nx_wiki_edit_handler.nx

nx_wiki_edit_handler.nx -- wiki R1: GET/POST /wiki/<slug>/edit HTTP handlers. The thin HTTP adapter over nx_wiki_page_save (the auth-gated persist core): GET /wiki/<slug>/edit -> 200 an HTML <form> pre-filled with the current markdown (AUTH-GATED: no/invalid X-Nishi-Session -> 401). The textarea body is HTML-escaped. POST /wiki/<slug>/edit -> read the posted body (the new markdown), extract the session token, call nx_wiki_page_save. On OK -> 200 (saved + Refresh to the page); on REFUSED -> 401. Persisted nothing on refuse. SECURITY-CRITICAL: BOTH verbs gate on the SAME reused validator the core uses (hub/nx_modern_auth_flow::nx_modern_auth_validate_session). The GET form is itself behind the gate so the edit UI never renders for an anon visitor; the POST re-checks inside nx_wiki_page_save (defence in depth -- never trust the GET gate alone for the write). COMPOSES (each imported ONCE): wiki/nx_wiki_page_save nx_wiki_page_save + doc-store read helpers nx_http_header_find X-Nishi-Session extraction nx_base64 b64_decode (header carries base64(152B token)) html_escape textarea pre-fill escaping COMPOSED BY: wiki/nx_wiki_routes dispatch /wiki/<slug>/edit (GET + POST) Status: R1. 2026-06-14. license_tier: ORIGINAL