nx_lan_signup_daemon.nx source

1// nx_lan_signup_daemon.nx -- the FAMILY SIGNUP + HR ADMIN surface, served (by the Nishi Publisher) ONLY to the LAN. 2// SEPARATE & additive: it does NOT touch the live public login daemon (whose registration stays CLOSED). Thin main 3// over the shared router nx_lan_signup_routes (lsd_route) -- the routes + gating are documented there; the socket 4// referee (nx_lan_signup_socket_gate) drives the SAME lsd_route over a real loopback socket (rule #15 DRY). 5// 6// Routes (each LAN-gated by the real accept() peer IP, never a spoofable header): 7// POST /register -> ls_signup_allowed (LAN AND invited) -> OPAQUE register -> hra_claim ; else 403 8// GET /hr -> owner-gated roster console (hap_emit) ; non-owner/non-LAN -> stub 9// POST /hr/invite -> owner-only: hra_invite ; POST /hr/suspend -> owner-only: hra_suspend 10// Run with the SAME server-keys path + realm (nishi_site_admin) as the hub /login daemon so session tokens validate. 11// 12// argv: [1]=port [2]=keys [3]=opaque-store [4]=budget [5]=hr-store [6]=realm(opt, default nishi_site_admin) [7]=argon2_m(opt) 13// One binary serves every property: run with [6]=andelinwest_admin + andelinwest's own keys + andelinwest_hr.log. 14import "nx_lan_signup_routes.nx" // lsd_route / lsd_atoi / lsd_slen / LSD_REALM / LSD_REALM_N 15import "nx_opaque_login.nx" // olg_ctx_setup + NxAuthContext 16import "nx_lan_signup.nx" // ls_ip4_from_sockaddr 17const LSD_MAGIC_16384: i64 = 16384 18const LSD_MAGIC_16383: i64 = 16383 19 20const LSD_PROD_M: i64 = 65536 21 22func main(argc: i64, argv: *i64) -> i64 { 23 if argc < 6 { 24 let um: *u8 = "usage: nx_lan_signup_daemon <port> <keys> <opaque-store> <budget> <hr-store> [realm] [argon2_m]\n" as *u8 25 sys_write(1, um, lsd_slen(um)) 26 sys_exit(2); return 2 27 } 28 let port: i64 = lsd_atoi(argv[1] as *u8) 29 let keys_path: *u8 = argv[2] as *u8 30 let store_path: *u8 = argv[3] as *u8 31 let budget: i64 = lsd_atoi(argv[4] as *u8) 32 let hr_store: *u8 = argv[5] as *u8 33 var realm: *u8 = LSD_REALM; var realm_n: i64 = LSD_REALM_N // argv[6] overrides -> serve any property (andelinwest) 34 if argc > 6 { realm = argv[6] as *u8; realm_n = lsd_slen(realm) } 35 var m_cost: i64 = LSD_PROD_M 36 if argc > 7 { m_cost = lsd_atoi(argv[7] as *u8) } 37 38 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 39 if olg_ctx_setup(ctx, keys_path, store_path, realm, realm_n, "Nishi family signup" as *u8, 19, m_cost, 3, 4) != 0 { 40 sys_write(1, "CTX-INIT-FAIL\n" as *u8, 14); sys_exit(1); return 1 41 } 42 43 let addr: *u8 = sys_mmap(16) 44 addr[0]=2 as u8; addr[1]=0 as u8 45 addr[2]=((port>>8)&0xff) as u8; addr[3]=(port&0xff) as u8 46 var zi: i64=4; while zi<16 { addr[zi]=0 as u8; zi=zi+1 } 47 let lfd: i64 = sys_socket(2, 1, 0) 48 if lfd < 0 { sys_write(1, "SOCKET-FAIL\n" as *u8, 12); sys_exit(1); return 1 } 49 let optv: *u8 = sys_mmap(4); optv[0]=1 as u8 50 sys_setsockopt(lfd, 1, 2, optv, 4) 51 if sys_bind(lfd, addr, 16) < 0 { sys_write(1, "BIND-FAIL\n" as *u8, 10); sys_exit(1); return 1 } 52 if sys_listen(lfd, 16) < 0 { sys_write(1, "LISTEN-FAIL\n" as *u8, 12); sys_exit(1); return 1 } 53 sys_write(1, "LAN-SIGNUP-UP\n" as *u8, 14) 54 55 let paddr: *u8 = sys_mmap(16) 56 let palen: *i64 = sys_mmap(8) as *i64 57 var served: i64 = 0 58 while served < budget { 59 palen[0] = 16 60 let cfd: i64 = sys_accept_with_addr(lfd, paddr, palen) 61 if cfd >= 0 { 62 sys_set_socket_timeout(cfd, 5) 63 let ip4: *u8 = sys_mmap(8) 64 ls_ip4_from_sockaddr(paddr, ip4) 65 let req: *u8 = sys_mmap(LSD_MAGIC_16384) 66 let rn: i64 = sys_read(cfd, req, LSD_MAGIC_16383) 67 if rn > 0 { 68 let he: i64 = lsd_find(req, rn, "\r\n\r\n" as *u8, 4) 69 var body: *u8 = req; var bn: i64 = 0 70 if he >= 0 { body = ((req as i64) + he + 4) as *u8; bn = rn - he - 4 } 71 let now: i64 = sys_now_realtime_sec() 72 lsd_route(ctx, realm, realm_n, ip4, req, rn, he, body, bn, now, hr_store, cfd) 73 } 74 sys_close(cfd) 75 } 76 served = served + 1 77 } 78 sys_close(lfd); sys_exit(0); return 0 79}