code wiki / _hdl_build / nx_torrent_authn.nx

nx_torrent_authn.nx

buildroot/runtime/_hdl_build/nx_torrent_authn.nx

6137 B91 linesdepth 16pulls 46 transitivereach 3 importersview sourcekind librarytopic torrent
docsdependenciesstructsconstsfunctions

about

nx_torrent_authn.nx -- R3: resolve a request's VIEWER LEVEL from its OPAQUE session, DENY-BY-DEFAULT. The torrent daemon's d_viewer_level was a stub returning OWNER (it was the operator's LOCAL single-user daemon). This wires the REAL auth so it can serve family-vs-operator on the hub: extract the session token (X-Nishi-Session header, else the ngs cookie -- media tags can't send headers) -> olg_whoami (validate the Ed25519-signed token against the realm's keys) -> handle -> ag_resolve_level over the roles registry (handle<TAB>level) -> level. ANY failure -- no token, tampered/expired token, or a handle absent from the roles registry -- returns 0 (ANON), so nx_taccess_allow then denies every gated area. Mirrors the proven gallery-gateway pattern (header-then-cookie -> olg_whoami). The realm keys/store + the roles registry are PATHS the daemon supplies (operator-provisioned -- accounts + role assignments never come from Claude). license_tier: ORIGINAL

dependencies 3 imports · 2 importers

nx_opaque_login.nx nx_hr.nx nx_syscalls.nx nx_torrent_authn.nx nx_torrent_authn_gate.nx nx_torrent_gateway.nx

imports: nx_opaque_login.nxnx_hr.nxnx_syscalls.nx

imported by: nx_torrent_authn_gate.nxnx_torrent_gateway.nx

structs

none

consts

14const K_MAGIC_1024: i64 = 1024
15const K_MAGIC_65536: i64 = 65536

functions

18func tau_find(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64
called by 4: tau_hdr_valtau_cookie_valtg_path_publicmain
30func tau_hdr_val(req: *u8, n: i64, name: *u8, nl: i64, out: *u8, cap: i64) -> i64
called by 2: tau_tokenmain calls 1: tau_find
48func tau_token(req: *u8, n: i64, out: *u8, cap: i64) -> i64
called by 1: tau_level calls 2: tau_hdr_valtau_cookie_val
55func tau_hex(inp: *u8, n: i64, out: *u8) -> i64
called by 1: tau_level
65func tau_cred_id(realm: *u8, realm_n: i64, handle: *u8, hn: i64, out_hex: *u8) -> i64 { return hr_cred_id(realm, realm_n, handle, hn, out_hex) }
calls 1: hr_cred_id
67func tau_read(path: *u8, buf: *u8, cap: i64) -> i64
calls 3: sys_openat_rdsys_readsys_close
74func tau_level(req: *u8, n: i64, keys_path: *u8, store_path: *u8, hr_store: *u8, realm: *u8, realm_n: i64, now_s: i64) -> i64
called by 2: tau_level_nowmain calls 6: sys_mmaptau_tokenolg_ctx_setupolg_whoamitau_hexhr_resolve_level
88func tau_level_now(req: *u8, n: i64, keys_path: *u8, store_path: *u8, hr_store: *u8, realm: *u8, realm_n: i64) -> i64
called by 1: main calls 3: sys_mmapsys_clock_gettime_realtau_level