code wiki / _hdl_build / nx_authz_svc_daemon.nx
nx_authz_svc_daemon.nx source
↩ module page · 50 lines · 2371 B
1// nx_authz_svc_daemon.nx -- the DEPLOYABLE sovereign authorization SERVICE (the single-writer authz plane). Binds
2// 127.0.0.1:8029 (LOOPBACK ONLY -- internal service-to-service; the public boundary already authenticated the user,
3// so a caller's grantor identity is trusted here per rule 12). Owns ONE tuple store `authzsvc_` in the cwd
4// (nishihost/, elderwesto-writable -> single writer, no cross-daemon permission mismatch, no append race). Every
5// surface CHECKs and WRITEs through this over HTTP -> a group defined anywhere grants access everywhere. Build with
6// --build-only; supervised by a reconcile cron (elderwesto), same idiom as office/survey. license_tier: ORIGINAL
7import "nx_authz_svc.nx"
8const AZ_MAGIC_65536: i64 = 65536
9const AZ_MAGIC_262144: i64 = 262144
10
11const AZ_PORT: i64 = 0x1f5d // 8029
12const AZ_STORE: *u8 = "authzsvc_"
13
14func az_addr_lo(out: *u8, port: i64) -> i64 {
15 out[0] = 2 as u8; out[1] = 0 as u8
16 out[2] = ((port >> 8) & 0xff) as u8; out[3] = (port & 0xff) as u8
17 out[4] = 127 as u8; out[5] = 0 as u8; out[6] = 0 as u8; out[7] = 1 as u8 // 127.0.0.1
18 var i: i64 = 8
19 while i < 16 { out[i] = 0 as u8; i = i + 1 }
20 return 0
21}
22
23func main() -> i64 {
24 let addr: *u8 = sys_mmap(16)
25 az_addr_lo(addr, AZ_PORT)
26 let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
27 if lfd < 0 { az_p("NX-AUTHZ-SVC socket FAILED -- fail loud\n" as *u8); return 1 }
28 let one: *i64 = (sys_mmap(8)) as *i64
29 one[0] = 1
30 sys_setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, one as *u8, 4)
31 if sys_bind(lfd, addr, 16) < 0 { az_p("NX-AUTHZ-SVC bind 127.0.0.1:8029 FAILED (port busy?) -- fail loud\n" as *u8); return 1 }
32 if sys_listen(lfd, 16) < 0 { az_p("NX-AUTHZ-SVC listen FAILED -- fail loud\n" as *u8); return 1 }
33 az_p("NX-AUTHZ-SVC serving http://127.0.0.1:8029/ store=authzsvc_ (single-writer ReBAC service; accept loop)\n" as *u8)
34
35 let reqb: *u8 = sys_mmap(AZ_MAGIC_65536)
36 let resb: *u8 = sys_mmap(AZ_MAGIC_262144)
37 var go: i64 = 1
38 while go == 1 {
39 let cfd: i64 = sys_accept(lfd)
40 if cfd >= 0 {
41 let rn: i64 = az_read_req(cfd, reqb, AZ_MAGIC_65536)
42 if rn > 0 {
43 let on: i64 = az_handle(AZ_STORE, reqb, rn, resb, AZ_MAGIC_262144)
44 az_write_all(cfd, resb, on)
45 }
46 sys_close(cfd)
47 }
48 }
49 return 0
50}