code wiki / _hdl_build / nx_vault_auth.nx
nx_vault_auth.nx source
↩ module page · 30 lines · 1534 B
1// nx_vault_auth.nx -- sovereign MULTI-AUTH methods (HashiCorp Vault "auth methods" gap from
2// vault_capability_census.tsv). A login presents a credential via a method (token / userpass / approle);
3// on success the vault issues a SESSION bound to a POLICY (composes nx_vault_acl) and a LEASE (composes
4// nx_vault_lease, session TTL). token = the token IS the secret; userpass + approle = BOTH an id and a
5// secret must match. Deny on wrong-secret, wrong-method, or unknown-id. Credentials are i64 hashes here
6// (production hashes the real secret via nx_sha256 / nx_machine_key). license_tier: ORIGINAL
7import "nx_vault_lease.nx"
8import "nx_syscalls.nx"
9
10const AM_TOKEN: i64 = 1
11const AM_USERPASS: i64 = 2
12const AM_APPROLE: i64 = 3
13
14// login against a principal registry (parallel arrays). returns policy_id (>=0) on success, -1 on failure.
15func auth_login(methods: *i64, id_h: *i64, sec_h: *i64, policy: *i64, n: i64, req_method: i64, req_id: i64, req_sec: i64) -> i64 {
16 var i: i64 = 0
17 while i < n {
18 if methods[i] == req_method {
19 var ok: i64 = 1
20 if sec_h[i] != req_sec { ok = 0 }
21 if req_method != AM_TOKEN { if id_h[i] != req_id { ok = 0 } } // userpass/approle need id too
22 if ok == 1 { return policy[i] }
23 }
24 i = i + 1
25 }
26 return 0 - 1
27}
28
29// the issued session is valid only while its lease holds (composes nx_vault_lease).
30func auth_session_valid(now: i64, issued_at: i64, ttl: i64) -> i64 { return lease_valid(now, issued_at, ttl, 0) }