Ë
    úmxiG  ã                  ó   — U d dl mZ d dlZd dlZd dlmZmZ d dlmZmZm	Z	 d dl
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZ  ee«      Zded<   er G d„ de«      ZdZded<   dZ ded<    e!e «      Z"ded<   dZ#ded<   dZ$ded<    G d„ d«      Z%d)d„Z&d*d„Z'd+d„Z(d,d„Z)d-d„Z*d.d„Z+d/d „Z,d0d!„Z-	 	 	 	 	 	 	 	 	 	 d1d"„Z.	 	 	 	 	 	 d2d#„Z/	 	 	 	 	 	 	 	 	 	 d3d$„Z0 ejb                  d%«      Z2	 	 	 	 	 	 d4d&„Z3	 	 	 	 	 	 	 	 d5d'„Z4d6d(„Z5y)7é    )ÚannotationsN)ÚCallableÚMapping)ÚdatetimeÚ	timedeltaÚtimezone)ÚTYPE_CHECKINGÚAnyÚFinalÚ	TypedDictÚcast)Úurlparse)Úconfig)ÚStreamlitAuthError)Ú
get_logger)ÚAttrDictÚsecrets_singletonr   Ú_LOGGERc                  ó"   — e Zd ZU ded<   ded<   y)ÚProviderTokenPayloadÚstrÚproviderÚintÚexpN)Ú__name__Ú
__module__Ú__qualname__Ú__annotations__© ó    úJ/home/htdocs/ttos/venv/lib/python3.12/site-packages/streamlit/auth_util.pyr   r   !   s   … Ø‹ØŒr    r   i   ÚMAX_COOKIE_BYTESz; Path=/; HttpOnlyÚCOOKIE_ATTRIBUTESÚCOOKIE_ATTR_SIZEé2   ÚSIGNING_OVERHEAD_SAFETY_BUFFERé   ÚSINGLE_BYTE_BASE64_SIZEc                  ó:   — e Zd ZdZdd„Zd	d„Zd
dd„Zdd„Zdd„Zy)Ú	AuthCachezBSimple cache implementation for storing info required for Authlib.c                ó   — i | _         y ©N©Úcache©Úselfs    r!   Ú__init__zAuthCache.__init__4   s	   € Ø%'ˆ�
r    c                ó8   — | j                   j                  |«      S r,   )r.   Úget©r0   Úkeys     r!   r3   zAuthCache.get7   s   € Ø�z‰z�~‰~˜cÓ"Ð"r    Nc                ó"   — || j                   |<   y r,   r-   )r0   r5   ÚvalueÚ
expires_ins       r!   ÚsetzAuthCache.set<   s   € Øˆ�
‰
�3Šr    c                ó   — | j                   S r,   r-   r/   s    r!   Úget_dictzAuthCache.get_dict?   s   € Ø�z‰zÐr    c                ó<   — | j                   j                  |d «       y r,   )r.   Úpopr4   s     r!   ÚdeletezAuthCache.deleteB   s   € Ø�
‰
�‰�s˜DÕ!r    )ÚreturnÚNone)r5   r   r?   r
   r,   )r5   r   r7   r
   r8   z
int | Noner?   r@   )r?   údict[str, Any])r5   r   r?   r@   )	r   r   r   Ú__doc__r1   r3   r9   r;   r>   r   r    r!   r*   r*   1   s   „ ÙLó(ó#ô
 óô"r    r*   c                 ó®   — 	 ddl } | j                  }t        t        t        |j                  d«      «      «      }|dk  ry	 y# t        t        f$ r Y yw xY w)zCheck if Authlib is installed.r   Nú.)é   é   é   FT)ÚauthlibÚ__version__ÚtupleÚmapr   ÚsplitÚImportErrorÚModuleNotFoundError)rH   Úauthlib_versionÚauthlib_version_tuples      r!   Úis_authlib_installedrQ   F   sa   € ð	Ûà!×-Ñ-ˆÜ %¤c¬#¨×/DÑ/DÀSÓ/IÓ&JÓ KÐà  9Ò,Øð -ð øô Ô,Ð-ò Ùðús   ‚=A ÁAÁAc                 óª   — t        j                  d«      } t        j                  «       r)t        j                  d«      }|r|j	                  d| «      } | S )zEGet the cookie signing secret from the configuration or secrets.toml.zserver.cookieSecretÚauthÚcookie_secret)r   Ú
get_optionr   Úload_if_toml_existsr3   )Úsigning_secretÚauth_sections     r!   Úget_signing_secretrY   U   sJ   € ä ×+Ñ+Ð,AÓB€NÜ×,Ñ,Ô.Ü(×,Ñ,¨VÓ4ˆÙØ)×-Ñ-¨o¸~ÓNˆNØÐr    c            	     ó–   — t        i «      } t        j                  «       r)t        dt        j                  dt        i «      «      «      } | S )z+Get the 'auth' section of the secrets.toml.r   rS   )r   r   rV   r   r3   )rX   s    r!   Úget_secrets_auth_sectionr[   _   s;   € ä˜B“<€LÜ×,Ñ,Ô.Ü˜JÔ(9×(=Ñ(=¸fÄhÈrÃlÓ(SÓTˆàÐr    c                 óú   — t        «       } | j                  d«      }t        |t        «      r|g}n+t        |t        «      r|D �cg c]  }t        |«      ‘Œ }}ng S t        |«      ddhz
  rt        d«      ‚|S c c}w )zïGet the expose_tokens configuration from secrets.toml.

    Returns a list of token types to expose. Accepts both string and list formats:
    - expose_tokens = "id" -> ["id"]
    - expose_tokens = ["id", "access"] -> ["id", "access"]
    Úexpose_tokensÚidÚaccesszHInvalid expose_tokens configuration. Only 'id' and 'access' are allowed.)r[   r3   Ú
isinstancer   Úlistr9   r   )rX   r]   ÚresÚtokens       r!   Úget_expose_tokens_configrd   h   s€   € ô ,Ó-€LØ ×$Ñ$ _Ó5€Mä�-¤Ô%Øˆo‰Ü	�M¤4Ô	(Ø'4Ö5˜eŒs�5�zÐ5ˆÑ5àˆ	ä
ˆ3ƒx�4˜Ð"Ò"Ü ØVó
ð 	
ð €Jùò 6s   ÁA8c                óê   — d| vry| d   }d|v r.|j                  dt        t        j                  d«      «      «      }	 t	        |«      }|j                  «       S # t
        $ r t        d|› d�«      ‚w xY w)zJGet the redirect_uri from auth_section - filling in port number if needed.Úredirect_uriNz{port}zserver.portzInvalid redirect_uri: ú". Please check your configuration.)Úreplacer   r   rU   r   Ú
ValueErrorr   Úgeturl)rX   rf   Úredirect_uri_parseds      r!   Úget_redirect_urirl   �   s’   € ð ˜\Ñ)Øà$ ^Ñ4€LØ�<ÑØ#×+Ñ+Ø”cœ&×+Ñ+¨MÓ:Ó;ó
ˆð
Ü& |Ó4Ðð ×%Ñ%Ó'Ð'øô ò 
Ü Ø$ \ NÐ2TÐUó
ð 	
ð
ús   ¾A ÁA2c                ó  — 	 ddl m} ddi}| t	        j
                  t        j                  «      t        d¬«      z   d	œ}|j                  ||t        «       «      }|j                  d
«      S # t        $ r t        d«      d‚w xY w)zAReturns a signed JWT token with the provider and expiration time.r   )ÚjwtúcTo use authentication features, you need to install Authlib>=1.3.2, e.g. via `pip install Authlib`.NÚalgÚHS256rG   )Úminutes)r   r   zlatin-1)Úauthlib.josern   rM   r   r   Únowr   Úutcr   ÚencoderY   Údecode)r   rn   ÚheaderÚpayloadÚprovider_tokens        r!   Úencode_provider_tokenr{   —   s‡   € ðÝ$ð �WÐ€FàÜ�|‰|œHŸL™LÓ)¬I¸aÔ,@Ñ@ñ€Gð  ŸJ™J v¨wÔ8JÓ8LÓM€Nà× Ñ  Ó+Ð+øô ò Ü Øuó
àð	ðús   ‚A+ Á+Bc                ó  — 	 ddl m}m}m} ddiddidœ}	 |j                  | t        «       |¬«      }|j                  «        t        d
|«      S # t        $ r t        d«      d‚w xY w# |$ r}t        d	|› �«      d‚d}~ww xY w)z-Decode the JWT token and validate the claims.r   )Ú	JoseErrorÚ	JWTClaimsrn   ro   NÚ	essentialT)r   r   )Úclaims_optionszError decoding provider token: r   )
rs   r}   r~   rn   rM   r   rw   rY   Úvalidater   )rz   r}   r~   rn   Úclaim_optionsry   Úes          r!   Údecode_provider_tokenr„   ª   s±   € ðß:Ñ:ð )¨$Ð/¸kÈ4Ð=PÑQ€MðRØ ŸZ™ZØÔ.Ó0Àð (ó 
ˆð 	×ÑÔô Ð&¨Ó0Ð0øô! ò Ü Øuó
àð	ðûð ò RÜ Ð#BÀ1À#Ð!FÓGÈTÐQûðRús"   ‚
A –,A' ÁA$Á'B Á,A;Á;B c           	     óÀ  — i }| j                  d«      r| j                  d«      |d<   | j                  d«      r| j                  d«      |d<   | j                  d«      r| j                  d«      |d<   | j                  d«      r6t        d| j                  dt        i «      «      «      j                  «       |d<   | j                  d«      r| j                  d«      |d<   |S )zKGenerate a default provider section for the 'auth' section of secrets.toml.Ú	client_idÚclient_secretÚserver_metadata_urlÚclient_kwargsr   r]   )r3   r   r   Úto_dict)rX   Údefault_provider_sections     r!   Ú!generate_default_provider_sectionrŒ   Á   sä   € à!ÐØ×Ñ˜Ô$Ø0<×0@Ñ0@ÀÓ0MÐ  Ñ-Ø×Ñ˜Ô(Ø4@×4DÑ4DÀ_Ó4UÐ  Ñ1Ø×ÑÐ-Ô.Ø:F×:JÑ:JØ!ó;
Ð Ð!6Ñ7ð ×Ñ˜Ô(Ü48Ø˜×(Ñ(¨¼(À2»,ÓGó5
ç
‰'‹)ð 	! Ñ1ð ×Ñ˜Ô(Ø4@×4DÑ4DÀ_Ó4UÐ  Ñ1Ø#Ð#r    c                óð   — t        j                  |«      } |||«      }t        |«      dz   t        |«      z   t        z   }|t        kD  r%t
        j                  d|«       t        | |||«       y | ||«       y)a[  Set a cookie, splitting into multiple cookies if necessary.

    Args:
        set_single_cookie_fn: Function to set a single cookie (cookie_name, value)
        create_signed_value_fn: Function to create a signed cookie value (cookie_name, value)
        cookie_name: Name of the cookie
        value: Dictionary value to serialize and store
    rE   zNCookie size (%d bytes) exceeds browser limit. Splitting into multiple cookies.N)ÚjsonÚdumpsÚlenr$   r"   r   ÚdebugÚ_set_split_cookie)Úset_single_cookie_fnÚcreate_signed_value_fnÚcookie_namer7   Úserialized_cookie_valueÚsigned_valueÚactual_cookie_sizes          r!   Úset_cookie_with_chunksr™   Õ   s„   € ô #Ÿj™j¨Ó/Ðñ *¨+Ð7NÓO€Lô ˜[Ó)¨AÑ-´°LÓ0AÑAÔDTÑTÐð Ô,Ò,Ü�‰Ø\Øô	
ô 	Ø Ø"ØØ#õ		
ñ 	˜[Ð*AÕBr    c                ó<   — d} | ||«      }t        |«      t        z
  S )a  Calculate the server's signing overhead by measuring the size difference.

    This empirically measures the overhead added by the signing function (e.g., Tornado's
    create_signed_value) by signing a minimal test value and computing the difference.

    Args:
        create_signed_value_fn: Function to create a signed cookie value
        cookie_name: Name of the cookie (affects overhead due to length prefix)

    Returns
    -------
        The number of bytes added by signing (excluding the base64-encoded value)
    Úx)r�   r(   )r”   r•   Ú
test_valueÚsigneds       r!   Ú_calculate_signing_overheadrž   û   s%   € ð" €JÙ# K°Ó<€FÜˆv‹;Ô0Ñ0Ð0r    c                ó  — t        ||«      t        z   }t        t        |«      z
  dz
  t        z
  }||z
  }|t
        k  rt        d«      ‚|dz  dz  }g }t        dt        |«      |«      D ]  }	||	|	|z    }
|j                  |
«       Œ t        |«      dk(  r | ||d   «       y | |dt        |«      › �«       t        t        |«      «      D ]  }	|› d|	dz   › �} | |||	   «       Œ t        j                  d	|t        |«      «       y)
aé  Split a large cookie value into multiple smaller cookies.

    The main cookie always exists and either contains the whole value or the chunk count.
    Additional chunks are stored as cookie_name_1, cookie_name_2, etc.

    Args:
        set_single_cookie_fn: Function to set a single cookie (cookie_name, value)
        create_signed_value_fn: Function to create a signed cookie value
        cookie_name: Name of the cookie
        value: Serialized string value to split and store
    rE   z0Not enough space available for the signed value.rF   r'   r   Nzchunks-Ú_z Split cookie '%s' into %d chunks)rž   r&   r"   r�   r$   r(   r   ÚrangeÚappendr   Úinfo)r“   r”   r•   r7   Úsigning_overheadÚavailable_for_signed_valueÚavailable_for_base64_valueÚ
chunk_sizeÚchunksÚiÚchunkÚ
chunk_names               r!   r’   r’     s;  € ô& 	$Ð$:¸KÓHÜ
(ñ	)ð ô 	œ3˜{Ó+Ñ+¨aÑ/Ô2BÑBð ð
 "<Ð>NÑ!NÐð "Ô$;Ò;Ü Ð!SÓTÐTð -¨qÑ0°QÑ6€JØ€FÜ�1”c˜%“j *Ó-ò ˆØ�a˜!˜j™.Ð)ˆØ�‰�eÕðô ˆ6ƒ{�aÒÙ˜[¨&°©)Ô4Øñ ˜¨´°F³¨}Ð&=Ô>ô ”3�v“;Óò 4ˆØ#�} A a¨!¡e WÐ-ˆ
Ù˜Z¨°©Õ3ð4ô ‡L�LØ*ØÜˆF‹õr    s   chunks-(\d+)c                ó¤  —  | |«      }|€|S t         j                  |«      }|€|S 	 t        |j                  d«      «      }g }t        |«      D ]C  }|› d|dz   › �} | |«      }|€t        j                  d|dz   |«        y|j                  |«       ŒE dj                  |«      }	|	S # t        t
        f$ r t        j                  d|«       Y yw xY w)añ  Get a cookie, reconstructing from chunks if it was split.

    If a count cookie exists, the main cookie contains the first chunk,
    and additional chunks are in cookie_name_1, cookie_name_2, etc.
    If no count cookie exists, the main cookie contains the entire value.

    Args:
        get_single_cookie_fn: Function to get a single cookie (cookie_name) -> bytes | None
        cookie_name: Name of the cookie

    Returns
    -------
        Cookie value as bytes, or None if not found
    NrE   z#Invalid chunk count for cookie '%s'r    z Missing chunk %d for cookie '%s'r    )Ú_chunks_regexÚmatchr   Úgroupri   Ú	TypeErrorr   Ú	exceptionr¡   r¢   Újoin)
Úget_single_cookie_fnr•   Úcookie_valuer®   Úchunk_countr¨   r©   r«   Úchunk_valueÚreconstructed_values
             r!   Úget_cookie_with_chunksr¸   S  sò   € ñ$ (¨Ó4€LØÐØÐä×Ñ Ó-€EØ€}ØÐðÜ˜%Ÿ+™+ a›.Ó)ˆð €Fä�;Óò #ˆØ#�} A a¨!¡e WÐ-ˆ
Ù*¨:Ó6ˆØÐÜ×ÑÐ@À!ÀaÁ%ÈÔUÙØ�‰�kÕ"ð#ð Ÿ(™( 6Ó*ÐØÐøô! œ	Ð"ò Ü×ÑÐ?ÀÔMÙðús   §B' Â'%CÃCc                óü   —  | |«      } ||«       |€yt         j                  |«      }|€y	 t        |j                  d«      «      }t	        d|dz   «      D ]  } ||› d|› �«       Œ y# t
        t        f$ r Y yw xY w)a–  Clear a cookie and any associated chunk cookies.

    The main cookie always exists. If there are chunks, also clear
    cookie_name_1, cookie_name_2, etc., and the count cookie.

    Args:
        get_single_cookie_fn: Function to get a single cookie (cookie_name) -> bytes | None
        clear_single_cookie_fn: Function to clear a single cookie (cookie_name)
        cookie_name: Name of the cookie
    NrE   r    )r­   r®   r   r¯   r¡   ri   r°   )r³   Úclear_single_cookie_fnr•   r´   r®   rµ   r©   s          r!   Úclear_cookie_and_chunksr»   ƒ  s”   € ñ (¨Ó4€LÙ˜;Ô'ØÐØä×Ñ Ó-€EØ€}ØðÜ˜%Ÿ+™+ a›.Ó)ˆä�q˜+¨™/Ó*ò 	9ˆAÙ" k ]°!°A°3Ð#7Õ8ñ	9øäœ	Ð"ò ñ 	ðús   ­;A) Á)A;Á:A;c                ó8  — t        j                  «       st        d«      ‚t        j                  d«      }|€t        d«      ‚d|vrt        d«      ‚d|vrt        d«      ‚|j                  | «      }d| v rt        d	| › d
�«      ‚|€| dk(  rt	        |«      }|€| dk(  rt        d«      ‚t        d| › d�«      ‚t        |t        «      st        d| › d�«      ‚g d¢}|D �cg c]	  }||vsŒ|‘Œ }}|r&| dk(  rt        d|› d�«      ‚t        d| › d|› d�«      ‚yc c}w )z[Validate the general auth credentials and auth credentials for the given
    provider.
    z“To use authentication features you need to configure credentials for at
            least one authentication provider in `.streamlit/secrets.toml`.rS   Nrf   zˆAuthentication credentials in `.streamlit/secrets.toml` are missing the
            "redirect_uri" key. Please check your configuration.rT   z‰Authentication credentials in `.streamlit/secrets.toml` are missing the
            "cookie_secret" key. Please check your configuration.r    zAuth provider name "zI" contains an underscore. Please use a provider name without underscores.Údefaultz�Authentication credentials in `.streamlit/secrets.toml` are missing for
                the default authentication provider. Please check your configuration.zeAuthentication credentials in `.streamlit/secrets.toml` are missing for the authentication provider "z#". Please check your configuration.zYAuthentication credentials in `.streamlit/secrets.toml` for the authentication provider "z6" must be valid TOML. Please check your configuration.)r†   r‡   rˆ   z€Authentication credentials in `.streamlit/secrets.toml` for the default authentication provider are missing the following keys: rg   z"" are missing the following keys: )r   rV   r   r3   rŒ   r`   r   )r   rX   Úprovider_sectionÚrequired_keysr5   Úmissing_keyss         r!   Úvalidate_auth_credentialsrÁ   ¦  sÒ  € ô ×0Ñ0Ô2Ü ðOó
ð 	
ô
 %×(Ñ(¨Ó0€LØÐÜ ðOó
ð 	
ð ˜\Ñ)Ü ðDó
ð 	
ð ˜lÑ*Ü ðEó
ð 	
ð
 $×'Ñ'¨Ó1Ðð ˆh�Ü Ø" 8 *ð ->ð ?ó
ð 	
ð
 Ð H°	Ò$9Ü<¸\ÓJÐàÐØ�yÒ Ü$ðYóð ô !ð,Ø,4¨:ð 6ðó
ð 	
ô Ð&¬Ô0Ü ð(Ø(0 zð 2"ð#ó
ð 	
ò J€MØ#0ÖP˜C°CÐ?OÒ4O’CÐP€LÐPÙØ�yÒ Ü$ðSà�.Ð BðDóð ô
 !ð(Ø(0 zÐ1SØˆnÐ>ð@ó
ð 	
ð ùò Qs   Ã	DÃ(D)r?   Úbool)r?   r   )r?   r   )r?   z	list[str])rX   r   r?   z
str | None)r   r   r?   r   )rz   r   r?   r   )rX   r   r?   rA   )
r“   úCallable[[str, str], None]r”   úCallable[[str, str], bytes]r•   r   r7   rA   r?   r@   )r”   rÄ   r•   r   r?   r   )
r“   rÃ   r”   rÄ   r•   r   r7   r   r?   r@   )r³   úCallable[[str], bytes | None]r•   r   r?   zbytes | None)r³   rÅ   rº   zCallable[[str], None]r•   r   r?   r@   )r   r   r?   r@   )6Ú
__future__r   rŽ   ÚreÚcollections.abcr   r   r   r   r   Útypingr	   r
   r   r   r   Úurllib.parser   Ú	streamlitr   Ústreamlit.errorsr   Ústreamlit.loggerr   Ústreamlit.runtime.secretsr   r   r   r   r   r   r"   r#   r�   r$   r&   r(   r*   rQ   rY   r[   rd   rl   r{   r„   rŒ   r™   rž   r’   Úcompiler­   r¸   r»   rÁ   r   r    r!   ú<module>rÐ      s¯  ðö #ã Û 	ß -ß 2Ñ 2ß =Õ =Ý !å Ý /Ý 'ß Aá˜HÓ%€ˆÓ %áô˜yô ð
 Ð �%Ó à/Ð �5Ó /ÙÐ/Ó0Ð �%Ó 0ð )+Ð  Ó *à!"Ð ˜Ó "÷"ñ "ó*óóóó2(ó,,ó&1ó.$ð(#CØ4ð#Cà7ð#Cð ð#Cð ð	#Cð
 
ó#CðL1Ø7ð1àð1ð 	ó1ð,<Ø4ð<à7ð<ð ð<ð ð	<ð
 
ó<ð~ �—
‘
Ð+Ó,€ð-Ø7ð-àð-ð ó-ð` Ø7ð à1ð ð ð ð 
ó	 ôFH
r    