424 lines
14 KiB
Python
424 lines
14 KiB
Python
"""RoomLink room-member grants and capability HTTP handlers."""
|
|
|
|
import time
|
|
import uuid
|
|
from typing import Any
|
|
|
|
try:
|
|
from aiohttp import web
|
|
except ImportError:
|
|
web = None # type: ignore[assignment]
|
|
|
|
|
|
class RoomGrantReauthorizationRequired(ValueError):
|
|
"""A validly signed room grant was revoked or superseded."""
|
|
|
|
|
|
def _require_unchanged_execution_policy(
|
|
claims: dict[str, Any],
|
|
execution_policy: dict[str, Any],
|
|
) -> None:
|
|
"""Keep renewal from silently granting a changed execution policy."""
|
|
if (
|
|
str(execution_policy.get("policy_digest") or "")
|
|
!= str(claims.get("execution_policy_digest") or "")
|
|
):
|
|
raise RoomGrantReauthorizationRequired(
|
|
"room execution policy changed"
|
|
)
|
|
|
|
|
|
def _room_grant_error_response(exc: Exception, *, _openai_error) -> "web.Response":
|
|
reauthorization = isinstance(exc, RoomGrantReauthorizationRequired)
|
|
return web.json_response(
|
|
_openai_error(
|
|
(
|
|
"Room authorization needs to be renewed."
|
|
if reauthorization
|
|
else "Room authorization is invalid or expired."
|
|
),
|
|
err_type="gateway_auth_error",
|
|
code=(
|
|
"room_reauthorization_required"
|
|
if reauthorization
|
|
else "invalid_room_grant"
|
|
),
|
|
),
|
|
status=403 if reauthorization else 401,
|
|
)
|
|
|
|
|
|
def _http_routes(self) -> list[tuple[str, str, Any]]:
|
|
return [
|
|
(
|
|
"POST",
|
|
"/v1/room-members/invitations",
|
|
self._handle_room_member_invitation,
|
|
),
|
|
(
|
|
"GET",
|
|
"/v1/room-members/capabilities",
|
|
self._handle_room_member_capabilities,
|
|
),
|
|
(
|
|
"POST",
|
|
"/v1/room-members/grants/refresh",
|
|
self._handle_room_member_grant_refresh,
|
|
),
|
|
(
|
|
"POST",
|
|
"/v1/room-members/grants/revoke",
|
|
self._handle_room_member_grant_revoke,
|
|
),
|
|
]
|
|
|
|
|
|
def _room_grant_token(request: "web.Request") -> str:
|
|
authorization = str(request.headers.get("Authorization") or "")
|
|
scheme, separator, token = authorization.partition(" ")
|
|
if not separator or scheme.lower() != "hermesroom":
|
|
return ""
|
|
return token.strip()
|
|
|
|
|
|
def _room_grant_secret(self) -> bytes:
|
|
from gateway.hosted_room_peer import gateway_room_grant_secret
|
|
|
|
return gateway_room_grant_secret()
|
|
|
|
|
|
def _room_grant_claims(
|
|
self,
|
|
request: "web.Request",
|
|
*,
|
|
permission: str,
|
|
) -> dict[str, Any]:
|
|
from gateway.hosted_room_peer import decode_room_grant
|
|
|
|
token = self._room_grant_token(request)
|
|
if not token:
|
|
raise ValueError("room grant is missing")
|
|
claims = decode_room_grant(
|
|
self._room_grant_secret(),
|
|
token,
|
|
permission=permission,
|
|
)
|
|
from gateway import hosted_rooms
|
|
|
|
if hosted_rooms.room_grant_is_revoked(
|
|
hosted_rooms.default_db_path(),
|
|
claims=claims,
|
|
):
|
|
raise RoomGrantReauthorizationRequired("room grant is revoked")
|
|
if not hosted_rooms.peer_room_grant_is_current(
|
|
hosted_rooms.default_db_path(),
|
|
claims=claims,
|
|
):
|
|
raise RoomGrantReauthorizationRequired("room grant is no longer current")
|
|
return claims
|
|
|
|
|
|
async def _handle_room_member_invitation(
|
|
self,
|
|
request: "web.Request",
|
|
*,
|
|
_openai_error,
|
|
_api_request_profile,
|
|
) -> "web.Response":
|
|
"""Mint a short-lived room/profile grant for a trusted home gateway."""
|
|
auth_err = self._check_auth(request)
|
|
if auth_err:
|
|
return auth_err
|
|
body, error = await self._read_json_body(request)
|
|
if error:
|
|
return error
|
|
required = {
|
|
"room_id",
|
|
"home_install_id",
|
|
"authority_gateway_id",
|
|
"authority_epoch",
|
|
"member_id",
|
|
}
|
|
allowed = required | {"grant_id", "ttl_seconds", "status_ttl_seconds"}
|
|
if set(body) - allowed or not required <= set(body):
|
|
return web.json_response(
|
|
_openai_error(
|
|
"Invitation is missing required room authority fields.",
|
|
code="invalid_room_invitation",
|
|
),
|
|
status=400,
|
|
)
|
|
try:
|
|
from gateway import hosted_rooms
|
|
from gateway.hosted_room_peer import (
|
|
PROTOCOL_VERSION as ROOM_LINK_PROTOCOL_VERSION,
|
|
catalog_mapping,
|
|
decode_room_grant,
|
|
issue_room_grant,
|
|
)
|
|
from gateway.hosted_room_execution_policy import execution_policy_mapping
|
|
|
|
profile = _api_request_profile.get() or "default"
|
|
target_install_id = hosted_rooms.local_authority_gateway_id()
|
|
ttl = float(body.get("ttl_seconds", 3600))
|
|
if not 60 <= ttl <= 24 * 60 * 60:
|
|
raise ValueError("ttl_seconds must be between 60 and 86400")
|
|
status_ttl = float(body.get("status_ttl_seconds", ttl))
|
|
if not ttl <= status_ttl <= 30 * 24 * 60 * 60:
|
|
raise ValueError(
|
|
"status_ttl_seconds must be at least ttl_seconds and no more than 2592000"
|
|
)
|
|
with self._profile_scope(profile):
|
|
execution_policy = execution_policy_mapping(target_profile=profile)
|
|
catalog = catalog_mapping(
|
|
installation_id=target_install_id,
|
|
protocol_versions=(ROOM_LINK_PROTOCOL_VERSION,),
|
|
link_modes=("direct",),
|
|
persistent_process=True,
|
|
text=True,
|
|
attachments=False,
|
|
target_profile=profile,
|
|
execution_policy=execution_policy,
|
|
)
|
|
token = issue_room_grant(
|
|
self._room_grant_secret(),
|
|
grant_id=str(body.get("grant_id") or f"grant-{uuid.uuid4().hex}"),
|
|
room_id=str(body["room_id"]),
|
|
home_install_id=str(body["home_install_id"]),
|
|
authority_gateway_id=str(body["authority_gateway_id"]),
|
|
authority_epoch=int(body["authority_epoch"]),
|
|
member_id=str(body["member_id"]),
|
|
target_install_id=target_install_id,
|
|
target_profile=profile,
|
|
execution_policy_digest=execution_policy["policy_digest"],
|
|
issued_at=time.time(),
|
|
ttl_seconds=ttl,
|
|
status_ttl_seconds=status_ttl,
|
|
)
|
|
claims = decode_room_grant(
|
|
self._room_grant_secret(), token, permission="status"
|
|
)
|
|
hosted_rooms.reserve_peer_room(
|
|
hosted_rooms.default_db_path(),
|
|
claims=claims,
|
|
expires_at=float(claims.get("status_expires_at", claims["expires_at"])),
|
|
)
|
|
except Exception as exc:
|
|
return web.json_response(
|
|
_openai_error(str(exc), code="invalid_room_invitation"),
|
|
status=400,
|
|
)
|
|
return web.json_response(
|
|
{
|
|
"object": "hermes.room_member.invitation",
|
|
"grant": token,
|
|
"target_profile": profile,
|
|
"catalog": catalog,
|
|
"expires_at": float(claims["expires_at"]),
|
|
"status_expires_at": float(claims["status_expires_at"]),
|
|
},
|
|
status=201,
|
|
)
|
|
|
|
|
|
async def _handle_room_member_capabilities(
|
|
self,
|
|
request: "web.Request",
|
|
*,
|
|
_openai_error,
|
|
_api_request_profile,
|
|
) -> "web.Response":
|
|
"""Verify a scoped grant and return this target's live room catalog."""
|
|
try:
|
|
from gateway import hosted_rooms
|
|
from gateway.hosted_room_peer import (
|
|
PROTOCOL_VERSION as ROOM_LINK_PROTOCOL_VERSION,
|
|
catalog_mapping,
|
|
)
|
|
from gateway.hosted_room_execution_policy import execution_policy_mapping
|
|
|
|
claims = self._room_grant_claims(request, permission="status")
|
|
profile = _api_request_profile.get() or "default"
|
|
installation_id = hosted_rooms.local_authority_gateway_id()
|
|
if (
|
|
claims["target_profile"] != profile
|
|
or claims["target_install_id"] != installation_id
|
|
):
|
|
raise ValueError("room grant target does not match this profile")
|
|
with self._profile_scope(profile):
|
|
execution_policy = execution_policy_mapping(target_profile=profile)
|
|
catalog = catalog_mapping(
|
|
installation_id=installation_id,
|
|
protocol_versions=(ROOM_LINK_PROTOCOL_VERSION,),
|
|
link_modes=("direct",),
|
|
persistent_process=True,
|
|
text=True,
|
|
attachments=False,
|
|
target_profile=profile,
|
|
execution_policy=execution_policy,
|
|
)
|
|
except Exception as exc:
|
|
return _room_grant_error_response(exc, _openai_error=_openai_error)
|
|
return web.json_response(
|
|
{
|
|
"object": "hermes.room_member.capabilities",
|
|
"room_id": claims["room_id"],
|
|
"home_install_id": claims["home_install_id"],
|
|
"authority_gateway_id": claims["authority_gateway_id"],
|
|
"authority_epoch": claims["authority_epoch"],
|
|
"member_id": claims["member_id"],
|
|
"target_profile": profile,
|
|
"catalog": catalog,
|
|
}
|
|
)
|
|
|
|
|
|
async def _handle_room_member_grant_refresh(
|
|
self,
|
|
request: "web.Request",
|
|
*,
|
|
_openai_error,
|
|
_api_request_profile,
|
|
) -> "web.Response":
|
|
"""Refresh dispatch access without a Desktop or broad gateway key."""
|
|
body, error = await self._read_json_body(request)
|
|
if error:
|
|
return error
|
|
if set(body) - {"ttl_seconds"}:
|
|
return web.json_response(
|
|
_openai_error(
|
|
"Grant refresh accepts only ttl_seconds.",
|
|
code="invalid_room_grant_refresh",
|
|
),
|
|
status=400,
|
|
)
|
|
try:
|
|
from gateway import hosted_rooms
|
|
from gateway.hosted_room_peer import (
|
|
MAX_DISPATCH_GRANT_TTL_SECONDS,
|
|
issue_room_grant,
|
|
)
|
|
from gateway.hosted_room_execution_policy import execution_policy_mapping
|
|
|
|
# A status-only bearer may observe a run but must never mint new
|
|
# dispatch authority. Renewal is possible only while the existing
|
|
# dispatch permission is still live.
|
|
claims = self._room_grant_claims(request, permission="dispatch")
|
|
profile = _api_request_profile.get() or "default"
|
|
installation_id = hosted_rooms.local_authority_gateway_id()
|
|
if (
|
|
claims["target_profile"] != profile
|
|
or claims["target_install_id"] != installation_id
|
|
):
|
|
raise ValueError("room grant target does not match this profile")
|
|
now = time.time()
|
|
hard_expiry = float(
|
|
claims.get("status_expires_at", claims["expires_at"])
|
|
)
|
|
remaining = hard_expiry - now
|
|
requested = float(
|
|
body.get("ttl_seconds", MAX_DISPATCH_GRANT_TTL_SECONDS)
|
|
)
|
|
if remaining <= 0 or requested <= 0:
|
|
raise ValueError("room grant renewal horizon expired")
|
|
dispatch_ttl = min(
|
|
requested,
|
|
MAX_DISPATCH_GRANT_TTL_SECONDS,
|
|
remaining,
|
|
)
|
|
with self._profile_scope(profile):
|
|
execution_policy = execution_policy_mapping(target_profile=profile)
|
|
_require_unchanged_execution_policy(claims, execution_policy)
|
|
token = issue_room_grant(
|
|
self._room_grant_secret(),
|
|
grant_id=f"grant-refresh-{uuid.uuid4().hex}",
|
|
room_id=claims["room_id"],
|
|
home_install_id=claims["home_install_id"],
|
|
authority_gateway_id=claims["authority_gateway_id"],
|
|
authority_epoch=int(claims["authority_epoch"]),
|
|
member_id=claims["member_id"],
|
|
target_install_id=installation_id,
|
|
target_profile=profile,
|
|
execution_policy_digest=execution_policy["policy_digest"],
|
|
permissions=claims["permissions"],
|
|
issued_at=now,
|
|
ttl_seconds=dispatch_ttl,
|
|
status_expires_at=hard_expiry,
|
|
)
|
|
except Exception as exc:
|
|
return _room_grant_error_response(exc, _openai_error=_openai_error)
|
|
return web.json_response(
|
|
{
|
|
"object": "hermes.room_member.grant",
|
|
"grant": token,
|
|
"expires_at": now + dispatch_ttl,
|
|
"status_expires_at": hard_expiry,
|
|
"execution_policy": execution_policy,
|
|
}
|
|
)
|
|
|
|
|
|
async def _handle_room_member_grant_revoke(
|
|
self,
|
|
request: "web.Request",
|
|
*,
|
|
_openai_error,
|
|
_api_request_profile,
|
|
) -> "web.Response":
|
|
"""Revoke exactly the scoped grant authenticating this request."""
|
|
body, error = await self._read_json_body(request)
|
|
if error:
|
|
return error
|
|
if body:
|
|
return web.json_response(
|
|
_openai_error(
|
|
"Grant revoke accepts no fields.",
|
|
code="invalid_room_grant_revoke",
|
|
),
|
|
status=400,
|
|
)
|
|
try:
|
|
from gateway import hosted_rooms
|
|
from gateway.hosted_room_peer import decode_room_grant
|
|
|
|
token = self._room_grant_token(request)
|
|
if not token:
|
|
raise ValueError("room grant is missing")
|
|
# Revoke is idempotent: a response-lost retry may authenticate with
|
|
# the grant that was just added to the denylist. Verify signature,
|
|
# scope, and hard horizon directly, then upsert the same grant id.
|
|
claims = decode_room_grant(
|
|
self._room_grant_secret(),
|
|
token,
|
|
permission="status",
|
|
)
|
|
profile = _api_request_profile.get() or "default"
|
|
installation_id = hosted_rooms.local_authority_gateway_id()
|
|
if (
|
|
claims["target_profile"] != profile
|
|
or claims["target_install_id"] != installation_id
|
|
):
|
|
raise ValueError("room grant target does not match this profile")
|
|
hosted_rooms.revoke_room_grant_scope(
|
|
hosted_rooms.default_db_path(),
|
|
claims=claims,
|
|
expires_at=float(
|
|
claims.get("status_expires_at", claims["expires_at"])
|
|
),
|
|
)
|
|
except Exception:
|
|
return web.json_response(
|
|
_openai_error(
|
|
"Room authorization is invalid or expired.",
|
|
err_type="gateway_auth_error",
|
|
code="invalid_room_grant",
|
|
),
|
|
status=401,
|
|
)
|
|
return web.json_response(
|
|
{
|
|
"object": "hermes.room_member.grant.revocation",
|
|
"revoked": True,
|
|
}
|
|
)
|