+ Wja0t$Rt^RIHt^RIt^RIt^RIt^RIHtH t H t H t ^t ]P!4t/tR]R&RsR]R&RtRt!R R ]4tR R R R/RRlltRRltRRltRRltRRltRRltR#)uWS-upgrade auth credentials for gated mode. Browsers cannot set ``Authorization`` on a WebSocket upgrade, and gated mode has no token injected into the SPA, so two credential shapes exist: (1) single-use browser tickets (``mint_ticket`` / ``consume_ticket``) fetched via authenticated ``POST /api/auth/ws-ticket`` and passed as ``?ticket=`` on the upgrade — 30 s TTL, a leak is uninteresting; (2) a process-lifetime internal credential (``internal_ws_credential`` / ``consume_internal_credential``) for *server-spawned* WS clients (the embedded-TUI PTY child on ``/api/ws`` + ``/api/pub``), which reuse their attach URL on every reconnect, possibly >30 s after boot — minted once, never expires, multi-use, never injected into any HTML/SPA (leaves the process only via the child's environment, so browser XSS cannot read it; grants no more than a ticket). In-memory; ``time.time`` patchable. ) annotationsN)AnyDictOptionalTuplez%dict[str, tuple[int, dict[str, Any]]]_ticketsz Optional[str]_internal_credentialzserver-internalc]tRt^ tRtRtR#) TicketInvalidz-Ticket missing, expired, or already consumed.N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r XC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\ws_tickets.pyr r s7rr issuerextrac ,V^8dQhRRRRRRRRRR/#)user_idstrproviderrrzOptional[dict[str, Any]]returnr )formats"r __annotate__r$s1  C 3  / ;> rc x\P!^ 4pRVRVR\\P!44/T;'g/CpV'dW%R&\;_uu_4\\P!44\ ,V3\ V&\4RRR4V# +'giT#;i)a=One-shot base64url ticket (32 random bytes) bound to this identity; ``consume_ticket`` hands the ``info`` dict back to the WS handler. ``extra`` rides along for routes that need server-chosen context (the Bot Desktop bridge pins the RFB socket's profile home here so a client can never pick another profile's screen).rr minted_atrN)secrets token_urlsafeinttime_lock TTL_SECONDSr_gc_expired_locked)rrrrticketinfos$$$$ r mint_ticketr*$s  " "2 &F w Hk3tyy{CS eX]XcXcac eD X  ,{:DA  M  Ms !=B(( B9 c V^8dQhRRRR/#)rr(rrdict[str, Any]r )rs"rrr4s  3 > rcJ\\P!44p\;_uu_4\P VR4pVf)V'dVR,R,MRp\ RV 24hVwrEWA8d \ R4hVuuRRR4# +'giR#;i)zYValidate and consume (single-use). Raises :class:`TicketInvalid` on missing/expired/used.N:NNu…zzunknown ticket: expired)r#r$r%rpopr )r(nowentry truncated expires_atr)s& rconsume_ticketr54sy diik C  VT* =06e+II"29+ >? ?    * * s"B6B B" cV^8dQhRR/#rrNoner )rs"rrrCsDrc\\P!44p\P4UUUu.uFwpwr#W 8gKVNK upppFp\P VR4K R#uupppi)z1Drop expired tickets. Caller must hold ``_lock``.N)r#r$ritemsr0)r1texp_s rr'r'CsR diik C#+>>#3 A#3KAxsyaa#3 A QB As A3 A3cV^8dQhRR/#)rrrr )rs"rrrJs$$$rc\;_uu_4\f\P!^ 4s\uuRRR4# +'giR#;i)uProcess-lifetime internal WS credential, minted once. Never injected into the SPA or returned over REST — only passed to a spawned child via its environment.N)r%rr!r"r rrinternal_ws_credentialr@Js/   '#*#8#8#< # s $> A c V^8dQhRRRR/#)rvaluerrr,r )rs"rrrTs H Hs H~ Hrc4\;_uu_4\pRRR4V'dXf \R4h\P!VP 4VP 44'g \R4hR\ R\/# +'giLy;i)zValidate an internal credential (NOT single-use); returns the fixed server-internal ``{user_id, provider}`` info dict, mirroring ``consume_ticket``. Constant-time compare; any value is rejected until a credential has been minted.Nzno internal credentialzinternal credential mismatchrr)r%rr r!compare_digestencodeINTERNAL_USER_IDINTERNAL_PROVIDER)rBexpecteds& rconsume_internal_credentialrITsl '  H$455  ! !%,,.(//2C D D:;; '5F GG s B B cV^8dQhRR/#r7r )rs"rrras$$$$rc\;_uu_4\P4RsRRR4R# +'giR#;i)z8Test-only: drop all tickets and the internal credential.N)r%rclearrr rr_reset_for_testsrMas% # s 0 A )__conditional_annotations__r __future__rr! threadingr$typingrrrrr&Lockr%r__annotations__rrFrG Exceptionr r*r5r'r@rIrM)rNs@rrUs # -- 24 /4&*m*%%8I8 b 26  $ H$r