+ Wja0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t Ht^RIHtRt^xtRt^t]P*!4t] !RR 44t] !R R 44t/tR ]R &/tR]R&!RR]4t!RR]4t!RR]4tRRlt RRlt!RRlt"RRlt#RRlt$R R!R"R/R#R$llt%R"R/R%R&llt&R"R/R'R(llt'R"R/R)R*llt(R+R,lt)R#)-aaGateway-brokered RFC 8252 (OAuth 2.0 for Native Apps) authorization store. The desktop cannot be a direct OAuth client of the upstream IDP (the Portal ``client_id`` is per gateway and only accepts the gateway's ``/auth/callback``), so the gateway brokers: authorization server *to the desktop*, OAuth client *to the Portal*. Desktop PKCE pair (cv_d, cc_d) + state -> ``/auth/native/authorize`` stashes a pending entry (:func:`register_pending`) keyed by an opaque ``broker_state`` riding in the gateway's own PKCE cookie -> upstream callback or password login mints a one-time code bound to cc_d (:func:`complete_pending`) -> desktop redeems it with cv_d at ``/auth/native/token`` (:func:`redeem_code`). PKCE binding, single use, short TTLs, 256-bit handles compared in constant time, no secret logging; in-memory, process-local, ``time.time`` patchable in tests. ) annotationsN) dataclass)DictOptional)SessioniXcN]tRt^&t$RtR]R&R]R&R]R&R]R&R]R&R tR #) _Pendingz>In-flight native authorization awaiting the upstream callback.strcode_challenge redirect_uri client_state client_ipint expires_atN__name__ __module__ __qualname____firstlineno____doc____annotations____static_attributes__rYC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\native_flow.pyr r &s!HNOrr c:]tRt^0t$RtR]R&R]R&R]R&RtR #) _IssuedCodez@A minted one-time gateway authorization code bound to a Session.r r rsessionrrrNrrrrrr0sJ Orrzdict[str, _Pending]_pendingzdict[str, _IssuedCode]_issuedc]tRt^F  # #F + 2 24 8 ? ? HHrc V^8dQhRRRR/#)r)nowrr+Noner)r,s"rr-r-NsCDrc\\3FSpVP4UUu.uFwr#VPV8gKVNK uppFpVP VR4K KU R#uuppi)z>Drop expired pending + issued entries. Caller holds ``_lock``.N)rr itemsrpop)r;storekvs& r _gc_lockedrCNsQG$ % D 1C!! DA IIa E%Ds A&A&cV^8dQhRR/#)r)r+boolr)r,s"rr-r-Us99T9rcV\\4\\4,\8#N)lenrr _MAX_ENTRIESrrr_capacity_ok_lockedrJUs MCL (L 88rc V^8dQhRRRR/#)r)r; Optional[int]r+rr)r,s"rr-r-Ys44m44rcJVf\\P!44#T#rG)rtime)r;s&r_nowrOYs"{3tyy{ 33rc$V^8dQhRRRRRR/#)r) broker_stater consumerEr+r r)r,s"rr-r-]s!ctrcV'd\PM\P!VR4pVf \R4hV#)zTLook up (optionally consuming) a pending entry; :class:`PendingNotFound` if unknown.Nz'unknown or expired native authorization)rr?getr%)rQrRentrys&$ r_pop_pending_lockedrV]s3$X\\(,, 6 d KE }GHH Lrrr;c 0V^8dQhRRRRRRRRRRRR/#) r)r r r r rr;rLr+r)r,s"rr-r-es<*-=@MP "%rc a\V4p\P!^ 4p\;_uu_4\ V4\ 4'g \ R4h\V3Rl\P444pS'dV\8d \ R4h\WVSV\,R7\V&RRR4V# +'giT#;i)zStash a pending native authorization; return an opaque ``broker_state``. ``code_challenge`` is the DESKTOP's cc_d. Raises ``NativeFlowError`` (fail closed) at store capacity or when ``client_ip`` holds ``_MAX_PENDING_PER_IP`` entries.z+native-flow authorization store at capacityc3L<"TFqPS8XgK^xK R#5i)N)r).0rBrs& r #register_pending..qsN 11[[I5MQQ 1s$ $z8too many pending native authorizations from this address)r r r rrN) rOsecrets token_urlsafe_lockrCrJr"sumrvalues_MAX_PENDING_PER_IPr _PENDING_TTL_SECONDS)r r r rr;rQper_ips$$$d$ rregister_pendingrges s)C((,L 3"$$!"OP PN 1NN #66!"\] ]!))S_C2F,F"H    s B C C c$V^8dQhRRRRRR/#)r)rQr r;rLr+r r)r,s"rr-r-zs&@@c@=@H@rc\;_uu_4\\V44\VRR7uuRRR4# +'giR#;i)z3Peek (without consuming) the pending authorization.FrRN)rarCrOrV)rQr;s&$r get_pendingrkzs) 49"<? s !; A c(V^8dQhRRRRRRRR/#)r)rQr rrr;rLr+r)r,s"rr-r-s)  3 G - [^ rcX\V4p\;_uu_4\V4\VRR7p\ 4'g \ R4h\ P!^ 4p\VPVV\,R7\V&RRR4V# +'giX#;i)z}Consume a pending authorization (single use) and mint a one-time gateway code bound to the desktop's challenge + ``session``.Trjz"native-flow code store at capacity)r rrN) rOrarCrVrJr"r_r`rr _CODE_TTL_SECONDSr )rQrr;pendinggw_codes&$$ rcomplete_pendingrqs s)C 3%lDA"$$!"FG G''+&"117..0  N  Ns A4B B) c(V^8dQhRRRRRRRR/#)r)coder code_verifierr;rLr+rr)r,s"rr-r-s)   S } PW rc\V4p\;_uu_4\V4\P VR4pRRR4Xf \ R4hVP V8d \ R4h\P!VP\V44'g \ R4hVP# +'giL;i)zVerify PKCE + consume a gateway code; return the bound :class:`Session`. The entry is popped BEFORE the PKCE check so a wrong verifier cannot be retried (no oracle, no replay).Nz*unknown, expired, or already-redeemed codez code expiredzPKCE verification failed) rOrarCr r?r'rhmaccompare_digestr r9r)rsrtr;issueds$$$ r redeem_coderys s)C 3T4( ~FGG 3.))   v44eM6J K K455 >> s "B66 C cV^8dQhRR/#)r)r+r<r)r,s"rr-r-s$rc\;_uu_4\P4\P4RRR4R# +'giR#;i)z+Test-only: drop all pending + issued state.N)rarclearr rrr_reset_for_testsr}s&   s )A A )*__conditional_annotations__r __future__rr5r1rvr_ threadingrN dataclassesrtypingrrhermes_cli.dashboard_auth.baserrernrIrdLockrar rrrr Exceptionr"r%r'r9rCrJrOrVrgrkrqryr})r~s@rrs #   !!2     !# ""$ $RiRHoHV/VI 94SU*@4@ RV  t  r