(GjNUdZddlmZddlZddlmZmZddlmZddl m Z m Z m Z ddl mZddlmZmZdd lmZmZdd lmZmZmZmZdd lmZejeZd Zd e d<d#dZ!d$dZ"d%dZ#d&dZ$d$dZ%d'dZ&d(d!Z'd)d"Z(dS)*aAuth-gate middleware for the dashboard. Engaged when ``app.state.auth_required is True``. The gate's job: 1. Allow a small set of routes through unauthenticated (login page, ``/auth/*`` OAuth round trip, ``/api/auth/providers``, static assets). 2. For everything else, demand a valid session cookie and attach the verified :class:`Session` to ``request.state.session``. 3. On HTML routes, redirect missing/invalid cookies to ``/login``. On ``/api/*`` routes, return 401 JSON. The middleware is a no-op when ``auth_required`` is False (loopback mode); the legacy ``_SESSION_TOKEN`` ``auth_middleware`` handles those binds. ) annotationsN) AwaitableCallable)Request) JSONResponseRedirectResponseResponse)list_session_providers) AuditEvent audit_log) ProviderErrorRefreshExpiredError)clear_sso_attempt_cookieread_session_cookiesread_sso_attempt_cookieset_sso_attempt_cookie)PUBLIC_API_PATHS) z /auth/loginz/auth/callbackz/auth/password-loginz /auth/logout/loginz/api/auth/providersz/assets/z /favicon.icoz /ds-assets/z/fonts/z/fonts-terminal/ztuple[str, ...]_GATE_PUBLIC_PREFIXESpathstrreturnboolcZtvrdStfdtDS)uTrue if ``path`` bypasses the OAuth auth gate. Two sources of public-ness: * :data:`PUBLIC_API_PATHS` — the shared ``/api/*`` allowlist that the legacy ``_SESSION_TOKEN`` middleware also honours. Matched exactly (no prefix expansion) so adding ``/api/status`` doesn't accidentally expose ``/api/status/secret-extension``. * :data:`_GATE_PUBLIC_PREFIXES` — auth-bootstrap routes and static mounts. Prefix-matched so ``/assets/foo.css`` lights up via ``/assets/``. Tc3NK|]}|kp|V dSN startswith).0prefixrs J/home/rurouni/.hermes/hermes-agent/hermes_cli/dashboard_auth/middleware.py z"_path_is_public..IsL  1$//&11)ranyr)rs`r!_path_is_publicr%:sN t +  r#requestrc|jdd}|r-|ddS|jr |jjndS)Nzx-forwarded-for,r)headersgetsplitstripclienthost)r&fwds r! _client_ipr1OsZ /  / 4 4C )yy~~a &&((("). 87>  b8r#reasonr cddlm}|jj}t |}||}|r|d|n|d}|dr |dkrdnd}t |d ||d d St|d S)uAPI routes → 401 JSON with ``login_url``; HTML routes → 302 → /login. The JSON envelope carries a ``login_url`` field with a ``next=`` query string so the SPA's global 401 handler can drop the user back where they were after re-auth. The contract is intentionally simple so any fetch-wrapper can implement the redirect without parsing details: if response.status === 401 && body.error in ("unauthenticated", "session_expired"): window.location.assign(body.login_url); HTML redirects also carry the ``next=`` query string so direct navigation to ``/sessions`` (etc.) without a cookie comes back to ``/sessions`` after login. Under a reverse proxy with ``X-Forwarded-Prefix: /hermes``, the ``login_url`` is prefixed (``/hermes/login?next=...``) so the browser's window.location.assign / Location: follow lands on the proxied login page rather than the bare ``/login`` (which the proxy doesn't route to the dashboard). rprefix_from_requestz /login?next=r/api/invalid_or_expired_sessionsession_expiredunauthenticated Unauthorized)errordetailr2 login_urli status_code.urlr?) hermes_cli.dashboard_auth.prefixr5rBr_safe_next_targetrrr)r&r2r5r next_paramr r= error_codes r!_unauth_responserGVs,EDDDDD ; D"7++J  ) )F/9 6++z+++     w 555  "  #( &          s ; ; ;;r#Response | Nonect|jj}|drdSt|r3ddlm}t |d}t||||St}t|dkrdSddlm}|d}||}t|}dd l m }|d ||j d } |r| d |} t| d}ddlm} t#|| ||t%t&j|j dt+||S)uMaybe auto-initiate the portal OAuth redirect on an unauth HTML load. Returns a 302 → ``/auth/login`` (the existing OAuth-initiation route) when ALL of the following hold, else ``None`` (caller falls back to the ordinary ``/login`` interstitial): * the request is an HTML document navigation, not an ``/api/*`` fetch (a fetch() would follow the 302 into the cross-origin OAuth dance opaquely — same reason ``_unauth_response`` never redirects APIs); * exactly ONE interactive provider is registered — with two or more we can't pick for the user, so the ``/login`` chooser must render; with zero there's nothing to redirect to; * the one-shot loop-guard marker is ABSENT. Its presence means we already bounced to the portal once and came back still unauthenticated (no portal session) — auto-redirecting again would ping-pong, so we fall through to ``/login`` and clear the marker. The portal ``/oauth/authorize`` auto-approves any current member of the dashboard's org and is a silent 302 when the user already holds a portal session, so for the common case (clicked a dashboard link while signed in to the portal) this removes the interstitial CLICK entirely. It removes a click, not a security check: the redirect lands on ``/auth/login`` which runs the unchanged PKCE auth-code flow. r6Nrr4 no_cookier2r quotez/auth/login?provider=r(safez&next=r@rA) detect_https) use_httpsr auto_ssoproviderr2ip)rBrrrrCr5rGrr lenrD urllib.parserOnamer!hermes_cli.dashboard_auth.cookiesrRrr r LOGIN_STARTr1) r&rr5resp providersrVr rErO auth_loginrRs r!_auto_sso_responser`s2 ; D wtw''HHHHHH <<< .A.A'.J.JKKKK '((I 9~~tDDDDDD|H  ) )F"7++J""""""PPx}21N1N1NPPJ7"66*66   < < >>>> W--f g    Kr#c@|jjr*drdrdStfddDrdSdksdrdS|jj}|rd|n}d d lm}||d S) uOBuild the URL-encoded ``next`` query value, or empty string. Only same-origin relative paths are accepted; absolute URLs or ``//evil.com`` open-redirect attempts are silently dropped. The empty string return means the caller produces a bare ``/login`` URL — fine, user lands at the dashboard root after re-auth. /z//r(c3NK|]}|kp|V dSrr)rprs r!r"z$_safe_next_target..sL     'T__Q''      r#)rz/auth/z /api/auth/z/apir6?rrNrP)rBrrr$queryrYrO)r&rftargetrOrs @r!rDrDs ; D ts++tt/D/Dr     3   r v~~11~r K E"' 1  u   TF"""""" 5b ! ! !!r# call_next(Callable[[Request], Awaitable[Response]]c LKt|jjdds||d{VSt|jddr||d{VS|jj}t |r||d{VSt |\}}|s&|s$t|}||St|dSd}|rd}tD]} | |}np#t$rc} t d|j| tt j|jd t%| ||j}Yd} ~ d} ~ wwxYw|n||t'd d |d idS| t)||} | | \} } | |j_||d{V} ddlm}m}ddlm}|| | j| jt;| ||||tt j| | jt%|| Stt jdt%|t|d} ddlm }ddlm}|| ||| S||j_||d{VS)zEngaged only when ``app.state.auth_required is True``. No-op pass-through in loopback mode so the legacy auth_middleware can handle those binds via ``_SESSION_TOKEN``. auth_requiredFNtoken_authenticatedrJrK) access_tokenz9dashboard-auth: provider %r unreachable during verify: %sprovider_unreachablerUr<zAuth provider z unreachableir> refresh_tokenr)rRset_session_cookiesr4)rmrpaccess_token_expires_inrSr )rVuser_idrWno_provider_recognises)r2rWr7)clear_session_cookiesrL)!getattrappstaterBrr%rr`rGr verify_sessionr _logwarningrZr r SESSION_VERIFY_FAILUREr1r_attempt_refreshsessionr[rRrqrCr5rmrp_expires_in_secondsREFRESH_SUCCESSrsru)r&rhrat_rtautor~unreachable_providerrVe refreshed new_sessionrefreshing_providerresponserRrqr5rus r!gated_auth_middlewarers 7;$ou = =(Yw''''''''' w}3U;;(Yw''''''''' ; Dt(Yw'''''''''"7++GB =c ="'**  K <<<< G + ,0.00  H "11r1BB    OM15%]1!'**  (/+3=( "# ?3? P,@PPPQ   %WC@@@  /8 ,K,$/GM !&Yw////////H          M L L L L L  (5)7(;K(H(H&,w//**733      *,#+g&&      O  -+'""    $G4PQQQ LKKKKKHHHHHHh/B/B7/K/KLLLL#GM7## # # # # # ##sC** E4AEEintcddl}tdt|jt|z S)a%Seconds until the access token's ``exp``, floored at 60. Mirrors the auth-route's ``max(60, exp - now)`` so the access-token cookie's Max-Age tracks the token lifetime even on a slightly skewed clock. ``time`` imported locally to keep the module's import surface minimal. rN<)timemaxr expires_at)r~rs r!rrs=KKK r3w)**S-=-== > >>r#c |sdStD]} ||}n#t$r4ttj|jdt|YdSt$r\}t d|j|ttj|jdt|Yd}~dSd}~wwxYw| ||jfcSdS)uNTry to rotate an expired session via the refresh token. Returns ``(new_session, provider_name)`` on success, or ``None`` if there's no RT or every provider's ``refresh_session`` failed with ``RefreshExpiredError`` (dead/revoked/reuse-detected RT → force re-login). A ``ProviderError`` (Portal unreachable) is NOT swallowed into a re-login here — re-raising would 500 the request; instead we log and return None so the caller forces a clean re-login, which is the safer UX than a hard error on a transient network blip during the narrow refresh window. Nrorefresh_expiredrUz:dashboard-auth: provider %r unreachable during refresh: %srn) r refresh_sessionrr r REFRESH_FAILURErZr1r rzr{)r&rprVrrs r!r}r}s9 t*,,.. "222OOKK"    *!(g&&      444    LLL q    *!-g&&      444444   " - - - - # 4s-9C* C3AC  C)rrrr)r&rrr)r&rr2rrr )r&rrrH)r&rrhrirr )rr)r&r))__doc__ __future__rloggingtypingrrfastapirfastapi.responsesrrr hermes_cli.dashboard_authr hermes_cli.dashboard_auth.auditr r hermes_cli.dashboard_auth.baser rr[rrrr&hermes_cli.dashboard_auth.public_pathsr getLogger__name__rzr__annotations__r%r1rGr`rDrrr}r#r!rs #"""""&&&&&&&&FFFFFFFFFF<<<<<<AAAAAAAAMMMMMMMM DCCCCCw"" *    *99993<3<3<3