AHjT4dZddlZddlZddlZddlZddlZddlZddlmZddl m Z m Z m Z m Z mZmZmZmZmZmZmZddlZddlZddlmZddlmZddlmZddlmZdd lm Z dd l!m"Z"ejFd kr dd l m$Z$dd l%m&Z&n dd l'm$Z$dd l m&Z&ejPe)Z*edZ+e&dZ,GddeZ-Gdde.Z/Gdde.Z0GddeZ1GddejdZ3Gdde.Z4de$e,e+fde$e,e+ffdZ5Gdd Z6y)!zSSO login base dependency.N) TracebackType) AnyClassVarDictListLiteralOptionalType TypedDictTypeVarUnionoverload)WebApplicationClient) HTTPException)Request)RedirectResponse)get_pkce_challenge_pair)generate_random_state) )Callable) ParamSpecTPc0eZdZUdZeed<eed<eed<y)DiscoveryDocumentzDiscovery document.authorization_endpointtoken_endpointuserinfo_endpointN)__name__ __module__ __qualname____doc__str__annotations__L/root/tools/cai/cai_env/lib/python3.12/site-packages/fastapi_sso/sso/base.pyrr$sr'rceZdZdZy)UnsetStateWarningz$Warning about unset state parameter.Nr r!r"r#r&r'r(r*r*,s.r'r*ceZdZdZy)ReusedOauthClientWarningz+Warning about reused oauth client instance.Nr+r&r'r(r-r-0s5r'r-ceZdZdZy) SSOLoginErrorzRaised when any login-related error ocurrs. Such as when user is not verified or if there was an attempt for fake login. Nr+r&r'r(r/r/4sr'r/ceZdZUdZdZeeed<dZee jed<dZ eeed<dZ eeed<dZ eeed<dZeeed<dZeeed <y) OpenIDzOClass (schema) to represent information got from sso provider in a common form.Nidemail first_name last_name display_namepictureprovider)r r!r"r#r2r r$r%r3pydanticEmailStrr4r5r6r7r8r&r'r(r1r1;snYB )-E8H%% &- $J $#Ix}#"&L(3-&!GXc]!"Hhsm"r'r1ceZdZdZy)SecurityWarningz&Raised when insecure usage is detectedNr+r&r'r(r<r<Gs0r'r<funcreturnc`dtjdtjdtffd }|S)Nargskwargsr>c|rt|dts|i|S|djstjdt d|i|S)NrzPlease make sure you are using SSO provider in an async context (using 'async with provider:'). See https://github.com/tomasvotava/fastapi-sso/issues/186 for more information.)category stacklevel) isinstanceSSOBase _in_stackwarningswarnr<)r@rAr=s r(wrapperz'requires_async_context..wrapperLsZ:d1gw7(( (Aw  MMb(   T$V$$r')rr@rAr)r=rKs` r(requires_async_contextrLKs, %qvv % %a % Nr'ceZdZUdZeZeed<eZeed<eZ eed<eZ e e e jefed<gZeeeed<dZee eeefed<d Zeed <d Zeed <d Zeed < d;dedede e e jefdedede eef dZede efdZeedefdZeede efdZ eede efdZ!eede efdZ"drGz!Base class for all SSO providers.r8 client_id client_secret redirect_uriscopeNadditional_headersF uses_pkcerequires_state`_pkce_challenge_lengthallow_insecure_http use_statec||_||_||_||_t j |_d|_d|_d|_ |jr=tjd|jjdtjd<|rt!j"dt$|xs |j&|_d|_d|_d|_d|_d|_d|_y)z)Base class (mixin) for all SSO providers.FNz-Initializing %s with allow_insecure_http=True1OAUTHLIB_INSECURE_TRANSPORTzArgument 'use_state' of SSOBase's constructor is deprecated and will be removed in future releases. Use 'state' argument of individual methods instead.S256)rNrOrPrWasyncioLock _login_lockrH _oauth_client_generated_stateloggerdebug __class__r osenvironrIrJDeprecationWarningrQ_scope_refresh_token _id_token_state_pkce_code_challenge_pkce_code_verifier_pkce_challenge_method)selfrNrOrPrWrXrQs r(__init__zSSOBase.__init__is("/GS)< "<<>=A/3  # # LLH$..JaJa b8;BJJ4 5  MM[#  )tzz -1(,%) 37!26 &,#r'r>cf|jtjdt|jS)agRetrieves the state as it was returned from the server. Warning: This will emit a warning if the state is unset, implying either that the server didn't return a state or `verify_and_process` hasn't been called yet. Returns: Optional[str]: The state parameter returned from the server. z'state' parameter is unset. This means the server either didn't return state (was this expected?) or 'verify_and_process' hasn't been called yet.)rkrIrJr*ros r(statez SSOBase.states/ ;;  MMk!  {{r'c|jtk(rtd|jd|jt |j|_|jS)aRetrieves the OAuth Client to aid in generating requests and parsing responses. Raises: NotImplementedError: If the provider is not supported or `client_id` is not set. Returns: WebApplicationClient: OAuth client instance. Provider  not supported)rNNotImplementedNotImplementedErrorr8r`rrrs r( oauth_clientzSSOBase.oauth_clientsQ >>^ +% $--&OP P    %!5dnn!ED !!!r'c.|jjS)zRetrieves the access token from token endpoint. Returns: Optional[str]: The access token if available. )ry access_tokenrrs r(r{zSSOBase.access_tokens  ---r'cJ|jxs|jjS)zRetrieves the refresh token if returned from provider. Returns: Optional[str]: The refresh token if available. )riry refresh_tokenrrs r(r}zSSOBase.refresh_tokens!""Ed&7&7&E&EEr'c|jS)zRetrieves the id token if returned from provider. Returns: Optional[str]: The id token if available. )rjrrs r(id_tokenzSSOBase.id_tokens~~r'responsesessionc<Ktd|jdw)aConverts a response from the provider's user info endpoint to an OpenID object. Args: response (dict): The response from the user info endpoint. session (Optional[httpx.AsyncClient]): The HTTPX AsyncClient session. Raises: NotImplementedError: If the provider is not supported. Returns: OpenID: The user information in a standardized format. rurvrxr8)rorrs r(openid_from_responsezSSOBase.openid_from_responses "Idmm_N"KLLc<Ktd|jdw)aRetrieves the discovery document containing useful URLs. Raises: NotImplementedError: If the provider is not supported. Returns: DiscoveryDocument: A dictionary containing important endpoints like authorization, token and userinfo. rurvrrrs r(get_discovery_documentzSSOBase.get_discovery_documents "Idmm_N"KLLrc`K|jd{}|jdS7w)z8Return `authorization_endpoint` from discovery document.Nrrgetro discoverys r(rzSSOBase.authorization_endpoints.5577 }}5668 .,.c`K|jd{}|jdS7w)z0Return `token_endpoint` from discovery document.Nrrrs r(rzSSOBase.token_endpoints.5577 }}-..8rc`K|jd{}|jdS7w)z3Return `userinfo_endpoint` from discovery document.Nrrrs r(rzSSOBase.userinfo_endpoints.5577 }}0118rrPparamsrsrrsc TK|xsi}|xs |j}| td|jrMt|j|j fs,t j|jjd|jrF|sD|j,t j|jjd|j}|jj|jd{f|||j|j |j d|}|S7/w)aGenerates and returns the prepared login URL. Args: redirect_uri (Optional[str]): Overrides the `redirect_uri` specified on this instance. params (Optional[Dict[str, Any]]): Additional query parameters to add to the login request. state (Optional[str]): The state parameter for the OAuth 2.0 authorization request. Raises: ValueError: If `redirect_uri` is not provided either at construction or request time. Returns: str: The prepared login URL. NzEredirect_uri must be provided, either at construction or request timez| uses PKCE and no code was generated yet. Use SSO class as a context manager to get rid of this warning and possible errors.z requires state in the request but none was provided nor generated automatically. Use SSO as a context manager. The login process will most probably fail.)rPrsrQcode_challengecode_challenge_method)rP ValueErrorrSallrmrlrIrJrdr rTraryprepare_request_urirrhrn)rorPrrs request_uris r( get_login_urlzSSOBase.get_login_urls'(2#8t'8'8  de e >>#t'?'?AZAZ&["\ MM>>**-.ee    u$$, ~~..12xx))E;d'';;-- - %++44"&"="=    .sC4D(6D&70D(cK|jr|s |j}|j|||d{}t|d}|jr%|j dt |j|S7Cw)aConstructs and returns a redirect response to the login page of OAuth SSO provider. Args: redirect_uri (Optional[str]): Overrides the `redirect_uri` specified on this instance. params (Optional[Dict[str, Any]]): Additional query parameters to add to the login request. state (Optional[str]): The state parameter for the OAuth 2.0 authorization request. Returns: RedirectResponse: A Starlette response directing to the login page of the OAuth SSO provider. rNi/pkce_code_verifier)rTrarrrS set_cookier$rm)rorPrrs login_urirs r(get_login_redirectzSSOBase.get_login_redirect/ss"   u))E,,,v]b,cc #Is3 >>    4c$:R:R6S T ds2A:A8AA:T)rheadersrPconvert_responserequestrrc KywNr&rorrrrPrs r(verify_and_processzSSOBase.verify_and_processHs )rrrPc Kywrr&rs r(rzSSOBase.verify_and_processSs $'rc K|xsi}|jjd}|Btjd|j|j |jt dd|jjd|_d}|jr2|jjd}|tjd|j||||||| d{S7w) atProcesses the login given a FastAPI (Starlette) Request object. This should be used for the /callback path. Args: request (Request): FastAPI or Starlette request object. params (Optional[Dict[str, Any]]): Additional query parameters to pass to the provider. headers (Optional[Dict[str, Any]]): Additional headers to pass to the provider. redirect_uri (Optional[str]): Overrides the `redirect_uri` specified on this instance. convert_response (bool): If True, userinfo response is converted to OpenID object. Raises: SSOLoginError: If the 'code' parameter is not found in the callback request. Returns: Optional[OpenID]: User information as OpenID instance (if convert_response == True) Optional[Dict[str, Any]]: The original JSON response from the API. codeNz9Callback request: URI: %s Headers: %s Query params: %siz2'code' parameter was not found in callback requestrsrzaPKCE code verifier was not found in the request Cookie. This will probably lead to a login error.rrRrPrr) query_paramsrrbrcurlrr/rkrScookiesrIrJ process_login)rorrrrPrrrs r(rzSSOBase.verify_and_process^s4-R##''/ < LLQ $$    %YZ Z**..w7 ,0 >>!(!4!45I!J !) w''  &%1-(    sC!C*#C($C*ctjdtdd|_d|_d|_d|_|jrt|_ |jr"t|j\|_ |_|S)NzSSO Providers are supposed to be used in async context, please change 'with provider' to 'async with provider'. See https://github.com/tomasvotava/fastapi-sso/issues/186 for more information.rC)rE)rIrJrgr`rirjrkrTrrarSrrVrmrlrrs r( __enter__zSSOBase.__enter__sv  u   ""   $9$;D ! >>BYZ^ZuZuBv ?D $d&? r'c.K|jjd{d|_d|_d|_d|_d|_|jrt|_ |jr"t|j\|_ |_|S7rw)NT)r_acquirerHr`rirjrkrTrrarSrrVrmrlrrs r( __aenter__zSSOBase.__aenter__s&&(((!"   $9$;D ! >>BYZ^ZuZuBv ?D $d&?  )sBBA3B _exc_type_exc_val_exc_tbcNKd|_|jjyw)NF)rHr_releaserorrrs r( __aexit__zSSOBase.__aexit__s!    "s#%cyrr&rs r(__exit__zSSOBase.__exit__s r'ciSrr&rrs r(_extra_query_paramszSSOBase._extra_query_paramss r'rrrc Kywrr&rorrrrRrPrrs r(rzSSOBase.process_logins r)rrRrPrc Kywrr&rs r(rzSSOBase.process_logins $'rcRK|j/d|_d|_d|_tjdt |xsi}|j |j|xsi}|j |jxsi|j}|js+|jdk7rt|jdd} n t|} |jd|j|j} |r|j d|i|j j"|j$d{f| |xs|j&xs| |d|\} } } | y| j |t)j*|j,|j.}t)j04d{}|j3| | | | d{}|j5}|j7d |_|j7d |_|j j9t5j:||j j=|j>d{\}} }| j ||j@j | |j7|d{}|j5}|r+|jC||d{cdddd{S|cdddd{S77U7;77_757'7#1d{7swYyxYww) aProcesses login from the callback endpoint to verify the user and request user info endpoint. It's a lower-level method, typically, you should use `verify_and_process` instead. Args: code (str): The authorization code. request (Request): FastAPI or Starlette request object. params (Optional[Dict[str, Any]]): Additional query parameters to pass to the provider. additional_headers (Optional[Dict[str, Any]]): Additional headers to be added to all requests. redirect_uri (Optional[str]): Overrides the `redirect_uri` specified on this instance. pkce_code_verifier (Optional[str]): A PKCE code verifier sent to the server to verify the login request. convert_response (bool): If True, userinfo response is converted to OpenID object. Raises: ReusedOauthClientWarning: If the SSO object is reused, which is not safe and caused security issues. Returns: Optional[OpenID]: User information in OpenID format if the login was successful (convert_response == True). Optional[Dict[str, Any]]: Original userinfo API endpoint response. NzReusing the SSO object is not safe and caused a security issue in previous versions.To make sure you don't see this warning, please use the SSO object as a context manager.httpszhttp://zhttps://z:// code_verifier)authorization_response redirect_urlr)rcontentauthr}r)"r`rirjrIrJr-updaterrRrrWschemer$replacenetlocpathryprepare_token_requestrrPhttpx BasicAuthrNrO AsyncClientpostjsonrparse_request_body_responsedumps add_tokenrrr)rorrrrRrPrrr current_url current_path token_urlrbodyrrrruri_s r(rzSSOBase.process_logins>    )!%D "&D !DN MMo)  2 d..//52!!$"9"9"?R@kk''CJJ',Ac(**9jAKc(K**S SXXJ?  MM?,>? @#J4#4#4#J#J%% %$ #.%J):):Jl $  $  7D  )*t~~t/A/AB$$&  '$\\)WdY]\^^HmmoG")++o">D $[[4DN    9 9$**W:M N"//99@V@V:VWOC! NN- . OO " "7 +$[[--HmmoG!66wHH       & ^ ;W.I     sD1L'3K?4A9L'-L.L'1L L BLL A L*L ++LL L L'&L'L',L- L'9L:L'L'LL L LL'L'L$L L$ L')NFFNr)r>rG)=r r!r"r#rwr8r$r%rNrOrPr r r9 AnyHttpUrlrQrrrRrrrSboolrTrVintrppropertyrsrLrryr{r}rdictrrr1rrrrrrrrrrrrrrrr BaseExceptionrrrrrr&r'r(rGrG[sc+"Hc"#Is#'M3'>LL(5!4!4c!9:;L!#E8DI #=A$sCx.!9:AIt ND "$C$ CG$)%)&-&-&-uX%8%8#%=>? &- " &-  &-S "&-Px}& "2 " ".hsm..Fx}FF(3- M4 M(5K\K\B] Mio M M.? M7hsm77 /hsm// 2#22CG+/# -uX%8%8#%=>?-c3h( - } - -d'++/# smc3h(  }   2 ,0,0&**.c3h(  $sCx.)  sm "$- &  ,0,0&* ''c3h( ' $sCx.) ' sm '"%.' $sCx. !'' ,0,0&*AE3 3 c3h( 3 $sCx.) 3 sm 3   wu~ =>3  x$sCx.!99 :3 3 j" #D/0#=)#-( #  #D/0=)-(   T ,07;&*,0*.    c3h(  %T#s(^4 sm %SM "$-  &    ,07;&*,0 ' ' ' c3h( ' %T#s(^4 'sm '%SM '"%. ' $sCx. ! ' ' ,07;&*,0AEWWW c3h( W %T#s(^4 WsmW%SMW  wu~ =>W x$sCx.!99 :WWr'rG)7r#r]rloggingresysrItypesrtypingrrrrrr r r r r rrr9oauthlib.oauth2rstarlette.exceptionsrstarlette.requestsrstarlette.responsesrfastapi_sso.pkcerfastapi_sso.stater version_infortyping_extensionsrcollections.abc getLoggerr rbrrr UserWarningr*r-r/ BaseModelr1r<rLrGr&r'r(rs   jjjj 0.&043g+(   8 $ CL cN / /6{6M #X   #1k1 !Q$ HQTN  ^^r'