`gjsW>UdZddlmZddlZddlmZmZddlmZddl m Z m Z m Z ddl mZddlmZmZdd lmZmZmZdd lmZmZmZmZmZmZdd lmZej>e Z!d Z"d e#d<ddZ$ddZ% ddZ&ddZ'ddZ(ddZ) ddZ*ddZ+ddd dZ,y)!aAuth-gate middleware for the dashboard. Engaged when ``app.state.auth_required is True``. The gate's job: 1. Allow a small set of routes through unauthenticated (login page, ``/auth/*`` OAuth round trip, ``/api/auth/providers``, static assets). 2. For everything else, demand a valid session cookie and attach the verified :class:`Session` to ``request.state.session``. 3. On HTML routes, redirect missing/invalid cookies to ``/login``. On ``/api/*`` routes, return 401 JSON. The middleware is a no-op when ``auth_required`` is False (loopback mode); the legacy ``_SESSION_TOKEN`` ``auth_middleware`` handles those binds. ) annotationsN) AwaitableCallable)Request) JSONResponseRedirectResponseResponse)list_session_providers) AuditEvent audit_log)DashboardAuthProvider ProviderErrorRefreshExpiredError)clear_sso_attempt_cookieread_session_cookiesread_session_providerread_sso_attempt_cookieset_session_provider_cookieset_sso_attempt_cookie)PUBLIC_API_PATHS) z /auth/loginz/auth/callbackz/auth/password-loginz /auth/logout/loginz/api/auth/providersz/api/mcp/oauth/callback/z/assets/z /favicon.icoz /ds-assets/z/fonts/z/fonts-terminal/ztuple[str, ...]_GATE_PUBLIC_PREFIXEScFtvrytfdtDS)uTrue if ``path`` bypasses the OAuth auth gate. Two sources of public-ness: * :data:`PUBLIC_API_PATHS` — the shared ``/api/*`` allowlist that the legacy ``_SESSION_TOKEN`` middleware also honours. Matched exactly (no prefix expansion) so adding ``/api/status`` doesn't accidentally expose ``/api/status/secret-extension``. * :data:`_GATE_PUBLIC_PREFIXES` — auth-bootstrap routes and static mounts. Prefix-matched so ``/assets/foo.css`` lights up via ``/assets/``. Tc3NK|]}|k(xsj|ywN startswith).0prefixpaths W/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/dashboard_auth/middleware.py z"_path_is_public..Ps.  1$//&11"%)ranyr)r s`r!_path_is_publicr%As+  + c|jjdd}|r"|jddjS|jr|jj SdS)Nzx-forwarded-for,r)headersgetsplitstripclienthost)requestfwds r! _client_ipr2VsS //  / 4C yy~a &&((")..7>>  8b8r&cJt}r|jfd|S)agPrefer the hinted provider without making the hint authoritative. The cookie can outlive a provider rename/removal or become stale after a deployment change. A stable sort moves a matching provider to the front while preserving registration order for every remaining candidate; an unknown hint therefore leaves the normal scan unchanged. c"|jk7Sr)name)provider provider_hints r!z,_ordered_session_providers..isHMM],Jr&)key)r sort)r7 providerss` r!_ordered_session_providersr<]s%'(IJK r&cddlm}|jj}t |}||}|r|d|n|d}|j dr|dk(rdnd}t |d ||d d St|d S)uAPI routes → 401 JSON with ``login_url``; HTML routes → 302 → /login. The JSON envelope carries a ``login_url`` field with a ``next=`` query string so the SPA's global 401 handler can drop the user back where they were after re-auth. The contract is intentionally simple so any fetch-wrapper can implement the redirect without parsing details: if response.status === 401 && body.error in ("unauthenticated", "session_expired"): window.location.assign(body.login_url); HTML redirects also carry the ``next=`` query string so direct navigation to ``/sessions`` (etc.) without a cookie comes back to ``/sessions`` after login. Under a reverse proxy with ``X-Forwarded-Prefix: /hermes``, the ``login_url`` is prefixed (``/hermes/login?next=...``) so the browser's window.location.assign / Location: follow lands on the proxied login page rather than the bare ``/login`` (which the proxy doesn't route to the dashboard). rprefix_from_requestz /login?next=r/api/invalid_or_expired_sessionsession_expiredunauthenticated Unauthorized)errordetailreason login_urli status_code.urlrJ) hermes_cli.dashboard_auth.prefixr?rMr _safe_next_targetrrr)r0rGr?r next_paramrrH error_codes r!_unauth_responserRms,E ;;  D"7+J  )F/96(,zl+xv   w55 "  #( &       s ;;r&cD|jj}|jdryt|r(ddlm}t |d}t||||St}t|dk7ryddlm}|d}t|d d ry||}t|}dd l m }|d ||jd } |r| d|} t| d}ddlm} t%|| ||t't(j*|jdt-||S)uMaybe auto-initiate the portal OAuth redirect on an unauth HTML load. Returns a 302 → ``/auth/login`` (the existing OAuth-initiation route) when ALL of the following hold, else ``None`` (caller falls back to the ordinary ``/login`` interstitial): * the request is an HTML document navigation, not an ``/api/*`` fetch (a fetch() would follow the 302 into the cross-origin OAuth dance opaquely — same reason ``_unauth_response`` never redirects APIs); * exactly ONE interactive provider is registered — with two or more we can't pick for the user, so the ``/login`` chooser must render; with zero there's nothing to redirect to; * that provider is OAuth-style, not a password form provider. Password providers must render ``/login`` so the user can enter credentials; * the one-shot loop-guard marker is ABSENT. Its presence means we already bounced to the portal once and came back still unauthenticated (no portal session) — auto-redirecting again would ping-pong, so we fall through to ``/login`` and clear the marker. The portal ``/oauth/authorize`` auto-approves any current member of the dashboard's org and is a silent 302 when the user already holds a portal session, so for the common case (clicked a dashboard link while signed in to the portal) this removes the interstitial CLICK entirely. It removes a click, not a security check: the redirect lands on ``/auth/login`` which runs the unchanged PKCE auth-code flow. r@Nrr> no_cookierGrsupports_passwordFquotez/auth/login?provider=r(safez&next=rKrL detect_https) use_httpsrauto_ssor6rGip)rMr rrrNr?rRrr lengetattrrO urllib.parserZr5r!hermes_cli.dashboard_auth.cookiesr^rr r LOGIN_STARTr2) r0r r?respr;r6rrPrZ auth_loginr^s r!_auto_sso_responserjs6 ;;  D ww'H < .A'.JK '(I 9~D|Hx,e4  )F"7+J"80x}}21N0OPJ"|6*6   .s.    'T__Q'' r#)rz/auth/z /api/auth/z/apir@?rrYr[)rMr rr$queryrerZ)r0rptargetrZr s @r!rOrOs ;;  D ts+tt/D  3  v~1 KK  E"'vQug TF" b !!r&c HKt|jjdds||d{St|jddr||d{S|jj}t |r||d{St |\}}t|}|s|st|}||St|dSd}|r@d}t|D]} | j|}|n||t)d d |d idS| t+|||} | | \} } | |j_||d{}ddlm}m}ddlm}||| j:| j<t?| ||||| t!t"j@| | jBt'||St!t"j$dt'|t|d}ddlm"}ddlm}|||||S||j_||d{}|s=|jFr1ddlm}ddlm}tI||jF|||||S7=77#t$rj} tjd| j| t!t"j$| jd t'| | | j}Yd} ~  d} ~ wwxYw#t$r&} t)d d t-| d idcYd} ~ Sd} ~ wwxYw77w)zEngaged only when ``app.state.auth_required is True``. No-op pass-through in loopback mode so the legacy auth_middleware can handle those binds via ``_SESSION_TOKEN``. auth_requiredFNtoken_authenticatedrTrU) access_tokenz9dashboard-auth: provider %r unreachable during verify: %sprovider_unreachablerarFzAuth provider z unreachableirI) refresh_tokenr7r)r^set_session_cookiesr>)rurwaccess_token_expires_inr_rr6)r6user_idrbno_provider_recognises)rGrbrA)clear_session_cookiesrVr])r6r_r)%rdappstaterMr r%rrrjrRr<verify_sessionr_logwarningr5r r SESSION_VERIFY_FAILUREr2r_attempt_refreshstrsessionrfr^rxrNr?rurw_expires_in_secondsREFRESH_SUCCESSrzr|r6r)r0 call_nextr at_rtr7autorunreachable_providerr6e refreshed new_sessionrefreshing_providerresponser^rxr?r|s r!gated_auth_middlewarersD 7;;$$ou =w''' w}}3U;w''' ;;  Dtw'''"7+GB)'2M c"'*  K << G ,02=A H "11r1B"% & ?3? ^,@+C<PQ   (!+I  /8 ,K,$/GMM !&w//H   M (55)77(;K(H&w/*73,  **,#++g&   O  - -+'" $G4PQ LHh/B7/KL#GMMw''H W--BH# %%"7+&w/  OS(((h!  OMM155%]]1!'*  (/+3==( J  ^CF:\BC   0^(s-L"I,&L"I/0L"I2AL"I5,L"/L" K+#L"=L>C(L"&L 'AL"/L"2L"5 K(>AK#L"#K((L"+ L4LLL"LL" L"c|ddl}tdt|jt|jz S)a%Seconds until the access token's ``exp``, floored at 60. Mirrors the auth-route's ``max(60, exp - now)`` so the access-token cookie's Max-Age tracks the token lifetime even on a slightly skewed clock. ``time`` imported locally to keep the module's import surface minimal. rN<)timemaxint expires_at)rrs r!rrs/ r3w))*S-== >>r&)r7c |syd}t|D]'} |j|}|||j fcS| t|y#t$r3ttj |j dt|Yst$ri}tjd|j |ttj |j dt|| |j }Yd}~d}~wwxYw)aTry to rotate an expired session via the refresh token. The provider hint only changes candidate order. ``RefreshExpiredError`` rejects the token for that candidate, but cannot prove ownership because providers such as Basic raise it for foreign opaque tokens too. Likewise, ``ProviderError`` only makes that candidate unavailable. Both are audited and the remaining providers are tried. Returns ``None`` only when there is no RT or every reachable provider rejects it. If no provider succeeds and at least one raised ``ProviderError``, re-raises with that provider's name so the caller can return 503 without clearing potentially valid cookies. N)rwrefresh_expiredraz:dashboard-auth: provider %r unreachable during refresh: %srv) r<refresh_sessionrr r REFRESH_FAILUREr5r2rrr)r0rwr7unavailable_providerr6rrs r!rrs '+.}=. "222OK.  " - -5.6'011 5#  **!(g&     LLL q  **!-g&   $+'/}}$  sA  9C5C5 AC00C5)r rreturnbool)r0rrr)r7 str | Nonerzlist[DashboardAuthProvider])r0rrGrrr )r0rrzResponse | None)r0rrz(Callable[[Request], Awaitable[Response]]rr )rr)r0rr7r)-__doc__ __future__rloggingtypingrrfastapirfastapi.responsesrrr hermes_cli.dashboard_authr hermes_cli.dashboard_auth.auditr r hermes_cli.dashboard_auth.baser rrrfrrrrrr&hermes_cli.dashboard_auth.public_pathsr getLogger__name__rr__annotations__r%r2r<rRrjrOrrrr&r!rs #&FF<A Dw" *  *9     3