`nx_cap_mint.nx` source

1// nx_cap_mint.nx -- CLI to MINT a capability token for R0's tools/call (R2 live). Reads the HMAC secret from a keyfile
2// (the vault-provisioned prod secret -- the SAME file R0 loads), and mints a capability granting <allow> until <exp>.
3// Operator-run (holds the keyfile); the eventual auth-gated self-service issuance endpoint is the ratchet.
4//   nx_cap_mint <keyfile> <allow-comma-list-or-*> <exp-epoch> <nonce>   -> prints the capability token to stdout.
5// license_tier: ORIGINAL
6import "nx_cap_token.nx"
7const CM_MAGIC_2048: i64 = 2048
8
9func cm_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func cm_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let d: i64 = s[i] as i64; if d >= 48 { if d <= 57 { v = v * 10 + (d - 48) } } i = i + 1 } return v }
11
12// the forgeable dev fallback baked into nx_tools_api (TA_CAP_SECRET). A token signed with it is forgeable by anyone
13// who can read the source/binary -> the minter must never sign with it. Provision a real key first (nx_cap_keygen).
14const CM_PLACEHOLDER: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8
15
16// a[0..alen) equals the NUL-terminated b, exact length? (placeholder detection)
17func cm_streq_n(a: *u8, alen: i64, b: *u8) -> i64 {
18    var i: i64 = 0
19    while i < alen { if b[i] == (0 as u8) { return 0 } if a[i] != b[i] { return 0 } i = i + 1 }
20    if b[alen] != (0 as u8) { return 0 }
21    return 1
22}
23
24// cm_mint: PURE core. Issue a capability over `allow` with `secret`, EXCEPT return 0-1 (fail-closed) if `secret` is
25// the forgeable placeholder. The gate drives this directly with a real test key (mirrors nx_cap_token_gate).
26func cm_mint(secret: *u8, secretlen: i64, allow: *u8, allen: i64, exp: i64, nonce: i64, out: *u8, cap: i64) -> i64 {
27    if cm_streq_n(secret, secretlen, CM_PLACEHOLDER) == 1 { return 0 - 1 }
28    return capt_issue(secret, secretlen, allow, allen, exp, nonce, out, cap)
29}
30
31func main(argc: i64, argv: *i64) -> i64 {
32    if argc < 5 { cm_puts("usage: nx_cap_mint <keyfile> <allow> <exp-epoch> <nonce>\n" as *u8); sys_exit(2); return 2 }
33    let kf: *u8 = argv[1] as *u8
34    let allow: *u8 = argv[2] as *u8
35    let exp: i64 = cm_atoi(argv[3] as *u8)
36    let nonce: i64 = cm_atoi(argv[4] as *u8)
37    let ksz: *i64 = sys_mmap(16) as *i64
38    let key: *u8 = sys_read_file(kf, ksz)
39    if (key as i64) == 0 { cm_puts("nx_cap_mint: cannot read keyfile\n" as *u8); sys_exit(1); return 1 }
40    let klen: i64 = ksz[0]
41    if klen <= 0 { cm_puts("nx_cap_mint: empty keyfile\n" as *u8); sys_exit(1); return 1 }
42    let tok: *u8 = sys_mmap(CM_MAGIC_2048)
43    let tn: i64 = cm_mint(key, klen, allow, capt_slen(allow), exp, nonce, tok, CM_MAGIC_2048)
44    if tn <= 0 { cm_puts("REFUSED: keyfile holds the forgeable placeholder secret -- provision a real key first (nx_cap_keygen)\n" as *u8); sys_exit(4); return 4 }
45    sys_write(1, tok, tn)
46    cm_puts("\n" as *u8)
47    sys_exit(0)
48    return 0
49}
nx_cap_mint.nx source

`nx_cap_mint.nx` source
