nx_mtls_serve_decision.nx
buildroot/runtime/nx_mtls_serve_decision.nx
about
nx_mtls_serve_decision.nx -- R7 ENFORCEMENT: turn an mTLS handshake result into a doc-serving decision.
This is the glue the doc-serving wall (wiki_gw / the OPAQUE wall that today bounces a top-level nav to login)
calls AFTER the mTLS run loop returns. The run loop hands back out_auth {1=verified, 0=no-cert, -1=verify-failed}
+ the presented client cert; this rung composes R6 (nx_mtls_cert_identity + nx_mtls_authz_level, deny-by-default)
into exactly one of four decisions. Building + gating it HERE means the live daemon wiring is a trivial call to
proven logic, not ad-hoc branching -- and the never-lockout / request-not-require property is baked in + tested:
out_auth == -1 -> REJECT a cert was presented but FAILED to prove key-possession. NOT a fallback --
silently falling back would be a downgrade. 403/close.
out_auth == 0 -> FALLBACK NO cert presented. Serve via the EXISTING header-token path exactly as today
(a browser with no cert still works -> never-lockout, request-not-require).
out_auth == 1 -> (identity) a VERIFIED cert. Extract the Subject CN identity:
REJECT verified key but no extractable identity (malformed) -> close.
FORBIDDEN verified identity but NOT enrolled in the roster -> 403 (deny-by-default).
BY_IDENTITY verified + enrolled -> serve; out_uidhex + out_level set.
The roster (uidhex -> level) is the live HR/uid index the daemon supplies (olgd_idx_lookup + HR level), same as
R6. This rung is the DECISION; that is the DATA. Composes nx_mtls_authz (R6). license_tier: ORIGINAL expect_exit: 0
dependencies 2 imports · 1 importers
imports: nx_syscalls.nxnx_mtls_authz.nx
imported by: nx_hgw_mtls_resolve.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 22 | const NX_MAGIC_4096: i64 = 4096 |
| 24 | const NX_SERVE_REJECT: i64 = 0 // cert presented but verify-failed (out_auth<0) OR verified-but-no-identity |
| 25 | const NX_SERVE_FALLBACK: i64 = 1 // no cert (out_auth==0) -> existing header-token path; never-lockout |
| 26 | const NX_SERVE_FORBIDDEN: i64 = 2 // verified identity but unenrolled -> 403 (deny-by-default) |
| 27 | const NX_SERVE_BY_IDENTITY: i64 = 3 // verified + enrolled -> serve; out_uidhex + out_level set |
functions
| 31 | func nx_mtls_serve_decide( |
| 50 | func sd_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 51 | func sd_row(name: *u8, ok: i64) -> i64 { if ok == 1 { sd_w(" PASS " as *u8) } else { sd_w(" FAIL " as *u8) } sd_w(name); sd_w("\n" as *u8); return ok } |
| 53 | func main() -> i64 |