
    ȯei                        d dl mZ d dlmZmZmZ d dlmZmZm	Z	m
Z
mZ d dlmZ d dlmZ erd dlmZ d dlZd dlmZ  G d	 d
e	ee      Z G d de      Zy)    )annotations)TYPE_CHECKINGAnycast)BaseApp	BaseOAuthOAuth2Mixin
OAuthErrorOpenIDMixin)OAuth2Session)TornadoIntegration)CallableN)	AuthCachec                  Z     e Zd ZeZd fdZ	 d	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 ddZd	dZ xZ	S )
TornadoOAuth2Appc                ~    t        dt        | 	               }d|j                  dg       v rd| j                  d<   |S )zGWe enforce S256 code challenge method if it is supported by the server.dict[str, Any]S256 code_challenge_methods_supportedcode_challenge_method)r   superload_server_metadatagetclient_kwargs)selfresult	__class__s     a/var/www/html/glpi_dashboard/venv/lib/python3.12/site-packages/streamlit/web/server/oidc_mixin.pyr   z%TornadoOAuth2App.load_server_metadata-   sB    &(D(FGVZZ BBGG:@D67    c                ~     | j                   |fi |} | j                  dd|i| |j                  |d   d       y)a(  Create a HTTP Redirect for Authorization Endpoint.

        :param request_handler: HTTP request instance from Tornado.
        :param redirect_uri: Callback or redirect URI for authorization.
        :param kwargs: Extra parameters to include.
        :return: A HTTP redirect response.
        redirect_uriurli.  )statusN )create_authorization_url_save_authorize_dataredirect)r   request_handlerr!   kwargsauth_contexts        r   authorize_redirectz#TornadoOAuth2App.authorize_redirect4   sK     5t44\LVL!!!L|L|L  e!4S Ar   c                R   |j                  dd      }|r|j                  dd      }t        ||      |j                  d      |j                  d      d}i }|j                  dd      }| j                  j	                  ||j                  d            }| j                  j                  ||j                  d             |st        d	d
      | j                  ||      } | j                  di ||}	d|	v r#d|v r| j                  |	|d   |      }
i |	d|
i}	t        d|	      S )zl
        :param request_handler: HTTP request instance from Tornado.
        :return: A token dict.
        errorNerror_description)r-   descriptioncodestate)r0   r1   claims_optionsinvalid_statez>OAuth state not found or expired. Please try logging in again.id_tokennonce)r5   r2   userinfor   r$   )get_argumentr
   pop	frameworkget_state_datar   clear_state_data_format_state_paramsfetch_access_tokenparse_id_tokenr   )r   r(   r)   r-   r/   paramssessionr2   
state_datatokenr6   s              r   authorize_access_tokenz'TornadoOAuth2App.authorize_access_tokenE   sG     ,,Wd;)667JDQK5kBB $008$11':
 #%$4d;^^227FJJw<OP
''G1DE%\ 
 **:v>''';&;F;7j#8**Z0 + H 4u3j(3E$e,,r   c                    |j                  dd      }|r i }| j                  j                  |||       yt        d      )a\  Authlib underlying uses the concept of "session" to store state data.
        In Tornado, we don't have a session, so we use an empty dict as a placeholder.
        We also override state access to use the cache instead of session in `TornadoIntegration`.
        Authlib 1.6.6+ always writes state to session even when cache is available.
        r1   NzMissing state value)r8   r9   set_state_dataRuntimeError)r   r)   r1   r@   s       r   r&   z%TornadoOAuth2App._save_authorize_datan   s>     

7D)&(GNN))'5&A455r   )returnr   )N)r(   tornado.web.RequestHandlerr!   r   r)   r   rG   None)r(   rH   r)   r   rG   r   )r)   r   rG   rI   )
__name__
__module____qualname__r   
client_clsr   r+   rC   r&   __classcell__r   s   @r   r   r   *   se    J !B3B B 	B
 
B"'-9'-EH'-	'-R6r   r   c                  @     e Zd ZeZeZ	 	 	 	 d	 	 	 	 	 	 	 d fdZ xZS )TornadoOAuthc                8    t         |   |||       || _        y )N)cachefetch_tokenupdate_token)r   __init__config)r   rW   rS   rT   rU   r   s        r   rV   zTornadoOAuth.__init__   s'     	[| 	 	
 r   )NNNN)rW   zdict[str, Any] | NonerS   zAuthCache | NonerT   1Callable[[dict[str, Any]], dict[str, Any]] | NonerU   rX   )	rJ   rK   rL   r   oauth2_client_clsr   framework_integration_clsrV   rN   rO   s   @r   rQ   rQ   |   sO    ( 2 )-"&IMJN
%
  
 G	

 H
 
r   rQ   )
__future__r   typingr   r   r    authlib.integrations.base_clientr   r   r	   r
   r   $authlib.integrations.requests_clientr   0streamlit.web.server.authlib_tornado_integrationr   collections.abcr   tornado.webtornadostreamlit.auth_utilr   r   rQ   r$   r   r   <module>rd      sP   " # + +  P(-O6{K O6d9 r   