+ Wj<a0t$Rt^RIHt^RIt^RIt^RIHtHtH t H t ^RI H t ^RI HtHt^RIHt^RIHtHt^RIHtHt^R IHtHtHt]P<!]4t ]!!4t"R ]#R &]PH!4t%R R lt&RRlt'RRlt(RRlt)RRlt*R#)a~Route-agnostic non-interactive (bearer-token) auth seam for the dashboard. Any machine-credential provider plugs in here. A route opts in by registering its exact path via :func:`register_token_route`; only registered paths are token-authable, so the auth surface of existing routes never widens. :func:`token_auth_middleware` runs OUTERMOST (installed last) and owns the decision for a token route: a recognised token attaches ``request.state.token_principal`` + ``token_authenticated`` (the cookie gates honour that flag and never bounce to /login); otherwise 401, or 503 when a provider's backing store was unreachable. Fails closed. ) annotationsN) AwaitableCallableOptionalTuple)Request) JSONResponseResponse)list_token_providers) AuditEvent audit_log) ProviderErrorTokenPrincipal) client_ipextract_bearerunreachable_responsezset[str] _token_routesc V^8dQhRRRR/#)pathstrreturnNone)formats"XC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\token_auth.py __annotate__rs  s t c\;_uu_4\PV4RRR4R# +'giR#;i)zZMark ``path`` (exact match) as token-authable. Idempotent; does NOT make the route public.N)_lockraddrs&rregister_token_router"s! $ s / A c V^8dQhRRRR/#)rrrrboolr)rs"rrr%s%%%%rcn\;_uu_4V\9uuRRR4# +'giR#;i)z@True if ``path`` was registered as token-authable (exact match).N)rrr!s&ris_token_router&%s }$ s # 4 cV^8dQhRR/#)rrrr)rs"rrr+sDrc\;_uu_4\P4RRR4R# +'giR#;i)z,Test-only: drop all registered token routes.N)rrclearrrrclear_token_routesr*+s  s. ? c V^8dQhRRRR/#)rrequestrrz.tuple[Optional[TokenPrincipal], Optional[str]]r)rs"rrr1s,Zrc\V4pV'gR#Rp\4F pVPVR7pTfKTR3u# RV3# \d=p\P RTP T4Tf TP pRp?KjRp?i\d-p\P RTP T4Rp?KRp?ii;i)aTry every token provider against the request's bearer token. Returns ``(principal, None)`` on success; ``(None, None)`` for no token or no recogniser (401); ``(None, name)`` when no provider accepted it AND at least one was unreachable (caller surfaces 503). Never raises.N)tokenz?dashboard-auth: token provider %r unreachable during verify: %sz:dashboard-auth: token provider %r raised during verify: %s)NN)extract_bearer_tokenr verify_tokenr _logwarningname Exception)r,r. unreachableprovider principales& rauthenticate_tokenr91s ! )E !%K(*  --E-:I  d? "+    LLZ! +"&mm   LLU! +  s)A  C1B  CC!CCc$V^8dQhRRRRRR/#)rr,r call_nextz(Callable[[Request], Awaitable[Response]]rr r)rs"rrrKs)aa a!IaNVarc "VPPp\V4'gV!V4GRjxL #\V4wr4Ve2W0PnRVPnV!V4GRjxL #V'd3\\PVRV\V4R7\V4#\\PRV\V4R7\RRR R /R R 7#LLw5i) z}Pass-through for unregistered paths; for a token route, valid token -> attach principal + flag, unreachable -> 503, else 401.NTprovider_unreachable)r6reasonripno_provider_recognises_token)r>rr?errorunauthenticateddetail Unauthorizedi) status_code) urlrr&r9statetoken_principaltoken_authenticatedr r TOKEN_AUTH_FAILURE _client_iprr)r,r;rr7r5s&& rtoken_auth_middlewarerLKs ;;  D $  w'''/8I(1 %,0 )w'''  ) )KH^*W- /$K00 %%.LSW g   "3X~N\_ ``( (s)3C1C-AC17C/8 C1A*C1/C1)+__conditional_annotations____doc__ __future__rlogging threadingtypingrrrrfastapirfastapi.responsesrr hermes_cli.dashboard_authr hermes_cli.dashboard_auth.auditr r hermes_cli.dashboard_auth.baser r'hermes_cli.dashboard_auth.request_utilsrrKrr/r getLogger__name__r1setr__annotations__Lockrr"r&r*r9rL)rMs@rr^s{#774:AH[["% x %  4ar