nx_hr_admin.nx source
↩ module page · 42 lines · 3127 B
1// nx_hr_admin.nx -- CUTOVER (operator: "drive the cutover" off TSV): now a THIN COMPAT-SHIM that delegates the hra_*
2// API to nx_hr_sov (the sovereign nx_seg_store + canon HR directory). The API is byte-stable, so the daemons,
3// nx_hr_entitle, nx_hr_access, the provisioner, and every gate keep their CALLS -- only the STORAGE is now sovereign
4// (no tsv [[feedback-no-3rd-party-tsv-sovereign-store]]). The `store` param is now a seg_store PREFIX. The BASE nx_hr
5// (TAB-log) is LEFT untouched for torrent (nx_torrent_authn uses hr_resolve_level directly) -> NO sibling breakage.
6// seg_store auto-derives a unique commit id from the record content, so the hra_* API needs no segid (true drop-in).
7import "nx_hr_sov.nx" // hrs_* (seg_store-backed HR directory)
8import "nx_syscalls.nx"
9
10const HRA_LVL_OWNER: i64 = 3
11const HRA_LVL_MEMBER: i64 = 1
12const HRA_LVL_NONE: i64 = 0
13const HRA_ST_NONE: i64 = 0
14const HRA_ST_ACTIVE: i64 = 1
15const HRA_ST_SUSPENDED: i64 = 2
16const HRA_ST_INVITED: i64 = 3
17
18// ENROLL active (added to the shim so callers can set up the store via the hra_* API, seg_store-consistent).
19func hra_enroll(store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, level: i64, family: *u8, ts: i64, actor: *u8, out_cid: *u8) -> i64 {
20 return hrs_enroll(store, realm, realm_n, handle, hn, level, family, ts, actor, out_cid)
21}
22// INVITE a person by handle (status=invited, no access until claimed).
23func hra_invite(store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, level: i64, family: *u8, ts: i64, actor: *u8, out_cid: *u8) -> i64 {
24 return hrs_invite(store, realm, realm_n, handle, hn, level, family, ts, actor, out_cid)
25}
26// CLAIM an invite (invited -> active@level). returns the claimed level, 0 if not invited.
27func hra_claim(store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, family: *u8, ts: i64, actor: *u8) -> i64 {
28 return hrs_claim(store, realm, realm_n, handle, hn, family, ts, actor)
29}
30// SUSPEND by handle (-> level 0).
31func hra_suspend(store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64, family: *u8, ts: i64, actor: *u8) -> i64 {
32 let cid: *u8=sys_mmap(96); if hrs_cred_id(realm, realm_n, handle, hn, cid) <= 0 { return 1 }
33 return hrs_suspend(store, cid, handle, family, ts, actor)
34}
35// THE RESOLVER (level if active, else 0) -- by cred_id. cidlen kept for API compat (seg_store keys by NUL-term cred).
36func hra_resolve_level(store: *u8, cred_id: *u8, cidlen: i64) -> i64 { return hrs_resolve_level(store, cred_id) }
37// 1 iff the latest record for (realm,handle) is INVITED.
38func hra_is_invited(store: *u8, realm: *u8, realm_n: i64, handle: *u8, hn: i64) -> i64 { return hrs_is_invited(store, realm, realm_n, handle, hn) }
39// 1 iff the user (by cred_id) is an ACTIVE superadmin (owner, lvl>=3). cidlen kept for API compat.
40func hra_is_superadmin(store: *u8, cred_id: *u8, cidlen: i64) -> i64 { return hrs_is_superadmin(store, cred_id) }
41// ROSTER count: distinct cred_ids whose LATEST status == want_status (HRA_ST_ACTIVE/INVITED).
42func hra_roster_count(store: *u8, want_status: i64) -> i64 { return hrs_roster_count(store, want_status) }