߲jyUdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZddlmZmZmZmZej(eZdZd Zd Zd Zd Zd aded<ddZedddZGddee Z ddZ!ddZ"ddZ#ddiZ$dZ%y)urDrainSecretProvider — shared-bearer-secret auth for the drain-control endpoint. Non-interactive token capability of the ``DashboardAuthProvider`` ABC (``verify_token`` + the ``token_auth`` middleware seam): ``nous-account-service`` provisions a per-agent unique secret (``HERMES_DASHBOARD_DRAIN_SECRET``, env-only — it is a credential); an inbound bearer is compared constant-time and vouched for as the ``drain-control`` principal. Fail-CLOSED entropy gate at registration (length, distinct chars, Shannon bits); interactive ABC methods raise. Knobs ``scope`` / ``min_secret_chars`` live under ``dashboard.drain_auth``. ) annotationsN)Counter)Optional)DashboardAuthProviderSessionTokenPrincipal)NonInteractiveMixinSkipRegistrationload_config_sectionregister_providerzdashboard-auth-drain+g`@z/api/gateway/drainstrLAST_SKIP_REASONc|syt|tfdt|jD }|zS)zJTotal Shannon entropy (bits) of ``value`` over its character distribution.gc3ZK|]"}|z tj|z z$ywN)mathlog2).0cns J/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/drain/__init__.py z _shannon_bits..,s'P1QUdiiA..Ps(+)lensumrvalues)valueper_charrs @r _shannon_bitsr!'s<  E AP8M8M8OPPPH a< min_charsc|syt||krdt|d|dStt|}|tkr d|dtdSt|}|tkrd|d d td d Sy ) zHuman-readable rejection reason if ``secret`` is too weak, else ``None``. Checks, in order: length >= ``min_chars``, distinct chars >= ``_MIN_DISTINCT_CHARS``, Shannon entropy >= ``_MIN_SHANNON_BITS``.zsecret is emptyzsecret too short: z chars (need >= z]; use a >=256-bit value, e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`)zsecret has only z distinct characters (need >= z); looks structured/low-entropyzsecret entropy too low: z.0fz bits (need >= z); looks structured/repeatedN)rset_MIN_DISTINCT_CHARSr!_MIN_SHANNON_BITS)secretr$distinctbitss rassess_secret_strengthr,0s   6{Y V -=i[I3 3 43v;H%%!(+IJ]I^^}~~  D )$s?CTUXBYYuvv r"cVeZdZdZdZdZdZdZdZdZ dd dd Z dd Z dd Z dd Z ddZy)DrainSecretProviderz@Non-interactive shared-bearer-secret provider for drain control.z drain-secretz"Drain Control (service credential)TFz @S@ST[@\]!OdiiY]YdYdXfg gr"cyr)r5 access_tokens rverify_sessionz"DrainSecretProvider.verify_sessionbsr"c,t|jr)NotImplementedError_NOT_INTERACTIVEr5 refresh_tokens rrefresh_sessionz#DrainSecretProvider.refresh_sessiongs!$"7"788r"cyrrCrIs rrevoke_sessionz"DrainSecretProvider.revoke_sessionjsr"N)r)rr0rreturnNone)r@rrNzOptional[TokenPrincipal])rDrrNzOptional[Session])rJrrNr)rJrrNrO)__name__ __module__ __qualname____doc__r? display_namesupports_tokensupports_sessionrH_NO_START_LOGINr7rArErKrMrCr"rr.r.DsAJ D7LNUlO4;' 9r"r.c.tttddS)N dashboard drain_auth)r logger_TAGrCr"r_load_config_drain_auth_sectionr]ps vt[, GGr"ctjjddj}|s t dt }t |jddxsdjxsd} t|jdt}t||}|t d|d d ||d S#ttf$r t}Y=256-bit secret (e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`) to enable NAS-driven drain coordination; leave it unset to disable the drain endpoint.r0r/min_secret_charsr#u+HERMES_DASHBOARD_DRAIN_SECRET rejected — z2. The drain endpoint stays disabled (fail-closed).warning)level)r)r0) osenvirongetstripr r]rint_DEFAULT_MIN_SECRET_CHARS TypeErrorr2r,)r)sectionr0r$r6s r _settingsrkts ZZ^^;R @ F F HF  [\ \./G  GW-8 9 ? ? A LWE. $68QRS $Fi @F 9&As t u -- z ".- .s8B<<CCcdat|tttt \}a|y ddlm}|ttjd|dty#t$r%}tjdt|Yd}~Hd}~wwxYw)aRegister ``DrainSecretProvider`` when a strong secret is set; no-op (records a skip reason) when ``HERMES_DASHBOARD_DRAIN_SECRET`` is unset or fails the entropy gate. On success also registers the drain route as token-authable via the generic seam.rNr)register_token_routez;dashboard-auth-drain: could not register token route %s: %szWdashboard-auth-drain: registered drain service-credential provider (scope=%s, route=%s)r0) rr r[r\r.rk$hermes_cli.dashboard_auth.token_authrmDRAIN_ROUTE_PATH Exceptionrainfo)ctxkwargsrmexcs rregisterrus 0fdDWYbcF  ~mM-. KKaw)+ mTVfhkllmsA B#BB LoginStart)zhermes_cli.dashboard_authrvctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_once) _PLUGIN_COMPAT_LAZYreAttributeErrorrP importlibhermes_cli.plugin_compatrxgetattr import_module)r?targetr|rxs r __getattr__rse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AAr")rrrNfloat)r)rr$rgrNz Optional[str])rNdict)rNrO)&rS __future__rr<loggingrrc collectionsrtypingrhermes_cli.dashboard_authrrrplugins.dashboard_auth._sharedr r r r getLoggerrPr[r\rhr'r(ror__annotations__r!r,r.r]rkrurzrrCr"rrs#  TTxx   8 $(#=V('-/D'XH.,+:= Br"