b5aa16f785
- credential_sources: _remove_nous_device_code/_remove_minimax_oauth/xai/codex share _remove_auth_store_oauth; hint-only steps (claude_code, qwen-cli, config:*) built by _suppress_only(); registry is a literal ordered list (register()/_register_all_sources() removed; order preserved, first match wins). - credential_persistence: fold _fingerprint_value into fingerprint_secret_value; compact key tables and docstrings. - Behavior parity verified old vs new: removal-step lookup + hint text for 12 (provider, source) cases; 3000 random sanitize/fingerprint payloads.
124 lines
4.8 KiB
Python
124 lines
4.8 KiB
Python
"""Credential-pool disk-boundary sanitization helpers.
|
|
|
|
Decide which pool entries are references to *borrowed* runtime secrets and
|
|
strip raw values before those entries reach ``auth.json``. Deliberately free
|
|
of ``hermes_cli.auth`` imports so the pool model and the auth-store write
|
|
boundary share one policy without import cycles.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import re
|
|
from typing import Any, Dict, Mapping
|
|
|
|
|
|
# Sources Hermes owns and may persist with secrets. Any other non-empty,
|
|
# non-manual source is borrowed/reference-only so new external providers fail
|
|
# closed at the disk boundary.
|
|
_PERSISTABLE_PROVIDER_SOURCES = frozenset({
|
|
("anthropic", "hermes_pkce"),
|
|
("minimax-oauth", "oauth"),
|
|
("nous", "device_code"),
|
|
("openai-codex", "device_code"),
|
|
("xai-oauth", "device_code"),
|
|
})
|
|
|
|
# Metadata keys that look secret-ish by suffix but are safe to persist.
|
|
_SAFE_SECRETISH_METADATA_KEYS = frozenset({
|
|
"secret_fingerprint", "secret_source", "token_type", "scope", "client_id",
|
|
"agent_key_id", "agent_key_expires_at", "agent_key_expires_in",
|
|
"agent_key_reused", "agent_key_obtained_at", "expires_at", "expires_at_ms",
|
|
"expires_in", "last_refresh", "last_status", "last_status_at",
|
|
"last_error_code", "last_error_reason", "last_error_message",
|
|
"last_error_reset_at",
|
|
})
|
|
|
|
_SECRET_VALUE_KEYS = frozenset({
|
|
"access_token", "refresh_token", "agent_key", "api_key", "apikey",
|
|
"api_token", "auth_token", "authorization", "bearer_token", "client_secret",
|
|
"credential", "credentials", "id_token", "oauth_token", "private_key",
|
|
"secret_key", "session_token", "password", "secret", "token", "tokens",
|
|
})
|
|
|
|
_SECRET_VALUE_SUFFIXES = (
|
|
"_api_key", "_api_token", "_access_token", "_auth_token", "_refresh_token",
|
|
"_bearer_token", "_client_secret", "_id_token", "_oauth_token",
|
|
"_private_key", "_session_token", "_secret_key", "_password", "_secret",
|
|
"_token", "_key",
|
|
)
|
|
|
|
_CAMEL_CASE_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
|
|
|
|
|
|
def _normalize_key(key: Any) -> str:
|
|
raw = _CAMEL_CASE_BOUNDARY.sub("_", str(key or "").strip())
|
|
return raw.lower().replace("-", "_").replace(".", "_")
|
|
|
|
|
|
def is_borrowed_credential_source(source: Any, provider_id: Any = None) -> bool:
|
|
"""Return True when ``source`` points at a borrowed/reference-only secret."""
|
|
normalized_source = str(source or "").strip().lower()
|
|
if not normalized_source or normalized_source == "manual" or normalized_source.startswith("manual:"):
|
|
return False
|
|
normalized_provider = str(provider_id or "").strip().lower()
|
|
return (normalized_provider, normalized_source) not in _PERSISTABLE_PROVIDER_SOURCES
|
|
|
|
|
|
def _is_secret_payload_key(key: Any) -> bool:
|
|
normalized = _normalize_key(key)
|
|
if not normalized or normalized in _SAFE_SECRETISH_METADATA_KEYS:
|
|
return False
|
|
return normalized in _SECRET_VALUE_KEYS or normalized.endswith(_SECRET_VALUE_SUFFIXES)
|
|
|
|
|
|
def fingerprint_secret_value(value: Any) -> str | None:
|
|
"""Non-reversible ``sha256:<16 hex>`` fingerprint of one secret value.
|
|
|
|
Callers comparing a live secret against the ``secret_fingerprint`` left on
|
|
a sanitized (borrowed) pool row need exactly the digest this module writes.
|
|
"""
|
|
if value is None:
|
|
return None
|
|
text = str(value)
|
|
if not text:
|
|
return None
|
|
digest = hashlib.sha256(text.encode("utf-8", errors="surrogatepass")).hexdigest()
|
|
return f"sha256:{digest[:16]}"
|
|
|
|
|
|
def _credential_secret_fingerprint(payload: Mapping[str, Any]) -> str | None:
|
|
for key in ("agent_key", "access_token", "refresh_token", "api_key", "token", "secret"):
|
|
fingerprint = fingerprint_secret_value(payload.get(key))
|
|
if fingerprint:
|
|
return fingerprint
|
|
for key, value in payload.items():
|
|
if _is_secret_payload_key(key):
|
|
fingerprint = fingerprint_secret_value(value)
|
|
if fingerprint:
|
|
return fingerprint
|
|
existing = payload.get("secret_fingerprint")
|
|
if isinstance(existing, str) and existing.startswith("sha256:"):
|
|
return existing
|
|
return None
|
|
|
|
|
|
def sanitize_borrowed_credential_payload(
|
|
payload: Mapping[str, Any],
|
|
provider_id: Any = None,
|
|
) -> Dict[str, Any]:
|
|
"""Return a disk-safe credential-pool payload.
|
|
|
|
Owned sources pass through unchanged. Borrowed sources keep labels,
|
|
source refs, status/cooldown metadata, counters and a fingerprint, but
|
|
every raw secret value field is removed.
|
|
"""
|
|
result = dict(payload)
|
|
if not is_borrowed_credential_source(result.get("source"), provider_id):
|
|
return result
|
|
fingerprint = _credential_secret_fingerprint(result)
|
|
sanitized = {k: v for k, v in result.items() if not _is_secret_payload_key(k)}
|
|
if fingerprint:
|
|
sanitized["secret_fingerprint"] = fingerprint
|
|
return sanitized
|