
    lKj0                         d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	lmZ dd
lmZmZ  G d de	      Z G d de      ZeZy)z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler)origin_matches_pat   )allow_unauthenticated)passwd_checkset_passwordc                   @    e Zd ZdZddZddZed        Zed        Zy)LoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc                     | j                  | j                  dt        | j                  d| j                              |             y)zRender the login form.z
login.htmlnextdefault)r   messageN)writerender_templater   get_argumentbase_url)selfr   s     j/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/jupyter_server/auth/login.py_renderzLoginFormHandler._render   sC    

   1 1&$-- 1 PQ ! 	
    c                    || j                   }|j                  dd      }d|v r,|j                  d      \  }}}| d|j                  d       }n%|j	                  d      rd|j                  d      z   }t        |      }|j                  s4|j                  s(|j                  dz   j	                  | j                         sd}|j                  s|j                  ri|j                   d|j                   }|j                         }| j                  r| j                  |k(  }n"| j                  rt        | j                  |      }|s | j                  j                  d	|z         |}| j                  |       y)
zRedirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        N\z%5C:z:///z//Fz!Not allowing login redirect to %r)r   replace	partitionlstrip
startswithr   schemenetlocpathlowerallow_originallow_origin_patr   logwarningredirect)	r   urlr   r#   _restparsedalloworigins	            r   _redirect_safezLoginFormHandler._redirect_safe"   sE    ?mmG kk$& #:!mmC0OFAtHCC 012C ~~d#SZZ_,# MMV]]FKK#4E3Q3QRVR_R_3`E}}"MM?#fmm_=$$ --7E**.t/D/DfME  !Ds!JKcr   c                     | j                   r/| j                  d| j                        }| j                  |       y| j	                          y)zGet the login form.r   r   N)current_userr   r   r2   r   )r   next_urls     r   getzLoginFormHandler.getT   s=     (((GH)LLNr   c                 ~   | j                   j                  |       x}| _        |&| j                  d       | j	                  ddi       y| j
                  j                  d|j                   d       | j                   j                  | |       | j                  d| j                  	      }| j                  |       y)
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r   r   )identity_providerprocess_login_formr4   
set_statusr   r)   infousernameset_login_cookier   r   r2   )r   userr5   s      r   postzLoginFormHandler.post]   s     $(#9#9#L#LT#RRt <OOC LL'+@!ALBdmm_K89//d;$$VT]]$CH%r   N)	__name__
__module____qualname____doc__r   r2   r	   r6   rC    r   r   r   r      s:    

0d   & &r   r   c                      e Zd ZdZed        Zd Zed        Ze	dd       Z
 ej                  dej                        Ze	d        Ze	d	        Ze	d
        Ze	d        Ze	d        Ze	d        Ze	dd       Ze	d        Ze	d        Zy)LegacyLoginHandlerzLegacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 8    | j                  | j                        S rD   )password_from_settingssettings)r   s    r   hashed_passwordz"LegacyLoginHandler.hashed_passwords   s    **4==99r   c                     t        ||      S )zCheck a passwd.)r
   )r   abs      r   r
   zLegacyLoginHandler.passwd_checkw   s    Aq!!r   c                    | j                  dd      }| j                  dd      }| j                  | j                        rr| j                  | j                  |      r2|s0| j                  | t        j                         j                         n$| j                  r| j                  |k(  r| j                  | t        j                         j                         |rt        | j                  dd      r| j                  j                  dd      }t        j                  j                  |d      }t!        | j                  d	      r+t#        ||
      x| j                  _        | j                  d<   | j$                  j'                  d|z         n&| j)                  d       | j+                  ddi       y| j                  d| j,                        }| j/                  |       y)zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.jsonrO   )config_filezWrote hashed password to %sr8   r9   r:   r;   Nr   )r   get_login_availablerN   r
   rO   rA   uuiduuid4hextokengetattrr<   r6   osr%   joinhasattrr   r)   r?   r>   r   r   r2   )r   typed_passwordrV   rX   rY   r5   s         r   rC   zLegacyLoginHandler.post{   s{    **:r*B(((D##DMM2  !5!5~F|%%dDJJL,<,<=

n <%%dDJJL,<,<=GD,B,BD[]b$c!%!2!2<!DJ"$'',,z;W"XKt557HI(;O..>zAZ HHMM"?+"MN$g/D%EF$$VT]]$CH%r   Nc                 `   |j                   j                  di       }|j                  dd       |j                   j                  d|j                  j                  dk(        r|j                  dd       |j                  d|j
                          |j                  |j                  |fi | |S )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer%   )rN   r6   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idre   s       r   rA   z#LegacyLoginHandler.set_login_cookie   s     !))--.>C!!*d3 1I1IW1TU%%h5!!&'*:*:;!!!'"5"5wQ.Qr   ztoken\s+(.+)c                     |j                  dd      }|sR| j                  j                  |j                  j                  j                  dd            }|r|j                  d      }|S )zGet the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        r^   rU   Authorizationr   )r   auth_header_patmatchrk   headersr6   group)ro   rp   
user_tokenms       r   	get_tokenzLegacyLoginHandler.get_token   s]     ))'26
##))'//*A*A*E*EoWY*Z[AWWQZ
r   c                 &    | j                  |       S )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedro   rp   s     r   should_check_originz&LegacyLoginHandler.should_check_origin   s     --g666r   c                 N    t        |dd      |j                   t        |dd      S )r|   _user_idN_token_authenticatedF)r_   r4   r~   s     r   r}   z)LegacyLoginHandler.is_token_authenticated   s,     7J-5  w 6>>r   c                    t        |dd      r|j                  S | j                  |      }| j                  |      }|xs |}|r||k7  r| j	                  ||       d|_        |_|j                  |j                        6|j                  j                  d|j                         |j                          |j                  sd}||_        |S )r|   r   NTz(Clearing invalid/expired login cookie %s	anonymous)r_   r   get_user_tokenget_user_cookierA   r   
get_cookiern   r)   r*   clear_login_cookielogin_available)ro   rp   token_user_idcookie_user_idrq   s        r   get_userzLegacyLoginHandler.get_user   s    
 7J-###**73,,W5  1> .($$Wg6 ,0G(? !!'"5"56B##$NPWPcPcd**,** & #r   c                     |j                   j                  di       } |j                  |j                  fi |}|r|j	                         }|S )r|   get_secure_cookie_kwargs)rN   r6   get_secure_cookiern   decode)ro   rp   r   rq   s       r   r   z"LegacyLoginHandler.get_user_cookie   sQ     $+#3#3#7#78RTV#W +'++G,?,?\C[\nn&Gr   c                 \   |j                   }|sy| j                  |      }d}||k(  r2|j                  j                  d|j                  j
                         d}|rQ| j                  |      }|<t        j                         j                  }|j                  j                  d|        |S y)r|   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )r^   rz   r)   debugrk   	remote_ipr   r[   r\   r]   r?   )ro   rp   r^   rx   authenticatedrq   s         r   r   z!LegacyLoginHandler.get_user_token   s     ]]7+
KKB)) !M ))'2G**,**  NwiX Nr   c                 <   |j                   s[d}||j                  j                  | d       |j                  s,|j                  s|j                  j                  | d       yyy|j                  s)|j                  s|j                  j                  d       yyy)r|   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr)   r*   rT   r^   )ro   appssl_optionsr*   s       r   validate_securityz$LegacyLoginHandler.validate_security  s     vvTG"7)+^ _`<<		i  C C )2<
 ciiGGOOT '0r   c                 &    |j                  dd      S )r|   rT   rU   )r6   ro   rN   s     r   rM   z)LegacyLoginHandler.password_from_settings$  s     ||J++r   c                 \    t        | j                  |      xs |j                  d            S )r|   r^   )boolrM   r6   r   s     r   rZ   z&LegacyLoginHandler.get_login_available)  s(     C..x8QHLL<QRRr   rD   )rE   rF   rG   rH   propertyrO   r
   r	   rC   classmethodrA   recompile
IGNORECASErt   rz   r   r}   r   r   r   r   rM   rZ   rI   r   r   rK   rK   l   s    : :" & &4 
 
 !bjj"--@O " 7 7 ? ? " "H    >  " , , S Sr   rK   )rH   r`   r   r[   urllib.parser   tornado.escaper   base.handlersr   utilsr   	decoratorr	   securityr
   r   r   rK   LoginHandlerrI   r   r   <module>r      sM    ; 
 	  ! % * & , 0W&~ W&tAS) ASJ "r   