)jq&UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z mZmZddlZddlmZmZmZmZmZmZejeZdZdZdZdZd Zd Z d a!d e"d <d!dZ#d"dZ$GddeZ%d#dZ&d$dZ'd%dZ(d&d Z)dS)'u SelfHostedOIDCProvider — generic self-hosted OpenID Connect dashboard auth. A standards-compliant OpenID Connect Relying Party for the ``hermes dashboard`` OAuth gate. Unlike the bundled ``nous`` provider (which encodes Nous Portal's bespoke contract — ``agent:{instance_id}`` client ids, a custom access-token JWT, the ``x-nous-refresh-token`` header, an ``oauth_contract_version`` claim), this provider speaks **plain OIDC** so it works against any conformant self-hosted identity provider: Authentik · Keycloak · Zitadel · Authelia · Auth0 · Okta · Google · … It is a pure drop-in plugin: it implements the five :class:`~hermes_cli.dashboard_auth.DashboardAuthProvider` methods and touches nothing in core auth/runtime/login. The HTTP round trip, cookies, CSRF ``state`` check and ``redirect_uri`` reconstruction are all owned by ``hermes_cli/dashboard_auth/routes.py``; this provider only: 1. discovers the IDP's endpoints from ``{issuer}/.well-known/openid-configuration``, 2. builds the ``/authorize`` URL with PKCE (S256), 3. exchanges the authorization code for tokens at the discovered ``token_endpoint``, 4. verifies the **ID token** (RS256/ES256) against the discovered ``jwks_uri`` with ``iss`` / ``aud`` pinned to the configured issuer / client id, and maps standard OIDC claims (``sub``, ``email``, ``name``) onto a :class:`~hermes_cli.dashboard_auth.Session`. Why the ID token (not the access token)? OIDC guarantees the ID token is a signed JWT carrying identity claims — that is its entire purpose. The access token's format is opaque to the client per the spec; many IDPs issue random opaque strings the client cannot verify locally. Verifying the ID token is the only choice that is universally correct across self-hosted IDPs. (The ``nous`` provider verifies its *access* token because Nous Portal mints a custom JWT access token with the dashboard claims baked in — a non-OIDC shortcut.) Public PKCE clients only. Confidential clients (with a ``client_secret``) are not yet supported — see the ``# TODO(confidential-client)`` seam in ``complete_login`` / ``refresh_session``. Self-hosters configuring a CLI/SPA client almost always register a public + PKCE client, which is the smaller, simpler surface. Configuration surfaces (env wins over config.yaml when set non-empty, so a provisioned-but-not-populated secret can't shadow a valid config.yaml entry — same precedence convention as the ``nous`` plugin):: # config.yaml — canonical surface dashboard: oauth: provider: self-hosted self_hosted: issuer: https://auth.example.com/application/o/hermes/ # required client_id: hermes-dashboard # required scopes: "openid profile email" # optional # Environment overrides (Docker/Fly secret injection) HERMES_DASHBOARD_OIDC_ISSUER HERMES_DASHBOARD_OIDC_CLIENT_ID HERMES_DASHBOARD_OIDC_SCOPES # optional; defaults to "openid profile email" Skip reasons: when the plugin loads but can't register (missing issuer / client_id), it writes a human-readable reason to the module-level :data:`LAST_SKIP_REASON` so the gate's fail-closed branch can surface a useful operator error instead of the bare "no providers registered". ) annotationsN)AnyDictOptional)DashboardAuthProviderInvalidCodeError LoginStart ProviderErrorRefreshExpiredErrorSessionzopenid profile email)RS256ES256RS384RS512ES384ES512g$@ii,strLAST_SKIP_REASONrawbytesreturncttj|dS)u6Base64url-encode without ``=`` padding (RFC 7636 §4).=)base64urlsafe_b64encoderstripdecode)rs R/home/wildlama/.hermes/hermes-agent/plugins/dashboard_auth/self_hosted/__init__.py_b64url_no_padr s-  #C ( ( / / 5 5 < < > >>urlfieldctj|}|jdkr|S|jdkr |jpddvr|St d|d|)a{Reject an endpoint URL that isn't HTTPS (loopback http is allowed). OAuth credentials (codes, tokens) flow over these URLs. We require HTTPS for everything except an explicit loopback host so a misconfigured issuer can't ship the authorization code / refresh token in cleartext. Returns the URL unchanged on success; raises :class:`ProviderError` otherwise. httpshttpr) localhost 127.0.0.1z::1zOIDC z. must be https:// (or http on localhost), got )urllibparseurlparseschemehostnamer )r"r#parseds r_require_https_or_loopbackr/s|\ " "3 ' 'F }  }FO$9r?$$  LLLSLL  r!ceZdZdZdZdZedd2d Zd3dZd4dZ d5dZ d6dZ d7dZ ddd8d"Z d9d$Zd:d%Zd9d&Zd;d(Zdd-Zd?d0Zd1S)@SelfHostedOIDCProviderzHGeneric self-hosted OpenID Connect provider (authorization-code + PKCE).z self-hostedzSelf-Hosted OIDC)scopesissuerr client_idr2rNonecR|std|std|d|_t|jd||_|pt |_d|_d|_ tj |_ d|_ dS)Nzissuer is requiredzclient_id is required/r3r#g) ValueErrorr_issuerr/ _client_idstrip_DEFAULT_SCOPES_scopes _discovery_discovery_fetched_at threadingLock_discovery_lock _jwks_client)selfr3r4r2s r__init__zSelfHostedOIDCProvider.__init__s 3122 2 6455 5 }}S)) "4r)r* urlencoder ) rErGdisco code_verifierrQrPparamsrVrWs r start_loginz"SelfHostedOIDCProvider.start_logins ##L111##%%&w':2'>'>?? ' N=//88 9 9 @ @ B B  w226677$(\,%+  -. Q Q1G1G1O1O Q Q  "#LE#L#L]#L#L |NSSSSr!rLrPrbr c|}|}d|||j|d}||d|tS)Nauthorization_code) grant_typerLrGr4rbtoken_endpoint)bad_request_exc)rYr; _exchanger)rErLrPrbrG_radatas rcomplete_loginz%SelfHostedOIDCProvider.complete_loginsd ##%%/(*   ~~ " #T;K   r! refresh_tokenc|std|}d|j||jd}||d|t|S)Nz#no refresh token present in sessionrn)rgr4rnrOrh)riprevious_refresh_token)r rYr;r>rj)rErnrarls rrefresh_sessionz&SelfHostedOIDCProvider.refresh_sessionsz M%&KLL L##%%**\   ~~ " # /#0    r! access_tokenOptional[Session]c ||}n#t$rYdSt$rwxYw||d|S)Nrid_tokenrnclaims)_verify_id_tokenrr _session_from_tokens)rErrrws rverify_sessionz%SelfHostedOIDCProvider.verify_sessionsy  **<88FF   44     ((!F)   s  0 0c|sdS |}n#t$rYdSwxYwt|dpd}|sdS t j||d|jddditn2#t$r%}t d|Yd}~nd}~wwxYwdS) Nrevocation_endpointrrn)tokentoken_type_hintr4Acceptapplication/jsonrlheaderstimeoutz-self-hosted OIDC: revoke failed (ignored): %s) rYr rgetr<httpxpostr;_TOKEN_ENDPOINT_TIMEOUT_SEC Exceptionloggerdebug)rErnraendpointexcs rrevoke_sessionz%SelfHostedOIDCProvider.revoke_session's 4 ''))EE   44 uyy!677=2>>DDFF 4 O J*'6!% "#563      O O O LLH# N N N N N N N N Ots$ ))'(B B?B::B?r)rprhrlDict[str, str]ritype[Exception]rpc| tj||ddit}n*#tj$r}t d||d}~wwxYw|jdkr9||}|dd}|d ||jd kr't d |jd |jdd ||} | d } | rt| tst dt| dd } | r| dkrt d| | | } | d} t| tr| s|pd} | | | | S)uwPOST the token endpoint and turn the response into a Session. Shared by ``complete_login`` (auth-code grant) and ``refresh_session`` (refresh grant). ``bad_request_exc`` is raised on a 400 — ``InvalidCodeError`` for the auth-code path, ``RefreshExpiredError`` for the refresh path — preserving the middleware's distinct handling. rrrz!OIDC token endpoint unreachable: Nierrorinvalid_requestzIDP rejected token request: zOIDC token endpoint returned z: rvuOIDC token response missing id_token — ensure the 'openid' scope is configured and the client is allowed to receive an ID token. token_typerbearerzunexpected token_type=rnru)rrr RequestErrorr status_code_parse_json_bodyrtext isinstancerlowerrxry)rErhrlrirpresponserbody error_codepayloadrvrrwrns rrjz SelfHostedOIDCProvider._exchangeDs/ z!#563 HH !   9C99    3 & &((22D'+<==J!/;z;;   3 & &+0D++=#&++  ''11;;z** z(C88   \26677==??  I*00 G G GHH H&&x00  O44 --- 9] 928bM((]6)   s"A AA Dict[str, Any]ctj}|j||jz tkr|jS|j5tj}|j&||jz tkr|jcdddS|}||_||_d|_|cdddS#1swxYwYdS)z=Return the cached OIDC discovery document, fetching if stale.N)timer?r@_DISCOVERY_CACHE_TTL_SECrC_fetch_discoveryrD)rEnowras rrYz%SelfHostedOIDCProvider._get_discoverys!ikk O 't115MMM? "  !  )++C+4559QQQ        ))++E#DO),D &!%D                   s4B4=*B44B8;B8c|jdS)Nz!/.well-known/openid-configuration)r:)rEs r_discovery_urlz%SelfHostedOIDCProvider._discovery_urls,AAAAr!c|} tj|ddit}n*#tj$r}t d||d}~wwxYw|jdkrt d|jd|||}|st dt|d d pd  }t|d d pd  }t|d d pd  }|r|r|st d t|dd pd  }|r8| d|j krt d|d|j t|d t|d t|d t|dd pd  } |p|j |||| dS)Nrr)rrzOIDC discovery unreachable: rzOIDC discovery returned z for z'OIDC discovery returned a non-JSON bodyrSrrhjwks_urizPOIDC discovery missing one of authorization_endpoint / token_endpoint / jwks_urir3r7z4OIDC discovery issuer mismatch: document advertises z but configured issuer is r8r|)r3rSrhrr|) rrr_DISCOVERY_TIMEOUT_SECrr rrrr<rr:r/) rEr"rrrrSrhradvertised_issuerr|s rrz'SelfHostedOIDCProvider._fetch_discoverys!!## Oy!#56.HH ! O O O Ds D DEE3 N O  3 & &M8+?MMcMM ''11 K IJJ J!$ KK0" 5 5 ;" " %'' W[[)92>>D"EEKKMMw{{:r228b99??AA% ^ 8 ,   Hb 9 9 ?R@@FFHH  !2!9!9#!>!>$,!N!N$$$$<$$  # "*B     #>9IJJJJ"8:>>>>! KK-r 2 2 8b  %''  (74<&<, #6    s5AAArc|j8ddlm}|}||ddt|_|jS)Nr) PyJWKClientrT) cache_keyslifespan)rDjwtrrY_JWKS_CACHE_SECONDS)rErras r_get_jwks_clientz'SelfHostedOIDCProvider._get_jwks_clients`   $ ' ' ' ' ' '''))E + j!,!!!D    r!rvc ddl}|} ||}nE#|j$r}t d||d}~wt $r}t d||d}~wwxYw |||jtt|j |ddgdi}n#|j $r}td||d}~w|j$r}d} ||d d d  }d |d d|dd|dd|j d }n#t $rYnwxYwt d|||d}~wwxYw|S)NrzJWKS lookup failed: r3require)expiataudisssub) algorithmsaudiencer3optionszID token expired: rF)verify_signature verify_exp)rz [token iss=rz aud=rz; expected iss=]zID token verification failed: )rrYrget_signing_key_from_jwtPyJWKClientErrorr rrkeylist_ALLOWED_ID_TOKEN_ALGSr;ExpiredSignatureErrorrInvalidTokenErrorr) rErvrra signing_keyrrwdetails unverifieds rrxz'SelfHostedOIDCProvider._verify_id_tokensF ##%% I//11JJKK# G G G s > >??S H I! ZZ 677X"$G$G$GH  FF( H H H"#=#=#=>>C G$    G  ZZ16eLL( 0:>>%#8#800%>>%0000$)(O00 ?000     ??g?? ' . sm'A B A B,A??BAC E<C'' E<4E77AEE7 EE7EE77E<rwc t|dd}|stdt|ddpd}t|dp-|dp|dp|pd}|dp|d pd}|sK|d }t|tr!|rd d |D}t|pd}t |||||jt|d ||S)u\Map verified OIDC claims onto a Session. The verified ID token is stored in ``Session.access_token`` so the per-request ``verify_session`` re-verifies a real JWT. The opaque OAuth access token is intentionally NOT stored — Hermes does not call any resource API with it; the dashboard only needs identity. rrz&ID token missing 'sub' (user_id) claimemailnamepreferred_usernamenicknameorg_id organizationgroups,c34K|]}t|VdS)N)r).0gs r z>SelfHostedOIDCProvider._session_from_tokens..Cs(!9!9Q#a&&!9!9!9!9!9!9r!r)user_idr display_namerprovider expires_atrrrn) rrr rrjoinr rint) rErvrnrwrrrrrs rryz+SelfHostedOIDCProvider._session_from_tokens!s{fjj++,, J HII IFJJw++1r22 JJv   zz.// zz*%%     H%%IN)C)CIr :ZZ))F&$'' :F :!9!9&!9!9!999V\r""%Y6%=))!'    r!c,tj|}|jdvrt d||jdkr|jdvrt d||jr|jdst d|dS) zFast-fail obviously-broken redirect_uris before bouncing to the IDP. The IDP's own allowlist is authoritative; this just catches the common operator-error case with a clear message. Mirrors the nous provider. )r%r&z"redirect_uri must be http(s), got r&)r'r(z?redirect_uri may only use http:// for localhost/127.0.0.1, got z/auth/callbackz6redirect_uri path must end with '/auth/callback', got N)r)r*r+r,r r-pathendswith)rErGr.s rrXz-SelfHostedOIDCProvider._validate_redirect_uriQs &&|44 = 1 1 1E\EE  =F " "v? ( (  (#(( { &+"6"67G"H"H (#((   r!rhttpx.Responsec|jdd}|dsiS |}n#t$ricYSwxYwt |t r|niS)Nz content-typerr)rr startswithjsonr9rdict)rErctypers rrz'SelfHostedOIDCProvider._parse_json_bodyjs $$^R88 233 I ==??DD   III !$--5tt25sA AAN)r3rr4rr2rrr5)rGrrr ) rLrrPrrbrrGrrr )rnrrr )rrrrrs)rnrrr5) rhrrlrrirrprrr )rr)rr)rr)rvrrr)rvrrnrrwrrr )rGrrr5)rrrr)__name__ __module__ __qualname____doc__rrr=rFrdrmrqrzrrjrYrrrrxryrXrr!rr1r1sRR D%L& &&&&&&>TTTT:    4    *    &F') @ @ @ @ @ @ H.BBBB9 9 9 9 z ! ! ! !1111j. . . . `2666666r!r1rc ddlm}m}|}n4#t$r'}td|icYd}~Sd}~wwxYw||ddd}t |tr|niS)uReturn the ``dashboard.oauth`` block from config.yaml, or ``{}``. Robust to load_config() raising, the ``dashboard`` key being absent or non-dict, and ``oauth`` being present but not a dict — each falls through to ``{}`` so callers can rely on ``.get(...)``. r)cfg_get load_configz[dashboard-auth-self-hosted: load_config() raised %s; falling back to env-only configurationN dashboardoauth)default)hermes_cli.configrrrrrrr)rrcfgrsections r_load_config_oauth_sectionrzs ::::::::kmm   5     gc;>>>G $// 777R7s AAAA oauth_sectionc^|d}t|tr|niS)z@Return the ``dashboard.oauth.self_hosted`` sub-block, or ``{}``. self_hosted)rrr)rrs r_oidc_subsectionrs.   M * *CS$'' /33R/r!env_var cfg_valuerctj|d}|r|St |pdS)zenv-wins-config with empty-is-unset precedence. 1. ``env_var`` when non-empty after strip (an empty provisioned secret must not shadow a valid config.yaml entry). 2. ``cfg_value`` from config.yaml. 3. Empty string. r)osenvironrr<r)rrenvs r_resolve_settingrsP *.." % % + + - -C  yB   % % ' ''r!r5cdat}t|}td|d}td|d}td|dpt }|r|sEdt |d t |d atd td S t||| }nD#ttf$r0}d|at d tYd }~d Sd }~wwxYw| |td|||d S)uPlugin entry — called by the plugin loader at startup. Registers :class:`SelfHostedOIDCProvider` only when both an issuer and a client_id are configured (via ``HERMES_DASHBOARD_OIDC_*`` env vars or the ``dashboard.oauth.self_hosted`` block in config.yaml). Operator-owned loopback / ``--insecure`` dashboards leave these unset, so the plugin is a no-op for them. On skip, writes a reason to :data:`LAST_SKIP_REASON` that names BOTH configuration surfaces so operators don't guess wrong about which to set. rHERMES_DASHBOARD_OIDC_ISSUERr3HERMES_DASHBOARD_OIDC_CLIENT_IDr4HERMES_DASHBOARD_OIDC_SCOPESr2u:Self-hosted OIDC dashboard auth is not configured. Set both an issuer and a client_id — either as env vars (HERMES_DASHBOARD_OIDC_ISSUER + HERMES_DASHBOARD_OIDC_CLIENT_ID) or under dashboard.oauth.self_hosted.{issuer,client_id} in config.yaml — or pass --insecure to skip the OAuth gate entirely. (issuer set: z; client_id set: )zdashboard-auth-self-hosted: %sN)r3r4r2z,SelfHostedOIDCProvider construction failed: zTdashboard-auth-self-hosted: registered provider (issuer=%s, client_id=%s, scopes=%r))rrrrrr=boolrrr1r9r warning register_dashboard_auth_providerinfo)ctxroidc_cfgr3r4r2rrs rregisterr s.00M ..H & X(>(>F!)8<< +D+DI 7h9O9OPP     F||||T)____  .   57GHHH )Yv     & @3 @ @  79IJJJ ((222 KK / sC--D.>%D))D.)rrrr)r"rr#rrr)rr)rrrr)rrrrrr)rr5)*r __future__rrr\loggingrrZrAr urllib.parser)typingrrrrhermes_cli.dashboard_authrrr r r r getLoggerrrr=rrrrrr__annotations__r r/r1rrrr rr!rrs>>>@#"""""   &&&&&&&&&&   8 $ $) P"  ???? 6O6O6O6O6O62O6O6O6n8888,0000 ( ( ( (<<<<<<r!