߲ji4dZddlmZddlZddlZddlZddlZddlZddlZ ddl m Z m Z m Z mZddlZddlmZmZmZmZmZmZmZdZdZdd iZd d Zd!d ZGd d eZ d"dZd#dZ d$dZ!d%dZ"d&dZ#dd d'dZ$d(d)dZ%ddddd d*dZ&d+dZ' d,dZ(GddZ)GddeZ*y)-a:Helpers shared by the bundled dashboard-auth providers. Each provider module keeps its own ``logger`` / ``LAST_SKIP_REASON`` (the gate reads those by module) and its ``register(ctx)``; the config/env resolution, skip/register bookkeeping, PKCE login start, token-endpoint exchange and JWT verification live here. ) annotationsN)AnyCallableDictOptional)DashboardAuthProviderInvalidCodeError LoginStart ProviderErrorRefreshExpiredErrorSessionclassify_jwks_lookup_errori,g$@Acceptapplication/jsonc ddlm}m}|}||g|ddi}t |t r|SiS#t$r}|j d||icYd}~Sd}~wwxYw)uThe ``config.yaml`` block at ``path`` as a dict, or ``{}`` — robust to load_config() raising (fresh install, malformed YAML), absent keys, or a non-dict value.r)cfg_get load_configzC%s: load_config() raised %s; falling back to env-only configurationNdefault)hermes_cli.configrr Exceptiondebug isinstancedict)loggertagpathrrcfgexcsections C/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/_shared.pyload_config_sectionr! se:mc/D/$/G $/77R7  Z\_ade s1 AAAActjj|djxst |xsdjS)zEnv-wins-over-config; an empty env value is treated as unset so a provisioned-but-blank secret can't shadow a valid config.yaml entry.)osenvirongetstripstr)env_name cfg_values r resolve_env_or_cfgr+.s9 ::>>(B ' - - / O3yB3G3M3M3OOc&eZdZdZddfd ZxZS)SkipRegistrationzRaised by a provider's settings resolver to decline registration; ``reason`` is the operator-facing text stored in the module's ``LAST_SKIP_REASON``.cBt||||c|_|_yN)super__init__reasonlevel)selfr3r4 __class__s r r2zSkipRegistration.__init__:s   "(% TZr,)r)r3r(r4r(returnNone)__name__ __module__ __qualname____doc__r2 __classcell__)r6s@r r.r.6sM00r,r.cb |}|di|}|j||dfS#t$r@}t||jd||jd|jfcYd}~Sd}~wtt f$r2}|j d|} |jd|| d| fcYd}~Sd}~wwxYw)aVBuild ``provider_cls(**settings())`` and register it on ``ctx``. Returns ``(kwargs, "")`` on success, ``(None, skip_reason)`` when ``settings`` raised ``SkipRegistration`` (logged at its level) or construction raised ``ValueError`` / ``ProviderError`` (logged as a warning). Callers store the reason in ``LAST_SKIP_REASON``. z%s: %sNz construction failed: r#) r.getattrr4r3 ValueErrorr r9warning register_dashboard_auth_provider) ctxrr provider_clssettingskwargsproviderskiprr3s r register_providerrJ?s )&)((2 2: !# #Hc4;;?T[[   & ))**@Fxf-V|s,& B.5A*$B.*B.<'B)#B.)B.cftj|jdjS)u6Base64url-encode without ``=`` padding (RFC 7636 §4).=)base64urlsafe_b64encoderstripdecode)raws r b64url_no_padrRXs'  # #C ( / / 5 < < >>r,ctjj|}|jdvrt d||j r|j j dst d|y)zFast-fail obviously-broken redirect_uris before bouncing to the IDP (whose allowlist is authoritative). Any ``http://`` host is allowed so dashboards behind TLS-terminating proxies / on LAN IPs aren't rejected.)httpshttpz"redirect_uri must be http(s), got z/auth/callbackz6redirect_uri path must end with '/auth/callback', got N)urllibparseurlparseschemer rendswith) redirect_uriparseds r validate_redirect_urir]]sm\\ " "< 0F }}--@@PQRR ;;fkk223CDTUaTdeffEr,c nttjd}ttjd}d||||ttj|j dj dd}t|dtjj|dd |d |i S) u Build the authorization-code + PKCE (S256) redirect and cookie payload. Callers validate ``redirect_uri`` first. The auth-route layer expects ``cookie_payload["hermes_session_pkce"]`` as a flat ``state=…;verifier=…`` string (it prepends ``provider=``).@ codeasciiS256) response_type client_idr[scopestatecode_challengecode_challenge_method?hermes_session_pkcezstate=z ;verifier=) redirect_urlcookie_payload) rRsecrets token_byteshashlibsha256encodedigestr rVrW urlencode) authorize_urlrerfr[ code_verifierrgparamss r pkce_login_startrxhs "'"5"5b"9:M '--b1 2Ei`epu'}7K7KG7T(U(\(\(^_!')F %a (>(>v(F'GH-wj/XY [[r,c|jjddjdsiS |j}t |t r|SiS#t$ricYSwxYw)zOJSON object body, or ``{}`` for non-JSON content-type / parse error / non-dict.z content-typer#r)headersr& startswithjsonrArr)responsebodys r parse_json_bodyrxse      3 > >?Q R }}dD)41r1  sA A! A!)rzc  tj||it|xsit}|j dk(r(t|jdd} ||d| |j dk7r*t |d |j d |jddt|} | j|} | rt| ts t |t| jd d j} | r| d k7rt d| | | fS#tj$r} t |d| | d} ~ wwxYw)uPOST a token grant and return ``(token, payload)``. A 400 (OAuth-shaped error envelope) raises ``bad_request_exc`` — ``InvalidCodeError`` for the auth-code path, ``RefreshExpiredError`` for refresh — so the middleware's distinct handling is preserved. Any other non-200, transport failure, missing ``token_key`` or non-bearer ``token_type`` raises ``ProviderError``. Redirects are deliberately NOT followed: the body carries an auth code / refresh token. )datarztimeoutz unreachable: Nierrorinvalid_requestz rejected token request: z returned z: token_typer#bearerzunexpected token_type=) httpxpost JSON_HEADERSTOKEN_ENDPOINT_TIMEOUT_SEC RequestErrorr status_coderr&textrr(lower)urlrrzbad_request_excidpendpoint token_key missing_msgr}r error_codepayloadtokenrs r exchange_tokenrsQG::c6Y6Y'-UW6Yc}~s"$X.227zlKLLs"xj 83G3G2H8==Y]Z]K^Jabcch'G KK "E  5#.K((W[[r2399;JjH,4ZNCDD '>   Gxjse<=3FGs)DD?)D::D?r#cP|jd}t|tr|r|S|S)zThe token response's refresh token, or ``fallback`` when absent/non-string (the session then behaves as access-token-only until expiry). refresh_token)r&rr()rfallbackrts r refresh_token_fromrs( _ %BB$299r,r)labelemail display_nameorg_idc t|jdd}|st|dt|||||t |d||S)z=Map verified JWT claims onto a Session; ``sub`` is mandatory.subr#z missing 'sub' (user_id) claimexp)user_idrrrrH expires_at access_tokenr)r(r&r r int) rHclaimsrrrrrrrs r session_from_claimsrs[&**UB'(G ug%CDEE u<Yave}%LP] __r,c4ddlm}||dtdddS)zPyJWKClient with explicit Accept/User-Agent (some WAFs block the library default). Imported lazily so plugin discovery stays cheap.r) PyJWKClientTrzHermesAgent/1.0)rz User-Agent) cache_keyslifespanrz)jwtrJWKS_CACHE_SECONDS)jwks_urlrs r make_jwks_clientrs' T,>-=NO QQr,c ddl} |j|} |j ||j |||dgdiS#t$r}t||d}~wwxYw#|j $r}t|d||d}~w|j$rn}d} |j |ddd  } d | jd d | jdd|d |d } n#t$rYnwxYwt|d|| |d}~wwxYw)uVerify ``token`` against ``jwks_client`` with pinned ``aud``/``iss``. Unreachable JWKS → ``ProviderError`` (503); a bearer that is not one of our JWTs (opaque peer key, foreign kid) → ``InvalidCodeError`` (None / next provider); folding both into 503 broke peer-key bearers. Expiry raises ``InvalidCodeError`` (verify_session maps it to None); any other claim failure raises ``ProviderError`` with the unverified iss/aud appended so operators can spot config drift. rNrequire)riataudissr) algorithmsaudienceissueroptionsz expired: r#F)verify_signature verify_exp)rz [token iss=rz aud=rz; expected iss=]z verification failed: ) rget_signing_key_from_jwtrrrPkeyExpiredSignatureErrorr InvalidTokenErrorr&r ) r jwks_clientrrrrr signing_keyrdetails unverifieds r verify_jwtrsI7!::5A Uzz ;??zHU[ CDF F 7 )-36 7  $ $C% 3%89sB  U E]b3cdJz~~e47uZ^^E=ReZdZUdZdZded<dZded<d dZd dZy) NonInteractiveMixinzOAuth-redirect stubs for providers without a browser login flow (password / service credential). ``_NOT_INTERACTIVE`` is the operator-facing reason; ``_NO_START_LOGIN`` optionally overrides the ``start_login`` message.r#r(_NOT_INTERACTIVE_NO_START_LOGINcHt|jxs |jr0)NotImplementedErrorrr)r5r[s r start_loginzNonInteractiveMixin.start_logins!$"6"6"O$:O:OPPr,c,t|jr0)rrr5rargrvr[s r complete_loginz"NonInteractiveMixin.complete_logins!$"7"788r,N)r[r(r7r rar(rgr(rvr(r[r(r7r ) r9r:r;r<r__annotations__rrrr?r,r rrs)9cOSQ9r,rcNeZdZUdZdZded<dZded<d dZd d Zdd Z dd Z y)JwtOAuthProvidera2Authorization-code + PKCE provider whose session token is a JWT we verify ourselves (nous: Portal access token; self-hosted: OIDC ID token). Subclasses set ``_client_id`` and implement: ``_jwks_uri() -> str``; ``_claims_for(token) -> claims`` (raises ``InvalidCodeError`` on expiry/foreign token, ``ProviderError`` otherwise); ``_grant(data, *, bad_request_exc, headers=None, previous_refresh_token="") -> Session``; ``_refresh_request(refresh_token) -> (form_data, extra_headers)``; ``_session(token, refresh_token, claims) -> Session``.Nr _jwks_clientr#r( _client_idcn|jt|j|_|jSr0)rr _jwks_uri)r5s r _get_jwks_clientz!JwtOAuthProvider._get_jwks_clients.    $ 01A BD    r,cP|jd|||j|dtS)Nauthorization_code) grant_typerar[rerv)r)_grantrr rs r rzJwtOAuthProvider.complete_login s1{{/|//M K,. .r,cv|s td|j|\}}|j||t|S)Nz#no refresh token present in session)rzrprevious_refresh_token)r _refresh_requestr)r5rrrzs r refresh_sessionz JwtOAuthProvider.refresh_sessionsH%&KL L--m< g{{ '3F_ln nr,cj |j|}|j|d|S#t$rYywxYw)Nr#) _claims_forr _session)r5rrs r verify_sessionzJwtOAuthProvider.verify_sessions@ %%l3F}}\2v66   s & 22)r7rr)rr(r7r )rr(r7zOptional[Session]) r9r:r;r<rrrrrrrr?r,r rrs2>L#J! .n7r,r)rlogging.Loggerrr(rr(r7r)r)r(r*rr7r() rrrr(rEtyperFzCallable[[], dict]r7ztuple[Optional[dict], str])rQbytesr7r()r[r(r7r8) rur(rer(rfr(r[r(r7r )r}zhttpx.Responser7Dict[str, Any])rr(rzDict[str, str]rzzOptional[Dict[str, str]]rztype[Exception]rr(rr(rr(rr(r7ztuple[str, Dict[str, Any]])r#)rrrr(r7r()rHr(rrrr(rr(rr(rr(rr(rr(r7r )rr(r7r)rr(rrrz list[str]rr(rr(rr(r7r)+r< __future__rrMrploggingr$rn urllib.parserVtypingrrrrrhermes_cli.dashboard_authrr r r r r rrrrr!r+rr.rJrRr]rxrrrrrrrrr?r,r rs#  00    !,- 8P0y0&)9=I[2? g [ 2LP "0Hbq (+:=B\<:rrQS _ _) _