Ë
    úmxi  ã                  ó¬   — d dl mZ d dlmZmZmZ d dlmZmZm	Z	m
Z
mZ d dlmZ d dlmZ erd dlmZ d dlZd dlmZ  G d	„ d
e	ee«      Z G d„ de«      Zy)é    )Úannotations)ÚTYPE_CHECKINGÚAnyÚcast)ÚBaseAppÚ	BaseOAuthÚOAuth2MixinÚ
OAuthErrorÚOpenIDMixin)ÚOAuth2Session)ÚTornadoIntegration)ÚCallableN)Ú	AuthCachec                  óZ   ‡ — e Zd ZeZdˆ fd„Z	 d	 	 	 	 	 	 	 dd„Z	 	 	 	 	 	 dd„Zd	d„Zˆ xZ	S )
ÚTornadoOAuth2Appc                ó~   •— t        dt        ‰| �	  «       «      }d|j                  dg «      v rd| j                  d<   |S )zGWe enforce S256 code challenge method if it is supported by the server.údict[str, Any]ÚS256Ú code_challenge_methods_supportedÚcode_challenge_method)r   ÚsuperÚload_server_metadataÚgetÚclient_kwargs)ÚselfÚresultÚ	__class__s     €úV/home/htdocs/ttos/venv/lib/python3.12/site-packages/streamlit/web/server/oidc_mixin.pyr   z%TornadoOAuth2App.load_server_metadata-   sB   ø€ äÐ&¬©Ñ(DÓ(FÓGˆØ�V—Z‘ZÐ BÀBÓGÑGØ:@ˆD×ÑÐ6Ñ7Øˆó    c                ó~   —  | j                   |fi |¤Ž} | j                  dd|i|¤Ž |j                  |d   d¬«       y)a(  Create a HTTP Redirect for Authorization Endpoint.

        :param request_handler: HTTP request instance from Tornado.
        :param redirect_uri: Callback or redirect URI for authorization.
        :param kwargs: Extra parameters to include.
        :return: A HTTP redirect response.
        Úredirect_uriÚurli.  )ÚstatusN© )Úcreate_authorization_urlÚ_save_authorize_dataÚredirect)r   Úrequest_handlerr!   ÚkwargsÚauth_contexts        r   Úauthorize_redirectz#TornadoOAuth2App.authorize_redirect4   sK   € ð 5�t×4Ñ4°\ÑLÀVÑLˆØ!ˆ×!Ñ!ÑL¨|ÐL¸|ÒLØ× Ñ  ¨eÑ!4¸SÐ ÕAr   c                óR  — |j                  dd«      }|r|j                  dd«      }t        ||¬«      ‚|j                  d«      |j                  d«      dœ}i }|j                  dd«      }| j                  j	                  ||j                  d«      «      }| j                  j                  ||j                  d«      «       |st        d	d
¬«      ‚| j                  ||«      } | j                  di |¤|¤Ž}	d|	v r#d|v r| j                  |	|d   |¬«      }
i |	¥d|
i¥}	t        d|	«      S )zl
        :param request_handler: HTTP request instance from Tornado.
        :return: A token dict.
        ÚerrorNÚerror_description)r-   ÚdescriptionÚcodeÚstate)r0   r1   Úclaims_optionsÚinvalid_statez>OAuth state not found or expired. Please try logging in again.Úid_tokenÚnonce)r5   r2   Úuserinfor   r$   )Úget_argumentr
   ÚpopÚ	frameworkÚget_state_datar   Úclear_state_dataÚ_format_state_paramsÚfetch_access_tokenÚparse_id_tokenr   )r   r(   r)   r-   r/   ÚparamsÚsessionr2   Ú
state_dataÚtokenr6   s              r   Úauthorize_access_tokenz'TornadoOAuth2App.authorize_access_tokenE   sG  € ð  ×,Ñ,¨W°dÓ;ˆÙØ)×6Ñ6Ð7JÈDÓQˆKÜ 5°kÔBÐBð $×0Ñ0°Ó8Ø$×1Ñ1°'Ó:ñ
ˆð #%ˆàŸ™Ð$4°dÓ;ˆØ—^‘^×2Ñ2°7¸F¿J¹JÀwÓ<OÓPˆ
Ø�‰×'Ñ'¨°·±¸GÓ1DÔEáÜØ%Ø\ôð ð
 ×*Ñ*¨:°vÓ>ˆØ'�×'Ñ'Ñ;¨&Ð;°FÑ;ˆà˜Ñ 7¨jÑ#8Ø×*Ñ*Ø˜Z¨Ñ0Àð +ó ˆHð 4�uÐ3˜j¨(Ñ3ˆEÜÐ$ eÓ,Ð,r   c                ó€   — |j                  dd«      }|r i }| j                  j                  |||«       yt        d«      ‚)a\  Authlib underlying uses the concept of "session" to store state data.
        In Tornado, we don't have a session, so we use an empty dict as a placeholder.
        We also override state access to use the cache instead of session in `TornadoIntegration`.
        Authlib 1.6.6+ always writes state to session even when cache is available.
        r1   NzMissing state value)r8   r9   Úset_state_dataÚRuntimeError)r   r)   r1   r@   s       r   r&   z%TornadoOAuth2App._save_authorize_datan   s>   € ð —
‘
˜7 DÓ)ˆÙØ&(ˆGØ�N‰N×)Ñ)¨'°5¸&ÕAäÐ4Ó5Ð5r   )Úreturnr   )N)r(   útornado.web.RequestHandlerr!   r   r)   r   rG   ÚNone)r(   rH   r)   r   rG   r   )r)   r   rG   rI   )
Ú__name__Ú
__module__Ú__qualname__r   Ú
client_clsr   r+   rC   r&   Ú__classcell__©r   s   @r   r   r   *   se   ø„ Ø€Jõð !ðBà3ðBð ðBð ð	Bð
 
óBð"'-Ø9ð'-ØEHð'-à	ó'-÷R6r   r   c                  ó@   ‡ — e Zd ZeZeZ	 	 	 	 d	 	 	 	 	 	 	 dˆ fd„Zˆ xZS )ÚTornadoOAuthc                ó8   •— t         ‰| �  |||¬«       || _        y )N)ÚcacheÚfetch_tokenÚupdate_token)r   Ú__init__Úconfig)r   rW   rS   rT   rU   r   s        €r   rV   zTornadoOAuth.__init__€   s'   ø€ ô 	‰ÑØ [¸|ð 	ô 	
ð ˆ�r   )NNNN)rW   zdict[str, Any] | NonerS   zAuthCache | NonerT   ú1Callable[[dict[str, Any]], dict[str, Any]] | NonerU   rX   )	rJ   rK   rL   r   Úoauth2_client_clsr   Úframework_integration_clsrV   rN   rO   s   @r   rQ   rQ   |   sO   ø„ Ø(ÐØ 2Ðð )-Ø"&ØIMØJNð
à%ð
ð  ð
ð Gð	
ð
 H÷
ñ 
r   rQ   )Ú
__future__r   Útypingr   r   r   Ú authlib.integrations.base_clientr   r   r	   r
   r   Ú$authlib.integrations.requests_clientr   Ú0streamlit.web.server.authlib_tornado_integrationr   Úcollections.abcr   Útornado.webÚtornadoÚstreamlit.auth_utilr   r   rQ   r$   r   r   ú<module>rd      sP   ðõ" #ç +Ñ +÷õ õõ PáÝ(ãå-ôO6�{ K°ô O6ôd�9õ r   