code wiki / _hdl_build / nx_vault_rotation.nx
nx_vault_rotation.nx source
↩ module page · 27 lines · 1483 B
1// nx_vault_rotation.nx -- sovereign LEASE-DRIVEN AUTO-ROTATION (upgrades the rotation PARTIAL in
2// vault_capability_census.tsv to full HashiCorp-rotation-class). A secret carries a rotate_interval; when
3// now >= issued_at + rotate_interval it is DUE for rotation. Rotation bumps the version (monotonic) and
4// resets issued_at; the OLD version stays accepted for a GRACE overlap window so in-flight users don't break
5// (zero-downtime rotation). The new version's validity uses the lease engine. Composes nx_vault_lease.
6// "now" is injected (deterministic/replayable). license_tier: ORIGINAL
7import "nx_vault_lease.nx"
8import "nx_syscalls.nx"
9
10// is the secret due for rotation at `now`? (issued rotate_interval ago)
11func rot_due(now: i64, issued_at: i64, rotate_interval: i64) -> i64 {
12 if now >= issued_at + rotate_interval { return 1 }
13 return 0
14}
15
16// next version after a rotation (strictly monotonic bump).
17func rot_next_version(cur: i64) -> i64 { return cur + 1 }
18
19// during/after rotation the OLD version is still accepted for a GRACE overlap (zero-downtime):
20// accepted while now < old_issued_at + old_ttl + grace.
21func rot_overlap_valid(now: i64, old_issued: i64, old_ttl: i64, grace: i64) -> i64 {
22 if now < old_issued + old_ttl + grace { return 1 }
23 return 0
24}
25
26// the NEW version's validity from its rotation time (composes the lease engine).
27func rot_new_valid(now: i64, rotated_at: i64, ttl: i64) -> i64 { return lease_valid(now, rotated_at, ttl, 0) }