߲j.>dZddlmZddlmZmZddlmZddlm Z edGdd Z edGd d Z edGd d Z Gdde ZGdde ZGdde ZGdde ZddZGddeZddZy)zFAbstract base + dataclasses + exceptions for dashboard auth providers.) annotations)ABCabstractmethod) dataclass)OptionalT)frozencbeZdZUdZded<ded<ded<ded<ded<ded <ded <ded <y ) SessionzA verified interactive identity (from ``complete_login`` / ``verify_session``). All fields mandatory; providers without orgs set ``org_id=""``. The tokens are opaque to Hermes.struser_idemail display_nameorg_idproviderint expires_at access_token refresh_tokenN__name__ __module__ __qualname____doc____annotations__C/home/ubuntu/.hermes/hermes-agent/hermes_cli/dashboard_auth/base.pyr r s3] L J KMOrr c4eZdZUdZded<ded<dZded<y) TokenPrincipalu A verified non-interactive (service-to-service) caller — the token analog of :class:`Session`: one bearer token on one request, no login/cookie/refresh. ``principal`` is an opaque stable caller id; ``scopes`` empty means "unscoped" (a route MAY enforce one).r principalrrztuple[str, ...]scopesN)rrrrrr!rrrrrs`NM FO rrc&eZdZUdZded<ded<y) LoginStartaFirst leg of the OAuth round trip: ``redirect_url`` is the IDP's authorize endpoint; ``cookie_payload`` maps cookie name -> serialised PKCE/CSRF state that the auth route sets (HttpOnly, Secure + ``SameSite=None`` over HTTPS, TTL <= 10 min; see ``set_pkce_cookie``).r redirect_urlzdict[str, str]cookie_payloadNrrrrr#r#!sb""rr#ceZdZdZy) ProviderErrorz HTTP 503.Nrrrrrrrr'r'*sFrr'ceZdZdZy)InvalidCodeErrorzLOAuth callback ``code``/``state`` failed validation. Middleware -> HTTP 400.Nr(rrrr*r*.sVrr*ceZdZdZy)InvalidCredentialsErrorzQUsername/password rejected. The route answers a generic 401 (no username oracle).Nr(rrrr,r,2s[rr,ceZdZdZy)RefreshExpiredErrorzThis provider rejects the refresh token. Not proof of ownership in a multi-provider deployment: middleware tries the rest and forces re-login only after every reachable one rejects it.Nr(rrrr.r.6srr.c ddl}t||jrtd|St||j |j frtd|St||jrtd|St||jrtd|Std|S#t$rtd|cYSwxYw)uMap a ``PyJWKClient.get_signing_key_from_jwt`` failure to the protocol. Only a genuine transport failure (``PyJWKClientConnectionError``, or an unexpected JWKS shape) is a :class:`ProviderError` (503, never forces logout). A non-JWT bearer (``DecodeError``), a JWKS with no key for this ``kid`` (``PyJWKSetError``) or any other invalid token is simply not verifiable by this provider -> :class:`InvalidCodeError` (``verify_session`` returns ``None``). Folding "cannot parse" into "cannot reach" once made every opaque bearer a fast 503. * ``jwt.DecodeError`` — the bearer is not a JWT at all (an opaque peer key, a legacy session token, garbage). #94558: hosted agents answered every non-JWT bearer with a fast 503 ``Auth provider 'nous' unreachable`` even though Portal was healthy, because "cannot parse" and "cannot reach" were folded into one branch. * ``jwt.PyJWKSetError`` — the JWKS was fetched fine but holds no key for this token's ``kid`` (rotated/foreign key). rNzJWKS lookup failed: z'token not verifiable by this provider: ) jwt Exceptionr' isinstancePyJWKClientConnectionError DecodeError PyJWKSetErrorr*PyJWKClientErrorInvalidTokenError)excr0s rclassify_jwks_lookup_errorr9<s= #s5563C59::#):):;<"I# OPP#s++,3C59::#s,,-"I# OPP /w7 88 =3C7;<<=sB00C  C ceZdZUdZdZded<dZded<dZded<dZded <d Z ded <e dd Z e dd Z e ddZ e ddZe ddZddZddZy)DashboardAuthProvideraProtocol every dashboard-auth provider plugin implements. Lifecycle: ``start_login`` (redirect URL + PKCE state) -> IDP -> ``complete_login`` (code + verifier -> Session) -> ``verify_session`` per request -> ``refresh_session`` near expiry -> ``revoke_session`` on logout (best-effort, must not raise). Failure semantics: ``start_login`` / ``complete_login`` raise ``ProviderError`` when the IDP is unreachable, ``complete_login`` ``InvalidCodeError`` on a bad code/state; ``verify_session`` returns ``None`` for expired/unknown tokens (middleware refreshes) and raises ``ProviderError`` when unreachable (503); ``refresh_session`` raises ``RefreshExpiredError`` when the token is invalid for that provider (a foreign opaque token looks expired, so middleware tries the rest) and ``ProviderError`` on network failure (503, cookies kept). Subclasses MUST set ``name`` (stable lowercase id) and ``display_name``. Capability flags: ``supports_password`` (credential form + ``complete_password_login``; OAuth methods may be ``NotImplementedError`` stubs), ``supports_token`` (``verify_token`` for the token-auth seam), ``supports_session`` (False for token-only credentials such as drain, never offered a login). r namerFboolsupports_passwordsupports_tokenTsupports_sessioncyNr)self redirect_uris r start_loginz!DashboardAuthProvider.start_loginss?BrcyrCr)rDcodestate code_verifierrEs rcomplete_loginz$DashboardAuthProvider.complete_loginvs[^rcyrCr)rDrs rverify_sessionz$DashboardAuthProvider.verify_sessionzsILrcyrCrrDrs rrefresh_sessionz%DashboardAuthProvider.refresh_session}sADrcyrCrrOs rrevoke_sessionz$DashboardAuthProvider.revoke_sessions=@rcDtt|jd)u]Verify a username/password pair and mint a :class:`Session` (only called when ``supports_password``). Raise ``InvalidCredentialsError`` on rejection (SHOULD be constant time for unknown users — no timing oracle) and ``ProviderError`` when the store is unreachable. The default raises so a mis-flagged provider fails loudly.zd does not support password login (set supports_password = True and override complete_password_login)NotImplementedErrortyper)rDusernamepasswords rcomplete_password_loginz-DashboardAuthProvider.complete_password_logins/ "Dz""#$R RS SrcDtt|jd)a}Verify a non-interactive bearer token; return its principal. Mirrors ``verify_session``: return ``None`` (never raise) for an unrecognised token so the seam falls through; raise ``ProviderError`` ONLY for a genuine backing-store outage. Shared secrets MUST be compared with ``hmac.compare_digest``. The default raises so a mis-flagged provider fails loudly.zR does not support token auth (set supports_token = True and override verify_token)rT)rDtokens r verify_tokenz"DashboardAuthProvider.verify_tokens/ "Dz""#$D DE ErN)rEr returnr#) rHr rIr rJr rEr r]r )rr r]zOptional[Session])rr r]r )rr r]None)rWr rXr r]z 'Session')r[r r]z'Optional[TokenPrincipal]')rrrrr=rrr?r@rArrFrKrMrPrRrYr\rrrr;r;[s"D#NL##t# ND !d!BB__#&_7:_JM_RY__LLDD@@SErr;cBdD])}t||drt|jd|dD]2}tt||drt|jd|t|ddr-t|jdt |j y) zzRaise ``TypeError`` if ``cls`` doesn't fully implement the protocol (call it from every provider plugin's unit tests).)r=rr<z missing or empty attribute: )rFrKrMrPrRNz missing method: __abstractmethods__z% has unimplemented abstract methods: )getattr TypeErrorrcallablesortedr`)clsattrmethods rassert_protocol_compliancerhs)TsD"%s||n,I$RS ST%HVT23s||n,=fXFG GHs)40||nA&I`I`BaAb ce e1rN)r8 BaseExceptionr]r1)rerVr]r^)r __future__rabcrr dataclassesrtypingrr rr#r1r'r*r,r.r9r;rhrrrrnsL"#! $    $!!! $###GIGWyW\i\) 9>8EC8Ev er