
    bi/                         d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	lmZmZ  G d
 de	      Z G d de      ZeZy)z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler   )allow_unauthenticated)passwd_checkset_passwordc                   @    e Zd ZdZddZddZed        Zed        Zy)LoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc                     | j                  | j                  dt        | j                  d| j                              |             y)zRender the login form.z
login.htmlnextdefault)r   messageN)writerender_templater   get_argumentbase_url)selfr   s     T/home/cdr/jupyterlab/.venv/lib/python3.12/site-packages/jupyter_server/auth/login.py_renderzLoginFormHandler._render   sC    

   1 1&$-- 1 PQ ! 	
    c                    || j                   }|j                  dd      }d|v r+|j                  d      \  }}}| d|j                  d       }t	        |      }|j
                  s4|j                  s(|j                  dz   j                  | j                         sd}|j
                  s|j                  r||j
                   d|j                   }|j                         }| j                  r| j                  |k(  }n5| j                  r)t        t        j                  | j                  |            }|s | j                  j!                  d|z         |}| j#                  |       y)	zRedirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        N\z%5C:z:///Fz!Not allowing login redirect to %r)r   replace	partitionlstripr   schemenetlocpath
startswithlowerallow_originallow_origin_patboolrematchlogwarningredirect)	r   urlr   r!   _restparsedalloworigins	            r   _redirect_safezLoginFormHandler._redirect_safe!   s.    ?mmG kk$& #:!mmC0OFAtHCC 012C# MMV]]FKK#4E3Q3QRVR_R_3`E}}"MM?#fmm_=$$ --7E** $*?*?!HIE  !Ds!JKcr   c                     | j                   r/| j                  d| j                        }| j                  |       y| j	                          y)zGet the login form.r   r   N)current_userr   r   r4   r   )r   next_urls     r   getzLoginFormHandler.getN   s=     (((GH)LLNr   c                 ~   | j                   j                  |       x}| _        |&| j                  d       | j	                  ddi       y| j
                  j                  d|j                   d       | j                   j                  | |       | j                  d| j                  	      }| j                  |       y)
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r   r   )identity_providerprocess_login_formr6   
set_statusr   r+   infousernameset_login_cookier   r   r4   )r   userr7   s      r   postzLoginFormHandler.postW   s     $(#9#9#L#LT#RRt <OOC LL'+@!ALBdmm_K89//d;$$VT]]$CH%r   N)	__name__
__module____qualname____doc__r   r4   r   r8   rE    r   r   r   r      s:    

+Z   & &r   r   c                      e Zd ZdZed        Zd Zed        Ze	dd       Z
 ej                  dej                        Ze	d        Ze	d	        Ze	d
        Ze	d        Ze	d        Ze	d        Ze	dd       Ze	d        Ze	d        Zy)LegacyLoginHandlerzLegacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 8    | j                  | j                        S rF   )password_from_settingssettings)r   s    r   hashed_passwordz"LegacyLoginHandler.hashed_passwordm   s    **4==99r   c                     t        ||      S )zCheck a passwd.)r	   )r   abs      r   r	   zLegacyLoginHandler.passwd_checkq   s    Aq!!r   c                    | j                  dd      }| j                  dd      }| j                  | j                        rr| j                  | j                  |      r2|s0| j                  | t        j                         j                         n$| j                  r| j                  |k(  r| j                  | t        j                         j                         |rt        | j                  dd      r| j                  j                  dd      }t        j                  j                  |d      }t!        | j                  d	      r+t#        ||
      x| j                  _        | j                  d<   | j$                  j'                  d|z         n&| j)                  d       | j+                  ddi       y| j                  d| j,                        }| j/                  |       y)zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.jsonrQ   )config_filezWrote hashed password to %sr:   r;   r<   r=   Nr   )r   get_login_availablerP   r	   rQ   rC   uuiduuid4hextokengetattrr>   r8   osr#   joinhasattrr
   r+   rA   r@   r   r   r4   )r   typed_passwordrX   rZ   r[   r7   s         r   rE   zLegacyLoginHandler.postu   s{    **:r*B(((D##DMM2  !5!5~F|%%dDJJL,<,<=

n <%%dDJJL,<,<=GD,B,BD[]b$c!%!2!2<!DJ"$'',,z;W"XKt557HI(;O..>zAZ HHMM"?+"MN$g/D%EF$$VT]]$CH%r   Nc                 `   |j                   j                  di       }|j                  dd       |j                   j                  d|j                  j                  dk(        r|j                  dd       |j                  d|j
                          |j                  |j                  |fi | |S )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer#   )rP   r8   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idrg   s       r   rC   z#LegacyLoginHandler.set_login_cookie   s     !))--.>C!!*d3 1I1IW1TU%%h5!!&'*:*:;!!!'"5"5wQ.Qr   ztoken\s+(.+)c                     |j                  dd      }|sR| j                  j                  |j                  j                  j                  dd            }|r|j                  d      }|S )zGet the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        r`   rW   Authorizationr   )r   auth_header_patr*   rm   headersr8   group)rq   rr   
user_tokenms       r   	get_tokenzLegacyLoginHandler.get_token   s]     ))'26
##))'//*A*A*E*EoWY*Z[AWWQZ
r   c                 &    | j                  |       S )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedrq   rr   s     r   should_check_originz&LegacyLoginHandler.should_check_origin   s     --g666r   c                 N    t        |dd      |j                   t        |dd      S )r}   _user_idN_token_authenticatedF)ra   r6   r   s     r   r~   z)LegacyLoginHandler.is_token_authenticated   s,     7J-5  w 6>>r   c                    t        |dd      r|j                  S | j                  |      }| j                  |      }|xs |}|r||k7  r| j	                  ||       d|_        |_|j                  |j                        6|j                  j                  d|j                         |j                          |j                  sd}||_        |S )r}   r   NTz(Clearing invalid/expired login cookie %s	anonymous)ra   r   get_user_tokenget_user_cookierC   r   
get_cookierp   r+   r,   clear_login_cookielogin_available)rq   rr   token_user_idcookie_user_idrs   s        r   get_userzLegacyLoginHandler.get_user   s    
 7J-###**73,,W5  1> .($$Wg6 ,0G(? !!'"5"56B##$NPWPcPcd**,** & #r   c                     |j                   j                  di       } |j                  |j                  fi |}|r|j	                         }|S )r}   get_secure_cookie_kwargs)rP   r8   get_secure_cookierp   decode)rq   rr   r   rs   s       r   r   z"LegacyLoginHandler.get_user_cookie   sQ     $+#3#3#7#78RTV#W +'++G,?,?\C[\nn&Gr   c                 \   |j                   }|sy| j                  |      }d}||k(  r2|j                  j                  d|j                  j
                         d}|rQ| j                  |      }|<t        j                         j                  }|j                  j                  d|        |S y)r}   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )r`   r{   r+   debugrm   	remote_ipr   r]   r^   r_   rA   )rq   rr   r`   ry   authenticatedrs   s         r   r   z!LegacyLoginHandler.get_user_token   s     ]]7+
KKB)) !M ))'2G**,**  NwiX Nr   c                 <   |j                   s[d}||j                  j                  | d       |j                  s,|j                  s|j                  j                  | d       yyy|j                  s)|j                  s|j                  j                  d       yyy)r}   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr+   r,   rV   r`   )rq   appssl_optionsr,   s       r   validate_securityz$LegacyLoginHandler.validate_security  s     vvTG"7)+^ _`<<		i  C C )2<
 ciiGGOOT '0r   c                 &    |j                  dd      S )r}   rV   rW   )r8   rq   rP   s     r   rO   z)LegacyLoginHandler.password_from_settings  s     ||J++r   c                 \    t        | j                  |      xs |j                  d            S )r}   r`   )r(   rO   r8   r   s     r   r\   z&LegacyLoginHandler.get_login_available#  s(     C..x8QHLL<QRRr   rF   )rG   rH   rI   rJ   propertyrQ   r	   r   rE   classmethodrC   r)   compile
IGNORECASErv   r{   r   r~   r   r   r   r   rO   r\   rK   r   r   rM   rM   f   s    : :" & &4 
 
 !bjj"--@O " 7 7 ? ? " "H    >  " , , S Sr   rM   )rJ   rb   r)   r]   urllib.parser   tornado.escaper   base.handlersr   	decoratorr   securityr	   r
   r   rM   LoginHandlerrK   r   r   <module>r      sJ    ; 
 	  ! % * , 0R&~ R&jAS) ASJ "r   