`gjy UdZddlmZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ejeZe j"ZehdZded<Gd d ej,Zd d Zdd Zy)uAudit log for dashboard-auth events. Profile-aware location: ``$HERMES_HOME/logs/dashboard-auth.log``. Format: one JSON object per line. Token-like fields are stripped before serialisation to avoid leaking refresh tokens or JWTs to disk. This module deliberately keeps a minimal dependency surface — no imports from ``hermes_constants`` or other hermes_cli modules — so it can be imported safely from middleware code that loads early in the startup sequence. ) annotationsN)Path)Any> codestatecookieticket access_token Authorization authorization code_verifier refresh_token frozenset_REDACTED_FIELDSc@eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd Zy) AuditEventzmEvent types written to dashboard-auth.log. Values are the literal ``event`` field on the JSON line. login_start login_success login_failurelogoutrefresh_successrefresh_failurerevokesession_verify_failurews_ticket_mintedws_ticket_rejectedtoken_auth_successtoken_auth_failureN)__name__ __module__ __qualname____doc__ LOGIN_START LOGIN_SUCCESS LOGIN_FAILURELOGOUTREFRESH_SUCCESSREFRESH_FAILUREREVOKESESSION_VERIFY_FAILUREWS_TICKET_MINTEDWS_TICKET_REJECTEDTOKEN_AUTH_SUCCESSTOKEN_AUTH_FAILURER/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/dashboard_auth/audit.pyrr"sJ  K#M#M F'O'O F5)---r0rctjjdxs tt j dz }t |dz dz S)a ``$HERMES_HOME/logs/dashboard-auth.log`` with the standard fallback. Mirrors ``hermes_constants.get_hermes_home`` semantics: env var wins, else ``~/.hermes``. A local copy avoids an import cycle with the middleware which lives below ``hermes_cli``. HERMES_HOMEz.hermeslogszdashboard-auth.log)osenvirongetstrrhome)r9s r1_resolve_log_pathr:6s@ ::>>- ( HC i0G,HD : !5 55r0c |jDcic]\}}|tvr||}}}tjj tj j j|jd|}tj|ddz}t} |jjddt5t|dd 5}|j!|d d d d d d y cc}}w#1swYxYw#1swYy xYw#t"$r } t$j'd | Yd } ~ y d } ~ wwxYw) uAppend one event to the audit log. Token-like fields are dropped. Missing log directory is created. Write failures are logged at WARNING but never raise — auth must not fail because the audit logger broke. )tsevent),:) separators T)parentsexist_okazutf-8)encodingNz)dashboard-auth audit log write failed: %s)itemsr_dtdatetimenowtimezoneutc isoformatvaluejsondumpsr:parentmkdir _write_lockopenwrite Exception_logwarning) r=fieldskv safe_fieldsentrylinepathfes r1 audit_lograAs( A $ $ 1K lls||//0::<   E ::e 3d :D  DE $6  dC'2 a         E @!DDEsSC:%#DD D)D 1DD D  DDD E!D<<E)returnr)r=rrXrrbNone)r" __future__rrHrGenumrNloggingr5 threadingpathlibrtypingr getLoggerrrVLockrRrr__annotations__Enumrr:rar/r0r1rns{ #  w"inn ()) ..(6Er0