
    g1                       d dl mZ d dlZd dlmZ d dlmZ d dlZd dl	m
Z
mZmZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ  e
       Zdd
Z G d dej2                  j4                        Z G d deej2                  j4                        Z G d deej2                  j4                        Z G d deej2                  j4                        Zy)    )annotationsN)Any)urlparse)	AuthCachedecode_provider_token!generate_default_provider_sectionget_secrets_auth_section)StreamlitAuthError)make_url_path)TornadoOAuthTornadoOAuth2App)AUTH_COOKIE_NAMEc                l   t               }|r#|j                  dd      }|j                         }ni }d}|j                  | i       }|s| dk(  rt	        |      }||d<   |j                  di       }d|vrd|d<   d|vrd	|d<   t        |t        
      }|j                  |        |j                  |       |fS )zRCreate an OAuth client for the given provider based on secrets.toml configuration.redirect_uriN/defaultclient_kwargsscopezopenid email profilepromptselect_account)cache)	r	   getto_dict
setdefaultr   r   
auth_cacheregistercreate_client)providerauth_sectionr   configprovider_sectionprovider_client_kwargsoauths          ^/var/www/openai/venv/lib/python3.12/site-packages/streamlit/web/server/oauth_authlib_routes.pycreate_oauth_clientr%   $   s    +-L#''=%%'((26I 5<\J,y-88"M,,*@w'--+;x(z2E	NN8x(,66    c                  0    e Zd ZdZddZddZd	dZddZy)
AuthHandlerMixinzNMixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0.c                    || _         y N)base_url)selfr+   s     r$   
initializezAuthHandlerMixin.initializeB   s	     r&   c                N    | j                  t        | j                  d             y )Nr   )redirectr   r+   r,   s    r$   redirect_to_basez!AuthHandlerMixin.redirect_to_baseE   s    mDMM378r&   c                    t        j                  |      }	 | j                  t        |d       y # t        $ r | j                  t        |d       Y y w xY w)NT)httpOnly)httponly)jsondumpsset_signed_cookier   AttributeErrorset_secure_cookie)r,   	user_infoserialized_cookie_values      r$   set_auth_cookiez AuthHandlerMixin.set_auth_cookieH   sa    "&**Y"7	 "" ' # 
  	"" ' # 	s   0 !AAc                .    | j                  t               y r*   )clear_cookier   r0   s    r$   clear_auth_cookiez"AuthHandlerMixin.clear_auth_cookieZ   s    *+r&   N)r+   strreturnNone)rA   rB   )r:   zdict[str, Any]rA   rB   )__name__
__module____qualname____doc__r-   r1   r<   r?    r&   r$   r(   r(   ?   s    X!9$,r&   r(   c                      e Zd Zd ZddZy)AuthLoginHandlerc                   K   | j                         }|| j                          yt        |      \  }}	 |j                  | |       y# t        $ r&}| j                  dt        |             Y d}~yd}~ww xY ww)z*Redirect to the OAuth provider login page.Ni  )reason)_parse_provider_tokenr1   r%   authorize_redirect	Exception
send_errorr@   )r,   r   clientr   es        r$   r   zAuthLoginHandler.get_   ss     --/!!#28<	0%%dL9 	0OOCAO//	0s.   2A:A A:	A7A2-A:2A77A:c                    | j                  dd       }	 |t        d      t        |      }|d   S # t        $ r Y y w xY w)Nr   zMissing provider token)get_argumentr
   r   )r,   provider_tokenpayloads      r$   rL   z&AuthLoginHandler._parse_provider_tokenl   sV    **:t<	%()ABB+N;G z"" " 		s   1 	==NrA   z
str | None)rC   rD   rE   r   rL   rG   r&   r$   rI   rI   ^   s    0	#r&   rI   c                      e Zd Zd Zy)AuthLogoutHandlerc                D    | j                          | j                          y r*   )r?   r1   r0   s    r$   r   zAuthLogoutHandler.gety   s     r&   N)rC   rD   rE   r   rG   r&   r$   rX   rX   x   s     r&   rX   c                  "    e Zd Zd ZddZddZy)AuthCallbackHandlerc                  K   | j                         }| j                         }|| j                          y | j                  dd       }|r| j                          y || j                          y t	        |      \  }}|j                  |       }|j                  d      }t        ||d      }|r| j                  |       | j                          y w)NerroruserinfoT)originis_logged_in)	_get_provider_by_state_get_origin_from_secretsr1   rS   r%   authorize_access_tokenr   dictr<   )	r,   r   r_   r]   rP   _tokenusercookie_values	            r$   r   zAuthCallbackHandler.get   s     ..0..0>!!#!!'40!!#!!#'1	--d3yy$DdC  .s   CCc                    | j                  d      }t        t        j                         j	                               }i }|D ]  }|j                  d      \  }}}}|||<    |j                  |d       }|S )Nstatere   )rS   listr   get_dictkeyssplitr   )	r,   state_code_from_urlcurrent_cache_keysstate_provider_mappingkeyre   recorded_providercoder   s	            r$   ra   z*AuthCallbackHandler._get_provider_by_state   s|    "//8!*"5"5"7"<"<">?!#%C,/IIcN)Aq#T+<"4( &  699:MtTr&   c                    d }t               }|r|j                  dd       }|sy t        |      }|j                  dz   |j                  z   }|S )Nr   z://)r	   r   r   schemenetloc)r,   r   r   redirect_uri_parsedorigin_from_redirect_uris        r$   rb   z,AuthCallbackHandler._get_origin_from_secrets   s\    /1'++NDAL&|4&&.1D1K1KK 	! ('r&   NrV   )rC   rD   rE   r   ra   rb   rG   r&   r$   r[   r[   ~   s     2	(r&   r[   )r   r@   rA   ztuple[TornadoOAuth2App, str])
__future__r   r5   typingr   urllib.parser   tornado.webtornadostreamlit.auth_utilr   r   r   r	   streamlit.errorsr
   streamlit.url_utilr   streamlit.web.server.oidc_mixinr   r    streamlit.web.server.server_utilr   r   r%   webRequestHandlerr(   rI   rX   r[   rG   r&   r$   <module>r      s    #   !   0 , J =[
76,w{{11 ,>#')C)C #4 ('++*D*D  2(*GKK,F,F 2(r&   