}tfdZddlZddlZddlmZddlmZddlmZddlm Z m Z m Z ddl Z ddl mZmZddlmZmZdd lmZdd lmZmZmZdd lmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+m,Z,Gdde%Z-GddeZ.Gdde+eZ/Gdde/Z0Gdde/Z1Gdde0Z2Gdde2Z3d Z4y)!zw Authenticated HTTP proxy for Jupyter Notebooks Some original inspiration from https://github.com/senko/tornado-proxy N)Lockcopy)mkdtemp)quoteurlparse urlunparse)JupyterHandlerutcnow) ensure_async url_path_join)SupervisedProcess) httpclienthttputilweb)SimpleAsyncHTTPClient)BytesDictInstanceIntegerUnicodeUniondefaultobserve) HasTraits) UnixResolvercall_with_asked_args)WebSocketHandlerMixinpingable_ws_connectcJeZdZdZeej Zee ee jgZ e ZeZedZeddZedd Zed d Zed d Zed dZfdZdZxZS)RewritableResponsezJ A class to hold the response to be rewritten by rewrite_response )klass) trait_typesT) allow_noneheadersc@t|jjSN)r orig_responser'selfs g/var/www/html/software/conda/envs/higlass/lib/python3.12/site-packages/jupyter_server_proxy/handlers.py_default_headersz#RewritableResponse._default_headers+sD&&..//bodyc.|jjSr))r*r0r+s r- _default_bodyz RewritableResponse._default_body/!!&&&r/codec.|jjSr))r*r4r+s r- _default_codez RewritableResponse._default_code3r3r/reasonc.|jjSr))r*r7r+s r-_default_reasonz"RewritableResponse._default_reason7s!!(((r/c|jtjj|ddk(r)tjj|dd|_yy)NoldUnknownnew)r7r responsesget)r,changes r- _observe_codez RewritableResponse._observe_code;sK ;;(,,00 J J",,00 JDK Kr/c<t||i||jyr))super__init__r4r,argskwargs __class__s r-rDzRewritableResponse.__init__Hs $)&) r/c,t|}|||S)zI Apply a function to a copy of self, and return the copy r)r,funcr=s r-_apply_to_copyz!RewritableResponse._apply_to_copyNs4j S  r/)__name__ __module__ __qualname____doc__rr HTTPResponser*rrr HTTPHeadersr'rr0rr4rr7rr.r2r6r9rrArDrK __classcell__rHs@r-r#r#s :#:#:;M8L8L)M NOG 7D 9D  %F Y00 V_'' V_'' X)) V_ K K r/r#c4eZdZdZej dZy)AddSlashHandlerz*Add trailing slash to URLs that need them.ct|jj}|j|jdz}|j t |y)N/)path)rrequesturi_replacerXredirectr )r,rFsrcdests r-r?zAddSlashHandler.getZs?t||''(||C|0 j&'r/N)rLrMrNrOr authenticatedr?r/r-rUrUWs4((r/rUceZdZdZdZfdZddZdZfdZddZ ddZ dd Z dd Z dd Z dd Zdd ZdZdZdZdZdZdZdZdZdZdZddZdZdZdZdZdZxZ S) ProxyHandlera A tornado request handler that proxies HTTP and websockets from a given host/port combination. This class is not meant to be used directly as a means of overriding CORS. This presents significant security risks, and could allow arbitrary remote code access. Instead, it is meant to be subclassed and used for proxying URLs from trusted sources. Subclasses should implement open, http_get, post, put, delete, head, patch, and options. Ncd|_|jdd|_|jdddg|_|jdt |_d|_t| |i|y)N absolute_urlFhost_allowlist localhostz 127.0.0.1rewrite_response) proxy_basepoprerftuplerh_requested_subprotocolsrCrDrEs r-rDzProxyHandler.__init__osk"JJ~u=$jj)9K;UV &  G! (,$ $)&)r/c.tj||Sr))r check_origin)r,origins r-rnzProxyHandler.check_origin}s**488r/c Ktdw)Nz0Subclasses of ProxyHandler should implement openNotImplementedErrorr,port proxied_paths r-openzProxyHandler.opens!"TUU cdKt||i|}| |d{|jjdk(rY|jjj ddj dk(r"|jstjdytjd|y7w)z Enforce authentication on *all* requests. This method is called *before* any other method for all requests. See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.prepare. NGETUpgraderd websocketcyr)r`)request_handlers r-z&ProxyHandler.prepare..r/) rCpreparerYmethodr'r?lower current_userr HTTPErrorr_)r,rFrG _preparedrHs r-rzProxyHandler.preparesGOT4V4  OO LL  5 ( $$((B7==?;N$$mmC((% T ?? @ @    ]S S G Gr/c4|jr|j||}t||}n|}|jdsd|z}t |d}dj ||||}|j jr|d|j jzz }|S)NrWz:/?#[]@!$&'()*+,;=-._~)safez {protocol}://{host}:{port}{path})rrrtrX?)rerr startswithrformatrYquery)r,rrrtru context_path client_path client_uris r-get_client_urizProxyHandler.get_client_uris   11$=L' lCK&K%%c* +KK.FG 7>> ? <<   # 2 22 2Jr/c"|j}|jd|||}|js!|j||}||d<||d<||d<t j |f|j j|d|d|j}|S)NhttpzX-Forwarded-ContextzX-ProxyContextPathzX-Forwarded-PrefixF)rr0decompress_responser') proxy_request_headersrrerr HTTPRequestrYrproxy_request_options) r,rrtrur0r'rrreqs r-_build_proxy_requestz!ProxyHandler._build_proxy_request s,,.((t\J   11$=L-9G) *,8G( ),8G( )$$  <<&& %  ((*   r/clt|jr|j||S||jvSr))callablerf)r,rs r-_check_host_allowlistz"ProxyHandler._check_host_allowlist7s4 D'' (&&tT2 24... .r/cjK|j|stjdd|dgd}|D]2}||jjvs|jj|=4|j |jjj ddjdk(r,|jjd|jd |jj}|s|jjd vrd }nd }|jS|jjd |j|dk(sJdtdt!|j}nt#j$}|j'||||}|jjd|j( |j+|dd {} |j | j0rNt3| j0t"jur)tjd t/| j0t5| } |j6} t9| t:t<fr| } n| g} |j| |||d| }| D] dt4ffd }|j?|}"|j|j,|j@tCjD|_#|jjID]\}}|dvs |jK|||jr|jM|jy y 7}#t"j$rD} | j,dk(r/|j tjdt/| d } ~ wwxYww)z This serverextension handles: {base_url}/proxy/{port([0-9]+)}/{proxied_path} {base_url}/proxy/absolute/{port([0-9]+)}/{proxied_path} {base_url}/{proxy_base}/{proxied_path} r|zHost 'zp' is not allowed. See https://jupyter-server-proxy.readthedocs.io/en/latest/arbitrary-ports-hosts.html for info.) zProxy-Connectionz Keep-AliveTransfer-EncodingTE ConnectionTrailerrzzProxy-AuthorizationzProxy-Authenticaterzrdr{z=we wanna websocket, but we don't define WebSocketProxyHandler>PUTPOSTr/Nz Making client for Unix socket %rrg'Unix sockets only possible on localhostT)force_instanceresolverzProxying request to F) raise_erroriW)r*)rYr*rrtrXrewritable_responsec$td|iS)Nresponser)r!optional_args_to_rewrite_functionrewrites r- rewrite_pez&ProxyHandler.proxy..rewrite_pes&/&(;?r/)zContent-Lengthrr)'rrrrYr'rr?rrinfo set_statusr0r unix_socketrrrrAsyncHTTPClientrurlfetchr4rerrortyper#rhrlistrkrKr7rrQ_headersget_all add_headerwrite)r,rrtruhop_by_hop_headersheader_to_remover0clientrrerroriginal_responserhrewrite_responsesrewritten_responserheadervrrs @@r-rzProxyHandler.proxy=sd))$/--qq   !3 ; 4<<#7#77LL(()9: ;  <<   # #Ir 2 8 8 :k I HHMMO  OOC ||  ||""o5    ' HHNN=t?O?O P;& Q(Q Q&*#l4;K;K.LF //1F''dL$G -cggY78 #\\#5\AAH  >>d8>>2*:N:NN--S%89 9!3 J  $44 *T5M:$4!%5$6! <|dk(sJdjjd|tj nd jd |||jfd fd  fd }|d{y7w) z Called when a client opens a websocket connection. We establish a websocket connection to the proxied backend & set up a callback to relay messages through. r|z|Host '{host}' is not allowed. See https://jupyter-server-proxy.readthedocs.io/en/latest/arbitrary-ports-hosts.html for info.)rNrWrgrz#Opening websocket on Unix socket %rrcj|jyj|t|ty)zz Callback when the backend sends messages to us We just pass it back to the frontend Nr)rrrrr)rr,s r- message_cbz+ProxyHandler.proxy_open..message_cbs9  ! ! # ""7:gu3M"Nr/cHjj|y)zy Callback when the backend sends pings to us. We just pass it back to the frontend. N)rping)rr,s r-ping_cbz(ProxyHandler.proxy_open..ping_cbs  ! ! # IIdOr/c (Kjjdjtj}t |j d{_jjjdjjjk7rNjjdjjdjdj dyy7w) Nz,Trying to establish websocket connection to )rr')rYon_message_callbackon_ping_callback subprotocolsrz$Websocket connection established to z,Websocket subprotocol between proxy/server (z*) became different than for client/proxy (zd) due to https://github.com/jupyterhub/jupyter-server-proxy/issues/459. Requested subprotocols were .) rrrrrr!rlrselected_subprotocolwarn)rYrr'rrrr,s r-start_websocket_connectionz;ProxyHandler.proxy_open..start_websocket_connections HHMMH U V  ! ! # ,,WMG/$.!(!99! DG  ! ! # HHMM@ M Nww++t/H/HH B477C_C_B`a??C?X?X>YZ3373O3O2PPQSIsA#D&D'B*D) rrrrrrrrrrrr) r,rrtrurrr'rrrs ` @@@@@r- proxy_openzProxyHandler.proxy_opens))$/ OOC HHMMqqwqwrxr  JJL &&s+-L    ';& Q(Q Q& HHNN@$ G#D$4$45HH((tT<H ,,. O   0)***sDD D Dc|jjj}|j|j |S)z}A dictionary of headers to be used when constructing a tornado.httpclient.HTTPRequest instance for the proxy request.)rYr'rupdateget_request_headers_override)r,r's r-rz"ProxyHandler.proxy_request_headerss6,,&&++-t88:;r/ciS)zCAdd additional request headers. Typically overridden in subclasses.r`r+s r-r z)ProxyHandler.get_request_headers_override$s r/ctdddS)z}A dictionary of options to be used when constructing a tornado.httpclient.HTTPRequest instance for the proxy request.Fg@o@gr@)follow_redirectsconnect_timeoutrequest_timeout)dictr+s r-rz"ProxyHandler.proxy_request_options(s"E5  r/cy)zi http://www.tornadoweb.org/en/stable/guide/security.html Defer to proxied apps. Nr`r+s r-check_xsrf_cookiezProxyHandler.check_xsrf_cookie/rr/cf|r|nd|_|r$|jjd|d|dSy)a Select a single Sec-WebSocket-Protocol during handshake. Overrides `tornado.websocket.WebSocketHandler.select_subprotocol` that includes an informative docstring: https://github.com/tornadoweb/tornado/blob/v6.4.0/tornado/websocket.py#L337-L360. NzClient sent subprotocols: z, selecting the firstr)rlrr)r,rs r-select_subprotocolzProxyHandler.select_subprotocol6s@8D|$  HHNN,\N:OP  ? "r/r))rd)!rLrMrNrOrrDrnrvrrrrrrrrrrrrrrrrrrrrr rrrrRrSs@r-rbrbas K *9 VBB   XVWYN .A 6H$>./ L4\O+b  r/rbcReZdZdZdZdZdZdZdZdZ dZ d Z fd Z xZ S) LocalProxyHandleraN A tornado request handler that proxies HTTP and websockets from a port on the local system. Same as the above ProxyHandler, but specific to 'localhost'. The arguments "port" and "proxied_path" in each method are extracted from the URL as capture groups in the regex specified in the add_handlers method. cBK|j||d{S7wr)rrss r-rzLocalProxyHandler.http_get^sZZl3333s cDK|jd||d{S7wNrgrrss r-rvzLocalProxyHandler.openas__[$ EEEE   c&|j||Sr)rrss r-rzLocalProxyHandler.postdzz$ --r/c&|j||Sr)rrss r-rzLocalProxyHandler.putgrr/c&|j||Sr)rrss r-rzLocalProxyHandler.deletejrr/c&|j||Sr)rrss r-rzLocalProxyHandler.headmrr/c&|j||Sr)rrss r-rzLocalProxyHandler.patchprr/c&|j||Sr)rrss r-rzLocalProxyHandler.optionssrr/c&t|d||SrrCr)r,rtrurHs r-rzLocalProxyHandler.proxyvsw}[$ ==r/)rLrMrNrOrrvrrrrrrrrRrSs@r-rrSs;4F......>>r/rcReZdZdZdZdZdZdZdZdZ dZ d Z fd Z xZ S) RemoteProxyHandlera A tornado request handler that proxies HTTP and websockets from a port on a specified remote system. The arguments "host", "port" and "proxied_path" in each method are extracted from the URL as capture groups in the regex specified in the add_handlers method. cDK|j|||d{S7wr)rr,rrtrus r-rzRemoteProxyHandler.http_getsZZdL9999rc(|j|||Sr)rr(s r-rzRemoteProxyHandler.postzz$l33r/c(|j|||Sr)rr(s r-rzRemoteProxyHandler.putr*r/c(|j|||Sr)rr(s r-rzRemoteProxyHandler.deleter*r/c(|j|||Sr)rr(s r-rzRemoteProxyHandler.headr*r/c(|j|||Sr)rr(s r-rzRemoteProxyHandler.patchr*r/c(|j|||Sr)rr(s r-rzRemoteProxyHandler.optionsr*r/cDK|j|||d{S7wr)rr(s r-rvzRemoteProxyHandler.opens__T4>>>>rc&t||||Sr)r$)r,rrtrurHs r-rzRemoteProxyHandler.proxysw}T466r/)rLrMrNrOrrrrrrrrvrrRrSs@r-r&r&zs::444444?77r/r&czeZdZdZdZiZedZdZdZ fdZ dZ fdZ d Z d Zd Zd Zd ZdZxZS)NamedLocalProxyHandlera^ A tornado request handler that proxies HTTP and websockets from a port on the local system. The port is specified in config, and associated with a name which forms part of the URL. Config will create a subclass of this for each named proxy. A further subclass below is used for named proxies where we also start the server. rcR|j|jxsd|jdS)Nrdrtrrr5r+s r- process_argsz#NamedLocalProxyHandler.process_argss*II ,,2   r/c|j}t|tur|jdi|St|tur|Dcgc]}|j |c}St|t urB|jDcic]&\}}|j ||j |(c}}Stdt|cc}wcc}}w)NzValue of unrecognized type r`) r6rrrr_render_templateritems ValueError)r,valuerFrks r-r8z'NamedLocalProxyHandler._render_templates   ;# 5<<'$' ' %[D 6;<D))!,< < %[D "KKMAq%%a($*?*?*BB  :4;-HI I=s C +Ccft|rt||j}|j|S)z5Call any callables, then render any templated values.)rrr6r8)r, attributes r-_realize_rendered_templatez1NamedLocalProxyHandler._realize_rendered_templates- I ,Y8I8IJI$$Y//r/c*K|jdsd|z}|jrJt|jrt|jd|i}n|jj ||}t t |||d{S7w)NrWrX)rmappathrrr?r rCrr,rtrXrHs r-rzNamedLocalProxyHandler.proxysus#:D << %+DLL64.I||''d3!%'-d";<<<>>>s )202cTKt||j|d{S7wr))rCrvrtr,rXrHs r-rvzNamedLocalProxyHandler.opens"W\$))T2222s (&(c:|j|j|Sr)rrtrDs r-rzNamedLocalProxyHandler.postzz$))T**r/c:|j|j|Sr)rHrDs r-rzNamedLocalProxyHandler.putrIr/c:|j|j|Sr)rHrDs r-rzNamedLocalProxyHandler.deleterIr/c:|j|j|Sr)rHrDs r-rzNamedLocalProxyHandler.headrIr/c:|j|j|Sr)rHrDs r-rzNamedLocalProxyHandler.patchrIr/c:|j|j|Sr)rHrDs r-rzNamedLocalProxyHandler.optionsrIr/)rLrMrNrOrtrApropertyr6r8r?rrrvrrrrrrrRrSs@r-r3r3s^ DG    J0 =?3++++++r/r3ceZdZdZfdZdZdZedZedZ dZ dZ d Z d Z d Zd Zfd ZfdZxZS)SuperviseAndProxyHandlera A tornado request handler that proxies HTTP and websockets from a local process which is launched on demand to handle requests. The command and other process options are specified in config. A subclass of this will be made for each configured server process. cld|_d|_i|_t|_t ||i|y)NrF)requested_portrequested_unix_socketrArcommandrCrDrEs r-rDz!SuperviseAndProxyHandler.__init__s5%*" v  $)&)r/c6||_d|vrt|d<yy)N proc_lock)stater)r,rXs r- initializez#SuperviseAndProxyHandler.initializes" e #!%E+  $r/processcd|jryd|jvr|jr|j|jd<natj}|j d|jf|j d|jd<|j |jdS)zj Allocate either the requested port or a random empty port for use by application rrtrdr)rTrXrSsocketbind getsocknamer)r,socks r-rtzSuperviseAndProxyHandler.ports  % %  #""%)%8%8 6"}} 2t2234%)%5%5%7%: 6" zz&!!r/cd|jvre|jdur-td}tjj |d}n|jr |j}nd}||jd<|jdS)NrTzjupyter-server-proxy-)prefixr\)rXrTrosrXjoin)r,sock_dir sock_paths r-rz$SuperviseAndProxyHandler.unix_socketsq  *))T1"*ABGGLL8< ++ 66  (1DJJ} %zz-((r/c8|j|jSr))r?rUr+s r-get_cmdz SuperviseAndProxyHandler.get_cmd&s..t||<.>?I%dii[1CI((9=   ";;sE;B  dHHNNYt{{m;se#LM             00 uH=>         sAEC E E"C)9C :C)=-C* C)5C6C): ECE C)C)EC% CC% !C)(E)2D/E E'D*(E.D//E2 E=E>EE E EEc DK|jd4d{d|jvr/|j}|s!d|jd< dddd{ytjj }|j |j |j}t|jg|||j||jd}||jd< |jd{|jd{}|s<|jd{tj dd|jd dddd{y7T77r7\7D#|jd=xYw7$#1d{7swYyxYww) z# Start the process rWNprocz+process not managed by jupyter-server-proxy)env ready_func ready_timeoutrrzcould not start z in time)rXrgrbenvironrrrlrornamer{rstartreadykillrr)r,cmd server_envtimeoutr}is_readys r-ensure_processz'SuperviseAndProxyHandler.ensure_processNs~::k*( ( TZZ'lln)VDJJv&( ( (  ZZ__. !!$,,.1**,(II##44") &* 6" **,&&%)ZZ\1H#"iik))!mmC3CDII;h1WXX$E( ( ( ( <'1* 6*Q( ( ( ( sF E*F 2F  F E-F B F *E6=E0>E6E2E6/E40(E6F  F $F %F -F 0E62E64E66FF  F  FF FF cK|jd{tt| ||d{S7%7wr))rr rCrrBs r-rzSuperviseAndProxyHandler.proxys;!!###!%'-d";<<< $rs  44?<)--;VVV)"'A88v(n(o(.od$> $>N#7#7LJ+.J+\X(5X(v5r/