mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-16 14:32:34 +00:00
f64e4f4f57
For air-gapped / self-hosted-IdP deploys with NO Nous Portal, let the gateway
obtain its caller-identity bearer from a generic OAuth2 client_credentials grant
against the operator's own IdP (e.g. Microsoft Entra ID) instead of only
resolve_nous_access_token(). The connector's OIDC tenant resolver reads a claim
(default tid) off that token as the tenant.
- gateway/relay: new canonical _resolve_relay_identity_token() — client_credentials
when gateway.idp.token_url (or GATEWAY_RELAY_IDP_* env) is set, else Nous Portal
(unchanged default). Wired into self_provision_relay().
- hermes_cli/gateway_enroll: _resolve_identity_token() delegates to the canonical
resolver so the enroll CLI and the runtime self-provision path share ONE impl.
Config via gateway.idp.{token_url,client_id,client_secret,scope} in config.yaml
(env override GATEWAY_RELAY_IDP_*). No behaviour change when unset.
Tests: tests/gateway/relay/test_identity_token_resolver.py (6 — mode selection,
request shape, config/env precedence, fail-closed). Relay suite 162 pass.
Validated via the cross-repo gateway<->connector live E2E (provision, managed
self-provision, inbound round-trip, /link) against a connector running the OIDC
tenant resolver with zero NAS config.
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| stub_connector.py | ||
| test_auth.py | ||
| test_contract_doc_conformance.py | ||
| test_descriptor.py | ||
| test_descriptor_from_entry.py | ||
| test_identity_token_resolver.py | ||
| test_no_stub_leak.py | ||
| test_relay_adapter.py | ||
| test_relay_follow_up.py | ||
| test_relay_going_idle.py | ||
| test_relay_interrupt.py | ||
| test_relay_multiplatform.py | ||
| test_relay_passthrough.py | ||
| test_relay_policy_send.py | ||
| test_relay_registration.py | ||
| test_relay_roundtrip.py | ||
| test_relay_roundtrip_telegram.py | ||
| test_relay_sheds_crypto.py | ||
| test_self_provision.py | ||
| test_ws_transport.py | ||