9iJ d Z ddlZddlZddlZddlZddlmZ ddlZddlZ ddl m
Z
m Z ddl m
Z
mZmZ ddlmZ ej, e Zd?d Zd
Zd Zd?d Z d
Z d Z d Z d Z G d de Z! G d de
e" Z# G d de# Z$ G d de" Z%edk( rddl&Z&ddl'Z'ddl(m)Z) ejT ejV e&jX e&jZ e d z xZ.Z/e.ja d d d!" e.ja d#d$% e.ja d&e1dd'( e.ja d)e1d*d+( e.ja d,d-d./ e.ja d0dd1/ e/je Z3 e)d2e3jh ie3jj Z6 e%e3jn 3 5 Z8e6js e3jt re3jt jw ndd4jy e3jz e8j} 5 6 Z? e@ e'j e8j e?d7 d8d9d:e3j e?d; < d=> ddd yy# e$ r ddlm
Z
m Z ddl
m
Z
mZ ddlmZ ddlmZ Y 8w xY w# 1 sw Y yxY w)@a$ A one-stop helper for desktop app to acquire an authorization code.
It starts a web server to listen redirect_uri, waiting for auth code.
It optionally opens a browser window to guide a human user to manually login.
After obtaining an auth code, the web server will automatically shut down.
N)Template)
HTTPServerBaseHTTPRequestHandler)urlparseparse_qs urlencode)escape)r r )r c t | 5 }|j |d j d cd d d S # 1 sw Y y xY w)Nportz
Open this link to Sign In
(You may want to use incognito window)
Abort
)auth_uriwelcome_templatecode)AuthCodeReceiverget_auth_responseget) listen_portr
receivers J/var/www/html/venv/lib/python3.12/site-packages/msal/oauth2cli/authcode.pyobtain_auth_coder sG { + x)) " * c&k s "9Ac L t d 5 } | j D ]B }|j dd d j }|j dk7 s: d d d y d d d t
j j d S # 1 sw Y (xY w# t $ r Y 6w xY w)Nz/proc/1/cgroup: /Tz /.dockerenv)open readlinessplitstripIOErrorospathexists)fline cgroup_paths r _is_inside_dockerr& * s
"
# q
"jja 0 3 9 9 ; $$&#-
77>>- ((
s; B A
B B B "B $B BB B#"B#c dd l } | j }t |d|d j }t |d|d j }|dk( xr d|v S )Nr systemreleaser linux microsoft)platformunamegetattrlower)r, r-
platform_namer) s r is_wslr1 8 s^
NN EE8U1X6<<>MeYa1779G G # > w(>> c ddl }|r!|j | j | }n|j | }|s:t r0 ddl}|j ddddj
| g }|dk( }|S |S # t $ r Y |S w xY w)zJBrowse uri with named browser. Default browser is customizable by $BROWSERr Nzpowershell.exez
-NoProfilez-CommandzStart-Process "{}")
webbrowserr r r1
subprocesscallformatFileNotFoundError)r
browser_namer4 browser_openedr5 exit_codes r _browser< D s # 5::8D $ 2 fh #!<=Q=X=XYa=bceI &!^N > ! s -A7 7 BBc | j D ci c]+ \ }}|t |t rt | dk( r|d n|- c}}S c c}}w )z;Flatten parse_qs()'s single-item lists into the item itself r )items
isinstancelistlen)qskvs r _qs2kvrF [ sL HHJ Aq
z!T*s1v{qt A s 0Ac $ | j d S )N<)
startswithtexts r _is_htmlrL a s ??3 r2 c h | j D ci c] \ }}|t | c}}S c c}}w N)r? r )key_value_pairsrD rE s r _escaperP e s+ %4%:%:%< =TQAvayL == =s .c \ t | t r| j s t | S | S rN )r@ str isprintablereprrJ s r _printifyrU i s% #D#.t7G7G7I4:StSr2 c e Zd Zd ZddZd Zy)_AuthCodeHandlerc t t | j j }|j d s|j d rt | }t j d| | j j r:| j j |j d k7 r| j d y d|v r| j j n| j j }t |j r t | }n|}| j |j di | || j _ y | j | j j$ y )Nr errorzGot auth response: %sstatezState mismatch )r r r! queryr rF loggerdebugserver
auth_state_send_full_responsesuccess_templateerror_templaterL templaterP safe_substitute
auth_response welcome_page)selfrC rf rd safe_datas r do_GETz_AuthCodeHandler.do_GETo s htyy)//
0
66&>RVVG_ "2JM LL0- @{{%%$++*@*@MDUDUV]D^*^ (()9: | !KK 8 8)-)C)C H - -. '
6I -I(()A)A)A)NI)NO,9 ) $ $T[[%=%= >r2 c | j |rdnd t | rdnd}| j d| | j | j j |j
d y )N i z text/htmlz
text/plainz Content-typezutf-8)
send_responserL send_header end_headerswfilewriteencode)rh bodyis_ok content_types r ra z$_AuthCodeHandler._send_full_response sX %3S1&.tn{, 6
W-.r2 c L t j |gt t | y rN )r] r^ maprU )rh r7 argss r log_messagez _AuthCodeHandler.log_message s V3c)T 23r2 N)T)__name__
__module__ __qualname__rj ra ry r[ r2 r rW rW n s ?0/4r2 rW c $ e Zd Z fdZd Z xZS )_AuthCodeHttpServerc |\ }}|r$t j dk( s
t rd| _ t t
| |g|i | y )Nwin32F)sysr, r1 allow_reuse_addresssuperr~ __init__)rh server_addressrx kwargs_r __class__s r r z _AuthCodeHttpServer.__init__ sB 4 S\\W,
(-D $
!41.R4R6Rr2 c t d )Nz"Timeout. No auth response arrived.) RuntimeErrorrh s r handle_timeoutz"_AuthCodeHttpServer.handle_timeout s ?@@r2 )rz r{ r| r r
__classcell__)r s @r r~ r~ s SAr2 r~ c $ e Zd Zej Zy)_AuthCodeHttpServer6N)rz r{ r| socketAF_INET6address_familyr[ r2 r r r s __Nr2 r c D e Zd Zd dZd Zd
dZ d dZd Zd Zd Z y) r Nc t rdnd}t |xs g | _ d|v rt nt } |||xs dft
| _ d| _ y)a Create a Receiver waiting for incoming auth response.
:param port:
The local web server will listen at http://...:
You need to use the same port when you register with your app.
If your Identity Provider supports dynamic port, you can use port=0 here.
Port 0 means to use an arbitrary unused port, per this official example:
https://docs.python.org/2.7/library/socketserver.html#asynchronous-mixins
:param scheduled_actions:
For example, if the input is
``[(10, lambda: print("Got stuck during sign in? Call 800-000-0000"))]``
then the receiver would call that lambda function after
waiting the response for 10 seconds.
z0.0.0.0 127.0.0.1r r FN)r& sorted_scheduled_actionsr r~ rW _server_closing)rh r scheduled_actionsaddressServers r r zAuthCodeReceiver.__init__ sU 1 2) #)):)@b"A ), %=P w 24DE
r2 c 4 | j j d S )z*The port this server actually listening tor> )r r r s r get_portzAuthCodeReceiver.get_port s ||**1--r2 c i }t j | j |f| }d|_ |j t j
}|rt j
|z
|k rn t j d |j sn| j rt j
|z
| j d d kD r\| j j d \ }} | | j r+t j
|z
| j d d kD r\|r t j
|z
|k rn|xs dS )a Wait and return the auth response. Raise RuntimeError when timeout.
:param str auth_uri:
If provided, this function will try to open a local browser.
:param int timeout: In seconds. None means wait indefinitely.
:param str state:
You may provide the state you used in auth_uri,
then we will use it to validate incoming response.
:param str welcome_template:
If provided, your end user will see it instead of the auth_uri.
When present, it shall be a plaintext or html template following
`Python Template string syntax `_,
and include some of these placeholders: $auth_uri and $abort_uri.
:param str success_template:
The page will be displayed when authentication was largely successful.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.1
:param str error_template:
The page will be displayed when authentication encountered error.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.2
:param callable auth_uri_callback:
A function with the shape of lambda auth_uri: ...
When a browser was unable to be launch, this function will be called,
so that the app could tell user to manually visit the auth_uri.
:param str browser_name:
If you did
``webbrowser.register("xyz", None, BackgroundBrowser("/path/to/browser"))``
beforehand, you can pass in the name "xyz" to use that browser.
The default value ``None`` means using default browser,
which is customizable by env var $BROWSER.
:return:
The auth response of the first leg of Auth Code flow,
typically {"code": "...", "state": "..."} or {"error": "...", ...}
See https://tools.ietf.org/html/rfc6749#section-4.1.2
and https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
Returns None when the state was mismatched, or when timeout occurred.
)targetrx r Tr> r N)
threadingThread_get_auth_responsedaemonstarttimesleepis_aliver pop)rh timeoutr resulttbeginr callbacks r r z"AuthCodeReceiver.get_auth_response s j **&6
K 18tyy{U"W,d JJqM::<** e+d.E.Ea.H.KK " 5 5 9 9! < 8
** e+d.E.Ea.H.KK 29tyy{U"W,d ~ r2 c
dj | j }
dj |
} t j d| t |xs d j || | j _ |rp|r|
n|} t j d| z d }
t | |
}
|
s@|s6t j d j | || j
n || t |xs d | j _ t |xs d | j _
|| j _ i | j _ || j _ | j" s>| j j% | j j rn
| j" s>|j' | j j y # t j d Y ;xY w)Nzhttp://localhost:{p})pz{loc}?error=abort)loczAbort by visit %s )r
abort_uriz*Open a browser on this device to visit: %sF)r9 z_browse(...) unsuccessfula Found no browser in current environment. If this program is being run inside a container which either (1) has access to host network (i.e. started by `docker run --net=host -it ...`), or (2) published port {port} to host network (i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), you can use browser on host to visit the following link. Otherwise, this auth attempt would either timeout (current timeout setting is {timeout}) or be aborted by CTRL+C. Auth URI: {auth_uri})r
r r z8Authentication completed. You can close this window now.z?Authentication failed. $error: $error_description. ($error_uri))r7 r r] r^ r re r rg infor< exceptionwarningrb rc r rf r` r handle_requestupdate)rh r r
r rZ r rb rc auth_uri_callbackr9 welcome_urir _urir: s r r z#AuthCodeReceiver._get_auth_response s
-33dmmo3F '..;.? ()4$,-=-C$D$T$T %U %4 ! "2;D KKDtK L "N
>!(L!I
"(NN H IO%)7 IO IR S &d+(01A 2G F)H %&.~ 0N M'O # ' %' ""' --
LL ' ' )||))
--
dll001I
> !<=s
G G#c F d| _ | j j y)zGEither call this eventually; or use the entire class as context managerTN)r r server_closer s r closezAuthCodeReceiver.closeP s
!!#r2 c | S rN r[ r s r __enter__zAuthCodeReceiver.__enter__U s r2 c $ | j y rN )r )rh exc_typeexc_valexc_tbs r __exit__zAuthCodeReceiver.__exit__X s
r2 )NNrN )NNNNNNNN)
rz r{ r| r r r r r r r r[ r2 r r r s9 ! F.
C J MQIM " 42l$
r2 r __main__r> )Client)levelz/The auth code received will be shown at stdout.)formatter_class descriptionz
--endpointz The auth endpoint for your app.z>https://login.microsoftonline.com/common/oauth2/v2.0/authorize)helpdefault client_idz!The client_id of your application)r z--portzThe port in redirect_uri)typer r z --timeout< zTimeout value, in secondz--hostr zThe host of redirect_uri)r r z--scopezThe scope listauthorization_endpointr zhttp://{h}:{p})hr )scope redirect_urir
zASign In, or AbortOh no. $error