`gjUdZddlmZddlZddlZddlmZmZmZm Z ejdZ dZ iZ ded<ejZdd Zddd d  dd Zdd Zy)u Inbound cron-fire token verification for Chronos (Phase 4E.1). When NAS relays an external scheduler fire to the agent, it POSTs ``/api/cron/fire`` with a short-lived NAS-minted JWT. This module verifies that JWT before any job runs — the security boundary for remotely-triggered job execution. We verify a NAS-minted JWT (the trust path the agent already has) rather than let an external scheduler call the agent directly: the scheduler signs with NAS's keys, which the agent doesn't (and shouldn't) hold. See the plan's DQ-4. The verifier is pluggable (``get_fire_verifier``) so the escape-hatch mode (direct per-job cron-key) can swap in later with no handler change. Crypto is delegated to PyJWT (already a declared dependency) — we do NOT hand-roll JWT verification. ) annotationsN)AnyCallableDictOptionalzcron.chronos.verify cron_firezDict[str, Any] _JWK_CLIENTSctj|}||St5tj|}|ddlm}||}|t|<|cdddS#1swYyxYw)axReturn a process-cached PyJWKClient for ``jwks_url`` (one per URL). PyJWKClient does its own key caching internally (``cache_keys``/``lifespan``); the whole point here is to reuse the SAME instance across fires so that cache is actually hit instead of discarded. Double-checked-locked so concurrent fires resolve to a single shared client without racing. Nr) PyJWKClient)r get_JWK_CLIENTS_LOCKjwtr )jwks_urlclientr s X/root/.hermes/venv/lib/python3.12/site-packages/plugins/cron_providers/chronos/verify.py_get_jwk_clientr1sf  h 'F  !!(+ > ' *F%+L "s 0AA#) jwks_or_keyissuerleeway_secondsc|r|sy|stjdy ddl}d}|jds|jdr't |}|j |j }n|}dddgi}tgd ||| } |r|| d <|j||fi| } | jd tk7rtjdty| S#t$r } tjd | Yd} ~ yd} ~ wwxYw)uVerify a NAS-minted cron-fire JWT. Return decoded claims, or None. Checks (all must pass): - signature against the NAS JWKS (``jwks_or_key`` is a JWKS URL) — RS256 family; symmetric secrets are rejected (NAS signs asymmetrically). - ``aud`` == ``expected_audience`` (this agent: ``agent:{instance_id}``). - ``exp`` / ``nbf`` within ``leeway_seconds``. - ``iss`` == ``issuer`` when an issuer is configured. - ``purpose`` == ``"cron_fire"`` — so a general agent JWT can't be replayed against the fire endpoint. Returns None (never raises) on any failure, so the handler can answer 401 without leaking which check failed. Nz1cron fire: no JWKS/key configured; refusing tokenrzhttp://zhttps://requireexpaud)RS256RS384RS512ES256ES384) algorithmsaudienceleewayoptionsrz(cron fire: token verification failed: %spurposez+cron fire: token missing/!=%s purpose claim) loggerwarningr startswithrget_signing_key_from_jwtkeydictdecode Exceptionr _FIRE_PURPOSE) tokenexpected_audiencerrrr signing_key jwk_clientr# decode_kwargsclaimses rverify_nas_fire_tokenr5Fs , )  JK  ! !) , 0F0Fz0R )5J$==eDHHK&Kuen-(,D&! ) &,M( #E;@-@ zz) -DmT M A1EsBC D C;;DctS)uReturn the active inbound-fire verifier. Default = the NAS-JWT verifier. The DQ-4 escape hatch (direct per-job cron-key) would return a cron-key verifier here instead, selected by config — so the webhook handler never changes when the auth mode is swapped. )r5rget_fire_verifierr9s  ! r8)rstrreturnr) r.r:r/r:r Optional[str]rr<rintr;zOptional[Dict[str, Any]])r;z'Callable[..., Optional[Dict[str, Any]]])__doc__ __future__rlogging threadingtypingrrrr getLoggerr%r-r __annotations__Lockr rr5r9r7r8rrFs$#00   0 1 " n!"INN$2"&  A AA A  A  AAH!r8