code wiki / _hdl_build / nx_shard_registry.nx
nx_shard_registry.nx source
↩ module page · 86 lines · 4477 B
1// nx_shard_registry.nx -- the SSOT reader for the Nishi SHARDED ecosystem (CAP-SHARD-REGISTRY). Industry best-practice
2// for managing many shards/tenants = ONE control plane over a REGISTRY of data planes (AWS Organizations' account tree,
3// k8s fleet's cluster registry, a SaaS tenant catalog: "onboard a tenant = write a row to the registry"). This reads
4// knowledge/hosting/shards.conf -- one row per shard = the JOIN the ecosystem lacked (domain x service x port x
5// identity x roles x health, today scattered across ~8 confs). The control plane (nx_mgmt_api /api/shards) enumerates +
6// ADDRESSES every shard by shard-id, and per-shard AUTH (realm) + per-shard RBAC (roles_path) become DATA not code --
7// which is exactly how one canonical realm scopes authority per shard WITHOUT the rejected dual-realm hack. Composes the
8// shipped slk_* TSV parsers (nx_site_lock_lib). Add a shard = a row + reload, no recompile.
9// row: shard_id <TAB> domain <TAB> service <TAB> port <TAB> realm <TAB> keys <TAB> store <TAB> roles_path <TAB> health_flow
10// license_tier: ORIGINAL
11import "nx_site_lock_lib.nx"
12
13const SR_F_ID: i64 = 0 // shard-id -- the PRIMARY KEY the control plane targets (e.g. andelinwest-portal)
14const SR_F_DOMAIN: i64 = 1
15const SR_F_SERVICE: i64 = 2
16const SR_F_PORT: i64 = 3
17const SR_F_REALM: i64 = 4 // the shard's OPAQUE realm (canonical for control-plane shards; own realm for tenant silos)
18const SR_F_KEYS: i64 = 5
19const SR_F_STORE: i64 = 6
20const SR_F_ROLES: i64 = 7 // the per-shard roles file -- THE per-shard-RBAC crux (ag_uid_to_level's 4th arg)
21const SR_F_HEALTH: i64 = 8 // the functional health flow name (funcchecks.conf) for real round-trip truth
22
23// number of shard rows (skips # comments + blank lines).
24func sr_count(reg: *u8, n: i64) -> i64 {
25 var ls: i64 = 0; var c: i64 = 0
26 while ls < n {
27 let le: i64 = slk_line_end(reg, n, ls)
28 if le > ls { if reg[ls] != (35 as u8) { c = c + 1 } }
29 ls = le + 1
30 }
31 return c
32}
33
34// copy field `f` of the shard row at [ls,le) into out (NUL-terminated); returns length (0 = absent).
35func sr_field_at(reg: *u8, ls: i64, le: i64, f: i64, out: *u8, cap: i64) -> i64 {
36 let fs: *i64 = sys_mmap(8); let fe: *i64 = sys_mmap(8)
37 if slk_field(reg, ls, le, f, fs, fe) == 1 {
38 var o: i64 = 0; let fl: i64 = fe[0] - fs[0]
39 while o < fl { if o < cap - 1 { out[o] = reg[fs[0] + o] } o = o + 1 }
40 out[o] = 0 as u8
41 return fl
42 }
43 out[0] = 0 as u8; return 0
44}
45
46// integer field `f` of the row at [ls,le); 0 if absent.
47func sr_field_int(reg: *u8, ls: i64, le: i64, f: i64) -> i64 {
48 let fs: *i64 = sys_mmap(8); let fe: *i64 = sys_mmap(8)
49 if slk_field(reg, ls, le, f, fs, fe) == 1 { return slk_atoi(reg, fs[0], fe[0]) }
50 return 0
51}
52
53// find a shard by its PRIMARY KEY (shard-id): returns line-start offset (>=0) + fills out_le, or -1. This is the
54// addressing primitive -- the control plane targets ONE shard by id, then reads any column with sr_field_at.
55func sr_find_by_id(reg: *u8, n: i64, id: *u8, idlen: i64, out_le: *i64) -> i64 {
56 let fs: *i64 = sys_mmap(8); let fe: *i64 = sys_mmap(8)
57 var ls: i64 = 0
58 while ls < n {
59 let le: i64 = slk_line_end(reg, n, ls)
60 if le > ls { if reg[ls] != (35 as u8) {
61 if slk_field(reg, ls, le, SR_F_ID, fs, fe) == 1 {
62 if slk_eq(slk_at(reg, fs[0]), fe[0] - fs[0], id, idlen) == 1 { out_le[0] = le; return ls }
63 }
64 } }
65 ls = le + 1
66 }
67 out_le[0] = 0; return 0 - 1
68}
69
70// THE per-shard-RBAC accessor: the roles-path for shard-id (empty if no such shard). ma_level_of passes THIS as
71// ag_uid_to_level's roles_path so authority is scoped per shard -- operator is level-3 in every shard's file; a
72// tenant owner is level-3 only in theirs. One realm, per-shard role scoping = the federation, no dual-realm.
73func sr_roles_of(reg: *u8, n: i64, id: *u8, idlen: i64, out: *u8, cap: i64) -> i64 {
74 let lebox: *i64 = sys_mmap(8)
75 let ls: i64 = sr_find_by_id(reg, n, id, idlen, lebox)
76 if ls < 0 { out[0] = 0 as u8; return 0 }
77 return sr_field_at(reg, ls, lebox[0], SR_F_ROLES, out, cap)
78}
79
80// convenience: the backend PORT for a shard-id (0 = no such shard).
81func sr_port_of(reg: *u8, n: i64, id: *u8, idlen: i64) -> i64 {
82 let lebox: *i64 = sys_mmap(8)
83 let ls: i64 = sr_find_by_id(reg, n, id, idlen, lebox)
84 if ls < 0 { return 0 }
85 return sr_field_int(reg, ls, lebox[0], SR_F_PORT)
86}