nx_library_gate_handle.nx source

1// nx_library_gate_handle.nx -- the LOGIN-GATE for /library on the live sites daemon (operator 2026-06-13: 2// login-gate FIRST, then deploy). A dynamic handler the daemon calls for GET /library (mirrors the 3// nx_wiki_queue_handle dispatch pattern): extract the OPAQUE session token from the request 4// "X-Nishi-Session: <hex>" header, validate it (nx_ncs_validate_token, Ed25519), and: 5// valid -> serve the worldwide scholarly library (knowledge/library.html) as 200 (SERVED=0) 6// absent/forged/expired -> 302 -> /wiki/login (REDIRECT=1); data NEVER served unauthenticated. 7// Library (no main) so the daemon imports it + one dispatch line. license_tier: ORIGINAL 8import "nx_syscalls.nx" 9import "nx_ed25519_signature.nx" 10import "hub/nx_no_cookie_session.nx" 11const LG_MAGIC_262144: i64 = 262144 12const LG_MAGIC_262143: i64 = 262143 13 14const LG_SERVED: i64 = 0 15const LG_REDIRECT: i64 = 1 16const LG_TOKBYTES: i64 = 152 17 18func lg_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 19func lg_contains(hay: *u8, hlen: i64, needle: *u8) -> i64 { 20 let nl: i64 = lg_strlen(needle); var i: i64=0 21 while i+nl<=hlen { var q: i64=0; var ok: i64=1; while q<nl { if hay[i+q]!=needle[q]{ok=0;q=nl} q=q+1 } if ok==1{return i} i=i+1 } 22 return 0-1 23} 24func lg_hexval(c: i64) -> i64 { 25 if c>=48 { if c<=57 { return c-48 } } 26 if c>=97 { if c<=102 { return c-87 } } 27 if c>=65 { if c<=70 { return c-55 } } 28 return 0-1 29} 30// decode up to LG_TOKBYTES hex bytes from hay[off..] into tok; return bytes decoded 31func lg_hexdecode(hay: *u8, off: i64, hlen: i64, tok: *u8) -> i64 { 32 var i: i64=off; var b: i64=0 33 var go: i64=1 34 while go==1 { 35 if b>=LG_TOKBYTES { go=0 } 36 if go==1 { 37 if i+1>=hlen { go=0 } else { 38 let h: i64=lg_hexval(hay[i] as i64) 39 let l: i64=lg_hexval(hay[i+1] as i64) 40 if h<0 { go=0 } else { if l<0 { go=0 } else { tok[b]=((h*16)+l) as u8; b=b+1; i=i+2 } } 41 } 42 } 43 } 44 return b 45} 46func lg_app(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){dst[off+i]=s[i];i=i+1} return off+lg_strlen(s) } 47func lg_readfile(path: *u8, buf: *u8, cap: i64) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0{return 0} var tot: i64=0; var r: i64=1; while r>0 { let d: *u8=((buf as i64)+tot) as *u8; r=sys_read(fd,d,cap-tot); if r>0{tot=tot+r} } sys_close(fd); return tot } 48func lg_wn(dst: *u8, off: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48;k=1} while m>0{t[k]=48+(m%10);m=m/10;k=k+1} var i: i64=0; while i<k{dst[off+i]=t[k-1-i];i=i+1} return off+k } 49 50// the gate. server_pub_32 = the daemon's Ed25519 public key; now = unix seconds; libpath = host 51// path to library.html. Returns LG_SERVED (filled 200+body) or LG_REDIRECT (filled 302). 52func nx_library_gate_handle(req: *u8, reqn: i64, server_pub_32: *u8, now: i64, libpath: *u8, out: *u8, cap: i64, out_n: *i64) -> i64 { 53 var authed: i64 = 0 54 let hpos: i64 = lg_contains(req, reqn, "X-Nishi-Session: " as *u8) 55 if hpos >= 0 { 56 let tok: *u8 = sys_mmap(LG_TOKBYTES) 57 let nb: i64 = lg_hexdecode(req, hpos + 17, reqn, tok) 58 if nb == LG_TOKBYTES { 59 let v: i64 = nx_ncs_validate_token(server_pub_32, tok, now, 0 as *u8, 0 as *u8) 60 if v == 0 { authed = 1 } 61 } 62 } 63 if authed == 1 { 64 let body: *u8 = sys_mmap(LG_MAGIC_262144) 65 let bn: i64 = lg_readfile(libpath, body, LG_MAGIC_262143) 66 var o: i64 = 0 67 o = lg_app(out, o, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: " as *u8) 68 o = lg_wn(out, o, bn) 69 o = lg_app(out, o, "\r\nCache-Control: private, no-store\r\nConnection: keep-alive\r\n\r\n" as *u8) 70 var i: i64 = 0 71 while i < bn { out[o+i]=body[i]; i=i+1 } 72 o = o + bn 73 out_n[0] = o 74 return LG_SERVED 75 } 76 var o2: i64 = 0 77 o2 = lg_app(out, o2, "HTTP/1.1 302 Found\r\nLocation: /wiki/login\r\nContent-Length: 0\r\nConnection: keep-alive\r\n\r\n" as *u8) 78 out_n[0] = o2 79 return LG_REDIRECT 80}