nx_cap_mint.nx source
↩ module page · 91 lines · 4731 B
1// nx_cap_mint.nx -- CLI to MINT a capability token for R0's tools/call (R2 live). Reads the HMAC secret from a keyfile
2// (the vault-provisioned prod secret -- the SAME file R0 loads), and mints a capability granting <allow> until <exp>.
3// Operator-run (holds the keyfile); the eventual auth-gated self-service issuance endpoint is the ratchet.
4// nx_cap_mint <keyfile> <allow-comma-list-or-*> <exp-epoch> <nonce> -> prints the capability token to stdout.
5// license_tier: ORIGINAL
6import "nx_cap_token.nx"
7import "nx_fio.nx"
8
9func cm_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func cm_decimal(s:*u8,n:i64)->i64{
11 if n<=0{return 0-1};var v:i64=0;var i:i64=0
12 while i<n{let c:i64=s[i] as i64;if c<48 || c>57{return 0-1}
13 if v>(CAPT_SIZE_MAX-(c-48))/10{return 0-1}
14 v=v*10+c-48;i=i+1
15 };return v
16}
17func cm_atoi(s:*u8)->i64{return cm_decimal(s,capt_slen(s))}
18
19// the forgeable dev fallback baked into nx_tools_api (TA_CAP_SECRET). A token signed with it is forgeable by anyone
20// who can read the source/binary -> the minter must never sign with it. Provision a real key first (nx_cap_keygen).
21const CM_PLACEHOLDER: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8
22
23// a[0..alen) equals the NUL-terminated b, exact length? (placeholder detection)
24func cm_streq_n(a: *u8, alen: i64, b: *u8) -> i64 {
25 var i: i64 = 0
26 while i < alen { if b[i] == (0 as u8) { return 0 } if a[i] != b[i] { return 0 } i = i + 1 }
27 if b[alen] != (0 as u8) { return 0 }
28 return 1
29}
30
31// cm_mint: PURE core. Issue a capability over `allow` with `secret`, EXCEPT return 0-1 (fail-closed) if `secret` is
32// the forgeable placeholder. The gate drives this directly with a real test key (mirrors nx_cap_token_gate).
33func cm_mint(secret: *u8, secretlen: i64, allow: *u8, allen: i64, exp: i64, nonce: i64, out: *u8, cap: i64) -> i64 {
34 if cm_streq_n(secret, secretlen, CM_PLACEHOLDER) == 1 { return 0 - 1 }
35 return capt_issue(secret, secretlen, allow, allen, exp, nonce, out, cap)
36}
37
38// Capability input snapshots own exact file extents and use the shared region reader.
39struct NxCapFile {bytes:*u8,length:i64,code:i64}
40func cm_file_close(file:*NxCapFile)->i64{
41 var rc:i64=0
42 if (file.bytes as i64)>0{
43 var i:i64=0;while i<file.length{file.bytes[i]=0 as u8;i=i+1}
44 rc=sys_munmap_direct(file.bytes,file.length)
45 }
46 file.bytes=0 as *u8;file.length=0;return rc
47}
48func cm_file_read(path:*u8,file:*NxCapFile)->i64{
49 file.bytes=0 as *u8;file.length=0;file.code=0
50 let r:*NxFileReadRegion=sys_mmap_try(__size_of(NxFileReadRegion)) as *NxFileReadRegion
51 if (r as i64)<=0{file.code=CAPT_ERR_ALLOC;return file.code}
52 fio_region_init(r);var rc:i64=fio_region_open(path,r)
53 if rc==0{
54 if r.total<=0{rc=FIO_EINVAL}
55 else{
56 file.length=r.total;file.bytes=sys_mmap_try(file.length)
57 if (file.bytes as i64)<=0{file.bytes=0 as *u8;rc=CAPT_ERR_ALLOC}
58 }
59 }
60 var got:i64=0
61 while rc==0 && got<file.length{
62 let part:i64=fio_region_next(r,file.bytes+got,file.length-got)
63 if part<=0{rc=FIO_EIO}else{got=got+part}
64 }
65 let closed:i64=fio_region_close(r);if rc==0 && closed!=0{rc=closed}
66 let freed:i64=sys_munmap_direct(r as *u8,__size_of(NxFileReadRegion))
67 if rc==0 && freed!=0{rc=CAPT_ERR_RELEASE}
68 if rc!=0{cm_file_close(file)}
69 file.code=rc;return rc
70}
71func cm_mint_file(path:*u8,allow:*u8,allen:i64,exp:i64,nonce:i64,out:*u8,cap:i64)->i64{
72 let file:*NxCapFile=sys_mmap_try(__size_of(NxCapFile)) as *NxCapFile
73 if (file as i64)<=0{return CAPT_ERR_ALLOC}
74 var rc:i64=cm_file_read(path,file)
75 if rc==0{rc=cm_mint(file.bytes,file.length,allow,allen,exp,nonce,out,cap)}
76 let closed:i64=cm_file_close(file);let freed:i64=sys_munmap_direct(file as *u8,__size_of(NxCapFile))
77 if closed!=0 || freed!=0{return CAPT_ERR_RELEASE};return rc
78}
79func main(argc:i64,argv:*i64)->i64{
80 if argc<5{cm_puts("usage: nx_cap_mint <keyfile> <allow> <exp-epoch> <nonce>\n");return 2}
81 let allow:*u8=argv[2] as *u8;let exp:i64=cm_atoi(argv[3] as *u8);let nonce:i64=cm_atoi(argv[4] as *u8)
82 if exp<=0 || nonce<=0{cm_puts("REFUSED: expiry and nonce must be positive decimal integers\n");return 2}
83 let capacity:i64=capt_issue_capacity(capt_slen(allow),exp,nonce);if capacity<=0{return 2}
84 let tok:*u8=sys_mmap_try(capacity);if (tok as i64)<=0{cm_puts("REFUSED: token allocation unavailable\n");return 3}
85 let tn:i64=cm_mint_file(argv[1] as *u8,allow,capt_slen(allow),exp,nonce,tok,capacity)
86 var result:i64=0
87 if tn<=0{cm_puts("REFUSED: key validation, signing or resource failure; no token emitted\n");result=4}
88 else{if sys_write(1,tok,tn)!=tn{result=5}else{cm_puts("\n")}}
89 var i:i64=0;while i<capacity{tok[i]=0 as u8;i=i+1}
90 if sys_munmap_direct(tok,capacity)!=0{return 6};return result
91}