
    5i1                       U d dl mZ d dlZd dlmZmZmZ d dlmZm	Z	 d dl
Zd dlmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZm Z   ee!      Z"de#d<    e       Z$ddZ% G d dejL                  jN                        Z( G d de(ejL                  jN                        Z) G d de(ejL                  jN                        Z* G d de(ejL                  jN                        Z+y)    )annotationsN)AnyFinalcast)	urlencodeurlparse)	AuthCacheclear_cookie_and_chunksdecode_provider_token!generate_default_provider_sectionget_cookie_with_chunksget_redirect_uriget_secrets_auth_sectionset_cookie_with_chunks)StreamlitAuthError)
get_logger)make_url_path)TornadoOAuthTornadoOAuth2App)AUTH_COOKIE_NAMETOKENS_COOKIE_NAMEr   _LOGGERc                f   t               }|r t        |      xs d}|j                         }ni }d}|j                  | i       }|s| dk(  rt	        |      }||d<   |j                  di       }d|vrd|d<   d|vrd|d<   t        |t              }|j                  |        |j                  |       |fS )	zRCreate an OAuth client for the given provider based on secrets.toml configuration./defaultclient_kwargsscopezopenid email profilepromptselect_account)cache)	r   r   to_dict
setdefaultr   r   
auth_cacheregistercreate_client)providerauth_sectionredirect_uriconfigprovider_sectionprovider_client_kwargsoauths          s/home/obispo/Crisostomo_bridge/mision_env/lib/python3.12/site-packages/streamlit/web/server/oauth_authlib_routes.pycreate_oauth_clientr.   +   s    +-L'5<%%'((26I 5<\J,y-88"M,,*@w'--+;x(z2E	NN8x(,66    c                  T    e Zd ZdZd
dZddZ	 	 	 	 	 	 ddZddZddZddZ	ddZ
y	)AuthHandlerMixinzNMixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0.c                    || _         y N)base_url)selfr4   s     r-   
initializezAuthHandlerMixin.initializeI   s	     r/   c                N    | j                  t        | j                  d             y )Nr   )redirectr   r4   r5   s    r-   redirect_to_basez!AuthHandlerMixin.redirect_to_baseL   s    mDMM378r/   c                    t        | j                  | j                  t        |       t        | j                  | j                  t        |       y r3   )r   _set_single_cookie_create_signed_valuer   r   )r5   	user_infotokenss      r-   set_auth_cookiez AuthHandlerMixin.set_auth_cookieO   sF     	##%%		
 	##%%		
r/   c                t    	 | j                  ||d       y# t        $ r | j                  ||d       Y yw xY w)zSet a single cookie.T)httpOnly)httponlyN)set_signed_cookieAttributeErrorset_secure_cookier5   cookie_namevalues      r-   r<   z#AuthHandlerMixin._set_single_cookie_   sR    	 "" # 
  	"" # 	s    77c                ~    	 | j                  ||      S # t        $ r t        d| j                  ||            cY S w xY w)zCreate a signed cookie value.bytes)create_signed_valuerE   r   create_secure_cookie_valuerG   s      r-   r=   z%AuthHandlerMixin._create_signed_valueq   sF    	V++K?? 	V!@!@e!TUU	Vs    %<<c                    	 t        d| j                  |            S # t        $ r t        d| j                  |            cY S t        $ r Y yw xY w)zGet a signed cookie.rK   N)r   get_signed_cookierE   get_secure_cookie	Exception)r5   rH   s     r-   _get_signed_cookiez#AuthHandlerMixin._get_signed_cookiey   sR    	!7!7!DEE 	F!7!7!DEE 		s    $AAAc                    t        | j                  | j                  t               t        | j                  | j                  t               y)z6Clear auth cookies, including any split cookie chunks.N)r
   rR   clear_cookier   r   r9   s    r-   clear_auth_cookiez"AuthHandlerMixin.clear_auth_cookie   s>    ##	

 	 ##	
r/   N)r4   strreturnNonerW   rX   )r>   dict[str, Any]r?   rZ   rW   rX   )rH   rV   rI   rV   rW   rX   )rH   rV   rI   rV   rW   rK   )rH   rV   rW   zbytes | None)__name__
__module____qualname____doc__r6   r:   r@   r<   r=   rR   rU    r/   r-   r1   r1   F   sA    X!9
'
1?
	
 $V	
r/   r1   c                      e Zd ZddZddZy)AuthLoginHandlerc                   K   | j                         }|| j                          yt        |      \  }}	 |j                  | |       y# t        $ r&}| j                  dt        |             Y d}~yd}~ww xY ww)z*Redirect to the OAuth provider login page.Ni  )reason)_parse_provider_tokenr:   r.   authorize_redirectrQ   
send_errorrV   )r5   r&   clientr(   es        r-   getzAuthLoginHandler.get   ss     --/!!#28<	0%%dL9 	0OOCAO//	0s.   2A:A A:	A7A2-A:2A77A:c                l    | j                  dd       }|y 	 t        |      }|d   S # t        $ r Y y w xY w)Nr&   )get_argumentr   r   )r5   provider_tokenpayloads      r-   rd   z&AuthLoginHandler._parse_provider_token   sM    **:t<!	+N;G z"" " 		s   ' 	33NrY   rW   z
str | None)r[   r\   r]   ri   rd   r_   r/   r-   ra   ra      s    0	#r/   ra   c                  $    e Zd ZddZddZddZy)AuthLogoutHandlerc                    | j                          | j                         }|r| j                  |       y | j                          y r3   )rU   _get_provider_logout_urlr8   r:   )r5   provider_logout_urls     r-   ri   zAuthLogoutHandler.get   s9     ";;=MM-.!!#r/   c                    t               }|sy t        |      }|sy |j                  d      st        j	                  d       y |S )Nz/oauth2callbackz.Redirect URI does not end with /oauth2callback)r   r   endswithr   warning)r5   r'   r(   s      r-   _get_redirect_uriz#AuthLogoutHandler._get_redirect_uri   sE    /1'5$$%67OOLMr/   c                   t        | j                  t              }|sy	 t        j                  |      }|j                  d      }|syt        |      \  }}|j                         }|j                  d      }|st        j                  d|       y| j                         }|t        j                  d       y|j                  |d}	t        | j                  t              }
|
r.	 t        j                  |
      }|j                  d      }|r||	d<   | d
t!        |	       S # t        j                  t        f$ r t        j                  d	       Y yw xY w# t"        $ r }t        j%                  d|       Y d}~yd}~ww xY w)z7Get the OAuth provider's logout URL from OIDC metadata.Nr&   end_session_endpointz-No end_session_endpoint found for provider %sz$Redirect url could not be determined)	client_idpost_logout_redirect_uriid_tokenid_token_hintz#Error, invalid tokens cookie value.?z%Failed to get provider logout URL: %s)r   rR   r   jsonloadsri   r.   load_server_metadatar   inforw   rz   r   JSONDecodeError	TypeError	exceptionr   rQ   rv   )r5   cookie_valuer>   r&   rg   _metadatary   r(   logout_paramstokens_cookie_valuer?   r|   rh   s                 r-   rr   z*AuthLogoutHandler._get_provider_logout_url   sz   -d.E.EGWX0	

<0I }}Z0H+H5IFA224H#+<<0F#G 'LhW
  113L#CD $--,8M #9'');# #	 !ZZ(;<F%zz*5H9Ao6 ++1Y}-E,FGG ,,i8  %%=  	   	OOCQG	sN   (E AE 'E 8+E $-D! E !.EE EE 	E>E99E>NrY   rn   )r[   r\   r]   ri   rw   rr   r_   r/   r-   rp   rp      s    $7r/   rp   c                  $    e Zd ZddZddZddZy)AuthCallbackHandlerc                .  K   | j                         }|| j                          y | j                         }|&t        j	                  d       | j                          y | j                  dd       }|r| j                  dd       }|j                  dd      j                  dd      }|r"|j                  dd      j                  dd      nd }t        j	                  d||       | j                          y t        |      \  }}|j                  |       }	t        d|	j                  d	            }
t        |
|d
|      }dD ci c]  }||	v s||	|    }}|
r| j                  ||       nt        j	                  d       | j                          y c c}w w)Nz:Error, misconfigured origin for `redirect_uri` in secrets.errorerror_description
 z6Error during authentication: %s. Error description: %srZ   userinfoT)originis_logged_inr&   )r|   access_tokenzError, missing user info.)_get_provider_by_stater:   _get_origin_from_secretsr   r   rk   replacer.   authorize_access_tokenr   ri   dictr@   )r5   r&   r   r   r   sanitized_errorsanitized_error_descriptionrg   r   tokenuserr   kr?   s                 r-   ri   zAuthCallbackHandler.get   s    ..0 !!#..0>MML !!#!!'40 $ 1 12Et L#mmD"5==dBGO % "))$3;;D"E (
 MMH+
 !!#'1	--d3$eii
&;<DdXV'CR!qEz!U1X+RR  v6 MM56 Ss   D?F	FFAFc                   | j                  dd       }|y t        t        j                         j	                               }i }|D ]  }	 |j                  d      \  }}}}|||<     |j                  |      }|S # t        $ r Y ?w xY w)Nstater   )rk   listr#   get_dictkeyssplit
ValueErrorri   )	r5   state_code_from_urlcurrent_cache_keysstate_provider_mappingkeyr   recorded_providercoder&   s	            r-   r   z*AuthCallbackHandler._get_provider_by_state/  s    "//>&!*"5"5"7"<"<">?!#% 	=C03		#-1' ,="4(	=   699:MN  s   	A99	BBc                    d }t               }|rt        |      }|sy t        |      }|j                  dz   |j                  z   }|S )Nz://)r   r   r   schemenetloc)r5   r(   r'   redirect_uri_parsedorigin_from_redirect_uris        r-   r   z,AuthCallbackHandler._get_origin_from_secretsI  sT    /1+L9L&|4&&.1D1K1KK 	! ('r/   NrY   rn   )r[   r\   r]   ri   r   r   r_   r/   r-   r   r      s    - ^4(r/   r   )r&   rV   rW   ztuple[TornadoOAuth2App, str]),
__future__r   r   typingr   r   r   urllib.parser   r   tornado.webtornadostreamlit.auth_utilr	   r
   r   r   r   r   r   r   streamlit.errorsr   streamlit.loggerr   streamlit.url_utilr   streamlit.web.server.oidc_mixinr   r    streamlit.web.server.server_utilr   r   r[   r   __annotations__r#   r.   webRequestHandlerr1   ra   rp   r   r_   r/   r-   <module>r      s    #  # # , 	 	 	 0 ' , J QH% %[
76I
w{{11 I
X#')C)C #4P('++*D*D PfW(*GKK,F,F W(r/   