`gj\>UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlmZmZmZmZej&dZ ddlmZmZdd lmZd.d Zej:d Zd0d Zd.dZ d.dZ!d.dZ"d.dZ#d1d2dZ$d.dZ%d1d2dZ&dgZ'de(d<gdZ)dZ*d1d3dZ+d1d4dZ,d5dZ-d6dZ.d7dZ/d8dZ0d9d Z1d:d!Z2d;d"Z3d1dd&Z6d1d?d'Z7d@d(Z8d1dAd)Z9d1dBd*Z:d1dAd+Z;d:d,Z Credentials | None refresh_or_none(creds, email=None) -> Credentials | None build_user_chat_service(creds) -> chat_v1.Resource list_authorized_emails() -> List[str] CLI commands (driven by the agent through the /setup-files slash command, modeled on skills/productivity/google-workspace/scripts/setup.py): --check Exit 0 if auth is valid, else 1 --client-secret /path/to.json Persist OAuth client credentials --auth-url Print the OAuth URL for the user --auth-code CODE Exchange auth code for token --revoke Revoke and delete stored token --install-deps Install Python dependencies --email EMAIL Scope CLI ops to a specific user (defaults to legacy single-user mode when omitted) The flow mirrors the existing google-workspace skill exactly so anyone familiar with that flow can read this without surprises. Token storage layout -------------------- - Per-user tokens (keyed by sender email): ``${HERMES_HOME}/google_chat_user_tokens/.json`` - Legacy single-user token (fallback, untouched for backward compat): ``${HERMES_HOME}/google_chat_user_token.json`` - Per-user pending OAuth state during /setup-files start → exchange: ``${HERMES_HOME}/google_chat_user_oauth_pending/.json`` - Legacy pending state: ``${HERMES_HOME}/google_chat_user_oauth_pending.json`` - OAuth client secret (profile-scoped — each profile registers its own): ``${HERMES_HOME}/google_chat_user_client_secret.json`` ) annotationsN)Path)AnyListOptionalTuplez(gateway.platforms.google_chat_user_oauth)display_hermes_homeget_hermes_homectjjddj}|r t |St j dz S)N HERMES_HOMEz.hermes)osenvirongetstriprhome)vals V/root/.hermes/venv/lib/python3.12/site-packages/plugins/platforms/google_chat/oauth.pyr r Ss;jjnn]B/557tCy9 99rctdz S)Ngoogle_chat_user_tokensr(rrr_user_tokens_dirr,{s >5 55rctdz S)Nz#google_chat_user_oauth_pending.jsonr(rrr_legacy_pending_pathr. >A AArctdz S)Ngoogle_chat_user_oauth_pendingr(rrr_user_pending_dirr2s >< <e$DDD  rctdz S)Nz#google_chat_user_client_secret.jsonr(rrr_client_secret_pathr8r/rcL|rtt|dz StS)Nr4)r2r&r.r5s r_pending_auth_pathr:s)  "(>'?u%EEE  !!rz4https://www.googleapis.com/auth/chat.messages.create List[str]SCOPES)zgoogle-api-python-clientzgoogle-auth-oauthlibzgoogle-auth-httplib2zhttp://localhost:1ct|}|jsy ddlm}ddlm} |jt|}|jr|S|jr1|jr% |j|t!|||Sy#t $rtjdYywxYw#t$r!}tjd||Yd}~yd}~wwxYw#t$r }tjd|Yd}~yd}~wwxYw)uKLoad + validate persisted user OAuth credentials. ``email`` selects the per-user token file; ``None`` falls back to the legacy single-user path (left in place for installs that ran the pre-multi-user flow). Returns a ``google.oauth2.credentials.Credentials`` instance ready for use, or ``None`` if no token is stored, the token is corrupt, or refresh fails. Adapter callers should treat ``None`` as "user has not run /setup-files yet" and surface the setup-instructions fallback to the user. Does NOT raise on the no-token case — that's expected. Nr CredentialsRequestz[google_chat_user_oauth] google-auth not installed; user-OAuth attachment delivery is disabled. Install hermes-agent[google_chat].z3[google_chat_user_oauth] token at %s is corrupt: %szS[google_chat_user_oauth] token refresh failed (user should re-run /setup-files): %s)r6existsgoogle.oauth2.credentialsr?google.auth.transport.requestsrA ImportErrorloggerwarningfrom_authorized_user_filer Exceptionvalidexpired refresh_tokenrefresh_persist_credentials)r$ token_pathr?rAcredsexcs rload_user_credentialsrRsU#J    9: 55c*oF {{  }},,  MM') $ UJ/  K  R    A     NN236   s@ BB5,C"B21B25 C>CC" D +DD c6|y|jr|S ddlm}|jr:|j r. |j |t|t||Sy#t$rYywxYw#t$r }tjd|Yd}~yd}~wwxYw)uhRefresh ``creds`` if expired. Returns the credentials or ``None``. Used by the adapter just before calling media.upload to ensure the token is current. Returns ``None`` if refresh fails — caller falls back to the text-notice path. ``email`` controls where the refreshed token is written back; ``None`` keeps the legacy single-file path. Nrr@z+[google_chat_user_oauth] refresh failed: %s) rJrDrArErKrLrMrNr6rIrFrG)rPr$rArQs rrefresh_or_nonerTs } {{ : }},,  MM') $  E(: ;L    NN=s   s(A ,A/ A,+A,/ B8BBc&ddlm}|dd|dS)a Build a Google Chat API client authenticated as the user. Used for media.upload + the subsequent messages.create that references the attachmentDataRef. The bot's separate SA-authed client (``self._chat_api`` in the adapter) is for everything else. r)buildchatv1F) credentialscache_discovery)googleapiclient.discoveryrV)rP build_services rbuild_user_chat_servicer]sA 5% PPrct}|jsgSg}|jD]>}|js|jdk(s$|j |j @|j|S)u]Return the set of user emails that have stored per-user tokens. Lists files in the per-user tokens dir; does NOT include the legacy single-user token (its owner is unknown). Sanitized filenames lose the ``+suffix`` part of plus-addressed emails — accept that and use this list only for admin display, not for trust decisions. r4)r,rBiterdiris_filesuffixappendstemsort)doutfs rlist_authorized_emailsrhsh A 88: C YY[ 99;188w. JJqvv HHJ Jrc  t|ttj|j y#t $rt jd|dYywxYw)zBPersist refreshed credentials atomically with private permissions.z<[google_chat_user_oauth] failed to persist credentials at %sT)exc_infoN)_write_private_json"_normalize_authorized_user_payloadjsonloadsto_jsonrIrFdebug)rPrOs rrNrN.sS    .tzz%--//J K    J    s69!AAcHt|}|jdsd|d<|S)zGEnsure the persisted token JSON has the type field google-auth expects.typeauthorized_user)dictr)payload normalizeds rrlrlAs'gJ >>& !. 6 rcZ|jjdd tj|jd|j dtj dtjd} tjt|tjtjztjztjtj z}tj"|dd 5}t%j&||d d |j)tj*|j-d d d t/|| tj|tjtj z |j1r|j3y y #t$rYwxYw#1swY~xYw#t$rYJwxYw#t$rYy wxYw# |j1r|j3ww#t$rYwwxYwxYw)z=Atomically write JSON with 0o600 permissions where supported.T)parentsexist_okiz.tmp..wzutf-8)encodingF)indent ensure_asciiN)parentmkdirrchmodOSError with_suffixgetpidsecrets token_hexopenrO_WRONLYO_CREATO_EXCLstatS_IRUSRS_IWUSRfdopenrmdumpflushfsyncfilenorrBunlink)pathdatatmp_pathfdfhs rrkrkIsKKdT2  e$% }Ag6G6G6J5K LMH WW M KK"** $ryy 0 LL4<< '  YYr3 1 "R IIdBqu = HHJ HHRYY[ ! " x&  HHT4<<$,,6 7  !!+     " "         !!   s F=>?    ! A1AHHJ4CPQ Q '(  7u=> 23 9: s$ ""AB C$B>>Cct|}|jstd|yt|}|td|dytd|y)zxPrint status; return True if creds are usable. Per-user when ``email`` given, legacy single-user when omitted. zNOT_AUTHENTICATED: No token at Fz*TOKEN_INVALID: Re-run /setup-files (path: )zAUTHENTICATED: Token valid at T)r6rBrrR)r$rOrPs r check_authrsd U#J     / |<= !% (E } ::,aHI *:, 78 rc t|jj}|js#t d|t j d tj|j}dvr/d|vr+t dt dt j dt}t||t d|y #tj$r#t dt j dYwxYw) zGValidate and copy the user's OAuth client_secret.json into HERMES_HOME.zERROR: File not found: rzERROR: File is not valid JSON. installedwebzPERROR: Not a Google OAuth client secret file (missing 'installed' or 'web' key).z@Download from: https://console.cloud.google.com/apis/credentialszOK: Client secret saved to N) r expanduserresolverBrrrrmrn read_textJSONDecodeErrorr8rk)rsrcrtargets rstore_client_secretrs t*   ! ) ) +C ::< 'u-.  zz#--/* $5#4  )   N   "F% 'x 01!    ./  s#C3D  D r5cLt|}t|||t|xsddy)Nr )state code_verifier redirect_urir$)r:rk _REDIRECT_URI)rrr$pendings r_save_pending_authrs, 'G*)[b  rct|}|js tdtjd t j |j}jdr|jds+tdtdtjd|S#t$r8}td|tdtjdYd}~d}~wwxYw) Nz>  LM  zz'++-. 88G DHH_$= BC %&  K  =cUCD >?  s#B// C08.C++C0c|jds|dfSddlm}m}||}||j}d|vr t dt jd|jddgd}|dd|fS) zGAccept a raw auth code OR the full failed-redirect URL the user pastes.httpNrparse_qsurlparsecodez(ERROR: No 'code' parameter found in URL.rr) startswith urllib.parserrqueryrrrr) code_or_urlrrparsedparamsrs r_extract_code_and_staters}  ! !& )D  / k "F fll #F V 89  JJw ' *E &>! e ##rcbtjs tdtjdt ddlm}|jttttd}|jdd \}}t||j| t|y ) zPrint the OAuth URL for the user to visit. Persists PKCE state. ``email`` namespaces the pending state so two users can be mid-flow in parallel without trampling each other's PKCE verifier. :ERROR: No client secret stored. Run --client-secret first.rrFlowT)scopesrautogenerate_code_verifierofflineconsent) access_typeprompt)rrr$N)r8rBrrrrgoogle_auth_oauthlib.flowrfrom_client_secrets_filerr<rauthorization_urlrr)r$rflowauth_urlrs r get_auth_urlrs  ' ' ) JK  N.  ( (  !""#' ) D ,,-OHeU$2D2DER (Orcvtjs tdtjdt |}|}t |\}}|r(||dk7r tdtjdtddlm }ddl m }m }tt}t|t rb|j#drQ|||j$} | j'd xsd gdj)} | r| j+}|j-t!t||j'd t.|d|d  } dt0j2d<| j5|| j8} t;t=j>| jA}tC| dr%| jDrt| jDxsgng}|r||d<n|tk7r||d<tG|}tI||tK|jMdtd||rtOdtQ|dn tOd}td|y#t6$r9} td| tdtjdYd} ~ 5d} ~ wwxYw)zExchange an auth code (or pasted redirect URL) for a refresh token. ``email`` selects the destination token path. ``None`` writes to the legacy single-user path (kept for the existing CLI entrypoint and for pre-multi-user installs). rrrzKERROR: OAuth state mismatch. Run --auth-url again to start a fresh session.rrrrscoper rr)rrrr1OAUTHLIB_RELAX_TOKEN_SCOPE)rzERROR: Token exchange failed: z=The code may have expired. Run --auth-url to get a fresh URL.Ngranted_scopesrT missing_okz"OK: Authenticated. Token saved to z/google_chat_user_tokens/r4z/google_chat_user_token.jsonzProfile path: ))r8rBrrrrrrrrrrrlistr< isinstancerrrrrsplitrrrr fetch_tokenrIrYrlrmrnrohasattrrr6rkr:rr r&)rr$ pending_auth raw_callbackreturned_staterrrrr scope_valrrQrP token_payloadactually_grantedrO rel_labels rexchange_auth_coders|  ' ' ) JK  %e,LL248D..L,AA     N./&\N,$)@)@)H(<0667ZZ(0RD!4::< &__.N  ( (  !"!%%nmD7#"?3 ) D36 /0 d#   E6tzz%--/7RSM 5* +0D0D U ! ! 'R(  "2 h 6 !"0 hU#J M2u$$$5 .zl ;<   !!:?5;Q:RRWX#%&&B C  N9+ &'9  .se45 MN  s%I66 J8?.J33J8ct|}|js tdytddlm}ddlm} |jt|t}|jr"|jr|j|ddl}|jj!|jjd|j"ddd i d td |j'dt)|j'dtd|y#t$$r}td|Yd}~Xd}~wwxYw)zRevoke the stored token with Google and delete it locally. Per-user when ``email`` given, legacy single-user when omitted. zNo token to revoke.Nrr>r@z+https://oauth2.googleapis.com/revoke?token=POSTz Content-Typez!application/x-www-form-urlencoded)methodheaders)timeoutzToken revoked with Google.z9Remote revocation failed (token may already be invalid): TrzDeleted )r6rBrrrCr?rDrArHrr<rKrLrMurllib.requestrequesturlopentokenrIrr:)r$rOr?rArPurllibrQs rrevokerQs$ U#J     #$N56Q55c*ovN ==U00 MM') $ NN " "=ekk]K')LM #     *+&u$$$5 HZL !" Q I#OPPQsB$D E(D;;Ec\tjd}|jd}|jddd|jd d d |jd dd|jddd |jddd|jddd|jdddd|j }|j xsd}|j r(tjt|rdydy|jrt|jy|jr t|y|jrt|j|y|j r t!|y|j"r"tjt#rdndyy)NzDGoogle Chat user-OAuth setup for Hermes (native attachment delivery)) descriptionT)requiredz--check store_truez)Check if auth is valid (exit 0=yes, 1=no))actionhelpz--client-secretPATHzStore OAuth client_secret.json)metavarrz --auth-urlz!Print OAuth URL for user to visitz --auth-codeCODEzExchange auth code for tokenz--revokezRevoke and delete stored tokenz--install-depszInstall Python dependenciesz--emailEMAILzMScope operation to a specific user's token (default: legacy single-user path))rdefaultrrr)argparseArgumentParseradd_mutually_exclusive_group add_argument parse_argsr$checkrrr client_secretrrr auth_coderrr)parsergroupargsr$s rmainrvs  $ $ZF  / / / >E yGI (&<> |L?A }f:< z,<> ' 9;  7DAB    D JJ $E zz j'/Q/  D../ U 4>>51 u   ln!, r__main__)returnr)rr)r$rrr)N)r$ Optional[str]rr)r$rr Optional[Any])rPrr$rrr)rPrrr)rr;)rPrrOrrNone)rurtrrt)rrrrrr)rr)rbool)r$rrr)rrrr)rrrrr$rrr)r$rrrt)rrrzTuple[str, Optional[str]])r$rrr)rrr$rrr)>__doc__ __future__rr rmloggingrrerr subprocessrpathlibrtypingrrrr getLoggerrFhermes_constantsr r ModuleNotFoundErrorrEutilsrrcompiler!r&r)r,r.r2r6r8r:r<__annotations__rrrRrTr]rhrNrlrkrrrrrrrrrrr__name__rrrr*sf6p#    --   E FE !rzz+, " :6B= B";  % 9xBQ&  &@2&2:.2 * 6: $ $ 6H(V"#J"-J zFY [) = sD DD