nx_mgmt_session_mint.nx source
↩ module page · 21 lines · 1414 B
1// nx_mgmt_session_mint.nx -- CLI over nx_session_mint_lib: mint an M5 no-cookie session token (the X-Nishi-Session
2// credential) from a server KEY BUNDLE, for a realm + handle, WITHOUT the OPAQUE passphrase. Sovereign equivalent of
3// what /login issues on a correct password -- used to SELF-AUTHORIZE the mgmt control plane from the NAS-resident
4// signing key (operator-authorized 2026-07-08: "mint a session from the NAS key"; strictly less power than the sudo
5// already granted). uid_hash = SHA256(realm|||handle); if that handle is admin in the roles registry, the session is
6// PRIVILEGED. CLI: nx_mgmt_session_mint <keysfile> <realm> <handle> <ttl_s> -> prints base64(token) on stdout.
7import "nx_session_mint_lib.nx" // msm_mint_b64, msm_slen, msm_atoi
8
9func main(argc: i64, argv: *i64) -> i64 {
10 if argc < 5 { sys_write(2, "usage: nx_mgmt_session_mint <keysfile> <realm> <handle> <ttl_s>\n" as *u8, 63); return 1 }
11 let keysfile: *u8 = argv[1] as *u8
12 let realm: *u8 = argv[2] as *u8
13 let handle: *u8 = argv[3] as *u8
14 let ttl: i64 = msm_atoi(argv[4] as *u8)
15 let now: i64 = sys_now_realtime_sec()
16 let b64: *u8 = sys_mmap(512)
17 let blen: i64 = msm_mint_b64(keysfile, realm, msm_slen(realm), handle, msm_slen(handle), now, ttl, b64)
18 if blen < 0 { sys_write(2, "MINT-FAIL\n" as *u8, 10); return 2 }
19 sys_write(1, b64, blen); sys_write(1, "\n" as *u8, 1)
20 return 0
21}