o
iX @ s d Z ddlmZ ddlZddlZddlZddlZddlmZ ddl Z ddl
Z
zddl m Z m
Z
ddlmZmZmZ ddlmZ W n% eye ddlm Z m
Z
ddlmZmZ dd lmZ ddlmZ Y nw eeZdHd
d Zd d
Z dd Z dHddZ dd Z dd Z dd Z!dd Z"G dd de
Z#G d d d e e$Z%G d d d e%Z&G d d! d!e$Z'ed"kr[ddl(Z(ddl)Z)d#d$l*m+Z+ ej,ej-d% e(j.e(j/e d& d' Z0Z1e0j2d(d)d*d+ e0j2d,d-d. e0j2d/e3dd0d1 e0j2d2e3d3d4d1 e0j2d5d6d7d8 e0j2d9dd:d8 e14 Z5e+d;e5j6ie5j7Z8e'e5j9d<8Z:e8j;e5j<r$e5j<= ndd=j>e5j?e:@ d>d?ZAeBe)jCe:jDeAd@ dAdBdCe5jEeAdD dEdFdG W d dS 1 sTw Y dS dS )Ia$ A one-stop helper for desktop app to acquire an authorization code.
It starts a web server to listen redirect_uri, waiting for auth code.
It optionally opens a browser window to guide a human user to manually login.
After obtaining an auth code, the web server will automatically shut down.
) defaultdictN)Template)
HTTPServerBaseHTTPRequestHandler)urlparseparse_qs urlencodeescape)r r )r c C sB t | d}|j|dddW d S 1 sw Y d S )Nportz
Open this link to Sign In
(You may want to use incognito window)
Abort
)auth_uriwelcome_templatecode)AuthCodeReceiverget_auth_responseget)Z listen_portr
receiver r N/home/app/Keep/.python/lib/python3.10/site-packages/msal/oauth2cli/authcode.pyobtain_auth_code s $r c C s z7t d)} | D ] }|ddd }| dkr& W d W dS q
W d n1 s1w Y W n ty@ Y nw tjdS )Nz/proc/1/cgroup: /Tz /.dockerenv)open readlinessplitstripIOErrorospathexists)flineZ cgroup_pathr r r _is_inside_docker+ s
r$ c C sH dd l } | }t|d|d }t|d|d }|dko#d|v S )Nr systemreleaser linuxZ microsoft)platformunamegetattrlower)r( r) Z
platform_namer& r r r is_wsl9 s
r, c s zt }|jdvrtd|j W dS W n ty% td Y dS w t fdddD r8td dS d d
l}|rG|| }n| }|st rd d
l
}z
| d g}|d k}W n t yk Y nw |sz| d g}|d
v }W |S t y Y |S w |S )zJBrowse uri with named browser. Default browser is customizable by $BROWSER)httphttpsz"Invalid URI scheme for browser: %sFzInvalid URI: %sc 3 s | ]}| v V qd S Nr ).0cr
r r O s z_browse..z
zInvalid characters in URIr NZwslviewz explorer.exe)r )
r schemeloggerwarning
ValueErrorany
webbrowserr r r,
subprocesscallFileNotFoundError)r
browser_nameZ
parsed_urir: browser_openedr; exit_coder r2 r _browseE sF
rA c C dd | D S )z;Flatten parse_qs()'s single-item lists into the item itselfc S s4 i | ]\}}|t |trt|d kr|d n|qS )r4 r )
isinstancelistlenr0 kvr r r
p s (z_qs2kv..items)qsr r r _qs2kvn s rM c C s
| dS )N<)
startswithtextr r r _is_htmlt s
rR c C rB )Nc S s i | ] \}}|t |qS r r rF r r r rI y s z_escape..rJ )Zkey_value_pairsr r r _escapex s rS c C s t | tr
| s
t| S | S r/ )rC str isprintablereprrP r r r _printify{ s rW c @ s6 e Zd Zdd Zdd Zdd Zd
dd Zd
d Zd S )_AuthCodeHandlerc C s t t| jj}|dd gd }|dd gd }|dkr'| | jj d S |dkr4| jddd d S |r?| jd dd d S | jd
dd d S ) NZwelcomer errortrueabortzAuthentication abortedFis_okzresponse_mode=query is not supported for authentication responses. This application operates in response_mode=form_post mode only.z_Authentication could not be completed. You can close this window and return to the application.)r r r queryr _send_full_responseserver welcome_page)selfrL Z
welcome_paramZ error_paramr r r do_GET s
z_AuthCodeHandler.do_GETc C sd t | jdd}| j|d}t|}|ds |dr)| t| d S | j ddd d S ) NzContent-Lengthr utf-8r rY zInvalid POST requestFr\ )
intheadersr rfilereaddecoder _process_auth_responserM r_ )rb content_lengthZ post_datarL r r r do_POST s z_AuthCodeHandler.do_POSTc C s t d| | jjr | jj|dkr | jddd dS d|v r$| jjn| jj}t|j r2t
|}n|}t t |}| |j
di | || j_dS ) z:Process the auth response from either GET or POST request.zGot auth response: %sstatez>State mismatch. Waiting for next response... or you may abort.Fr\ r Nr )r6 debugr`
auth_stater r_ success_templateerror_templaterR templaterS r rT safe_substitute
auth_response)rb rt rr Z safe_dataZ filled_datar r r rj s
z'_AuthCodeHandler._process_auth_responseTc C sL | |rdnd t|rdnd}| d| | | j|d d S )N i z text/htmlz
text/plainz Content-typerd )Z
send_responserR Z send_headerZ end_headerswfilewriteencode)rb bodyr] content_typer r r r_ s
z$_AuthCodeHandler._send_full_responsec G s t j|gtt|R d S r/ )r6 rn maprW )rb formatargsr r r log_message s z _AuthCodeHandler.log_messageN)T)__name__
__module__ __qualname__rc rl rj r_ r~ r r r r rX s
rX c s$ e Zd Z fddZdd Z ZS )_AuthCodeHttpServerc sD |\}}|rt jdkst rd| _tt| j|g|R i | d S )Nwin32F)sysr( r, allow_reuse_addresssuperr __init__)rb server_addressr} kwargs_r __class__r r r s "z _AuthCodeHttpServer.__init__c C s t d)Nz"Timeout. No auth response arrived.) RuntimeErrorrb r r r handle_timeout s z"_AuthCodeHttpServer.handle_timeout)r r r r r
__classcell__r r r r r s
r c @ s e Zd ZejZdS )_AuthCodeHttpServer6N)r r r socketAF_INET6address_familyr r r r r s
r c @ sR e Zd ZdddZdd ZdddZ ddd Zd
d Zd d
Zdd Z dS )r Nc C sJ t rdnd}t|p g | _d|v rtnt}|||pdft| _d| _dS )a Create a Receiver waiting for incoming auth response.
:param port:
The local web server will listen at http://...:
You need to use the same port when you register with your app.
If your Identity Provider supports dynamic port, you can use port=0 here.
Port 0 means to use an arbitrary unused port, per this official example:
https://docs.python.org/2.7/library/socketserver.html#asynchronous-mixins
:param scheduled_actions:
For example, if the input is
``[(10, lambda: print("Got stuck during sign in? Call 800-000-0000"))]``
then the receiver would call that lambda function after
waiting the response for 10 seconds.
z0.0.0.0 127.0.0.1r r FN)r$ sorted_scheduled_actionsr r rX _server_closing)rb r Zscheduled_actionsaddressServerr r r r s
zAuthCodeReceiver.__init__c C s | j jd S )z*The port this server actually listening tor4 )r r r r r r get_port s zAuthCodeReceiver.get_portc K s i }t j| j|f|d}d|_| t }|r"t | |k rdn td | s-n7| jrXt | | jd d krX| j d\}}| | jrXt | | jd d ks=|rct | |k s#nq#|pgdS )a Wait and return the auth response. Raise RuntimeError when timeout.
:param str auth_uri:
If provided, this function will try to open a local browser.
Starting from 2026, the built-in http server will require response_mode=form_post.
:param int timeout: In seconds. None means wait indefinitely.
:param str state:
You may provide the state you used in auth_uri,
then we will use it to validate incoming response.
:param str welcome_template:
If provided, your end user will see it instead of the auth_uri.
When present, it shall be a plaintext or html template following
`Python Template string syntax `_,
and include some of these placeholders: $auth_uri and $abort_uri.
:param str success_template:
The page will be displayed when authentication was largely successful.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.1
:param str error_template:
The page will be displayed when authentication encountered error.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.2
:param callable auth_uri_callback:
A function with the shape of lambda auth_uri: ...
When a browser was unable to be launch, this function will be called,
so that the app could tell user to manually visit the auth_uri.
:param str browser_name:
If you did
``webbrowser.register("xyz", None, BackgroundBrowser("/path/to/browser"))``
beforehand, you can pass in the name "xyz" to use that browser.
The default value ``None`` means using default browser,
which is customizable by env var $BROWSER.
:return:
The auth response of the first leg of Auth Code flow,
typically {"code": "...", "state": "..."} or {"error": "...", ...}
See https://tools.ietf.org/html/rfc6749#section-4.1.2
and https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
Returns None when the state was mismatched, or when timeout occurred.
)targetr} r Tr4 r N)
threadingThread_get_auth_responsedaemonstarttimesleepis_aliver pop)rb timeoutr resulttbeginr callbackr r r r s& 6
z"AuthCodeReceiver.get_auth_responsec
C s^ dj | d}
dj |
d} td| |r,tt|j} | dd gd dks,J d t|p0d
j || d | j
_ |rt|rA|
d n|}
t d
|
d}zt
|
| d}W n td Y |st|sptdj |
|| d n||
d}t|p|d| | j
_t|pd| | j
_|| j
_i | j
_|| j
_| js| j
| j
jrn| jr|| j
j d S )Nzhttp://localhost:{p})pz{loc}?error=abort)loczAbort by visit %sZ
response_moder Z form_postziThe built-in http server supports HTTP POST only. The auth_uri must be built with response_mode=form_post )r
abort_uriz
?welcome=truez*Open a browser on this device to visit: %sF)r> z_browse(...) unsuccessfula Found no browser in current environment. If this program is being run inside a container which either (1) has access to host network (i.e. started by `docker run --net=host -it ...`), or (2) published port {port} to host network (i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), you can use browser on host to visit the following link. Otherwise, this auth attempt would either timeout (current timeout setting is {timeout}) or be aborted by CTRL+C. Auth URI: {auth_uri})r
r r z`For your security: Do not share the contents of this page, the address bar, or take screenshots.z\Authentication complete. You can return to the application. Please close this browser tab.
zBAuthentication failed. $error: $error_description. ($error_uri).
)r| r r6 rn r r r^ r r rs r ra inforA exceptionr7 rp rq r rt ro r handle_requestupdate)rb r r
r rm r rp rq Zauth_uri_callbackr> netlocr paramsZ_urir? Zrecommendationr r r r H sX
z#AuthCodeReceiver._get_auth_responsec C s d| _ | j dS )zGEither call this eventually; or use the entire class as context managerTN)r r server_closer r r r close s zAuthCodeReceiver.closec C s | S r/ r r r r r __enter__ s zAuthCodeReceiver.__enter__c C s | d S r/ )r )rb exc_typeexc_valexc_tbr r r __exit__ s zAuthCodeReceiver.__exit__)NNr/ )NNNNNNNN)
r r r r r r r r r r r r r r r s
#
F
D r __main__r4 )Client)levelz/The auth code received will be shown at stdout.)formatter_class descriptionz
--endpointz The auth endpoint for your app.z>https://login.microsoftonline.com/common/oauth2/v2.0/authorize)helpdefault client_idz!The client_id of your application)r z--portzThe port in redirect_uri)typer r z --timeout< zTimeout value, in secondz--hostr zThe host of redirect_uri)r r z--scopezThe scope listZauthorization_endpointr zhttp://{h}:{p})hr )scopeZ redirect_urir
zBSign In, or AbortzOh no. $errorzOh yeah. Got $coderm )r
r rq rp r rm )indentr/ )F__doc__ collectionsr loggingr r r stringr r r Z http.serverr r urllib.parser r r htmlr
ImportErrorBaseHTTPServerurllibZcgi getLoggerr r6 r r$ r, rA rM rR rS rW rX objectr r r argparsejsonZoauth2r basicConfigINFOArgumentParser ArgumentDefaultsHelpFormatterr parser add_argumentre
parse_argsr} Zendpointr clientr r Zinitiate_auth_code_flowr r r| hostr Zflowprintdumpsr r r r r r s
)A
B
$