code wiki / _hdl_build / nx_project_serve.nx
`nx_project_serve.nx` source

↩ module page · 746 lines · 33373 B
1// nx_project_serve.nx -- the /project GATEWAY core (pure request->response; sockets live in the _daemon
2// wrapper, the gate drives THIS core with real tokens and no sockets -- the relate_serve idiom).
3// Sits behind the sites.elf proxy row `nishifamily.com /project 8028 gated` (fail-closed 302 on down).
4// Per request: resolve the OPAQUE no-cookie X-Nishi-Session token -> uid (olg_whoami, realm
5// nishi_site_admin, the SAME keys/store the /login minter uses) -> handle (uid-hex over the login
6// daemon's index file) -> person (data-driven map rows in serve.conf) -> the ROLE-SCOPED project page
7// via pj_html_build (owner/team all tasks, contractor own-only, non-member 403 DENY -- fail-closed).
8// Token-less top-level navigation -> the sessionStorage bootstrap (a bare 302 would loop: no-cookie navs
9// carry no header). Present-but-invalid token -> 302 /login. /project/demo -> the public demo tenant.
10// serve.conf (hot, per-request): `store <prefix>` `pid <id>` `demo <person>` `map <handle> <person>`.
11// license_tier: ORIGINAL
12import "nx_opaque_login.nx"
13import "nx_hub_gw_decide.nx"
14import "nx_site_lock_lib.nx"
15import "nx_project.nx"
16const PSV_MAGIC_719468: i64 = 719468
17const PSV_MAGIC_146097: i64 = 146097
18const PSV_MAGIC_146096: i64 = 146096
19const PSV_MAGIC_1460: i64 = 1460
20const PSV_MAGIC_36524: i64 = 36524
21const PSV_MAGIC_86400: i64 = 86400
22const PSV_MAGIC_65536: i64 = 65536
23const PSV_MAGIC_8192: i64 = 8192
24const PSV_MAGIC_262144: i64 = 262144
25const PSV_MAGIC_1024: i64 = 1024
26const PSV_MAGIC_16384: i64 = 16384
27const PSV_MAGIC_131072: i64 = 131072
28const PSV_MAGIC_16400: i64 = 16400
29const PSV_MAGIC_16383: i64 = 16383
30
31const PSV_BOOTSTRAP: *u8 = "<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width, initial-scale=1'><title>Nishi Project</title></head><body><main style='max-width:48rem;margin:8vh auto;padding:1.5rem;font:1.1rem/1.6 system-ui,sans-serif'><h1>Nishi Project</h1><p id='project-status' role='status' aria-live='polite'>Opening your project…</p><button id='project-retry' type='button' hidden>Retry</button><details><summary>Release notes</summary><p>Session recovery · 8 September 2026. Access and connection failures retain your session. Sign-in returns to the project you requested.</p></details><noscript>Enable JavaScript to use the existing secure session handoff.</noscript></main><script>(function(){var status=document.getElementById('project-status');var retry=document.getElementById('project-retry');var destination=location.pathname+location.search+location.hash;function show(message){status.textContent=message;retry.hidden=false;retry.disabled=false}function signin(){location.assign('/login?return='+encodeURIComponent(destination))}async function load(){retry.disabled=true;retry.hidden=true;status.textContent='Opening your project…';var token;try{token=sessionStorage.getItem('nsess')}catch(e){show('Browser session storage is unavailable. Enable it for this site, then retry.');return}if(!token){signin();return}try{var r=await fetch(location.pathname+location.search,{headers:{'X-Nishi-Session':token},credentials:'omit',cache:'no-store',redirect:'manual'});if(r.type==='opaqueredirect'||r.status===401){signin();return}if(r.status===403){show('Access denied for this project. Your session has been kept. Ask the project owner to check your membership.');return}if(!r.ok){show('Project service returned HTTP '+r.status+'. Your session has been kept. Retry when the service is available.');return}if(!(r.headers.get('content-type')||'').toLowerCase().includes('text/html')){show('The project service returned an unexpected response. Your session has been kept.');return}var html=await r.text();if(!html){show('The project service returned an empty page. Your session has been kept.');return}document.open();document.write(html);document.close()}catch(e){show('Unable to reach the project service. Your session has been kept. Check your connection and retry.')}}retry.addEventListener('click',load);return load()})();</script></body></html>"
32const PSV_DENY: *u8 = "<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><title>Nishi Project - no access</title></head><body><h1>Not a member of this project</h1><p>Your login is valid, but this account has no membership record on the project. Ask the project owner to add you.</p><p><a href='/login'>switch account</a></p></body></html>"
33
34// leak-free bounded read into a REUSED caller buffer; returns bytes (>=0) or -1 (hub gw discipline)
35func ps_read_file(path: *u8, out: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var total: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let base: i64 = out as i64
      let tail: *u8 = (base + total) as *u8
      let nr: i64 = sys_read(fd, tail, cap - total)
      if nr <= 0 { go = 0 }
      if nr > 0 { total = total + nr }
      if total >= cap { go = 0 }
  }
  sys_close(fd)
  return total
50}
51
52func ps_hex(dst: *u8, off: i64, src: *u8, n: i64) -> i64 {
  let hx: *u8 = "0123456789abcdef" as *u8
  var o: i64 = off
  var i: i64 = 0
  while i < n {
      let c: i64 = (src[i] as i64) & 0xff
      dst[o] = hx[(c >> 4) & 15]
      dst[o + 1] = hx[c & 15]
      o = o + 2
      i = i + 1
  }
  return o
64}
65
66// uidhex -> handle from the login daemon's index (field0=uidhex field1=handle); returns handle len or 0
67func ps_idx_lookup(idxbuf: *u8, idxlen: i64, uidhex: *u8, uxn: i64, out_h: *u8) -> i64 {
  let fs: *i64 = sys_mmap(8) as *i64
  let fe: *i64 = sys_mmap(8) as *i64
  var ls: i64 = 0
  var found: i64 = 0
  while ls < idxlen {
      let le: i64 = slk_line_end(idxbuf, idxlen, ls)
      if found == 0 { if le > ls { if idxbuf[ls] != (35 as u8) {
          if slk_field(idxbuf, ls, le, 0, fs, fe) == 1 {
              if slk_eq(slk_at(idxbuf, fs[0]), fe[0] - fs[0], uidhex, uxn) == 1 {
                  if slk_field(idxbuf, ls, le, 1, fs, fe) == 1 {
                      var o: i64 = 0
                      let hl: i64 = fe[0] - fs[0]
                      while o < hl { if o < 127 { out_h[o] = idxbuf[fs[0] + o] } o = o + 1 }
                      out_h[o] = 0 as u8
                      found = hl
                  }
              }
          }
      } } }
      ls = le + 1
  }
  return found
90}
91
92// conf pair: first line `<key> <v1> <v2>` -> both tokens; 1 if found (e.g. `demo <pid> <person>`)
93func ps_conf_pair(b: *u8, n: i64, key: *u8, out1: *u8, out2: *u8) -> i64 {
  out1[0] = 0 as u8
  out2[0] = 0 as u8
  let t0: *u8 = sys_mmap(128)
  var i: i64 = 0
  var found: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if b[e] == (10 as u8) { go = 0 } else { e = e + 1 }
          }
      }
      if found == 0 {
          var p: i64 = pj_tok(b, i, e, t0, 128)
          if pj_eq(t0, key) == 1 {
              p = pj_tok(b, p, e, out1, 128)
              p = pj_tok(b, p, e, out2, 128)
              if out1[0] != (0 as u8) { if out2[0] != (0 as u8) { found = 1 } }
          }
      }
      i = e + 1
  }
  return found
118}
119
120// project row `project <pid> <store-prefix>` -> store prefix for pid; 1 if found
121func ps_proj_store(b: *u8, n: i64, pid: *u8, out: *u8, cap: i64) -> i64 {
  out[0] = 0 as u8
  let t0: *u8 = sys_mmap(128)
  let t1: *u8 = sys_mmap(128)
  var i: i64 = 0
  var found: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if b[e] == (10 as u8) { go = 0 } else { e = e + 1 }
          }
      }
      if found == 0 {
          var p: i64 = pj_tok(b, i, e, t0, 128)
          if pj_eq(t0, "project" as *u8) == 1 {
              p = pj_tok(b, p, e, t1, 128)
              if pj_eq(t1, pid) == 1 {
                  p = pj_tok(b, p, e, out, cap)
                  if out[0] != (0 as u8) { found = 1 }
              }
          }
      }
      i = e + 1
  }
  return found
148}
149
150// pid charset guard: 1..40 of [a-z0-9_-] (fail-closed; the path segment is caller data)
151func ps_pid_ok(s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) {
      let c: i64 = s[i] as i64
      var okc: i64 = 0
      if c >= 97 { if c <= 122 { okc = 1 } }
      if c >= 48 { if c <= 57 { okc = 1 } }
      if c == 95 { okc = 1 }
      if c == 45 { okc = 1 }
      if okc == 0 { return 0 }
      i = i + 1
  }
  if i < 1 { return 0 }
  if i > 40 { return 0 }
  return 1
166}
167
168// the PICKER page: every `project` conf row where person is a member -> a link card.
169// returns page len, or -2 when person belongs to no project (deny).
170func ps_picker(confbuf: *u8, cl: i64, person: *u8, hb: *u8) -> i64 {
  let t0: *u8 = sys_mmap(128)
  let t1: *u8 = sys_mmap(128)
  let t2: *u8 = sys_mmap(256)
  var o: i64 = 0
  o = pj_head(hb, o, "Nishi Projects" as *u8)
  o = pj_cat(hb, o, "<h1>Nishi Projects</h1><p class='meta'>signed in as " as *u8)
  o = pj_cat(hb, o, person)
  o = pj_cat(hb, o, " - you see only projects where you hold a membership record</p>" as *u8)
  var nproj: i64 = 0
  var i: i64 = 0
  while i < cl {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= cl { go = 0 } else {
              if confbuf[e] == (10 as u8) { go = 0 } else { e = e + 1 }
          }
      }
      var p: i64 = pj_tok(confbuf, i, e, t0, 128)
      if pj_eq(t0, "project" as *u8) == 1 {
          p = pj_tok(confbuf, p, e, t1, 128)
          p = pj_tok(confbuf, p, e, t2, 256)
          if t1[0] != (0 as u8) { if t2[0] != (0 as u8) {
              let stg: *i64 = pj_st_new()
              if pj_gather(t2, t1, stg) == 0 { if stg[12] == 1 {
                  let role: i64 = pj_roleof(stg, person)
                  if role != 0 {
                      o = pj_cat(hb, o, "<a class='card' href='/project/p/" as *u8)
                      o = pj_cat(hb, o, t1)
                      o = pj_cat(hb, o, "'>" as *u8)
                      o = pj_cat(hb, o, stg[14] as *u8)
                      o = pj_cat(hb, o, " <span class='meta'>(" as *u8)
                      o = pj_cat(hb, o, t1)
                      o = pj_cat(hb, o, " - your role: " as *u8)
                      o = pj_cat(hb, o, role as *u8)
                      o = pj_cat(hb, o, ")</span></a>" as *u8)
                      nproj = nproj + 1
                  }
              } }
          } }
      }
      i = e + 1
  }
  if nproj == 0 { return 0 - 2 }
  o = pj_foot(hb, o)
  return o
217}
218
219// map row `map <handle> <person>`; absent -> person = handle (natural handle==person default)
220func ps_map(b: *u8, n: i64, handle: *u8, out: *u8, cap: i64) -> i64 {
  let t0: *u8 = sys_mmap(128)
  let t1: *u8 = sys_mmap(128)
  var i: i64 = 0
  var found: i64 = 0
  while i < n {
      var e: i64 = i
      var go: i64 = 1
      while go == 1 {
          if e >= n { go = 0 } else {
              if b[e] == (10 as u8) { go = 0 } else { e = e + 1 }
          }
      }
      if found == 0 {
          var p: i64 = pj_tok(b, i, e, t0, 128)
          if pj_eq(t0, "map" as *u8) == 1 {
              p = pj_tok(b, p, e, t1, 128)
              if pj_eq(t1, handle) == 1 {
                  p = pj_tok(b, p, e, out, cap)
                  if out[0] != (0 as u8) { found = 1 }
              }
          }
      }
      i = e + 1
  }
  if found == 0 {
      var k: i64 = 0
      var go2: i64 = 1
      while go2 == 1 {
          out[k] = handle[k]
          if handle[k] == (0 as u8) { go2 = 0 } else { k = k + 1 }
      }
  }
  return found
254}
255
256// epoch-days -> civil (Howard Hinnant algorithm, mirrors the proven planner math)
257func ps_civil(z0: i64, out: *i64) -> i64 {
  var z: i64 = z0 + PSV_MAGIC_719468
  var era: i64 = z / PSV_MAGIC_146097
  if z < 0 { era = (z - PSV_MAGIC_146096) / PSV_MAGIC_146097 }
  let doe: i64 = z - era * PSV_MAGIC_146097
  let yoe: i64 = (doe - doe / PSV_MAGIC_1460 + doe / PSV_MAGIC_36524 - doe / PSV_MAGIC_146096) / 365
  let y0: i64 = yoe + era * 400
  let doy: i64 = doe - (365 * yoe + yoe / 4 - yoe / 100)
  let mp: i64 = (5 * doy + 2) / 153
  let d: i64 = doy - (153 * mp + 2) / 5 + 1
  var m: i64 = mp + 3
  if mp >= 10 { m = mp - 9 }
  var y: i64 = y0
  if m <= 2 { y = y0 + 1 }
  out[0] = y
  out[1] = m
  out[2] = d
  return 0
275}
276
277// LEAK ROOT-FIX 2026-08-17: this ran on EVERY request and did sys_mmap(32) per call, never unmapped --
278// one PAGE (4096B) leaked per request. Measured on the live daemon: worst_committed_kb creeping ~264KB
279// (=64 pages = 64 probe requests) per resmon beat, 2.55GB total, swap 690->720 permil. Scratch is now a
280// static pointer, mmapped ONCE on first use (the estate's sanctioned static-POINTER idiom) -- leak-free
281// by construction and one syscall cheaper per request.
282static ps_ymd_scratch: *i64
283
284func ps_today(out: *u8) -> i64 {
  let secs: i64 = sys_now_realtime_sec()
  let days: i64 = secs / PSV_MAGIC_86400
  if (ps_ymd_scratch as i64) == 0 { ps_ymd_scratch = sys_mmap(32) as *i64 }
  let ymd: *i64 = ps_ymd_scratch
  ps_civil(days, ymd)
  var o: i64 = 0
  o = pj_catn(out, o, ymd[0])
  out[o] = 45 as u8
  o = o + 1
  if ymd[1] < 10 { out[o] = 48 as u8; o = o + 1 }
  o = pj_catn(out, o, ymd[1])
  out[o] = 45 as u8
  o = o + 1
  if ymd[2] < 10 { out[o] = 48 as u8; o = o + 1 }
  o = pj_catn(out, o, ymd[2])
  out[o] = 0 as u8
  return o
302}
303
304// build a full HTTP response into resp; returns total bytes
305func ps_resp(resp: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 {
  var o: i64 = 0
  o = pj_cat(resp, o, "HTTP/1.1 " as *u8)
  o = pj_cat(resp, o, status)
  o = pj_cat(resp, o, "\r\nContent-Type: " as *u8)
  o = pj_cat(resp, o, ctype)
  o = pj_cat(resp, o, "\r\nContent-Length: " as *u8)
  o = pj_catn(resp, o, blen)
  o = pj_cat(resp, o, "\r\nConnection: close\r\nCache-Control: no-store\r\n\r\n" as *u8)
  var i: i64 = 0
  while i < blen { resp[o] = body[i]; o = o + 1; i = i + 1 }
  return o
317}
318
319func ps_redirect(resp: *u8, loc: *u8) -> i64 {
  var o: i64 = 0
  o = pj_cat(resp, o, "HTTP/1.1 302 Found\r\nLocation: " as *u8)
  o = pj_cat(resp, o, loc)
  o = pj_cat(resp, o, "\r\nContent-Length: 0\r\nConnection: close\r\nCache-Control: no-store\r\n\r\n" as *u8)
  return o
325}
326
327func ps_text(resp: *u8, status: *u8, msg: *u8) -> i64 {
  return ps_resp(resp, status, "text/plain; charset=utf-8" as *u8, msg, pj_slen(msg))
329}
330
331// ---- st slots: 0=ctx 1=confpath 2=idxpath 3=pagebuf 4=confbuf 5=idxbuf 6=tokbuf 7=pathbuf
332//      8=uid 9=uxbuf 10=handle 11=person 12=todaybuf 13=storebuf 14=pidbuf 15=demobuf 16=uidn ----
333func psv_st_new(ctx: *NxAuthContext, confpath: *u8, idxpath: *u8) -> *i64 {
  let st: *i64 = sys_mmap(8 * 20) as *i64
  st[0] = ctx as i64
  st[1] = confpath as i64
  st[2] = idxpath as i64
  st[3] = sys_mmap(PSV_MAGIC_65536)
  st[4] = sys_mmap(PSV_MAGIC_8192)
  st[5] = sys_mmap(PSV_MAGIC_262144)
  st[6] = sys_mmap(512)
  st[7] = sys_mmap(PSV_MAGIC_1024)
  st[8] = sys_mmap(64)
  st[9] = sys_mmap(160)
  st[10] = sys_mmap(128)
  st[11] = sys_mmap(128)
  st[12] = sys_mmap(32)
  st[13] = sys_mmap(256)
  st[14] = sys_mmap(128)
  st[15] = sys_mmap(128)
  st[16] = sys_mmap(16)
  return st
353}
354
355func psv_handle(st: *i64, req: *u8, rn: i64, resp: *u8) -> i64 {
  let path: *u8 = st[7] as *u8
  var pl: i64 = hgw_path(req, rn, path, PSV_MAGIC_1024)
  // strip the query string: the edge relays the FULL request-target (/project?b=x) and exact-match
  // routing would 404 it (found live: WebFetch cache-busters). '?' truncates.
  var qi: i64 = 0
  var qgo: i64 = 1
  while qgo == 1 {
      if qi >= pl { qgo = 0 } else {
          if path[qi] == (63 as u8) { path[qi] = 0 as u8; pl = qi; qgo = 0 } else { qi = qi + 1 }
      }
  }
  let confbuf: *u8 = st[4] as *u8
  let cl: i64 = ps_read_file(st[1] as *u8, confbuf, PSV_MAGIC_8192)
  if cl <= 0 { return ps_text(resp, "503 Service Unavailable" as *u8, "project portal not configured" as *u8) }
  let today: *u8 = st[12] as *u8
  ps_today(today)
  let pagebuf: *u8 = st[3] as *u8
  let storebuf: *u8 = st[13] as *u8
  // ---- /project/demo = the PUBLIC demo tenant (conf: `demo <pid> <person>`) ----
  var isdemo: i64 = 0
  if slk_eq(path, pl, "/project/demo" as *u8, 13) == 1 { isdemo = 1 }
  if slk_eq(path, pl, "/project/demo/" as *u8, 14) == 1 { isdemo = 1 }
  if isdemo == 1 {
      let dpid: *u8 = st[14] as *u8
      let dper: *u8 = st[15] as *u8
      if ps_conf_pair(confbuf, cl, "demo" as *u8, dpid, dper) == 0 { return ps_text(resp, "404 Not Found" as *u8, "no public demo configured" as *u8) }
      if ps_proj_store(confbuf, cl, dpid, storebuf, 256) == 0 { return ps_text(resp, "503 Service Unavailable" as *u8, "demo project not in conf" as *u8) }
      let dn: i64 = pj_html_build(storebuf, dpid, dper, today, pagebuf)
      if dn < 0 { return ps_text(resp, "503 Service Unavailable" as *u8, "demo unavailable" as *u8) }
      return ps_resp(resp, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, pagebuf, dn)
  }
  // ---- route shape: the picker root, or a per-project page /project/p/<pid> ----
  var isroot: i64 = 0
  if slk_eq(path, pl, "/project" as *u8, 8) == 1 { isroot = 1 }
  if slk_eq(path, pl, "/project/" as *u8, 9) == 1 { isroot = 1 }
  var ispage: i64 = 0
  if isroot == 0 { if pl > 11 { if pj_starts(path, "/project/p/" as *u8) == 1 { ispage = 1 } } }
  if isroot == 0 { if ispage == 0 { return ps_text(resp, "404 Not Found" as *u8, "not found" as *u8) } }
  // ---- session resolution (fail-closed; token-less nav gets the sessionStorage bootstrap) ----
  let tok: *u8 = st[6] as *u8
  let tl: i64 = hgw_hdr_val(req, rn, "X-Nishi-Session:" as *u8, 16, tok, 512)
  if tl == 0 { return ps_resp(resp, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, PSV_BOOTSTRAP, pj_slen(PSV_BOOTSTRAP)) }
  let ctx: *NxAuthContext = st[0] as *NxAuthContext
  let uid: *u8 = st[8] as *u8
  let uidn: *i64 = st[16] as *i64
  let handle: *u8 = st[10] as *u8
  var hl: i64 = 0
  let now: i64 = sys_now_realtime_sec()
  if olg_whoami(ctx, tok, tl, now, uid, 64, uidn) == NX_MAUTH_OK {
      let uxbuf: *u8 = st[9] as *u8
      let uxn: i64 = ps_hex(uxbuf, 0, uid, uidn[0])
      let idxbuf: *u8 = st[5] as *u8
      let il: i64 = ps_read_file(st[2] as *u8, idxbuf, PSV_MAGIC_262144)
      if il > 0 { hl = ps_idx_lookup(idxbuf, il, uxbuf, uxn, handle) }
  }
  if hl == 0 { return ps_redirect(resp, "/login?return=/project" as *u8) }
  let person: *u8 = st[11] as *u8
  ps_map(confbuf, cl, handle, person, 128)
  // ---- the PICKER: projects where this person holds a membership record ----
  if isroot == 1 {
      let kn: i64 = ps_picker(confbuf, cl, person, pagebuf)
      if kn >= 0 { return ps_resp(resp, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, pagebuf, kn) }
      return ps_resp(resp, "403 Forbidden" as *u8, "text/html; charset=utf-8" as *u8, PSV_DENY, pj_slen(PSV_DENY))
  }
  // ---- per-project page: /project/p/<pid> (unknown pid = 404, non-member = 403) ----
  let pidp: *u8 = ((path as i64) + 11) as *u8
  if ps_pid_ok(pidp) == 0 { return ps_text(resp, "404 Not Found" as *u8, "not found" as *u8) }
  if ps_proj_store(confbuf, cl, pidp, storebuf, 256) == 0 { return ps_text(resp, "404 Not Found" as *u8, "no such project" as *u8) }
  let n2: i64 = pj_html_build(storebuf, pidp, person, today, pagebuf)
  if n2 >= 0 { return ps_resp(resp, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, pagebuf, n2) }
  if n2 == 0 - 2 { return ps_resp(resp, "403 Forbidden" as *u8, "text/html; charset=utf-8" as *u8, PSV_DENY, pj_slen(PSV_DENY)) }
  return ps_text(resp, "503 Service Unavailable" as *u8, "project store unavailable" as *u8)
428}
429
430// ---------------- SELFTEST (socket-free; REAL tokens against fresh auto-init keys) ----------------
431func psv_req(dst: *u8, path: *u8, tok: *u8) -> i64 {
  var o: i64 = 0
  o = pj_cat(dst, o, "GET " as *u8)
  o = pj_cat(dst, o, path)
  o = pj_cat(dst, o, " HTTP/1.1\r\nHost: t\r\n" as *u8)
  if tok[0] != (0 as u8) {
      o = pj_cat(dst, o, "X-Nishi-Session: " as *u8)
      o = pj_cat(dst, o, tok)
      o = pj_cat(dst, o, "\r\n" as *u8)
  }
  o = pj_cat(dst, o, "\r\n" as *u8)
  return o
443}
444
445func psv_selftest() -> i64 {
  let uniq: i64 = sys_now_us()
  let base: *u8 = sys_mmap(256)
  var bo: i64 = 0
  bo = pj_cat(base, bo, "/tmp/psg_" as *u8)
  bo = pj_catn(base, bo, uniq)
  base[bo] = 0 as u8
  let keys: *u8 = sys_mmap(256)
  var o: i64 = pj_cat(keys, 0, base)
  o = pj_cat(keys, o, "_keys.bin" as *u8)
  keys[o] = 0 as u8
  let astore: *u8 = sys_mmap(256)
  o = pj_cat(astore, 0, base)
  o = pj_cat(astore, o, "_astore.log" as *u8)
  astore[o] = 0 as u8
  let idxf: *u8 = sys_mmap(256)
  o = pj_cat(idxf, 0, base)
  o = pj_cat(idxf, o, "_idx.tsv" as *u8)
  idxf[o] = 0 as u8
  let conff: *u8 = sys_mmap(256)
  o = pj_cat(conff, 0, base)
  o = pj_cat(conff, o, "_serve.conf" as *u8)
  conff[o] = 0 as u8
  let planf: *u8 = sys_mmap(256)
  o = pj_cat(planf, 0, base)
  o = pj_cat(planf, o, "_plan.txt" as *u8)
  planf[o] = 0 as u8
  let projf: *u8 = sys_mmap(256)
  o = pj_cat(projf, 0, base)
  o = pj_cat(projf, o, "_proj.txt" as *u8)
  projf[o] = 0 as u8
  let prefix: *u8 = sys_mmap(256)
  o = pj_cat(prefix, 0, base)
  o = pj_cat(prefix, o, "_stA-" as *u8)
  prefix[o] = 0 as u8
  let prefB: *u8 = sys_mmap(256)
  o = pj_cat(prefB, 0, base)
  o = pj_cat(prefB, o, "_stB-" as *u8)
  prefB[o] = 0 as u8
  let planb: *u8 = sys_mmap(256)
  o = pj_cat(planb, 0, base)
  o = pj_cat(planb, o, "_planb.txt" as *u8)
  planb[o] = 0 as u8
  let projb: *u8 = sys_mmap(256)
  o = pj_cat(projb, 0, base)
  o = pj_cat(projb, o, "_projb.txt" as *u8)
  projb[o] = 0 as u8
  let outf: *u8 = sys_mmap(256)
  o = pj_cat(outf, 0, base)
  o = pj_cat(outf, o, "_run.out" as *u8)
  outf[o] = 0 as u8
496
  pj_wfile(planf, "TASK fence f0 amber 2026-07-01 30 1 - permits\nTASK fence f1 amber 2026-07-20 200 3 - posts\nTASK fence f2 bo 2026-07-18 100 4 - rails\nTASK fence f3 bo 2026-07-19 80 2 f2 gates\nDONE fence f1 2026-07-08\n" as *u8)
  pj_wfile(projf, "PROJ fence elder fence-build\nMEMBER fence amber team 240\nMEMBER fence bo contractor 120\nWCONF fence 120 1\n" as *u8)
  pj_wfile(planb, "TASK barn b1 amber 2027-01-01 60 3 - paint\n" as *u8)
  pj_wfile(projb, "PROJ barn elder barn-paint\nMEMBER barn amber team -\n" as *u8)
  let confc: *u8 = sys_mmap(PSV_MAGIC_1024)
  o = 0
  o = pj_cat(confc, o, "project fence " as *u8)
  o = pj_cat(confc, o, prefix)
  o = pj_cat(confc, o, "\nproject barn " as *u8)
  o = pj_cat(confc, o, prefB)
  o = pj_cat(confc, o, "\ndemo fence elder\nmap bo_test bo\n" as *u8)
  confc[o] = 0 as u8
  pj_wfile(conff, confc)
510
  var pass: i64 = 0
  // T1 the independent planner writes the task records for BOTH projects
  let a1: *i64 = sys_mmap(8 * 8) as *i64
  a1[0] = "load" as *u8 as i64
  a1[1] = planf as i64
  a1[2] = prefix as i64
  a1[3] = "7301" as *u8 as i64
  a1[4] = 0
  let rc1: i64 = pj_run("_offc/nx_vizsla_plan.elf" as *u8, a1, outf)
  let a1b: *i64 = sys_mmap(8 * 8) as *i64
  a1b[0] = "load" as *u8 as i64
  a1b[1] = planb as i64
  a1b[2] = prefB as i64
  a1b[3] = "7303" as *u8 as i64
  a1b[4] = 0
  let rc1b: i64 = pj_run("_offc/nx_vizsla_plan.elf" as *u8, a1b, outf)
  let av: *i64 = sys_mmap(8 * 8) as *i64
  av[0] = "pj" as *u8 as i64
  av[1] = "load" as *u8 as i64
  av[2] = projf as i64
  av[3] = prefix as i64
  av[4] = "7302" as *u8 as i64
  let rc2: i64 = pj_cmd_load(5, av)
  let avb: *i64 = sys_mmap(8 * 8) as *i64
  avb[0] = "pj" as *u8 as i64
  avb[1] = "load" as *u8 as i64
  avb[2] = projb as i64
  avb[3] = prefB as i64
  avb[4] = "7304" as *u8 as i64
  let rc2b: i64 = pj_cmd_load(5, avb)
  var ok: i64 = 0
  if rc1 == 0 { if rc1b == 0 { if rc2 == 0 { if rc2b == 0 { ok = 1 } } } }
  pass = pass + pj_check(1, ok, "fixtures-loaded-2-projects" as *u8)
  // T2 auth context on FRESH keys (load_or_init) + register + login = REAL tokens
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  let crc: i64 = olg_ctx_setup(ctx, keys, astore, "nishi_site_admin" as *u8, 16, "Nishi site admin" as *u8, 16, 256, 2, 1)
  let mn: *u8 = sys_mmap(PSV_MAGIC_1024)
  let mnn: *i64 = sys_mmap(16) as *i64
  let rr1: i64 = olg_register(ctx, "bo_test" as *u8, 7, "pw_bo_9931x" as *u8, 11, mn, PSV_MAGIC_1024, mnn)
  let rr2: i64 = olg_register(ctx, "mallory_t" as *u8, 9, "pw_mal_442x" as *u8, 11, mn, PSV_MAGIC_1024, mnn)
  let tokb: *u8 = sys_mmap(512)
  let tbn: *i64 = sys_mmap(16) as *i64
  let lr1: i64 = olg_login(ctx, "bo_test" as *u8, 7, "pw_bo_9931x" as *u8, 11, tokb, 512, tbn)
  let tokm: *u8 = sys_mmap(512)
  let tmn: *i64 = sys_mmap(16) as *i64
  let lr2: i64 = olg_login(ctx, "mallory_t" as *u8, 9, "pw_mal_442x" as *u8, 11, tokm, 512, tmn)
  tokb[tbn[0]] = 0 as u8
  tokm[tmn[0]] = 0 as u8
  ok = 0
  if crc == 0 { if rr1 == 0 { if rr2 == 0 { if lr1 == 0 { if lr2 == 0 { ok = 1 } } } } }
  pass = pass + pj_check(2, ok, "opaque-register-login" as *u8)
  // build the uid->handle index from the REAL whoami uids
  let uid: *u8 = sys_mmap(64)
  let uidn: *i64 = sys_mmap(16) as *i64
  let now: i64 = sys_now_realtime_sec()
  let idxc: *u8 = sys_mmap(PSV_MAGIC_1024)
  var io: i64 = 0
  if olg_whoami(ctx, tokb, tbn[0], now, uid, 64, uidn) == NX_MAUTH_OK {
      io = ps_hex(idxc, io, uid, uidn[0])
      idxc[io] = 9 as u8
      io = io + 1
      io = pj_cat(idxc, io, "bo_test\n" as *u8)
  }
  if olg_whoami(ctx, tokm, tmn[0], now, uid, 64, uidn) == NX_MAUTH_OK {
      io = ps_hex(idxc, io, uid, uidn[0])
      idxc[io] = 9 as u8
      io = io + 1
      io = pj_cat(idxc, io, "mallory_t\n" as *u8)
  }
  idxc[io] = 0 as u8
  pj_wfile(idxf, idxc)
  // the handler state
  let st: *i64 = psv_st_new(ctx, conff, idxf)
  let req: *u8 = sys_mmap(PSV_MAGIC_16384)
  let resp: *u8 = sys_mmap(PSV_MAGIC_131072)
  let none: *u8 = sys_mmap(8)
  none[0] = 0 as u8
  // T3 token-less nav -> bootstrap 200
  var rn: i64 = psv_req(req, "/project" as *u8, none)
  var n: i64 = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 200" as *u8) == 1 { if pj_contains(resp, n, "sessionStorage" as *u8) == 1 { ok = 1 } }
  pass = pass + pj_check(3, ok, "bootstrap-no-token" as *u8)
  // T4 garbage token -> 302 /login (fail-closed)
  rn = psv_req(req, "/project" as *u8, "AAAAgarbagegarbage" as *u8)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 302" as *u8) == 1 { ok = 1 }
  pass = pass + pj_check(4, ok, "neg-bad-token-302" as *u8)
  // T5 the PICKER: bo sees fence (member) and NEVER barn (not a member)
  rn = psv_req(req, "/project" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 200" as *u8) == 1 {
      if pj_contains(resp, n, "/project/p/fence" as *u8) == 1 {
          if pj_contains(resp, n, "/project/p/barn" as *u8) == 0 { ok = 1 }
      }
  }
  pass = pass + pj_check(5, ok, "picker-membership-scoped" as *u8)
  // T6 per-project page: contractor scope holds on /project/p/fence
  rn = psv_req(req, "/project/p/fence" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 200" as *u8) == 1 {
      if pj_contains(resp, n, "<td>f2</td>" as *u8) == 1 {
          if pj_contains(resp, n, "<td>f1</td>" as *u8) == 0 {
              if pj_contains(resp, n, "role=contractor" as *u8) == 1 { ok = 1 }
          }
      }
  }
  pass = pass + pj_check(6, ok, "page-contractor-scope" as *u8)
  // T7 CROSS-PROJECT deny: bo on barn -> 403
  rn = psv_req(req, "/project/p/barn" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 403" as *u8) == 1 { ok = 1 }
  pass = pass + pj_check(7, ok, "neg-cross-project-403" as *u8)
  // T8 valid login, NO membership anywhere -> picker denies
  rn = psv_req(req, "/project" as *u8, tokm)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 403" as *u8) == 1 { if pj_contains(resp, n, "Not a member" as *u8) == 1 { ok = 1 } }
  pass = pass + pj_check(8, ok, "neg-no-membership-403" as *u8)
  // T9 unknown pid -> 404 (no leak)
  rn = psv_req(req, "/project/p/ghost" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 404" as *u8) == 1 { ok = 1 }
  pass = pass + pj_check(9, ok, "neg-unknown-pid-404" as *u8)
  // T10 public demo: owner view shows all rows + the risk column/summary (f0 overdue by real today)
  rn = psv_req(req, "/project/demo" as *u8, none)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 200" as *u8) == 1 {
      if pj_contains(resp, n, "<td>f1</td>" as *u8) == 1 {
          if pj_contains(resp, n, "OVERDUE" as *u8) == 1 {
              if pj_contains(resp, n, "risk: overdue=" as *u8) == 1 { ok = 1 }
          }
      }
  }
  pass = pass + pj_check(10, ok, "public-demo-risk-column" as *u8)
  // T11 unknown subpath -> 404
  rn = psv_req(req, "/project/zzz" as *u8, none)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 404" as *u8) == 1 { ok = 1 }
  pass = pass + pj_check(11, ok, "neg-404-subpath" as *u8)
  // T12 query string stripped on the picker
  rn = psv_req(req, "/project?b=cachebust" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 200" as *u8) == 1 { if pj_contains(resp, n, "/project/p/fence" as *u8) == 1 { ok = 1 } }
  pass = pass + pj_check(12, ok, "query-string-stripped" as *u8)
  // T13 pid traversal guard: dot/slash pids are refused
  rn = psv_req(req, "/project/p/../etc" as *u8, tokb)
  n = psv_handle(st, req, rn, resp)
  ok = 0
  if pj_contains(resp, n, "HTTP/1.1 404" as *u8) == 1 { ok = 1 }
  pass = pass + pj_check(13, ok, "neg-pid-traversal-404" as *u8)
670
  let rep: *u8 = sys_mmap(256)
  var z: i64 = 0
  z = pj_cat(rep, z, "NX-PROJECT-SERVE-GATE pass=" as *u8)
  z = pj_catn(rep, z, pass)
  z = pj_cat(rep, z, "/13 verdict=" as *u8)
  if pass == 13 { z = pj_cat(rep, z, "GREEN\n" as *u8) } else { z = pj_cat(rep, z, "RED\n" as *u8) }
  sys_write(1, rep, z)
  if pass == 13 { return 0 }
  return 1
680}
681
682// ---------------- DAEMON (sockets; the NAS runs this behind the gated proxy row) ----------------
683func psv_daemon(argc: i64, argv: *i64) -> i64 {
  if argc < 7 {
      pj_p("usage: nx_project_serve <port> <keys> <store> <budget> <conf> <idx> [m] [t] [p]\n" as *u8)
      sys_exit(2)
      return 2
  }
  let port: i64 = pj_atoi(argv[1] as *u8)
  let keys_path: *u8 = argv[2] as *u8
  let store_path: *u8 = argv[3] as *u8
  let budget: i64 = pj_atoi(argv[4] as *u8)
  let confpath: *u8 = argv[5] as *u8
  let idxpath: *u8 = argv[6] as *u8
  var m_cost: i64 = PSV_MAGIC_65536
  if argc > 7 { m_cost = pj_atoi(argv[7] as *u8) }
  var t_cost: i64 = 3
  if argc > 8 { t_cost = pj_atoi(argv[8] as *u8) }
  var p_cost: i64 = 4
  if argc > 9 { p_cost = pj_atoi(argv[9] as *u8) }
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  if olg_ctx_setup(ctx, keys_path, store_path, "nishi_site_admin" as *u8, 16, "Nishi site admin" as *u8, 16, m_cost, t_cost, p_cost) != 0 {
      pj_p("CTX-INIT-FAIL\n" as *u8)
      sys_exit(1)
      return 1
  }
  let addr: *u8 = sys_mmap(16)
  addr[0] = 2 as u8
  addr[1] = 0 as u8
  addr[2] = ((port >> 8) & 255) as u8
  addr[3] = (port & 255) as u8
  var zi: i64 = 4
  while zi < 16 { addr[zi] = 0 as u8; zi = zi + 1 }
  let lfd: i64 = sys_socket(2, 1, 0)
  if lfd < 0 { pj_p("SOCKET-FAIL\n" as *u8); sys_exit(1); return 1 }
  let optv: *u8 = sys_mmap(4)
  optv[0] = 1 as u8
  optv[1] = 0 as u8
  optv[2] = 0 as u8
  optv[3] = 0 as u8
  sys_setsockopt(lfd, 1, 2, optv, 4)
  if sys_bind(lfd, addr, 16) < 0 { pj_p("BIND-FAIL\n" as *u8); sys_exit(1); return 1 }
  if sys_listen(lfd, 16) < 0 { pj_p("LISTEN-FAIL\n" as *u8); sys_exit(1); return 1 }
  pj_p("PROJECT-GATEWAY-UP\n" as *u8)
  let st: *i64 = psv_st_new(ctx, confpath, idxpath)
  let req: *u8 = sys_mmap(PSV_MAGIC_16400)
  let resp: *u8 = sys_mmap(PSV_MAGIC_131072)
  pj_p("PSV-BUFS-OK\n" as *u8)
  var served: i64 = 0
  while served < budget {
      let cfd: i64 = sys_accept(lfd)
      if cfd >= 0 {
          sys_set_socket_timeout(cfd, 5)
          let rn: i64 = sys_read(cfd, req, PSV_MAGIC_16383)
          if rn > 0 {
              let n: i64 = psv_handle(st, req, rn, resp)
              sys_write(cfd, resp, n)
          }
          sys_close(cfd)
      }
      served = served + 1
  }
  sys_close(lfd)
  sys_exit(0)
  return 0
746}
nx_project_serve.nx source

`nx_project_serve.nx` source
