77 lines
3.9 KiB
Python
77 lines
3.9 KiB
Python
"""Solstice sign-in: browser PKCE with a loopback redirect, token exchange and refresh brokered by the
|
|
Nous portal (NAS), which holds the confidential client secret. Hermes keeps its own PKCE verifier and
|
|
the user's tokens; NAS never sees a prompt.
|
|
|
|
The generic ``hermes_cli.auth_oauth_pkce_plugin`` flow runs the browser leg, the credential-pool row
|
|
and the single-use-safe refresh. This module supplies only what is NAS-specific: the client config it
|
|
discovers and the token POSTs it brokers. Every NAS call carries the user's Nous access token.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any, Dict, Mapping
|
|
|
|
DEFAULT_NAS_BASE_URL = "https://portal.nousresearch.com"
|
|
_CONFIG_PATH = "/api/oauth/gemini-auth/config"
|
|
_TOKEN_PATHS = {"authorization_code": "/api/oauth/gemini-auth/exchange", "refresh_token": "/api/oauth/gemini-auth/refresh"}
|
|
_TIMEOUT_SECONDS = 30.0
|
|
|
|
|
|
def _err(message: str, code: str, *, relogin: bool = False):
|
|
from hermes_cli.auth_constants import AuthError
|
|
return AuthError(f"solstice: {message}", provider="solstice", code=code, relogin_required=relogin)
|
|
|
|
|
|
def _nas_base_url() -> str:
|
|
"""The Nous portal the user is signed into (``HERMES_PORTAL_BASE_URL`` override first)."""
|
|
from hermes_cli.auth import _nous_portal_base_url, get_provider_auth_state
|
|
return _nous_portal_base_url(get_provider_auth_state("nous") or {})
|
|
|
|
|
|
def _nas_request(method: str, path: str, *, json: Mapping[str, Any] | None = None) -> dict[str, Any]:
|
|
from hermes_cli.auth import _default_verify, resolve_nous_access_token
|
|
from hermes_cli.auth_constants import httpx
|
|
|
|
try:
|
|
token = resolve_nous_access_token()
|
|
except Exception as exc:
|
|
raise _err("sign in to Nous Portal first (`hermes auth add nous`).", "solstice_nous_login_required",
|
|
relogin=True) from exc
|
|
try:
|
|
response = httpx.request(method, _nas_base_url() + path, json=json, timeout=_TIMEOUT_SECONDS,
|
|
headers={"Accept": "application/json", "Authorization": f"Bearer {token}"},
|
|
verify=_default_verify())
|
|
except Exception as exc:
|
|
raise _err(f"Nous portal request failed: {type(exc).__name__}", "solstice_broker_unreachable") from exc
|
|
if response.status_code == 404:
|
|
raise _err("not available on this Nous account yet.", "solstice_not_configured")
|
|
if response.status_code >= 400:
|
|
raise _err(f"Nous portal returned HTTP {response.status_code}.", "solstice_broker_failed")
|
|
return response.json()
|
|
|
|
|
|
def discover_client() -> dict[str, str]:
|
|
"""``client_id`` / ``authorize_url`` / ``scope`` NAS serves for the shared Google client."""
|
|
payload = _nas_request("GET", _CONFIG_PATH)
|
|
missing = [k for k in ("client_id", "authorize_url", "scope") if not str(payload.get(k) or "").strip()]
|
|
if missing:
|
|
raise _err(f"Nous portal config is missing {', '.join(missing)}.", "solstice_config_invalid")
|
|
return {k: str(payload[k]).strip() for k in ("client_id", "authorize_url", "scope")}
|
|
|
|
|
|
def broker_token_request(grant: Mapping[str, str]) -> Mapping[str, Any]:
|
|
"""``OAuthPKCEConfig.token_request``: send the grant to NAS, which adds the client secret.
|
|
|
|
NAS folds every Google token-endpoint failure into HTTP 502, so a refresh it rejects is treated as
|
|
a dead grant (re-login) rather than retried against a token Google already refused.
|
|
"""
|
|
path = _TOKEN_PATHS[grant["grant_type"]]
|
|
body = {k: v for k, v in grant.items() if k in ("code", "code_verifier", "redirect_uri", "refresh_token")}
|
|
try:
|
|
return _nas_request("POST", path, json=body)
|
|
except Exception as exc:
|
|
if grant["grant_type"] == "refresh_token" and getattr(exc, "code", "") == "solstice_broker_failed":
|
|
raise _err("the stored sign-in was rejected; run `hermes auth add solstice` again.",
|
|
"invalid_grant", relogin=True) from exc
|
|
raise
|