� K�gQT��>�ddlmZmZmZmZmZmZddlmZddl m Zddl mZ ddlmZddlmZddlmZddlmZdd lmZmZdd lmZmZGd�d��ZGd �de��ZGd�de��Z Gd�de ��ZGd�de ��ZGd�d��Z dS)�)�Any�Dict�List�Optional�Union�cast)� HTTPException)�OAuth2)� OAuthFlows)�Form)�SecurityBase)�get_authorization_scheme_param)�Request)�HTTP_401_UNAUTHORIZED�HTTP_403_FORBIDDEN)� Annotated�Docc��eZdZdZddddd�deeedfed��ed��fd eee��ed ��fdeee��ed��fdeee��ed ��fdeeedfe��ed��fdeeedfe��ed��ffd�Z dS)�OAuth2PasswordRequestFormaD This is a dependency class to collect the `username` and `password` as form data for an OAuth2 password flow. The OAuth2 specification dictates that for a password flow the data should be collected using form data (instead of JSON) and that it should have the specific fields `username` and `password`. All the initialization parameters are extracted from the request. Read more about it in the [FastAPI docs for Simple OAuth2 with Password and Bearer](https://fastapi.tiangolo.com/tutorial/security/simple-oauth2/). ## Example ```python from typing import Annotated from fastapi import Depends, FastAPI from fastapi.security import OAuth2PasswordRequestForm app = FastAPI() @app.post("/login") def login(form_data: Annotated[OAuth2PasswordRequestForm, Depends()]): data = {} data["scopes"] = [] for scope in form_data.scopes: data["scopes"].append(scope) if form_data.client_id: data["client_id"] = form_data.client_id if form_data.client_secret: data["client_secret"] = form_data.client_secret return data ``` Note that for OAuth2 the scope `items:read` is a single scope in an opaque string. You could have custom internal logic to separate it by colon characters (`:`) or similar, and get the two parts `items` and `read`. Many applications do that to group and organize permissions, you could do it as well in your application, just know that that it is application specific, it's not part of the specification. N�)� grant_type�scope� client_id� client_secretr�password��patternaD The OAuth2 spec says it is required and MUST be the fixed string "password". Nevertheless, this dependency class is permissive and allows not passing it. If you want to enforce it, use instead the `OAuth2PasswordRequestFormStrict` dependency. �username�~ `username` string. The OAuth2 spec requires the exact field name `username`. �~ `password` string. The OAuth2 spec requires the exact field name `password". r�� A single string with actually several scopes separated by spaces. Each scope is also a string. For example, a single string with: ```python "items:read items:write users:read profile openid" ```` would represent the scopes: * `items:read` * `items:write` * `users:read` * `profile` * `openid` r�� If there's a `client_id`, it can be sent as part of the form fields. But the OAuth2 specification recommends sending the `client_id` and `client_secret` (if any) using HTTP Basic auth. r�& If there's a `client_password` (and a `client_id`), they can be sent as part of the form fields. But the OAuth2 specification recommends sending the `client_id` and `client_secret` (if any) using HTTP Basic auth. c�~�||_||_||_|��|_||_||_dS�N)rrr�split�scopesrr)�selfrrrrrrs �g/home/asafur/pinokio/api/open-webui.git/app/env/lib/python3.11/site-packages/fastapi/security/oauth2.py�__init__z"OAuth2PasswordRequestForm.__init__=s>��f%�� k�k�m�m��"��*��) �__name__� __module__�__qualname__�__doc__rr�strrrr*�r+r)rrs��*�*�t �X � � �cX+�X+�X+��#�t�)��D��$�$�$��C�� X+��D�F�F��C�� X+�2��D�F�F��C�� 3X+�F��D�F�F��C�� GX+�v��#�t�)��D�F�F��C�� wX+�L!��#�t�)��D�F�F��C�� MX+�X+�X+�X+�X+�X+r+rc��eZdZdZ ddeeed��ed��fdeee��ed ��fdeee��ed ��fdeee��ed��fd eeedfe��ed��fdeeedfe��ed��ff�fd� Z �xZ S)�OAuth2PasswordRequestFormStrictaG This is a dependency class to collect the `username` and `password` as form data for an OAuth2 password flow. The OAuth2 specification dictates that for a password flow the data should be collected using form data (instead of JSON) and that it should have the specific fields `username` and `password`. All the initialization parameters are extracted from the request. The only difference between `OAuth2PasswordRequestFormStrict` and `OAuth2PasswordRequestForm` is that `OAuth2PasswordRequestFormStrict` requires the client to send the form field `grant_type` with the value `"password"`, which is required in the OAuth2 specification (it seems that for no particular reason), while for `OAuth2PasswordRequestForm` `grant_type` is optional. Read more about it in the [FastAPI docs for Simple OAuth2 with Password and Bearer](https://fastapi.tiangolo.com/tutorial/security/simple-oauth2/). ## Example ```python from typing import Annotated from fastapi import Depends, FastAPI from fastapi.security import OAuth2PasswordRequestForm app = FastAPI() @app.post("/login") def login(form_data: Annotated[OAuth2PasswordRequestFormStrict, Depends()]): data = {} data["scopes"] = [] for scope in form_data.scopes: data["scopes"].append(scope) if form_data.client_id: data["client_id"] = form_data.client_id if form_data.client_secret: data["client_secret"] = form_data.client_secret return data ``` Note that for OAuth2 the scope `items:read` is a single scope in an opaque string. You could have custom internal logic to separate it by colon characters (`:`) or similar, and get the two parts `items` and `read`. Many applications do that to group and organize permissions, you could do it as well in your application, just know that that it is application specific, it's not part of the specification. grant_type: the OAuth2 spec says it is required and MUST be the fixed string "password". This dependency is strict about it. If you want to be permissive, use instead the OAuth2PasswordRequestForm dependency class. username: username string. The OAuth2 spec requires the exact field name "username". password: password string. The OAuth2 spec requires the exact field name "password". scope: Optional string. Several scopes (each one a string) separated by spaces. E.g. "items:read items:write users:read profile openid" client_id: optional string. OAuth2 recommends sending the client_id and client_secret (if any) using HTTP Basic auth, as: client_id:client_secret client_secret: optional string. OAuth2 recommends sending the client_id and client_secret (if any) using HTTP Basic auth, as: client_id:client_secret rNrrra The OAuth2 spec says it is required and MUST be the fixed string "password". This dependency is strict about it. If you want to be permissive, use instead the `OAuth2PasswordRequestForm` dependency class. rrr rr!rr"rr#c�V��t��||||||��dS)N)rrrrrr)�superr*)r(rrrrrr� __class__s �r)r*z(OAuth2PasswordRequestFormStrict.__init__�sC��d ��!��'� � � � � � r+)rNN)r,r-r.r/rr0rrrr*� __classcell__�r6s@r)r3r3�s��=�=�p � � �aY �Y ��D��$�$�$��C�� Y ��D�F�F��C�� Y �0��D�F�F��C�� 1Y �D��D�F�F��C�� EY �t��#�t�)��D�F�F��C�� uY �J!��#�t�)��D�F�F��C�� KY �Y �Y �Y �Y �Y �Y �Y �Y �Y r+r3c �2�eZdZdZe��dddd�deeeeeeee fffe d��fdeeee d��fd eeee d ��fdeee d��ffd �Z dedeefd�ZdS)r a� This is the base class for OAuth2 authentication, an instance of it would be used as a dependency. All other OAuth2 classes inherit from it and customize it for each OAuth2 flow. You normally would not create a new class inheriting from it but use one of the existing subclasses, and maybe compose them if you want to support multiple flows. Read more about it in the [FastAPI docs for Security](https://fastapi.tiangolo.com/tutorial/security/). NT��flows�scheme_name�description� auto_errorr;zA The dictionary of OAuth2 flows. r<�� Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`). r=�� Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`). r>�� By default, if no HTTP Authorization header is provided, required for OAuth2 authentication, it will automatically cancel the request and send the client an error. If `auto_error` is set to `False`, when the HTTP Authorization header is not available, instead of erroring out, the dependency result will be `None`. This is useful when you want to have optional authentication. It is also useful when you want to have authentication that can be provided in one of multiple optional ways (for example, with OAuth2 or in a cookie). c��ttt|��|��|_|p|jj|_||_dS)N)r;r=)�OAuth2Modelr�OAuthFlowsModel�modelr6r,r<r>)r(r;r<r=r>s r)r*zOAuth2.__init__AsI��h!��.�.�K� � � �� '�A�$�.�*A��$��r+�request�returnc��K�|j�d��}|s|jrttd��dS|S)N� Authorization�Not authenticated)�status_code�detail)�headers�getr>r r)r(rF� authorizations r)�__call__zOAuth2.__call__{sW��+�+�O�<�<� �� #� 2�;N��t��r+)r,r-r.r/rDrrrr0rrr�boolr*rrPr1r+r)r r 4sP�� , �O�� ( �e8%�8%�8%��/�4��T�#�s�(�^�(;�#<�<�=��C�� 8%��S�M��C�� 8%�*��S�M��C�� +8%�>��C�� ?8%�8%�8%�8%�t �g� �(�3�-� � � � � � r+r c�<��eZdZdZ ddeeed��fdeeeed��fdeeeeefed ��fd eeeed��fdee ed ��ff �fd� Z dedeefd�Z�xZ S)�OAuth2PasswordBearera) OAuth2 flow for authentication using a bearer token obtained with a password. An instance of it would be used as a dependency. Read more about it in the [FastAPI docs for Simple OAuth2 with Password and Bearer](https://fastapi.tiangolo.com/tutorial/security/simple-oauth2/). NT�tokenUrlz� The URL to obtain the OAuth2 token. This would be the *path operation* that has `OAuth2PasswordRequestForm` as a dependency. r<r?r'�� The OAuth2 scopes that would be required by the *path operations* that use this dependency. r=r@r>rAc��|si}ttt||d��}t��||||��dS)N)rTr')rr:�rDrrr5r*)r(rTr<r'r=r>r;r6s �r)r*zOAuth2PasswordBearer.__init__�su��z� ��F��#�H��G�G�H�H� � � �� #�#�!� � � � � � r+rFrGc��K�|j�d��}t|��\}}|r|��dkr"|jrttdddi��dS|S�NrI�bearerrJzWWW-Authenticate�Bearer)rKrLrM�rMrNr�lowerr>r r�r(rFrO�scheme�params r)rPzOAuth2PasswordBearer.__call__��+�+�O�<�<� �6�}�E�E� �� (� :� :�� #� 5�.�/��:��t��r+)NNNT)r,r-r.r/rr0rrrrQr*rrPr7r8s@r)rSrS�s��8 � � �( �wG �G ��C�� G ��S�M��C�� G �*��T�#�s�(�^�$��C�� +G �<��S�M��C�� =G �P��C�� QG �G �G �G �G �G �R�g��(�3�-��r+rSc�t��eZdZdZ ddedeeed��fdeeeed��fd eeeed ��fdeeeeefed��fd eeeed��fdee ed��ff�fd� Z dedeefd�Z�xZ S)�OAuth2AuthorizationCodeBearerz� OAuth2 flow for authentication using a bearer token obtained with an OAuth2 code flow. An instance of it would be used as a dependency. NT�authorizationUrlrTzE The URL to obtain the OAuth2 token. � refreshUrlzT The URL to refresh the token and obtain a new one. r<r?r'rUr=r@r>rAc ��|si}ttt||||d��}t��||||��dS)N)rdrTrer')�authorizationCoder:rW) r(rdrTrer<r'r=r>r;r6s �r)r*z&OAuth2AuthorizationCodeBearer.__init__�s��J� ��F��"��(8� (�",�$� �� #�#�!� � � � � � r+rFrGc��K�|j�d��}t|��\}}|r|��dkr"|jrttdddi��dS|SrYr\r^s r)rPz&OAuth2AuthorizationCodeBearer.__call__Grar+)NNNNT)r,r-r.r/r0rrrrrQr*rrPr7r8s@r)rcrc�s��. � � � �( �GW �W ��W ��C�� W ��S�M��C�� W �&��S�M��C�� 'W �:��T�#�s�(�^�$��C�� ;W �L��S�M��C�� MW �`��C�� aW �W �W �W �W �W �r�g��(�3�-��r+rcc�\�eZdZdZ ddeeeeed��ffd�Z dS)�SecurityScopesa This is a special class that you can define in a parameter in a dependency to obtain the OAuth2 scopes required by all the dependencies in the same chain. This way, multiple dependencies can have different scopes, even when used in the same *path operation*. And with this, you can access all the scopes required in all those dependencies in a single place. Read more about it in the [FastAPI docs for OAuth2 scopes](https://fastapi.tiangolo.com/advanced/security/oauth2-scopes/). Nr'zA This will be filled by FastAPI. c�V�|pg|_d�|j��|_dS)N� )r'�join� scope_str)r(r's r)r*zSecurityScopes.__init__cs0��$ �L�b� �� H�H�T�[�!�!� ��r+r%) r,r-r.r/rrrr0rr*r1r+r)rjrjVsn�� * �"�"��T�#�Y��C�� "�"�"�"�"�"r+rjN)!�typingrrrrrr�fastapi.exceptionsr �fastapi.openapi.modelsr rCrrD�fastapi.param_functionsr�fastapi.security.baser �fastapi.security.utilsr�starlette.requestsr�starlette.statusrr�typing_extensionsrrrr3rSrcrjr1r+r)�<module>rxs��9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�9�,�,�,�,�,�,�8�8�8�8�8�8�@�@�@�@�@�@�(�(�(�(�(�(�.�.�.�.�.�.�A�A�A�A�A�A�&�&�&�&�&�&�F�F�F�F�F�F�F�F�-�,�,�,�,�,�,�,�E+�E+�E+�E+�E+�E+�E+�E+�PY �Y �Y �Y �Y �&?�Y �Y �Y �xP�P�P�P�P�\�P�P�P�f^�^�^�^�^�6�^�^�^�Bk�k�k�k�k�F�k�k�k�\("�("�("�("�("�("�("�("�("�("r+