o
    ,&]i                     @  s  U d dl mZ d dlZd dlmZmZmZ d dlmZ d dl	Z
d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ eeZded< e ZdddZG dd de
j j!Z"G dd de"e
j j!Z#G dd de"e
j j!Z$G dd de"e
j j!Z%dS )    )annotationsN)AnyFinalcast)urlparse)	AuthCachedecode_provider_token!generate_default_provider_sectionget_secrets_auth_section)StreamlitAuthError)
get_logger)make_url_path)TornadoOAuthTornadoOAuth2App)AUTH_COOKIE_NAMEr   _LOGGERproviderstrreturntuple[TornadoOAuth2App, str]c                 C  s   t  }|r|dd}| }ni }d}|| i }|s(| dkr(t|}||d< |di }d|vr6d|d< d|vr>d	|d< t|td
}||  || |fS )zRCreate an OAuth client for the given provider based on secrets.toml configuration.redirect_uriN/defaultclient_kwargsscopezopenid email profilepromptselect_account)cache)	r
   getto_dict
setdefaultr	   r   
auth_cacheregistercreate_client)r   auth_sectionr   configprovider_sectionprovider_client_kwargsoauth r)   g/var/www/html/IGF-ODF-V3/venv/lib/python3.10/site-packages/streamlit/web/server/oauth_authlib_routes.pycreate_oauth_client'   s$   

r+   c                   @  s8   e Zd ZdZdddZddd	ZdddZdddZdS )AuthHandlerMixinzNMixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0.base_urlr   r   Nonec                 C  s
   || _ d S N)r-   )selfr-   r)   r)   r*   
initializeE   s   
zAuthHandlerMixin.initializec                 C  s   |  t| jd d S )Nr   )redirectr   r-   r0   r)   r)   r*   redirect_to_baseH   s   z!AuthHandlerMixin.redirect_to_base	user_infodict[str, Any]c                 C  s`   t |}t| dkrtd z| jt|dd W d S  ty/   | j	t|dd Y d S w )Ni   z`Authentication cookie size exceeds maximum browser limit of 4096 bytes. Authentication may fail.T)httpOnly)httponly)
jsondumpslenencoder   errorset_signed_cookier   AttributeErrorset_secure_cookie)r0   r5   serialized_cookie_valuer)   r)   r*   set_auth_cookieK   s$   
z AuthHandlerMixin.set_auth_cookiec                 C  s   |  t d S r/   )clear_cookier   r3   r)   r)   r*   clear_auth_cookied   s   z"AuthHandlerMixin.clear_auth_cookieN)r-   r   r   r.   r   r.   )r5   r6   r   r.   )__name__
__module____qualname____doc__r1   r4   rB   rD   r)   r)   r)   r*   r,   B   s    


r,   c                   @  s    e Zd Zd	ddZd
ddZdS )AuthLoginHandlerr   r.   c              
     sv   |   }|du r|   dS t|\}}z	|| | W dS  ty: } z| jdt|d W Y d}~dS d}~ww )z*Redirect to the OAuth provider login page.Ni  )reason)_parse_provider_tokenr4   r+   authorize_redirect	Exception
send_errorr   )r0   r   clientr   er)   r)   r*   r   i   s    zAuthLoginHandler.get
str | Nonec                 C  s@   |  dd }|d u rd S z	t|}W |d S  ty   Y d S w )Nr   )get_argumentr   r   )r0   provider_tokenpayloadr)   r)   r*   rL   v   s   
z&AuthLoginHandler._parse_provider_tokenNrE   r   rR   )rF   rG   rH   r   rL   r)   r)   r)   r*   rJ   h   s    
rJ   c                   @  s   e Zd ZdddZdS )AuthLogoutHandlerr   r.   c                 C  s   |    |   d S r/   )rD   r4   r3   r)   r)   r*   r      s   zAuthLogoutHandler.getNrE   )rF   rG   rH   r   r)   r)   r)   r*   rW      s    rW   c                   @  s*   e Zd ZdddZdddZddd	Zd
S )AuthCallbackHandlerr   r.   c                   s  |   }|  }|d u rtd |   d S | dd }|rK| dd }|dddd}|r<|ddddnd }td|| |   d S |d u rZtd |   d S t|\}}|	| }	t
d	|	d
}
t|
|dd}|
r|| | ntd |   d S )Nz;Error, misconfigured origin for `redirect_uri` in secrets. r=   error_description
 z6Error during authentication: %s. Error description: %szMissing provider for OAuth callback; this often indicates a stale or replayed callback (for example, from browser back/forward navigation).r6   userinfoT)originis_logged_inzError, missing user info.)_get_provider_by_state_get_origin_from_secretsr   r=   r4   rS   replacewarningr+   authorize_access_tokenr   r   dictrB   )r0   r   r^   r=   rY   sanitized_errorsanitized_error_descriptionrP   _tokenusercookie_valuer)   r)   r*   r      sP   
zAuthCallbackHandler.getrR   c           	      C  sP   |  d}tt  }i }|D ]}|d\}}}}|||< q||}|S )Nstaterh   )rS   listr!   get_dictkeyssplitr   )	r0   state_code_from_urlcurrent_cache_keysstate_provider_mappingkeyrh   recorded_providercoder   r)   r)   r*   r`      s   


z*AuthCallbackHandler._get_provider_by_statec                 C  s>   d }t  }|r|dd }|sd S t|}|jd |j }|S )Nr   z://)r
   r   r   schemenetloc)r0   r   r$   redirect_uri_parsedorigin_from_redirect_urir)   r)   r*   ra      s   z,AuthCallbackHandler._get_origin_from_secretsNrE   rV   )rF   rG   rH   r   r`   ra   r)   r)   r)   r*   rX      s    

2rX   )r   r   r   r   )&
__future__r   r9   typingr   r   r   urllib.parser   tornado.webtornadostreamlit.auth_utilr   r   r	   r
   streamlit.errorsr   streamlit.loggerr   streamlit.url_utilr   streamlit.web.server.oidc_mixinr   r    streamlit.web.server.server_utilr   rF   r   __annotations__r!   r+   webRequestHandlerr,   rJ   rW   rX   r)   r)   r)   r*   <module>   s$   
&