
    e                     4   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlZd dlmZ d dlmZ d dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZmZ d dlmZ d	d
lmZ d	dl m!Z! d	dl"m#Z#m$Z$m%Z%m&Z&m'Z' d	dl(m)Z) d	dl*m+Z+m,Z,  ej-        e.          Z/dZ0dZ1d Z2d Z3d Z4d Z5 G d dej6        j        e          Z7 G d de7          Z8 G d de8          Z9 G d de8          Z: G d de7          Z; G d d e7          Z< G d! d"e7          Z= G d# d$e7          Z> G d% d&e7          Z? G d' d(e7          Z@ G d) d*e7          ZA G d+ d,e7          ZB G d- d.e          ZC G d/ d0ej6        j                  ZD G d1 d2e          ZE G d3 d4eE          ZFe=e?e@e<e8eBe;e>eAe9e:d5ZG e!d6          D ]ZHeHI                                eGeHjJ        <    eKeGL                                          ejM        N                    d7          d8         _N        dS )9    N)urlsafe_b64encode)partial)AuthProvider)OAuth2Mixin)	HTTPErrorHTTPRequest)r   RequestHandlerdecode_signed_value)WebSocketHandler   )config)entry_points_for)BASIC_LOGIN_TEMPLATECDN_DISTERROR_TEMPLATELOGOUT_TEMPLATE_env)state)base64url_encodedecode_tokenzpanel-oauth-statezpanel-oauth-codec                    	 t          j        | j        d          }n*# t          $ r t          j        | j        d          }Y nw xY wt	          j        dd|          }t	          j        dd|          }t          j        |          }|S )z
    Decodes the JSON-format response body

    Arguments
    ---------
    response: tornado.httpclient.HTTPResponse

    Returns
    -------
    Decoded response content
    asciiutf-8"')codecsdecodebody	Exceptionresubjsonloads)responser   s     *lib/python3.11/site-packages/panel/auth.pydecode_response_bodyr&   &   s    5}X]G44 5 5 5}X]G4456#tT""D6#sD!!D:dDKs    $AAc                 j    |                      ||                      d| dg                    d         S )zH
    Extracts a request argument from a urllib.parse.parse_qs dict.
    z/?Nr   )get)argskeys     r%   extract_urlparamr+   =   s3     88C*s**tf5566q99    c                     t          j        |           }t          j        |                    d                                        d          S )zCSerialize OAuth state to a base64 string after passing through JSONutf8r   )r"   dumpsbase64r   encoder   )r   
json_states     r%   _serialize_stater3   D   s>    E""J#J$5$5f$=$=>>EEgNNNr,   c                    t          | t                    r|                     d          } 	 t          j        |                               d          }n-# t          $ r  t                              d|            i cY S w xY w	 t          j
        |          S # t          $ r  t                              d|           i cY S w xY w)z9Deserialize OAuth state as serialized in _serialize_stater   r.   zFailed to b64-decode state: %rzFailed to json-decode state: %r)
isinstancestrr1   r0   urlsafe_b64decoder   
ValueErrorlogerrorr"   r#   )	b64_stater2   s     r%   _deserialize_stater<   J   s    )S!! .$$W--	-i88??GG

   		2I>>>			z*%%%   		3Z@@@			s#   'A 'A>=A>B 'C ?C c                       e Zd ZdddZg dZddiZdZdZeZ	dZ
ed	             Z	 dd
Z	 	 ddZd Zd Zd Zd Zd Zd Zd ZddZddZd ZdS )OAuthLoginHandlerapplication/jsonTornado OAuthAcceptz
User-Agent)openidemailprofileoffline_access
grant_typeauthorization_codeN/loginc                     dt           j        v rt           j        d         S dt          j        vr| j        S d t          j        d                             d          D             S )NscopePANEL_OAUTH_SCOPEc                     g | ]}|S  rN   ).0rK   s     r%   
<listcomp>z,OAuthLoginHandler._SCOPE.<locals>.<listcomp>u   s    NNN%NNNr,   ,)r   oauth_extra_paramsosenviron_DEFAULT_SCOPESsplitselfs    r%   _SCOPEzOAuthLoginHandler._SCOPEo   s^    f///,W55 
22''NN2:.A#B#H#H#M#MNNNNr,   c                   K   |r&|                      ||||           d{V \  }}}}|S |||dd|id}dt          j        v rt          j        d         |d         d<   | j        
| j        |d<   dt          j        v rt          j        d         |d<   t                              d	t          |           j                    | j        d
i | dS )a  
        Fetches the authenticated user

        Arguments
        ---------
        redirect_uri: (str)
          The OAuth redirect URI
        client_id: (str)
          The OAuth client ID
        state: (str)
          The unguessable random string to protect against
          cross-site request forgery attacks
        client_secret: (str, optional)
          The client secret
        code: (str, optional)
          The response code from the server
        )client_secretcodeNr\   r   )redirect_uri	client_idr[   response_typeextra_paramsaudiencer`   rK   z%s making authorize requestrN   )	_fetch_access_tokenr   rR   rY   r9   debugtype__name__authorize_redirect)	rX   r]   r^   r   r[   r\   user_paramss	            r%   get_authenticated_userz(OAuthLoginHandler.get_authenticated_userw   s     &  	"&":":+	 #; # #      MD!Q K )%*#
 
 222171J:1VF>":.;""kF7Of///$7@F7O		/d1DEEE))&)))))r,   c                 	  K   t                               dt          |           j                   d|i| j        }|r||d<   | j        rd                    | j                  |d<   |r||d<   |r
||d<   d|d<   |r||d	<   n1|r|                    ||
           n|                                 |d<   | 	                                }	t          | j        dt          j        |          | j                  }
	 |	                    |
           d{V }n`# t           $ rS}t                               dt          |           j                   |                     |j        d           Y d}~nd}~ww xY w|j        rt)          |          x}sBt                               dt          |           j                   |                     |           d|vrI|r/t                               dt          |           j                   dS |                     ||d           |d         |                    d          }}|                    d          }|rt-          |          }|                    d          x}r\	 |                     ||||          }t                               dt          |           j                   ||||fS # t0          $ r Y nw xY wt3          | j                  }| j        r+| j        }| j                            |d                   |d<   n!d                    | j        |d                   }t                               dt          |           j                   	 |	                    ||           d{V }t)          |          }n# t           $ r d}Y nw xY w|st                               dt          |           j                   	 t;          |d                   }nU# t<          $ rH t                               dt          |           j                   |                     ||d           Y nw xY wt                               dt          |           j                   |                     ||||          }||||fS ) a  
        Fetches the access token.

        Arguments
        ---------
        client_id:
          The client ID
        redirect_uri:
          The redirect URI
        code:
          The response code from the server
        client_secret:
          The client secret
        refresh_token:
          A token used for refreshing the access_token
        username:
          A username
        password:
          A password
        z%s making access token request.r^   r]    rK   r\   refresh_tokenrG   r[   )usernamepasswordcode_verifierPOST)methodr   headersNz%s access token request failed.  )statusz6%s token endpoint did not return a valid access token.access_tokenz2%s token endpoint did not reissue an access token.)NNN
expires_inid_tokenz3%s successfully obtained access_token and id_token.Authorizationz{}{}z%s requesting OpenID userinfo.)rs   zP%s could not obtain userinfo or id_token, falling back to decoding access_token.z!%s could not decode access_token.z3%s successfully obtained access_token and userinfo.)r9   rc   rd   re   _EXTRA_TOKEN_PARAMSrY   joinupdateget_code_cookieget_auth_http_clientr   _OAUTH_ACCESS_TOKEN_URLurlparse	urlencode_API_BASE_HEADERSfetchHTTPClientError_raise_errorr$   r   r&   r(   int_on_authr   dict_access_token_header_OAUTH_USER_URLformatr   r   )rX   r^   r]   r[   r\   rm   rn   ro   ri   httpreqr$   er   rv   rw   rx   rg   user_headersuser_urluser_responses                        r%   rb   z%OAuthLoginHandler._fetch_access_token   s     0 			3T$ZZ5HIII
&
  	2%1F>"; 	4!hht{33F7O 	"!F6N 	3&3F?##2F<  	=&3F?## 	=MM8hM????&*&:&:&<&<F?#((** (#F++*	
 
 
	6!ZZ__,,,,,,HH 	6 	6 	6II7d9LMMMaj55555555	6 } 	(,@,J,J%JT 	(IINPTUYPZPZPcdddh'''%% (		NPTUYPZPZPcddd''hS999&*>&:DHH_<U<UmXXl++
 	)ZJhhz***8 	EE}}X|]JWW 		OQUVZQ[Q[Qdeee\=*DD	     D233$ 	Q+H,0,E,L,L^$- -L)) }}T%94;OPPH		2DJJ4GHHH	"&**X|*"L"LLLLLLLM+M::HH 	 	 	HHH	  	>IIhjnosjtjtj}~~~>'^(<== > > >		=tDzz?RSSS!!(D!=====> 			GdI\]]]}}X|]JOO\=*<<sP   6D 
E/A	E**E/4J? ?
KK$,N N N O) )AP;:P;c                     | j         [|                     t          t          j                  pd                    dd          | _         |                     t                     | j         S )z[Get OAuth state from cookies
        To be compared with the value in redirect URL
        Nmax_age_daysr,   r.   replace)_state_cookieget_secure_cookieSTATE_COOKIE_NAMEr   oauth_expiryr   clear_cookierW   s    r%   get_state_cookiez"OAuthLoginHandler.get_state_cookie  sd     %&&'8vGZ&[[b_bfVY''  /000!!r,   c                 V    |                      t          |t          j        d           d S NT)expires_dayshttponly)set_secure_cookier   r   r   )rX   r   s     r%   set_state_cookiez"OAuthLoginHandler.set_state_cookie  s6    u63FQU 	 	
 	
 	
 	
 	
r,   c                    | j         j                            | j        d          }|                     d|          x}}|r|                    dt          j        d                    }t          j        |          }|                    ddd|j        	                    d          z             
                                }||k    rt                              d||           t          t          j                    j        |pdd          S )N next\/)schemenetlocpathzIgnoring next_url %r, using %r)state_idnext_url)requesturir   _login_endpointget_argumentr   quote_replacer   lstripgeturlr9   warningr3   uuiduuid4hex)rX   root_urlr   original_next_urlurlinfos        r%   	get_statezOAuthLoginHandler.get_state$  s   <#++D,@"EE'+'8'8'J'JJ$ 	''hnT.B.BCCH '11G''"31D1DS1I1I+I (  fhh  ,,,46G    )x3GG
 
 	
r,   c                 |   t          j                    j        t          j                    j        z   t          j                    j        z   }t          j        |                    d                                                    }t          |                              d          	                    dd          }||fS )Nr   =r   )
r   r   r   hashlibsha256r1   digestr   r   r   )rX   rp   hashed_code_verifiercode_challenges       r%   get_codezOAuthLoginHandler.get_code8  s    
(4:<<+;;djll>NN&~m.B.B7.K.KLLSSUU*+?@@GGPPXXY\^`aan,,r,   c                     |                      t          t          j                  pd                    dd          }|                     t                     |S )Nr   r,   r.   r   )r   CODE_COOKIE_NAMEr   r   r   r   rX   r\   s     r%   r}   z!OAuthLoginHandler.get_code_cookie>  sP    &&'7fFY&ZZa^aiijpr{||*+++r,   c                 V    |                      t          |t          j        d           d S r   )r   r   r   r   r   s     r%   set_code_cookiez!OAuthLoginHandler.set_code_cookieC  s5    d1Dt 	 	
 	
 	
 	
 	
r,   c                   K   t                               dt          |           j                   t          j        rt          j        }n*d                    | j        j        | j        j	                  }|t          j
        d}|                     di           }|r2t          j        |          }d |                                D             }|                     dt          |d                    }|                     dt          |d                    }|                     dt          |d                    }|h|                     d	t          |d	                    }|s|}t                               d
t          |           j        |           t#          d||          |                                 }|r||k    r.t                               d||           t#          ddd          t)          |          }	|                    t          j        ||d            | j        di | d {V }
|
t#          dd          t                               dt          |           j                   |                      |	j        dd                     d S |                                 x|d<   }	|                     |	            | j        di | d {V  d S )Nz%s received login requestz	{0}://{1})r]   r^   r   c                 L    i | ]!\  }}|                     d           d         |"S )?)rV   )rO   argvalues      r%   
<dictcomp>z)OAuthLoginHandler.get.<locals>.<dictcomp>Z  s-    UUUjc5		#r*EUUUr,   r\   r   r:   error_descriptionz2%s failed to authenticate with following error: %srt   reasonOAuth state mismatch: %s != %sz=OAuth state mismatch. Please restart the authentication flow.zstate mismatch)r[   r\   r     zPermissions unknown.'%s authorized user, redirecting to app.r   r   rN   )r9   rc   rd   re   r   oauth_redirect_urir   r   protocolhost	oauth_keyr   r   parse_qsitemsr+   r:   r   r   r   r<   r|   oauth_secretrj   redirectr(   r   r   )rX   r]   ri   next_argr\   	url_stater:   	error_msgcookie_stater   rg   s              r%   r(   zOAuthLoginHandler.getH  s     		-tDzz/BCCC$ 	!4LL&--%! L
 )",
 
 $$VR00 	V(22HUUHNNDTDTUUUH  )9(F)K)KLL%%g/?'/R/RSS	 !!'+;Hg+N+NOO))#%5h@S%T%TV VI "!	IIDT

#U   C59999 ,,.. 	8y((<lIVVV%dm}~~~~&y11E MM!'!4"    
 54>>v>>>>>>>>D|%;<<<II?dATUUUMM)%)J4455555 '+nn&6&66F7Oe!!%(((-$-7777777777777r,   c           	      6   t          |t                    rt          |          }n#|}t          t	          j        |                    }t          j        p| j        }||v r	||         }n>t          
                    dt          |           j        |           t          dd          |                     d           |                     d|t          j                   t"          j        rt"          j                            |                    d                    }t"          j                            |                    d                    }|r2t"          j                            |                    d                    }|                     d|t          j                   |                     d	|t          j                   |rt*          j                            t*          j        j                                                  }|                     d
t          t7          ||z                       t          j                   |r"|                     d|t          j                   |t"          j        v r t"          j                            |d            |S )Nz-%s token payload did not contain expected %r.rt   z,OAuth token payload missing user informationis_guestrg   r   r   rv   rx   r   rm   )r5   r6   r   r   r"   r/   r   oauth_jwt_user	_USER_KEYr9   r:   rd   re   r   r   r   r   r   
encryptionencryptr1   dtdatetimenowtimezoneutc	timestampr   _oauth_user_overridespop)	rX   rx   rv   rm   rw   decodeduser_keyrg   now_tss	            r%   r   zOAuthLoginHandler._on_auth  s>   h$$ 	>"8,,GGG'
8(<(<==H(:DNw8$DDIIE4jj)85 5 5C!OPPP*%%%vt&:MNNN 	X +33L4G4G4P4PQQL'//0H0HIIH X % 0 8 89M9Mg9V9V W W~|&J]^^^z8&BUVVV 	t[__R[_55??AAF"">3s6J;N7O7O3P3P_e_r"sss 	e""?MPVPc"ddd5...'++D$777r,     c           	         	 |pt          |          }n# t          j        j        $ r |}Y nw xY w| j        j                            dd          }|j        r(t                              | d|j         d|            n t          	                    | d| d           t          ||                    dt          |                    |                    dd	          
          )NLoginHandlerr   z OAuth provider returned a z error. The full response was: zN OAuth provider failed to fully authenticate returning the following response:.r   r:   zUnknown errorr   )r&   r"   decoderJSONDecodeError	__class__re   r   r:   r9   r   r   r(   r6   )rX   r$   r   ru   providers        r%   r   zOAuthLoginHandler._raise_error  s&   	9/99DD|+ 	 	 	DDD	>*22>2FF> 	$II > >hn > >7;> > ? ? ? ? KK8 # ## # # $ $ $ HH(#d))4488G_55
 
 
 	
s    --c           	         |d         \  }}}|                                   |                     dd           t          |t                    r|j        |j        }}nD| j        j                            dd          }t          
                    | d|            d\  }}|                     | j                            t          j        dd	||
                     d S )Nexc_infoContent-Typez	text/htmlr   r   z. OAuth provider encountered unexpected error: )z500: Internal Server Errorz&Server encountered unexpected problem.zPanel: Authentication ErrorzAuthentication Error)npm_cdntitle
error_typer:   r   )clear_all_cookies
set_headerr5   r   r   log_messager   re   r   r9   r:   write_error_templaterenderr   r   )rX   status_codekwargsrh   r   r:   r   r   s           r%   write_errorzOAuthLoginHandler.write_error  s    $1a   444a## 	 x9EE~.66~rJJHII      E9 	

4'..N/- / 
 
 	 	 	 	 	r,   )NNNNNNNN)Nr   )re   
__module____qualname__r   rU   rz   r   r   r   r  r   propertyrY   rj   rb   r   r   r   r   r}   r   r(   r   r   r
  rN   r,   r%   r>   r>   Z   sY        %% 
 GFFO 	-  M$OOO O XO ?C,* ,* ,* ,*^ FJ48m= m= m= m=^	" 	" 	"
 
 


 
 
(- - -  

 
 

<8 <8 <8|   >
 
 
 
&    r,   r>   c                   r    e Zd ZdZddiZed             Zed             Zed             Zed             Z	dS )	GenericLoginHandler	Bearer {}rG   rH   c                 |    t           j                            dt          j                            d                    S )N	TOKEN_URLPANEL_OAUTH_TOKEN_URLr   rR   r(   rS   rT   rW   s    r%   r   z+GenericLoginHandler._OAUTH_ACCESS_TOKEN_URL  s*    (,,["*..I`:a:abbbr,   c                 |    t           j                            dt          j                            d                    S )NAUTHORIZE_URLPANEL_OAUTH_AUTHORIZE_URLr  rW   s    r%   _OAUTH_AUTHORIZE_URLz(GenericLoginHandler._OAUTH_AUTHORIZE_URL  s*    (,,_bjnnMh>i>ijjjr,   c                 |    t           j                            dt          j                            d                    S )NUSER_URLPANEL_OAUTH_USER_URLr  rW   s    r%   r   z#GenericLoginHandler._OAUTH_USER_URL  s*    (,,ZH^9_9_```r,   c                 ~    t           j                            dt          j                            dd                    S )NUSER_KEYPANEL_USER_KEYrD   r  rW   s    r%   r   zGenericLoginHandler._USER_KEY  s-    (,,ZHXZa9b9bcccr,   N)
re   r  r  r   rz   r  r   r  r   r   rN   r,   r%   r  r    s        & 	* c c Xc k k Xk a a Xa d d Xd d dr,   r  c                   "    e Zd ZddiZd Zd ZdS )PasswordLoginHandlerrG   ro   c                     	 |                      d          }n# t          $ r d}Y nw xY w|                      dd           }|r|                     d|           | j                            |t
                    }|                     |           d S Nr:   r   r   r   )errormessage	PANEL_CDNr   r   
set_cookie_login_templater  r   r  rX   r$  r   htmls       r%   r(   zPasswordLoginHandler.get      	,,W55LL 	 	 	LLL	 $$VT22 	2OOJ111#**% + 
 
 	

4    ''c                 f  K   |                      dd          }|                      dd          }t          j        rt          j        }n"| j        j         d| j        j         | j         }|                     t          j        |||           d {V \  }}}}|sd S | 	                    d           d S )Nrn   r   ro   ://)r^   r]   rn   ro   r   )
r   r   r   r   r   r   r   rb   r   r   )rX   rn   ro   r]   rg   rh   s         r%   postzPasswordLoginHandler.post  s      $$Z44$$Z44$ 	b!4LL"l3aa8Ia4K_aaL"66&%	 7 
 
 
 
 
 
 
 
aA  	Fcr,   N)re   r  r  rz   r(   r/  rN   r,   r%   r!  r!    sA         	j      r,   r!  c                       e Zd Zd Zd ZdS )CodeChallengeLoginHandlerc                   K   |                      dd          }|                      dd          }t          j        rt          j        }n"| j        j         d| j        j         | j         }|r|s|                     |           d S |                                 }||k    r,t          
                    d||           t          dd          t          |          }|                     |t          j        ||           d {V }|t          d	          t                              d
t!          |           j                   |                      |j        dd                     d S )Nr\   r   r   r.  r   r   zOAuth state mismatch)r\   r   r   r   r   )r   r   r   r   r   r   r   _authorize_redirectr   r9   r   r   r<   rj   r   rc   rd   re   r   r(   )rX   r\   r   r]   r   r   rg   s          r%   r(   zCodeChallengeLoginHandler.get  sl       ,,%%gr22	$ 	b!4LL"l3aa8Ia4K_aaL 	9 	$$\222F,,..9$$KK8,	RRRC!7888"9--00v?OQZae0ffffffff<C.. 		;T$ZZ=PQQQiei
C0011111r,   c           	      p   |                                  }|                     |           |                                 \  }}|                     |           t          j        dd                    | j                  |d|d|d}t          j	        |          }| 
                    | j         d|            d S )Nr\   rl   queryS256)r^   r_   rK   r   response_moder   code_challenge_methodr]   r   )r   r   r   r   r   r   r{   rY   r   r   r   r  )rX   r]   r   rp   r   ri   query_paramss          r%   r3  z-CodeChallengeLoginHandler._authorize_redirect+  s      e$$$(,%~]+++)#XXdk**$,%+(	
 	
  )&112CC\CCDDDDDr,   N)re   r  r  r(   r3  rN   r,   r%   r1  r1    s7        2 2 20E E E E Er,   r1  c                   &    e Zd ZdZdZdZdZdZdZdS )GithubLoginHandlerzGitHub OAuth2 Authentication
    To authenticate with GitHub, first register your application at
    https://github.com/settings/applications/new to get the client ID and
    secret.
    z+https://github.com/login/oauth/access_tokenz(https://github.com/login/oauth/authorizezhttps://api.github.com/userztoken {}loginN)	re   r  r  __doc__r   r  r   r   r   rN   r,   r%   r;  r;  ?  s7          LE3O%IIIr,   r;  c                   &    e Zd ZddiZdZdZdZdZdS )BitbucketLoginHandlerrB   r?   z.https://bitbucket.org/site/oauth2/access_tokenz+https://bitbucket.org/site/oauth2/authorizez0https://api.bitbucket.org/2.0/user?access_token=rn   N)re   r  r  r   r   r  r   r   rN   r,   r%   r?  r?  O  s7         	$ OHHOIIIr,   r?  c                   d    e Zd ZdZdZdZdZdZed             Z	ed             Z
ed             Zd	S )
Auth0Handlerr  z!https://{0}.auth0.com/oauth/tokenzhttps://{0}.auth0.com/authorizezhttps://{0}.auth0.com/userinforD   c                 v    t           j                            dd          }| j                            |          S N	subdomainexampler   rR   r(   _OAUTH_ACCESS_TOKEN_URL_r   rX   urls     r%   r   z$Auth0Handler._OAUTH_ACCESS_TOKEN_URLf  s1    '++KCC,33C888r,   c                 v    t           j                            dd          }| j                            |          S rC  r   rR   r(   _OAUTH_AUTHORIZE_URL_r   rH  s     r%   r  z!Auth0Handler._OAUTH_AUTHORIZE_URLk  s1    '++KCC)00555r,   c                 v    t           j                            dd          }| j                            |          S rC  r   rR   r(   _OAUTH_USER_URL_r   rH  s     r%   r   zAuth0Handler._OAUTH_USER_URLp  s1    '++KCC$++C000r,   N)re   r  r  r   rG  rL  rO  r   r  r   r  r   rN   r,   r%   rA  rA  \  s        &B=7I9 9 X9 6 6 X6 1 1 X1 1 1r,   rA  c                   t    e Zd ZddiZddiZdZdZdZdZd	Z	e
d
             Ze
d             Ze
d             ZdS )GitLabLoginHandlerrB   r?   rG   rH   zhttps://{0}/oauth/tokenzhttps://{0}/oauth/authorizezhttps://{0}/api/v4/userr  rn   c                 v    t           j                            dd          }| j                            |          S NrI  z
gitlab.comrF  rH  s     r%   r   z*GitLabLoginHandler._OAUTH_ACCESS_TOKEN_URL  s1    '++E<@@,33C888r,   c                 v    t           j                            dd          }| j                            |          S rS  rK  rH  s     r%   r  z'GitLabLoginHandler._OAUTH_AUTHORIZE_URL  s1    '++E<@@)00555r,   c                 v    t           j                            dd          }| j                            |          S rS  rN  rH  s     r%   r   z"GitLabLoginHandler._OAUTH_USER_URL  s1    '++E<@@$++C000r,   N)re   r  r  r   rz   rG  rL  rO  r   r   r  r   r  r   rN   r,   r%   rQ  rQ  w  s         	$
 	*  990&I9 9 X9 6 6 X6 1 1 X1 1 1r,   rQ  c                   j    e Zd ZdddZdZdZdZdZed             Z	ed	             Z
ed
             ZdS )AzureAdLoginHandlerr?   r@   rA   z7https://login.microsoftonline.com/{tenant}/oauth2/tokenz;https://login.microsoftonline.com/{tenant}/oauth2/authorizer   unique_namec                     t           j                            dt          j                            dd                    }| j                            |          S NAAD_TENANT_IDtenantcommon)r\  rS   rT   r(   r   rR   rG  r   rX   r\  s     r%   r   z+AzureAdLoginHandler._OAUTH_ACCESS_TOKEN_URL  E    1J1N1NxYa1b1bcc,3363BBBr,   c                     t           j                            dt          j                            dd                    }| j                            |          S rZ  rS   rT   r(   r   rR   rL  r   r_  s     r%   r  z(AzureAdLoginHandler._OAUTH_AUTHORIZE_URL  E    1J1N1NxYa1b1bcc)000???r,   c                 :     | j         j        di t          j        S NrN   rO  r   r   rR   rW   s    r%   r   z#AzureAdLoginHandler._OAUTH_USER_URL  !    +t$+HHf.GHHHr,   Nre   r  r  r   rG  rL  rO  r   r  r   r  r   rN   r,   r%   rW  rW    s         %% 
  YYIC C XC @ @ X@ I I XI I Ir,   rW  c                   j    e Zd ZdddZdZdZdZdZed             Z	ed	             Z
ed
             ZdS )AzureAdV2LoginHandlerr?   r@   rA   z<https://login.microsoftonline.com/{tenant}/oauth2/v2.0/tokenz@https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorizer   rD   c                     t           j                            dt          j                            dd                    }| j                            |          S rZ  r^  r_  s     r%   r   z-AzureAdV2LoginHandler._OAUTH_ACCESS_TOKEN_URL  r`  r,   c                     t           j                            dt          j                            dd                    }| j                            |          S rZ  rb  r_  s     r%   r  z*AzureAdV2LoginHandler._OAUTH_AUTHORIZE_URL  rc  r,   c                 :     | j         j        di t          j        S re  rf  rW   s    r%   r   z%AzureAdV2LoginHandler._OAUTH_USER_URL  rg  r,   Nrh  rN   r,   r%   rj  rj    s         %% 
  ^^IC C XC @ @ X@ I I XI I Ir,   rj  c                   z    e Zd ZdZdddZdZdZdZdZd	Z	d
Z
dZed             Zed             Zed             ZdS )OktaLoginHandlerzOkta OAuth2 Authentication

    To authenticate with Okta you first need to set up and configure
    in the Okta developer console.
    rH   zcode,token,id_token)rG   r_   zhttps://{0}/oauth2/{1}/v1/tokenzhttps://{0}/oauth2/v1/tokenz#https://{0}/oauth2/{1}/v1/authorizezhttps://{0}/oauth2/v1/authorizez0https://{0}/oauth2/{1}/v1/userinfo?access_token=z,https://{0}/oauth2/v1/userinfo?access_token=rD   c                     t           j                            dd          }t           j                            dd          }|r| j                            ||          S | j                            |          S NrI  zokta.comserverdefault)r   rR   r(   rG  r   _OAUTH_ACCESS_TOKEN_URL__rX   rI  rr  s      r%   r   z(OktaLoginHandler._OAUTH_ACCESS_TOKEN_URL  sj    '++E:>>*..xCC 	>077VDDD188===r,   c                     t           j                            dd          }t           j                            dd          }|r| j                            ||          S | j                            |          S rq  )r   rR   r(   rL  r   _OAUTH_AUTHORIZE_URL__ru  s      r%   r  z%OktaLoginHandler._OAUTH_AUTHORIZE_URL  sj    '++E:>>*..xCC 	;-44S&AAA.55c:::r,   c                     t           j                            dd          }t           j                            dd          }|r| j                            ||          S | j                            ||          S rq  )r   rR   r(   rO  r   _OAUTH_USER_URL__ru  s      r%   r   z OktaLoginHandler._OAUTH_USER_URL  sl    '++E:>>*..xCC 	>(//V<<<)00f===r,   N)re   r  r  r=  rz   rG  rt  rL  rw  rO  ry  r   r  r   r  r   rN   r,   r%   ro  ro    s          .. 
  A =A>IFI> > X> ; ; X; > > X> > >r,   ro  c                   *    e Zd ZddiZg dZdZdZdZdS )GoogleLoginHandlerr   z0application/x-www-form-urlencoded; charset=utf-8)rC   rD   rE   z,https://accounts.google.com/o/oauth2/v2/authz*https://accounts.google.com/o/oauth2/tokenrD   N)re   r  r  r   rU   r  r   r   rN   r,   r%   r{  r{    s<         	J 544OIJIIIr,   r{  c                   *    e Zd ZeZd Zd Zd Zd ZdS )BasicLoginHandlerc                     	 |                      d          }n# t          $ r d}Y nw xY w|                      dd           }|r|                     d|           | j                            |t
                    }|                     |           d S r#  r&  r)  s       r%   r(   zBasicLoginHandler.get  r+  r,  c                    dt           j                            | j        i           v rt           j        | j                 d         }nt          j        }t          |t                    rnt          j	        
                    |          rOt          |d          5 }t          j        |                                          }d d d            n# 1 swxY w Y   t          |t                    r||vrdS |||         k    S ||k    rdS dS )N
basic_authr   )encodingFT)r   _server_configr(   applicationr   r  r5   r6   rS   r   isfileopenr"   r#   readr   )rX   rn   ro   	auth_info	auth_files        r%   	_validatezBasicLoginHandler._validate   s.   5/33D4DbIIII,T-=>|LII)Ii%% 	9"'..*C*C 	9i'222 9i Jy~~'7'788	9 9 9 9 9 9 9 9 9 9 9 9 9 9 9i&& 	y((uy222""4us   'C

CCc                    |                      dd          }|                      dd          }|                     ||          }|rB|                     |           |                     dd          }|                     |           d S dt
          j                            d          z   }|                     | j        j	        |z              d S )Nrn   r   ro   r   r   z?error=zInvalid username or password!)
r   r  set_current_user
get_cookier   tornadoescape
url_escaper   r   )rX   rn   ro   authr   r   s         r%   r/  zBasicLoginHandler.post0  s    $$Z44$$Z44~~h11 	8!!(+++z377HMM(#####!GN$=$=>]$^$^^IMM$,*Y677777r,   c                    |s,|                      d           |                      d           d S |                      d           |                     d|t          j                   t	          t          j        d|i                    }t          j        r2t          j        	                    |
                    d                    }|                     d|t          j                   d S )Nr   rg   r   r   rx   )r   r   r   r   r   r"   r/   r   r   r   r1   )rX   rg   rx   s      r%   r  z"BasicLoginHandler.set_current_user<  s     	j)))f%%%F*%%%vt&:MNNN#DJ~$>$>?? 	J'//0H0HIIHz8&BUVVVVVr,   N)	re   r  r  r   r(  r(   r  r/  r  rN   r,   r%   r}  r}    sZ        *O     
8 
8 
8
W 
W 
W 
W 
Wr,   r}  c                       e Zd ZdZeZd ZdS )LogoutHandlerrI   c                    |                      d           |                      d           |                      d           |                      d           |                      d           |                      t                     | j                            t          | j                  }|                     |           d S )Nrg   rx   rv   rm   r   )r%  LOGIN_ENDPOINT)r   r   _logout_templater  r   r   r  )rX   r*  s     r%   r(   zLogoutHandler.getO  s    &!!!*%%%.)))/***.)))+,,,$++/ , 
 
 	

4r,   N)re   r  r  r   r   r  r(   rN   r,   r%   r  r  I  s.        O&    r,   r  c                        e Zd ZdZ	 	 	 d fd	Zd Zd Zed             Zed             Z	ed             Z
ed	             Zed
             Z xZS )BasicAuthProviderzF
    An AuthProvider which serves a simple login and logout page.
    Nc                    |t           | _        nRt          |          5 }t          j        |                                          | _        d d d            n# 1 swxY w Y   |t          | _        nRt          |          5 }t          j        |                                          | _        d d d            n# 1 swxY w Y   |t          | _	        nRt          |          5 }t          j        |                                          | _	        d d d            n# 1 swxY w Y   |pd| _
        |pd| _        |pg | _        t          j        | j                   t!                                                       d S )NrI   z/logout)r   r  r  r   from_stringr  r   r  r   r(  r   _logout_endpoint_guest_endpointsr   on_session_destroyed_remove_usersuper__init__)	rX   login_endpointlogout_endpointlogin_templatelogout_templateerror_templateguest_endpointsfr   s	           r%   r  zBasicAuthProvider.__init__b  s0   
 !#1D  n%% B'+'7'A'A$B B B B B B B B B B B B B B B"$3D!!o&& C!(,(8(B(B%C C C C C C C C C C C C C C C!#7D  n%% B'+'7'A'A$B B B B B B B B B B B B B B B-9 / <9 / 52"4#4555s5   ,AAA,B99B= B=",DD!Dc                 x   |j         j                            d          }|j         j                            d          }|rd}n7|r3t          t          j        d|          }|r|                    d          }nd }|sd S t          j        |xx         dz  cc<   t          j        |         st          j        |= d S d S Nr   rg   guestr   r   )	r   cookiesr(   r
   r   cookie_secretr   r   _active_usersrX   session_contextguest_cookieuser_cookierg   s        r%   r  zBasicAuthProvider._remove_user}  s    &.6:::FF%-599&AA 		DD 	&$fk D  ,{{7++D 	FD!!!Q&!!!"4( 	*#D)))	* 	*r,   c                 ~    t           j        r|| j        k    sd|v sdS |                    dd          | j        v rdndS )Nz?code=Tz/wsr   F)r   oauth_optionalr   r   r  )rX   r   s     r%   _allow_guestzBasicAuthProvider._allow_guest  sM      	#1E*E*EUX4{{5"--1FFFttEQr,   c                       fd}|S )Nc                    |                      dt          j                  }|r|                    d          }ng                    | j        j                  rHd}d| j        j        d<   t          | t                    s"| 
                    ddt          j                   |r/t          | t                    rt          j        |xx         dz  cc<   |S )	Nrg   r   r   r  1r   r   r   )r   r   r   r   r  r   r   r  r5   r   r'  r   r  )request_handlerrg   rX   s     r%   get_userz,BasicAuthProvider.get_user.<locals>.get_user  s    "44V&J]4^^D b{{7++""?#:#>?? b>A'/
;!/3CDD b#..z3VM`.aaa /
?4DEE /#D)))Q.)))Kr,   rN   )rX   r  s   ` r%   r  zBasicAuthProvider.get_user  s#    	 	 	 	 	 r,   c                     | j         S N)r   rW   s    r%   	login_urlzBasicAuthProvider.login_url  s    ##r,   c                 T    | j         t          _         | j        t          _        t          S r  )r   r}  r(  rW   s    r%   login_handlerzBasicAuthProvider.login_handler  s     ,0,@),0,@)  r,   c                     | j         S r  )r  rW   s    r%   
logout_urlzBasicAuthProvider.logout_url  s    $$r,   c                 b    | j         r| j         t          _         | j        t          _        t          S r  )r  r  r   rW   s    r%   logout_handlerz BasicAuthProvider.logout_handler  s*      	C-1-BM*(,(<%r,   r  )re   r  r  r=  r  r  r  r  r  r  r  r  r  __classcell__r   s   @r%   r  r  ]  s         
 48BF     6* * *&R R R
   X  $ $ X$ ! ! X!
 % % X%   X    r,   r  c                   v     e Zd ZdZed             Ze fd            Zed             Zd Zd Z	d Z
d Z xZS )	OAuthProviderz~
    An AuthProvider using specific OAuth implementation selected via
    the global config.oauth_provider configuration.
    c                     d S r  rN   rW   s    r%   r  zOAuthProvider.get_user  s    tr,   c                       fd}|S )Nc                 2  K   t          t                                        |           }t          j        r||S t
          j                            t
          j        j	                  
                                }d }|t          j        v rit          j        |         s,t          j        d           d {V  t          j        |         ,t          j        |         }|d         }|d         r|d         }nS|                     dt          j                  }|st"                              d           d S t          j        |          }|j	 t)          |          }|d         }nQ# t*          $ rD |                     dt          j                  }|t"                              d           |cY S Y nw xY w|t          j        v rt          j        |         d	         }nc|                     d	t          j                  }	|	r>t          j        |	          }                    |d         ||| j        | j                   nd }||k    rt"                              d
           |S |r/	 t)          |          }
|
d         |k     rd }n# t*          $ r Y nw xY w|/t"                              dt3                    j                   d S t"                              dt3                    j                                       ||| j        | j                   d {V  |S )N皙?rv   expiryr   z:No access token available, forcing user to reauthenticate.expr   zCaccess_token is not a valid JWT token. Expiry cannot be determined.rm   z1Fully authenticated and access_token still valid.z[%s access_token is expired and refresh_token not available, forcing user to reauthenticate.%s refreshing token)r  r  r  r   oauth_refresh_tokensr   r   r   r   r   r   r   r   asynciosleepr   r   r9   rc   _decrypt_cookier   r   _schedule_refreshr  r   rd   re   _refresh_access_token)handlerrg   r   r  
user_staterv   access_cookieaccess_jsonrm   refresh_cookierefresh_jsonr   rX   s              r%   r  z.OAuthProvider.get_user_async.<locals>.get_user  sG     --66w??D. $,[__R[_55??AAFFu2225d; -!-,,,,,,,,,  5d; -"8>
).9h' 2'1F ' 9 9.W]Wj 9 k k$ IIZ[[[F$4]CC~$".|"<"<K(/FF  $ $ $$66~TZTg6hhF~		"ghhh# &~$ u222 % ;D A/ R!(!:!:?Y_Yl!:!m!m! )$)$9.$I$IM**;u+=t]T[Tgipixyyyy$(M		MNNN #/#>#>L#E*V33(,    D $		wy}  C  zD  zD  zM  N  N  NII+T$ZZ-@AAA,,T='BUW^WfgggggggggKs%   E# #A	F10F1#J 
JJrN   )rX   r  r   s   ` r%   get_user_asynczOAuthProvider.get_user_async  s*    =	 =	 =	 =	 =	 =	| r,   c                     t           t          j                 }| j        r| j        |_        | j        |_        | j        |_        |S r  )AUTH_PROVIDERSr   oauth_providerr  r(  r   )rX   r  s     r%   r  zOAuthProvider.login_handler  s@     !67 	;&*&:G#"&"6"&"6r,   c                    |j         j                            d          }|j         j                            d          }|rd}n7|r3t          t          j        d|          }|r|                    d          }nd }|sd S t          j        |xx         dz  cc<   t          j        |         s*t          j        |= |t          j	        v rt          j	        |= d S d S d S r  )
r   r  r(   r
   r   r  r   r   r  r   r  s        r%   r  zOAuthProvider._remove_user  s    &.6:::FF%-599&AA 		DD 	&$fk D  ,{{7++D 	FD!!!Q&!!!"4( 	6#D)u222/555	6 	622r,   c                    t           j                            |          sd S t          j                            t          j        j                                                  }||z
  dz
  }t          
                    dt          |           j        |           t          j                                        t          j        |          z   }t          | j        ||||          }	|dk    rt          j        |	           d S | d}
	 t          j        |
           n# t$          $ r Y nw xY wt          j        |
|	|           d S # t          j        |
|	|           w xY w)N
   z)%s scheduling token refresh in %d seconds)secondsr   z-refresh-access-tokens)at)r   r  r(   r   r   r   r   r   r   r9   rc   rd   re   	timedeltar   _scheduled_refreshexecutecancel_taskKeyErrorschedule_task)rX   	expiry_tsrg   rm   r  r   r   expiry_secondsexpiry_date
refresh_cbtasks              r%   r  zOAuthProvider._schedule_refresh&  sU   "&&t,, 	F11;;=="V+b0		=tDzz?RTbccckoo''",~*N*N*NNT4dM;X_``
QM*%%%F...	Bd#### 	 	 	D	 j[AAAAAAEj[AAAAAs*   D E 
D(%E 'D((E Ec                   K   |                      ||||           d {V  t          j        |         }|d         |d         }}|d         r	|d         }nt          |          d         }|                     |||||           d S )Nrv   rm   r  r  )r  r   r   r   r  )rX   rg   rm   r  r   r  rv   r  s           r%   r  z OAuthProvider._scheduled_refresh9  s      ((}k7SSSSSSSSS06
&0&@*_B]mh 	7)FF!,//6Fvt]KQQQQQr,   c                   K   |t           j        v rjt           j        |         s@t           j        |         s,t          j        d           d {V  t           j        |         ,d S t           j        |         d         }t                              dt          |           j                   i t           j        |<   |                     ||          }|	                    t          j        t          j        |           d {V \  }}}}|r\t          j                            t          j        j                                                  }	|||r|	|z   nd dt           j        |<   d S t           j        |= d S )Nr  rm   r  )r  r   )r^   r[   rm   )rv   rm   r  )r   r   r  r  r9   rc   rd   re   r  rb   r   r   r   r   r   r   r   r   r   )
rX   rg   rm   r  r   auth_handlerrh   rv   rw   r   s
             r%   r  z#OAuthProvider._refresh_access_tokenC  s     5....t4 S5d; -!-,,,,,,,,,  5d; - % ;D A/ R		'd)<===,.#D)))k7)SS;G;[;[& -' <\ <
 <
 6
 6
 6
 6
 6
 6
2<

  	2[__R[_55??AAF ,!./9C&++t1 1E'--- +D111r,   )re   r  r  r=  r  r  r  r  r  r  r  r  r  r  s   @r%   r  r    s         
   X ? ? ? ? X?B   X6 6 6*B B B&R R R2 2 2 2 2 2 2r,   r  )auth0azureazurev2	bitbucketgenericgooglegithubgitlaboktaro   	auth_codez
panel.authF_oauth_provider)Or  r0   r   r   r   r   r"   loggingrS   r    urllib.parseparser   r   r   	functoolsr   r  bokeh.server.auth_providerr   tornado.authr   tornado.httpclientr   r   r   tornado.webr	   r
   tornado.websocketr   r   entry_pointsr   io.resourcesr   r   r   r   r   io.stater   utilr   r   	getLoggerre   r9   r   r   r&   r+   r3   r<   webr>   r  r!  r1  r;  r?  rA  rQ  rW  rj  ro  r{  r}  r  r  r  r  entry_pointloadnamelistkeysparamobjectsrN   r,   r%   <module>r     s             				 				        $ $ $ $ $ $        3 3 3 3 3 3 $ $ $ $ $ $ H H H H H H H H F F F F F F F F F F . . . . . .       * * * * * *                    0 0 0 0 0 0 0 0g!!' %   .: : :O O O   t t t t t2K t t tnd d d d d+ d d d2$ $ $ $ $. $ $ $N*E *E *E *E *E 3 *E *E *E\    *    
 
 
 
 
- 
 
 
1 1 1 1 1$ 1 1 161 1 1 1 1* 1 1 1DI I I I I+ I I I8I I I I I- I I I8.> .> .> .> .>( .> .> .>b    *   9W 9W 9W 9W 9W 9W 9W 9Wx    GK.   (\ \ \ \ \ \ \ \~`2 `2 `2 `2 `2% `2 `2 `2H  $&"   $*  $#L11 : :K'2'7'7'9'9N;#$$9=n>Q>Q>S>S9T9T  U  - . 6 6 6r,   