NQjjdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZmZmZgdZddlmZmZeGd d ZdddZedZGddeeZdS)uShared substrate for external secret-source backends. Every backend (Bitwarden, 1Password, …) needs the same handful of security-sensitive primitives: * a uniform result object (:class:`FetchResult`), * environment-variable name validation (:func:`is_valid_env_name`), * a two-layer fetch cache whose disk half writes atomically with ``0600`` permissions and honours a TTL (:class:`DiskCache`, :class:`CachedFetch`). These used to live inline inside ``bitwarden.py``. Pulling them here means the atomic-write / ``0600`` / TTL logic is audited and fixed in exactly one place instead of drifting across copy-pasted per-backend modules — each backend supplies only its own cache-key shape and a serializer for it. Nothing in this module ever raises out to the caller's hot path: the disk layer is strictly best-effort (a miss just triggers a refetch), because a cache problem must never block Hermes startup. ) annotationsN) dataclass)Path)CallableDictGenericOptionalTypeVar) FetchResult CachedFetch DiskCacheis_valid_env_nameresolve_cache_home)r rc0eZdZUdZded<ded<d d Zd S) r z;A set of fetched secret values plus when they were fetched.zDict[str, str]secretsfloat fetched_at ttl_secondsreturnboolcP|dkrdStj|jz |kS)NrF)timer)selfrs ?/home/alina/.hermes/hermes-agent/agent/secret_sources/_cache.pyis_freshzCachedFetch.is_fresh@s* !  5 do-<<N)rrrr)__name__ __module__ __qualname____doc____annotations__rrrr r 9sHEE======rr home_pathOptional[Path]rrcv|6ttjdtjdz }|S)aResolve the Hermes home used for cache paths. ``home_path`` is whatever ``load_hermes_dotenv()`` already resolved; falling back to ``$HERMES_HOME`` / ``~/.hermes`` keeps direct callers (and tests that don't thread a home through) working. N HERMES_HOMEz.hermes)rosgetenvhome)r#s rrrMs4=$)++ 2IJJKK rKcFeZdZdZddZddd Z dddZ dddZdddZd S)r uBest-effort, profile-aware on-disk cache for fetched secret values. One JSON object per backend lives at ``/cache/``:: {"key": "", "secrets": {...}, "fetched_at": 1.0} The file holds only secret *values* keyed by the serialized cache key — never raw auth material. Backends are responsible for fingerprinting tokens/sessions *before* they reach ``key_serializer`` so the token can't land in the key. Writes are atomic (``mkstemp`` → ``chmod 0600`` → ``os.replace``) and the containing ``cache/`` directory is forced to ``0700`` — ``mkdir``'s mode is umask-subject, so the chmod is the reliable form. Both ``read`` and ``write`` short-circuit when ``ttl_seconds <= 0``, so setting the TTL to zero disables *both* cache layers symmetrically: a user opting out never gets secret values written to disk at all. basenamestrkey_serializerCallable[[K], str]rNonecp||_||_|ddd}d|d|_dS)N.r_) _basename_key_serializersplit _tmp_prefix)rr,r.stems r__init__zDiskCache.__init__psA!-~~c1%%a(&t;;;rNr#r$rc6t|dz |jz S)Ncache)rr5rr#s rpathzDiskCache.pathxs!),,w6GGrkeyr*rrOptional[CachedFetch]c|dkrdS||} t|dd5}tj|}dddn #1swxYwYn#ttjf$rYdSwxYwt |tsdS|d| |krdS|d}|d}t |trt |ttfsdSd | D} t| t| } | |sdS| S) zReturn a fresh cached entry for ``key``, or None. Best-effort: any I/O or parse error, a key mismatch, or a stale entry all return None so the caller re-fetches. rNrutf-8encodingr?rrcni|]2\}}t|tt|t/||3Sr") isinstancer-).0kvs r z"DiskCache.read..sQ! ! ! Q 1c0B0B! GQRSUXGYGY! q! ! ! r)rr)r>openjsonloadOSErrorJSONDecodeErrorrGdictgetr6intritemsr r) rr?rr#r>fpayloadrrtypedentrys rreadzDiskCache.read{s !  4yy## dC'222 'a)A,, ' ' ' ' ' ' ' ' ' ' ' ' ' ' '-.   44 '4(( 4 ;;u  !5!5c!:!: : :4++i(([[.. '4((  :U|0T0T 4! ! $]]__! ! ! EeJ6G6GHHH~~k** 4 s4AA AAAAAA87A8rXr c|dkrdS||} |j}|dd tj|dn#t $rYnwxYw|||j|jd}tj |j dt|\}} tj |d d 5} tj|| dddn #1swxYwYtj| d tj| |dS#t"$r( tj| n#t $rYnwxYwwxYw#t $rYdSwxYw) uPersist ``entry`` for ``key`` atomically at mode ``0600``. No-op when ``ttl_seconds <= 0`` (so caching is genuinely off) or on any I/O error — the next invocation just re-fetches. rNT)parentsexist_oki)r?rrz.tmp)prefixsuffixdirwrCrDi)r>parentmkdirr'chmodrOr6rrtempfilemkstempr8r-fdopenrMdumpreplace BaseExceptionunlink) rr?rXrr#r> cache_dirrVfdtmprUs rwritezDiskCache.writes !   Fyy##  I OOD4O 8 8 8 E****    ++C00 =#.G&'C NNGB Yr3999*QIgq)))***************e$$$ 3%%%%%    IcNNNND       DD sEAE A!E A!!AE4D$ C-! D$-C11D$4C15-D$$ E/EE EEEEE E'&E'c ||dS#ttf$rYdSwxYw)z6Delete the on-disk cache file if present (idempotent).N)r>rjFileNotFoundErrorrOr=s rclearzDiskCache.clearsR  IIi ' ' ) ) ) ) )!7+    DD s'+AA)r,r-r.r/rr0Nr#r$rr)r?r*rrr#r$rr@) r?r*rXr rrr#r$rr0)r#r$rr0) rrrr r:r>rYrnrqr"rrr r \s&''''HHHHH%) #####T%) .....`rr rrrs)r __future__rrMr'rdr dataclassesrpathlibrtypingrrrr r __all__agent.secret_sources.baser rr rr*r r"rrrzsl(#"""""  !!!!!!==============     = = = = = = =  =&      GCLLyyyyy yyyyyr