`gjjdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZmZmZgdZddlmZmZeGd d Zddd Zed ZGd deeZy)uShared substrate for external secret-source backends. Every backend (Bitwarden, 1Password, …) needs the same handful of security-sensitive primitives: * a uniform result object (:class:`FetchResult`), * environment-variable name validation (:func:`is_valid_env_name`), * a two-layer fetch cache whose disk half writes atomically with ``0600`` permissions and honours a TTL (:class:`DiskCache`, :class:`CachedFetch`). These used to live inline inside ``bitwarden.py``. Pulling them here means the atomic-write / ``0600`` / TTL logic is audited and fixed in exactly one place instead of drifting across copy-pasted per-backend modules — each backend supplies only its own cache-key shape and a serializer for it. Nothing in this module ever raises out to the caller's hot path: the disk layer is strictly best-effort (a miss just triggers a refetch), because a cache problem must never block Hermes startup. ) annotationsN) dataclass)Path)CallableDictGenericOptionalTypeVar) FetchResult CachedFetch DiskCacheis_valid_env_nameresolve_cache_home)r rc.eZdZUdZded<ded<ddZy) r z;A set of fetched secret values plus when they were fetched.zDict[str, str]secretsfloat fetched_atcV|dkrytj|jz |kS)NrF)timer)self ttl_secondss N/root/.hermes/venv/lib/python3.12/site-packages/agent/secret_sources/_cache.pyis_freshzCachedFetch.is_fresh@s' !  doo-<<N)rrreturnbool)__name__ __module__ __qualname____doc____annotations__rrrr r 9sE =rr cr|4ttjdtjdz }|S)aResolve the Hermes home used for cache paths. ``home_path`` is whatever ``load_hermes_dotenv()`` already resolved; falling back to ``$HERMES_HOME`` / ``~/.hermes`` keeps direct callers (and tests that don't thread a home through) working. HERMES_HOMEz.hermes)rosgetenvhome) home_paths rrrMs0=$))+ 2IJK rKcdeZdZdZddZd d dZ d d dZ d d dZd d dZy)r uBest-effort, profile-aware on-disk cache for fetched secret values. One JSON object per backend lives at ``/cache/``:: {"key": "", "secrets": {...}, "fetched_at": 1.0} The file holds only secret *values* keyed by the serialized cache key — never raw auth material. Backends are responsible for fingerprinting tokens/sessions *before* they reach ``key_serializer`` so the token can't land in the key. Writes are atomic (``mkstemp`` → ``chmod 0600`` → ``os.replace``) and the containing ``cache/`` directory is forced to ``0700`` — ``mkdir``'s mode is umask-subject, so the chmod is the reliable form. Both ``read`` and ``write`` short-circuit when ``ttl_seconds <= 0``, so setting the TTL to zero disables *both* cache layers symmetrically: a user opting out never gets secret values written to disk at all. c`||_||_|jddd}d|d|_y)N.r_) _basename_key_serializersplit _tmp_prefix)rbasenamekey_serializerstems r__init__zDiskCache.__init__ps8!-~~c1%a(tfA;rNc8t|dz |jz S)Ncache)rr/rr(s rpathzDiskCache.pathxs!),w6GGrc|dkry|j|} t|dd5}tj|}dddt tsy|jd|j|k7ry|jd}|jd}t |trt |ttfsy|jD cic]*\} } t | tst | ts(| | ,} } } t| t| } | j|sy| S#1swYxYw#ttj f$rYywxYwcc} } w) zReturn a fresh cached entry for ``key``, or None. Best-effort: any I/O or parse error, a key mismatch, or a stale entry all return None so the caller re-fetches. rNrutf-8encodingkeyrr)rr)r:openjsonloadOSErrorJSONDecodeError isinstancedictgetr0intritemsstrr r) rr@rr(r:fpayloadrrkvtypedentrys rreadzDiskCache.read{s; ! yy# dC'2 'a))A, ''4( ;;u !5!5c!: :++i([[. '4( :U|0T%]]_! Q 1c0BzRSUXGYAqD! ! EeJ6GH~~k* ) ' '--.  ! s9D>D2D>E/EE2D;7D>>EEc|dkry|j|} |j}|jdd tj|d|j ||j|jd}tj|jdt|\}} tj|d d 5} tj|| dddtj| d tj | |y#t $rYwxYw#1swYExYw#t"$r' tj$| #t $rYwxYwwxYw#t $rYywxYw) uPersist ``entry`` for ``key`` atomically at mode ``0600``. No-op when ``ttl_seconds <= 0`` (so caching is genuinely off) or on any I/O error — the next invocation just re-fetches. rNT)parentsexist_oki)r@rrz.tmp)prefixsuffixdirwr=r>i)r:parentmkdirr%chmodrDr0rrtempfilemkstempr2rKfdopenrBdumpreplace BaseExceptionunlink) rr@rQrr(r: cache_dirrMfdtmprLs rwritezDiskCache.writesU !  yy#  I OOD4O 8 E*++C0 ==#..G&&''C NGB YYr39*QIIgq)*e$ 3%!  **! IIcN     sED AE'D&?D4D& DEDED#D&& E0EE EEEEE E%$E%cn |j|jy#ttf$rYywxYw)z6Delete the on-disk cache file if present (idempotent).N)r:rcFileNotFoundErrorrDr9s rclearzDiskCache.clears3  IIi ' ' )!7+   s "44)r3rKr4zCallable[[K], str]rNoneNr(Optional[Path]rr)r@r)rrr(rnrzOptional[CachedFetch]) r@r)rQr rrr(rnrrk)r(rnrrk) rrrr r6r:rRrgrjr"rrr r \s&'H%) # ##" #  #T%) . .. . " .  .`rr rlrm)r __future__rrBr%r]r dataclassesrpathlibrtypingrrrr r __all__agent.secret_sources.baser rr rr)r r"rrrusn(#  !==   = =  =&  CLy yr