+ jHjBVa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt ^RI H t H t H t ^RIt^RIHtHtHt^RIHtHtHtHtHtHtHtHtHtHtHtH t H!t!H"t"H#t#H$t$]PJ!]&4t'Rt(Rt)Rt*Rt+R t,R s-R ].R &R Rlt/RRlt0!RR]4t1RRlt2RRlt3RRlt4R#)uSelfHostedOIDCProvider — generic self-hosted OpenID Connect dashboard auth. A plain OIDC Relying Party (Authentik, Keycloak, Zitadel, Authelia, Auth0, Okta, …): discovers endpoints from ``{issuer}/.well-known/openid-configuration``, builds the PKCE (S256) authorize URL, exchanges the code, and verifies the **ID token** (the access token is opaque per spec) against the discovered ``jwks_uri`` with ``iss``/``aud`` pinned. Public and confidential (``client_secret`` layered on top of PKCE, never replacing it) clients both work. Config: ``dashboard.oauth.self_hosted.{issuer,client_id,scopes,client_secret,id_token_leeway}`` or ``HERMES_DASHBOARD_OIDC_*`` (leeway is config.yaml-only; default 60s of clock-skew tolerance for the ID token's time claims, ``0`` restores strict verification). ) annotationsN)AnyDictOptional) LoginStart ProviderErrorSession)DEFAULT_TOKEN_LEEWAY_SECONDS JSON_HEADERSTOKEN_ENDPOINT_TIMEOUT_SECJwtOAuthProviderSkipRegistrationexchange_tokenload_config_sectionparse_json_body parse_leewaypkce_login_startrefresh_token_fromregister_providerresolve_env_or_cfgsession_from_claimsvalidate_redirect_uri verify_jwtzdashboard-auth-self-hostedzopenid profile emailg$@istrLAST_SKIP_REASONc$V^8dQhRRRRRR/#)urlrfieldreturn)formats"P/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/self_hosted/__init__.py __annotate__r$>s&^^C^3^3^c\PPV4pVPR8Xg-VPR8XdVP;'gRR9dV#\ RV RV: 24h)zReject non-HTTPS endpoint URLs (loopback http allowed) so a misconfigured issuer can't ship auth codes / refresh tokens in cleartext.httpshttprzOIDC z. must be https:// (or http on localhost), got ) localhostz 127.0.0.1z::1)urllibparseurlparseschemehostnamer)rrparseds&$ r#_require_https_or_loopbackr0>sd\\ " "3 'F }}FMMV$;AVAVTV[|@| %w&TUXT[\ ]]r%c V^8dQhRRRR/#)rrrr tupler!)r"s"r#r$r$GsBBBBr%c\PPV4pVPP 4pY!P ;'gRP 4VP ;'gRRR^P/PV43#)z``(scheme, hostname, port)`` for an origin compare, with default ports normalised so ``https://h`` and ``https://h:443`` are the same origin.rr'ir()r*r+r,r-lowerr.portget)rpartsr-s& r#_originr8Gsq LL ! !# &E \\   !F ^^))r002 JJ @ @7C488@ BBr%c]tRt^Pt$RtRtRt]tR] R&R] RRR ]/R R llt R R lt RRlt RRltRRltRRRR/RRlltRRltRRltRRltRR ltR!R"lt]tR#R$ltR%tR#)&SelfHostedOIDCProviderzHGeneric self-hosted OpenID Connect provider (authorization-code + PKCE).z self-hostedzSelf-Hosted OIDCfloat_id_token_leewayscopes client_secretrid_token_leewayc 0V^8dQhRRRRRRRRRRRR /#) rissuerr client_idr=r>r?r;r Noner!)r"s"r#r$#SelfHostedOIDCProvider.__annotate__Zs>&&&),&69&\_&& &r%c V'g \R4hV'g \R4hVPR4Vn\VPRR7W nVP 4;'g\ Vn\V4Vn T;'gRP 4Vn RVn RVn \P!4VnRVnR#)zissuer is requiredzclient_id is required/rArrNg) ValueErrorrstrip_issuerr0 _client_idstrip_DEFAULT_SCOPES_scopesrr<_client_secret _discovery_discovery_fetched_at threadingLock_discovery_lock _jwks_client)selfrArBr=r>r?s&$$$$$r#__init__SelfHostedOIDCProvider.__init__Zs12 245 5}}S) "4<DDF $($=$=e$D! (9?KY]YhYhwlvw O JJx4U|4U}4U_z {     O LLH# N N Os)B'%B9' B65B69 C%C  C%c V^8dQhRRRR/#)rr_dict[str, Any]r z%tuple[dict[str, str], dict[str, str]]r!)r"s"r#r$rDs l l. l=b lr%c VP'g//3#VPR4;'g.pRV9dRV9dRVP//3#\PP VP RR7 R\PP VPRR7 2p/RR \ P!VPR 44PR 4 2/3#) u;``(extra_data, extra_headers)`` for token-endpoint client auth. Public client → ``({}, {})`` (PKCE alone). Confidential client → ``client_secret_post`` when the IDP advertises it *without* ``client_secret_basic``, else HTTP Basic (the OIDC default and the fallback when nothing is advertised). RFC 6749 §2.3.1.%token_endpoint_auth_methods_supportedclient_secret_postclient_secret_basicr>r)safe: AuthorizationzBasic zutf-8ascii) rOr6r*r+quoterKbase64 b64encodeencodedecode)rVr_methodsuserpasss&& r#rk+SelfHostedOIDCProvider._token_endpoint_auths """r6M))CDJJ 7 */DG/S#T%8%892= =ll((r(BC1V\\EWEWX\XkXkrtEWEuDvwOvf.>.>xw?W.X._._`g.h-i%jkkkr%c V^8dQhRRRR/#)rrcrr z/tuple[dict[str, str], Optional[dict[str, str]]]r!)r"s"r#r$rDsc6er%c BRRRVPRVRVP/R3#) grant_typercrBr]N)rKrN)rVrcs&&r#_refresh_request'SelfHostedOIDCProvider._refresh_requests1?K/[h dll $  r%riNprevious_refresh_tokenc ,V^8dQhRRRRRRRRR R /#) rrhzdict[str, str]bad_request_excztype[Exception]rizOptional[dict[str, str]]rrr rr!)r"s"r#r$rDs=dd"d8GdRjd #d dr%c  VP4pVPV4wrg\VR,/VCVCWrRRRRR7wrVPV4p VP V\ W4V 4#)uPOST the discovered token endpoint and turn the response into a Session. Confidential-client auth (body field or Basic header) is added for both grants — the IDP rejects an unauthenticated refresh with ``invalid_client``.token_endpointIDPzOIDC token endpointid_tokenuOIDC token response missing id_token — ensure the 'openid' scope is configured and the client is allowed to receive an ID token.)riridprr token_key missing_msg)r^rkr_verify_id_token_sessionr) rVrhrrirr_rsrtrpayloadclaimss &&$$$ r#_grantSelfHostedOIDCProvider._grants##%$($=$=e$D! * " #%;%; %;] 5 &&x0}}X'9''Z\bccr%cV^8dQhRR/#)rr zdict[str, Any] | Noner!)r"s"r#r$rDs"7r%c VPe<\P!4VP, \8d VP#R#N)rPtimerQ_DISCOVERY_CACHE_TTL_SECrVs&r#_fresh_discovery'SelfHostedOIDCProvider._fresh_discoverys2 ?? &499;9S9S+SVn+n?? "r%cV^8dQhRR/#rr ryr!)r"s"r#r$rDs   r%c *VP4pVfkVP;_uu_4VP4pVf8VP4;qn\P!4VnRVnRRR4V#V# +'giT#;i)zSReturn the cached OIDC discovery document, fetching if stale (double-checked lock).N)rrT_fetch_discoveryrPrrQrU)rVr_s& r#r^%SelfHostedOIDCProvider._get_discoverys}%%' =%%%--/=.2.C.C.EEEO15D.(,D% &  u &%  s A B B cV^8dQhRR/#rr!)r"s"r#r$rDs0c0c.0cr%c  pa VP R2p\P!V\\RR7pTP^8wd\ RTP RT: 24h\\TP44\TP48wd(\ RTP RTP: R 24h\T4o S 'g \ R 4hR T 3R llpRUu/uF qUT!T4bK pp\TP44'g \ R 4hT!R4pT'd>TPR4TP8wd\ RT: RTP: 24hTP4Fwr\!YR7K S PR4p RT;'g TP/TCRT!R4R\#T \$4'dT U u.uFp \T 4NK up /C#./C# \P dp\ RT 24ThRp?ii;iuupiuup i)z!/.well-known/openid-configurationT)rirjfollow_redirectszOIDC discovery unreachable: NzOIDC discovery returned z for zOIDC discovery resolved to z*, outside the configured issuer's origin ()z'OIDC discovery returned a non-JSON bodyc V^8dQhRRRR/#)rkeyrr r!)r"s"r#r$=SelfHostedOIDCProvider._fetch_discovery..__annotate__s ; ;s ;s ;r%cj<\SPVR4;'gR4P4#)r)rr6rL)rrs&r#r6SelfHostedOIDCProvider._fetch_discovery..fields*w{{3+11r288: :r%zPOIDC discovery missing one of authorization_endpoint / token_endpoint / jwks_urirArFz4OIDC discovery issuer mismatch: document advertises z but configured issuer is rGr{re)r\rjwks_uri)rJrlr6r _DISCOVERY_TIMEOUT_SEC RequestErrorr status_coder8rrrallvaluesrIitemsr0 isinstancelist) rVrresponserurk endpointsadvertised_issuerrauth_methods_rawmrs & @r#r'SelfHostedOIDCProvider._fetch_discoverysI?@ O yylDZmqrH   3 &":8;O;O:PPUVYU\ ]^ ^ 3x||$ %)> >-hll^<$$(LL#3167 7"(+ IJ J ; ;+cc*bQa[*b c9##%&& rs s"(O !2!9!9#!>$,,!NFGXF[\,,0LL+;=> >")HC &s 6*#;;'NO '774<<cc "5)>#? 36@AQSW6X6X!12!1AQ!12 c c _a c cG!! O">se DE3 N O*d&3s#"H)H.%H3 H+H&&H+cV^8dQhRR/#)rr rr!)r"s"r#r$rDs1131r%c 0VP4R,#)r)r^rs&r# _jwks_uri SelfHostedOIDCProvider._jwks_uris""$Z00r%c V^8dQhRRRR/#)rrrr ryr!)r"s"r#r$rDseeeer%c  VP4R,p\WP4\\4VP VRVP R7#)rAID token) algorithmsaudiencerAlabelleeway)r^r_get_jwks_clientr_ALLOWED_ID_TOKEN_ALGSrKr<)rVrrAs&& r#r'SelfHostedOIDCProvider._verify_id_tokensK$$&x0 ++-$?U:V__V:dNcNce er%c(V^8dQhRRRRRRRR/#)rrrrcrryr rr!)r"s"r#r$rDs)&&&S&.&U\&r%c  l\VPRR4;'gR4pVPR4;'gVPR4;'gRpVPR4pV'g7\V\4'd!V'dRP RV44p\ VP Y1TRT\VPR 4;'g?VPR 4;'g&VPR 4;'g T;'gR4\T;'gR4R 7#) uMap verified OIDC claims onto a Session. The verified ID token is stored in ``Session.access_token`` so the per-request ``verify_session`` re-verifies a real JWT; the opaque OAuth access token is not kept — the dashboard only needs identity.emailrorg_id organizationgroups,c38"TFp\V4xK R#5ir)r).0gs& r# 2SelfHostedOIDCProvider._session..s5fc!fffsrnamepreferred_usernamenickname) access_tokenrcrr display_namer)rr6rrjoinrr)rVrrcrrrrs&&&& r#rSelfHostedOIDCProvider._sessionsFJJw+11r2H%IIN)CIIrH%*VT22vXX5f55F" IIvMYckpVZZ/||6::>R3S||W]WaWablWm||qv||z|}v||$& &r%) rKrOrPrQrTr<rJrUrN)__name__ __module__ __qualname____firstlineno____doc__rrr r<__annotations__rMrWr`rvrkrrrr^rrr _claims_forr__static_attributes__r!r%r#r:r:PsR D%L;e:&.__annotate__+s&CC#CCCr%c:<\VSPV44#r)rr6)rroidc_cfgs&&r#setting_settings..setting+s!(HLL,ABBr%HERMES_DASHBOARD_OIDC_ISSUERrAHERMES_DASHBOARD_OIDC_CLIENT_IDrBu:Self-hosted OIDC dashboard auth is not configured. Set both an issuer and a client_id — either as env vars (HERMES_DASHBOARD_OIDC_ISSUER + HERMES_DASHBOARD_OIDC_CLIENT_ID) or under dashboard.oauth.self_hosted.{issuer,client_id} in config.yaml — or pass --insecure to skip the OAuth gate entirely. (issuer set: z; client_id set: rr=HERMES_DASHBOARD_OIDC_SCOPESr>#HERMES_DASHBOARD_OIDC_CLIENT_SECRETr?)rr boolrMrr6)rrArBrs @r# _settingsr's)+HCC3X >F9;GI  HIMV ~Ufgklugvfwwx  z{ { &+y'8(CVV!FX< 5F(GH  JJr%cV^8dQhRR/#)rr rCr!)r"s"r#r$r$@s k kT kr%c Rs\V\\\\ 4wpsVeI\P RVR,VR,VR,\VR,4VR,4R#R#) zIRegister :class:`SelfHostedOIDCProvider` when issuer + client_id are set.rNzzdashboard-auth-self-hosted: registered provider (issuer=%s, client_id=%s, scopes=%r, confidential=%s, id_token_leeway=%ss)rArBr=r>r?)rrrprr:rinfor)ctxkws& r#registerr @si,S&$@VXabB ~  Y xL"[/2h<b>Q9RTVWhTi kr%)RS256ES256RS384RS512ES384ES512)5__conditional_annotations__r __future__rrloggingrRr urllib.parser*typingrrrrlhermes_cli.dashboard_authrrrplugins.dashboard_auth._sharedr r r rnr r rrrrrrrrrrr getLoggerrrprrMrrrrrr0r8r:rrr )rs@r#rs #  && HH$   8 $#) P #^BN&-N&fRJ2 kr%