nx_office_daemon.nx source

1// nx_office_daemon.nx -- the DEPLOYABLE Nishi Office daemon (ops shell around the gated pure core nx_office_serve). 2// Binds 0.0.0.0:8030 (LAN-reachable on the NAS); files live under CWD "office/". Route /office -> this port on the 3// sovereign edge. R-AUTHZ: resolves the OPAQUE session (X-Nishi-Session header, or the `sess` form field on a 4// zero-JS POST) -> handle, and passes it to of_handle_auth so OWNED docs are ReBAC-gated while unowned docs stay 5// PUBLIC (non-breaking). FAIL-SAFE: if the auth ctx can't init, serve PUBLIC-only (owned docs lock, public work). 6// Build with --build-only; run deliberately. license_tier: ORIGINAL 7import "nx_office_serve.nx" 8import "nx_opaque_login.nx" // olg_ctx_setup / olg_whoami -- the SAME keys+realm the /login minter signs with 9 10const OD_PORT: i64 = 0x1f5e // 8030 11const OD_KEYS: *u8 = "opaque_keys.bin" 12const OD_ASTORE: *u8 = "opaque_store.log" 13const OD_IDX: *u8 = "nishi_uid_handle.tsv" // the login daemon's uid(hex)->handle index (authz keys off handle) 14 15func d_addr(out: *u8, port: i64) -> i64 { 16 out[0] = 2 as u8; out[1] = 0 as u8 17 out[2] = ((port >> 8) & 0xff) as u8; out[3] = (port & 0xff) as u8 18 out[4] = 0 as u8; out[5] = 0 as u8; out[6] = 0 as u8; out[7] = 0 as u8 19 var i: i64 = 8 20 while i < 16 { out[i] = 0 as u8; i = i + 1 } 21 return 0 22} 23 24func main() -> i64 { 25 let root: *u8 = "office" as *u8 26 let base: *u8 = "/office" as *u8 27 // authz tuples (officeauthz_*) live in the cwd (nishihost/), which this daemon's user (elderwesto) owns -- no 28 // mkdir needed. (knowledge/status/ is root-owned by relate, so an elderwesto write there would silently fail.) 29 // AUTH ctx -- FAIL-SAFE: on failure serve PUBLIC-only (owned docs stay locked = safe, public docs still work). 30 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 31 var auth_off: i64 = 0 32 if olg_ctx_setup(ctx, OD_KEYS, OD_ASTORE, "nishi_site_admin" as *u8, 16, "Nishi site admin" as *u8, 16, 256, 2, 1) != 0 { 33 auth_off = 1 34 p("NX-OFFICE-DAEMON auth ctx unavailable -> PUBLIC-ONLY mode (owned docs locked)\n" as *u8) 35 } 36 let addr: *u8 = sys_mmap(16) 37 d_addr(addr, OD_PORT) 38 let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0) 39 if lfd < 0 { p("NX-OFFICE-DAEMON socket FAILED -- fail loud\n" as *u8); return 1 } 40 let one: *i64 = (sys_mmap(8)) as *i64 41 one[0] = 1 42 sys_setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, one as *u8, 4) 43 if sys_bind(lfd, addr, 16) < 0 { p("NX-OFFICE-DAEMON bind 0.0.0.0:8030 FAILED (port busy?) -- fail loud\n" as *u8); return 1 } 44 if sys_listen(lfd, 16) < 0 { p("NX-OFFICE-DAEMON listen FAILED -- fail loud\n" as *u8); return 1 } 45 p("NX-OFFICE-DAEMON serving http://0.0.0.0:8030/ root=office/ AUTHZ=nx_rebac (accept loop)\n" as *u8) 46 47 let reqb: *u8 = sys_mmap(262144) 48 let resb: *u8 = sys_mmap(1048576) 49 let hbuf: *u8 = sys_mmap(256) 50 let tokb: *u8 = sys_mmap(600) 51 let uid: *u8 = sys_mmap(64) 52 let uidn: *i64 = sys_mmap(16) as *i64 53 var go: i64 = 1 54 while go == 1 { 55 let cfd: i64 = sys_accept(lfd) 56 if cfd >= 0 { 57 let rn: i64 = of_read_req(cfd, reqb, 262144) 58 if rn > 0 { 59 hbuf[0] = 0 as u8; tokb[0] = 0 as u8 60 if auth_off == 0 { 61 // session token: X-Nishi-Session header (curl/API + a future JS bootstrap), else the `sess` 62 // form field (zero-JS POST). Invalid/absent -> empty handle -> of_handle_auth open mode. 63 of_hdr_get(reqb, rn, "X-Nishi-Session:" as *u8, tokb, 600) 64 if tokb[0] == (0 as u8) { 65 var bs2: i64 = 0 - 1 66 var jj: i64 = 0 67 while jj + 3 < rn { 68 if reqb[jj] == (13 as u8) { if reqb[jj+1] == (10 as u8) { if reqb[jj+2] == (13 as u8) { if reqb[jj+3] == (10 as u8) { bs2 = jj + 4; jj = rn } } } } 69 jj = jj + 1 70 } 71 if bs2 >= 0 { of_form_get((reqb as i64 + bs2) as *u8, rn - bs2, "sess" as *u8, tokb, 600) } 72 } 73 if tokb[0] != (0 as u8) { 74 if olg_whoami(ctx, tokb, of_slen(tokb), sys_now_realtime_sec(), uid, 64, uidn) == NX_MAUTH_OK { 75 rb_resolve_handle(OD_IDX, uid, uidn[0], hbuf, 256) 76 } 77 } 78 } 79 let on: i64 = of_handle_auth(root, base, reqb, rn, resb, 1048576, hbuf, OF_AUTHZ, tokb) 80 if on > 0 { of_write_all(cfd, resb, on) } 81 } 82 sys_close(cfd) 83 } 84 } 85 return 0 86}