jFdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z mZddlmZddlmZdZd Zd Zd Zd Zd Zd ZeddZde deddfdZGddZy)a DM Pairing System Code-based approval flow for authorizing new users on messaging platforms. Instead of static allowlists with user IDs, unknown users receive a one-time pairing code that the bot owner approves via the CLI. Security features (based on OWASP + NIST SP 800-63-4 guidance): - 8-char codes from 32-char unambiguous alphabet (no 0/O/1/I) - Cryptographic randomness via secrets.choice() - 1-hour code expiry - Max 3 pending codes per platform - Rate limiting: 1 request per user per 10 minutes - Lockout after 5 failed approval attempts (1 hour) - File permissions: chmod 0600 on all data files - Codes are never logged to stdout Storage: ~/.hermes/pairing/ N)Path)Optional)expand_whatsapp_aliasesnormalize_whatsapp_identifier)get_hermes_dir)atomic_replace ABCDEFGHJKLMNPQRSTUVWXYZ23456789iiXzplatforms/pairingpairingpathdatareturncF|jjddtjt |jd\}} t j |dd5}|j||jt j|jdddt|| t j|d y#1swY-xYw#t$rYywxYw#t$r' t j|#t$rYwxYwwxYw) uWrite data to file with restrictive permissions (owner read/write only). Uses a temp-file + atomic rename so readers always see either the old complete file or the new one — never a partial write. Tparentsexist_okz.tmp)dirsuffixwutf-8encodingNi)parentmkdirtempfilemkstempstrosfdopenwriteflushfsyncfilenorchmodOSError BaseExceptionunlink)rrfdtmp_pathfs /home/cube/projects/richard/traning coach/.omo/evidence/nutricoach-v150-combined/st_01a0560c-r63-installed-wheel-first-claim-qa/venv/lib/python3.12/site-packages/gateway/pairing.py _secure_writer.7s  KKdT2##DKK(8HLB YYr3 1Q GGDM GGI HHQXXZ 2 x&  HHT5 ! 2 1      IIh      sg C0$AC)C0>C!CC0! C-*C0,C--C00 D :DD  DD DD c eZdZdZdZdedefdZdedefdZdefdZ dede fd Z ded e dd fd Z ded edefdZ ded edeefdZdedededefdZded edefdZd&dedefdZd'ded ededd fdZded edefdZedededefdZ d'ded ededeefdZdededee fdZd&dedefdZd&dedefdZded edefdZ ded edd fd Z!dedefd!Z"dedd fd"Z#dedd fd#Z$d$edefd%Z%y )( PairingStorea Manages pairing codes and approved user lists. Data files per platform: - {platform}-pending.json : pending pairing requests - {platform}-approved.json : approved (paired) users - _rate_limits.json : rate limit tracking cdtjddtj|_y)NTr) PAIRING_DIRr threadingRLock_lockselfs r-__init__zPairingStore.__init__[s%$6__& platformrct|dz S)Nz -pending.jsonr2r7r:s r- _pending_pathzPairingStore._pending_pathasz777r9ct|dz S)Nz-approved.jsonr<r=s r-_approved_pathzPairingStore._approved_pathdsz888r9ctdz S)Nz_rate_limits.jsonr<r6s r-_rate_limit_pathzPairingStore._rate_limit_pathgs000r9rc|jr& tj|jdSiS#tjt f$ricYSwxYw)Nrr)existsjsonloads read_textJSONDecodeErrorr')r7rs r- _load_jsonzPairingStore._load_jsonjsR ;;= zz$..'."BCC (('2   s$9AArNcHt|tj|ddy)NF)indent ensure_ascii)r.rEdumps)r7rrs r- _save_jsonzPairingStore._save_jsonrsdDJJtAEJKr9user_idcht|xsdj}|dk(rt|xs|S|S)z LU]U }8TVVr9c||j|j|}|D]}|j|||syy)z3Check if a user is approved (paired) on a platform.TF)rIr@rc)r7r:rPapprovedapproved_user_ids r- is_approvedzPairingStore.is_approvedsA??4#6#6x#@A ( ##H.>H!)r9cg}|r|gn|jd}|D]P}|j|j|}|jD]\}}|j ||d|R|S)z5List approved users, optionally filtered by platform.re)r:rP)_all_platformsrIr@itemsappend)r7r:results platformspreuidinfos r- list_approvedzPairingStore.list_approvedsr"*XJ0C0CJ0O At':':1'=>H%^^- TA#FFG.r9 user_namec@|j|j|}|j||}|Dcgc]}|j|||r|}}|D]}||=|t jd||<|j |j||ycc}w)zAAdd a user to the approved list. Must be called under self._lock.)rr approved_atN)rIr@rVrctimerO)r7r:rPrrrenormalized_user_idrf duplicate_idss r- _approve_userzPairingStore._approve_users??4#6#6x#@A!44XwG%- $, ##H.>@RS $,  !. )*!.#99;( #$ ++H5x@ sBc *|j|}|j5|j|}|Dcgc]}|j|||r|}}|r&|D]}||=|j || dddy dddycc}w#1swYyxYw)zz-PairingStore.generate_code..sP=O7>>(3=Os#%r )hashr}rPrr created_at)r5_cleanup_expiredrV_is_locked_out_is_rate_limitedrIr>lenMAX_PENDING_PER_PLATFORMjoinrange CODE_LENGTHr urandomrr token_hexhexrurO_record_rate_limit) r7r:rPrrrvpendingr|r} code_hashentry_ids r- generate_codezPairingStore.generate_codesDZZ  ! !( +!%!8!87!K ""8, Z$$Xw7Zood&8&8&BCG7|77Z$77PU;=OPPD::b>Dd3I((+H" -&"iik !GH  OOD..x8' B  # #Hg 6QZZs6E. E.(3E.$CE..E7c 6|j5|j||jj}|j |r dddy|j |j |}d}d}|jD]i\}}t|tsd|vsd|vr tj|d}|j||} tj| |dse|}|}n||j!| dddy||=|j#|j |||j%||d|j'dd|d|j'dddcdddS#t$rYwxYw#1swYyxYw)u Approve a pairing code. Adds the user to the approved list. Returns ``{user_id, user_name}`` on success, ``None`` if the code is invalid/expired OR the platform is currently locked out after ``MAX_FAILED_ATTEMPTS`` failed approvals (#10195). Callers can disambiguate with ``_is_locked_out(platform)``. Verification: the user-provided code is hashed with each stored entry's salt and compared to the stored hash using constant-time comparison. Pre-hash entries (legacy plaintext-key format from pre-upgrade pending.json files) are silently ignored — they get pruned at TTL by ``_cleanup_expired``. Nr}rrPrrrR)rPrr)r5rupperrTrrIr>rj isinstancedictbytesfromhex ValueErrorrrcompare_digest_record_failed_attemptrOrxget) r7r:r|r matched_key matched_entryrentryr}candidate_hashs r- approve_codezPairingStore.approve_codesZZ  ! !( +::<%%'D""8,Zood&8&8&BCGK M#*==?%!%.&&*= ==v7D"&t!<)).%-H"*K$)M$3"++H5OZR $ OOD..x8' B   xy)A,00bA C)3*..{B?aZ:";ZsDAFAF-F+F1FA!F F  F F  FFc g}|j5|r|gn|jd}|D]}|j||j|j |}|j D]\}}t |ts|jd}t |ttfs?ttj|z dz } |jd} t | tr| ddnd} |j|| |jdd |jd d | d   ddd|S#1swY|SxYw) uList pending pairing requests, optionally filtered by platform. Codes are stored hashed — the ``code`` field is replaced with the first 8 hex characters of the hash so admins can distinguish entries without revealing the original code. Legacy plaintext-key entries (pre-hash format) are shown with a "legacy" placeholder so admins can see them age out without crashing on a missing ``hash`` field. rr<rNr legacyrPrRrr)r:r|rPrr age_minutes)r5rirrIr>rjrrrintfloatrurrk) r7r:rlrmrnrrrprage_minhash_val code_displays r- list_pendingzPairingStore.list_pendingHs% ZZ&. D4G4G 4RI%%a(//$*<*'. $'6*+*s D$D>>Ec(|j5d}|r|gn|jd}|D]Q}|j|j|}|t |z }|j |j|iS ddd|S#1swYSxYw)z2Clear all pending requests. Returns count removed.rrN)r5rirIr>rrO)r7r:countrmrnrs r- clear_pendingzPairingStore.clear_pendingis ZZE&. D4G4G 4RI//$*<* r9c|j|j}tj}|j||D]}|d|}|||<|j |j|y)z7Record the time of a pairing request for rate limiting.rN)rIrBrur\rO)r7r:rPrnowrrs r-rzPairingStore._record_rate_limitsm!6!6!89iik**8W=EJaw'CF3K> --/8r9c|j|j}d|}|j|d}tj|kS)zBCheck if a platform is in lockout due to failed approval attempts. _lockout:r)rIrBrru)r7r:r lockout_key lockout_untils r-rzPairingStore._is_locked_outsF!6!6!89!(,  ;2 yy{]**r9c `|j|j}d|}|j|ddz}|||<|tk\rGd|}t jt z||<d||<t d|dt dtdd |j|j|y ) zMRecord a failed approval attempt. Triggers lockout after MAX_FAILED_ATTEMPTS.z _failures:rrz[pairing] Platform z locked out for zs after z failed attemptsT)r#N)rIrBrMAX_FAILED_ATTEMPTSruLOCKOUT_SECONDSprintrO)r7r:rfail_keyfailsrs r-rz#PairingStore._record_failed_attempts!6!6!89z* 8Q'!+ x ' '%hZ0K"&))+"?F;  F8  'z1A/ARS.//?AHL N --/8r9c|j|}|j|}tj}g}|jD]~\}}t |t s|j |(|jd}t |ttfs|j |a||z tkDsn|j ||r|D]}||=|j||yy)uRemove expired pending codes. Tolerant of malformed / legacy entries — anything without a numeric ``created_at`` is treated as expired (it's effectively unusable with the new hash-keyed schema anyway). rN) r>rIrurjrrrkrrrCODE_TTL_SECONDSrO) r7r:rrrexpiredrrprs r-rzPairingStore._cleanup_expireds!!(+//$'iik%mmoNHddD)x(,/Jj3,7x(j $44x(. #H%$ OOD' * r9rcg}tjD]e}|jjd|ds#|jj d|dd}|j drU|j |g|S)z:List all platforms that have data files of a given suffix.-z.jsonrRr)r2iterdirnameendswithreplace startswithrk)r7rrmr,r:s r-rizPairingStore._all_platformsst $$&Avv6(%0166>>AfXU*;R@**3/$$X. ' r9r)rR)&__name__ __module__ __qualname____doc__r8rrr>r@rBrrIrOrVrXr\r`rcrglistrqrxr{ staticmethodrrrrrrrrrrrrrrir9r-r0r0Qsb' 8c8d89s9t91$1tLtL4LDL3  s s3x WW3WsWtWC#$cTAcACACAQUA$sST&GGEGcGG =?66&)6696 #6pBSBBBHSDB c S st93999+s+t+ 9s 9t 9 +++4STr9r0)rrrEr rrr3rupathlibrtypingrgateway.whatsapp_identityrrhermes_constantsrutilsrrrrrrrrr2rr.r0rr9r-rs(  ,  . 0)< CD4qqr9