+ jHjh<Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t H t HtHt^RIt^RIHtHtHtHtHtHtHtRtRtRR/tR tR R ltR R ltRRlt!RR] 4t!RRlt"RRlt#RRlt$RRlt%RRlt&RR/RRllt'R2R R!llt(R"R#R$RR%RR&R/R'R(llt)R)R*lt*R+]/R,R-llt+!R.R/4t,!R0R1]4t-R#)3a:Helpers shared by the bundled dashboard-auth providers. Each provider module keeps its own ``logger`` / ``LAST_SKIP_REASON`` (the gate reads those by module) and its ``register(ctx)``; the config/env resolution, skip/register bookkeeping, PKCE login start, token-endpoint exchange and JWT verification live here. ) annotationsN)AnyCallableDictOptional)DashboardAuthProviderInvalidCodeError LoginStart ProviderErrorRefreshExpiredErrorSessionclassify_jwks_lookup_errori,g$@Acceptapplication/jsongN@c(V^8dQhRRRRRRRR/#)loggerlogging.Loggertagstrpathreturndict)formats"C/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/_shared.py __annotate__r's( 8 8 8S 8 8 8c^RIHpHpV!4pT!T.TO5RR/p\ T\ 4'dT#/# \dpTP RY4/uRp?#Rp?ii;i)uThe ``config.yaml`` block at ``path`` as a dict, or ``{}`` — robust to load_config() raising (fresh install, malformed YAML), absent keys, or a non-dict value.)cfg_get load_configzC%s: load_config() raised %s; falling back to env-only configurationNdefault)hermes_cli.configrr Exceptiondebug isinstancer)rrrrr cfgexcsections&&* rload_config_sectionr)'se:mc/D/$/G $//77R7  Z\_e s7 A AA A c$V^8dQhRRRRRR/#)renv_namer cfg_valuerrr)rs"rrr5s&PPPPPrc\PPVR4P4;'g$\ T;'gR4P4#)zEnv-wins-over-config; an empty env value is treated as unset so a provisioned-but-blank secret can't shadow a valid config.yaml entry.)osenvirongetstripr)r+r,s&&rresolve_env_or_cfgr35s> ::>>(B ' - - / O O3yB3G3M3M3OOrc V^8dQhRRRR/#)rrawrrfloatr)rs"rrr;scercVf\#\V4P4pV'g\#\V4p\ P !T4'dT^8dR#T# \dR#i;i)uSeconds of clock-skew tolerance for JWT time claims, fail-closed. Unset → :data:`DEFAULT_TOKEN_LEEWAY_SECONDS` (60s — the zero-leeway default made any issuer-ahead clock skew fail, #47815). An explicit value must be a finite, non-negative number: unparseable / negative / NaN / inf fall back to ``0.0`` so a typo can only ever *lose* tolerance, never widen the window. ``0`` is honoured (strict pre-fix behaviour for operators who want it). g)DEFAULT_TOKEN_LEEWAY_SECONDSrr2r6 ValueErrormathisfinite)r5textvalues& r parse_leewayr>;si {++ s8>> D ++d  ==  519 L s A%% A43A4c6a]tRt^TtRtRRV3RllltRtV;t#)SkipRegistrationzRaised by a provider's settings resolver to decline registration; ``reason`` is the operator-facing text stored in the module's ``LAST_SKIP_REASON``.c$V^8dQhRRRRRR/#)rreasonrlevelrNoner)rs"rrSkipRegistration.__annotate__Xs!00s030T0rc B<\SV`V4WuVnVnR#N)super__init__rBrC)selfrBrC __class__s&&&rrISkipRegistration.__init__Xs  "( TZr)rCrB)r$)__name__ __module__ __qualname____firstlineno____doc__rI__static_attributes__ __classcell__)rKs@rr@r@TsM000rr@c ,V^8dQhRRRRRRRRR R /#) rrrrr provider_clstypesettingszCallable[[], dict]rztuple[Optional[dict], str]r)rs"rrr]s4&)9=I[rcdV!4pV!R/VBpTPT4TR3# \d?p\YP4!RY'P4RTP3uRp?#Rp?i\\ 3d2pTP RT 2p TPRY)4RT 3uRp?#Rp?ii;i)aFBuild ``provider_cls(**settings())`` and register it on ``ctx``. Returns ``(kwargs, "")`` on success, ``(None, skip_reason)`` when ``settings`` raised ``SkipRegistration`` (logged at its level) or construction raised ``ValueError`` / ``ProviderError`` (logged as a warning). Callers store the reason in ``LAST_SKIP_REASON``. z%s: %sNz construction failed: r.r) r@getattrrCrBr9r rMwarning register_dashboard_auth_provider) ctxrrrUrWkwargsproviderskipr'rBs &&&&& rregister_providerr`]s )&)((2 2: ! #Hc;;?T[[   & ))**@Fx-V|s2& B/3A*$B/*B/=B/>&B*$B/*B/c V^8dQhRRRR/#)rr5bytesrrr)rs"rrrvs??u??rch\P!V4PR4P4#)u6Base64url-encode without ``=`` padding (RFC 7636 §4).=)base64urlsafe_b64encoderstripdecode)r5s&r b64url_no_padrivs'  # #C ( / / 5 < < >>rc V^8dQhRRRR/#)r redirect_urirrrDr)rs"rrr{sggggrc\PPV4pVPR9d\ RV: 24hVP 'd"VP P R4'g\ RV: 24hR#)zFast-fail obviously-broken redirect_uris before bouncing to the IDP (whose allowlist is authoritative). Any ``http://`` host is allowed so dashboards behind TLS-terminating proxies / on LAN IPs aren't rejected.z"redirect_uri must be http(s), got z/auth/callbackz6redirect_uri path must end with '/auth/callback', got N)httpshttp)urllibparseurlparseschemer rendswith)rkparseds& rvalidate_redirect_uriru{sr\\ " "< 0F }}--@@PQRR ;;;fkk223CDDTUaTdeffErc ,V^8dQhRRRRRRRRRR/#)r authorize_urlr client_idscoperkrr r)rs"rrrs8 [ [C [s [3 [VY [^h [rc\\P!^@44p\\P!^ 44pRRRVRVRVRVR\\P!VP R44P 44R R /p\V R \PPV4 2R R V RV 2/R7#)uBuild the authorization-code + PKCE (S256) redirect and cookie payload. Callers validate ``redirect_uri`` first. The auth-route layer expects ``cookie_payload["hermes_session_pkce"]`` as a flat ``state=…;verifier=…`` string (it prepends ``provider=``). response_typecoderxrkrystatecode_challengeasciicode_challenge_methodS256?hermes_session_pkcezstate=z ;verifier=) redirect_urlcookie_payload) risecrets token_byteshashlibsha256encodedigestr rorp urlencode)rwrxryrk code_verifierr}paramss&$$$ rpkce_login_startrs "'"5"5b"9:M '--b1 2EiW^`egnpu-}7K7KG7T(U(\(\(^_)F %a (>(>v(F'GH-wj/XY [[rc V^8dQhRRRR/#)rresponsezhttpx.Responserdict[str, Any]r)rs"rrrs22n22rcVPPRR4PR4'g/#VP4p\ T\ 4'dT#/# \d/u#i;i)zOJSON object body, or ``{}`` for non-JSON content-type / parse error / non-dict.z content-typer.r)headersr1 startswithjsonr9r%r)rbodys& rparse_json_bodyrsk      3 > >?Q R R }}dD))41r1  sA A/.A/rc<V^8dQhRRRRRRRRR RR RR RR RR R/ #)rurlrdatazdict[str, str]rzOptional[dict[str, str]]bad_request_excztype[Exception]idpendpoint token_key missing_msgrztuple[str, dict[str, Any]]r)rs"rrrsT "0Hbq (+:=B\rc\P!Y/\CT;'g/C\R7pTP R8Xd)\T4PRR4p T!T RT 24hTP ^8wd0\ T RTP R TPR ,: 24h\T4p T PT4p T 'd\T \4'g \ T4h\T PR R 44P4p T 'dT R 8wd\ RT : 24hY3# \Pdp \ T RT 24T hRp ? ii;i)uPOST a token grant and return ``(token, payload)``. A 400 (OAuth-shaped error envelope) raises ``bad_request_exc`` — ``InvalidCodeError`` for the auth-code path, ``RefreshExpiredError`` for refresh — so the middleware's distinct handling is preserved. Any other non-200, transport failure, missing ``token_key`` or non-bearer ``token_type`` raises ``ProviderError``. Redirects are deliberately NOT followed: the body carries an auth code / refresh token. )rrtimeoutz unreachable: Nierrorinvalid_requestz rejected token request: z returned z: :NN token_typer.bearerzunexpected token_type=) httpxpost JSON_HEADERSTOKEN_ENDPOINT_TIMEOUT_SEC RequestErrorr status_coderr1r<r%rlower)rrrrrrrrrr' error_codepayloadtokenrs&&$$$$$$ rexchange_tokenrsOG::c6Y6Y'--UW6Yc}~s"$X.227zlKLLs"xj 83G3G2H8==Y]K^Jabcch'G KK "E  5#..K((W[[r2399;JjH,4ZNCDD >   Gxjse<=3FGs D9D99E$EE$r.c$V^8dQhRRRRRR/#)rrrfallbackrrr)rs"rrrs!:::#:s:rchVPR4p\V\4'd V'dV#T#)zThe token response's refresh token, or ``fallback`` when absent/non-string (the session then behaves as access-token-only until expiry). refresh_token)r1r%r)rrrts&& rrefresh_token_fromrs+ _ %BB$$299rlabelremail display_nameorg_idc<V^8dQhRRRRRRRRRRRRR RR RR R / #) rr^rclaimsr access_tokenrrrrrrr r)rs"rrrsT - - -) --|=NO QQrleewayc8V^8dQhRRRRRRRRRRR RR R R R /#)rrr jwks_clientr algorithmsz list[str]audiencerrrr6rrr)rs"rrrsX3U3U 3U 3U1:3UFI3USV3U_b3U 3U3Urc ^RIpVPV4pTP YP Y#YFR.RO/R7# \dp \T 4T hRp ? ii;i TP dp \T RT 24T hRp ? iTPdp \T RT 24T hRp ? iTPdp \T RT 24T hRp ? iTPdvp R p TP TR R R R /R 7p RT PR4: RT PR4: RT: RT: R2 p M \dMi;i\T RT T 24T hRp ? ii;i)uVerify ``token`` against ``jwks_client`` with pinned ``aud``/``iss``. ``leeway`` is seconds of clock-skew tolerance on the time claims (default 60 — the previous zero-leeway made any issuer-ahead skew fail login, #47815). Unreachable JWKS → ``ProviderError`` (503); a bearer that is not one of our JWTs (opaque peer key, foreign kid) → ``InvalidCodeError`` (None / next provider); folding both into 503 broke peer-key bearers. Expiry and not-yet-valid (``iat``/``nbf`` in the future beyond the leeway — a *token* failure, not a transport failure) raise ``InvalidCodeError`` (verify_session maps it to None); any other claim failure raises ``ProviderError`` with the unverified iss/aud appended so operators can spot config drift. Nrequireaudr)rrrroptionsz expired: z signature invalid: z not yet valid: r.verify_signatureF verify_exp)rz [token iss=z aud=z; expected iss=]z verification failed: )riatrrr) rget_signing_key_from_jwtr#r rhkeyExpiredSignatureErrorrInvalidSignatureErrorImmatureSignatureErrorInvalidTokenErrorr1r ) rrrrrrrr signing_keyr'details unverifieds &&$$$$$ r verify_jwtrs"7!::5A Uzz ??zU[ CDF F 7)-367  $ $C% 3%89sB  $ $M%(?SH  U E4F|]b3cdJz~~e47uZ^^E=R str``; ``_claims_for(token) -> claims`` (raises ``InvalidCodeError`` on expiry/foreign token, ``ProviderError`` otherwise); ``_grant(data, *, bad_request_exc, headers=None, previous_refresh_token="") -> Session``; ``_refresh_request(refresh_token) -> (form_data, extra_headers)``; ``_session(token, refresh_token, claims) -> Session``.Nr _jwks_clientr.r _client_idcV^8dQhRR/#)rrrr)rs"rrJwtOAuthProvider.__annotate__2s!!#!rc rVPf\VP44VnVP#rG)rr _jwks_uri)rJs&r_get_jwks_client!JwtOAuthProvider._get_jwks_client2s.    $ 01A BD    rc ,V^8dQhRRRRRRRRRR/#rr)rs"rrr7s1..c.#.c.Y\.ah.rc  XVPRRRVRVRVPRV/\R7#) grant_typeauthorization_coder|rkrxr)r)_grantrrrs&$$$$rrJwtOAuthProvider.complete_login7s<{{ /~| $//?M K,. .rc V^8dQhRRRR/#)rrrrr r)rs"rrr>snnnnrc ~V'g \R4hVPV4wr#VPW#\VR7#)z#no refresh token present in session)rrprevious_refresh_token)r _refresh_requestr)rJrrrs&$ rrefresh_session JwtOAuthProvider.refresh_session>sD%&KL L--m< {{ 3F_ln nrc V^8dQhRRRR/#)rrrrzOptional[Session]r)rs"rrrEs77c76G7rc pVPV4pTPTRT4# \dR#i;i)Nr.) _claims_forr_session)rJrrs&$ rverify_sessionJwtOAuthProvider.verify_sessionEs@ %%l3F}}\2v66   s & 55)r) rMrNrOrPrQrrrrrrrrRrrrrr&s7>L#J! .n77rr)r.).rQ __future__rrerloggingr:r/r urllib.parserotypingrrrrrhermes_cli.dashboard_authrrr r r r r rrrr8r)r3r>r#r@r`rirurrrrrrrrrrrrrs#  00    !,- $ 8P 20y02? g [ 2KO<: - -') -?A -QS -Q3U03Up 9 9&7,&7r