+ WjvHRt^RIHt^RIHtHt^RIHt^RIH t ]!RR7!RR44t ]!RR7!R R 44t ]!RR7!R R 44t !R R] 4t!RR] 4t!RR] 4t!RR] 4tRRlt!RR]4tRRltR#)zFAbstract base + dataclasses + exceptions for dashboard auth providers.) annotations)ABCabstractmethod) dataclass)OptionalT)frozencz]tRt^ t$RtR]R&R]R&R]R&R]R&R]R&R]R &R]R &R]R &R tR]R &RtR#)SessionzA verified interactive identity (from ``complete_login`` / ``verify_session``). All fields mandatory; providers without orgs set ``org_id=""``. The tokens are opaque to Hermes.struser_idemail display_nameorg_idproviderint expires_at access_token refresh_tokenissuerN)__name__ __module__ __qualname____firstlineno____doc____annotations__r__static_attributes__rRC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\base.pyr r s=] L J KMOFCrr c>]tRt^t$RtR]R&R]R&RtR]R&RtR#) TokenPrincipaluA verified non-interactive (service-to-service) caller — the token analog of :class:`Session`: one bearer token on one request, no login/cookie/refresh. ``principal`` is an opaque stable caller id; ``scopes`` empty means "unscoped" (a route MAY enforce one).r principalrztuple[str, ...]scopesrN)rrrrrrr#rrrrr!r!s`NM FO rr!c0]tRt^"t$RtR]R&R]R&RtR#) LoginStarta First leg of the OAuth round trip: ``redirect_url`` is the IDP's authorize endpoint; ``cookie_payload`` maps cookie name -> serialised PKCE/CSRF state that the auth route sets (HttpOnly, Secure + ``SameSite=None`` over HTTPS, TTL <= 10 min; see ``set_pkce_cookie``).r redirect_urlzdict[str, str]cookie_payloadrN)rrrrrrrrrrr%r%"sb""rr%c]tRt^+tRtRtR#) ProviderErrorz HTTP 503.rNrrrrrrrrrr)r)+sFrr)c]tRt^/tRtRtR#)InvalidCodeErrorzLOAuth callback ``code``/``state`` failed validation. Middleware -> HTTP 400.rNr*rrrr,r,/sVrr,c]tRt^3tRtRtR#)InvalidCredentialsErrorzQUsername/password rejected. The route answers a generic 401 (no username oracle).rNr*rrrr.r.3s[rr.c]tRt^7tRtRtR#)RefreshExpiredErrorzThis provider rejects the refresh token. Not proof of ownership in a multi-provider deployment: middleware tries the rest and forces re-login only after every reachable one rejects it.rNr*rrrr0r07srr0c V^8dQhRRRR/#)exc BaseExceptionreturn Exceptionr)formats"r __annotate__r8=s99M9i9rc^RIp\YP4'd\RT 24#\YP TP 34'd\RT 24#\YP4'd\RT 24#\YP4'd\RT 24#\RT: 24# \d\RT: 24u#i;i)uMap a ``PyJWKClient.get_signing_key_from_jwt`` failure to the protocol. Only a genuine transport failure (``PyJWKClientConnectionError``, or an unexpected JWKS shape) is a :class:`ProviderError` (503, never forces logout). A non-JWT bearer (``DecodeError``), a JWKS with no key for this ``kid`` (``PyJWKSetError``) or any other invalid token is simply not verifiable by this provider -> :class:`InvalidCodeError` (``verify_session`` returns ``None``). Folding "cannot parse" into "cannot reach" once made every opaque bearer a fast 503. * ``jwt.DecodeError`` — the bearer is not a JWT at all (an opaque peer key, a legacy session token, garbage). #94558: hosted agents answered every non-JWT bearer with a fast 503 ``Auth provider 'nous' unreachable`` even though Portal was healthy, because "cannot parse" and "cannot reach" were folded into one branch. * ``jwt.PyJWKSetError`` — the JWKS was fetched fine but holds no key for this token's ``kid`` (rotated/foreign key). NzJWKS lookup failed: z'token not verifiable by this provider: ) jwtr6r) isinstancePyJWKClientConnectionError DecodeError PyJWKSetErrorr,PyJWKClientErrorInvalidTokenError)r3r:s& rclassify_jwks_lookup_errorrA=s= #55663C59::#):):;<<"I# OPP#++,,3C59::#,,--"I# OPP /w7 88 =3C7;<<=sCC"!C"c]tRt^\t$RtRtR]R&RtR]R&RtR]R&Rt R]R &R t R]R &] R R l4t ] RRl4t ] RRl4t] RRl4t] RRl4tRRltRRltRtR#)DashboardAuthProvideraProtocol every dashboard-auth provider plugin implements. Lifecycle: ``start_login`` (redirect URL + PKCE state) -> IDP -> ``complete_login`` (code + verifier -> Session) -> ``verify_session`` per request -> ``refresh_session`` near expiry -> ``revoke_session`` on logout (best-effort, must not raise). Failure semantics: ``start_login`` / ``complete_login`` raise ``ProviderError`` when the IDP is unreachable, ``complete_login`` ``InvalidCodeError`` on a bad code/state; ``verify_session`` returns ``None`` for expired/unknown tokens (middleware refreshes) and raises ``ProviderError`` when unreachable (503); ``refresh_session`` raises ``RefreshExpiredError`` when the token is invalid for that provider (a foreign opaque token looks expired, so middleware tries the rest) and ``ProviderError`` on network failure (503, cookies kept). Subclasses MUST set ``name`` (stable lowercase id) and ``display_name``. Capability flags: ``supports_password`` (credential form + ``complete_password_login``; OAuth methods may be ``NotImplementedError`` stubs), ``supports_token`` (``verify_token`` for the token-auth seam), ``supports_session`` (False for token-only credentials such as drain, never offered a login). rr namer Fboolsupports_passwordsupports_tokenTsupports_sessionc V^8dQhRRRR/#)r2 redirect_urir r5r%r)r7s"rr8"DashboardAuthProvider.__annotate__usBB3B:Brc R#Nr)selfrJs&$r start_login!DashboardAuthProvider.start_logints?Brc ,V^8dQhRRRRRRRRRR/#)r2coder state code_verifierrJr5r r)r7s"rr8rKxs;___#&_7:_JM_RY_rc R#rMr)rNrRrSrTrJs&$$$$rcomplete_login$DashboardAuthProvider.complete_loginws[^rc V^8dQhRRRR/#)r2rr r5zOptional[Session]r)r7s"rr8rK|sLLcL6GLrc R#rMr)rNrs&$rverify_session$DashboardAuthProvider.verify_session{sILrc V^8dQhRRRR/#)r2rr r5r r)r7s"rr8rKsDDDDrc R#rMrrNrs&$rrefresh_session%DashboardAuthProvider.refresh_session~sADrc V^8dQhRRRR/#)r2rr r5Noner)r7s"rr8rKs@@s@t@rc R#rMrr^s&$rrevoke_session$DashboardAuthProvider.revoke_sessions=@rc$V^8dQhRRRRRR/#)r2usernamer passwordr5r r)r7s"rr8rKs&SS3S#S'Src D\\V4P R24h)uEVerify a username/password pair and mint a :class:`Session` (only called when ``supports_password``). Raise ``InvalidCredentialsError`` on rejection (SHOULD be constant time for unknown users — no timing oracle) and ``ProviderError`` when the store is unreachable. The default raises so a mis-flagged provider fails loudly.zd does not support password login (set supports_password = True and override complete_password_login)NotImplementedErrortyper)rNrgrhs&$$rcomplete_password_login-DashboardAuthProvider.complete_password_logins/ "Dz""#$R RS Src V^8dQhRRRR/#)r2tokenr r5zOptional[TokenPrincipal]r)r7s"rr8rKsEESE-EErc D\\V4P R24h)aeVerify a non-interactive bearer token; return its principal. Mirrors ``verify_session``: return ``None`` (never raise) for an unrecognised token so the seam falls through; raise ``ProviderError`` ONLY for a genuine backing-store outage. Shared secrets MUST be compared with ``hmac.compare_digest``. The default raises so a mis-flagged provider fails loudly.zR does not support token auth (set supports_token = True and override verify_token)rj)rNrps&$r verify_token"DashboardAuthProvider.verify_tokens/ "Dz""#$D DE ErrN)rrrrrrDrr rFrGrHrrOrVrZr_rdrmrrrrrrrCrC\s"D#NL##t# ND !d!BB__LLDD@@SEErrCc V^8dQhRRRR/#)r2clsrlr5rbr)r7s"rr8r8s e eD eT ercnRF0p\WR4'dK\VP RV: 24h RF8p\\WR44'dK \VP RV 24h \VRR4'd.\VP R\ VP 4 24hR#) zvRaise ``TypeError`` if ``cls`` doesn't fully implement the protocol (call it from every provider plugin's unit tests).rz missing or empty attribute: Nz missing method: __abstractmethods__z% has unimplemented abstract methods: )rDr )rOrVrZr_rd)getattr TypeErrorrcallablesortedrw)ruattrmethods& rassert_protocol_compliancer~s)s"%%s||n,I$RS S)%T233s||n,=fXFG G%s)400||nA&I`I`BaAb ce e1rN)r __future__rabcrr dataclassesrtypingrr r!r%r6r)r,r.r0rArCr~rrrrsL"#! $    $!!! $###GIGWyW\i\) 9>8EC8Ev er