code wiki / _hdl_build / nx_vault_acl.nx
nx_vault_acl.nx source
↩ module page · 40 lines · 1907 B
1// nx_vault_acl.nx -- sovereign path-based ACL POLICY engine (HashiCorp Vault "policies + identity" gap from
2// vault_capability_census.tsv). A policy is a set of rules (path-prefix -> capabilities, or an explicit
3// deny). Evaluation is DENY-BY-DEFAULT, EXPLICIT-DENY-WINS, and LONGEST-PREFIX-grant -- the three rules that
4// make least-privilege actually hold. Pure logic over caller-supplied rule arrays. license_tier: ORIGINAL
5import "nx_syscalls.nx"
6
7const CAP_READ: i64 = 1
8const CAP_WRITE: i64 = 2
9const CAP_LIST: i64 = 4
10const CAP_DELETE: i64 = 8
11
12// is rule-path `p` (len pl) a prefix of request-path `q` (len ql)?
13func acl_is_prefix(p: *u8, pl: i64, q: *u8, ql: i64) -> i64 {
14 if pl > ql { return 0 }
15 var i: i64 = 0
16 while i < pl { if p[i] != q[i] { return 0 } i = i + 1 }
17 return 1
18}
19
20// evaluate the policy for (req_path, req_cap). paths = array of (*u8 cast to i64); lens/deny/caps = parallel
21// i64 arrays. returns 1 ALLOW / 0 DENY. Order-independent: any matching deny rule denies; otherwise the
22// LONGEST matching grant decides; no match = deny-by-default.
23func acl_eval(paths: *i64, lens: *i64, deny: *i64, caps: *i64, nrules: i64, req: *u8, req_len: i64, req_cap: i64) -> i64 {
24 var deny_flag: i64 = 0
25 var best_len: i64 = 0 - 1
26 var best_caps: i64 = 0
27 var i: i64 = 0
28 while i < nrules {
29 let rp: *u8 = paths[i] as *u8
30 if acl_is_prefix(rp, lens[i], req, req_len) == 1 {
31 if deny[i] == 1 { deny_flag = 1 }
32 else { if lens[i] > best_len { best_len = lens[i]; best_caps = caps[i] } }
33 }
34 i = i + 1
35 }
36 if deny_flag == 1 { return 0 } // explicit deny wins
37 if best_len < 0 { return 0 } // deny by default (no matching grant)
38 if (best_caps & req_cap) == req_cap { return 1 } // longest-prefix grant must include the requested cap
39 return 0
40}