code wiki / _hdl_build / nx_status_daemon.nx
`nx_status_daemon.nx` source

↩ module page · 271 lines · 14360 B
1// nx_status_daemon.nx -- THE ACCESS WALL for nishifamily.com/status, on the CANONICAL Modern Auth (the
2// SINGLE ecosystem-wide auth: OPAQUE-3DH + Argon2id KSF + BIP39 recovery + NO-COOKIE Ed25519 session).
3// Operator 2026-06-16: "lets have that be how all the sites work." Composes the ONE shared gate
4// (nx_sa_validate) -- no bespoke crypto, no cookies (the prior cms_pw + Set-Cookie build violated the
5// charter's C1 no-cookie cardinal and is gone). A loopback HTTP daemon the sites daemon reverse-proxies to.
6//
7// The router is a PURE FUNCTION sd_handle(ctx, req_bytes, n, statusfile, out) -> out_n -- request bytes in,
8// response bytes out, no socket. The socket loop is a thin shell over it; the gate drives it IN-PROCESS
9// (sovereign Nishi test, no curl/shell). Routes:
10//   POST /status/login    -> handle=<h>&passphrase=<p> (url-decoded) -> nx_modern_auth_login
11//                            -> 200 {"token":"<base64 152B>"} | 401 {"error":"unauthorized"} (same for
12//                            wrong-pw / unknown-handle: client-enumeration defense)
13//   GET  /status/content  -> X-Nishi-Session header validates (nx_sa_validate) ? serve <statusfile> : 401
14//   GET  /status (+ any)  -> the no-cookie SPA shell: login form + fetch() that stores the token in
15//                            sessionStorage and sends it as X-Nishi-Session (NEVER a cookie)
16// Context armed at startup via nx_uas_server_keys_load_or_init + nx_auth_context_init; the admin is
17// provisioned out-of-band by nx_modauth_arm (this daemon never registers).
18// argv: [1]=port [2]=keysfile [3]=storefile [4]=realm [5]=statusfile [6]=request-budget.
19// Sovereign: nx_site_auth + nx_modern_auth_flow + nx_http_server + nx_base64 + nx_syscalls. license_tier: ORIGINAL
20import "nx_syscalls.nx"
21import "nx_http_server.nx"
22import "nx_site_auth.nx"
23import "hub/nx_modern_auth_flow.nx"
24import "nx_base64.nx"
25const SD_MAGIC_8192: i64 = 8192
26
27const SD_REQCAP: i64 = 65536
28const SD_OUTCAP: i64 = 524288
29
30func sd_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != 0 as u8 { n = n + 1 } return n }
31func sd_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != 0 as u8 { d[o + i] = s[i]; i = i + 1 } return o + i }
32func sd_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != 0 as u8 { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v }
33func sd_catn(d: *u8, o: i64, v: i64) -> i64 {
  let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var w: i64 = o; var i: i64 = 0
  while i < k { d[w] = t[k - 1 - i]; w = w + 1; i = i + 1 }
  return w
40}
41func sd_starts(req: *u8, n: i64, s: *u8) -> i64 {
  let sl: i64 = sd_len(s)
  if n < sl { return 0 }
  var i: i64 = 0
  while i < sl { if req[i] != s[i] { return 0 } i = i + 1 }
  return 1
47}
48
49// ---- request parsing (pure; the gate drives these directly) --------------------------------------
50
51// path = the slice between the 1st and 2nd ASCII space of "METHOD PATH HTTP/1.1". sets off/len, 1/0.
52func sd_find_path(req: *u8, n: i64, off_box: *i64, len_box: *i64) -> i64 {
  var sp1: i64 = 0
  var f1: i64 = 0
  while f1 == 0 { if sp1 >= n { f1 = 1 } else { if (req[sp1] as i64) == 32 { f1 = 1 } else { sp1 = sp1 + 1 } } }
  let start: i64 = sp1 + 1
  var e: i64 = start
  var f2: i64 = 0
  while f2 == 0 { if e >= n { f2 = 1 } else { if (req[e] as i64) == 32 { f2 = 1 } else { e = e + 1 } } }
  off_box[0] = start
  len_box[0] = e - start
  if e <= start { return 0 }
  return 1
64}
65
66// byte offset just past the CRLFCRLF header terminator, or n if there is no body.
67func sd_body_off(req: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i + 4 <= n {
      if (req[i] as i64) == 13 { if (req[i + 1] as i64) == 10 { if (req[i + 2] as i64) == 13 { if (req[i + 3] as i64) == 10 { return i + 4 } } } }
      i = i + 1
  }
  return n
74}
75
76func sd_hexnib(c: i64) -> i64 {
  if c >= 48 { if c <= 57 { return c - 48 } }
  if c >= 97 { if c <= 102 { return c - 87 } }
  if c >= 65 { if c <= 70 { return c - 55 } }
  return 0 - 1
81}
82
83// urldecode src[0..n) into out (cap out_cap): '+'->space, %XX->byte. one output byte per loop. -1 on error.
84func sd_urldecode(src: *u8, n: i64, out: *u8, out_cap: i64) -> i64 {
  var i: i64 = 0
  var o: i64 = 0
  while i < n {
      if o >= out_cap { return 0 - 1 }
      let c: i64 = src[i] as i64
      if c == 43 { out[o] = 32 as u8; i = i + 1 }
      if c == 37 {
          if i + 3 > n { return 0 - 1 }
          let hi: i64 = sd_hexnib(src[i + 1] as i64)
          let lo: i64 = sd_hexnib(src[i + 2] as i64)
          if hi < 0 { return 0 - 1 }
          if lo < 0 { return 0 - 1 }
          out[o] = ((hi << 4) | lo) as u8
          i = i + 3
      }
      if c != 43 { if c != 37 { out[o] = c as u8; i = i + 1 } }
      o = o + 1
  }
  return o
104}
105
106// find "name=" in body[0..body_n); on hit set out_off/out_n to the raw (still-encoded) value slice. 1/0.
107func sd_form_field(body: *u8, body_n: i64, name: *u8, name_n: i64, out_off: *i64, out_n: *i64) -> i64 {
  var pos: i64 = 0
  while pos < body_n {
      var m: i64 = 1
      if pos + name_n + 1 > body_n { m = 0 }
      if m == 1 {
          var i: i64 = 0
          while i < name_n {
              if (body[pos + i] as i64) != (name[i] as i64) { m = 0; i = name_n }
              if i < name_n { i = i + 1 }
          }
      }
      if m == 1 { if (body[pos + name_n] as i64) != 61 { m = 0 } }
      var vend: i64 = pos
      var scan: i64 = 1
      while scan == 1 {
          if vend >= body_n { scan = 0 }
          if scan == 1 { if (body[vend] as i64) == 38 { scan = 0 } }
          if scan == 1 { vend = vend + 1 }
      }
      if m == 1 {
          out_off[0] = pos + name_n + 1
          out_n[0] = vend - (pos + name_n + 1)
          return 1
      }
      pos = vend + 1
  }
  return 0
135}
136
137// the no-cookie SPA shell: login -> token in sessionStorage -> fetch content with X-Nishi-Session. (public UI)
138func sd_shell(out: *u8) -> i64 {
  var o: i64 = 0
  o = sd_cat(out, o, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\n\r\n" as *u8)
  o = sd_cat(out, o, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Nishi status</title>" as *u8)
  o = sd_cat(out, o, "<style>body{font-family:-apple-system,Segoe UI,sans-serif;max-width:820px;margin:7vh auto;padding:0 20px;color:#1c1c1e}#login{max-width:330px}input{width:100%;padding:10px;margin:.45rem 0;box-sizing:border-box;border:1px solid #ccc;border-radius:7px}button{padding:10px 18px;border:0;border-radius:7px;background:#0a6;color:#fff;font-size:1rem}.e{color:#b00;min-height:1.2em}</style>" as *u8)
  o = sd_cat(out, o, "<div id=login><h2>&#128274; Nishi admin</h2><input id=h placeholder=\"handle\" autocomplete=username autofocus><input id=p type=password placeholder=\"passphrase\" autocomplete=current-password><button id=b>Sign in</button><p id=e class=e></p></div><div id=content hidden></div>" as *u8)
  o = sd_cat(out, o, "<script>var L=document.getElementById('login'),C=document.getElementById('content'),E=document.getElementById('e');function show(){fetch('/status/content',{headers:{'X-Nishi-Session':sessionStorage.nx_sess||''}}).then(function(r){if(r.ok){return r.text()}throw 0}).then(function(t){C.innerHTML=t;L.hidden=true;C.hidden=false}).catch(function(){sessionStorage.removeItem('nx_sess')})}" as *u8)
  o = sd_cat(out, o, "document.getElementById('b').onclick=function(){E.textContent='';var b='handle='+encodeURIComponent(document.getElementById('h').value)+'&passphrase='+encodeURIComponent(document.getElementById('p').value);fetch('/status/login',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:b}).then(function(r){if(r.ok){return r.json()}throw 0}).then(function(j){sessionStorage.nx_sess=j.token;show()}).catch(function(){E.textContent='Wrong handle or passphrase.'})};if(sessionStorage.nx_sess){show()}</script>" as *u8)
  return o
147}
148
149func sd_emit_401_json(out: *u8) -> i64 {
  return sd_cat(out, 0, "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 24\r\n\r\n{\"error\":\"unauthorized\"}" as *u8)
151}
152
153// ---- THE ROUTER: pure function, request bytes -> response bytes (no socket). gate drives this directly. --
154func sd_handle(ctx: *NxAuthContext, req: *u8, req_n: i64, statusfile: *u8, out: *u8) -> i64 {
  let poff: *i64 = sys_mmap(8) as *i64
  let plen: *i64 = sys_mmap(8) as *i64
  poff[0] = 0
  plen[0] = 0
  sd_find_path(req, req_n, poff, plen)
  let path: *u8 = ((req as i64) + poff[0]) as *u8
  let pn: i64 = plen[0]
  let is_post: i64 = (req[0] == 80 as u8) as i64
  var o: i64 = 0
  if sd_starts(path, pn, "/status/login" as *u8) == 1 {
      if is_post == 1 {
          let body_off: i64 = sd_body_off(req, req_n)
          let body: *u8 = ((req as i64) + body_off) as *u8
          let body_n: i64 = req_n - body_off
          let hoff: *i64 = sys_mmap(8) as *i64
          let hn: *i64 = sys_mmap(8) as *i64
          let poff2: *i64 = sys_mmap(8) as *i64
          let pnn: *i64 = sys_mmap(8) as *i64
          var got: i64 = 0
          if sd_form_field(body, body_n, "handle" as *u8, 6, hoff, hn) == 1 {
              if sd_form_field(body, body_n, "passphrase" as *u8, 10, poff2, pnn) == 1 { got = 1 }
          }
          var ok: i64 = 0
          if got == 1 {
              let hbuf: *u8 = sys_mmap(256)
              let pbuf: *u8 = sys_mmap(512)
              let h_dec: i64 = sd_urldecode(((body as i64) + hoff[0]) as *u8, hn[0], hbuf, 255)
              let p_dec: i64 = sd_urldecode(((body as i64) + poff2[0]) as *u8, pnn[0], pbuf, 511)
              if h_dec > 0 { if p_dec > 0 {
                  let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES)
                  let tok_n: *i64 = sys_mmap(8) as *i64
                  tok_n[0] = 0
                  if nx_modern_auth_login(ctx, hbuf, h_dec, pbuf, p_dec, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) == NX_MAUTH_OK {
                      let b64: *u8 = sys_mmap(256)
                      let b64_n: i64 = b64_encode(tok, NX_MAUTH_SESSION_TOKEN_BYTES, b64)
                      o = sd_cat(out, o, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8)
                      o = sd_catn(out, o, 12 + b64_n)
                      o = sd_cat(out, o, "\r\n\r\n{\"token\":\"" as *u8)
                      var z: i64 = 0
                      while z < b64_n { out[o] = b64[z]; o = o + 1; z = z + 1 }
                      o = sd_cat(out, o, "\"}" as *u8)
                      ok = 1
                  }
              } }
          }
          if ok == 0 { o = sd_emit_401_json(out) }
      } else { o = sd_shell(out) }
  } else { if sd_starts(path, pn, "/status/content" as *u8) == 1 {
      let now_s: i64 = sys_now_realtime_sec()
      if nx_sa_validate(ctx, req, req_n, now_s) == NX_MAUTH_OK {
          let sbox: *i64 = sys_mmap(16) as *i64; sbox[0] = 0
          let page: *u8 = sys_read_file(statusfile, sbox)
          if (page as i64) != 0 {
              o = sd_cat(out, o, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: " as *u8)
              o = sd_catn(out, o, sbox[0])
              o = sd_cat(out, o, "\r\n\r\n" as *u8)
              var z2: i64 = 0
              while z2 < sbox[0] { out[o] = page[z2]; o = o + 1; z2 = z2 + 1 }
          } else { o = sd_cat(out, o, "HTTP/1.1 500 Internal Server Error\r\nConnection: close\r\nContent-Length: 0\r\n\r\n" as *u8) }
      } else { o = sd_emit_401_json(out) }
  } else { o = sd_shell(out) } }
  return o
217}
218
219func main(argc: i64, argv: *i64) -> i64 {
  if argc < 7 { sys_write(2, "usage: nx_status_daemon <port> <keysfile> <storefile> <realm> <statusfile> <budget>\n" as *u8, 83); return 1 }
  let port: i64 = sd_atoi(argv[1] as *u8)
  let keysfile: *u8 = argv[2] as *u8
  let storefile: *u8 = argv[3] as *u8
  let realm: *u8 = argv[4] as *u8
  let statusfile: *u8 = argv[5] as *u8
  let budget: i64 = sd_atoi(argv[6] as *u8)
  let realm_n: i64 = sd_len(realm)
228
  // ---- fail-fast: arm the realm context at startup (Rule 20) ----
  let oprf_seed: *u8 = sys_mmap(32)
  let akp: *u8 = sys_mmap(32)
  let akb: *u8 = sys_mmap(33)
  let edp: *u8 = sys_mmap(32)
  let edb: *u8 = sys_mmap(32)
  if nx_uas_server_keys_load_or_init(keysfile, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { sys_write(2, "FATAL: server-key bundle\n" as *u8, 24); return 2 }
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, storefile as i64, oprf_seed, edp, edb, 900, SD_MAGIC_8192, 1, 1, 5, 1) != NX_MAUTH_OK { sys_write(2, "FATAL: context init\n" as *u8, 20); return 3 }
238
  let addr: *u8 = sys_mmap(16)
  if nx_http_server_addr_loopback(addr, port) != 16 { return 4 }
  let lv: *i64 = sys_mmap(8) as *i64
  let lfd: i64 = nx_http_server_listen(addr, 64, lv)
  if lfd < 0 { return 4 }
244
  let req: *u8 = sys_mmap(SD_REQCAP)
  let out: *u8 = sys_mmap(SD_OUTCAP)
  var served: i64 = 0
248
  while served < budget {
      let av: *i64 = sys_mmap(8) as *i64
      let cfd: i64 = nx_http_server_accept_one(lfd, av)
      if cfd < 0 { served = served + 1 }
      if cfd >= 0 {
          let om: *i64 = sys_mmap(8) as *i64
          let opo: *i64 = sys_mmap(8) as *i64
          let opl: *i64 = sys_mmap(8) as *i64
          let ocl: *i64 = sys_mmap(8) as *i64
          let obo: *i64 = sys_mmap(8) as *i64
          let orn: *i64 = sys_mmap(8) as *i64
          let rrc: i64 = nx_http_server_read_request(cfd, req, SD_REQCAP, om, opo, opl, ocl, obo, orn)
          if rrc == NXS_OK {
              let o: i64 = sd_handle(ctx, req, orn[0], statusfile, out)
              nx_http_server_send_response_nokeep_close(cfd, out, o)
          }
          sys_close(cfd)
          served = served + 1
      }
  }
  sys_close(lfd)
  return 0
271}
nx_status_daemon.nx source

`nx_status_daemon.nx` source
