code wiki / _hdl_build / nx_site_auth.nx

nx_site_auth.nx

buildroot/runtime/_hdl_build/nx_site_auth.nx

7659 B156 linesdepth 15pulls 45 transitivereach 24 importersview sourcekind librarytopic site

docs dependencies structs consts functions

about

nx_site_auth.nx -- THE ONE access gate every Nishi site composes (build-once; no per-site auth). module: nishi-core.hub.site_auth capability: CORE_COMPUTE (the unified per-request access wall for ALL sites) Operator (2026-06-16): "lets have that be how all the sites work" -- the canonical Modern Auth (NISHI_MODERN_AUTH_CHARTER: OPAQUE-3DH + Argon2id KSF + BIP39 recovery + NO-COOKIE Ed25519 session) is the SINGLE access method ecosystem-wide. This is the realm-agnostic hot path: extract the X-Nishi-Session token (base64 152B, NEVER a cookie -- C1 cardinal), validate it against the route's NxAuthContext via nx_modern_auth_validate_session. Returns NX_MAUTH_OK to ALLOW, a negative NX_MAUTH_* code to DENY (NO_SESSION / INVALID_SESSION / EXPIRED / REALM_MISMATCH). Every site daemon (wiki admin, /status, andelinwest CMS, future sites) calls THIS for every protected request -- one gate, one auth. Composes (no duplicate primitives): nx_modern_auth_flow + nx_http_header_find + nx_base64. license_tier: ORIGINAL

dependencies 4 imports · 5 importers

imports: nx_syscalls.nxnx_http_header_find.nxnx_base64.nxnx_modern_auth_flow.nx

imported by: nx_authz_session_gate.nxnx_media_server.nxnx_site_auth_gate.nxnx_sitegen_studio_daemon.nxnx_status_daemon.nx

structs

none

consts

none

functions

24	func nx_sa_validate(ctx: NxAuthContext, req: u8, headers_end: i64, now_s: i64) -> i64 called by 5: ma_authed main sed_handle stu_handle sd_handle calls 4: sys_mmap nx_http_header_find b64_decode nx_modern_auth_validate_session
44	func nx_sa_validate_handle(ctx: NxAuthContext, req: u8, headers_end: i64, now_s: i64, handle_out: u8, handle_cap: i64, handle_n: i64) -> i64 called by 6: sg_decide main dad_handle epd_handle ms_handle ma_level_of calls 4: sys_mmap nx_http_header_find b64_decode nx_modern_auth_validate_session
67	func sa_hexval(c: i64) -> i64 called by 1: nx_sa_pct_decode
76	func nx_sa_pct_decode(src: u8, n: i64, out: u8, cap: i64) -> i64 called by 2: main nx_sa_validate_qs calls 1: sa_hexval
103	func nx_sa_tok_urlenc(src: u8, n: i64, out: u8, start: i64) -> i64 called by 5: dad_landing main epd_landing_mail main sed_landing
119	func nx_sa_qs_raw(path: u8, pn: i64, voff: i64) -> i64 called by 5: dad_handle epd_handle main nx_sa_validate_qs sed_handle
143	func nx_sa_validate_qs(ctx: NxAuthContext, path: u8, pn: i64, now_s: i64, handle_out: u8, handle_cap: i64, handle_n: i64) -> i64 called by 4: dad_handle epd_qs_mailbox main sed_handle calls 5: sys_mmap nx_sa_qs_raw nx_sa_pct_decode b64_decode nx_modern_auth_validate_session