`gj\pUdZddlmZddlZddlZddlZddlmZmZddl m Z m Z m Z m Z ddlmZmZmZddlmZmZmZddlmZdd lmZmZmZdd lmZmZdd lm Z m!Z!m"Z"dd l#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-ej\e/Z0eZ1d3dZ2d3dZ3d3dZ4e1jkddd4dZ6e1jkddd5dZ7e1jkddd6d7dZ8e1jkdd d8 d9dZ9d:dZ:dZ;d Z<eeZ=d!e>d"<ej~Z@d;d#ZAdd,ZFe1jkd-d.d>d/ZGe1jd0d1d>d2ZHy)?uHTTP routes for the dashboard-auth OAuth round trip. Mounted at root (no prefix) by ``web_server.py``. The router does not auto-gate; gating is performed by ``gated_auth_middleware``, which allowlists everything under ``/auth/*`` and ``/api/auth/providers``. The routes: GET /login → server-rendered login page GET /auth/login?provider=N → 302 to IDP, sets PKCE cookie GET /auth/callback?code,state → completes login, sets session cookies POST /auth/logout → clears cookies, best-effort revoke GET /api/auth/providers → list registered providers (login bootstrap) GET /api/auth/me → current Session as JSON (auth-required) ) annotationsN) defaultdictdeque)AnyDequeDictTuple) APIRouter HTTPExceptionRequest) HTMLResponse JSONResponseRedirectResponse) BaseModel) get_providerlist_providerslist_session_providers) AuditEvent audit_log)InvalidCodeErrorInvalidCredentialsError ProviderError)clear_pkce_cookieclear_session_cookiesclear_sso_attempt_cookie detect_httpsread_pkce_cookieread_session_cookiesset_pkce_cookieset_session_cookies)render_login_htmlcddlm}m}ddlm}m}|}|r|dSt |jd}||}|s|S||}||j||jS)uReconstruct the absolute callback URL the IDP redirects back to. Three resolution tiers: 1. ``HERMES_DASHBOARD_PUBLIC_URL`` env var or ``dashboard.public_url`` in config.yaml — when set, this is the complete authority (scheme + host + optional path prefix) and we append ``/auth/callback`` verbatim. ``X-Forwarded-Prefix`` is IGNORED on this code path because the operator has declared the public URL — we no longer need to guess from proxy headers, and stacking the prefix on top would double-prefix the common case where the prefix is already baked into ``public_url``. Relief valve for deploys behind reverse proxies whose forwarded headers aren't reliable. 2. ``X-Forwarded-Prefix: /hermes`` (Mission Control deploys) — we prepend the prefix to the path FastAPI's ``url_for`` produces (it doesn't natively honour this header — it isn't part of the Starlette/uvicorn proxy_headers set). 3. Bare ``request.url_for("auth_callback")`` — under uvicorn's ``proxy_headers=True`` this picks up the public https URL from ``X-Forwarded-Host`` plus ``X-Forwarded-Proto``. Fly.io's default path. r)urlparse urlunparse)prefix_from_requestresolve_public_url/auth/callback auth_callback)path) urllib.parser#r$ hermes_cli.dashboard_auth.prefixr%r&strurl_for_replacer)) requestr#r$r%r& public_urlbaseprefixparseds S/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/dashboard_auth/routes.py _redirect_urir58s{42 $%J ^,, w/ 0D  )F  d^F foofXfkk]+CoD EEc|jjdd}|r"|jddjS|jr|jj SdS)Nzx-forwarded-for,r)headersgetsplitstripclienthost)r/fwds r4 _client_iprAlsS //  / 4C yy~a &&((")..7>>  8b8r6cddlm}||S)aAResolve the X-Forwarded-Prefix header for the active request. Local indirection so the routes pass a consistent value to the cookie helpers (cookie name + Path attribute) and the gate's redirect builders (login_url construction). See ``hermes_cli.dashboard_auth.prefix`` for the normalisation rules. r)r%)r+r%)r/r%s r4_prefixrCssE w ''r6/login login_page)namecKt|jjdd}tt |ddiSw)Nnextr8) next_pathz Cache-Controlz#no-store, no-cache, must-revalidate)r:)_validate_post_login_target query_paramsr;r r!)r/rIs r4rErEsH ,  ,I I. "GH s?Az/api/auth/providersauth_providersc Kt}|stddidSd|Dcgc]0}|j|jt t |ddd2c}iScc}ww) Ndetailzno auth providers registered) status_code providerssupports_passwordF)rF display_namerR)rrrFrSboolgetattr)rQps r4api_auth_providersrWs'(I  5 6      !%)A2E:&       s!A!5A A!z /auth/login auth_loginc 8Kt|}|tdd|t|ddstdd|t|ddr=d d lm}t |}t |d }|r|d ||d }t|dS |jt|}ttj|t|t|j d} |j"j%dd } d| vr| rd|d| nd|} t |}|rd d lm}| d||d } t'| | t)|t || S#t$r;}ttj|dt|tdd|d}~wwxYww)NzUnknown provider: rPrNsupports_sessionTz-Provider does not support interactive login: rRFr)quoterDz?next=r8)safe.urlrP) redirect_uriprovider_unreachableproviderreasoniprOProvider unreachable: )rerghermes_session_pkcez provider=;z;next=)payload use_httpsr2)rr rUr*r]rJrCr start_loginr5rrr LOGIN_FAILURErA LOGIN_START redirect_urlcookie_payloadr;rr) r/rerHrVr] safe_next login_urllseresppkces r4rXrXsXAy'|4   1($ /B8,O  q%u-&/5 w'(/ $+VE)",E+FGII3??  ]] g(>] ? g  S AD    !6 ;D$048*AdV,IhZ:P,D1I&veIB789 dl7&;w KO     $ $)'"  +A3/    s+BFE#B0F F6FFFr'r(c Kt|}|s2ttjdt |t ddt d|jdD}|jdd }|jd d }|jd d } |jd d } t|} | t dd ||r;ttj|d|t |t dd|d|d|r||k7r3ttj|dt |t dd | j||| t|} ttj|| j| j | j"t |t%d| j&t)t+j*z }t-| xsd}t/|d }t1|| j2| j4|t7|t9|| j:!t=|t9|"t?|t9|"|S#t$r;} ttj|dt |t dd| d} ~ wt$r;} ttj|dt |t dd| d} ~ wwxYww)#Nmissing_pkce_cookie)rfrgizMissing PKCE state cookier[c3JK|]}d|vs|jddyw)=N)r<).0segs r4 z auth_callback..s&!C3J #qs ##rjrer8stateverifierrHzUnknown provider in cookie: idp_error)rerferrorrgzOAuth error from provider: z ()state_mismatchrdz(OAuth state mismatch (CSRF check failed))coder code_verifierrb invalid_codezInvalid code: rcrOrhreuser_idemailorg_idrg</r_r` access_token refresh_tokenaccess_token_expires_inrlr2rer2) rrrrnrAr dictr<r;rcomplete_loginr5rr LOGIN_SUCCESSrrrmax expires_atinttimerJrr rrrrCrerr)r/rrrerror_descriptionpkce_rawparts provider_nameexpected_staternext_from_cookierVsessionru expires_inlandingrvs r4r(r(s (H   $ $('" .   %-^^C%8 EIIj"-MYYw+NyyR(H yy,]#Ay1-1BC     $ $"'"  0r:K9LAN  E^+  $ $"#'"  =   """&w/ # 4  mm~~ g  R++c$))+.>>?J**:;BsG S 9D ))++ *w'w!!d77#34T''*:; Kg J  $ $"!'"  nQC4HII     $ $")'"  +A3/    s7D=K-I$DK-$ K*-6J## K*/6K%%K**K-c|syddlm}||jdrjdrytfddDrydk(sjd ryS) uReturn ``raw`` if it's a safe same-origin path, else empty string. The ``next`` query param survives a full OAuth round trip — the gate encodes it into the /login redirect, the login page emits it back into /auth/login, and the IDP preserves it across /authorize/callback. We have to re-validate here because the value came back in via the URL (an attacker could craft a /auth/callback URL with their own ``next=https://evil.example``). r8r)unquoterz//c3NK|]}|k(xsj|yw)N) startswith)r}rVdecodeds r4rz._validate_post_login_target..s0   1 -**1-- s"%)rDz/auth/z /api/auth/z/apiz/api/)r*rrany)rawrrs @r4rJrJysn $clG   c "g&8&8&>  3 &G..w7 Nr6 gN@zDict[str, Deque[float]] _pw_attemptsc8tj}|tz }|xsd}t5t|}|r#|d|kr|j |r |d|krt |tk\r dddy|j| dddy#1swYyxYw)uiTrue if ``ip`` has exceeded the password-login attempt budget. Sliding window: prune attempts older than the window, then check the count. Records the attempt timestamp when allowed. An empty IP (no discernible client) shares a single bucket — fail-safe toward throttling rather than letting unattributable traffic through unmetered. _unknown_rNTF) r monotonic_PW_RATE_WINDOW_SEC_pw_attempts_lockrpopleftlen_PW_RATE_MAX_ATTEMPTSappend)rgnowcutoffkeybuckets r4_password_rate_limitedrs .. C & &F  C c"V+ NN V+ v;/ /   cs.BB5BBcbt5tjdddy#1swYyxYw)z(Test-only: clear all rate-limit buckets.N)rrclearr6r4_reset_password_rate_limitrs& s%.c:eZdZUded<ded<ded<dZded<y)_PasswordLoginBodyr,reusernamepasswordr8rHN)__name__ __module__ __qualname____annotations__rHrr6r4rrsMMMD#Nr6rz/auth/password-loginauth_password_loginc Kt|}t|r4ttj|j d|t ddt|j }| t|dds4ttj|j d |t d d  |j|j|j }ttj|j |j |j"|j$|t'd|j(t+t-j,z }t/|j0xsd}t3d|d}t5||j6|j8|t;|t=||j |S#t$r5ttj|j d |t ddt$rt ddt$r<}ttj|j d|t dd|d}~wwxYww)uAuthenticate a username/password against a password provider. Mirrors the cookie-minting tail of ``/auth/callback`` but skips the PKCE/state/code machinery (those are OAuth-only). On success sets the session cookies and returns JSON ``{"ok": true, "next": }`` — the credential form POSTs via fetch and navigates client-side, so a 302 (which fetch follows opaquely) is the wrong shape here. Failure modes, all deliberately generic so the endpoint can't be used as a username oracle or a provider-enumeration oracle: * unknown provider / provider lacks password support → 404 * bad credentials → 401 ("Invalid credentials") * backing store unreachable → 503 * too many attempts from this IP → 429 rate_limitedrdiz+Too many login attempts. Try again shortly.r[NrRFunknown_password_providerrZzUnknown provider)rrinvalid_credentialszInvalid credentialsizProvider misconfiguredrcrOrhrrrT)okrHr)rArrrrnrer rrUcomplete_password_loginrrrNotImplementedErrorrrrrrrrrrrJrHrr rrrrC) r/bodyrgrVrrurrrvs r4rrs" G Bb!  $ $]]!  @  T]]#Ay#6>   $ $]].  4FGGR++]]T]], 2  mm~~ R++c$))+.>>?J)$))4;G tW5 6D ))++ *w'w!! KW #K  $ $]](  4IJJ N4LMM R  $ $]])  6LQC4PQQRs,B#I &'F3 C&I 3AI  7II  I z /auth/logout auth_logoutcKt|\}}|r"tD]} |j|t|jdd}ttj|r |jnd|r |jndt|t|}t!|dd }t#|| t%|| |S#t$r+}tj d|j |Yd}~d}~wwxYww) N)rz'dashboard-auth: revoke on %r failed: %srunknownr8rerrgrDr_r`r)rrrevoke_session Exception_logwarningrFrUrrrLOGOUTrerrArCrrr)r/_atrtrerusessr2rvs r4rr.s"7+GC '( H ''b'9  7==)T 2D #'$--Y!%2 g  W F 6(& 1s CD$v.d6* K%  =MM1 s.C<CBC< C9!C4/C<4C99C<z /api/auth/meauth_mecKt|jdd}| tdd|j|j|j |j |j|jdSw)zCReturn the verified session as JSON. Auth-required (gate enforces).rNr Unauthorizedr[)rrrSrrer) rUrr rrrSrrer)r/rs r4 api_auth_merRsb 7==)T 2D |NCC<<))++MMoo  sA,A.z/api/auth/ws-ticketauth_ws_ticketc Kt|jdd}| tddddlm}m}||j |j}ttj|j|j t| ||d Sw) aMint a short-lived single-use ticket for the authenticated session. Browsers cannot set ``Authorization`` on a WebSocket upgrade, so in gated mode the SPA POSTs this endpoint to get a ``?ticket=`` value to append to ``/api/pty``, ``/api/console``, ``/api/ws``, ``/api/pub``, or ``/api/events``. The ticket has a 30-second TTL and is single-use. Calling this endpoint multiple times in quick succession (e.g. one ticket per WS) is the expected pattern. rNrrr[r) TTL_SECONDS mint_ticket)rrer)ticket ttl_seconds) rUrr $hermes_cli.dashboard_auth.ws_ticketsrrrrerrWS_TICKET_MINTEDrA)r/rrrrs r4api_auth_ws_ticketrgsz 7==)T 2D |NCCN  FF ## g   [ 99sB B)r/r returnr,)r/r rr )rr)r8)r/r rer,rHr,)r8r8r8r8) r/r rr,rr,rr,rr,)rr,rr,)rgr,rrT)rNone)r/r rr)r/r )I__doc__ __future__rlogging threadingr collectionsrrtypingrrrr fastapir r r fastapi.responsesr rrpydanticrhermes_cli.dashboard_authrrrhermes_cli.dashboard_auth.auditrrhermes_cli.dashboard_auth.baserrr!hermes_cli.dashboard_auth.cookiesrrrrrrrr $hermes_cli.dashboard_auth.login_pager! getLoggerrrrouterr5rArCr;rErWrXr(rJrrrrLockrrrrpostrrrrrr6r4rs+# ***55JJ B   Cw" 1Fh9 ("H<( ) & !(89::M ->.>B ?3 } } } }  }  }4}@`(3E(: %:"INN$,  #*?@XAXv^-01FN+ , ( ")9::;:r6