code wiki / _hdl_build / nx_site_auth_gate.nx

nx_site_auth_gate.nx

buildroot/runtime/_hdl_build/nx_site_auth_gate.nx

5828 B115 linesdepth 16pulls 46 transitivereach 0 importersview sourcekind gate/prooftopic site
docsdependenciesstructsconstsfunctions

about

nx_site_auth_gate.nx -- REFEREE for the ONE shared access gate (nx_sa_validate) against the REAL canonical Modern Auth. Security code MUST prove it rejects: a wall that can't deny is no wall. Arms a realm exactly like production (load-or-init server keys -> nx_auth_context_init), provisions an admin (nx_modern_auth_register), logs in for a genuine 152B no-cookie token, base64-encodes it into an X-Nishi-Session header, then drives nx_sa_validate four ways: T1 valid X-Nishi-Session -> ALLOW (NX_MAUTH_OK) T2 NO session header -> DENY (NO_SESSION) <- default-deny T3 tampered token (1 b64 char flipped) -> DENY (INVALID_SESSION) <- Ed25519 sig catches it T4 valid token, clock past TTL -> DENY (EXPIRED) <- session actually expires GREEN iff T1..T4 hold. Sovereign: nx_site_auth + nx_modern_auth_flow + nx_base64 + nx_syscalls. license_tier: ORIGINAL

dependencies 4 imports · 0 importers

nx_site_auth.nx nx_modern_auth_flow.nx nx_base64.nx nx_syscalls.nx nx_site_auth_gate.nx

imports: nx_site_auth.nxnx_modern_auth_flow.nxnx_base64.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main g_w sys_write g_trunc sys_openat_wr sys_close sys_mmap nx_uas_server_keys_load_or sys_mmap ↻ sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close ↻ _uas_hex_dec _uas_nib nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd ↻ sys_read ↻ sys_close ↻ nx_opq_derive_keypair sys_mmap ↻ _voprf_load_context_string u256_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write ↻ sys_exit sys_mmap ↻ nx_opq_hash_to_scalar sys_mmap ↻ nx_h2c_expand_message_xmd_ sys_mmap ↻ _h2c_i2osp_1 _h2c_i2osp_2

structs

none

consts

none

functions

16func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: g_rowmain calls 1: sys_write
17func g_row(name: *u8, ok: i64) -> i64
called by 1: main calls 1: g_w
24func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 }
called by 1: main calls 2: sys_openat_wrsys_close
27func g_build_req(req: *u8, b64: *u8, b64_n: i64, with_session: i64) -> i64
called by 1: main
46func main() -> i64
calls 13: g_wg_truncsys_mmapnx_uas_server_keys_load_or_initsys_exitnx_auth_context_init+7