Ë
    :vžjµ0  ã                   óœ   — d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	lmZ dd
lmZmZ  G d„ de	«      Z G d„ de«      ZeZy)z5Tornado handlers for logging into the Jupyter Server.é    N)Úurlparse)Ú
url_escapeé   )ÚJupyterHandler)Úorigin_matches_paté   )Úallow_unauthenticated)Úpasswd_checkÚset_passwordc                   ó@   — e Zd ZdZdd„Zdd„Zed„ «       Zed„ «       Zy)ÚLoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc                 ó’   — | j                  | j                  dt        | j                  d| j                  ¬«      «      |¬«      «       y)zRender the login form.z
login.htmlÚnext©Údefault)r   ÚmessageN)ÚwriteÚrender_templater   Úget_argumentÚbase_url)Úselfr   s     új/workspace/moltex-experiments/.pixi/envs/default/lib/python3.12/site-packages/jupyter_server/auth/login.pyÚ_renderzLoginFormHandler._render   sC   € à�
‰
Ø× Ñ ØÜ × 1Ñ 1°&À$Ç-Á-Ð 1Ó PÓQØð !ó õ	
ó    c                 óð  — |€| j                   }|j                  dd«      }d|v r,|j                  d«      \  }}}|› d|j                  d«      › �}n%|j	                  d«      rd|j                  d«      z   }t        |«      }|j                  s4|j                  s(|j                  dz   j	                  | j                   «      s¥d}|j                  s|j                  ri|j                  › d|j                  › �}|j                  «       }| j                  r| j                  |k(  }n"| j                  rt        | j                  |«      }|s | j                  j                  d	|z  «       |}| j                  |«       y)
z¶Redirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        NÚ\z%5CÚ:z://Ú/z//Fz!Not allowing login redirect to %r)r   ÚreplaceÚ	partitionÚlstripÚ
startswithr   ÚschemeÚnetlocÚpathÚlowerÚallow_originÚallow_origin_patr   ÚlogÚwarningÚredirect)	r   Úurlr   r#   Ú_ÚrestÚparsedÚallowÚorigins	            r   Ú_redirect_safezLoginFormHandler._redirect_safe"   sE  € ð ˆ?Ø—m‘mˆGð �k‰k˜$ Ó&ˆð �#‰:Ø!Ÿm™m¨CÓ0‰OˆF�A�tØ�H˜C §¡¨CÓ 0Ð1Ð2‰Cð �~‰~˜dÔ#Ø˜SŸZ™Z¨›_Ñ,�Ü˜#“ˆð �MŠM˜VŸ]š]°F·K±KÀ#Ñ4E×3QÑ3QÐRV×R_ÑR_Ô3`àˆEà�}Š} §¢à"ŸM™M˜?¨#¨f¯m©m¨_Ð=�ØŸ™›�Ø×$Ò$Ø ×-Ñ-°Ñ7‘EØ×*Ò*Ü.¨t×/DÑ/DÀfÓM�EÙà—‘× Ñ Ð!DÀsÑ!JÔKØ�Ø�‰�cÕr   c                 óš   — | j                   r/| j                  d| j                  ¬«      }| j                  |«       y| j	                  «        y)zGet the login form.r   r   N)Úcurrent_userr   r   r2   r   )r   Únext_urls     r   ÚgetzLoginFormHandler.getT   s=   € ð ×ÒØ×(Ñ(¨¸¿¹Ð(ÓGˆHØ×Ñ Õ)à�L‰L�Nr   c                 ó~  — | j                   j                  | «      x}| _        |€&| j                  d«       | j	                  ddi¬«       y| j
                  j                  d|j                  › d�«       | j                   j                  | |«       | j                  d| j                  ¬	«      }| j                  |«       y)
zPost a login.Né‘  ÚerrorúInvalid credentials©r   zUser z logged in.r   r   )Úidentity_providerÚprocess_login_formr4   Ú
set_statusr   r)   ÚinfoÚusernameÚset_login_cookier   r   r2   )r   Úuserr5   s      r   ÚpostzLoginFormHandler.post]   s¤   € ð $(×#9Ñ#9×#LÑ#LÈTÓ#RÐRˆˆtÔ Øˆ<Ø�O‰O˜CÔ Ø�L‰L 'Ð+@Ð!AˆLÔBØà�‰�‰˜˜dŸm™m˜_¨KÐ8Ô9Ø×Ñ×/Ñ/°°dÔ;Ø×$Ñ$ V°T·]±]Ð$ÓCˆØ×Ñ˜HÕ%r   ©N)	Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r2   r	   r6   rC   © r   r   r   r      s:   „ ñó

ó0ðd ñó ðð ñ&ó ñ&r   r   c                   ó  — e Zd ZdZed„ «       Zd„ Zed„ «       Ze	dd„«       Z
 ej                  dej                  «      Ze	d„ «       Ze	d	„ «       Ze	d
„ «       Ze	d„ «       Ze	d„ «       Ze	d„ «       Ze	dd„«       Ze	d„ «       Ze	d„ «       Zy)ÚLegacyLoginHandlerz¤Legacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 ó8   — | j                  | j                  «      S rD   )Úpassword_from_settingsÚsettings)r   s    r   Úhashed_passwordz"LegacyLoginHandler.hashed_passwords   s   € à×*Ñ*¨4¯=©=Ó9Ð9r   c                 ó   — t        ||«      S )zCheck a passwd.)r
   )r   ÚaÚbs      r   r
   zLegacyLoginHandler.passwd_checkw   s   € ä˜A˜qÓ!Ð!r   c                 óÈ  — | j                  dd¬«      }| j                  dd¬«      }| j                  | j                  «      �rr| j                  | j                  |«      r2|s0| j                  | t        j                  «       j                  «       �n$| j                  rò| j                  |k(  rã| j                  | t        j                  «       j                  «       |rÙt        | j                  dd«      rÂ| j                  j                  dd«      }t        j                  j                  |d«      }t!        | j                  d	«      r+t#        ||¬
«      x| j                  _        | j                  d<   | j$                  j'                  d|z  «       n&| j)                  d«       | j+                  ddi¬«       y| j                  d| j,                  ¬«      }| j/                  |«       y)zPost a login form.ÚpasswordÚ r   Únew_passwordÚallow_password_changeFÚ
config_dirzjupyter_server_config.jsonrO   )Úconfig_filezWrote hashed password to %sr8   r9   r:   r;   Nr   )r   Úget_login_availablerN   r
   rO   rA   ÚuuidÚuuid4ÚhexÚtokenÚgetattrr<   r6   Úosr%   ÚjoinÚhasattrr   r)   r?   r>   r   r   r2   )r   Útyped_passwordrV   rX   rY   r5   s         r   rC   zLegacyLoginHandler.post{   s{  € ð ×*Ñ*¨:¸rÐ*ÓBˆØ×(Ñ(¨ÀÐ(ÓDˆà×#Ñ# D§M¡MÕ2Ø× Ñ  ×!5Ñ!5°~ÔFÉ|Ø×%Ñ% d¬D¯J©J«L×,<Ñ,<Ö=Ø—’ §
¡
¨nÒ <Ø×%Ñ% d¬D¯J©J«L×,<Ñ,<Ô=Ù¤G¨D×,BÑ,BÐD[Ð]bÔ$cØ!%§¡×!2Ñ!2°<ÀÓ!D�JÜ"$§'¡'§,¡,¨zÐ;WÓ"X�KÜ˜t×5Ñ5Ð7HÔIä(¨À;ÔOð˜×.Ñ.Ô>ÀÇÁÈzÑAZð —H‘H—M‘MÐ"?À+Ñ"MÕNà—‘ Ô$Ø—‘ gÐ/DÐ%E�ÔFØà×$Ñ$ V°T·]±]Ð$ÓCˆØ×Ñ˜HÕ%r   Nc                 ó`  — |j                   j                  di «      }|j                  dd«       |j                   j                  d|j                  j                  dk(  «      r|j                  dd«       |j                  d|j
                  «        |j                  |j                  |fi |¤Ž |S )z9Call this on handlers to set the login cookie for successÚcookie_optionsÚhttponlyTÚsecure_cookieÚhttpsÚsecurer%   )rN   r6   Ú
setdefaultÚrequestÚprotocolr   Úset_secure_cookieÚcookie_name)ÚclsÚhandlerÚuser_idre   s       r   rA   z#LegacyLoginHandler.set_login_cookie–   sœ   € ð !×)Ñ)×-Ñ-Ð.>ÀÓCˆØ×!Ñ! *¨dÔ3ð ×Ñ×Ñ °·±×1IÑ1IÈWÑ1TÔUØ×%Ñ% h°Ô5Ø×!Ñ! &¨'×*:Ñ*:Ô;Ø!ˆ×!Ñ! '×"5Ñ"5°wÑQÀ.ÒQØˆr   ztoken\s+(.+)c                 óÒ   — |j                  dd«      }|sR| j                  j                  |j                  j                  j                  dd«      «      }|r|j                  d«      }|S )z›Get the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        r^   rU   ÚAuthorizationr   )r   Úauth_header_patÚmatchrk   Úheadersr6   Úgroup)ro   rp   Ú
user_tokenÚms       r   Ú	get_tokenzLegacyLoginHandler.get_token¥   s]   € ð ×)Ñ)¨'°2Ó6ˆ
Ùà×#Ñ#×)Ñ)¨'¯/©/×*AÑ*A×*EÑ*EÀoÐWYÓ*ZÓ[ˆAÙØŸW™W Q›Z�
ØÐr   c                 ó&   — | j                  |«       S )ú+DEPRECATED in 2.0, use IdentityProvider API)Úis_token_authenticated©ro   rp   s     r   Úshould_check_originz&LegacyLoginHandler.should_check_origin·   s   € ð ×-Ñ-¨gÓ6Ð6Ð6r   c                 óN   — t        |dd«      €|j                   t        |dd«      S )r|   Ú_user_idNÚ_token_authenticatedF)r_   r4   r~   s     r   r}   z)LegacyLoginHandler.is_token_authenticated¼   s,   € ô �7˜J¨Ó-Ð5à× Ò Ü�wÐ 6¸Ó>Ð>r   c                 ó˜  — t        |dd«      r|j                  S | j                  |«      }| j                  |«      }|xs |}|r||k7  r| j	                  ||«       d|_        |€_|j                  |j                  «      �6|j                  j                  d|j                  «       |j                  «        |j                  sd}||_        |S )r|   r�   NTz(Clearing invalid/expired login cookie %sÚ	anonymous)r_   r�   Úget_user_tokenÚget_user_cookierA   r‚   Ú
get_cookiern   r)   r*   Úclear_login_cookieÚlogin_available)ro   rp   Útoken_user_idÚcookie_user_idrq   s        r   Úget_userzLegacyLoginHandler.get_userÄ   sÔ   € ô
 �7˜J¨Ô-Ø×#Ñ#Ð#Ø×*Ñ*¨7Ó3ˆØ×,Ñ,¨WÓ5ˆð  Ò1 >ˆÙð ˜.Ò(Ø×$Ñ$ W¨gÔ6ð ,0ˆGÔ(àˆ?ð ×!Ñ! '×"5Ñ"5Ó6ÐBØ—‘×#Ñ#Ð$NÐPW×PcÑPcÔdØ×*Ñ*Ô,Ø×*Ò*ð &�ð #ˆÔØˆr   c                 óœ   — |j                   j                  di «      } |j                  |j                  fi |¤Ž}|r|j	                  «       }|S )r|   Úget_secure_cookie_kwargs)rN   r6   Úget_secure_cookiern   Údecode)ro   rp   rŽ   rq   s       r   r†   z"LegacyLoginHandler.get_user_cookieé   sQ   € ð $+×#3Ñ#3×#7Ñ#7Ð8RÐTVÓ#WÐ Ø+�'×+Ñ+¨G×,?Ñ,?Ñ\ÐC[Ñ\ˆÙØ—n‘nÓ&ˆGØˆr   c                 ó\  — |j                   }|sy| j                  |«      }d}||k(  r2|j                  j                  d|j                  j
                  «       d}|rQ| j                  |«      }|€<t        j                  «       j                  }|j                  j                  d|› �«       |S y)r|   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )r^   rz   r)   Údebugrk   Ú	remote_ipr†   r[   r\   r]   r?   )ro   rp   r^   rx   Úauthenticatedrq   s         r   r…   z!LegacyLoginHandler.get_user_tokenò   s¨   € ð —‘ˆÙØà—]‘] 7Ó+ˆ
ØˆØ˜Òà�K‰K×ÑØBØ—‘×)Ñ)ôð !ˆMáð ×)Ñ)¨'Ó2ˆGØˆäŸ*™*›,×*Ñ*�Ø—‘× Ñ ØNÈwÈiÐXôð ˆNàr   c                 ó<  — |j                   s[d}|€|j                  j                  |› d�«       |j                  s,|j                  s|j                  j                  |› d�«       yyy|j                  s)|j                  s|j                  j                  d«       yyy)r|   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)Úipr)   r*   rT   r^   )ro   ÚappÚssl_optionsr*   s       r   Úvalidate_securityz$LegacyLoginHandler.validate_security  s�   € ð �vŠvØTˆGØÐ"Ø—‘—‘ 7 )Ð+^Ð _Ô`Ø—<’<¨¯	ª	Ø—‘—‘Ø�ið  Cð Cõð )2�<ð
 —’ c§i¢iØ�G‰G�O‰OðTõð '0�r   c                 ó&   — |j                  dd«      S )r|   rT   rU   )r6   ©ro   rN   s     r   rM   z)LegacyLoginHandler.password_from_settings$  s   € ð �|‰|˜J¨Ó+Ð+r   c                 ó\   — t        | j                  |«      xs |j                  d«      «      S )r|   r^   )ÚboolrM   r6   r›   s     r   rZ   z&LegacyLoginHandler.get_login_available)  s(   € ô �C×.Ñ.¨xÓ8ÒQ¸H¿L¹LÈÓ<QÓRÐRr   rD   )rE   rF   rG   rH   ÚpropertyrO   r
   r	   rC   ÚclassmethodrA   ÚreÚcompileÚ
IGNORECASErt   rz   r   r}   rŒ   r†   r…   r™   rM   rZ   rI   r   r   rK   rK   l   s  „ ñð ñ:ó ð:ò"ð ñ&ó ð&ð4 ò
ó ð
ð !�b—j‘j °"·-±-Ó@€Oàñó ðð" ñ7ó ð7ð ñ?ó ð?ð ñ"ó ð"ðH ñó ðð ñó ðð> òó ðð" ñ,ó ð,ð ñSó ñSr   rK   )rH   r`   r    r[   Úurllib.parser   Útornado.escaper   Úbase.handlersr   Úutilsr   Ú	decoratorr	   Úsecurityr
   r   r   rK   ÚLoginHandlerrI   r   r   Ú<module>rª      sM   ðÙ ;ó 
Û 	Û Ý !å %å *Ý &Ý ,ß 0ôW&�~ô W&ôtASÐ)ô ASðJ "�r   