code wiki / wiki / nx_wiki_admin_wiring.nx

nx_wiki_admin_wiring.nx

buildroot/runtime/wiki/nx_wiki_admin_wiring.nx

24000 B558 linesdepth 15pulls 45 transitivereach 6 importersview sourcekind librarytopic wiki
docsdependenciesstructsconstsfunctions

about

nx_wiki_admin_wiring.nx -- V-MODAUTH-7 per-site wiring for wiki admin routes. REWRITTEN 2026-05-27 from V1 cookie-based wiring to V-MODAUTH-6 SEALED API per NISHI_MODERN_AUTH_CHARTER §8. Composes hub/nx_modern_auth_flow (V-MODAUTH-6) which itself composes hub/nx_no_cookie_session (V-MODAUTH-5). NO COOKIES. NO Set-Cookie. NO Cookie: reads. Per C1 cardinal. Per-request flow (the hot path): 1. Caller extracts X-Nishi-Session header from HTTP request via nx_http_header_find 2. Caller base64-decodes the header value to a 152-byte binary session token 3. Caller passes (NxAuthContext + token bytes + now_unix_s) to nx_wiki_admin_handle 4. nx_wiki_admin_handle calls nx_modern_auth_validate_session 5. On success: emit 200/302 to protected content On failure: emit 401 with hint "POST passphrase to /wiki/admin/login" COMPOSES per "avoid duplicate primitives": hub/nx_modern_auth_flow V-MODAUTH-6 SEALED §8 API nx_http_header_find HTTP header extraction COMPOSED BY: wiki/nx_wiki_routes.nx dispatcher (updated to pass *NxAuthContext) SPEC REFERENCES: NISHI_MODERN_AUTH_CHARTER §8 SEALED 5-fn API NISHI_MODERN_AUTH_CHARTER §9.1 nishifamily.com wiring example V2 (2026-06-10): POST /wiki/admin/login is LIVE -- OPAQUE (RFC 9807, KAT-gated) + argon2id KSF + account store + Ed25519 session mint. Flow: POST /wiki/admin/login body "handle=<h>&passphrase=<p>" (form-urlencoded) -> nx_modern_auth_login -> 200 {"token":"<base64 152B>"} | 401 GET /wiki/admin/* X-Nishi-Session: <base64 token> -> 200 | 401 The 503 LOGIN_NOT_READY path remains ONLY for an unarmed context (no account store / oprf_seed wired at boot) -- honest, not a pretend-stub. Admin REGISTRATION is out-of-band (ops provisioning via nx_modern_auth_register; no public register endpoint on the admin realm).

dependencies 4 imports · 2 importers

nx_syscalls.nx nx_http_header_find.nx nx_base64.nx nx_modern_auth_flow.nx nx_wiki_admin_wiring.nx nx_wiki_login_live_gate.nx nx_wiki_routes.nx

imports: nx_syscalls.nxnx_http_header_find.nxnx_base64.nxnx_modern_auth_flow.nx

imported by: nx_wiki_login_live_gate.nxnx_wiki_routes.nx

structs

none

consts

48const NX_WAW_OK: i64 = 0
49const NX_WAW_BAD_INPUT: i64 = 1420
50const NX_WAW_BUF_OVERFLOW: i64 = 1421
51const NX_WAW_AUTH_FAILED: i64 = 1422
52const NX_WAW_LOGIN_NOT_READY: i64 = 1423 // /wiki/admin/login waits for V-MODAUTH-2/4
55const NX_WAW_MAX_HEADER_SCAN_BYTES: i64 = 8192
56const NX_WAW_RESP_CAP: i64 = 4096
57const NX_WAW_HDR_SESSION_NAME_N: i64 = 15 // "X-Nishi-Session" (was 16 = NEVER matched;
61const NX_WAW_METHOD_GET: i64 = 1
62const NX_WAW_METHOD_POST: i64 = 2

functions

66func _waw_hdr_session_name() -> *u8 { return "X-Nishi-Session" as *u8 }
called by 2: _waw_handle_refresh_postnx_wiki_admin_handle
68func _waw_append(resp_buf: *u8, out_off: *i64, resp_cap: i64,
called by 2: _waw_append_z_waw_emit_json_kv
81func _waw_append_z(resp_buf: *u8, out_off: *i64, resp_cap: i64,
called by 5: _waw_emit_401_waw_emit_authed_200_waw_emit_login_not_ready_waw_emit_json_kv_waw_emit_login_401 calls 1: _waw_append
99func _waw_emit_401(resp_buf: *u8, out_off: *i64, resp_cap: i64) -> i64
called by 1: nx_wiki_admin_handle calls 1: _waw_append_z
106func _waw_emit_authed_200(resp_buf: *u8, out_off: *i64, resp_cap: i64) -> i64
called by 1: nx_wiki_admin_handle calls 1: _waw_append_z
113func _waw_emit_login_not_ready(resp_buf: *u8, out_off: *i64, resp_cap: i64) -> i64
called by 1: nx_wiki_admin_handle calls 1: _waw_append_z
120func _waw_emit_json_kv(resp_buf: *u8, out_off: *i64, resp_cap: i64,
called by 2: _waw_emit_login_ok_waw_handle_recover_post calls 3: _waw_append_zsys_mmap_waw_append
149func _waw_emit_login_ok(resp_buf: *u8, out_off: *i64, resp_cap: i64,
called by 2: _waw_handle_login_post_waw_handle_refresh_post calls 3: sys_mmapb64_encode_waw_emit_json_kv
159func _waw_emit_login_401(resp_buf: *u8, out_off: *i64, resp_cap: i64) -> i64
called by 3: _waw_handle_login_post_waw_handle_recover_post_waw_handle_refresh_post calls 1: _waw_append_z
169func _waw_hex_nib(c: i64) -> i64
called by 1: _waw_urldecode
177func _waw_urldecode(src: *u8, n: i64, out: *u8, out_cap: i64) -> i64
called by 2: _waw_handle_login_post_waw_handle_recover_post calls 1: _waw_hex_nib
201func _waw_form_field(body: *u8, body_n: i64,
called by 2: _waw_handle_login_post_waw_handle_recover_post
236func _waw_content_length(http_req_buf: *u8, http_headers_end: i64) -> i64
called by 2: _waw_handle_login_post_waw_handle_recover_post calls 2: sys_mmapnx_http_header_find
258func _waw_handle_login_post(
called by 1: nx_wiki_admin_handle calls 7: _waw_content_lengthsys_mmap_waw_form_field_waw_urldecodenx_modern_auth_login_waw_emit_login_ok+1
315func _waw_handle_recover_post(
called by 1: nx_wiki_admin_handle calls 7: _waw_content_lengthsys_mmap_waw_form_field_waw_urldecodenx_modern_auth_recover_waw_emit_json_kv+1
385func _waw_handle_refresh_post(
called by 1: nx_wiki_admin_handle calls 7: sys_mmapnx_http_header_find_waw_hdr_session_nameb64_decodenx_modern_auth_refresh_session_waw_emit_login_ok+1
430func _waw_path_eq(url_path: *u8, url_path_n: i64, want: *u8, want_n: i64) -> i64
called by 1: nx_wiki_admin_handle
459func nx_wiki_admin_handle(
called by 2: mainnx_wiki_route_dispatch calls 12: sys_mmap_waw_path_eq_waw_handle_refresh_post_waw_emit_login_not_ready_waw_handle_login_post_waw_handle_recover_post+6