
    Kef/                         d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZ  G d	 d
e	          Z G d de          ZeZdS )z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler   )passwd_checkset_passwordc                   .    e Zd ZdZddZddZd Zd ZdS )LoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc                     |                      |                     dt          |                     d| j                            |                     dS )zRender the login form.z
login.htmlnextdefault)r   messageN)writerender_templater   get_argumentbase_url)selfr   s     9lib/python3.11/site-packages/jupyter_server/auth/login.py_renderzLoginFormHandler._render   s`    

   1 1&$- 1 P PQQ !  	
 	
 	
 	
 	
    c                    || j         }|                    dd          }d|v r3|                    d          \  }}}| d|                    d           }t	          |          }|j        s)|j        s"|j        dz                       | j                   sd}|j        s|j        rf|j         d|j         }|	                                }| j
        r| j
        |k    }n.| j        r't          t          j        | j        |                    }|s| j                            d|z             |}|                     |           dS )	zRedirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        N\z%5C:z:///Fz!Not allowing login redirect to %r)r   replace	partitionlstripr   schemenetlocpath
startswithlowerallow_originallow_origin_patboolrematchlogwarningredirect)	r   urlr   r    _restparsedalloworigins	            r   _redirect_safezLoginFormHandler._redirect_safe   sh    ?mG kk$&& #::!mmC00OFAt22C 0 022C# M 	V] 	FK#4E3Q3QRVR_3`3` 	E} J J"M==fm==$ J -7EE* J $*?!H!HIIE   !Ds!JKKKcr   c                     | j         r3|                     d| j                  }|                     |           dS |                                  dS )zGet the login form.r   r   N)current_userr   r   r3   r   )r   next_urls     r   getzLoginFormHandler.getL   sR     	(((GGH)))))LLNNNNNr   c                    | j                             |           x}| _        |/|                     d           |                     ddi           dS | j                            d|j         d           | j                             | |           | 	                    d| j
        	          }|                     |           dS )
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r   r   )identity_providerprocess_login_formr5   
set_statusr   r*   infousernameset_login_cookier   r   r3   )r   userr6   s      r   postzLoginFormHandler.postT   s    #'#9#L#LT#R#RRt <OOC   LL'+@!ALBBBF8dm888999//d;;;$$VT]$CCH%%%%%r   N)__name__
__module____qualname____doc__r   r3   r7   rD    r   r   r   r      se         

 
 
 
+ + + +Z  & & & & &r   r   c                   @   e Zd ZdZed             Zd Zd Zedd            Z	 e
j        de
j                  Zed             Zed	             Zed
             Zed             Zed             Zed             Zedd            Zed             Zed             ZdS )LegacyLoginHandlerzLegacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 6    |                      | j                  S rE   )password_from_settingssettings)r   s    r   hashed_passwordz"LegacyLoginHandler.hashed_passwordi   s    **4=999r   c                 "    t          ||          S )zCheck a passwd.)r   )r   abs      r   r   zLegacyLoginHandler.passwd_checkm   s    Aq!!!r   c                    |                      dd          }|                      dd          }|                     | j                  rc|                     | j        |          r0|s.|                     | t          j                    j                   n| j	        r| j	        |k    r|                     | t          j                    j                   |rt          | j        dd          r| j                            dd          }t          j                            |d          }t!          | j        d	          r%t#          ||
          x| j        _        | j        d<   | j                            d|z             n/|                     d           |                     ddi           dS |                      d| j                  }|                     |           dS )zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.jsonrP   )config_filezWrote hashed password to %sr9   r:   r;   r<   Nr   )r   get_login_availablerO   r   rP   rB   uuiduuid4hextokengetattrr=   r7   osr"   joinhasattrr	   r*   r@   r?   r   r   r3   )r   typed_passwordrW   rY   rZ   r6   s         r   rD   zLegacyLoginHandler.postq   s   **:r*BB(((DD##DM22 	  !5~FF | %%dDJLL,<==== 
n < <%%dDJLL,<=== OGD,BD[]b$c$c O!%!2!2<!D!DJ"$',,z;W"X"XKt57HII P );OOOP.>&B HMM"?+"MNNN$$$g/D%EFFF$$VT]$CCH%%%%%r   Nc                 D   |j                             di           }|                    dd           |j                             d|j        j        dk              r|                    dd           |                    d|j                    |j        |j        |fi | |S )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer"   )rO   r7   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idrf   s       r   rB   z#LegacyLoginHandler.set_login_cookie   s     !)--.>CC!!*d333 1IW1TUU 	6%%h555!!&'*:;;;!!'"5wQQ.QQQr   ztoken\s+(.+)c                     |                     dd          }|sO| j                            |j        j                            dd                    }|r|                    d          }|S )zGet the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        r_   rV   Authorizationr   )r   auth_header_patr)   rl   headersr7   group)rp   rq   
user_tokenms       r   	get_tokenzLegacyLoginHandler.get_token   sj     ))'266
 	(#))'/*A*E*EoWY*Z*Z[[A (WWQZZ
r   c                 .    |                      |           S )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedrp   rq   s     r   should_check_originz&LegacyLoginHandler.should_check_origin   s     --g6666r   c                 T    t          |dd          |j         t          |dd          S )r|   _user_idN_token_authenticatedF)r`   r5   r~   s     r   r}   z)LegacyLoginHandler.is_token_authenticated   s2     7J--5  w 6>>>r   c                    t          |dd          r|j        S |                     |          }|                     |          }|p|}|r#||k    r|                     ||           d|_        |W|                    |j                  4|j        	                    d|j                   |
                                 |j        sd}||_        |S )r|   r   NTz(Clearing invalid/expired login cookie %s	anonymous)r`   r   get_user_tokenget_user_cookierB   r   
get_cookiero   r*   r+   clear_login_cookielogin_available)rp   rq   token_user_idcookie_user_idrr   s        r   get_userzLegacyLoginHandler.get_user   s    
 7J-- 	$##**733,,W55  1> 	0 .(($$Wg666 ,0G(? !!'"566B##$NPWPcddd**,,,* & & #r   c                     |j                             di           } |j        |j        fi |}|r|                                }|S )r|   get_secure_cookie_kwargs)rO   r7   get_secure_cookiero   decode)rp   rq   r   rr   s       r   r   z"LegacyLoginHandler.get_user_cookie   sY     $+#3#7#78RTV#W#W +'+G,?\\C[\\ 	'nn&&Gr   c                 D   |j         }|sdS |                     |          }d}||k    r'|j                            d|j        j                   d}|rN|                     |          }|5t          j                    j	        }|j        
                    d|            |S dS )r|   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )r_   rz   r*   debugrl   	remote_ipr   r\   r]   r^   r@   )rp   rq   r_   rx   authenticatedrr   s         r   r   z!LegacyLoginHandler.get_user_token   s      	F]]7++
KB)   !M 	 ))'22G*,,*  XwXX   N4r   c                    |j         sRd}||j                            | d           |j        s&|j        s!|j                            | d           dS dS dS |j        s#|j        s|j                            d           dS dS dS )r|   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr*   r+   rU   r_   )rp   appssl_optionsr+   s       r   validate_securityz$LegacyLoginHandler.validate_security  s     v 	TG"7 _ _ _```< 	  C C C       
  	ci 	GOOT    	 	 	 	r   c                 .    |                     dd          S )r|   rU   rV   )r7   rp   rO   s     r   rN   z)LegacyLoginHandler.password_from_settings  s     ||J+++r   c                 p    t          |                     |          p|                    d                    S )r|   r_   )r'   rN   r7   r   s     r   r[   z&LegacyLoginHandler.get_login_available  s1     C..x88QHLL<Q<QRRRr   rE   )rF   rG   rH   rI   propertyrP   r   rD   classmethodrB   r(   compile
IGNORECASEru   rz   r   r}   r   r   r   r   rN   r[   rJ   r   r   rL   rL   b   s         : : X:" " "& & &4 
 
 
 [
 !bj"-@@O  [" 7 7 [7 ? ? [? " " ["H   [   [>    [" , , [, S S [S S Sr   rL   )rI   ra   r(   r\   urllib.parser   tornado.escaper   base.handlersr   securityr   r	   r   rL   LoginHandlerrJ   r   r   <module>r      s    ; ; 
			 				  ! ! ! ! ! ! % % % % % % * * * * * * 0 0 0 0 0 0 0 0P& P& P& P& P&~ P& P& P&f@S @S @S @S @S) @S @S @SH "r   