`gj-dZddlmZddlZddlZddlZddlZddlZddl Zddl Zddl m Z d dZ d dZd dZdd  dd Zdd Zy)u``hermes gateway enroll`` — enroll a self-hosted gateway with a relay connector. The connector⇄gateway channel is authenticated (the gateway may be customer-managed and internet-exposed). This command is the gateway half of the zero-touch enrollment in the connector repo's ``docs/connector-gateway-auth-design.md``: 1. Resolve a fresh Nous Portal access token from the existing login (``~/.hermes/auth.json``) — the same path ``hermes dashboard register`` uses (``resolve_nous_access_token``). This proves *which Nous org (tenant)* the caller owns; the connector derives the authoritative tenant from it via ``GET /api/oauth/account`` (never from anything the gateway asserts). 2. POST ``{enrollmentToken, gatewayId}`` to the connector's ``/relay/enroll`` with that token in the ``Authorization`` header, over TLS. 3. The connector verifies the enrollment token (signature + single-use + tenant match), mints a per-gateway secret, get-or-creates the per-tenant delivery key, and returns both ONCE. 4. Persist ``GATEWAY_RELAY_ID`` / ``GATEWAY_RELAY_SECRET`` / ``GATEWAY_RELAY_DELIVERY_KEY`` (+ ``GATEWAY_RELAY_URL`` if supplied) into ``~/.hermes/.env``. The per-gateway secret authenticates the WS upgrade; the per-tenant delivery key verifies signed inbound deliveries. Managed/hosted installs do NOT self-enroll: the orchestrator (NAS) mints the secret directly and stamps it into the container env, so this command refuses to run under ``is_managed()`` (mirrors ``dashboard register``). EXPERIMENTAL: the relay auth scheme may change without a deprecation cycle until ≥2 Class-1 platforms validate the contract. ) annotationsN)Optionalcd} tjj}d|xsdS#t$rd}YwxYw)a5A stable-ish default gateway instance id: ``-``. The gatewayId identifies this enrolled instance for kill-switch granularity (the connector indexes its secret verify list by it). Default to the host name so a human can recognize it; overridable via ``--gateway-id``. zgw-hermes)socket gethostnamestrip Exception)hosts L/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/gateway_enroll.py_default_gateway_idr+sP D!!#))+!" ## s "/ ==c|xs tjjddj}|sN ddlm}|jdxsi}t |jddxsdj}|sy|jd}|jd rd |td dz}n"|jd rd |td dz}|jd r|dtd  }|S#t$rd}YwxYw)aResolve the connector base URL (no trailing slash) for enrollment. Precedence: explicit ``--connector-url`` flag > ``GATEWAY_RELAY_URL`` env > ``gateway.relay_url`` in config.yaml. The relay URL is a ``ws(s)://`` dial target; enrollment is an ``http(s)://`` POST to the same host, so we map the scheme. Returns None when nothing is configured (the user must supply one). GATEWAY_RELAY_URLrr)_load_gateway_configgateway relay_urlN/zws://zhttp://zwss://zhttps://z/relay) osenvirongetr gateway.runrstrr rstrip startswithlenendswith)overriderawrcfgs r _resolve_connector_urlr!:s  >rzz~~&92> E E GC   8')--i8>BCcggk2.4"5;;=C  **S/C ~~g#c'lm,,  !3s8}~.. ||H"S]N# J C sA C>> D  D cddlm}|S)uResolve the caller-identity bearer token (generic-OIDC or Nous Portal). Delegates to the canonical resolver in ``gateway.relay`` so the enroll CLI and the runtime self-provision path share ONE implementation (generic OAuth2 client-credentials when ``gateway.idp.token_url`` is set — the air-gapped / self-hosted-IdP path; otherwise Nous Portal). Raises RuntimeError on failure. r_resolve_relay_identity_token) gateway.relayr$r#s r _resolve_identity_tokenr&Ys< ( **g.@timeoutc 2|jdd}tj||djd}tj j ||dd|ddd } tj j|| 5}tj|jj} d d d t' t(r| jds t!d| S#1swY7xYw#tjj$r} d } tj| jjxsijd d } n#t$rYnwxYw| jdk(r t!d| | jdk(rt!| xsd| t!d| j| r d| z| d z| d } ~ wtjj"$r!} t!d|d| j$| d } ~ wwxYw)aPOST to the connector's ``/relay/enroll`` and return the JSON body. Raises RuntimeError with a user-facing message on any non-2xx / transport failure. The connector returns ``{secret, deliveryKey, tenant, gatewayId}`` on success, ``{error}`` at 400/401/403. rz /relay/enroll)enrollmentToken gatewayIdzutf-8POSTzBearer zapplication/json) Authorizationz Content-TypeAccept)datamethodheadersr(NrerroriuConnector rejected the caller identity (401). Your Nous Portal token could not be verified — try `hermes auth add nous` and retry.izJEnrollment token invalid, expired, already used, or tenant mismatch (403).zConnector returned HTTP z: z!Could not reach the connector at secretz6Connector returned an unexpected response (no secret).)rjsondumpsencodeurllibrequestRequesturlopenloadsreaddecoder3 HTTPErrorrr code RuntimeErrorURLErrorreason isinstancedict) connector_base_url access_tokenenrollment_token gateway_idr)urlr0reqresppayloadexcdetails r _post_enrollrPgs & &s + ,M :C ::*:T U \ \]d eD ..  &|n5.( ! C ^^ # #C # 9 7Tjj!3!3!56G 74 gt $GKK,ASTT N9 7 7 << ! ! jj!2!2!45;@@"MF    88s?X  88s?`_ &sxxj 1fr&] U  RT U   << /0B/C2cjj\ R  sb'!C<2C0:C<0C95C<<HGAE"!G" E.+G-E..A'G H5HHcddlm}m}ddlm}m}|r t dtjdt|ddxs tjjdd j}|s t d tjdtt|d d}|s t d tjdt|d dxs tj} t!} t%|||} t) jdxsd } t)| jdxsd } t)| jdxsd } t)| jdxs|}|| | d}t|d dxsd j}|r|j+d|d<t|ddxsd j}|r|j+d|d<|j-D]\}}|s |||dd!lm}t d"|d#| rd$| nd zt t d%|d&t d'|t d(t d)|rt d*|j+d|rt d+|j+dt t d,y#|$rR} t| ddrt dt dnt d| tjdYd} ~ $d} ~ wt"$r.} t d| tjdYd} ~ Yd} ~ wwxYw#t&$r.} t d| tjdYd} ~ d} ~ wwxYw#t"$r1} t d|d | tjdYd} ~ d} ~ wwxYw)-zKEnroll this gateway with a relay connector; persist the auth creds to .env.r) AuthErrorresolve_nous_access_token) is_managedsave_env_valueu✗ `hermes gateway enroll` is not available in a managed/hosted install. The relay gateway secret is provisioned by the hosting platform.tokenNGATEWAY_RELAY_ENROLL_TOKENru✗ No enrollment token. Pass --token (or set GATEWAY_RELAY_ENROLL_TOKEN). The connector mints this single-use token when your tenant's route is provisioned; it is delivered with your gateway config. connector_urluo✗ No connector URL. Pass --connector-url (or set GATEWAY_RELAY_URL / gateway.relay_url in config.yaml).rIrelogin_requiredFu'✗ You're not logged into Nous Portal.zC Run `hermes setup` (or `hermes auth add nous`) first, then retry.u2✗ Could not resolve a Nous Portal access token: u/✗ Could not resolve a caller-identity token: )rFrGrHrIu✗ Enrollment failed: r4 deliveryKeytenantr,)GATEWAY_RELAY_IDGATEWAY_RELAY_SECRETGATEWAY_RELAY_DELIVERY_KEYrrwake_urlGATEWAY_RELAY_WAKE_URLu✗ Failed to write z to .env: ) get_env_pathu✓ Enrolled gateway ""z for tenant z Wrote to :z GATEWAY_RELAY_ID=z! GATEWAY_RELAY_SECRET=z' GATEWAY_RELAY_DELIVERY_KEY=z GATEWAY_RELAY_URL=z GATEWAY_RELAY_WAKE_URL=z The gateway now authenticates its relay WS upgrade with the per-gateway secret and verifies signed inbound deliveries with the tenant delivery key. Restart the gateway to pick up the new env.)hermes_cli.authrRrShermes_cli.configrTrUprintsysexitgetattrrrrr r!rr&r rPrArritemsrb)argsrRrSrTrUrHrFrIrGrNresultr4 delivery_keyr\resolved_gateway_idto_write explicit_urlexplicit_wake_urlkeyvaluerbs r cmd_gateway_enrollrusD< |  Q   gt4h Gceg8hooq   H  /ot0TU   3   $ d3L7J7LSSUJ .0  1%-!  H%+ ,Fvzz-06B7L H%+ ,Ffjj5CD 0 &&2HD/48>BEEGL(4(;(;C(@$% !z48>BEEG->-E-Ec-J)*nn& U   3 & / "#6"7q 9X^|F8=Tdf gh G K 'q )* !"5!6 78 -. 34 &|':':3'?&@AB +,=,D,DS,I+JKL G  =O  3*E 2 ; < W X FseL M   ?uEF    'u-.  F  (Zu= > HHQKK sU7 KM" NMAL%% M1#MM" N+#NN O%&OO)returnr)r Optional[str]rvrw) rFrrGrrHrrIrr)floatrvrE)rvNone)__doc__ __future__rr5rrrh urllib.errorr8 urllib.parseurllib.requesttypingrrr!r&rPrur'r rs<#  $> +( 777 7  7  7 7ttr'