epjadZddlmZddlZddlmZddlmZddlm Z ddl m Z m Zddd ZdddZddZGddZdS)aUser-authorization methods for ``GatewayRunner``. Extracted from ``gateway/run.py`` as part of the god-file decomposition campaign (``~/.hermes/plans/god-file-decomposition.md``, Phase 3 mechanical mixin lifts). This mixin holds the inbound-message authorization cluster: whether a user/chat is allowed to talk to the agent, the per-adapter DM policy, and the unauthorized-DM behavior. Behavior-neutral: every method is lifted verbatim from ``GatewayRunner``. ``self.*`` calls resolve unchanged via the MRO. Neutral dependencies import at module top; the module-level ``logger`` is imported lazily inside the one method that uses it (``from gateway.run import logger`` resolves at call time, when ``gateway.run`` is fully loaded) so this module never imports ``gateway.run`` at import time -> no import cycle. The lazy import preserves the exact logger name (``"gateway.run"``) so log records are unchanged. ) annotationsN)Optional)Platform) SessionSource)expand_whatsapp_aliasesnormalize_whatsapp_identifiernamestrdefaultreturnc(|s|S ddlm}||}|Bt|r!t|Sn#t$rYnwxYwt j|p|S)zERead allowlist/auth env; prefer profile secret_scope under multiplex.r) get_secret)agent.secret_scoperr strip Exceptionosgetenv)r r rvals 9/home/thesage/.hermes/hermes-agent/gateway/authz_mixin.py _auth_envrs  111111j ?s3xx~~//?s88>>## #      IdOO &w - - / //sAA A)(A)c.|s|S ddlm}m}|}|D|r:||}||St |Sn#t $rYnwxYwtj|p|S)uRead a platform allow/deny gate env var with per-profile isolation. Like ``_auth_env`` but authoritative under multiplex: when a profile secret scope is installed AND multiplexing is active, a key absent from the scope returns ``default`` instead of falling through to ``os.environ``. Under multiplex the process env may hold ANOTHER profile's first-writer-bridged value (the YAML→env bridges in the Discord/Telegram adapters' ``_apply_yaml_config`` are first-writer-wins), so falling through would leak profile A's allowlist into profile B (issue #72348). Single-profile deployments — no scope installed, or multiplex off — behave exactly like the legacy ``os.getenv`` read. r)current_secret_scopeis_multiplex_active) rrrgetr rrrr)r r rrscopers r_platform_gate_envr.s   PPPPPPPP$$&&  !4!4!6!6 ))D//C{s88>>## #      IdOO &w - - / //s6A A A,+A,set[str]c|tSt|tr d|DSdt|dDS)aGParse allowlist values from config or env var into a set of strings. Handles both list inputs (YAML sequences) and comma-separated string inputs (env vars or scalar YAML values). A scalar string is split on commas so ``allow_from: "123,456"`` yields ``{"123", "456"}``, not ``{"1", "2", "3", ",", ...}``. Nch|]D}t|#t|ESr r.0parts r z$_coerce_allow_set..Vs=GGGdSYY__5F5FGD !!GGGc^h|]*}||+Sr!rr#s rr&z$_coerce_allow_set..Ws- I I ITDJJLL IDJJLL I I Ir',)set isinstancelistr split)raws r_coerce_allow_setr0Ks_ {uu #tHGGcGGGG I ISXX^^C%8%8 I I IIr'ceZdZdZ dddZdd Zdd Zd dZddd!dZddd!dZ ddd"dZ ddd"dZ ddd#dZ d$dZ d%dZddd"dZdS)&GatewayAuthorizationMixinz6User/chat authorization methods for ``GatewayRunner``.NplatformOptional[Platform]profile Optional[str]c|sdS|pdpd}|r|dkrd}t|dd}t|r |}n#t$rd}YnwxYw||kr(t|ddpi}||St|ddpi}||vr|||SdSt|ddpi}||S)aResolve the live adapter whose intake policy should gate authorization. In multiplex mode, secondary-profile adapters live in ``_profile_adapters[profile]`` while the default/active profile uses ``self.adapters``. ``SessionSource.profile`` selects which map to consult. When a stamped profile has its own adapter registry entry, the default profile's same-platform adapter must not be consulted as a fallback. Nr r _active_profile_nameadapters_profile_adapters)rgetattrcallablerr)selfr3r5 profile_nameactive_profileactive_profile_fnr9profile_adapterss r_authorization_adapterz0GatewayAuthorizationMixin._authorization_adapter]s> 4 2,,..6$  LI55!N '.Dd K K )** **%6%6%8%8NN ***%)NNN*~--"4T::@b||H---&t-@$GGM2 ///' 599(CCC44T228b||H%%%s A A"!A"sourceOptional[SessionSource]c.|dS||}||St|dddur2t|ddpi}|tjS|t|ddt|ddS)z:Resolve the live adapter for an inbound ``SessionSource``.Ndelivered_via_upstream_relayFTr9r3r5)_registered_transport_adapterr;rrRELAYrB)r=rCtransport_adapterr9s r_adapter_for_sourcez-GatewayAuthorizationMixin._adapter_for_sources >4 >>vFF  ($ $ 695 A AT I I tZ66<"H<<// /** FJ - - FIt , ,   r'rcjt|dd}t|r |nd}t|dd}||dS|t|ddpi|ur|St|ddpi}|D]}|||ur|cSdS)aReturn the registered adapter that created *source*, if retained. ``source.profile`` is the runtime/session namespace. A chat-based profile route can therefore differ from the adapter profile when one shared credential serves several routed runtimes. ``build_source`` keeps the receiving adapter as in-process provenance so replies and intake-policy checks stay on that transport without weakening the fail-closed fallback for restored or hand-built sources. _transport_adapter_refNr3r9r:)r;r<rvalues)r=rC adapter_refadapterr3 profile_mapsrAs rrGz7GatewayAuthorizationMixin._registered_transport_adaptersf&>EE #+K#8#8B++---d6:t44 ?h.4 wtZ66<"AA(KK K KNt%8$??E2 , 3 3 5 5   *..x88889tr'r cT||}t|dd}|p|t|ddpi|urdSt|ddpiD] \}}|||ur|cS!t|ddS)z@Resolve the transport-owning profile for adapter policy lookups.r3Nr9r:r5)rGr;ritems)r=rCrOr3r5rAs r_adapter_profile_for_sourcez5GatewayAuthorizationMixin._adapter_profile_for_sources44V<<6:t44  74T::@bEEhOOOOt1488>Begg # #)).228<<<<"NNN=vy$///r'r5boolcz|sdS|||}|dStt|ddS)aWhether the adapter for *platform* delegates authz to a trusted upstream. Mirrors ``BasePlatformAdapter.authorization_is_upstream``. The relay adapter sets this True: the Team Gateway connector authenticates the gateway's WS and resolves owner-only author bindings before delivering, so an inbound relay event is already authorized as this instance's bound user. Unlike ``_adapter_enforces_own_access_policy`` (a LOCAL config policy the gateway mirrors only when it's an allowlist), this is an UPSTREAM decision the gateway honors directly. Defaults to ``False`` when the adapter is unknown or doesn't expose the flag. FNauthorization_is_upstreamrBrUr;r=r3r5rOs r"_adapter_authorization_is_upstreamz_DM_POLICY`` env var (the env var is not always bridged back into ``config.extra``) — and falls back to ``config.extra`` for bare runners built without a live adapter. Used by ``_is_user_authorized`` to decide whether an own-policy adapter actually restricted DM senders to a configured allowlist (trustworthy) or merely forwarded everyone under ``dm_policy: open`` / for a pairing handshake (not authorization). "Reached the gateway" only carries an authorization signal in the ``allowlist`` case. r N _dm_policyconfig platformsextra dm_policy rBr;hasattrrarr,dictr rlowerr=r3r5rOpolicyr` platform_cfgrbs r_adapter_dm_policyz,GatewayAuthorizationMixin._adapter_dm_policys* 2--h@@9@9L,555RV >T8T22F%'&+*F*F% $$X...  =IRGL'4888dE%&& 0;//6T8T22F%'&+*F*F% $$X...  =IRGL'4888dE%&& 3>226.allow_from`` on top of the top-level ``group_policy``. A group may be open at the chat level while still restricting which senders inside that group can invoke Hermes. If such a message reached the gateway, the adapter already checked that sender allowlist, so it is a trustworthy intake decision rather than the fail-open ``group_policy: open`` case. FN_groupsr`rarbgroups* allow_from allowFromc3XK|]%}t|V&dSNr")r$items r zPGatewayAuthorizationMixin._adapter_group_has_sender_allowlist..ps2BBTs4yy((BBBBBBr')rBr;rerarr,rfr rgrRrUrr-tupler+any)r=r3rpr5rOrsr`rjrb chat_id_str group_cfgloweredkeyvalue sender_allows r#_adapter_group_has_sender_allowlistz=GatewayAuthorizationMixin._adapter_group_has_sender_allowlist>sJ  w 5--h@@6=6I)T222t >T8T22F%'&+*F*F% $$X...  =IRGL'4888dE%&& -8,,&$'' 5'll JJ{++ )T** !''))G$llnn   Uc3''CIIKK7,B,BzRWY]G^G^,B %IE)T** ( 3I)T** 5 }}\22PimmK6P6P lC ( ( . **,,-- - lT5#$6 7 7 CBB\BBBBB Bur''SessionSource'ct|ddpi}t|dd}|r ||vr||St|ddS)aPick the per-profile PairingStore for a source, falling back to global. In a multiplexing gateway, each profile owns its own pairing whitelist so isolation is preserved. When the source has no profile (single- profile gateway, or a path that hasn't stamped profile yet) or the profile isn't registered, fall back to ``self.pairing_store`` (the global default) so existing behavior is preserved. pairing_storesNr5 pairing_store)r;)r=rC per_profiler5s r_pairing_store_forz,GatewayAuthorizationMixin._pairing_store_forss[d$4d;;Ar &)T22  (w+--w' 't_d333r'cddlm}|jtjtjhvrdS||}|jdus||j|rdS|j }|j dvr|j rtj dtj di|jd}|r?t|}|r.d |d D}d |vs |j |vrdS ||}|Wt%t%|d d dd pi} | d} | rt'| } d | vs |j | vrdSn#t($rYnwxYwtjdtjdtj dtjdi} t%|ddrT| |j} | r8t| ddvrdS|sdSitj dtjdtjdtjdtjdtjdtjdtjdtjd tj d!tj!d"tjd#tj"d$tj#d%tj$d&tj%d'tj d(tj&d)i}tj d*i}tj dtj di}itj d+tjd,tjd-tjd.tjd/tjd0tjd1tjd2tjd3tj d4tj!d5tjd6tj"d7tj#d8tj$d9tj%d:tj d;tj&dvrdSt%|d?ddurdS|jr |jj)nd}|-|}||.||rdStY||jd}d}d}|j d@vrPtY||jd}tY||jd}tYdA}|s|s|s|s|/|j|r|j dvrA|0|j|}|1|j|j |rdSn|2|j|}|dBkrc|j dvrX|3|j|}|t%|dCd nd }ti|rtk||SdS||}|qt%t%|d d dd pi} |j dvr| dD}n| dE}|rt'|} || vsd | vrdStYdFd>vS|r>|j d@vr5|j r.dG|d D}d |vs |j |vrdS|jtj kr|r|j d@vr|j rzdH|d D}|rYt%|dIds=|6dJd 7tq|d|_9|j |vrdStu}|r2|;dK|d D|r2|;dL|d D|r2|;dM|d Dd |vrdS|h} dN|vr.| <|dNd|jtjtjhvrtu}!|D]$}"|!;t{|"%|!r|!}| ;t{|t}|}#|#r| <|#|j1|jj)dOkr!|j?r| <|j?tk| |zS)Pao Check if a user is authorized to use the bot. Checks in order: 1. Per-platform allow-all flag (e.g., DISCORD_ALLOW_ALL_USERS=true) 2. Environment variable allowlists (TELEGRAM_ALLOWED_USERS, etc.) 3. DM pairing approved list 4. Global allow-all (GATEWAY_ALLOW_ALL_USERS=true) 5. Default: deny r)loggerTrT>forumgroupchannelTELEGRAM_GROUP_ALLOWED_CHATSQQ_GROUP_ALLOWED_USERSr c^h|]*}||+Sr!r))r$cids rr&z@GatewayAuthorizationMixin._is_user_authorized..s>)))99;;) )))r'r*rtNr`rbgroup_allowed_chatsDISCORD_ALLOW_BOTSFEISHU_ALLOW_BOTSTELEGRAM_ALLOW_BOTSSLACK_ALLOW_BOTSis_botFnone>allmentionsTELEGRAM_ALLOWED_USERSDISCORD_ALLOWED_USERSWHATSAPP_ALLOWED_USERSWHATSAPP_CLOUD_ALLOWED_USERSSLACK_ALLOWED_USERSSIGNAL_ALLOWED_USERSEMAIL_ALLOWED_USERSSMS_ALLOWED_USERSMATTERMOST_ALLOWED_USERSMATRIX_ALLOWED_USERSDINGTALK_ALLOWED_USERSFEISHU_ALLOWED_USERSWECOM_ALLOWED_USERSWECOM_CALLBACK_ALLOWED_USERSWEIXIN_ALLOWED_USERSBLUEBUBBLES_ALLOWED_USERSQQ_ALLOWED_USERSYUANBAO_ALLOWED_USERSTELEGRAM_GROUP_ALLOWED_USERSTELEGRAM_ALLOW_ALL_USERSDISCORD_ALLOW_ALL_USERSWHATSAPP_ALLOW_ALL_USERSWHATSAPP_CLOUD_ALLOW_ALL_USERSSLACK_ALLOW_ALL_USERSSIGNAL_ALLOW_ALL_USERSEMAIL_ALLOW_ALL_USERSSMS_ALLOW_ALL_USERSMATTERMOST_ALLOW_ALL_USERSMATRIX_ALLOW_ALL_USERSDINGTALK_ALLOW_ALL_USERSFEISHU_ALLOW_ALL_USERSWECOM_ALLOW_ALL_USERSWECOM_CALLBACK_ALLOW_ALL_USERSWEIXIN_ALLOW_ALL_USERSBLUEBUBBLES_ALLOW_ALL_USERSQQ_ALLOW_ALL_USERSYUANBAO_ALLOW_ALL_USERS)platform_registry>1yestruerole_authorized>rrGATEWAY_ALLOWED_USERS allowlist_is_dm_allowedgroup_allow_fromruGATEWAY_ALLOW_ALL_USERSc^h|]*}||+Sr!r))r$rps rr&z@GatewayAuthorizationMixin._is_user_authorized..sB!!!$+RYR_R_RaRa! !!!r'ch|]=}|d)|>S)-)r startswith)r$vs rr&z@GatewayAuthorizationMixin._is_user_authorized..sL7799'',, r'#_warned_telegram_group_users_legacyuTELEGRAM_GROUP_ALLOWED_USERS contains chat-ID-shaped values (%s). Treating them as chat IDs for backward compatibility. Move chat IDs to TELEGRAM_GROUP_ALLOWED_CHATS — the _USERS var is now for sender user IDs.c3fK|],}||V-dSrxr)r$uids rrzz@GatewayAuthorizationMixin._is_user_authorized..s<ccsWZW`W`WbWbcsyy{{ccccccr'c3fK|],}||V-dSrxr)rs rrzz@GatewayAuthorizationMixin._is_user_authorized..s<eesY\YbYbYdYdesyy{{eeeeeer'c3fK|],}||V-dSrxr)rs rrzz@GatewayAuthorizationMixin._is_user_authorized..s<aasUXU^U^U`U`asyy{{aaaaaar'@simplex)@ gateway.runrr3r HOMEASSISTANTWEBHOOKrSrFrZuser_id chat_typerpTELEGRAMQQBOTrrr.rJr;r0rDISCORDFEISHUSLACKrgrWHATSAPPWHATSAPP_CLOUDSIGNALEMAILSMS MATTERMOSTMATRIXDINGTALKWECOMWECOM_CALLBACKWEIXIN BLUEBUBBLESYUANBAOgateway.platform_registryrrallowed_users_env allow_all_envrr is_approvedr]rorrkrBr<rUwarningjoinsortedrr+updateadd_expand_whatsapp_auth_aliases_normalize_whatsapp_identifier user_name)$r=rCradapter_profilerchat_allowlist_envraw_chat_allowlistallowed_group_idsrOrbadapter_group_allowedallowedplatform_allow_bots_mapallow_bots_varplatform_env_mapplatform_group_user_env_mapplatform_group_chat_env_mapplatform_allow_all_maprentryplatform_allow_all_var platform_namerplatform_allowlistgroup_user_allowlistgroup_chat_allowlistglobal_allowlisteffective_policydm_check adapter_allowlegacy_chat_ids allowed_ids check_idsnormalized_allowed_ids allowed_idnormalized_user_ids$ r_is_user_authorizedz-GatewayAuthorizationMixin._is_user_authorizeds?  '&&&&& ?x5x7GH H H4::6BB:  .$ 6 6$:a:a O#;b; ; 64.  < < < <!#A 8"c&/2&& " $%78J%K%K"%$))#5#;#;C#@#@)))% ///6>EV3V3V#t 226::&#GGXt$D$DgtTTZXZE,1II6K,L,L),("34I"J"J'>>V^w-F-F#'4      2 O0  4 N. #  68U + + 488IIN "4^V"L"L"R"R"T"T"Z"Z"\"\`s"s"st 5  7  5   7   #%C  N1  O3   N1  L-   !;  O3   7  O3  N1   #%C  O3  "=! " N.# $  5%  *  =' #  = N4' #"  9"  7"   9"   #%E " N3 " O5 "  N3"  L/"   !="  O5"   9"  O5"  N3"   #%E"  O5"  "?!" " N0#" $  7%" " , ?"2 2 2 GGGGGG)--fo.CDDV.TR XG[R XdtR X077'8) #'DDD'+'A'A /(B(($?? /@$ $t $(,'>'> /(?(($${22'/LLL"&"="="O$3#>## '2$G-=tDDD!%! $H--;#'(9(9#:#::4 ..v66G"4 @ @'4PPVTV#'DDD$)II.@$A$AMM$)IIl$;$;M $/ >>G'))SG^^#t677==??CWW W  F$48J$J$Jv~$J!!/C/I/I#/N/N!!! '''6>=N+N+Nt Ox0 0 0$ 1 $6667-33C88O  t%JERRDNN6!8!899 @DD<>_444 ee  d   cc6H6N6Ns6S6Sccc c c c  f   ee6J6P6PQT6U6Ueee e e e  b   aa6F6L6LS6Q6Qaaa a a a +  4I '>> MM'--,,Q/ 0 0 0 ?x0(2IJ J J%(UU ") Y Y &--.KJ.W.WXXXX% 54   :7CC D D D!?!H!H ! 2 0111 O '%22 3 MM&* + + +I +,,,s&0A,E E,+E,AQ** Q76Q7ct|dd}|rht|drX|rVt|dr|j|nd}|r(dt|divr||S|t jkrdS|r"t|dr|jdkr|jS|r||| }|s|rt|dr|j|}|rt|ddnd}t|trHt|d pd  }|d krdS|d vrdS|rmit jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jdt jd}t jdt jd i}t=||d  rdS||d!D]&} t=|  rdS't=d" rdSdS)#u}Return how unauthorized DMs should be handled for a platform. Resolution order: 1. Explicit per-platform ``unauthorized_dm_behavior`` in config — always wins. 2. Email defaults to ``"ignore"`` unless explicitly opted into pairing. Inboxes may contain arbitrary unread human messages, so replying with pairing codes is not a safe platform default. 3. Explicit global ``unauthorized_dm_behavior`` in config — wins for chat-shaped platforms when no per-platform override is set. 4. When an adapter-level DM policy opts into pairing or silent drop, honor it. 5. When an allowlist (``PLATFORM_ALLOWED_USERS``, ``PLATFORM_GROUP_ALLOWED_USERS`` / ``PLATFORM_GROUP_ALLOWED_CHATS``, or ``GATEWAY_ALLOWED_USERS``) is configured, default to ``"ignore"`` — the allowlist signals that the owner has deliberately restricted access; spamming unknown contacts with pairing codes is both noisy and a potential info-leak. (#9337) 6. No allowlist and no explicit config → ``"pair"`` (open-gateway default). r`Nget_unauthorized_dm_behaviorraunauthorized_dm_behaviorrbignorepairrTrcr pairing>disabledrrrrrrrrrrrrrrrrrr)rr)rr!r)r;rerarrrrrrkr,rfr rrgrrrrrrrrrrrrrrrrr) r=r3r5r`rjrcrbrplatform_group_env_mapenv_keys r_get_unauthorized_dm_behaviorz7GatewayAuthorizationMixin._get_unauthorized_dm_behaviors0x..  Egf&DEE E( E=DV[=Y=Yc6+//999_cL E :glT[]_>`>` ` `::8DDD x~ % %8  7gf&@AA 7.&8866  //'/JJI R RGFK,H,H R%/33H== @LV gt<< > 8vr'rx)r3r4r5r6)rCrD)rCr)rCrr r6)r3r4r5r6r rU)r3r4r5r6r r )r3r4rpr6r5r6r rU)rCr)rCrr rU)__name__ __module__ __qualname____doc__rBrJrGrSrZr]rkrorrrr!r!r'rr2r2Zs@@ "&#&#&#&#&#&J    6. 0 0 0 0$"& JJJJJJ8"& KKKKKK@"& #1#1#1#1#1#1R"& !1!1!1!1!1!1P"& 333333j 4 4 4 4M-M-M-M-f "& ggggggggr'r2)r )r r r r r r )r r)r% __future__rrtypingrgateway.configrgateway.sessionrgateway.whatsapp_identityrrrrrrr0r2r!r'rr+s"#""""" ######)))))) 0 0 0 0 000000: J J J J^ ^ ^ ^ ^ ^ ^ ^ ^ ^ r'