nx_torrent_access.nx source
↩ module page · 48 lines · 2859 B
1// nx_torrent_access.nx -- ACCESS POLICY for torrent downloads + watch-while-stream, by AREA.
2//
3// Operator directive (2026-06-20): "make the gallery able to download sfw or nsfw and the media is where
4// the family users can download; on the gallery it allows where to download (media for sfw OR gallery for
5// nsfw). this is important for the watch while streaming off /torrent."
6//
7// TWO destination areas, each with a REQUIRED level (deny-by-default / fail-closed, NIST SP 800-207, the
8// same posture as nx_access_wall / nx_image_access):
9// AREA_SFW ("media" destination) -> required FAMILY (1): any logged-in family member or the operator.
10// AREA_NSFW ("gallery" destination) -> required OWNER (3): the operator ONLY.
11// A family member (1) can NEVER reach the NSFW/gallery area; no session (0) reaches nothing; garbage/negative
12// levels DENY; an UNKNOWN area DENIES even for the owner (no download to a bogus destination).
13//
14// OWNER==3 MIRRORS nx_galx_authz GALX_OWNER (the gallery's operator-only level for cam recordings + NSFW)
15// and nx_image_access NX_IMGSEARCH_OWNER; single vocabulary, asserted ==3 by nx_torrent_access_gate.
16// The enforcement point (the torrent daemon /add + /stream) derives viewer_level from the OPAQUE-
17// authenticated session exactly as the gallery does (nx_opaque_login olg_whoami -> handle -> roles level),
18// then calls nx_taccess_allow BEFORE writing/serving any byte. Internal CLI callers are trusted
19// (Cardinal 12: validate at the boundary). license_tier: ORIGINAL
20import "nx_syscalls.nx"
21
22const NX_TACCESS_OWNER: i64 = 3 // operator (== nx_galx_authz GALX_OWNER); gate asserts ==3
23const NX_TACCESS_FAMILY: i64 = 1 // logged-in family member; gate asserts ==1
24const NX_TACCESS_ANON: i64 = 0 // no session / anonymous
25
26const NX_TAREA_SFW: i64 = 0 // "media" destination -> required FAMILY(1)
27const NX_TAREA_NSFW: i64 = 1 // "gallery" destination -> required OWNER(3)
28
29const NX_TACCESS_DENY: i64 = 0
30const NX_TACCESS_ALLOW: i64 = 1
31
32// required level for an area. UNKNOWN area -> an impossibly-high level so nothing meets it (fail-closed).
33func nx_taccess_required_level(area: i64) -> i64 {
34 if area == NX_TAREA_SFW { return NX_TACCESS_FAMILY }
35 if area == NX_TAREA_NSFW { return NX_TACCESS_OWNER }
36 return 999
37}
38
39// THE decision. ALLOW iff the (session-derived) viewer level meets the area's required level, AND the area
40// is a known one. Deny-by-default / fail-closed: unknown area, no session, under-privileged, or garbage all DENY.
41func nx_taccess_allow(viewer_level: i64, area: i64) -> i64 {
42 if area != NX_TAREA_SFW {
43 if area != NX_TAREA_NSFW { return NX_TACCESS_DENY } // unknown destination -> DENY (even owner)
44 }
45 let req: i64 = nx_taccess_required_level(area)
46 if viewer_level >= req { return NX_TACCESS_ALLOW }
47 return NX_TACCESS_DENY
48}