code wiki / _hdl_build / nx_cred_admin.nx
nx_cred_admin.nx source
↩ module page · 69 lines · 3852 B
1// nx_cred_admin.nx -- CREDENTIAL-REQUEST ADMIN VIEW (operator 2026-06-13: flag API-key needs as a
2// process + an admin UI to provide them). Sovereign: reads knowledge/registry/cred_requests.tsv (the
3// flag list) and renders knowledge/cred_admin.html (the admin UI the operator opens). The operator
4// provides the key to the sovereign vault (nx_password_vault, never git) -> status PROVIDED -> the API
5// lane reads it. DATA -> HTML view, no 3rd-party. Re-run via renameat (no-trunc landmine).
6import "nx_syscalls.nx"
7const K_MAGIC_65536: i64 = 65536
8const K_MAGIC_65535: i64 = 65535
9
10func ca_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd, s, n); return 0 }
11
12func main() -> i64 {
13 let buf: *u8 = sys_mmap(K_MAGIC_65536)
14 let rf: i64 = sys_openat_rd("knowledge/registry/cred_requests.tsv" as *u8)
15 if rf < 0 { return 1 }
16 var n: i64 = 0
17 var r: i64 = sys_read(rf, buf, K_MAGIC_65535)
18 while r > 0 { n = n + r; if n >= K_MAGIC_65535 { r = 0 } else { r = sys_read(rf, (buf as i64 + n) as *u8, K_MAGIC_65535 - n) } }
19 sys_close(rf)
20
21 let of: i64 = sys_openat_wr("knowledge/cred_admin.html.tmp" as *u8, 0x1a4)
22 if of < 0 { return 1 }
23 ca_w(of, "<!doctype html><html><head><meta charset=\"utf-8\"><title>Nishi Credential Requests</title><style>body{font-family:system-ui;margin:2rem;max-width:60rem}table{border-collapse:collapse;width:100%}td,th{border:1px solid #ccc;padding:6px;text-align:left;font-size:14px}.PENDING{background:#fff3cd}.PROVIDED{background:#d4edda}</style></head><body>\n" as *u8)
24 ca_w(of, "<h1>Nishi — Credential Requests</h1>\n" as *u8)
25 ca_w(of, "<p>When the research lane needs an API key it is flagged here as a PROCESS (the ecosystem never silently fails). Provide the key to the sovereign vault (nx_secret_cli → nx_password_vault, never in git); status flips to PROVIDED and the API lane reads it for that target.</p>\n" as *u8)
26 ca_w(of, "<table><tr><th>id</th><th>target</th><th>api</th><th>auth header</th><th>docs</th><th>status</th><th>flagged</th><th>notes</th></tr>\n" as *u8)
27
28 var i: i64 = 0
29 var at_line_start: i64 = 1
30 var skip_line: i64 = 0
31 var in_cell: i64 = 0
32 while i < n {
33 let c: i64 = buf[i] as i64
34 if at_line_start == 1 {
35 at_line_start = 0
36 if c == 35 { skip_line = 1 } else {
37 skip_line = 0
38 ca_w(of, "<tr><td>" as *u8)
39 in_cell = 1
40 }
41 }
42 if skip_line == 0 {
43 if c == 10 {
44 if in_cell == 1 { ca_w(of, "</td></tr>\n" as *u8); in_cell = 0 }
45 at_line_start = 1
46 } else {
47 if c == 9 { ca_w(of, "</td><td>" as *u8) } else {
48 if c == 60 { ca_w(of, "<" as *u8) } else {
49 if c == 62 { ca_w(of, ">" as *u8) } else {
50 if c == 38 { ca_w(of, "&" as *u8) } else {
51 sys_write(of, (buf as i64 + i) as *u8, 1)
52 }
53 }
54 }
55 }
56 }
57 } else {
58 if c == 10 { at_line_start = 1; skip_line = 0 }
59 }
60 i = i + 1
61 }
62 if in_cell == 1 { ca_w(of, "</td></tr>\n" as *u8) }
63 ca_w(of, "</table>\n" as *u8)
64 ca_w(of, "<p><b>To provide a key:</b> store it in the sovereign vault under the target id (nx_secret_cli → nx_password_vault); flip status to PROVIDED. The authed write-back form is the X-CRED-UI rung (rides the CMS admin auth). The API lane (apifetch / sovereign fetch once live) injects the auth header from the vault.</p>\n" as *u8)
65 ca_w(of, "</body></html>\n" as *u8)
66 sys_close(of)
67 sys_renameat("knowledge/cred_admin.html.tmp" as *u8, "knowledge/cred_admin.html" as *u8)
68 return 0
69}