߲j #.UdZddlmZddlZddlmZmZmZddlm Z m Z m Z ddl m Z mZmZmZmZmZmZmZmZmZmZej0eZdZdZd Zd Zd ad e d <Gdde Z!ddZ"ddZ#ddZ$ddl%Z%ddl&Z&ddl'Z'ddl(Z(ddl)Z)ddl*Z+dddddZ,dZ-y)utNousDashboardAuthProvider — Nous Portal OAuth (authorization-code + PKCE). Implements ``nous-account-service/docs/agent-dashboard-oauth-contract.md``; registers only when a client_id (``dashboard.oauth.client_id`` / ``HERMES_DASHBOARD_OAUTH_CLIENT_ID``, shape ``agent:{instance_id}``) is configured. Access tokens are RS256 JWTs verified against the Portal JWKS with ``aud`` = bare client_id. Portal issues a 24h *rotating* refresh token with reuse detection: the middleware MUST persist ``Session.refresh_token`` back to the cookie on every refresh or the next refresh replays a rotated token and revokes the whole session. ) annotationsN)AnyDictOptional) LoginStart ProviderErrorSession) JwtOAuthProviderSkipRegistrationexchange_tokenload_config_sectionpkce_login_startrefresh_token_fromregister_providerresolve_env_or_cfgsession_from_claimsvalidate_redirect_uri verify_jwtzdashboard-auth-nouszhttps://portal.nousresearch.comzagent_dashboard:accessstrLAST_SKIP_REASONcreZdZdZdZdZddZddZddZddZ ddZ d d d  dd Z dd Z ddZ y )NousDashboardAuthProviderz7Nous Portal OAuth via authorization-code + PKCE (S256).nousz Nous Researchc(|jdstd|||_|tdd|_|j d|_|j d|_|j d|_|j d|_ d|_ y)Nagent:z?client_id must match contract shape 'agent:{instance_id}', got /z/.well-known/jwks.jsonz/oauth/authorizez/api/oauth/token) startswith ValueError _client_idlen_agent_instance_idrstrip _portal_url _jwks_url_authorize_url _token_url _jwks_client)self client_id portal_urls I/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/nous/__init__.py__init__z"NousDashboardAuthProvider.__init__.s##H-`aj`mno o#"+CMO"<%,,S1 ,,--CD!%!1!1 22BC!--..>?!%cft|t|j|jt|S)N)r+scope redirect_uri)rrr'r!_SCOPE)r*r2s r- start_loginz%NousDashboardAuthProvider.start_login:s'l+ 3 3tV\kwxxr/cyNr* refresh_tokens r-revoke_sessionz(NousDashboardAuthProvider.revoke_session>sr/c|jSr6)r&)r*s r- _jwks_uriz#NousDashboardAuthProvider._jwks_uriEs ~~r/c*d|j|dd|ifS)Nr9) grant_typer+r9zx-nous-refresh-token)r!r8s r-_refresh_requestz*NousDashboardAuthProvider._refresh_requestHs% +[h i #] 35 5r/Nr)headersprevious_refresh_tokenc t|j|||dddd\}}|j|t||j |S)NPortalzPortal token endpoint access_tokenz*Portal token response missing access_token)r@bad_request_excidpendpoint token_key missing_msg)r r(_sessionr _claims_for)r*datarEr@rArDpayloads r-_grantz NousDashboardAuthProvider._grantPsS!/ OOT7O#:nD!F g }}\+=g+FHXHXYeHfggr/ct||jdg|j|jd}|j d}|*||j k7rt d|d|j |j d}|tjdt|S|tk7rt d |d t|S) NRS256z access token) algorithmsaudienceissuerlabelagent_instance_idz"agent_instance_id mismatch: token=z vs configured=oauth_contract_versionzjNous Portal token missing oauth_contract_version claim (contract says it should be %d); proceeding anyway.z#unsupported oauth_contract_version=z , expected ) r_get_jwks_clientr!r%getr#rloggerwarning_EXPECTED_CONTRACT_VERSION)r*rDclaimstoken_instance_idcontract_versions r-rKz%NousDashboardAuthProvider._claims_for\s $//1wi__##>; #JJ':;  (->$BYBY-Y45F4IY]YpYpXstv v!::&>?  # NN|* ,  !; ;56F5IUoTpqs s r/c nt|j|||t|jdxsdS)Norg_idr)rDr9r`)rnamerrX)r*rDr9r\s r-rJz"NousDashboardAuthProvider._sessionrs9" IIvL ^abhblblmubvb|z|^} r/)r+rr,rreturnNone)r2rrbr)r9rrbrc)rbr)r9rrbz/tuple[Dict[str, str], Optional[Dict[str, str]]]) rLzDict[str, str]rEztype[Exception]r@zOptional[Dict[str, str]]rArrbr )rDrrbDict[str, Any])rDrr9rr\rdrbr )__name__ __module__ __qualname____doc__ra display_namer.r4r:r<r?rNrKrJr7r/r-rr(ssA D"L &y5nr&( h" h8G hRj h # h  h,r/rc.tttddS)N dashboardoauth)r rY_TAGr7r/r-_load_config_oauth_sectionrnzs vt[' BBr/ct}td|jdd}td|jddxst}|s t d|j dst d|d d ||d S) z\Resolve NousDashboardAuthProvider kwargs; the skip reason names BOTH configuration surfaces. HERMES_DASHBOARD_OAUTH_CLIENT_IDr+rHERMES_DASHBOARD_PORTAL_URLr,uyHERMES_DASHBOARD_OAUTH_CLIENT_ID is not set (and dashboard.oauth.client_id in config.yaml is empty). The Nous Portal provisions this env var (shape 'agent:{instance_id}') when it deploys a Hermes Agent instance — set it to your provisioned client id (either as an env var or under dashboard.oauth.client_id in config.yaml), or pass --insecure to skip the OAuth gate entirely.rz!HERMES_DASHBOARD_OAUTH_CLIENT_ID=z doesn't match the contract shape 'agent:{instance_id}'. The Nous Portal provisions this value at deploy time; check your Fly app's secrets or override with the value from the Portal admin UI.rZ)level)r+r,)rnrrX_DEFAULT_PORTAL_URLr r)sectionr+r,s r- _settingsru~s(*G"#Ew{{S^`bGcdI#$A7;;|]_C`axexJ  #$ $    )/ }=f g   #* ==r/cdat|tttt \}a|tj d|d|dyy)zFRegister ``NousDashboardAuthProvider`` when a client_id is configured.rNzBdashboard-auth-nous: registered provider (client_id=%s, portal=%s)r+r,)rrrYrmrruinfo)ctxkwargss r-registerrzsQ0fdD]_hiF   PRXYdRegmnzg{ }r/)hermes_cli.dashboard_authDashboardAuthProvider)r{InvalidCodeError)r{RefreshExpiredError)r{classify_jwks_lookup_error)r|r}r~rctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncer) _PLUGIN_COMPAT_LAZYrXAttributeErrorre importlibhermes_cli.plugin_compatrgetattr import_module)ratargetrrs r- __getattr__rse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AAr/)rbdict)rbrc).rh __future__rloggingtypingrrrhermes_cli.dashboard_authrrr plugins.dashboard_auth._sharedr r r r rrrrrrr getLoggerrerYrmrsr3r[r__annotations__rrnrurzbase64hashlibhttpxossecrets urllib.parseurllibrrr7r/r-rs#&&HH       8 $7 !#M 0MdC>,} TIO"] Br/