+ WjRt^RIHt^RIt^RIt^RIHtHt^RIH t ^RI H t ^RI H t ^RIHtHtRtRR ltR R ltR R ltRRltRRltRRRRRR/RRlltR#)zERequest-level helpers shared by the auth routes and both middlewares.) annotationsN)CallableOptional)Request JSONResponse)list_session_providers)DashboardAuthProvider ProviderErrorc V^8dQhRRRR/#requestrreturnstr)formats"[C:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\request_utils.py __annotate__rs99w939cVVP'dVPP#R#)a&ASGI peer address for rate limits, native pending caps, and auth audit. Never parse client-supplied ``X-Forwarded-For`` here: direct clients can spoof it. Trusted proxy normalization belongs upstream, where the server may rewrite ``request.client`` only for operator-configured trusted peers. )clienthost)rs&r client_iprs!#*...7>>  8b8rc V^8dQhRRRR/#r r)rs"rrrsGrcVPPRR4PR^4p\V4^8XdBV^,P 4P 4R8XdV^,P 4#R#)zM``Authorization: Bearer `` value (scheme case-insensitive), or ``""``. authorizationr bearer)headersgetsplitlenstriplower)rpartss& rextract_bearerr's_ OO   4 : :3 BE 5zQ58>>+113x?Qx~~ rc V^8dQhRRRR/#)r pathrrboolr)rs"rrr%s<aSPR4'dSPR4'dR#\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'dR#SR8H;'gSPR4'*#)zSame-origin post-login target: rejects non-relative and protocol-relative (``//evil``) values, the auth routes themselves, and every ``/api`` path./z//Fc3`<"TF#pSV8H;'gSPV4xK% R#5iN) startswith).0pr)s& r $is_safe_next_path..*s+ H4Gq419 * ** *4Gs..Tz/apiz/api/)r/any_NEXT_DENY_PREFIXES)r)sfris_safe_next_pathr6%si ??3  4??4#8#8 s H4G Hsss H4G HHH::$//'": ;;rcV^8dQhRR/#)r rintr)rs"rrr/s??S?rc\^<\VP4\\P!44, 4#)zGCookie Max-Age for the access token: seconds to ``exp``, floored at 60.)maxr8 expires_attime)sessions&raccess_token_max_ager>/s* r3w))*S-== >>rc V^8dQhRRRR/#)r provider_namerrrr)rs"rrr4seee erc*\RRV: R2/RR7#)zG503 for a transient IDP/backing-store outage (never a forced re-login).detailzAuth provider z unreachablei) status_coder)r@s&runreachable_responserD4s ^M3DL#QR`c ddrswallow on_swallowon_unreachablec4V^8dQhRRRRRRRRR R R R R R /#)r provider_hintz Optional[str]callz)Callable[[DashboardAuthProvider], object]phaserlogzlogging.LoggerrEztuple[type[BaseException], ...]rFz1Optional[Callable[[DashboardAuthProvider], None]]rGr)rs"rrr9sJ$$ $(Q$]`$ $"A$B$F $rc|a\4pS'dVPV3RlR7RpVFp V!V 4p T fKT u# Ve \V4hR# TdTe T!T 4K?\dEp TPRT PY+4Te T!T 4Tf T PpRp ? KRp ? ii;i)u Run ``call`` across the session providers; first non-``None`` result or ``None``. The hinted provider goes first (stable sort; a stale/unknown hint leaves registration order intact). ``swallow`` exceptions reject that candidate only. A ``ProviderError`` (IDP/JWKS unreachable) must NOT abort the chain — the credential may belong to a different, reachable provider; it is logged under ``phase`` and, if nothing else succeeds, re-raised as ``ProviderError(name)`` so the caller answers 503 instead of forcing a re-login. c"<VPS8g#r.)name)providerrIs&r(scan_session_providers..HsHMM],Jr)keyNz5dashboard-auth: provider %r unreachable during %s: %s)rsortr warningrO) rIrJrKrLrErFrG providers unreachablerPresultes f&$$$$$ rscan_session_providersrZ9s'(IJK!%K (^F  M!"K(( ! %8$   KKO u 1)x("&mm  s#AB;-B;6B;79B66B;)z/loginz/auth/z /api/auth/r)__doc__ __future__rloggingr<typingrrfastapirfastapi.responsesrhermes_cli.dashboard_authrhermes_cli.dashboard_auth.baser r r5rr'r6r>rDrZrrrrcslK" %*<O99<? e $DF$EI$IM $$r