+ Wj@+Rt^RIHt^RIt^RIt^RIt^RIt^RIHtH t H t ^RI H t ^RI Ht^RIHtRtRtR tR tR tR;tRu$Cookie helpers for dashboard auth. All HttpOnly, ``SameSite=Lax`` unless noted, Path = proxy prefix or /: ``hermes_session_at`` (access token; Max-Age = token TTL), ``hermes_session_rt`` (rotating refresh token; written only when the provider returned one, always cleared on logout/expiry), ``hermes_session_provider`` (non-secret routing hint so an RT is not handed to the wrong provider), ``hermes_session_pkce`` (PKCE state + CSRF nonce + provider hint, 10 min; ``SameSite=None; Secure`` over HTTPS because it is set on the /auth/login 302 and must survive the cross-site redirect chain — Chromium drops Lax cookies set on such a 302, crbug 40508226), ``hermes_sso_attempt`` (auto-SSO loop guard, 60 s). ``Secure`` only when ``request.url.scheme`` is https. Cookie-prefix hardening per draft-west-cookie-prefixes: bare name over HTTP; ``__Host-`` on gated HTTPS with Path=/; ``__Secure-`` behind a proxy prefix (``__Host-`` forbids Path != /). Setters and readers BOTH resolve the name via :func:`_resolved_name` — a mismatch silently breaks sessions. ) annotationsN)LiteralOptionalTuple)unquote)Request)Responsehermes_session_athermes_session_rthermes_session_providerhermes_session_pkcehermes_sso_attemptz^[A-Za-z0-9_-]+={0,2}$c(V^8dQhRRRRRRRR/#)barestr use_httpsboolprefixreturn)formats"UC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\cookies.py __annotate__r/s(>>>D>#>#>c:V'gV#V'dRV 2#RV 2#)zCCookie-prefix variant for the request shape (see module docstring). __Secure-__Host-r)rrrs&$$r_resolved_namer/s%  !'Ytf =wtf-==rc V^8dQhRRRR/#)rrrrr)rs"rrr6s%%%%rcV'dV#R#)zL``Path=/hermes`` under a proxy prefix (no leak to sibling apps), else ``/``./r)rs&r _cookie_pathr#6s6$$rc$V^8dQhRRRRRR/#rrrrrrdictr)rs"rrr;s!cdrcBRRRRR\V4/pV'dRVR&V#)httponlyTsamesitelaxpathsecure)r#rrattrss$$ r _common_attrsr/;s*tZ V@TUEh Lrc$V^8dQhRRRRRR/#r%r)rs"rrrBs!dCDrc8\WR7pV'dRVR&V#)zwAttributes shared by the PKCE set AND clear paths (a shape mismatch means the browser silently keeps the stale cookie).rrnoner))r/r-s$$ r _pkce_attrsr4Bs  I =E"j Lrr.c8V^8dQhRRRRRRRRRR R RR R R R/#)rresponserrrvaluemax_ageintrrrr.z dict | NonerNoner)rs"rrrKsR__8_3_s___"%_.9_EI_rc hVP!\WVR7V3RV/VeTM \WER7BR#)r2r8N) set_cookierr/)r6rr7r8rrr.s&&&$$$$r_setr=Ks; t@%_QX_%5=9+\_rrc ,V^8dQhRRRRRRRRRR /#) rr6rproviderrrrrrr:r)rs"rrrRs4111%(1591CF1PT1rc JV'd\V\V\W#R7R#R#)z?Persist the non-secret provider routing hint for token refresh.r8rrN)r=SESSION_PROVIDER_COOKIE _RT_MAX_AGE)r6r?rrs&$$$rset_session_provider_cookierDRs  X.+  1rr?c8V^8dQhRRRRRRRRRR R RR RR R /#)rr6r access_tokenr refresh_tokenaccess_token_expires_inr9rrrr?rr:r)rs"rrrZsVaaa),a=@a[^aa a14a>Barc \V\WWER7V'd\V\V\WER7\ WWER7R#)u``access_token_expires_in`` is seconds (the provider's reported TTL). An empty ``refresh_token`` means "don't persist the RT cookie" — a literal empty cookie would be dead state at best, attack surface at worst. Nous Portal issues a 24h rotating refresh token (hermes #37247); a provider that omits it returns ``Session.refresh_token == ""`` and we simply don't persist the RT cookie — the session then behaves as access-token-only until the AT expires. No other branch changes between the two cases. rA)r?rrN)r=SESSION_AT_COOKIESESSION_RT_COOKIErCrD)r6rFrGrHrrr?s&$$$$$$rset_session_cookiesrLZs7 $l- X(-  1y`rc 0V^8dQhRRRRRRRRRR R R /#) rr6r bare_namerrhttps_samesitez Literal['lax', 'strict', 'none'] bare_attrsr&rr:r)rs"rrrmsD @ @ @#& @36 @4 @BF @KO @rc RR\V433F!wrVVPV V 2R^VRVRR7K# VP!VR3R^/VBR#)a[Emit Max-Age=0 deletions for every plausible name variant (the setting request's shape is unknown). Prefixed names are rejected by the browser unless they carry ``Secure`` (``__Host-`` additionally ``Path=/``), so those deletions always do; the bare deletion mirrors the setter's shape (``bare_attrs``), which works on both HTTP and HTTPS origins.rrT)r8r+r(r)r,r8N)rr")r#r<)r6rNrrOrPvariantr+s&&$$$ r_clear_cookie_variantsrSmsh+[,v:N,OP i { #R#D  2Q  2?q?J?rc$V^8dQhRRRRRR/#rr6rrrrr:r)rs"rrr{s&XXHXXdXrc n\RVR7p\\\3Fp\ WVRVR7K R#)zIDelete the AT, RT and provider cookies (every name variant, active path).Fr2r*rrOrPN)r/rJrKrBrS)r6rrPnames&$ rclear_session_cookiesrY{s4v>J"$57NO 6%J XPrc V^8dQhRRRR/#)rpartsdict[str, str]rrr)rs"rrrsUU~U#Urc\P!VRRR7p\P!VP R44P R4P R4#)a2Wire value ``base64url(JSON)``, no padding. The urlsafe alphabet is a strict subset of RFC 6265 cookie-octets, so http.cookies never quotes it (strict proxies such as Go net/http reject the quoted form) and no value can collide with a delimiter; padding ``=`` would trigger quoting, the parser restores it.T) separators sort_keyszutf-8ascii=),:)jsondumpsbase64urlsafe_b64encodeencodedecoderstrip)r[raws& rencode_pkce_payloadrlsG **UzT BC  # #CJJw$7 8 ? ? H O OPS TTrc ,V^8dQhRRRRRRRRR R /#) rr6rpayloadr\rrrrrr:r)rs"rrrs;ddd$2d?CdMPdZ^drc ^\V\\V4\W#\ W#R7R7R#)zV``payload`` is the segment dict; see module docstring for the SameSite=None rationale.r2)r8rrr.N)r= PKCE_COOKIErl _PKCE_MAX_AGEr4)r6rnrrs&$$$rset_pkce_cookierrs% ; 3G &_read_with_fallback..s#\q\s c3b<"TF$pSPPV S 24xK& R#5ir})cookiesget)r~prNrys& rrrs,\^W__00A3yk1BCC^s,/N)next_NAME_VARIANTS)ryrNsffr_read_with_fallbackrs% #\^\#$( **rc V^8dQhRRRR/#)rryrrz#tuple[Optional[str], Optional[str]]r)rs"rrrs99'9.Q9rcB\V\4\V\43#)z:Returns (access_token, refresh_token), either may be None.)rrJrKrys&rread_session_cookiesrs$ G%67G%67 99rc V^8dQhRRRR/#rryrrrzr)rs"rrrsAA7A}Arc"\V\4#)zEReturn the provider routing hint associated with the session cookies.)rrBrs&rread_session_providerrs w(? @@rc V^8dQhRRRR/#rr)rs"rrrs55g5-5rc"\V\4#r})rrprs&rread_pkce_cookiers w 44rc V^8dQhRRRR/#)rrkrrr\r)rs"rrrsLLCLNLrcN\PV4'dVR\V4)^,,,p\P!\ P !VPR444p\V\4'd8VP4UUu/uFwr4\V4\V4bK upp#RV9dTM \!V4p\RVP#R444# \P\\3dRpLi;iuuppi)uInverse of :func:`encode_pkce_payload`. EVERY reader must go through this — reading the raw wire value parses zero segments and silently disables the check it feeds (provider dispatch, CSRF state, broker binding). Compatibility ladder for cookies minted by an older server mid-upgrade: 1. base64url(JSON); 2. flat form with raw ``;`` delimiters, split WITHOUT unquoting (the ``next`` segment carries its own URL-encoding); 3. URL-encoded flat form, unquote once then split. A NEW cookie hitting an OLD server fails the state check. 1. **base64url(JSON)** (current): the wire value is pure urlsafe base64 that decodes to a JSON object. Legacy forms can never match — they always contain ``%`` (URL-encoded, #99176) or a raw ``;`` (oldest flat form), both outside the base64url alphabet. Split as-is WITHOUT unquoting the payload — the ``next`` segment carries its own single URL-encoding, and unquoting here would turn a ``%3B`` inside it into a bogus delimiter and truncate the post-login target. Neither newer format can contain a raw ``;``. rar`N;c3X"TF pRV9gK VPR^4xK" R#5i)raN)split)r~segs& rr%parse_pkce_payload..s'K_cs ! #q!!_s **) _B64URL_REmatchlenrdloadsrfurlsafe_b64decoderhbinasciiError ValueErrorUnicodeDecodeError isinstancer&itemsrrr)rkpaddeddecodedkrflats& rparse_pkce_payloadrs 33s8)a-00Fjj!9!9&--:P!QRG gt $ $/6}}?tqCFCFN? ?*3'#,D KTZZ_K KK  ,>? G @sAC9 D!9"DDc(V^8dQhRRRRRRRR/#rtr)rs"rrrs)--X-T-3-X\-rc 6\V\R\WR7R#)z>Set the auto-SSO loop-guard marker; only its presence matters.1rAN)r=SSO_ATTEMPT_COOKIE_SSO_ATTEMPT_MAX_AGErvs&$$rset_sso_attempt_cookiers%s4H-rc V^8dQhRRRR/#rr)rs"rrrs<rs0 #  ++ &''3# ).   ZZ1 2 >% _<@_1IK1a#%a79a& @XrXUdSUdDBD* 9A 5L4-QS- < B"B)r