code wiki / _hdl_build / nx_vault_gateway.nx

nx_vault_gateway.nx

buildroot/runtime/_hdl_build/nx_vault_gateway.nx

30214 B456 linesdepth 16pulls 57 transitivereach 0 importersview sourcekind tooltopic vault
docsdependenciesstructsconstsfunctions

about

nx_vault_gateway.nx -- OPAQUE-gated /vault media browser (M0 product surface) per the family-suite spec. Reuses the gallery opaque realm (argv keys/store) so existing creds log in. Renders the SPEC'd shallow- faceted VISUAL browse: MAJOR=gen/real, GROUP=type, SOURCE=badge, thumbnails served from the record `ref` (DSM layout /volume1/vault/<class>/<type>/<shard>/<cid>_<source>.<ext>). Gated: no valid session -> 401, never a public byte (private-media cardinal rule). Cookie-auth (ngs, HttpOnly, Path=/vault). argv: [1]=port [2]=keys_path [3]=store_path [4]=budget [5]=allow_register [6]=m [7]=t [8]=p [9]=ttl license_tier: ORIGINAL No hw writes (Rule 26).

dependencies 5 imports · 0 importers

nx_opaque_login.nx nx_http_form.nx nx_registry.nx nx_mvault_record.nx nx_mvault_coll.nx nx_vault_gateway.nx

imports: nx_opaque_login.nxnx_http_form.nxnx_registry.nxnx_mvault_record.nxnx_mvault_coll.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gw_atoi olg_ctx_setup_ttl nx_uas_server_keys_load_or sys_mmap sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close _uas_hex_dec _uas_nib nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd ↻ sys_read ↻ sys_close ↻ nx_opq_derive_keypair sys_mmap ↻ _voprf_load_context_string u256_alloc nx_scratch nx_scratch_init nx_scratch_oom sys_mmap ↻ nx_opq_hash_to_scalar sys_mmap ↻ nx_h2c_expand_message_xmd_ sys_mmap ↻ _h2c_i2osp_1 _h2c_i2osp_2 u256_alloc ↻ _opq_reduce_48be_mod_n u256_alloc ↻ sys_mmap ↻ u256_load_be p256_modn_load_n u256_cmp

structs

none

consts

13const VGW_MAGIC_262144: i64 = 262144
14const VGW_MAGIC_2048: i64 = 2048
15const VGW_MAGIC_8388608: i64 = 8388608
16const VGW_MAGIC_16777216: i64 = 16777216
17const VGW_MAGIC_131072: i64 = 131072
18const VGW_MAGIC_131071: i64 = 131071
19const VGW_MAGIC_8192: i64 = 8192
21const VGW_PROD_M: i64 = 65536
22const VGW_SESSION_TTL: i64 = 86400
23const VGW_MVAULT_STORE: *u8 = "/volume1/homes/elderwesto/nishihost/knowledge/store/mvault-" as *u8
24const VGW_MAX_ITEMS: i64 = 3000
25const VGW_MEDIA_CAP: i64 = 25165824 // 24 MiB serve cap -- OOM guard; images/thumbnails only
31const VGW_MEDIA_ROOT: *u8 = "/volume1/homes/elderwesto/vaultfs" as *u8
32const VGW_REF_ROOT_LEN: i64 = 14 // len("/volume1/vault")
34const VGW_COLLBUF: i64 = 1048576 // buffer for the collection id index feeding the groupings facet
130const VGW_LOGIN_HTML: *u8 = "<!doctype html><html><head><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Nishi Vault</title><style>body{font-family:system-ui,sans-serif;max-width:420px;margin:8vh auto;padding:0 18px;color:#cdd7e6;background:#0b1019}h1{font-size:1.2rem;color:#e8eef7}p{color:#7c8aa5;font-size:.86rem}input{width:100%;padding:9px;margin:5px 0;box-sizing:border-box;border:1px solid #2a3550;border-radius:5px;background:#121a28;color:#e8eef7}button{padding:9px 16px;margin:6px 6px 0 0;background:#2d6cdf;color:#fff;border:0;border-radius:5px;cursor:pointer}#m{margin:14px 0;padding:12px;background:#121a28;border-left:3px solid #2d6cdf;color:#cdd7e6;min-height:1.2em}</style></head><body><h1>Nishi Vault &mdash; private</h1><p>OPAQUE aPAKE (RFC 9807). Same credentials as the gallery. The session rides an HttpOnly cookie, path-scoped to /vault.</p><div id=m>Log in to view the vault.</div><input id=h placeholder=handle autocomplete=username><input id=p type=password placeholder=passphrase autocomplete=current-password><button onclick=login()>Login</button><script>function $(i){return document.getElementById(i)}function M(t){$('m').textContent=t}async function login(){M('Logging in...');try{var r=await fetch('/vault/auth/login',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'handle='+encodeURIComponent($('h').value)+'&pw='+encodeURIComponent($('p').value)});var j=await r.json();if(!r.ok){M('Login failed: '+(j.error||r.status));return}M('Logged in. Opening vault...');location.href='/vault/'}catch(e){M('error: '+e)}}</script></body></html>" as *u8

functions

35func gw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 4: gw_401gw_302_loginvgw_ctype_formain
36func gw_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c<48{return v} if c>57{return v} v=v*10+(c-48); i=i+1 } return v }
called by 2: gw_read_fullmain
37func gw_starts(buf: *u8, n: i64, pre: *u8) -> i64 { var i: i64=0; while pre[i]!=(0 as u8){ if i>=n {return 0} if buf[i]!=pre[i]{return 0} i=i+1 } return 1 }
called by 3: vgw_ctype_forvgw_serve_catalogmain
38func gw_find(buf: *u8, n: i64, needle: *u8, nl: i64) -> i64
called by 6: gw_is_navgw_cookie_valgw_hdr_valgw_read_fullvgw_serve_mediamain
44func gw_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i]; o=o+1; i=i+1} return o }
called by 6: gw_sendgw_send_biggw_send_ckvgw_serve_mediavgw_serve_catalogmain
45func gw_catb(dst: *u8, off: i64, src: *u8, n: i64) -> i64 { var o: i64=off; var i: i64=0; while i<n {dst[o]=src[i]; o=o+1; i=i+1} return o }
called by 4: gw_sendgw_send_ckvgw_serve_catalogmain
46func gw_itoa(dst: *u8, off: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var o: i64=off; var q: i64=k-1; while q>=0{dst[o]=t[q];o=o+1;q=q-1} return o }
called by 5: gw_sendgw_send_biggw_send_ckvgw_serve_mediavgw_serve_catalog
48func gw_send(cfd: i64, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64
called by 3: gw_401vgw_serve_mediamain calls 3: gw_catgw_itoagw_catb
57func gw_send_big(cfd: i64, body: *u8, blen: i64) -> i64
called by 1: vgw_serve_catalog calls 2: gw_catgw_itoa
64func gw_401(cfd: i64) -> i64
called by 1: main calls 2: gw_sendgw_slen
68func gw_is_nav(req: *u8, n: i64) -> i64 { if gw_find(req, n, "Sec-Fetch-Mode: navigate" as *u8, 24) >= 0 { return 1 } return 0 }
called by 1: main calls 1: gw_find
69func gw_302_login(cfd: i64) -> i64
called by 1: main calls 1: gw_slen
73func gw_send_ck(cfd: i64, ctype: *u8, body: *u8, blen: i64, ckval: *u8, ckvallen: i64, ttl: i64) -> i64
called by 1: main calls 3: gw_catgw_catbgw_itoa
90func gw_hdr_val(req: *u8, hend: i64, name: *u8, nl: i64, out: *u8, cap: i64) -> i64
called by 2: gw_read_fullmain calls 1: gw_find
99func gw_reqpath(req: *u8, rn: i64, out: *u8, cap: i64) -> i64
called by 1: main
107func gw_read_full(cfd: i64, req: *u8, cap: i64) -> i64
called by 1: main calls 4: sys_readgw_findgw_hdr_valgw_atoi
132func vgw_nl(buf: *u8, from: i64, n: i64) -> i64 { var i: i64=from; var r: i64=n; while i<n { if buf[i]==(10 as u8) { r=i; i=n } else { i=i+1 } } return r }
called by 1: vgw_serve_catalog
134func vgw_field(rec: *u8, rl: i64, key: *u8, kl: i64, dst: *u8, o0: i64) -> i64
called by 1: vgw_serve_catalog calls 1: mv_rec_field
146func vgw_ref_of(cid: *u8, out: *u8, cap: i64) -> i64
called by 1: vgw_serve_media calls 2: mv_store_getmv_rec_field
160func vgw_jail_ok(p: *u8) -> i64
called by 1: vgw_serve_media
168func vgw_ctype_for(p: *u8) -> *u8
called by 1: vgw_serve_media calls 2: gw_slengw_starts
183func vgw_serve_media(cfd: i64, path: *u8, plen: i64) -> i64
called by 1: main calls 8: gw_findgw_sendvgw_ref_ofvgw_jail_okgw_catsys_read+2
216func vgw_serve_catalog(cfd: i64) -> i64
called by 1: main calls 12: reg_index_opengw_catgw_itoamvc_listvgw_nlmvc_get+6
321func main(argc: i64, argv: *i64) -> i64
calls 31: gw_atoiolg_ctx_setup_ttlsys_socketsys_setsockoptsys_bindsys_listen+25