media_e2e_gate.nx nx_media_server.nx nx_mgmt_api_gate.nx

diagram shows first 10 each side; +0 more imports, +22 more importers in the complete lists below.

imports: nx_syscalls.nxnx_no_cookie_session.nxnx_opaque_pake.nxnx_user_account_store.nxnx_bip39.nx

imported by: nx_authz_session_gate.nxnx_browser_forms_e2e_gate.nxnx_docportal_admin_daemon.nxnx_docportal_admin_daemon_gate.nxnx_docportal_multipart_gate.nxnx_email_portal_daemon.nxnx_email_portal_gate.nxnx_media_e2e_gate.nxnx_media_server.nxnx_mgmt_api_gate.nxnx_modauth_arm.nxnx_modauth_arm_vault.nxnx_modauth_e2e_gate.nxnx_modauth_probe.nxnx_nojs_session_gate.nxnx_opaque_login.nxnx_realm_isolation_gate.nxnx_site_auth.nxnx_site_auth_gate.nxnx_siteedit_daemon.nxnx_siteedit_gate.nxnx_sitegen_studio_daemon.nxnx_social_auth_recover.nxnx_social_auth_recover_gate.nxnx_status_daemon.nxnx_status_daemon_gate.nxnx_studio_daemon_gate.nxnx_wiki_admin_wiring.nxnx_wiki_https_daemon_mv.nxnx_wiki_page_save.nxnx_wiki_version.nxnx_wiki_vhost_table.nx

structs

111struct NxAuthContext

consts

76const NX_MAUTH_OK: i64 = 0
77const NX_MAUTH_BAD_INPUT: i64 = 1400
78const NX_MAUTH_BAD_CONTEXT: i64 = 1401
79const NX_MAUTH_NO_SESSION: i64 = 1402 // no token header in request
80const NX_MAUTH_INVALID_SESSION: i64 = 1403 // signature failed
81const NX_MAUTH_EXPIRED: i64 = 1404
82const NX_MAUTH_REALM_MISMATCH: i64 = 1405
83const NX_MAUTH_BUF_OVERFLOW: i64 = 1406
84const NX_MAUTH_NOT_IMPLEMENTED: i64 = 1407 // M2/M3/M4 prereq missing
85const NX_MAUTH_RATE_LIMITED: i64 = 1408
86const NX_MAUTH_USER_NOT_FOUND: i64 = 1409
87const NX_MAUTH_WRONG_PASSPHRASE: i64 = 1410
88const NX_MAUTH_RECOVERY_MISMATCH: i64 = 1411
91const NX_MAUTH_MAX_REALM_LEN: i64 = 128
92const NX_MAUTH_MAX_USER_HANDLE_LEN: i64 = 64
93const NX_MAUTH_MAX_PASSPHRASE_LEN: i64 = 256
94const NX_MAUTH_MAX_MNEMONIC_LEN: i64 = 512 // 24 BIP39 words * ~10 chars
95const NX_MAUTH_DEFAULT_SESSION_TTL_S: i64 = 900 // 15 min per charter §7
96const NX_MAUTH_HARD_MAX_TTL_S: i64 = 86400 // 24h hard cap
97const NX_MAUTH_DEFAULT_ARGON2ID_M_COST: i64 = 65536 // 64 MiB per OWASP 2026
98const NX_MAUTH_DEFAULT_ARGON2ID_T_COST: i64 = 3
99const NX_MAUTH_DEFAULT_ARGON2ID_P_COST: i64 = 4
100const NX_MAUTH_DEFAULT_RATE_LIMIT_PER_MIN: i64 = 5
102const NX_MAUTH_ED25519_PRIV_BYTES: i64 = 32
103const NX_MAUTH_ED25519_PUB_BYTES: i64 = 32
104const NX_MAUTH_SESSION_TOKEN_BYTES: i64 = 152 // matches M5 NX_NCS_TOKEN_BYTES
188const NX_MAUTH_OPAQUE_CONTEXT_LEN: i64 = 11
264const NX_MAUTH_REC_SUFFIX_LEN: i64 = 4

functions

140func nx_auth_context_init(
called by 30: mainmainmainmainmainmain+24
189func _ma_load_context(out: *u8) -> i64
called by 1: _ma_mk_cfgs
197func _ma_store_path(ctx: *NxAuthContext) -> *u8
called by 2: _ma_register_credential_ma_verify_credential
202func _ma_server_ake_keys(ctx: *NxAuthContext, out_priv_32: *u8, out_pub_33: *u8) -> i64
called by 2: _ma_register_credential_ma_verify_credential calls 2: sys_mmapnx_opq_derive_keypair
214func _ma_cred_id(user_id_hash_32: *u8, out_64: *u8) -> i64
called by 2: _ma_register_credential_ma_verify_credential
230func _ma_mk_cfgs(
called by 2: _ma_register_credential_ma_verify_credential calls 1: _ma_load_context
265func _ma_rec_handle(user_handle: *u8, user_handle_n: i64, out: *u8) -> i64
called by 2: _ma_issue_recoverynx_modern_auth_recover
278func _ma_register_credential(
called by 3: _ma_issue_recoverynx_modern_auth_registernx_modern_auth_recover calls 11: sys_mmapnx_ncs_derive_user_id_hash_ma_cred_id_ma_server_ake_keys_ma_mk_cfgsnx_opaque_create_registration_request+5
325func _ma_verify_credential(
called by 2: nx_modern_auth_loginnx_modern_auth_recover calls 11: nx_ncs_derive_user_id_hashsys_mmapnx_uas_lookup_ma_store_path_ma_server_ake_keys_ma_mk_cfgs+5
383func _ma_issue_recovery(
called by 2: nx_modern_auth_registernx_modern_auth_recover calls 4: sys_mmap_ma_rec_handlenx_bip39_generate_24_ma_register_credential
417func nx_modern_auth_register(
called by 20: mainmainmainmainmainmain+14 calls 2: _ma_register_credential_ma_issue_recovery
459func nx_modern_auth_login(
called by 21: mainmainmaindad_handlemainmain+15 calls 5: sys_mmap_ma_verify_credentialnx_ncs_derive_realm_id_hashsys_now_realtime_secnx_ncs_mint_token
519func nx_modern_auth_validate_session(
called by 12: mainmainmainolg_whoamiri_validatenx_sa_validate+6 calls 3: sys_mmapnx_ncs_derive_realm_id_hashnx_ncs_validate_token
570func nx_modern_auth_refresh_session(
called by 2: olg_refresh_waw_handle_refresh_post calls 1: nx_ncs_refresh_token
608func nx_modern_auth_recover(
called by 4: mainolg_recovernx_sar_recover_waw_handle_recover_post calls 6: sys_mmapnx_bip39_decode_ma_rec_handle_ma_verify_credential_ma_register_credential_ma_issue_recovery