Ë
    úmxiè1  ã                  óà  — U d dl mZ d dlZd dlmZmZmZ d dlmZm	Z	 d dl
Zd dlmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZm Z   ee!«      Z"de#d<    e«       Z$dd„Z% G d„ dejL                  jN                  «      Z( G d„ de(ejL                  jN                  «      Z) G d„ de(ejL                  jN                  «      Z* G d„ de(ejL                  jN                  «      Z+y)é    )ÚannotationsN)ÚAnyÚFinalÚcast)Ú	urlencodeÚurlparse)Ú	AuthCacheÚclear_cookie_and_chunksÚdecode_provider_tokenÚ!generate_default_provider_sectionÚget_cookie_with_chunksÚget_redirect_uriÚget_secrets_auth_sectionÚset_cookie_with_chunks)ÚStreamlitAuthError)Ú
get_logger)Úmake_url_path)ÚTornadoOAuthÚTornadoOAuth2App)ÚAUTH_COOKIE_NAMEÚTOKENS_COOKIE_NAMEr   Ú_LOGGERc                óf  — t        «       }|r t        |«      xs d}|j                  «       }ni }d}|j                  | i «      }|s| dk(  rt	        |«      }||d<   |j                  di «      }d|vrd|d<   d|vrd|d<   t        |t        ¬«      }|j                  | «       |j                  | «      |fS )	zRCreate an OAuth client for the given provider based on secrets.toml configuration.ú/ÚdefaultÚclient_kwargsÚscopezopenid email profileÚpromptÚselect_account)Úcache)	r   r   Úto_dictÚ
setdefaultr   r   Ú
auth_cacheÚregisterÚcreate_client)ÚproviderÚauth_sectionÚredirect_uriÚconfigÚprovider_sectionÚprovider_client_kwargsÚoauths          ú`/home/htdocs/ttos/venv/lib/python3.12/site-packages/streamlit/web/server/oauth_authlib_routes.pyÚcreate_oauth_clientr.   +   sÏ   € ä+Ó-€LÙÜ'¨Ó5Ò<¸ˆØ×%Ñ%Ó'‰àˆØˆà×(Ñ(¨°2Ó6Ðá ¨IÒ 5Ü<¸\ÓJÐØ,ˆˆyÑà-×8Ñ8¸È"ÓMÐØÐ,Ñ,Ø*@Ð˜wÑ'ØÐ-Ñ-Ø+;Ð˜xÑ(ä˜¤zÔ2€EØ	‡N�N�8ÔØ×Ñ˜xÓ(¨,Ð6Ð6ó    c                  óT   — e Zd ZdZd
d„Zdd„Z	 	 	 	 	 	 dd„Zdd„Zdd„Zdd„Z	dd„Z
y	)ÚAuthHandlerMixinzNMixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0.c                ó   — || _         y ©N)Úbase_url)Úselfr4   s     r-   Ú
initializezAuthHandlerMixin.initializeI   s	   € Ø ˆ�r/   c                óN   — | j                  t        | j                  d«      «       y )Nr   )Úredirectr   r4   ©r5   s    r-   Úredirect_to_basez!AuthHandlerMixin.redirect_to_baseL   s   € Ø�‰”m D§M¡M°3Ó7Õ8r/   c                óœ   — t        | j                  | j                  t        |«       t        | j                  | j                  t        |«       y r3   )r   Ú_set_single_cookieÚ_create_signed_valuer   r   )r5   Ú	user_infoÚtokenss      r-   Úset_auth_cookiez AuthHandlerMixin.set_auth_cookieO   sF   € ô 	Ø×#Ñ#Ø×%Ñ%ÜØô		
ô 	Ø×#Ñ#Ø×%Ñ%ÜØõ		
r/   c                ót   — 	 | j                  ||d¬«       y# t        $ r | j                  ||d¬«       Y yw xY w)zSet a single cookie.T)ÚhttpOnly)ÚhttponlyN)Úset_signed_cookieÚAttributeErrorÚset_secure_cookie©r5   Úcookie_nameÚvalues      r-   r<   z#AuthHandlerMixin._set_single_cookie_   sR   € ð	ð ×"Ñ"ØØØð #õ øô
 ò 	Ø×"Ñ"ØØØð #ö ð	ús   ‚ —7¶7c                ó~   — 	 | j                  ||«      S # t        $ r t        d| j                  ||«      «      cY S w xY w)zCreate a signed cookie value.Úbytes)Úcreate_signed_valuerE   r   Úcreate_secure_cookie_valuerG   s      r-   r=   z%AuthHandlerMixin._create_signed_valueq   sF   € ð	VØ×+Ñ+¨K¸Ó?Ð?øÜò 	Vä˜ ×!@Ñ!@ÀÈeÓ!TÓUÒUð	Vús   ‚ ”%<»<c                ó¢   — 	 t        d| j                  |«      «      S # t        $ r t        d| j                  |«      «      cY S t        $ r Y yw xY w)zGet a signed cookie.rK   N)r   Úget_signed_cookierE   Úget_secure_cookieÚ	Exception)r5   rH   s     r-   Ú_get_signed_cookiez#AuthHandlerMixin._get_signed_cookiey   sR   € ð	Ü˜ ×!7Ñ!7¸Ó!DÓEÐEøÜò 	Fä˜ ×!7Ñ!7¸Ó!DÓEÒEÜò 	áð	ús   ‚ �$AÁAÁAc                ó˜   — t        | j                  | j                  t        «       t        | j                  | j                  t        «       y)z6Clear auth cookies, including any split cookie chunks.N)r
   rR   Úclear_cookier   r   r9   s    r-   Úclear_auth_cookiez"AuthHandlerMixin.clear_auth_cookie„   s>   € äØ×#Ñ#Ø×ÑÜô	
ô
 	 Ø×#Ñ#Ø×ÑÜõ	
r/   N)r4   ÚstrÚreturnÚNone©rW   rX   )r>   údict[str, Any]r?   rZ   rW   rX   )rH   rV   rI   rV   rW   rX   )rH   rV   rI   rV   rW   rK   )rH   rV   rW   zbytes | None)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r6   r:   r@   r<   r=   rR   rU   © r/   r-   r1   r1   F   sA   „ ÙXó!ó9ð
Ø'ð
Ø1?ð
à	ó
ó ó$Vó	ô
r/   r1   c                  ó   — e Zd Zdd„Zdd„Zy)ÚAuthLoginHandlerc              ƒ  óø   K  — | j                  «       }|€| j                  «        yt        |«      \  }}	 |j                  | |«       y# t        $ r&}| j                  dt        |«      ¬«       Y d}~yd}~ww xY w­w)z*Redirect to the OAuth provider login page.Ni�  )Úreason)Ú_parse_provider_tokenr:   r.   Úauthorize_redirectrQ   Ú
send_errorrV   )r5   r&   Úclientr(   Úes        r-   ÚgetzAuthLoginHandler.get“   ss   è ø€ à×-Ñ-Ó/ˆØÐØ×!Ñ!Ô#Øä2°8Ó<Ñˆ�ð	0Ø×%Ñ% d¨LÕ9øÜò 	0Ø�O‰O˜C¬¨A«ˆO×/Ñ/ûð	0üs.   ‚2A:µA ÁA:Á	A7ÁA2Á-A:Á2A7Á7A:c                ól   — | j                  dd «      }|€y 	 t        |«      }|d   S # t        $ r Y y w xY w)Nr&   )Úget_argumentr   r   )r5   Úprovider_tokenÚpayloads      r-   rd   z&AuthLoginHandler._parse_provider_token    sM   € Ø×*Ñ*¨:°tÓ<ˆØÐ!Øð	Ü+¨NÓ;ˆGð �zÑ"Ð"øô "ò 	Ùð	ús   —' §	3²3NrY   ©rW   z
str | None)r[   r\   r]   ri   rd   r_   r/   r-   ra   ra   ’   s   „ ó0ô	#r/   ra   c                  ó$   — e Zd Zdd„Zdd„Zdd„Zy)ÚAuthLogoutHandlerc                óŒ   — | j                  «        | j                  «       }|r| j                  |«       y | j                  «        y r3   )rU   Ú_get_provider_logout_urlr8   r:   )r5   Úprovider_logout_urls     r-   ri   zAuthLogoutHandler.get­   s9   € Ø×ÑÔ à"×;Ñ;Ó=ÐÙØ�M‰MÐ-Õ.à×!Ñ!Õ#r/   c                óŠ   — t        «       }|sy t        |«      }|sy |j                  d«      st        j	                  d«       y |S )Nz/oauth2callbackz.Redirect URI does not end with /oauth2callback)r   r   Úendswithr   Úwarning)r5   r'   r(   s      r-   Ú_get_redirect_uriz#AuthLogoutHandler._get_redirect_uri¶   sE   € Ü/Ó1ˆÙØä'¨Ó5ˆÙØà×$Ñ$Ð%6Ô7Ü�O‰OÐLÔMØàÐr/   c                ó  — t        | j                  t        «      }|sy	 t        j                  |«      }|j                  d«      }|syt        |«      \  }}|j                  «       }|j                  d«      }|st        j                  d|«       y| j                  «       }|€t        j                  d«       y|j                  |dœ}	t        | j                  t        «      }
|
r.	 t        j                  |
«      }|j                  d«      }|r||	d<   |› d
t!        |	«      › �S # t        j                  t        f$ r t        j                  d	«       Y yw xY w# t"        $ r }t        j%                  d|«       Y d}~yd}~ww xY w)z7Get the OAuth provider's logout URL from OIDC metadata.Nr&   Úend_session_endpointz-No end_session_endpoint found for provider %sz$Redirect url could not be determined)Ú	client_idÚpost_logout_redirect_uriÚid_tokenÚid_token_hintz#Error, invalid tokens cookie value.ú?z%Failed to get provider logout URL: %s)r   rR   r   ÚjsonÚloadsri   r.   Úload_server_metadatar   Úinforw   rz   r   ÚJSONDecodeErrorÚ	TypeErrorÚ	exceptionr   rQ   rv   )r5   Úcookie_valuer>   r&   rg   Ú_Úmetadatary   r(   Úlogout_paramsÚtokens_cookie_valuer?   r|   rh   s                 r-   rr   z*AuthLogoutHandler._get_provider_logout_urlÅ   sz  € ä-¨d×.EÑ.EÔGWÓXˆáØð0	ÜŸ
™
 <Ó0ˆIØ —}‘} ZÓ0ˆHÙØä+¨HÓ5‰IˆF�Aà×2Ñ2Ó4ˆHØ#+§<¡<Ð0FÓ#GÐ á'Ü—‘ÐLÈhÔWØð
  ×1Ñ1Ó3ˆLØÐ#Ü—‘ÐCÔDØð $×-Ñ-Ø,8ñˆMô #9Ø×'Ñ'Ô);ó#Ðñ #ð	 Ü!ŸZ™ZÐ(;Ó<�FØ%Ÿz™z¨*Ó5�HÙØ9A˜ oÑ6ð +Ð+¨1¬Y°}Ó-EÐ,FÐGÐGøô ×,Ñ,¬iÐ8ò  Ü×%Ñ%Ø=ôñ  ð	 ûô ò 	Ü�O‰OÐCÀQÔGÜûð	úsN   Ÿ(E ÁAE Â'E Â8+E Ã$-D! ÄE Ä!.EÅE ÅEÅE Å	E>ÅE9Å9E>NrY   rn   )r[   r\   r]   ri   rw   rr   r_   r/   r-   rp   rp   ¬   s   „ ó$óô7r/   rp   c                  ó$   — e Zd Zdd„Zdd„Zdd„Zy)ÚAuthCallbackHandlerc              ƒ  ó.  K  — | j                  «       }|€| j                  «        y | j                  «       }|€&t        j	                  d«       | j                  «        y | j                  dd «      }|r‚| j                  dd «      }|j                  dd«      j                  dd«      }|r"|j                  dd«      j                  dd«      nd }t        j	                  d||«       | j                  «        y t        |«      \  }}|j                  | «      }	t        d|	j                  d	«      «      }
t        |
|d
|¬«      }dD �ci c]  }||	v sŒ||	|   “Œ }}|
r| j                  ||«       nt        j	                  d«       | j                  «        y c c}w ­w)Nz:Error, misconfigured origin for `redirect_uri` in secrets.ÚerrorÚerror_descriptionú
Ú úz6Error during authentication: %s. Error description: %srZ   ÚuserinfoT)ÚoriginÚis_logged_inr&   )r|   Úaccess_tokenzError, missing user info.)Ú_get_provider_by_stater:   Ú_get_origin_from_secretsr   rŽ   rk   Úreplacer.   Úauthorize_access_tokenr   ri   Údictr@   )r5   r&   r”   rŽ   r�   Úsanitized_errorÚsanitized_error_descriptionrg   r‡   ÚtokenÚuserr†   Úkr?   s                 r-   ri   zAuthCallbackHandler.get   s‘  è ø€ Ø×.Ñ.Ó0ˆØÐð ×!Ñ!Ô#Øà×.Ñ.Ó0ˆØˆ>Ü�M‰MØLôð ×!Ñ!Ô#Øà×!Ñ! '¨4Ó0ˆÙØ $× 1Ñ 1Ð2EÀtÓ LÐØ#Ÿm™m¨D°"Ó5×=Ñ=¸dÀBÓGˆOñ %ð "×)Ñ)¨$°Ó3×;Ñ;¸DÀ"ÔEàð (ô
 �M‰MØHØØ+ôð
 ×!Ñ!Ô#Øä'¨Ó1‰	ˆ�Ø×-Ñ-¨dÓ3ˆÜÐ$ e§i¡i°
Ó&;Ó<ˆä˜D¨¸dÈXÔVˆØ'CÖR !ÀqÈEÂz�!�U˜1‘X‘+ÐRˆÐRáØ× Ñ  ¨vÕ6ô �M‰MÐ5Ô6Ø×ÑÕùò Sùs   ‚D?FÅ	FÅFÅAFc                ó  — | j                  dd «      }|€y t        t        j                  «       j	                  «       «      }i }|D ]  }	 |j                  d«      \  }}}}|||<   Œ  |j                  |«      }|S # t        $ r Y Œ?w xY w)NÚstater‡   )rk   Úlistr#   Úget_dictÚkeysÚsplitÚ
ValueErrorri   )	r5   Ústate_code_from_urlÚcurrent_cache_keysÚstate_provider_mappingÚkeyr‡   Úrecorded_providerÚcoder&   s	            r-   r—   z*AuthCallbackHandler._get_provider_by_state/  s¥   € Ø"×/Ñ/°¸Ó>ÐØÐ&Øä!¤*×"5Ñ"5Ó"7×"<Ñ"<Ó">Ó?ÐØ!#ÐØ%ò 	=ˆCðØ03·	±	¸#³Ñ-��1Ð'¨ð ,=Ð" 4Ò(ð	=ð   6×9Ñ9Ð:MÓNˆØˆøô ò áðús   Á	A9Á9	BÂBc                óŒ   — d }t        «       }|rt        |«      }|sy t        |«      }|j                  dz   |j                  z   }|S )Nz://)r   r   r   ÚschemeÚnetloc)r5   r(   r'   Úredirect_uri_parsedÚorigin_from_redirect_uris        r-   r˜   z,AuthCallbackHandler._get_origin_from_secretsI  sT   € ØˆÜ/Ó1ˆÙÜ+¨LÓ9ˆLáØä& |Ó4Ðà×&Ñ&¨Ñ.Ð1D×1KÑ1KÑKð 	!ð (Ð'r/   NrY   rn   )r[   r\   r]   ri   r—   r˜   r_   r/   r-   rŒ   rŒ   ÿ   s   „ ó- ó^ô4(r/   rŒ   )r&   rV   rW   ztuple[TornadoOAuth2App, str]),Ú
__future__r   r   Útypingr   r   r   Úurllib.parser   r   Útornado.webÚtornadoÚstreamlit.auth_utilr	   r
   r   r   r   r   r   r   Ústreamlit.errorsr   Ústreamlit.loggerr   Ústreamlit.url_utilr   Ústreamlit.web.server.oidc_mixinr   r   Ú streamlit.web.server.server_utilr   r   r[   r   Ú__annotations__r#   r.   ÚwebÚRequestHandlerr1   ra   rp   rŒ   r_   r/   r-   ú<module>rÁ      s½   ðö #ã ß #Ñ #ß ,ã ÷	÷ 	ó 	õ 0Ý 'Ý ,ß Jß Qá˜HÓ%€ˆÓ %á‹[€
ó7ô6I
�w—{‘{×1Ñ1ô I
ôX#Ð'¨¯©×)CÑ)Cô #ô4PÐ(¨'¯+©+×*DÑ*Dô PôfW(Ð*¨G¯K©K×,FÑ,Fõ W(r/   