sj,!TdZddlmZddlZddlZddlZddlZddlZddlZ ddl Z ddl m Z m Z ddlmZddlmZejeZeddhZd d d Zd Zd$dZGdde jjZGdde jjZd%dZddd&dZ dddd'd"Z!gd#Z"dS)(z>Security policy for credential-bearing stdlib urllib requests.) annotationsN)CallableIterable)Path)Anyacceptz user-agentPi)httphttps)HERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLEurlstrreturntuple[str, str, int | None]ctj|}|jpd}|j}||jpdd||nt |fS)z>Return a normalized (scheme, hostname, effective port) origin..) urllibparseurlparseschemelowerporthostnamerstrip_DEFAULT_PORTSget)rparsedrrs >/home/agent/.hermes/hermes-agent/hermes_cli/urllib_security.py url_originr#s \ " "3 ' 'Fm!r ( ( * *F ;D  B%%''..s33 n&8&8&@&@ c0eZdZdZedd d Zfd ZxZS) SafeCredentialRedirectHandlerzAPreserve request headers only while redirects stay on one origin.)cross_origin_safe_headers original_urlrr' Iterable[str]rNonecjt||_td|D|_dS)Nc3XK|]%}t|V&dSN)rr).0names r" z9SafeCredentialRedirectHandler.__init__..6sC4 4 "&CIIOO  4 4 4 4 4 4 r$)r#_original_origin frozenset_cross_origin_safe_headers)selfr(r's r"__init__z&SafeCredentialRedirectHandler.__init__/sH !+< 8 8*34 4 *C4 4 4 + + '''r$ct||||||}|dStj|j|}t ||jkrWt| D]5\} } | |j vr| | 6|Sr-) superredirect_requestrrurljoinfull_urlr#r1list header_itemsrr3 remove_header) r4reqfpcodemsgheadersnewurl redirected resolved_urlr/_value __class__s r"r8z.SafeCredentialRedirectHandler.redirect_request:sWW--c2tS'6RR  4|++CL&AA l # #t'< < <!%Z%<%<%>%> ? ? 3 3 f::<.fsZ  4,,22444       r$r)cafileuRCA bundle could not be loaded from %s: %s — falling back to default certificatesNuJCA bundle path does not exist: %s — falling back to default certificatesdarwinruaCould not load certifi for urllib HTTPS verification: %s — falling back to default certificates)next_CA_BUNDLE_ENV_VARSr expanduseris_filesslcreate_default_contextrOSErrorSSLErrorloggerwarningsysplatformcertifiwhere ImportError) ca_bundleca_pathexcrpras @r"_resolved_https_contextrvcs    +   Iy//,,.. ??    1WFFFFS\*   h  NN\     |xt )AAAA #, / o    ttttt s0!A==B9B44B9**DE1EE ssl_contextr(c ttjdd}|lt}|tj}n=tjtj|}ttjddfdt|ddD}!||t||t|tjj|}t|dtt|d dg|_ |S) aClone the installed opener's handlers, replacing redirect policy only. When ``ssl_context`` is provided, the cloned HTTPS handler is replaced with one bound to that context so per-provider TLS settings (``ssl_ca_cert`` / ``ssl_verify``) apply to this request. When it is None, Hermes-owned openers get an explicit CA default via ``_resolved_https_context`` (env bundle first, certifi on macOS); an application-installed opener's TLS policy is preserved unchanged. _openerN)context HTTPSHandlercg|]I}t|tjjs(t|5t j|JSr-) isinstancerrRHTTPRedirectHandlercopy)r.handler_https_handler_clsrxs r" z8_secure_opener_from_installed_policy..sg    '6>#EFF   #".7$677/ ' /..r$handlersrZ_hermes_initial_addheaders addheaders) getattrrrRrv build_openerr|appendr&rOsetattrr;r)r(rx installedr{rsecuredrs ` @r"$_secure_opener_from_installed_policyrst 488I)++ ?3355II33++G+<<I!FF     y*b99   H#5#A**;???@@@ OO1,??@@@ OO0>>???n)84G $ WY b 1 122 G Nr$)opener_factoryrxrRrStimeoutrVrCallable[..., Any] | Nonec |Yt|j|}t|ddD]0\}}||s|||1n|t |j}|||S)aOpen a request without forwarding credentials across origins. The default preserves an application-installed opener's proxy, TLS, cookies, custom protocol handlers, and instrumentation while replacing its redirect handler. ``opener_factory`` is an explicit test seam; security is never disabled based on global ``urlopen`` identity. ``ssl_context`` (an ``ssl.SSLContext``) overrides the HTTPS handler's TLS policy for this request only. It is used to honor a custom provider's ``ssl_ca_cert`` / ``ssl_verify`` on the ``/models`` discovery path, which otherwise falls back to the process-wide ``SSL_CERT_FILE`` / certifi bundle. NrwrrZ)r)rr:r has_header add_headerr&open)rRrrrxopenerr/ras r"open_credentialed_urlrs&5  +   #6+GLL 0 0KD%%%d++ 0""4/// 0  =g>N O OPP ;;w; 0 00r$)r&rr#)rrrr)rr[)r(r)rRrSrrVrr)#rK __future__rrloggingr^rhrn urllib.parserurllib.requestcollections.abcrrpathlibrtypingr getLoggerrHrlr2rLrrer#rRrr& BaseHandlerrOrvrr__all__rZr$r"rsDD""""""  ........  8 $ $'Y,'?@@s++    FN$F<6>#=2''''TLP------h15 111111>   r$