laantungir/n_signer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 40 Wiki Activity

v0.0.16 - Implement deny-by-default approval model with on-demand nostr_index derivation and --preapprove CLI flag

Browse Source
This commit is contained in:
Laan Tungir
2026-05-04 18:44:40 -04:00
parent cfaa8ff637
commit 7ffba2b678
22 changed files with 1692 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/secure_mem.c
View File

@@ -75,7 +75,7 @@ int mnemonic_generate(int word_count, char *out, size_t out_len);
#define ROLE_PURPOSE_MAX 32
#define ROLE_CURVE_MAX 16
#define ROLE_PUBKEY_HEX_MAX 66 /* 64 hex chars + null + pad */
#define ROLE_TABLE_MAX_ENTRIES 64
#define ROLE_TABLE_MAX_ENTRIES 256
/* Purpose enum for fast comparison (string form kept for config/display) */
typedef enum {
@@ -241,6 +241,12 @@ typedef enum {
PROMPT_DENY
} prompt_mode_t;
typedef enum {
POLICY_SOURCE_DEFAULT = 0, /* the catch-all entry */
POLICY_SOURCE_PREAPPROVE, /* from --preapprove CLI flag */
POLICY_SOURCE_SESSION_GRANT /* from prompt [a] during session */
} policy_source_t;
/* A single policy entry */
typedef struct {
char caller[POLICY_CALLER_MAX_LEN]; /* e.g. "uid:1000" or "*" for any */
@@ -251,6 +257,7 @@ typedef struct {
char purposes[POLICY_MAX_PURPOSES][ROLE_PURPOSE_MAX];
int purpose_count;
prompt_mode_t prompt;
policy_source_t source;
} policy_entry_t;
/* Policy table */
@@ -279,7 +286,8 @@ int policy_table_add(policy_table_t *table, const policy_entry_t *entry);
* Returns POLICY_ALLOW, POLICY_DENY, POLICY_PROMPT, or POLICY_NO_MATCH.
*/
int policy_check(const policy_table_t *table, const char *caller_id,
const char *verb, const char *role_name, const char *purpose);
const char *verb, const char *role_name, const char *purpose,
policy_source_t *out_source);
/* Parse prompt mode from string */
prompt_mode_t prompt_mode_from_str(const char *s);