"""Server-rendered /login page (no React, no SPA bundle, no injected token). Providers come from the registry; an OAuth provider renders an anchor to ``/auth/login?provider=``, a ``supports_password`` provider renders a credential form wired by :data:`_PASSWORD_FORM_SCRIPT`. Styling mirrors the ``@nous-research/ui`` design system; fonts load from the SPA's ``/fonts/`` mount, which the gate allowlists pre-auth. The ``class="provider-btn"`` anchor is test-stable: the suite extracts its href to walk the OAuth flow. """ from __future__ import annotations import html from urllib.parse import quote, urlencode from hermes_cli.dashboard_auth import list_session_providers # Single curly braces are ``str.format`` placeholders; CSS curlies are doubled. _LOGIN_HTML_TEMPLATE = """\ Sign in — Hermes Agent

NousResearch

Sign in

Choose a sign-in method to continue to the Hermes Agent dashboard.

{provider_buttons}

{password_script} """ _EMPTY_HTML = """\ Sign-in unavailable — Hermes Agent

Sign-in unavailable

This dashboard is bound to a non-loopback host but no authentication providers are available.

Configure the bundled username/password provider or an OAuth provider. See the dashboard authentication documentation for setup instructions.

For auth-free local use, bind to 127.0.0.1 and connect through an SSH tunnel or Tailscale.

""" # Emitted ONLY when a ``supports_password`` provider is listed, so OAuth-only # login pages stay script-free. Plain string (not ``str.format``): braces are # literal. One delegated submit handler covers every form; the provider name # comes from the form's ``data-provider`` attribute. _PASSWORD_FORM_SCRIPT = """\ """ def render_login_html(*, next_path: str = "") -> str: """Return the full HTML for ``GET /login``. ``next_path`` is threaded into each provider button/form so the OAuth round trip carries it end-to-end. The caller validates it same-origin; it is HTML-escaped here as defence in depth. """ providers = list_session_providers() if not providers: return _EMPTY_HTML # URL-encode then HTML-escape, matching the gate's ``_safe_next_target`` # shape so a round-tripped value is byte-identical. next_qs = f"&next={html.escape(quote(next_path, safe=''), quote=True)}" if next_path else "" buttons = [ _render_password_form(p, next_path) if getattr(p, "supports_password", False) else f' ' f'Sign in with {html.escape(p.display_name)}' for p in providers ] needs_password_script = any(getattr(p, "supports_password", False) for p in providers) return _LOGIN_HTML_TEMPLATE.format( provider_buttons="\n".join(buttons), password_script=_PASSWORD_FORM_SCRIPT if needs_password_script else "", ) def render_native_provider_choice_html( *, providers, authorize_path: str, code_challenge: str, code_challenge_method: str, redirect_uri: str, state: str) -> str: """Provider picker for a native authorize request with more than one interactive provider. Every link re-enters ``/auth/native/authorize`` with the SAME desktop PKCE inputs plus an explicit ``provider``, so the choice never leaves the validated native flow. """ common = {"code_challenge": code_challenge, "code_challenge_method": code_challenge_method, "redirect_uri": redirect_uri, "state": state} buttons = [] for p in providers: href = html.escape(f"{authorize_path}?{urlencode({**common, 'provider': p.name})}", quote=True) buttons.append(f' ' f'Sign in with {html.escape(p.display_name)}') if not buttons: return _EMPTY_HTML return _LOGIN_HTML_TEMPLATE.format(provider_buttons="\n".join(buttons), password_script="") def _render_password_form(provider, next_path: str) -> str: """Username/password form for a ``supports_password`` provider. ``next_path`` rides in a hidden field (already validated by the caller, HTML-escaped here). The provider name is a ``data-`` attribute so the script does not depend on field ordering. """ pname = html.escape(provider.name, quote=True) plabel = html.escape(provider.display_name) safe_next = html.escape(next_path, quote=True) if next_path else "" return ( f' ' )