`gjR0UdZddlmZddlZddlZddlmZmZmZm Z ddl m Z ddl m Z mZddlmZddlmZmZdd lmZmZej.eZeZd ed <ej:Zdd Zdd Z ddZ!ddZ"ddZ# ddZ$ ddZ%y)u Route-agnostic non-interactive (bearer-token) auth seam for the dashboard. This is the generic API-token capability (decisions.md Q-C): a reusable seam that ANY service-to-service / machine-credential provider plugs into, NOT a drain-specific hook. The drain bearer-secret plugin is merely the first consumer. How it fits the existing auth framework: * The interactive gate (``gated_auth_middleware``) authenticates a human via a session cookie on every non-public route. A service caller has no cookie — it presents a bearer token in the ``Authorization`` header on a single request. That is what this seam verifies. * A route opts in by registering its exact path via :func:`register_token_route`. Only registered paths are token-authable; everything else is untouched, so this can never accidentally widen the auth surface of an existing route. * :func:`token_auth_middleware` runs OUTERMOST (installed last in ``web_server.py``). For a token route it fully owns the auth decision: authenticate via the stacked token providers, attach the verified :class:`~hermes_cli.dashboard_auth.base.TokenPrincipal` to ``request.state.token_principal`` + set ``request.state.token_authenticated``, and pass through; otherwise reject (401 unauthenticated, or 503 when a provider's backing store was unreachable). The downstream cookie/session gates honour ``token_authenticated`` and skip enforcement, so a token-authed service request is never bounced to ``/login``. * Fails closed: a token route with no registered token provider, no token, or an unrecognised token gets 401 — never an open pass-through. Provider stacking mirrors ``verify_session``: each ``supports_token`` provider is consulted in registration order until one returns a principal. A provider that doesn't recognise the token returns ``None`` and the seam moves on; a provider whose backing store is unreachable raises ``ProviderError``, which the seam remembers and surfaces as 503 only if NO provider accepts the token. ) annotationsN) AwaitableCallableOptionalTuple)Request) JSONResponseResponse)list_token_providers) AuditEvent audit_log) ProviderErrorTokenPrincipalzset[str] _token_routescdt5tj|dddy#1swYyxYw)uMark ``path`` (exact match) as token-authable. Idempotent. Call at module import / app setup so the seam knows which routes to guard. Registering a route does NOT make it public — it makes it authenticate by token instead of by session cookie. N)_lockraddpaths W/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/dashboard_auth/token_auth.pyregister_token_router<s*  $   s&/cJt5|tvcdddS#1swYyxYw)z@True if ``path`` was registered as token-authable (exact match).N)rrrs ris_token_routerGs" %}$%%%s"cbt5tjdddy#1swYyxYw)z,Test-only: drop all registered token routes.N)rrclearrclear_token_routesrMs& s%.c|jjdd}|r"|jddjS|jr|jj SdS)Nzx-forwarded-for,r)headersgetsplitstripclienthost)requestfwds r _client_ipr*SsS //  / 4C yy~a &&((")..7>>  8b8rc|jjdd}|jdd}t|dk(r7|dj j dk(r|dj Sy)uReturn the bearer token from the ``Authorization`` header, or "". Accepts `` `` where scheme is "bearer" (case-insensitive). Returns an empty string for a missing/malformed header or a non-bearer scheme — the caller treats "" as "no token presented". authorizationr  rbearer)r"r#r$lenr%lower)r(authpartss rextract_bearer_tokenr5Zsd ??   3D JJsA E 5zQ58>>+113x?Qx~~ rclt|}|syd}tD]} |j|}||dfcSd|fS#t$r9}tj d|j || |j }Yd}~ad}~wt$r+}tj d|j |Yd}~d}~wwxYw)uGTry every token provider against the request's bearer token. Returns ``(principal, unreachable_provider_name)``: * ``(TokenPrincipal, None)`` — a provider recognised and accepted the token. * ``(None, None)`` — no token, or no provider recognised it (reject 401). * ``(None, name)`` — no provider accepted it AND at least one provider's backing store was unreachable (the caller surfaces 503, not 401, so a transient outage doesn't read as "bad credentials"). Never raises: a provider ``ProviderError`` is caught and remembered. )NNN)tokenz?dashboard-auth: token provider %r unreachable during verify: %sz:dashboard-auth: token provider %r raised during verify: %s)r5r verify_tokenr_logwarningname Exception)r(r7 unreachableprovider principales rauthenticate_tokenrAhs ! )E !%K(*#  --E-:I  d? "%#&  !  LLQ q "&mm   LLL q    s!? B3/A<< B3!B..B3c K|jj}t|s||d{St|\}}|2||j_d|j_||d{S|r:ttj|d|t|tdd|did Sttjd |t| td d dd S77xw)uOutermost auth seam for token-authable routes. No-op pass-through for any path not registered via :func:`register_token_route`. For a registered path, token auth is the only accepted scheme: * valid token → attach principal + ``token_authenticated`` flag, pass through. * unreachable → 503 (provider backing store down; not "bad credentials"). * otherwise → 401 unauthenticated. Runs before the cookie/session gates (installed last in ``web_server.py``). The cookie gates honour ``request.state.token_authenticated`` and skip enforcement, so a token-authed request is never redirected to ``/login``. NTprovider_unreachable)r>reasonripdetailzAuth provider z unreachablei) status_codeno_provider_recognises_token)rDrrEunauthenticated Unauthorized)errorrFi) urlrrrAstatetoken_principaltoken_authenticatedr r TOKEN_AUTH_FAILUREr*r )r( call_nextrr?r=s rtoken_auth_middlewarerRs$ ;;  D $ w'''/8I{(1 %,0 )w'''  ) ) )'"    lC D  %%-  g   #~> 7( (s#-C,C(AC,1C*2A7C,*C,)rstrreturnNone)rrSrTbool)rTrU)r(rrTrS)r(rrTz.Tuple[Optional[TokenPrincipal], Optional[str]])r(rrQz(Callable[[Request], Awaitable[Response]]rTr )&__doc__ __future__rlogging threadingtypingrrrrfastapirfastapi.responsesr r hermes_cli.dashboard_authr hermes_cli.dashboard_auth.auditr r hermes_cli.dashboard_auth.baserr getLogger__name__r9setr__annotations__Lockrrrrr*r5rArRrrrrfs%L#774:AHw"% x  %  9 % %3%P2 2722r