`gjU6UdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z ddlmZmZej"eZdZd Zd Zd Zej0Ze dd ZiZd ed<ddZe GddZd dZd!dZ d"dZ!d#dZ"d$dZ#d%dZ$ d&dd d'dZ%ddd d(dZ&d)dZ'y)*u OAuth credential storage and refresh for the Honcho memory provider. An access token authenticates exactly like a scoped API key, so it is stored as the host's ``apiKey``; this module exchanges the refresh token before expiry to keep it live. Refresh tokens rotate with single-use reuse detection: a replayed stale token revokes the whole grant. So every refresh must persist the rotated token atomically and be serialized — and a failed refresh never raises into the agent (stale token stays; the fail-open path absorbs the eventual 401). ) annotationsN)contextmanager) dataclass)Path)AnyCallablezhch-at-zhch-rt-xg.@c#Kt|d}d} |jjddt|d}tj dk(rAddl}|jd|j|j|jdn.ddl }|j|j|j d| tj dk(rAddl}|jd|j|j|j$dn.ddl }|j|j|j&|j#yy#t$r.tj!d d ||j#d}YwxYw#t$rYWwxYw#| tj dk(rAddl}|jd|j|j|j$dn.ddl }|j|j|j&n#t$rYnwxYw|j#wwxYww) uMachine-wide advisory lock around read-refresh-persist. The in-process ``_refresh_lock`` can't stop a second process (a sibling Hermes profile or the desktop app sharing this honcho.json) from replaying the single-use refresh token and tripping reuse-detection — which revokes the whole grant. An OS file lock on ``.lock`` serializes rotation across processes; best-effort, so a platform without flock degrades to in-process serialization only. z.lockNTparentsexist_okza+bntrz 77d?!GGAJNN299;C KK U]]; HHJ   S^b c > HHJB &   > 77d?!GGAJNN299;C KK U]];   HHJ sIB+EF$IBF I4FIFI F!I F!!I$I (BH+*I + H74I 6H77I  Iz(dict[tuple[str, str], tuple[float, str]] _expiry_cachecFt|xr|jtS)zCTrue when ``value`` is an OAuth access token (vs a static API key).)bool startswithACCESS_TOKEN_PREFIX)values r'is_oauth_access_tokenr/gs ; @5++,?@@ceZdZUdZded<ded<ded<ded<ded<d Zded <d Zded <d Zded<eddZ ddZ e dddZ y )OAuthCredentialzAn OAuth grant as stored in a honcho.json host block. ``access_token`` mirrors the host's ``apiKey``; the remaining fields live in the host's ``oauth`` sub-block. ``expires_at`` is absolute epoch seconds. str access_token refresh_tokenfloat expires_at client_idtoken_endpointwritescopeBearer token_typeN str | Noneconsent_peer_namec|jd}|jd}t|tr t|sy|jd}|jd}|jd}|r|r|sy t |jdd}||t||t|t|t|jd d t|jd d S#t t f$rd }YowxYw)zHBuild a credential from a honcho.json host block, or None if incomplete.oauthapiKeyN refreshToken tokenEndpointclientId expiresAtrgr;r: tokenTyper<r4r5r7r8r9r;r=)get isinstancedictr/r6 TypeError ValueErrorr3)clsblockrAaccessrefreshendpointr8r7s r'from_host_blockzOAuthCredential.from_host_block~s '"8$%&.CF.K))N+99_-IIj) H uyya89Jg,!)nx=eii12599[(;<  :& J s:C11DDc|jt|j|j|j|j |j dS)zFThe ``oauth`` sub-block to persist (the access token lives in apiKey).)rCrFrErDr;rG)r5intr7r8r9r;r=)selfs r' oauth_blockzOAuthCredential.oauth_blocksA!..T__-!00ZZ   r0)skewc&||j|z k\S)z@True when the access token is within ``skew`` seconds of expiry.)r7)rVnowrXs r' is_expiredzOAuthCredential.is_expiredst-..r0)rOdict[str, Any]returnz'OAuthCredential | None')r]r\)rZr6rXr6r]r+) __name__ __module__ __qualname____doc____annotations__r;r=r? classmethodrSrW_REFRESH_SKEW_SECONDSr[r0r'r2r2lsg NE3J$(z(  2  7L/r0r2crddl}|j|||}|j|jS)zFPOST form-encoded ``data`` to ``url`` and return the parsed JSON body.rN)datatimeout)httpxpostraise_for_statusjson)urlrgrhriresps r'_http_post_formros1 ::cg: 6D 99;r0c2t|jd|j|jdt}|j d}|j d}t |r|s td t|j dd}t|t|||z|j|jt|j d|jt|j d|j S#ttf$rd}YwxYw) zRun the refresh_token grant and return the rotated credential. Raises on any transport/protocol failure; callers fail open. r5) grant_typer8r5r4z3refresh response missing access_token/refresh_token expires_inrr;r=rH)ror9r8r5_REFRESH_TIMEOUT_SECONDSrIr/rMrUrLr2r3r;r=)credrZbodyrPrQrrs r'_exchange_refresh_tokenrvs  )!// ! DXXn %Fhh'G  (NOO,23  'l#..**$((7DJJ/0txx doo>?  z " s/DDDc tj|jdS#ttjf$ricYSwxYw)Nutf-8encoding)rlloads read_textOSErrorJSONDecodeError)r$s r' _read_configrs@zz$..'.:;; T)) * s$'AAc(|jjdd|jd|jd}t j |ddz}t j|t jt jzt jzd} t j|d d 5}|j|d d d t j||y #1swY xYw#t$r|jd wxYw)zFWrite ``raw`` to ``path`` atomically, preserving 0600 on the new file.Tr .z.tmp)indent iwrxryN) missing_ok)rr with_namerrldumpsrrO_WRONLYO_CREATO_TRUNCfdopenr:runlinkreplace)r$rawtmptextfdr&s r'_atomic_write_configrsKKdT2 ..1TYYKt, -C ::c! $t +D bkkBJJ.;U CB YYr3 1 R HHTN  JJsD     d # s$C47C( C4(C1-C44Dc|jD]I\}}t|tr/t|j|trt |||E|||<K|S)zLRecursively merge ``overlay`` into ``base`` (overlay wins on scalars/lists).)itemsrJrKrI _deep_merge)baseoverlaykeyr.s r'rrsTmmo U eT "z$((3-'F S 5 )DI  Kr0ct|}|jdi}|j|i}|j|d<|j|d<t |||j |jft t||f<y)zQPersist ``cred`` into ``host``'s block (apiKey + oauth), leaving all else intact.hostsrBrAN)r setdefaultr4rWrr7r)r3)r$hostrtrrrOs r'_persist_credentialrs{ t C NN7B 'E   T2 &E''E(O%%'E'Ns#(,9J9J'KM3t9d#$r0rZc|tjn|}t||f}|-tj|}|||dtz kr|ddfS||n t |}|jdxsij|xsi}t j|}|tj|dy|j|jft|<|j|s|jdfSt5t|5t |jdxsij|xsi} t j| xs|} | j|s7| j| j|jk7fcdddcdddS t| |} t%||| t j'd || jd fcdddcdddS#t$rA} t j#d|| | jdfcYd} ~ cdddcdddSd} ~ wwxYw#1swYnxYwdddy#1swYyxYw) aReturn ``(access_token, refreshed)`` for ``host``, refreshing if near expiry. Returns ``(None, False)`` when the host has no OAuth credential (e.g. a plain API key) so callers leave the existing token untouched. Refresh failures are swallowed: the current (possibly stale) token is returned with ``refreshed=False`` and the fail-open path handles any resulting 401. NrrFr)NFrz+Honcho OAuth refresh failed for host %s: %sz(Honcho OAuth token refreshed for host %sT)timer3r)rIrdrr2rSpopr7r4r[ _refresh_lockr(rvrrwarningrinfo) r$rrrZrcachedsourcerOrt fresh_blockcurrentrotatedexcs r'ensure_fresh_tokenrs2$))+#C t9d C {""3'  #q 4I(I"I!9e# #OSd);F ZZ &B + +D 1 7RE  * *5 1D |#t$//4+<+<=M# ??s? #  %'' *,T2*$D)--g6<"AA$GM2 !11+>F$!!c!*'')=)=ARAR)RR *** /-g3?G D$0 >E##T)*** / NNH$PS T''. .*** /*****sa? I BH= I G0-0H= I0 H:9$H5H:H=" I5H::H==I IIT) apply_configrZcJ|tjn|}|jd}|jd}t|r|s td t |jdd} t |t||| z||t|jddt|jdd  } t|} |jd } t| tr$| jd | _ |r t| | | j| jftt||f<| j!d i} | j!|i}| j|d<| j#|d<t%|| | S#t tf$rd} Y2wxYw)uApply a fresh OAuth grant to ``path`` for ``host``. Deep-merges the grant's ``config`` (the manifest default_config) into the file root — preserving other hosts and root keys — then writes the host's ``apiKey`` and ``oauth`` block. ``grant`` is an OAuthTokenResponse dict (access_token, refresh_token, expires_in, scope, config). ``apply_config=False`` skips the config merge and stores tokens only. r4r5z(grant missing access_token/refresh_tokenrrrr;r:r=r<rHconfigpeerNamerrBrA)rrIr/rMrUrLr2r3rrJrKr?rr7r4r)rrWr)r$rgrantr8r9rrZrPrQrrrtrgranted_configrrOs r' install_grantr2s~$$))+#C YY~ &Fii(G  (CDD<34  'l#%%))GW-.uyyx89 D t CYYx(N.$'!/!3!3J!?  ^ ,(,9J9J'KM3t9d#$ NN7B 'E   T2 &E''E(O%%'E'Ns# K3 z " sF F"!F"cJt|dd}| t|dsy||_y)aSRotate the live Honcho client's Bearer in place. Returns success. The SDK builds its auth header per request from the HTTP client's ``api_key``, so mutating it rotates every holder of the singleton without a rebuild. Guarded: an SDK shape change degrades to False and the caller can fall back to resetting the client. _httpNapi_keyFT)getattrhasattrr)clienttokenhttps r'apply_token_to_clientrgs- 67D )D |743DL r0)r$r)r.r>r]r+)rmr3rgzdict[str, str]rhr6r]r\)rtr2rZr6r]r2)r$rr]r\)r$rrr\r]None)rr\rr\r]r\)r$rrr3rtr2r]r)N) r$rrr3rzdict[str, Any] | NonerZ float | Noner]ztuple[str | None, bool])r$rrr3rr\r8r3r9r3rr+rZrr]r2)rrrr3r]r+)(ra __future__rrlloggingr threadingr contextlibr dataclassesrpathlibrtypingrr getLoggerr^rr-REFRESH_TOKEN_PREFIXrdrsLockrr(r)rbr/r2rorvrrrrrrrrer0r'rsl #   %!   8 $     --n;= 7<A  8/8/ 8/xB L"&1*  1* 1* 1* 1*  1*  1*v2 2 2 2  2  22 22j r0