*j=W|UdZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z mZejeZdZdefdZehdZdZd Ze d z Zdeeeffd Zd eeefddfd ZeZe dz Z dZ!dZ"deee#effdZ$deee#efddfdZ%e$Z&e j'Z(dede)fdZ*deddfdZ+dede,fdZ-da.e,dze/d<da0e,dze/d<de,fdZ1de,fdZ2ddde,dzdefdZ3e j'Z4d a5e)e/d!<da6edze/d"<d9d#Z7dedzfd$Z8de)fd%Z9de)fd&Z:de)fd'Z;de)fd(Zd,Z?d-ede)fd.Z@d-ededzfd/ZAd-ededzfd0ZBd-ed1ede)fd2ZCd9d3ZDdedzfd4ZEde)fd5ZFd:de)fd6ZGd9d7ZHd9d8ZIdS);z Hermes Web UI -- optional authentication. Off by default. Enable by setting HERMES_WEBUI_PASSWORD, configuring a password in Settings, or registering passkeys and then going passwordless. N) STATE_DIR load_settingsi'returnc\tjdd}|r!t |}d|cxkrdkrnn|St }|d}t|trd|cxkrdkrnn|StS)aResolve session TTL from env > settings > default. Priority mirrors get_password_hash(): HERMES_WEBUI_SESSION_TTL env var first, then settings.json, falling back to ``SESSION_TTL`` (30 days). Clamped to [60s, 1 year] to prevent runaway cookies or self-lockout. HERMES_WEBUI_SESSION_TTL<i3session_ttl_seconds) osgetenvstripisdigitintrget isinstance SESSION_TTL)env_vvalsvs +/Users/bertmahoney/hermes-webui/api/auth.py_resolve_session_ttlrs I0" 5 5 ; ; = =E }}%jj  # # # # # # # # #JA #$$A!SbA444444444 > /login/sw.js/health /favicon.ico/manifest.json/api/auth/login/api/auth/status/manifest.webmanifest/session/manifest.json/api/auth/passkey/login/api/auth/passkey/options/session/manifest.webmanifesthermes_sessionzX-Hermes-CSRF-Tokenz.sessions.jsonc trtjtd}t |t stdtjfd| DSn2#t$r%}t d|Yd}~nd}~wwxYwiS)zLoad persisted sessions from STATE_DIR, pruning expired entries. Returns an empty dict on any read or parse error so startup is never blocked by a corrupt or missing sessions file. utf-8encodingu)malformed sessions file — expected dictci|]?\}}t|tr%t|ttfr |k<||@S)rstrrfloat.0texpnows r z"_load_sessions..Ksa[[[vq#!!S))[.8sEl.K.K[PSVYPYPYsPYPYPYrz0Failed to load sessions file, starting fresh: %sN) _SESSIONS_FILEexistsjsonloads read_textrdict ValueErrortimeitems Exceptionloggerdebug)dataer3s @r_load_sessionsrC?s L  " " [:n666HHIIDdD)) N !LMMM)++C[[[[[[[ [  [ LLL GKKKKKKKKL IsBB!! C+C  Csessionsc( tjddtjtd\}} t j|dd5}t j||dddn #1swxYwYt j|d t j |tdS#t$r( t j |n#t$rYnwxYwwxYw#t$r&}td |Yd}~dSd}~wwxYw) zAtomically persist sessions to STATE_DIR/.sessions.json (0600). Uses a temp file + os.replace() so a crash mid-write never leaves a truncated file. Mirrors the same pattern as .signing_key persistence. Tparentsexist_okz .sessions.tmpdirsuffixwr(r)NzFailed to persist sessions: %s)rmkdirtempfilemkstempr fdopenr7dumpchmodreplacer5r>unlinkOSErrorr?r@)rDfdtmpfrBs r_save_sessionsrZRsy :t4444"yIIIC 2sW555 ' (A&&& ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' HS% JsN + + + + +     #        ::: 5q999999999:sp4C!B,A0$ B,0A44B,7A482B,, C7C  C CCCCC!! D+D  Dz.login_attempts.jsonr c& trtjtd}t |t stdtji}| D]E\}}t |trt |ts0fd|D}|r|||<F|Sn2#t$r%}td|Yd}~nd}~wwxYwiS)zFLoad persisted login attempts from STATE_DIR, pruning expired entries.r(r)u/malformed login-attempts file — expected dictcg|]H}t|ttfr*t|z tk9t|ISr,)rrr. _LOGIN_WINDOWr0r1r3s r z(_load_login_attempts..sV!!c5\228;U1XX~ 7U7U!HH7U7U7Urz6Failed to load login attempts file, starting fresh: %sN)_LOGIN_ATTEMPTS_FILEr6r7r8r9rr:r;r<r=r-listr>r?r@)rAattemptsip raw_timesfreshrBr3s @r_load_login_attemptsrgssER  & & ( ( :2<rUrVr?r@)rcrWrXrYrBs r_save_login_attemptsrjs@#))$)FFF"';'BK`aaaC 2sW555 ' (A&&& ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' HS% Js0 1 1 1 1 1     #        @@@ ;Q?????????@srAC1B<B4 B<BB<B2B<< C.CC. C)&C.(C))C..C11 D!;DD!rdcft5tjt|g}fd|D}|r |t|<nt|dt tt |tkcdddS#1swxYwYdS)z@Return True if the IP is allowed to attempt login (thread-safe).c0g|]}|z tk|Sr,)r^r_s rr`z%_check_login_rate..s'CCC!37]+B+BA+B+B+BrN)_LOGIN_ATTEMPTS_LOCKr<_login_attemptsrpoprjlen_LOGIN_MAX_ATTEMPTS)rdrcr3s @r_check_login_raterrs  3 3ikk"&&r2..CCCCxCCC  *"*OB     D ) ) )_---8}}22 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3sBB&&B*-B*ct5tj}t|g}|||t|<t tddddS#1swxYwYdS)z7Record a login attempt for rate limiting (thread-safe).N)rmr<rnrappendrj)rdr3rcs r_record_login_attemptrus ..ikk"&&r2..&_--- ..................sA"A77A;>A;filenamect|z } |r1|}t|dkr |ddSn+#t$rt d|YnwxYwtjd} tj dd| || dn+#t$rt d|YnwxYw|S)zLLoad a 32-byte key from STATE_DIR, generating and persisting one if missing. NzFailed to read key %sTrFrMzFailed to persist key %s) rr6 read_bytesrprVr?r@secrets token_bytesrN write_bytesrS)rvkey_filerawkeys r _load_keyrs8#H8 ??   %%''C3xx2~~3B3x 888 ,h777778  b ! !C;t4444S!!!u ;;; /:::::; Js%AA%A:9A:AC%C;:C;_PBKDF2_KEY_CACHE_SIGNING_KEY_CACHEc<ttdatS)Nz .pbkdf2_key)rrr,rr _pbkdf2_keyrs %m44 rc<ttdatS)Nz .signing_key)rrr,rr _signing_keyrs!&~66 rsaltrc|t}tjd||d}|S)a PBKDF2-SHA256 with 600k iterations (OWASP recommendation). Salt is the persisted PBKDF2 key, which is secret and unique per installation. This keeps the stored hash format a plain hex string (no format change to settings.json) while replacing the predictable STATE_DIR-derived salt from the original implementation. The *salt* parameter exists solely to support transparent migration of password hashes that were computed with a different key (e.g. the old `.signing_key`). Normal callers should never pass it. Nsha256i' )rhashlib pbkdf2_hmacencodehex)passwordrdks r_hash_passwordrs? |}}  Xx'8'8$ H HB 6688OrF_AUTH_HASH_COMPUTED_AUTH_HASH_CACHEcNt5dadaddddS#1swxYwYdS)zInvalidate the in-process password hash cache so the next call to get_password_hash() re-reads from settings.json or the env var.FN)_AUTH_HASH_LOCKrrr,rr_invalidate_password_hash_cachersz   #                  s cXtrtSt5trtcdddStjdd}|rt |}n#tdpd}|ada|cdddS#1swxYwYdS)u:Return the active password hash, or None if auth is disabled. Priority: env var > settings.json. The hash is computed once and cached for the lifetime of the process. PBKDF2-600k takes ~1 s and is called on nearly every HTTP request via check_auth → is_auth_enabled, so caching avoids wasting a full second of CPU per request after the first one. Thread-safe: double-checked locking ensures that under a burst of concurrent requests only one thread computes PBKDF2, while the fast path (after initialisation) requires zero locks. NHERMES_WEBUI_PASSWORDr password_hashT) rrrr r r rrr)env_pwresults rget_password_hashrs     $#  2B77==??  B#F++FF"__((99ATF!"sBA!BB#&B#c"tduS)z7True if a password is configured (env var or settings).N)rr,rris_password_auth_enabledr&s   d **rctjdd}|r(|dvS ddlm}|}t |tri|d}t |tr|St |tr(|dvSn#t$rYnwxYwdS)aReturn True if the passkey/WebAuthn surface is enabled for this deployment. Passkey support is opt-in default-off behind a feature flag so deployments that don't want the WebAuthn surface (or whose RP-ID setup isn't ready for non-localhost hosts) can disable it entirely with no UI surface, no endpoints, no credential storage. To enable: - Set ``HERMES_WEBUI_PASSKEY=1`` in the environment, OR - Set ``webui_passkey_enabled: true`` in the per-profile config.yaml With the flag off, ``are_passkeys_enabled()`` always returns False even if credentials were registered in the past, and ``/login`` shows password-only. HERMES_WEBUI_PASSKEYr>1onyestruer) get_configwebui_passkey_enabledF) r r r lower api.configrrr:rboolr-r>) env_valuercfgr~s r_passkey_feature_flag_enabledr+s 0"55IG  &&((,FFF  ))))))jll c4  I''122C#t$$  #s## Iyy{{((**.HHH      5sACr?r@)rexcs rare_passkeys_enabledrKs| ( * *u333333!!###  A3GGGuuuuus" AA  Ac:tp tS)z9True if password auth or passkey-only auth is configured.)rrr,rris_auth_enabledrXs # % % ?)=)?)??rplainc(t}|sdStjt||rdSt }t }||kr9tjt|||rddlm}|d|idSdS)aVVerify a plaintext password against the stored hash. Supports transparent migration of password hashes that were computed with the old `.signing_key` salt. When the two keys differ and the legacy-salted hash matches, the password is transparently re-hashed with the current `.pbkdf2_key` and persisted to settings.json. FTrr) save_settings _set_password)rhmaccompare_digestrrrrr)rexpected legacy_salt current_saltrs rverify_passwordr]s!""H u >%00(;;t..K==Ll""  ~e+FFF Q Q  0 0 0 0 0 0 M?E2 3 3 34 5rcTtjd}tjtzt|<t tt jt| tj  }|d|S)z7Create a new auth session. Returns signed cookie value.rx.) rz token_hexr<r _sessionsrZrnewrrrr hexdigest)tokensigs rcreate_sessionr|s}  b ! !Ey{{%9%;%;;Ie9 (<>>5<<>>7> B B L L N NC  c  rctjfdtD}|r6|D]}t|dt tdSdS)zFRemove all expired session entries to prevent unbounded memory growth.c&g|] \}}|k |Sr,r,r/s rr`z+_prune_expired_sessions..s">>>VQC#IIqIIIrN)r<rr=rorZ)expiredrr3s @r_prune_expired_sessionsrs} )++C>>>>y00>>>G" ' 'E MM% & & & &y!!!!!""r cookie_valuec6|rd|vrdSt|dd\}}tjt |t j}tj ||p/t|dkotj ||dd}|sdSt |}|rtj |krt|ddSdS)zFVerify a signed session cookie. Returns True if valid and not expired.rFrxNT)rrsplitrrrrrrrrrprrr<ro)rrrfull_sigvalidexpirys rverify_sessionrs 3l22u$$S!,,JE3x  GGQQSSH  X . .  CBB4.sHSbSMBB  u ]]5 ! !F TY[[6)) eT"""u 4rcL|rd|vrdS|dd\}}|pdS)zDReturn the raw server-side session token from a signed cookie value.rNr)r)rr_sigs r _session_token_from_cookie_valuers< 3l22t%%c1--KE4 =Drct|}|sdStjtd|t jS)aReturn the CSRF token bound to an authenticated WebUI session. The browser can read this token from the authenticated shell and echoes it in ``X-Hermes-CSRF-Token`` on unsafe API requests. The token is derived from the HttpOnly session cookie's server-side token, so it automatically rotates on login and is invalidated when the auth session expires or logs out. Callers must still verify the auth session before trusting it. Nzcsrf:)rrrrrrrrrrs rcsrf_token_for_sessionrsV -\ : :E t 8LNNOEOO$:$:$<$???,c#d))nn=== D!!!!c"""( )(((((!;-# < 3 fl 2 2  0s;;J (=>>>,c222 5rctjdd}|dvrdS|dvrdS|9t |jdddS|jd dd krdSdS) uReturn True if cookies should carry the Secure flag. Behaviour is overridable via HERMES_WEBUI_SECURE env var for reverse-proxy setups where TLS terminates at a frontend proxy (nginx, Cloudflare, etc.) and Python only sees plain HTTP. 1/true/yes → force Secure on; 0/false/no → force Secure off. When unset, fall back to heuristics: direct TLS socket (getpeercert) or X-Forwarded-Proto header from the request. .. warning:: The ``X-Forwarded-Proto`` header is only trustworthy when a reverse proxy (nginx, Cloudflare, etc.) is deployed in front of the application. Without a proxy, any client can forge the header and cause the Secure flag to be set on plain HTTP. HERMES_WEBUI_SECUREr)rrrT)rfalsenoFN getpeercertzX-Forwarded-Protohttps)r r r rgetattrrequestrr)renvs r_is_secure_contextrs ))2 . . 4 4 6 6 < < > >C """t """u 7?M4 8 8 D4 ?  2B 7 77 B B4 5rctj}||t<d|td<d|td<d|td<t t |td<t |rd|td<|d |td S) z$Set the auth cookie on the response.ThttponlyLaxsamesiterrmax-agesecure Set-CookieN) rrrrr-rrr OutputString)rrrs rset_auth_cookier.s \ & & ( (F&F;&*F; #&+F; #"%F;%()=)?)?%@%@F; "'""-(,{H%  f[&9&F&F&H&HIIIIIrctj}d|t<d|td<d|td<d|td<|d|td S) z&Clear the auth cookie on the response.rTrrrrrrN)rrrrrr)rrs rclear_auth_cookier;sy \ & & ( (FF;&*F; #"%F;%(F; "  f[&9&F&F&H&HIIIIIr)rN)N)J__doc__rr http.cookiesrr7loggingr rzrO threadingr<rrr getLogger__name__r?rrr frozensetrrCSRF_HEADER_NAMEr5r:r-r.rCrZrrarqr^rbrgrjrnLockrmrrrrubytesrr__annotations__rrrrrrrrrrrrrrrrrrrrrrrrrrr,rrr&sg     ////////  8 $ $ c(y  (--S%Z(&:T#u*-:$::::2 N   !#99 d3U #342@4T%[(8#9@d@@@@('&((%y~'' 3# 3$ 3 3 3 3.c.d....(#'54<&&&#'EDL'''Ue6:edlc"!).""!T!!!##*###    !3:!!!!H+$++++ t@ d    @@@@@ 34>""",33: Z Zt Z Z Z ZMCMSMTMMMM&&&& ,S4Z , , , ,343333l: J J J JJJJJJJr