߲j'D^UdZddlmZddlZddlZddlZddlZddlZddl m Z m Z m Z ddl Z ddlmZmZmZddlmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!ejDe#Z$dZ%dZ&d Z'd Z(d Z)d a*d e+d<ddZ,ddZ-GddeZ.ddZ/ddZ0ddZ1ddl2Z2ddl3Z3ddl4Z4dddddZ5dZ6y) uSelfHostedOIDCProvider — generic self-hosted OpenID Connect dashboard auth. A plain OIDC Relying Party (Authentik, Keycloak, Zitadel, Authelia, Auth0, Okta, …): discovers endpoints from ``{issuer}/.well-known/openid-configuration``, builds the PKCE (S256) authorize URL, exchanges the code, and verifies the **ID token** (the access token is opaque per spec) against the discovered ``jwks_uri`` with ``iss``/``aud`` pinned. Public and confidential (``client_secret`` layered on top of PKCE, never replacing it) clients both work. Config: ``dashboard.oauth.self_hosted.{issuer,client_id,scopes,client_secret}`` or ``HERMES_DASHBOARD_OIDC_*``. ) annotationsN)AnyDictOptional) LoginStart ProviderErrorSession) JSON_HEADERSTOKEN_ENDPOINT_TIMEOUT_SECJwtOAuthProviderSkipRegistrationexchange_tokenload_config_sectionparse_json_bodypkce_login_startrefresh_token_fromregister_providerresolve_env_or_cfgsession_from_claimsvalidate_redirect_uri verify_jwtzdashboard-auth-self-hostedzopenid profile email)RS256ES256RS384RS512ES384ES512g$@istrLAST_SKIP_REASONctjj|}|jdk(s!|jdk(r|jxsddvr|St d|d|)zReject non-HTTPS endpoint URLs (loopback http allowed) so a misconfigured issuer can't ship auth codes / refresh tokens in cleartext.httpshttpr) localhostz 127.0.0.1z::1zOIDC z. must be https:// (or http on localhost), got )urllibparseurlparseschemehostnamer)urlfieldparseds P/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/self_hosted/__init__.py_require_https_or_loopbackr.:sa\\ " "3 'F }}FMMV$;AVTV[|@| %w&TUXT[\ ]]ctjj|}|jj }||j xsdj |j xsdddj|fS)z``(scheme, hostname, port)`` for an origin compare, with default ports normalised so ``https://h`` and ``https://h:443`` are the same origin.riP)r"r#)r%r&r'r(lowerr)portget)r*partsr(s r-_originr6Csi LL ! !# &E \\   !F U^^)r002 JJ @C488@ BBr/ceZdZdZdZdZeddddZddZddZ dd Z dd Z d dd  dd Z ddZ ddZddZddZddZeZddZy )SelfHostedOIDCProviderzHGeneric self-hosted OpenID Connect provider (authorization-code + PKCE).z self-hostedzSelf-Hosted OIDCr)scopes client_secretch|s td|s td|jd|_t|jd||_|j xst |_|xsdj |_d|_ d|_ tj|_ d|_y)Nzissuer is requiredzclient_id is required/issuerr+rg) ValueErrorrstrip_issuerr. _client_idstrip_DEFAULT_SCOPES_scopes_client_secret _discovery_discovery_fetched_at threadingLock_discovery_lock _jwks_client)selfr= client_idr9r:s r-__init__zSelfHostedOIDCProvider.__init__Rs12 245 5}}S) "4<DDF$($=$=e$D! M&?Y]YhYhwlvw O JJxd4U|4U}4U_z {   O LLH# N N Os)B+%B  BB C )CC c|jsiifS|jdxsg}d|vrd|vrd|jiifStjj |j ddtjj |jd}idd t j|jd jd ifS) uS``(extra_data, extra_headers)`` for token-endpoint client auth. Public client → ``({}, {})`` (PKCE alone). Confidential client → ``client_secret_post`` when the IDP advertises it *without* ``client_secret_basic``, else HTTP Basic (the OIDC default and the fallback when nothing is advertised). RFC 6749 §2.3.1.%token_endpoint_auth_methods_supportedclient_secret_postclient_secret_basicr:r)safe: AuthorizationzBasic zutf-8ascii) rFr4r%r&quoterBbase64 b64encodeencodedecode)rMrUmethodsuserpasss r-r_z+SelfHostedOIDCProvider._token_endpoint_auths ""r6M))CDJ 7 */DG/S#T%8%892= =ll((r(BC1V\\EWEWX\XkXkrtEWEuDvwOvf.>.>xw?W.X._._`g.h-i%jkkkr/c<d|j||jddfS)NrY) grant_typerNrYrR)rBrE)rMrYs r-_refresh_requestz'SelfHostedOIDCProvider._refresh_requests)+[hll $  r/N)r]previous_refresh_tokenc |j}|j|\}}t|di||||dddd\}} |j|} |j |t | || S)uPOST the discovered token endpoint and turn the response into a Session. Confidential-client auth (body field or Basic header) is added for both grants — the IDP rejects an unauthenticated refresh with ``invalid_client``.token_endpointIDPzOIDC token endpointid_tokenuOIDC token response missing id_token — ensure the 'openid' scope is configured and the client is allowed to receive an ID token.)r]bad_request_excidprf token_key missing_msg)rTr_r_verify_id_token_sessionr) rMr\rr]r}rUrgrhrpayloadclaimss r-_grantzSelfHostedOIDCProvider._grants##%$($=$=e$D! M* " #%;%; %;]ds 5 '&&x0}}X'9'CY'Z\bccr/c|j4tj|jz tkr |jSyN)rGtimerH_DISCOVERY_CACHE_TTL_SECrMs r-_fresh_discoveryz'SelfHostedOIDCProvider._fresh_discoverys2 ?? &499;9S9S+SVn+n?? "r/c|j}|`|j5|j}|7|jx}|_t j|_d|_ddd|S|S#1swY|SxYw)zSReturn the cached OIDC discovery document, fetching if stale (double-checked lock).N)rrK_fetch_discoveryrGrrHrL)rMrUs r-rTz%SelfHostedOIDCProvider._get_discoverys~%%' =%% ---/=.2.C.C.EEEDO15D.(,D%  -  u  -  s A A55A?c |jd} tj|ttd}|jdk7rt d|jd|tt|jt|jk7r&t d|jd |jd t| s t d d fd }d Dcic] }||| }}t|js t d|d}|r9|jd|jk7rt d|d|j|jD]\}}t!|| jd} d|xs |ji||dt#| t$r| D cgc] } t| c} dSgdS#tj $r}t d||d}~wwxYwcc}wcc} w)Nz!/.well-known/openid-configurationT)r]r^follow_redirectszOIDC discovery unreachable: zOIDC discovery returned z for zOIDC discovery resolved to z*, outside the configured issuer's origin ()z'OIDC discovery returned a non-JSON bodyc^tj|dxsdjS)Nr)rr4rC)keyrs r-r+z6SelfHostedOIDCProvider._fetch_discovery..fields'w{{3+1r288: :r/)rQrjwks_urizPOIDC discovery missing one of authorization_endpoint / token_endpoint / jwks_urir=r<z4OIDC discovery issuer mismatch: document advertises z but configured issuer is r>rlrX)rXrl)rrreturnr)rAr`r4r _DISCOVERY_TIMEOUT_SEC RequestErrorr status_coder6rr*rallvaluesr@itemsr. isinstancelist) rMr*responserir+k endpointsadvertised_issuerrauth_methods_rawmrs @r-rz'SelfHostedOIDCProvider._fetch_discoverys8?@ O yylDZmqrH   3 &":8;O;O:PPUVYU\ ]^ ^ 3x||$ %)> >-hll^<$$(LL#3167 7"(+ IJ J ;+ccQQa[c c9##%& rs s"(O !2!9!9#!>$,,!NFGXF[\,,0LL+;=> >") 7HC &s# 6 7#;;'NO '74<<cc$))>#?6@AQSW6X!12AQ2 c c _a c cG!! O">se DE3 N O*d&3s#!GG=6HG:&G55G:c(|jdS)Nr)rTrs r- _jwks_uriz SelfHostedOIDCProvider._jwks_uris""$Z00r/c|jd}t||jtt|j |dS)Nr=ID token) algorithmsaudiencer=label)rTr_get_jwks_clientr_ALLOWED_ID_TOKEN_ALGSrB)rMrr=s r-rz'SelfHostedOIDCProvider._verify_id_tokensE$$&x0 d++-$?U:V__V:G Gr/c t|jddxsd}|jdxs|jdxsd}|jd}|s*t|tr|rdj d|D}t |j |||d|t|jd xs,|jd xs|jd xs|xsdt|xsd S) uMap verified OIDC claims onto a Session. The verified ID token is stored in ``Session.access_token`` so the per-request ``verify_session`` re-verifies a real JWT; the opaque OAuth access token is not kept — the dashboard only needs identity.emailrorg_id organizationgroups,c32K|]}t|ywr)r).0gs r- z2SelfHostedOIDCProvider._session.. s5c!f5srnamepreferred_usernamenickname) access_tokenrYrr display_namer)rr4rrjoinrr)rMrrYrrrrs r-rzSelfHostedOIDCProvider._sessionsFJJw+1r2H%IN)CIrH%*VT2vXX5f55F" IIvHMYckpVZZ/|6::>R3S|W]WaWablWm|qv|z|}v|$& &r/) r=rrNrr9rr:rrNone)rSrrr)rYrrr)rUDict[str, Any]rz%tuple[Dict[str, str], Dict[str, str]])rYrrz/tuple[Dict[str, str], Optional[Dict[str, str]]]) r\zDict[str, str]rztype[Exception]r]zOptional[Dict[str, str]]r}rrr )rzDict[str, Any] | None)rr)rr)rrrr)rrrYrrrrr )__name__ __module__ __qualname____doc__rrrDrOrVrjr_r|rrrTrrr _claims_forrr/r-r8r8LsR D%LETkm&*w. lnr&(d"d8GdRjd #d d, 0ch1G #K&r/r8c0tttdddS)N dashboardoauth self_hosted)rrd_TAGrr/r-_load_config_oauth_sectionrs vt['= QQr/ctdfd }|dd}|dd}|r|s$tdt|dt|d|||d d xst|d d d S)zYResolve SelfHostedOIDCProvider kwargs; the skip reason names BOTH configuration surfaces.c:t|j|Sr)rr4)env_namecfg_keyoidc_cfgs r-settingz_settings..settings!(HLL,ABBr/HERMES_DASHBOARD_OIDC_ISSUERr=HERMES_DASHBOARD_OIDC_CLIENT_IDrNu:Self-hosted OIDC dashboard auth is not configured. Set both an issuer and a client_id — either as env vars (HERMES_DASHBOARD_OIDC_ISSUER + HERMES_DASHBOARD_OIDC_CLIENT_ID) or under dashboard.oauth.self_hosted.{issuer,client_id} in config.yaml — or pass --insecure to skip the OAuth gate entirely. (issuer set: z; client_id set: rHERMES_DASHBOARD_OIDC_SCOPESr9#HERMES_DASHBOARD_OIDC_CLIENT_SECRETr:)r=rNr9r:)rrrrrr)rr boolrD)rr=rNrs @r- _settingsrs)+HC3X >F9;GI  F|T)_  ./ /y8(CV !FX  ZZr/c dat|tttt \}a|/tj d|d|d|dt|dyy)zIRegister :class:`SelfHostedOIDCProvider` when issuer + client_id are set.rNzedashboard-auth-self-hosted: registered provider (issuer=%s, client_id=%s, scopes=%r, confidential=%s)r=rNr9r:)r rrdrr8rinfor)ctxkws r-registerr1s],S&$@VXabB ~ s xL"[/2h<b>Q9R Tr/)hermes_cli.dashboard_authDashboardAuthProvider)rInvalidCodeError)rRefreshExpiredError)rclassify_jwks_lookup_error)rrrrctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_once) _PLUGIN_COMPAT_LAZYr4AttributeErrorr importlibhermes_cli.plugin_compatrgetattr import_module)rtargetrrs r- __getattr__rMse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AAr/)r*rr+rrr)r*rrtuple)rdict)rr)7r __future__rrtloggingrIr urllib.parser%typingrrrr`hermes_cli.dashboard_authrrr plugins.dashboard_auth._sharedr r rbr r rrrrrrrrrr getLoggerrrdrrDrrrr __annotations__r.r6r8rrrhashlibossecretsrrrr/r-rs#  && HH   8 $#) P #^BD&-D&RRZ0T TIO"] Br/