code wiki / _hdl_build / nx_email_portal_daemon.nx
`nx_email_portal_daemon.nx` source

↩ module page · 973 lines · 56025 B
1// nx_email_portal_daemon.nx -- the mail.<domain> EMAIL-PORTAL daemon on the CANONICAL ecosystem auth
2// (the SAME Modern Auth the doc portal / status use: OPAQUE-3DH + Argon2id + NO-COOKIE Ed25519 session).
3// Replaces the demo-grade nx_email_webmail_daemon (hardcoded single mailbox, NO auth) with a real
4// multi-user, per-domain portal:
5//   GET  /                     -> login + register + mail SPA shell (public)
6//   POST /mail/register        -> invite-gated OPAQUE self-registration (handle -> <handle>@<domain>)
7//   POST /mail/login           -> handle+passphrase -> 200 {"token":...} | 401
8//   *    /mail/*   (token)     -> X-Nishi-Session validates -> the mailbox is derived ONLY from the
9//                                 session handle (per-user isolation BY CONSTRUCTION -- no request
10//                                 parameter can address another user's mailbox):
11//        GET  /mail/inbox      -> HTML fragment: newest-first message list (Subject/From, escaped)
12//        GET  /mail/msg?n=K    -> HTML fragment: the raw message, HTML-escaped
13//        POST /mail/del?n=K    -> soft-delete (seg_store tombstone; history preserved, rule 13)
14//        POST /mail/send       -> to/subject/body form: rcpt@<domain> -> REAL local delivery into the
15//                                 rcpt mailbox (same store the data-driven MTA delivers into, so real
16//                                 inbound mail appears here the moment MX/relay is armed);
17//                                 foreign rcpt -> appended to relay-queue@<domain> + an HONEST
18//                                 "QUEUED-EXTERNAL (relay not armed)" receipt -- never a fake send.
19//        GET  /mail/whoami     -> {"handle":...,"mailbox":...}
20// Loopback HTTP daemon behind the SNI router's mail.<d> row (sites.elf reverse-proxies; TLS terminates
21// at sites.elf with the per-domain wildcard). Every response carries Content-Length (the buffered-proxy
22// contract). Pure router epd_handle = bytes-in/bytes-out (the gate drives it in-process, no socket).
23// license_tier: ORIGINAL
24import "nx_status_daemon.nx"
25import "hub/nx_modern_auth_flow.nx"
26import "nx_syscalls.nx"
27import "nx_invite_token.nx"   // invite-token store: inv_check / inv_consume (mint via nx_invite_issue_cli)
28import "nx_opaque_login.nx"   // olg_register (OPAQUE one-shot over nx_modern_auth_register)
29import "nx_email_webmail.nx"  // wm_esc + nx_email_mailbox (store) + nx_email_mime (header parse)
30const EPD_MAGIC_1024: i64 = 1024
31const EPD_MAGIC_8192: i64 = 8192
32
33const EPD_REQCAP: i64 = 65536
34const EPD_OUTCAP: i64 = 262144
35const EPD_BODYCAP: i64 = 131072
36const EPD_MSGCAP: i64 = 24576         // assembled outbound message cap
37const EPD_SHOWCAP: i64 = 16384        // per-message render cap (truncated view beyond)
38const EPD_INBOX_PAGE: i64 = 50        // newest-first page size
39
40// ---- handle hygiene: [a-z0-9][a-z0-9._-]{0,31} (defensive at the boundary; the mailbox is a
41// seg_store KEY so this is address hygiene + '#'/'@' key-scheme separation, not path safety) ----
42func epd_handle_ok(h: *u8, n: i64) -> i64 {
  if n < 1 { return 0 }
  if n > 32 { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = h[i] as i64
      var ok: i64 = 0
      if c >= 97 { if c <= 122 { ok = 1 } }
      if c >= 48 { if c <= 57 { ok = 1 } }
      if i > 0 {
          if c == 46 { ok = 1 }
          if c == 95 { ok = 1 }
          if c == 45 { ok = 1 }
      }
      if ok == 0 { return 0 }
      i = i + 1
  }
  return 1
60}
61
62// ---- session-uid -> handle MAILMAP. The no-cookie session carries the 32-byte user-id HASH
63// (not the plaintext handle), so registration appends "MAP <64hex-uid> <handle>\n" to
64// "<storefile>.mailmap" (append-only, rule 13) and the session gate resolves hash -> handle.
65func epd_hex32(src: *u8, out: *u8) -> i64 {
  let hx: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < 32 {
      out[i * 2] = hx[((src[i] as i64) >> 4) & 15]
      out[i * 2 + 1] = hx[(src[i] as i64) & 15]
      i = i + 1
  }
  out[64] = 0 as u8
  return 64
75}
76
77func epd_mailmap_path(ctx: *NxAuthContext, out: *u8) -> i64 {
  let sp: *u8 = ctx.account_store as *u8
  var i: i64 = 0
  while sp[i] != (0 as u8) { out[i] = sp[i]; i = i + 1 }
  let suf: *u8 = ".mailmap" as *u8
  var j: i64 = 0
  while suf[j] != (0 as u8) { out[i] = suf[j]; i = i + 1; j = j + 1 }
  out[i] = 0 as u8
  return i
86}
87
88func epd_map_put(path: *u8, hexuid: *u8, h: *u8, hn: i64) -> i64 {
  let row: *u8 = sys_mmap(256)
  var o: i64 = sd_cat(row, 0, "MAP " as *u8)
  var i: i64 = 0
  while i < 64 { row[o] = hexuid[i]; o = o + 1; i = i + 1 }
  row[o] = 32 as u8; o = o + 1
  i = 0
  while i < hn { row[o] = h[i]; o = o + 1; i = i + 1 }
  row[o] = 10 as u8; o = o + 1
  let fd: i64 = sys_openat_append(path, 0x1a4)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, row, o)
  sys_close(fd)
  return 0
102}
103
104// resolve hexuid -> handle (latest row wins); returns handle length or 0.
105func epd_map_get(path: *u8, hexuid: *u8, out: *u8, cap: i64) -> i64 {
  let szp: *i64 = sys_mmap(16) as *i64
  szp[0] = 0
  let b: *u8 = sys_read_file(path, szp)
  if (b as i64) == 0 { return 0 }
  let n: i64 = szp[0]
  var best: i64 = 0
  var cur: i64 = 0
  while cur < n {
      var le: i64 = cur
      while le < n && (b[le] as i64) != 10 { le = le + 1 }
      // row: "MAP " + 64 hex + " " + handle
      if le - cur > 69 {
          if (b[cur] as i64) == 77 {
              var m: i64 = 1
              var k: i64 = 0
              while k < 64 { if b[cur + 4 + k] != hexuid[k] { m = 0; k = 64 } else { k = k + 1 } }
              if m == 1 {
                  var w: i64 = 0
                  var s: i64 = cur + 69
                  while s < le { if w < cap - 1 { out[w] = b[s]; w = w + 1 } s = s + 1 }
                  out[w] = 0 as u8
                  best = w
              }
          }
      }
      cur = le + 1
  }
  return best
134}
135
136// case-insensitive ASCII equality of h[0..hn) vs NUL-terminated lit
137func epd_ci_eq(h: *u8, hn: i64, lit: *u8) -> i64 {
  var ln: i64 = 0
  while lit[ln] != (0 as u8) { ln = ln + 1 }
  if hn != ln { return 0 }
  var i: i64 = 0
  while i < ln {
      var a: i64 = h[i] as i64
      var b: i64 = lit[i] as i64
      if a >= 65 { if a <= 90 { a = a + 32 } }
      if b >= 65 { if b <= 90 { b = b + 32 } }
      if a != b { return 0 }
      i = i + 1
  }
  return 1
151}
152
153// build "<handle>@<domain>" NUL-terminated; returns length
154func epd_mailbox(h: *u8, hn: i64, domain: *u8, out: *u8) -> i64 {
  var o: i64 = 0
  var i: i64 = 0
  while i < hn { out[o] = h[i]; o = o + 1; i = i + 1 }
  out[o] = 64 as u8; o = o + 1
  i = 0
  while domain[i] != (0 as u8) { out[o] = domain[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  return o
163}
164
165// full HTTP response with Content-Length (the buffered-proxy contract)
166func epd_resp(out: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 {
  var o: i64 = 0
  o = sd_cat(out, o, "HTTP/1.1 " as *u8)
  o = sd_cat(out, o, status)
  o = sd_cat(out, o, "\r\nContent-Type: " as *u8)
  o = sd_cat(out, o, ctype)
  o = sd_cat(out, o, "\r\nConnection: close\r\nContent-Length: " as *u8)
  o = sd_catn(out, o, blen)
  o = sd_cat(out, o, "\r\n\r\n" as *u8)
  var i: i64 = 0
  while i < blen { out[o] = body[i]; o = o + 1; i = i + 1 }
  return o
178}
179
180// ?n=<digits> from the path (path includes the query). -1 if absent.
181func epd_qn(path: *u8, pn: i64) -> i64 {
  var q: i64 = 0 - 1
  var i: i64 = 0
  while i < pn { if (path[i] as i64) == 63 { q = i; i = pn } i = i + 1 }
  if q < 0 { return 0 - 1 }
  var j: i64 = q + 1
  while j + 1 < pn {
      if (path[j] as i64) == 110 {
          if (path[j + 1] as i64) == 61 {
              var ok: i64 = 0
              if j == q + 1 { ok = 1 }
              if j > q + 1 { if (path[j - 1] as i64) == 38 { ok = 1 } }
              if ok == 1 {
                  var v: i64 = 0
                  var k: i64 = j + 2
                  var any: i64 = 0
                  while k < pn {
                      let c: i64 = path[k] as i64
                      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); any = 1; k = k + 1 } else { k = pn } } else { k = pn }
                  }
                  if any == 1 { return v }
                  return 0 - 1
              }
          }
      }
      j = j + 1
  }
  return 0 - 1
209}
210
211// the no-cookie mail SPA: login/register -> token in sessionStorage -> inbox/read/compose via fetch
212// with the X-Nishi-Session header (NEVER a cookie). Body-first so the header carries Content-Length.
213func epd_shell(domain: *u8, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Mail &mdash; " as *u8)
  b = sd_cat(body, b, domain)
  b = sd_cat(body, b, "</title>" as *u8)
  b = sd_cat(body, b, "<style>body{font-family:-apple-system,Segoe UI,sans-serif;max-width:840px;margin:5vh auto;padding:0 20px;color:#1c1c1e}input,textarea{width:100%;padding:9px;margin:.35rem 0;box-sizing:border-box;border:1px solid #ccc;border-radius:7px}textarea{min-height:120px}button{padding:9px 16px;border:0;border-radius:7px;background:#2a4d8f;color:#fff;font-size:.95rem;margin:.2rem .3rem .2rem 0;cursor:pointer}.e{color:#b00;min-height:1.2em}.ok{color:#0a6}ul{list-style:none;padding:0}li.m{padding:.55rem .7rem;border:1px solid #dcdce2;border-radius:8px;margin:.4rem 0;cursor:pointer;background:#fafafc}li.m:hover{background:#eef2fb}.f{color:#667;font-size:.85rem;margin-left:.5rem}pre{white-space:pre-wrap;background:#f6f6f9;border:1px solid #dcdce2;border-radius:8px;padding:1rem;overflow-x:auto}h2{margin:.4rem 0}.tab{margin-bottom:1rem}</style>" as *u8)
  b = sd_cat(body, b, "<div id=login><h2>&#9993; " as *u8)
  b = sd_cat(body, b, domain)
  b = sd_cat(body, b, " mail</h2><form id=lf method=post action=/mail/login><input type=hidden name=ui value=1><input id=h name=handle placeholder=\"handle (your mailbox name)\" autocomplete=username autofocus><input id=p name=passphrase type=password placeholder=\"passphrase\" autocomplete=current-password><button type=submit id=b>Sign in</button></form><button id=sr>I have an invite</button><p id=e class=e></p></div>" as *u8)
  b = sd_cat(body, b, "<div id=reg hidden><h2>Create your mailbox</h2><input id=rh placeholder=\"choose a handle: a-z 0-9 . _ - (becomes handle@" as *u8)
  b = sd_cat(body, b, domain)
  b = sd_cat(body, b, ")\"><input id=rp type=password placeholder=\"choose a passphrase\"><input id=ri placeholder=\"invite code\"><button id=rb>Register</button><button id=rc>Back</button><p id=re class=e></p><pre id=rm hidden></pre></div>" as *u8)
  b = sd_cat(body, b, "<div id=mail hidden><div class=tab><button id=ib>Inbox</button><button id=cb>Compose</button><span id=me class=f></span></div><div id=inbox></div><div id=comp hidden><h2>Compose</h2><input id=ct placeholder=\"to (handle, or handle@" as *u8)
  b = sd_cat(body, b, domain)
  b = sd_cat(body, b, ")\"><input id=cs placeholder=subject><textarea id=cx></textarea><button id=cd>Send</button><p id=cr class=e></p></div><div id=view hidden><button id=vb>&larr; Back</button><button id=vd>Delete</button><div id=vc></div></div></div>" as *u8)
  b = sd_cat(body, b, "<script>var L=document.getElementById('login'),G=document.getElementById('reg'),M=document.getElementById('mail'),IB=document.getElementById('inbox'),CP=document.getElementById('comp'),VW=document.getElementById('view'),VC=document.getElementById('vc'),E=document.getElementById('e'),curN=-1;" as *u8)
  b = sd_cat(body, b, "function H(){return{'X-Nishi-Session':sessionStorage.nx_mail||''}}" as *u8)
  b = sd_cat(body, b, "function inbox(){CP.hidden=true;VW.hidden=true;IB.hidden=false;fetch('/mail/inbox',{headers:H()}).then(function(r){if(!r.ok)throw 0;return r.text()}).then(function(t){IB.innerHTML=t;var xs=IB.querySelectorAll('li.m');for(var i=0;i<xs.length;i++){xs[i].onclick=(function(n){return function(){openMsg(n)}})(xs[i].getAttribute('data-n'))}}).catch(function(){M.hidden=true;L.hidden=false})}" as *u8)
  b = sd_cat(body, b, "function openMsg(n){curN=n;fetch('/mail/msg?n='+n,{headers:H()}).then(function(r){return r.text()}).then(function(t){IB.hidden=true;CP.hidden=true;VW.hidden=false;VC.innerHTML=t})}" as *u8)
  b = sd_cat(body, b, "document.getElementById('vb').onclick=inbox;document.getElementById('vd').onclick=function(){fetch('/mail/del?n='+curN,{method:'POST',headers:H()}).then(inbox)};" as *u8)
  b = sd_cat(body, b, "document.getElementById('ib').onclick=inbox;document.getElementById('cb').onclick=function(){IB.hidden=true;VW.hidden=true;CP.hidden=false};" as *u8)
  b = sd_cat(body, b, "document.getElementById('cd').onclick=function(){var R=document.getElementById('cr');R.textContent='';var q='to='+encodeURIComponent(ct.value)+'&subject='+encodeURIComponent(cs.value)+'&body='+encodeURIComponent(cx.value);fetch('/mail/send',{method:'POST',headers:Object.assign({'Content-Type':'application/x-www-form-urlencoded'},H()),body:q}).then(function(r){return r.text()}).then(function(t){R.className='ok';R.textContent=t}).catch(function(){R.className='e';R.textContent='Send failed.'})};" as *u8)
  b = sd_cat(body, b, "document.getElementById('lf').onsubmit=function(){E.textContent='';var q='handle='+encodeURIComponent(h.value)+'&passphrase='+encodeURIComponent(p.value);fetch('/mail/login',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:q}).then(function(r){if(r.ok)return r.json();throw 0}).then(function(j){sessionStorage.nx_mail=j.token;L.hidden=true;M.hidden=false;fetch('/mail/whoami',{headers:H()}).then(function(r){return r.json()}).then(function(w){document.getElementById('me').textContent=w.mailbox});inbox()}).catch(function(){E.textContent='Wrong handle or passphrase.'});return false};" as *u8)
  b = sd_cat(body, b, "document.getElementById('sr').onclick=function(){L.hidden=true;G.hidden=false};document.getElementById('rc').onclick=function(){G.hidden=true;L.hidden=false};" as *u8)
  b = sd_cat(body, b, "document.getElementById('rb').onclick=function(){var R=document.getElementById('re'),RM=document.getElementById('rm');R.textContent='';var q='handle='+encodeURIComponent(rh.value)+'&pw='+encodeURIComponent(rp.value)+'&invite='+encodeURIComponent(ri.value);fetch('/mail/register',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:q}).then(function(r){if(r.ok)return r.json();throw 0}).then(function(j){RM.hidden=false;RM.textContent='Mailbox created. SAVE this recovery mnemonic now:\\n\\n'+j.mnemonic+'\\n\\nThen go back and sign in.'}).catch(function(){R.textContent='Registration failed (bad invite, taken handle, or invalid handle characters).'})};</script>" as *u8)
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
240}
241
242// newest-first inbox HTML FRAGMENT (the shell fetches this with the session header)
243func epd_inbox_frag(prefix: *u8, mailbox: *u8, body: *u8) -> i64 {
  let cnt: i64 = nx_mbox_count(prefix, mailbox)
  var b: i64 = 0
  b = sd_cat(body, b, "<h2>Inbox</h2>" as *u8)
  if cnt == 0 {
      b = sd_cat(body, b, "<p class=f>No messages yet.</p>" as *u8)
      return b
  }
  let pp: *i64 = sys_mmap(8) as *i64
  let ll: *i64 = sys_mmap(8) as *i64
  let subj: *u8 = sys_mmap(EPD_MAGIC_1024)
  let from: *u8 = sys_mmap(EPD_MAGIC_1024)
  b = sd_cat(body, b, "<ul>" as *u8)
  var shown: i64 = 0
  var i: i64 = cnt - 1
  while i >= 0 {
      if shown < EPD_INBOX_PAGE {
          let rc: i64 = nx_mbox_get_n(prefix, mailbox, i, pp, ll)
          if rc == 1 {
              let raw: *u8 = pp[0] as *u8
              let rn: i64 = ll[0]
              let sn: i64 = nx_mime_header_find(raw, rn, "Subject" as *u8, 7, subj, 1023)
              let fn: i64 = nx_mime_header_find(raw, rn, "From" as *u8, 4, from, 1023)
              b = sd_cat(body, b, "<li class=m data-n=" as *u8)
              b = sd_catn(body, b, i)
              b = sd_cat(body, b, "><b>" as *u8)
              if sn > 0 { b = wm_esc(body, b, subj, sn) } else { b = sd_cat(body, b, "(no subject)" as *u8) }
              b = sd_cat(body, b, "</b><span class=f>" as *u8)
              if fn > 0 { b = wm_esc(body, b, from, fn) }
              b = sd_cat(body, b, "</span></li>" as *u8)
              shown = shown + 1
          }
      }
      i = i - 1
  }
  b = sd_cat(body, b, "</ul><p class=f>" as *u8)
  b = sd_catn(body, b, cnt)
  b = sd_cat(body, b, " message slot(s); deleted ones are tombstoned, never erased.</p>" as *u8)
  return b
282}
283
284// assemble a minimal RFC-5322-shaped message (local delivery; the relay rung re-frames for the wire)
285func epd_assemble(fromb: *u8, tob: *u8, tn: i64, subjb: *u8, sn: i64, bodyb: *u8, bn: i64, msg: *u8) -> i64 {
  var m: i64 = 0
  m = sd_cat(msg, m, "From: " as *u8)
  m = sd_cat(msg, m, fromb)
  m = sd_cat(msg, m, "\r\nTo: " as *u8)
  var i: i64 = 0
  while i < tn { msg[m] = tob[i]; m = m + 1; i = i + 1 }
  m = sd_cat(msg, m, "\r\nSubject: " as *u8)
  i = 0
  while i < sn { msg[m] = subjb[i]; m = m + 1; i = i + 1 }
  m = sd_cat(msg, m, "\r\nDate-Unix: " as *u8)
  m = sd_catn(msg, m, sys_now_realtime_sec())
  m = sd_cat(msg, m, "\r\n\r\n" as *u8)
  i = 0
  while i < bn { msg[m] = bodyb[i]; m = m + 1; i = i + 1 }
  return m
301}
302
303// ===== NISHI-FIRST no-JS webmail (2026-07-05 doctrine). Full-page routes carrying the no-cookie session
304// in ?s= (shared nx_sa_validate_qs), so the Nishi browser reads + composes mail with ZERO JS -- fetch/SPA
305// stays for the third-party last mile. NO Set-Cookie (C1 preserved). =====
306
307// auth via ?s= + resolve the mailbox (identity ONLY from the validated session -> mailmap -> handle@dom).
308// returns 1 (authed, shand/shn/mbox filled) or 0. 8 args (arg-cap safe).
309func epd_qs_mailbox(ctx: *NxAuthContext, domain: *u8, path: *u8, pn: i64, now: i64, shand: *u8, shn_p: *i64, mbox: *u8) -> i64 {
  shn_p[0] = 0
  let suid: *u8 = sys_mmap(64)
  let sun: *i64 = sys_mmap(8) as *i64
  sun[0] = 0
  if nx_sa_validate_qs(ctx, path, pn, now, suid, 64, sun) != NX_MAUTH_OK { return 0 }
  if sun[0] != 32 { return 0 }
  let uhex: *u8 = sys_mmap(72)
  epd_hex32(suid, uhex)
  let mmp: *u8 = sys_mmap(512)
  epd_mailmap_path(ctx, mmp)
  let hn: i64 = epd_map_get(mmp, uhex, shand, 64)
  if hn <= 0 { return 0 }
  if epd_handle_ok(shand, hn) != 1 { return 0 }
  shn_p[0] = hn
  epd_mailbox(shand, hn, domain, mbox)
  return 1
326}
327
328// splice the raw (already %-encoded) session token into a body buffer at offset b; returns new offset.
329func epd_splice(body: *u8, b: i64, sraw: *u8, srn: i64) -> i64 {
  var o: i64 = b
  var i: i64 = 0
  while i < srn { body[o] = sraw[i]; o = o + 1; i = i + 1 }
  return o
334}
335
336// the no-JS landing after a form login: link to the inbox carrying the session in ?s=.
337func epd_landing_mail(out: *u8, b64: *u8, b64n: i64) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><title>Signed in</title><body style=\"font-family:sans-serif;max-width:760px;margin:6vh auto;padding:0 20px\"><h2>&#9993; Signed in</h2><p>No-JS webmail (nishi-first).</p><p><a href=\"/mail/box?s=" as *u8)
  b = nx_sa_tok_urlenc(b64, b64n, body, b)
  b = sd_cat(body, b, "\">Open your mailbox &rarr;</a></p>" as *u8)
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
344}
345
346// full no-JS inbox page: each message is an <a> to /mail/read?s=..&n=K (no data-n, no JS).
347func epd_inbox_page(prefix: *u8, mbox: *u8, sraw: *u8, srn: i64, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Inbox</title><body style=\"font-family:sans-serif;max-width:760px;margin:4vh auto;padding:0 20px\"><h2>Inbox</h2><p><a href=\"/mail/write?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\">&#9998; Compose</a></p>" as *u8)
  let cnt: i64 = nx_mbox_count(prefix, mbox)
  if cnt == 0 { b = sd_cat(body, b, "<p style=color:#667>No messages yet.</p>" as *u8) }
  else {
      let pp: *i64 = sys_mmap(8) as *i64
      let ll: *i64 = sys_mmap(8) as *i64
      let subj: *u8 = sys_mmap(EPD_MAGIC_1024)
      let from: *u8 = sys_mmap(EPD_MAGIC_1024)
      b = sd_cat(body, b, "<ul style=\"list-style:none;padding:0\">" as *u8)
      var shown: i64 = 0
      var i: i64 = cnt - 1
      while i >= 0 {
          if shown < EPD_INBOX_PAGE {
              let rc: i64 = nx_mbox_get_n(prefix, mbox, i, pp, ll)
              if rc == 1 {
                  let raw: *u8 = pp[0] as *u8
                  let rn: i64 = ll[0]
                  let sn: i64 = nx_mime_header_find(raw, rn, "Subject" as *u8, 7, subj, 1023)
                  let fn: i64 = nx_mime_header_find(raw, rn, "From" as *u8, 4, from, 1023)
                  b = sd_cat(body, b, "<li style=\"padding:.5rem .7rem;border:1px solid #dcdce2;border-radius:8px;margin:.4rem 0\"><a href=\"/mail/read?s=" as *u8)
                  b = epd_splice(body, b, sraw, srn)
                  b = sd_cat(body, b, "&n=" as *u8)
                  b = sd_catn(body, b, i)
                  b = sd_cat(body, b, "\"><b>" as *u8)
                  if sn > 0 { b = wm_esc(body, b, subj, sn) } else { b = sd_cat(body, b, "(no subject)" as *u8) }
                  b = sd_cat(body, b, "</b></a> <span style=\"color:#667;font-size:.85rem\">" as *u8)
                  if fn > 0 { b = wm_esc(body, b, from, fn) }
                  b = sd_cat(body, b, "</span></li>" as *u8)
                  shown = shown + 1
              }
          }
          i = i - 1
      }
      b = sd_cat(body, b, "</ul>" as *u8)
  }
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
388}
389
390// no-JS read page: the message + a delete FORM + back link (all carry ?s=).
391func epd_read_page(prefix: *u8, mbox: *u8, idx: i64, sraw: *u8, srn: i64, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><title>Message</title><body style=\"font-family:sans-serif;max-width:760px;margin:4vh auto;padding:0 20px\"><p><a href=\"/mail/box?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\">&larr; Inbox</a></p>" as *u8)
  let pp: *i64 = sys_mmap(8) as *i64
  let ll: *i64 = sys_mmap(8) as *i64
  let rc: i64 = nx_mbox_get_n(prefix, mbox, idx, pp, ll)
  if rc == 1 {
      b = sd_cat(body, b, "<pre style=\"white-space:pre-wrap;background:#f6f6f9;border:1px solid #dcdce2;border-radius:8px;padding:1rem;overflow-x:auto\">" as *u8)
      var show: i64 = ll[0]
      if show > EPD_SHOWCAP { show = EPD_SHOWCAP }
      b = wm_esc(body, b, pp[0] as *u8, show)
      if ll[0] > EPD_SHOWCAP { b = sd_cat(body, b, "\n[... truncated view ...]" as *u8) }
      b = sd_cat(body, b, "</pre><form method=post action=\"/mail/rm?s=" as *u8)
      b = epd_splice(body, b, sraw, srn)
      b = sd_cat(body, b, "&n=" as *u8)
      b = sd_catn(body, b, idx)
      b = sd_cat(body, b, "\"><button style=\"padding:8px 16px;border:0;border-radius:7px;background:#b00;color:#fff\">Delete</button></form>" as *u8)
  } else { b = sd_cat(body, b, "<p style=color:#667>This message was deleted (tombstoned).</p>" as *u8) }
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
413}
414
415// no-JS compose page: a real form POSTing to /mail/xsend?s=.
416func epd_write_page(domain: *u8, sraw: *u8, srn: i64, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Compose</title><body style=\"font-family:sans-serif;max-width:760px;margin:4vh auto;padding:0 20px\"><h2>Compose</h2><form method=post action=\"/mail/xsend?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\"><p>To: <input name=to placeholder=\"handle, or handle@" as *u8)
  b = sd_cat(body, b, domain)
  b = sd_cat(body, b, "\" style=\"width:100%;padding:8px\"></p><p>Subject: <input name=subject style=\"width:100%;padding:8px\"></p><p><textarea name=body rows=12 style=\"width:100%\"></textarea></p><button type=submit style=\"padding:9px 16px;border:0;border-radius:7px;background:#2a4d8f;color:#fff\">Send</button> <a href=\"/mail/box?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\">Cancel</a></form>" as *u8)
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
427}
428
429// deliver a composed message from `shand` -> `tob`: local recipient (same domain) into their mailbox,
430// foreign -> the honest relay-queue (durable, relay a named unarmed rung). lens[0]=shn lens[1]=tn
431// lens[2]=sn lens[3]=bn. Writes a human result into rmsg; returns its length. Shared by the JS /mail/send
432// and the no-JS /mail/xsend (one delivery engine, two front doors). 8 args (arg-cap safe).
433func epd_deliver(domain: *u8, prefix: *u8, shand: *u8, tob: *u8, sub: *u8, bod: *u8, lens: *i64, rmsg: *u8) -> i64 {
  let shn: i64 = lens[0]
  let tn: i64 = lens[1]
  let sn: i64 = lens[2]
  let bn: i64 = lens[3]
  let fromb: *u8 = sys_mmap(256)
  epd_mailbox(shand, shn, domain, fromb)
  let msg: *u8 = sys_mmap(EPD_MSGCAP)
  let mlen: i64 = epd_assemble(fromb, tob, tn, sub, sn, bod, bn, msg)
  var at: i64 = 0 - 1
  var ti: i64 = 0
  while ti < tn { if (tob[ti] as i64) == 64 { if at < 0 { at = ti } } ti = ti + 1 }
  var local_n: i64 = tn
  var dom_off: i64 = 0 - 1
  var dom_n: i64 = 0
  if at >= 0 { local_n = at; dom_off = at + 1; dom_n = tn - at - 1 }
  var is_local: i64 = 1
  if at >= 0 { let dp: *u8 = tob + dom_off; is_local = epd_ci_eq(dp, dom_n, domain) }
  let ts: i64 = sys_now_us()
  var r: i64 = 0
  if is_local == 1 {
      if epd_handle_ok(tob, local_n) == 1 {
          let rmb: *u8 = sys_mmap(256)
          epd_mailbox(tob, local_n, domain, rmb)
          let seq: i64 = nx_mbox_append(prefix, rmb, msg, mlen, ts)
          if seq >= 0 { r = sd_cat(rmsg, 0, "Delivered to " as *u8); r = sd_cat(rmsg, r, rmb) }
          else { r = sd_cat(rmsg, 0, "Delivery failed." as *u8) }
      } else { r = sd_cat(rmsg, 0, "Bad recipient handle (a-z 0-9 . _ -)." as *u8) }
  } else {
      let qmb: *u8 = sys_mmap(256)
      var qo: i64 = sd_cat(qmb, 0, "relay-queue@" as *u8)
      qo = sd_cat(qmb, qo, domain)
      qmb[qo] = 0 as u8
      let qseq: i64 = nx_mbox_append(prefix, qmb, msg, mlen, ts)
      if qseq >= 0 { r = sd_cat(rmsg, 0, "Queued for external relay (relay not armed yet; stored durably, nothing pretended)." as *u8) }
      else { r = sd_cat(rmsg, 0, "Queue failed." as *u8) }
  }
  return r
471}
472
473// no-JS send RESULT page: the delivery outcome + links back to compose / inbox (session in ?s=).
474func epd_sent_page(rmsg: *u8, rlen: i64, sraw: *u8, srn: i64, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(EPD_BODYCAP)
  var b: i64 = 0
  b = sd_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><title>Sent</title><body style=\"font-family:sans-serif;max-width:760px;margin:5vh auto;padding:0 20px\"><h2>&#9993; " as *u8)
  b = wm_esc(body, b, rmsg, rlen)
  b = sd_cat(body, b, "</h2><p><a href=\"/mail/box?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\">&larr; Inbox</a> &nbsp; <a href=\"/mail/write?s=" as *u8)
  b = epd_splice(body, b, sraw, srn)
  b = sd_cat(body, b, "\">Compose another</a></p>" as *u8)
  return epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, body, b)
485}
486
487// ---- THE ROUTER: request bytes -> response bytes (no socket). The gate drives this directly. ----
488func epd_handle(ctx: *NxAuthContext, domain: *u8, prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let poff: *i64 = sys_mmap(8) as *i64
  let plen: *i64 = sys_mmap(8) as *i64
  poff[0] = 0
  plen[0] = 0
  sd_find_path(req, req_n, poff, plen)
  let path: *u8 = ((req as i64) + poff[0]) as *u8
  let pn: i64 = plen[0]
  let is_post: i64 = (req[0] == 80 as u8) as i64
  var o: i64 = 0
498
  // ===== NISHI-FIRST no-JS full-page routes (session in ?s=; early-return). Matched BEFORE the JS
  // /mail/ header gate so their /mail/ prefix doesn't fall into it. =====
  if sd_starts(path, pn, "/mail/box" as *u8) == 1 {
      let now_b: i64 = sys_now_realtime_sec()
      let shand: *u8 = sys_mmap(128)
      let shn: *i64 = sys_mmap(8) as *i64
      let mbox: *u8 = sys_mmap(256)
      if epd_qs_mailbox(ctx, domain, path, pn, now_b, shand, shn, mbox) == 1 {
          let voff: *i64 = sys_mmap(8) as *i64
          let srn: i64 = nx_sa_qs_raw(path, pn, voff)
          let sraw: *u8 = ((path as i64) + voff[0]) as *u8
          return epd_inbox_page(prefix, mbox, sraw, srn, out)
      }
      return sd_emit_401_json(out)
  }
  if sd_starts(path, pn, "/mail/read" as *u8) == 1 {
      let now_r: i64 = sys_now_realtime_sec()
      let shand: *u8 = sys_mmap(128)
      let shn: *i64 = sys_mmap(8) as *i64
      let mbox: *u8 = sys_mmap(256)
      if epd_qs_mailbox(ctx, domain, path, pn, now_r, shand, shn, mbox) == 1 {
          let voff: *i64 = sys_mmap(8) as *i64
          let srn: i64 = nx_sa_qs_raw(path, pn, voff)
          let sraw: *u8 = ((path as i64) + voff[0]) as *u8
          let idx: i64 = epd_qn(path, pn)
          return epd_read_page(prefix, mbox, idx, sraw, srn, out)
      }
      return sd_emit_401_json(out)
  }
  if sd_starts(path, pn, "/mail/write" as *u8) == 1 {
      let now_w: i64 = sys_now_realtime_sec()
      let shand: *u8 = sys_mmap(128)
      let shn: *i64 = sys_mmap(8) as *i64
      let mbox: *u8 = sys_mmap(256)
      if epd_qs_mailbox(ctx, domain, path, pn, now_w, shand, shn, mbox) == 1 {
          let voff: *i64 = sys_mmap(8) as *i64
          let srn: i64 = nx_sa_qs_raw(path, pn, voff)
          let sraw: *u8 = ((path as i64) + voff[0]) as *u8
          return epd_write_page(domain, sraw, srn, out)
      }
      return sd_emit_401_json(out)
  }
  if sd_starts(path, pn, "/mail/xsend" as *u8) == 1 {
      if is_post == 1 {
          let now_x: i64 = sys_now_realtime_sec()
          let shand: *u8 = sys_mmap(128)
          let shn: *i64 = sys_mmap(8) as *i64
          let mbox: *u8 = sys_mmap(256)
          if epd_qs_mailbox(ctx, domain, path, pn, now_x, shand, shn, mbox) == 1 {
              let voff: *i64 = sys_mmap(8) as *i64
              let srn: i64 = nx_sa_qs_raw(path, pn, voff)
              let sraw: *u8 = ((path as i64) + voff[0]) as *u8
              let body_off: i64 = sd_body_off(req, req_n)
              let fb: *u8 = ((req as i64) + body_off) as *u8
              let fbn: i64 = req_n - body_off
              let toff: *i64 = sys_mmap(8) as *i64
              let tnf: *i64 = sys_mmap(8) as *i64
              let soff: *i64 = sys_mmap(8) as *i64
              let snf: *i64 = sys_mmap(8) as *i64
              let boff: *i64 = sys_mmap(8) as *i64
              let bnf: *i64 = sys_mmap(8) as *i64
              var got: i64 = 0
              if sd_form_field(fb, fbn, "to" as *u8, 2, toff, tnf) == 1 {
                  if sd_form_field(fb, fbn, "subject" as *u8, 7, soff, snf) == 1 {
                      if sd_form_field(fb, fbn, "body" as *u8, 4, boff, bnf) == 1 { got = 1 }
                  }
              }
              if got == 1 {
                  let tob: *u8 = sys_mmap(320)
                  let sub: *u8 = sys_mmap(EPD_MAGIC_1024)
                  let bod: *u8 = sys_mmap(EPD_SHOWCAP)
                  let tsrc: *u8 = ((fb as i64) + toff[0]) as *u8
                  let ssrc: *u8 = ((fb as i64) + soff[0]) as *u8
                  let bsrc: *u8 = ((fb as i64) + boff[0]) as *u8
                  let t_dec: i64 = sd_urldecode(tsrc, tnf[0], tob, 300)
                  let s_dec: i64 = sd_urldecode(ssrc, snf[0], sub, 1000)
                  let bcapm: i64 = EPD_SHOWCAP - 1
                  let b_dec: i64 = sd_urldecode(bsrc, bnf[0], bod, bcapm)
                  if t_dec > 0 {
                      let lens: *i64 = sys_mmap(64) as *i64
                      lens[0] = shn[0]
                      lens[1] = t_dec
                      lens[2] = s_dec
                      lens[3] = b_dec
                      let rmsg: *u8 = sys_mmap(512)
                      let rlen: i64 = epd_deliver(domain, prefix, shand, tob, sub, bod, lens, rmsg)
                      return epd_sent_page(rmsg, rlen, sraw, srn, out)
                  }
              }
              return epd_resp(out, "400 Bad Request" as *u8, "text/plain" as *u8, "missing to/subject/body" as *u8, 23)
          }
          return sd_emit_401_json(out)
      }
      return sd_emit_401_json(out)
  }
  if sd_starts(path, pn, "/mail/rm" as *u8) == 1 {
      if is_post == 1 {
          let now_d: i64 = sys_now_realtime_sec()
          let shand: *u8 = sys_mmap(128)
          let shn: *i64 = sys_mmap(8) as *i64
          let mbox: *u8 = sys_mmap(256)
          if epd_qs_mailbox(ctx, domain, path, pn, now_d, shand, shn, mbox) == 1 {
              let voff: *i64 = sys_mmap(8) as *i64
              let srn: i64 = nx_sa_qs_raw(path, pn, voff)
              let sraw: *u8 = ((path as i64) + voff[0]) as *u8
              let idx: i64 = epd_qn(path, pn)
              let ts: i64 = sys_now_us()
              var rmv: i64 = 0
              if idx >= 0 { if nx_mbox_delete_n(prefix, mbox, idx, ts) == 0 { rmv = 1 } }
              let rmsg: *u8 = sys_mmap(64)
              var rl: i64 = 0
              if rmv == 1 { rl = sd_cat(rmsg, 0, "Deleted." as *u8) } else { rl = sd_cat(rmsg, 0, "Delete failed." as *u8) }
              return epd_sent_page(rmsg, rl, sraw, srn, out)
          }
          return sd_emit_401_json(out)
      }
      return sd_emit_401_json(out)
  }
617
  if sd_starts(path, pn, "/mail/register" as *u8) == 1 {
      // INVITE-GATED OPAQUE self-registration (mirrors the doc portal) + the handle-hygiene guard:
      // the handle BECOMES the mailbox address, so charset is enforced at the boundary.
      if is_post == 1 {
          let body_off: i64 = sd_body_off(req, req_n)
          let body: *u8 = ((req as i64) + body_off) as *u8
          let body_n: i64 = req_n - body_off
          let hoff: *i64 = sys_mmap(8) as *i64
          let hn: *i64 = sys_mmap(8) as *i64
          let woff: *i64 = sys_mmap(8) as *i64
          let wn: *i64 = sys_mmap(8) as *i64
          let ioff: *i64 = sys_mmap(8) as *i64
          let inn: *i64 = sys_mmap(8) as *i64
          var got: i64 = 0
          if sd_form_field(body, body_n, "handle" as *u8, 6, hoff, hn) == 1 {
              if sd_form_field(body, body_n, "pw" as *u8, 2, woff, wn) == 1 {
                  if sd_form_field(body, body_n, "invite" as *u8, 6, ioff, inn) == 1 { got = 1 }
              }
          }
          var done: i64 = 0
          if got == 1 {
              let hbuf: *u8 = sys_mmap(256)
              let pbuf: *u8 = sys_mmap(512)
              let ibuf: *u8 = sys_mmap(128)
              let h_dec: i64 = sd_urldecode(((body as i64) + hoff[0]) as *u8, hn[0], hbuf, 255)
              let p_dec: i64 = sd_urldecode(((body as i64) + woff[0]) as *u8, wn[0], pbuf, 511)
              let i_dec: i64 = sd_urldecode(((body as i64) + ioff[0]) as *u8, inn[0], ibuf, 127)
              if h_dec > 0 { if p_dec > 0 { if i_dec > 0 {
                  if epd_handle_ok(hbuf, h_dec) == 0 {
                      let hb: *u8 = sys_mmap(256)
                      let hbn: i64 = sd_cat(hb, 0, "{\"error\":\"handle must be a-z 0-9 . _ - (1..32, start a-z0-9)\"}" as *u8)
                      o = epd_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, hb, hbn)
                      done = 1
                  } else {
                      let invpath: *u8 = sys_mmap(512)
                      var q: i64 = 0
                      let sp: *u8 = ctx.account_store as *u8
                      while sp[q] != (0 as u8) { invpath[q] = sp[q]; q = q + 1 }
                      let suf: *u8 = ".invites" as *u8
                      var w: i64 = 0
                      while suf[w] != (0 as u8) { invpath[q] = suf[w]; q = q + 1; w = w + 1 }
                      invpath[q] = 0 as u8
                      let now_s: i64 = sys_now_realtime_sec()
                      let lvl: i64 = inv_check(invpath, ibuf, i_dec, ctx.realm_id, ctx.realm_id_n, now_s)
                      if lvl <= 0 {
                          o = sd_cat(out, 0, "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 37\r\n\r\n{\"error\":\"invalid or expired invite\"}" as *u8)
                          done = 1
                      } else {
                          let mn: *u8 = sys_mmap(512)
                          let mnn: *i64 = sys_mmap(16) as *i64
                          if olg_register(ctx, hbuf, h_dec, pbuf, p_dec, mn, 512, mnn) == NX_MAUTH_OK {
                              inv_consume(invpath, ibuf, i_dec, now_s)
                              // mailmap: session tokens carry the uid HASH -> record hash->handle now
                              let uidh: *u8 = sys_mmap(32)
                              if nx_ncs_derive_user_id_hash(ctx.realm_id, ctx.realm_id_n, hbuf, h_dec, uidh) == NX_NCS_OK {
                                  let uhex: *u8 = sys_mmap(72)
                                  epd_hex32(uidh, uhex)
                                  let mmp: *u8 = sys_mmap(512)
                                  epd_mailmap_path(ctx, mmp)
                                  epd_map_put(mmp, uhex, hbuf, h_dec)
                              }
                              o = sd_cat(out, 0, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8)
                              o = sd_catn(out, o, 15 + mnn[0])
                              o = sd_cat(out, o, "\r\n\r\n{\"mnemonic\":\"" as *u8)
                              var z: i64 = 0
                              while z < mnn[0] { out[o] = mn[z]; o = o + 1; z = z + 1 }
                              o = sd_cat(out, o, "\"}" as *u8)
                              done = 1
                          } else {
                              o = sd_cat(out, 0, "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 27\r\n\r\n{\"error\":\"register failed\"}" as *u8)
                              done = 1
                          }
                      }
                  }
              } } }
          }
          if done == 0 { o = sd_cat(out, 0, "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 27\r\n\r\n{\"error\":\"register failed\"}" as *u8) }
      } else { o = epd_shell(domain, out) }
  } else { if sd_starts(path, pn, "/mail/login" as *u8) == 1 {
      if is_post == 1 {
          let body_off: i64 = sd_body_off(req, req_n)
          let body: *u8 = ((req as i64) + body_off) as *u8
          let body_n: i64 = req_n - body_off
          let hoff: *i64 = sys_mmap(8) as *i64
          let hn: *i64 = sys_mmap(8) as *i64
          let woff: *i64 = sys_mmap(8) as *i64
          let wn: *i64 = sys_mmap(8) as *i64
          var got: i64 = 0
          if sd_form_field(body, body_n, "handle" as *u8, 6, hoff, hn) == 1 {
              if sd_form_field(body, body_n, "passphrase" as *u8, 10, woff, wn) == 1 { got = 1 }
          }
          // ui=1 rides ONLY the native <form> submit (nishi-first no-JS) -> answer HTML, not JSON.
          var uiflag: i64 = 0
          let uoff: *i64 = sys_mmap(8) as *i64
          let un: *i64 = sys_mmap(8) as *i64
          if sd_form_field(body, body_n, "ui" as *u8, 2, uoff, un) == 1 { uiflag = 1 }
          var ok: i64 = 0
          if got == 1 {
              let hbuf: *u8 = sys_mmap(256)
              let pbuf: *u8 = sys_mmap(512)
              let h_dec: i64 = sd_urldecode(((body as i64) + hoff[0]) as *u8, hn[0], hbuf, 255)
              let p_dec: i64 = sd_urldecode(((body as i64) + woff[0]) as *u8, wn[0], pbuf, 511)
              if h_dec > 0 { if p_dec > 0 {
                  let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES)
                  let tok_n: *i64 = sys_mmap(8) as *i64
                  tok_n[0] = 0
                  if nx_modern_auth_login(ctx, hbuf, h_dec, pbuf, p_dec, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) == NX_MAUTH_OK {
                      let b64: *u8 = sys_mmap(256)
                      let b64_n: i64 = b64_encode(tok, NX_MAUTH_SESSION_TOKEN_BYTES, b64)
                      if uiflag == 1 { o = epd_landing_mail(out, b64, b64_n) }
                      else {
                          o = sd_cat(out, o, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8)
                          o = sd_catn(out, o, 12 + b64_n)
                          o = sd_cat(out, o, "\r\n\r\n{\"token\":\"" as *u8)
                          var z: i64 = 0
                          while z < b64_n { out[o] = b64[z]; o = o + 1; z = z + 1 }
                          o = sd_cat(out, o, "\"}" as *u8)
                      }
                      ok = 1
                  }
              } }
          }
          if ok == 0 {
              if uiflag == 1 { o = sd_cat(out, 0, "HTTP/1.1 401 Unauthorized\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: 101\r\n\r\n<!DOCTYPE html><meta charset=utf-8><p>Wrong handle or passphrase.</p><p><a href=\"/\">Try again</a></p>" as *u8) }
              else { o = sd_emit_401_json(out) }
          }
      } else { o = epd_shell(domain, out) }
  } else { if sd_starts(path, pn, "/mail/" as *u8) == 1 {
      // session-gated: identity comes ONLY from the validated token. The token carries the 32-byte
      // user-id HASH; the register-time mailmap resolves it to the handle -> the mailbox is
      // <session-handle>@<domain>. No request parameter can select another mailbox.
      let now_s: i64 = sys_now_realtime_sec()
      let suid: *u8 = sys_mmap(64)
      let sun: *i64 = sys_mmap(8) as *i64
      sun[0] = 0
      var authed: i64 = 0
      let shand: *u8 = sys_mmap(128)
      var shn0: i64 = 0
      if nx_sa_validate_handle(ctx, req, req_n, now_s, suid, 64, sun) == NX_MAUTH_OK {
          if sun[0] == 32 {
              let uhex2: *u8 = sys_mmap(72)
              epd_hex32(suid, uhex2)
              let mmp2: *u8 = sys_mmap(512)
              epd_mailmap_path(ctx, mmp2)
              shn0 = epd_map_get(mmp2, uhex2, shand, 64)
              if shn0 > 0 { if epd_handle_ok(shand, shn0) == 1 { authed = 1 } }
          }
      }
      if authed == 1 {
              let mbox: *u8 = sys_mmap(256)
              epd_mailbox(shand, shn0, domain, mbox)
              let frag: *u8 = sys_mmap(EPD_BODYCAP)
              if sd_starts(path, pn, "/mail/inbox" as *u8) == 1 {
                  let fb: i64 = epd_inbox_frag(prefix, mbox, frag)
                  o = epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, frag, fb)
              } else { if sd_starts(path, pn, "/mail/msg" as *u8) == 1 {
                  let idx: i64 = epd_qn(path, pn)
                  var served: i64 = 0
                  if idx >= 0 {
                      let pp: *i64 = sys_mmap(8) as *i64
                      let ll: *i64 = sys_mmap(8) as *i64
                      let rc: i64 = nx_mbox_get_n(prefix, mbox, idx, pp, ll)
                      if rc == 1 {
                          var fb: i64 = sd_cat(frag, 0, "<pre>" as *u8)
                          var show: i64 = ll[0]
                          if show > EPD_SHOWCAP { show = EPD_SHOWCAP }
                          fb = wm_esc(frag, fb, pp[0] as *u8, show)
                          if ll[0] > EPD_SHOWCAP { fb = sd_cat(frag, fb, "\n[... truncated view ...]" as *u8) }
                          fb = sd_cat(frag, fb, "</pre>" as *u8)
                          o = epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, frag, fb)
                          served = 1
                      }
                      if rc == 0 {
                          let fb2: i64 = sd_cat(frag, 0, "<p class=f>This message was deleted (tombstoned).</p>" as *u8)
                          o = epd_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, frag, fb2)
                          served = 1
                      }
                  }
                  if served == 0 {
                      let fb3: i64 = sd_cat(frag, 0, "<p class=f>No such message.</p>" as *u8)
                      o = epd_resp(out, "404 Not Found" as *u8, "text/html; charset=utf-8" as *u8, frag, fb3)
                  }
              } else { if sd_starts(path, pn, "/mail/del" as *u8) == 1 {
                  var deld: i64 = 0
                  if is_post == 1 {
                      let idx2: i64 = epd_qn(path, pn)
                      if idx2 >= 0 {
                          if nx_mbox_delete_n(prefix, mbox, idx2, sys_now_us()) == 0 {
                              let fb4: i64 = sd_cat(frag, 0, "OK" as *u8)
                              o = epd_resp(out, "200 OK" as *u8, "text/plain" as *u8, frag, fb4)
                              deld = 1
                          }
                      }
                  }
                  if deld == 0 {
                      let fb5: i64 = sd_cat(frag, 0, "delete failed" as *u8)
                      o = epd_resp(out, "400 Bad Request" as *u8, "text/plain" as *u8, frag, fb5)
                  }
              } else { if sd_starts(path, pn, "/mail/send" as *u8) == 1 {
                  var sent: i64 = 0
                  if is_post == 1 {
                      let body_off: i64 = sd_body_off(req, req_n)
                      let body: *u8 = ((req as i64) + body_off) as *u8
                      let body_n: i64 = req_n - body_off
                      let toff: *i64 = sys_mmap(8) as *i64
                      let tn: *i64 = sys_mmap(8) as *i64
                      let soff: *i64 = sys_mmap(8) as *i64
                      let sn: *i64 = sys_mmap(8) as *i64
                      let boff: *i64 = sys_mmap(8) as *i64
                      let bn: *i64 = sys_mmap(8) as *i64
                      var got: i64 = 0
                      if sd_form_field(body, body_n, "to" as *u8, 2, toff, tn) == 1 {
                          if sd_form_field(body, body_n, "subject" as *u8, 7, soff, sn) == 1 {
                              if sd_form_field(body, body_n, "body" as *u8, 4, boff, bn) == 1 { got = 1 }
                          }
                      }
                      if got == 1 {
                          let tob: *u8 = sys_mmap(320)
                          let sub: *u8 = sys_mmap(EPD_MAGIC_1024)
                          let bod: *u8 = sys_mmap(EPD_SHOWCAP)
                          let t_dec: i64 = sd_urldecode(((body as i64) + toff[0]) as *u8, tn[0], tob, 300)
                          let s_dec: i64 = sd_urldecode(((body as i64) + soff[0]) as *u8, sn[0], sub, 1000)
                          let b_dec: i64 = sd_urldecode(((body as i64) + boff[0]) as *u8, bn[0], bod, EPD_SHOWCAP - 1)
                          if t_dec > 0 { if s_dec >= 0 { if b_dec >= 0 {
                              // split to = local[@dom]
                              var at: i64 = 0 - 1
                              var ti: i64 = 0
                              while ti < t_dec { if (tob[ti] as i64) == 64 { if at < 0 { at = ti } } ti = ti + 1 }
                              var local_n: i64 = t_dec
                              var dom_off: i64 = 0 - 1
                              var dom_n: i64 = 0
                              if at >= 0 { local_n = at; dom_off = at + 1; dom_n = t_dec - at - 1 }
                              var is_local: i64 = 1
                              if at >= 0 { is_local = epd_ci_eq(((tob as i64) + dom_off) as *u8, dom_n, domain) }
                              // sender identity for From:
                              let fromb: *u8 = sys_mmap(256)
                              epd_mailbox(shand, shn0, domain, fromb)
                              let msg: *u8 = sys_mmap(EPD_MSGCAP)
                              let mlen: i64 = epd_assemble(fromb, tob, t_dec, sub, s_dec, bod, b_dec, msg)
                              if is_local == 1 {
                                  if epd_handle_ok(tob, local_n) == 1 {
                                      let rmb: *u8 = sys_mmap(256)
                                      epd_mailbox(tob, local_n, domain, rmb)
                                      let seq: i64 = nx_mbox_append(prefix, rmb, msg, mlen, sys_now_us())
                                      if seq >= 0 {
                                          var fb6: i64 = sd_cat(frag, 0, "DELIVERED-LOCAL to=" as *u8)
                                          fb6 = sd_cat(frag, fb6, rmb)
                                          fb6 = sd_cat(frag, fb6, " seq=" as *u8)
                                          fb6 = sd_catn(frag, fb6, seq)
                                          o = epd_resp(out, "200 OK" as *u8, "text/plain" as *u8, frag, fb6)
                                          sent = 1
                                      }
                                  } else {
                                      let fb7: i64 = sd_cat(frag, 0, "bad recipient handle (a-z 0-9 . _ -)" as *u8)
                                      o = epd_resp(out, "400 Bad Request" as *u8, "text/plain" as *u8, frag, fb7)
                                      sent = 1
                                  }
                              } else {
                                  // HONEST external queue: stored durably, relay is a named, unarmed rung.
                                  let qmb: *u8 = sys_mmap(256)
                                  var qo: i64 = sd_cat(qmb, 0, "relay-queue@" as *u8)
                                  qo = sd_cat(qmb, qo, domain)
                                  qmb[qo] = 0 as u8
                                  let qseq: i64 = nx_mbox_append(prefix, qmb, msg, mlen, sys_now_us())
                                  if qseq >= 0 {
                                      var fb8: i64 = sd_cat(frag, 0, "QUEUED-EXTERNAL seq=" as *u8)
                                      fb8 = sd_catn(frag, fb8, qseq)
                                      fb8 = sd_cat(frag, fb8, " (external relay not armed yet; queued durably, nothing pretended)" as *u8)
                                      o = epd_resp(out, "200 OK" as *u8, "text/plain" as *u8, frag, fb8)
                                      sent = 1
                                  }
                              }
                          } } }
                      }
                  }
                  if sent == 0 {
                      let fb9: i64 = sd_cat(frag, 0, "send failed" as *u8)
                      o = epd_resp(out, "400 Bad Request" as *u8, "text/plain" as *u8, frag, fb9)
                  }
              } else { if sd_starts(path, pn, "/mail/whoami" as *u8) == 1 {
                  var fbw: i64 = sd_cat(frag, 0, "{\"handle\":\"" as *u8)
                  fbw = wm_esc(frag, fbw, shand, shn0)
                  fbw = sd_cat(frag, fbw, "\",\"mailbox\":\"" as *u8)
                  fbw = sd_cat(frag, fbw, mbox)
                  fbw = sd_cat(frag, fbw, "\"}" as *u8)
                  o = epd_resp(out, "200 OK" as *u8, "application/json" as *u8, frag, fbw)
              } else {
                  let fbn: i64 = sd_cat(frag, 0, "<p class=f>No such mail route.</p>" as *u8)
                  o = epd_resp(out, "404 Not Found" as *u8, "text/html; charset=utf-8" as *u8, frag, fbn)
              } } } } }
      } else { o = sd_emit_401_json(out) }
  } else { o = epd_shell(domain, out) } } }
  return o
911}
912
913func main(argc: i64, argv: *i64) -> i64 {
  if argc < 8 { sys_write(2, "usage: nx_email_portal_daemon <port> <keysfile> <storefile> <realm> <domain> <mailprefix> <budget>\n" as *u8, 100); return 1 }
  let port: i64 = sd_atoi(argv[1] as *u8)
  let keysfile: *u8 = argv[2] as *u8
  let storefile: *u8 = argv[3] as *u8
  let realm: *u8 = argv[4] as *u8
  let domain: *u8 = argv[5] as *u8
  let prefix: *u8 = argv[6] as *u8
  let budget: i64 = sd_atoi(argv[7] as *u8)
  let realm_n: i64 = sd_len(realm)
923
  // ensure the mail store dir exists (prefix = "<dir>/"): mkdir the dir part, EEXIST is fine.
  let dirbuf: *u8 = sys_mmap(512)
  var dn: i64 = 0
  while prefix[dn] != (0 as u8) { dirbuf[dn] = prefix[dn]; dn = dn + 1 }
  if dn > 0 { if (dirbuf[dn - 1] as i64) == 47 { dirbuf[dn - 1] = 0 as u8 } }
  sys_mkdir(dirbuf, 511)
930
  // fail-fast: arm the realm context at startup (Rule 20), exactly like the doc portal
  let oprf_seed: *u8 = sys_mmap(32)
  let akp: *u8 = sys_mmap(32)
  let akb: *u8 = sys_mmap(33)
  let edp: *u8 = sys_mmap(32)
  let edb: *u8 = sys_mmap(32)
  if nx_uas_server_keys_load_or_init(keysfile, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { sys_write(2, "FATAL: server-key bundle\n" as *u8, 24); return 2 }
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, storefile as i64, oprf_seed, edp, edb, 900, EPD_MAGIC_8192, 1, 1, 5, 1) != NX_MAUTH_OK { sys_write(2, "FATAL: context init\n" as *u8, 20); return 3 }
940
  let addr: *u8 = sys_mmap(16)
  if nx_http_server_addr_loopback(addr, port) != 16 { sys_write(2, "FATAL: addr_loopback != 16\n" as *u8, 27); return 4 }
  let lv: *i64 = sys_mmap(8) as *i64
  let lfd: i64 = nx_http_server_listen(addr, 64, lv)
  if lfd < 0 { sys_write(2, "FATAL: listen failed (port busy or denied)\n" as *u8, 43); return 4 }
  sys_write(1, "nx_email_portal_daemon listening loopback (mail.<domain> behind the SNI router)\n" as *u8, 81)
947
  let req: *u8 = sys_mmap(EPD_REQCAP)
  let out: *u8 = sys_mmap(EPD_OUTCAP)
  var served: i64 = 0
  while served < budget {
      let av: *i64 = sys_mmap(8) as *i64
      let cfd: i64 = nx_http_server_accept_one(lfd, av)
      if cfd < 0 { served = served + 1 }
      if cfd >= 0 {
          let om: *i64 = sys_mmap(8) as *i64
          let opo: *i64 = sys_mmap(8) as *i64
          let opl: *i64 = sys_mmap(8) as *i64
          let ocl: *i64 = sys_mmap(8) as *i64
          let obo: *i64 = sys_mmap(8) as *i64
          let orn: *i64 = sys_mmap(8) as *i64
          let rrc: i64 = nx_http_server_read_request(cfd, req, EPD_REQCAP, om, opo, opl, ocl, obo, orn)
          if rrc == NXS_OK {
              let oN: i64 = epd_handle(ctx, domain, prefix, req, orn[0], out)
              nx_http_server_send_response_nokeep_close(cfd, out, oN)
          }
          sys_close(cfd)
          served = served + 1
      }
  }
  sys_close(lfd)
  return 0
973}
nx_email_portal_daemon.nx source

`nx_email_portal_daemon.nx` source
