
    (Gj
                        U d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	m
Z
  ej        e          Z ej                    Zi Zded<   ddZddZddZddZddZddZdS )a	  Module-level registry for DashboardAuthProvider instances.

Plugins call ``register_provider`` via the plugin context hook at startup.
The auth gate middleware iterates ``list_providers()`` and uses
``get_provider`` to dispatch on the session's ``provider`` field.
    )annotationsN)ListOptional)DashboardAuthProviderassert_protocol_compliancez dict[str, DashboardAuthProvider]
_providersproviderr   returnNonec                0   t          t          |                      t          5  | j        t          v rt          d| j                  | t          | j        <   ddd           n# 1 swxY w Y   t                              d| j        | j                   dS )zRegister a provider.

    Raises:
        TypeError: on protocol violation.
        ValueError: if a provider with the same name is already registered.
    z,dashboard-auth provider already registered: Nz+dashboard-auth: registered provider %r (%s))	r   type_locknamer   
ValueError_loginfodisplay_name)r	   s    H/home/rurouni/.hermes/hermes-agent/hermes_cli/dashboard_auth/registry.pyregister_providerr      s     tH~~...	 - -=J&&Px}PP   %-
8=!- - - - - - - - - - - - - - - 	II5x,    s   5A%%A),A)r   strOptional[DashboardAuthProvider]c                x    t           5  t                              |           cddd           S # 1 swxY w Y   dS )z@Return the registered provider for ``name``, or None if unknown.N)r   r   get)r   s    r   get_providerr   +   s{    	 $ $~~d##$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $   /33List[DashboardAuthProvider]c                     t           5  t          t                                                    cddd           S # 1 swxY w Y   dS )z0All registered providers, in registration order.N)r   listr   values     r   list_providersr"   1   s    	 ) )J%%''(() ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )s   &;??c                     t           5  d t                                          D             cddd           S # 1 swxY w Y   dS )u  Registered providers that support non-interactive token auth.

    The subset of ``list_providers()`` whose ``supports_token`` flag is True,
    in registration order. The ``token_auth`` middleware seam consults these
    (and only these) when a token-authable route is hit, so OAuth/password-only
    providers are never asked to ``verify_token``. Returns an empty list when
    no token provider is registered — a token-authable route then fails
    closed (401), never open.
    c                4    g | ]}t          |d d          |S )supports_tokenFgetattr.0ps     r   
<listcomp>z(list_token_providers.<locals>.<listcomp>B   s*    VVVa'!=Mu2U2UVVVVr!   Nr   r   r   r    r!   r   list_token_providersr-   7   s     
 W WVV:,,..VVVW W W W W W W W W W W W W W W W W W   #8<<c                     t           5  d t                                          D             cddd           S # 1 swxY w Y   dS )zRegistered providers with supports_session True (interactive cookie
    sessions). The login page, /auth/login, and the gate's verify/refresh loops
    consult only these. Mirror of list_token_providers.
    c                4    g | ]}t          |d d          |S )supports_sessionTr&   r(   s     r   r+   z*list_session_providers.<locals>.<listcomp>K   s+    WWWa'!=OQU2V2VWWWWr!   Nr,   r    r!   r   list_session_providersr2   E   s    
 
 X XWW:,,..WWWX X X X X X X X X X X X X X X X X Xr.   c                 x    t           5  t                                           ddd           dS # 1 swxY w Y   dS )z"Test-only: drop all registrations.N)r   r   clearr    r!   r   clear_providersr5   N   s~    	                   r   )r	   r   r
   r   )r   r   r
   r   )r
   r   )r
   r   )__doc__
__future__r   logging	threadingtypingr   r   hermes_cli.dashboard_auth.baser   r   	getLogger__name__r   Lockr   r   __annotations__r   r   r"   r-   r2   r5   r    r!   r   <module>r@      s;     # " " " " "      ! ! ! ! ! ! ! !       
 w""	/1
 1 1 1 1   ($ $ $ $) ) ) )W W W WX X X X     r!   