@clawpump/claw-agent 0.1.4 → 0.1.6

package/agent/hermes_cli/dashboard_auth/middleware.py

@@ -38,6 +38,7 @@ _log = logging.getLogger(__name__)
 _GATE_PUBLIC_PREFIXES: tuple[str, ...] = (
     "/auth/login",
     "/auth/callback",
+    "/auth/password-login",
     "/auth/logout",
     "/login",
     "/api/auth/providers",
@@ -206,6 +207,22 @@ async def gated_auth_middleware(
     # good refresh token — defeating the whole transparent-refresh feature.
     session = None
     if at:
+        # Try every registered provider's verify_session in turn. A provider
+        # that doesn't recognise the token returns None and we move on; the
+        # first provider that returns a Session wins.
+        #
+        # A provider may instead raise ProviderError (its IDP/JWKS is
+        # unreachable, so it can neither confirm nor deny the token). With
+        # multiple providers stacked, that MUST NOT abort the chain — the
+        # token may belong to a *different*, reachable provider. (Concretely:
+        # a self-hosted-OIDC session hits the `nous` provider first, which
+        # tries to reach Nous Portal's JWKS; if that's unreachable it raises,
+        # but the `self-hosted` provider can still verify the token.) So we
+        # remember the unreachable error and keep going. Only if NO provider
+        # verifies the token AND at least one was unreachable do we surface a
+        # 503 — distinguishing "transient IDP outage" (don't force re-login)
+        # from "token genuinely invalid" (fall through to refresh/relogin).
+        unreachable_provider: str | None = None
         for provider in list_providers():
             try:
                 session = provider.verify_session(access_token=at)
@@ -220,12 +237,19 @@ async def gated_auth_middleware(
                     reason="provider_unreachable",
                     ip=_client_ip(request),
                 )
-                return JSONResponse(
-                    {"detail": f"Auth provider {provider.name!r} unreachable"},
-                    status_code=503,
-                )
+                if unreachable_provider is None:
+                    unreachable_provider = provider.name
+                continue
             if session is not None:
                 break
+        if session is None and unreachable_provider is not None:
+            # No provider could verify the token and at least one couldn't be
+            # reached — treat as a transient outage rather than forcing a
+            # re-login through a (possibly also-unreachable) refresh.
+            return JSONResponse(
+                {"detail": f"Auth provider {unreachable_provider!r} unreachable"},
+                status_code=503,
+            )
 
     if session is None:
         # Access token is expired/invalid. Before forcing re-login, try to

package/agent/hermes_cli/dashboard_auth/prefix.py

@@ -31,6 +31,46 @@ _log = logging.getLogger(__name__)
 # rather than try to sanitise — the operator can fix their config.
 _REJECT_CHARS = frozenset(('"', "'", "<", ">", " ", "\n", "\r", "\t"))
 
+# Remember which (source, value) pairs we've already warned about.
+# ``resolve_public_url`` runs on every authenticated request, so an
+# un-deduplicated warning would flood the logs once per request for a
+# misconfigured deploy. Keyed on the raw value too, so changing the
+# config and reloading surfaces a fresh warning.
+_warned_malformed_public_urls: set = set()
+
+
+def _warn_if_malformed(source: str, raw: str) -> None:
+    """Warn (once per distinct value) when a non-empty public-url value
+    was rejected by :func:`_normalise_public_url`.
+
+    A non-empty value that normalises to ``""`` is almost always a
+    missing scheme (``hermes.example.com`` instead of
+    ``https://hermes.example.com``) — the single most common cause of
+    "I set HERMES_DASHBOARD_PUBLIC_URL but the OAuth callback is still
+    http://". Without this warning the value is silently discarded and
+    the dashboard falls back to reconstructing the redirect URI from
+    request headers, which behind a reverse proxy can yield the wrong
+    scheme. Surfacing it turns a silent footgun into a self-diagnosing
+    one.
+    """
+    cleaned = raw.strip() if raw else ""
+    if not cleaned:
+        return  # empty/unset is a legitimate "no override" — not malformed
+    key = (source, cleaned)
+    if key in _warned_malformed_public_urls:
+        return
+    _warned_malformed_public_urls.add(key)
+    _log.warning(
+        "%s is set to %r but was ignored because it is not a valid "
+        "absolute URL — it must include an http:// or https:// scheme "
+        "(e.g. https://%s). Falling back to reconstructing the OAuth "
+        "redirect URI from request headers, which may produce the wrong "
+        "scheme behind a reverse proxy.",
+        source,
+        cleaned,
+        cleaned.split("://")[-1] or "hermes.example.com",
+    )
+
 
 def normalise_prefix(raw: Optional[str]) -> str:
     """Normalise an X-Forwarded-Prefix header value.
@@ -153,5 +193,9 @@ def resolve_public_url() -> str:
     env_clean = _normalise_public_url(env_raw)
     if env_clean:
         return env_clean
-    cfg_raw = _load_dashboard_section().get("public_url", "")
-    return _normalise_public_url(str(cfg_raw))
+    _warn_if_malformed("HERMES_DASHBOARD_PUBLIC_URL env var", env_raw)
+    cfg_raw = str(_load_dashboard_section().get("public_url", ""))
+    cfg_clean = _normalise_public_url(cfg_raw)
+    if not cfg_clean:
+        _warn_if_malformed("dashboard.public_url in config.yaml", cfg_raw)
+    return cfg_clean

package/agent/hermes_cli/dashboard_auth/public_paths.py

@@ -46,4 +46,10 @@ PUBLIC_API_PATHS: frozenset[str] = frozenset({
     # Read-only theme + plugin manifests for the dashboard skin engine.
     "/api/dashboard/themes",
     "/api/dashboard/plugins",
+    # Chronos managed-cron fire webhook (NAS -> agent). NOT cookie-gated: it
+    # carries its own short-lived NAS-minted JWT (purpose=cron_fire), which the
+    # handler verifies as the real auth. Must bypass the dashboard auth gate so
+    # the NAS relay's bearer-only callback reaches the verifier instead of a
+    # 401 no_cookie. The JWT — not this allowlist — is the security boundary.
+    "/api/cron/fire",
 })

package/agent/hermes_cli/dashboard_auth/routes.py

@@ -16,11 +16,14 @@ The routes:
 from __future__ import annotations
 
 import logging
+import threading
 import time
-from typing import Any
+from collections import defaultdict, deque
+from typing import Any, Deque, Dict, Tuple
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from pydantic import BaseModel
 
 from hermes_cli.dashboard_auth import (
     get_provider,
@@ -29,6 +32,7 @@ from hermes_cli.dashboard_auth import (
 from hermes_cli.dashboard_auth.audit import AuditEvent, audit_log
 from hermes_cli.dashboard_auth.base import (
     InvalidCodeError,
+    InvalidCredentialsError,
     ProviderError,
 )
 from hermes_cli.dashboard_auth.cookies import (
@@ -154,7 +158,13 @@ async def api_auth_providers() -> Any:
         )
     return {
         "providers": [
-            {"name": p.name, "display_name": p.display_name}
+            {
+                "name": p.name,
+                "display_name": p.display_name,
+                "supports_password": bool(
+                    getattr(p, "supports_password", False)
+                ),
+            }
             for p in providers
         ],
     }
@@ -377,6 +387,152 @@ def _validate_post_login_target(raw: str) -> str:
     return decoded
 
 
+# ---------------------------------------------------------------------------
+# Public: password (non-redirect) login
+# ---------------------------------------------------------------------------
+#
+# Brute-force throttle. The OAuth flow has no guessable secret on our side
+# (the IDP owns credentials), but ``/auth/password-login`` accepts a
+# password we verify locally, so it's a credential-stuffing target. A
+# simple in-process sliding-window limiter per client IP raises the cost
+# of online guessing without any external dependency. It is intentionally
+# best-effort: process-local (resets on restart), and behind a trusting
+# proxy the IP is the proxy's unless X-Forwarded-For is set — which is why
+# this is defence-in-depth on top of the provider's own constant-time
+# verify, not the only line of defence.
+
+_PW_RATE_MAX_ATTEMPTS = 10
+_PW_RATE_WINDOW_SEC = 60.0
+_pw_attempts: Dict[str, Deque[float]] = defaultdict(deque)
+_pw_attempts_lock = threading.Lock()
+
+
+def _password_rate_limited(ip: str) -> bool:
+    """True if ``ip`` has exceeded the password-login attempt budget.
+
+    Sliding window: prune attempts older than the window, then check the
+    count. Records the attempt timestamp when allowed. An empty IP (no
+    discernible client) shares a single bucket — fail-safe toward
+    throttling rather than letting unattributable traffic through
+    unmetered.
+    """
+    now = time.monotonic()
+    cutoff = now - _PW_RATE_WINDOW_SEC
+    key = ip or "_unknown_"
+    with _pw_attempts_lock:
+        bucket = _pw_attempts[key]
+        while bucket and bucket[0] < cutoff:
+            bucket.popleft()
+        if len(bucket) >= _PW_RATE_MAX_ATTEMPTS:
+            return True
+        bucket.append(now)
+        return False
+
+
+def _reset_password_rate_limit() -> None:
+    """Test-only: clear all rate-limit buckets."""
+    with _pw_attempts_lock:
+        _pw_attempts.clear()
+
+
+class _PasswordLoginBody(BaseModel):
+    provider: str
+    username: str
+    password: str
+    next: str = ""
+
+
+@router.post("/auth/password-login", name="auth_password_login")
+async def auth_password_login(request: Request, body: _PasswordLoginBody):
+    """Authenticate a username/password against a password provider.
+
+    Mirrors the cookie-minting tail of ``/auth/callback`` but skips the
+    PKCE/state/code machinery (those are OAuth-only). On success sets the
+    session cookies and returns JSON ``{"ok": true, "next": <path>}`` —
+    the credential form POSTs via fetch and navigates client-side, so a
+    302 (which fetch follows opaquely) is the wrong shape here.
+
+    Failure modes, all deliberately generic so the endpoint can't be used
+    as a username oracle or a provider-enumeration oracle:
+      * unknown provider / provider lacks password support → 404
+      * bad credentials → 401 ("Invalid credentials")
+      * backing store unreachable → 503
+      * too many attempts from this IP → 429
+    """
+    ip = _client_ip(request)
+    if _password_rate_limited(ip):
+        audit_log(
+            AuditEvent.LOGIN_FAILURE,
+            provider=body.provider,
+            reason="rate_limited",
+            ip=ip,
+        )
+        raise HTTPException(
+            status_code=429,
+            detail="Too many login attempts. Try again shortly.",
+        )
+
+    p = get_provider(body.provider)
+    if p is None or not getattr(p, "supports_password", False):
+        # Don't leak which providers exist or which support passwords —
+        # same 404 whether the provider is unknown or OAuth-only.
+        audit_log(
+            AuditEvent.LOGIN_FAILURE,
+            provider=body.provider,
+            reason="unknown_password_provider",
+            ip=ip,
+        )
+        raise HTTPException(status_code=404, detail="Unknown provider")
+
+    try:
+        session = p.complete_password_login(
+            username=body.username, password=body.password
+        )
+    except InvalidCredentialsError:
+        audit_log(
+            AuditEvent.LOGIN_FAILURE,
+            provider=body.provider,
+            reason="invalid_credentials",
+            ip=ip,
+        )
+        # Generic message — never distinguish unknown-user from wrong-password.
+        raise HTTPException(status_code=401, detail="Invalid credentials")
+    except NotImplementedError:
+        # supports_password was True but the method isn't actually
+        # implemented — a provider bug, not a client error.
+        raise HTTPException(status_code=500, detail="Provider misconfigured")
+    except ProviderError as e:
+        audit_log(
+            AuditEvent.LOGIN_FAILURE,
+            provider=body.provider,
+            reason="provider_unreachable",
+            ip=ip,
+        )
+        raise HTTPException(status_code=503, detail=f"Provider unreachable: {e}")
+
+    audit_log(
+        AuditEvent.LOGIN_SUCCESS,
+        provider=body.provider,
+        user_id=session.user_id,
+        email=session.email,
+        org_id=session.org_id,
+        ip=ip,
+    )
+
+    expires_in = max(60, session.expires_at - int(time.time()))
+    landing = _validate_post_login_target(body.next) or "/"
+    resp = JSONResponse({"ok": True, "next": landing})
+    set_session_cookies(
+        resp,
+        access_token=session.access_token,
+        refresh_token=session.refresh_token,
+        access_token_expires_in=expires_in,
+        use_https=detect_https(request),
+        prefix=_prefix(request),
+    )
+    return resp
+
+
 @router.post("/auth/logout", name="auth_logout")
 async def auth_logout(request: Request):
     _at, rt = read_session_cookies(request)

package/agent/hermes_cli/dashboard_auth/ws_tickets.py

@@ -1,16 +1,32 @@
-"""Short-lived single-use tickets for WS-upgrade auth in gated mode.
+"""WS-upgrade auth credentials for gated mode.
 
 Browsers cannot set ``Authorization`` on a WebSocket upgrade. In loopback
 mode the legacy ``?token=<_SESSION_TOKEN>`` query param works because the
 token is injected into the SPA bundle. In gated mode there is no injected
-token — the SPA gets a fresh ticket via the authenticated REST endpoint
-``POST /api/auth/ws-ticket`` and passes that as ``?ticket=`` on the
-WS upgrade.
-
-Tickets are single-use, TTL = 30 seconds. In-memory; the dashboard is a
-single process so no distributed coordination is needed. The module
-exposes a small functional API rather than a class so tests can patch
-``time.time`` cleanly.
+token — so this module provides two credential shapes:
+
+1. **Single-use browser tickets** (``mint_ticket`` / ``consume_ticket``).
+   The SPA gets a fresh ticket via the authenticated REST endpoint
+   ``POST /api/auth/ws-ticket`` and passes it as ``?ticket=`` on the WS
+   upgrade. Single-use, TTL = 30 seconds — a leaked ticket is uninteresting.
+
+2. **A process-lifetime internal credential** (``internal_ws_credential`` /
+   ``consume_internal_credential``). This authenticates *server-spawned*
+   WS clients — specifically the embedded-TUI PTY child, which attaches to
+   ``/api/ws`` (JSON-RPC gateway) and ``/api/pub`` (event sidecar) over
+   loopback. A single-use 30s ticket is the wrong shape for that link: the
+   child reads its attach URL once at startup and **reuses it on every
+   reconnect**, and on a slow cold boot the child may not dial within 30s.
+   The internal credential is minted once per process, never expires, is
+   multi-use, and — critically — is **never injected into any HTML/SPA**:
+   it only ever leaves the process via the spawned child's environment, so
+   browser-side XSS cannot read it. A leaked internal credential grants no
+   more than a single-use ticket already does (the same two internal WS
+   endpoints), and the same Origin / host guards still apply downstream.
+
+In-memory; the dashboard is a single process so no distributed coordination
+is needed. The module exposes a small functional API rather than a class so
+tests can patch ``time.time`` cleanly.
 """
 
 from __future__ import annotations
@@ -18,7 +34,7 @@ from __future__ import annotations
 import secrets
 import threading
 import time
-from typing import Any, Dict, Tuple
+from typing import Any, Dict, Optional, Tuple
 
 #: Time-to-live for newly-minted tickets in seconds. 30 s is long enough
 #: that the SPA can call ``getWsTicket()`` and immediately open the WS,
@@ -28,6 +44,16 @@ TTL_SECONDS = 30
 _lock = threading.Lock()
 _tickets: Dict[str, Tuple[int, Dict[str, Any]]] = {}  # ticket -> (expires_at, info)
 
+#: The process-lifetime internal credential (see module docstring). Lazily
+#: minted on first ``internal_ws_credential()`` call and stable for the life
+#: of the process. Guarded by ``_lock``.
+_internal_credential: Optional[str] = None
+
+#: Identity recorded for connections that authenticate via the internal
+#: credential, so audit logs distinguish them from browser-initiated tickets.
+INTERNAL_USER_ID = "server-internal"
+INTERNAL_PROVIDER = "server-internal"
+
 
 class TicketInvalid(Exception):
     """Ticket missing, expired, or already consumed."""
@@ -81,7 +107,55 @@ def _gc_expired_locked() -> None:
         _tickets.pop(t, None)
 
 
+def internal_ws_credential() -> str:
+    """Return the process-lifetime internal WS credential, minting it once.
+
+    Used by the server to authenticate WS clients it spawns itself (the
+    embedded-TUI PTY child). The value is stable for the life of the process,
+    multi-use, and never expires — so a server-spawned child can reconnect
+    its ``/api/ws`` / ``/api/pub`` sockets indefinitely without re-minting.
+
+    The credential is never injected into the SPA HTML or returned over any
+    REST endpoint; it is only ever passed to a child process via its
+    environment. See the module docstring for the threat-model rationale.
+    """
+    global _internal_credential
+    with _lock:
+        if _internal_credential is None:
+            _internal_credential = secrets.token_urlsafe(32)
+        return _internal_credential
+
+
+def consume_internal_credential(value: str) -> Dict[str, Any]:
+    """Validate an internal credential. Raises :class:`TicketInvalid` on mismatch.
+
+    Unlike :func:`consume_ticket` this is **not** single-use — the value is
+    not removed on success, so a server-spawned child can present it on every
+    (re)connect. Returns the fixed server-internal identity ``info`` dict
+    (``{user_id, provider}``), mirroring the ``info`` shape ``consume_ticket``
+    returns, so a caller that wants to record the connecting identity can; the
+    current ``_ws_auth_ok`` caller validates for the boolean outcome only and
+    discards the dict.
+
+    A constant-time compare against the (lazily-minted) credential avoids
+    leaking length / prefix information on mismatch. If no internal
+    credential has been minted yet, any value is rejected.
+    """
+    with _lock:
+        expected = _internal_credential
+    if not value or expected is None:
+        raise TicketInvalid("no internal credential")
+    if not secrets.compare_digest(value.encode(), expected.encode()):
+        raise TicketInvalid("internal credential mismatch")
+    return {
+        "user_id": INTERNAL_USER_ID,
+        "provider": INTERNAL_PROVIDER,
+    }
+
+
 def _reset_for_tests() -> None:
-    """Test-only: drop all tickets."""
+    """Test-only: drop all tickets and the internal credential."""
+    global _internal_credential
     with _lock:
         _tickets.clear()
+        _internal_credential = None