+ Wj a0t$Rt^RIHt^RIt^RIt^RIt^RIH t ]P!] 4t Rt ]!R4t]!4tR]R&]!4tR]R&RR ltR R ltR R ltRRltRRltRRltRRltRRltR#)aX-Forwarded-Prefix and public-URL resolution for reverse-proxied deploys. Proxies mounting the dashboard at a path inject ``X-Forwarded-Prefix: /hermes`` so the backend can build prefixed URLs (Location headers, OAuth redirect_uri, cookie Path, SPA asset URLs). An operator-declared ``HERMES_DASHBOARD_PUBLIC_URL`` / ``dashboard.public_url`` is used verbatim for the OAuth redirect_uri instead (relief valve for unreliable proxy header chains). Single source of truth so the gate, routes, cookies and SPA mount agree on validation. ) annotationsN)Optionalset_warned_malformed_public_urls_warned_malformed_prefixesc ,V^8dQhRRRRRRRRRR /#) seenrkeytuplecleanedstrmsgreturnNone)formats"TC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\prefix.py __annotate__rs/SuscxV'dW9dR#VPV4\P!V.VO5!R#N)add_logwarning)r r r rargss&&&&*r _warn_oncers( ckHHSMLLtrc$V^8dQhRRRRRR/#)r sourcerrawrrr)rs"rrr&s& K Ks K K Krc V'dVP4MRp\\W3TRYVPR4R,;'gR4R#)zWarn once when a non-empty public-url value was rejected (almost always a missing scheme; silently falling back to header reconstruction can yield the wrong scheme behind a proxy).u%s is set to %r but was ignored because it is not a valid absolute URL — it must include an http:// or https:// scheme (e.g. https://%s). Falling back to reconstructing the OAuth redirect URI from request headers, which may produce the wrong scheme behind a reverse proxy.z://zhermes.example.comN)striprrsplit)rr r s&& r_warn_if_malformedr&&sI!ciikbG%'8' ) u-b1II5IKrc$V^8dQhRRRRRR/#)r r Optional[str]reasonrrrr)rs"rrr4s&bb=b#b$brcbV'dVP4MRp\\W!3VRW!4R#)z@Warn once when a non-empty X-Forwarded-Prefix value is rejected.r"zzX-Forwarded-Prefix header %r was ignored because %s. Dashboard URLs will be generated without a reverse-proxy path prefix.N)r$rr)r r)r s&& r_warn_if_malformed_prefixr+4s- ciikbG"W$5w PQXbrc V^8dQhRRRR/#r r r(rrr)rs"rrr=s  - C rcaV'dVP4MRoS'gR#SPR4'g RS,oSPR4oRS9gPRS9gI\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'd\ VR4R#\ S4\8d\ VR \ R 24R#S#) z``"/hermes"`` form (no trailing slash) or ``""`` when unset/malformed. ``..``, ``//`` and injection characters are rejected so a hostile proxy cannot smuggle HTML or traversal.r"/z//z..c3,<"TF qS9xK R#5irr).0cps& r #normalise_prefix..Fs$C]!V]TFz3it contains a disallowed character or path sequencezit is longer than z characters)r$ startswithrstripany _REJECT_CHARSr+len_MAX_PREFIX_LENGTH)r r3s&@rnormalise_prefixr==s A  <<   !G  A qyDAI$C]$C$C]$C!C!C!#'\] 1v""!#);.Zs6 13h r6TFr/>httphttps) r$r9r:urllibparseurlparse ValueErrorschemenetlocr8)r parsedrHs& @r_normalise_public_urlrSVs#))+"C ##6 6###6 666&&s+}}--V]]] ::c? s/C CCcV^8dQhRR/#)r rdictr)rs"rrres 8 8 8rc,^RIHpT!4p\ T\ 4'dTPR4MRp\ T\ 4'dT#/# \d/u#i;i \d#p\P RT4/uRp?#Rp?ii;i)zX``dashboard`` block of config.yaml as a dict, or ``{}`` when unloadable/absent/non-dict.) load_configzVdashboard-auth.prefix: load_config() raised %s; falling back to env-only configurationN dashboard)hermes_cli.configrW Exceptionrdebug isinstancerUrB)rWcfgexcsections r_load_dashboard_sectionr`es1m '1d&;&;cggk"G $//77R7    <=@ B s.AA& A#"A#& B1BBBcV^8dQhRR/#r?r)rs"rrrus  C rc \PPRR4p\V4pV'dV#\ RV4\ \ 4PRR44p\V4pV'g \ RV4V#)aOperator-declared dashboard public URL, or ``""`` (reconstruct from request). Precedence: ``HERMES_DASHBOARD_PUBLIC_URL`` env (blank counts as unset so a provisioned-but-blank secret cannot shadow config.yaml), then ``dashboard.public_url``; malformed warns and falls through.HERMES_DASHBOARD_PUBLIC_URLr"z#HERMES_DASHBOARD_PUBLIC_URL env var public_urlz#dashboard.public_url in config.yaml)osenvironrBrSr&rr`)env_raw env_cleancfg_raw cfg_cleans rresolve_public_urlrkuspjjnn:B?G%g.I    )__conditional_annotations____doc__ __future__rloggingre urllib.parserLtypingr getLogger__name__rr< frozensetr:rr__annotations__rrr&r+r=rDrSr`rk)rts@rr~s# "EF &)Us*"%%C' Kb $G  8 r