
    k7i<                         S SK r S SKJr  S SKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SS	KJ
r
  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  \ R$                  " \5      r " S S\\\5      rS rg)    N)generate_token)add_params_to_uri   )AccessDeniedError)InvalidClientError)InvalidGrantError)InvalidRequestError)OAuth2Error)UnauthorizedClientError)hooked   )AuthorizationEndpointMixin)	BaseGrant)TokenEndpointMixinc                       \ rS rSrSrSS/rSrS1rSrS r	S	\
4S
 jr\S 5       r\S 5       rS rS rS rS rS rSrg)AuthorizationCodeGrant   a   The authorization code grant type is used to obtain both access
tokens and refresh tokens and is optimized for confidential clients.
Since this is a redirection-based flow, the client must be capable of
interacting with the resource owner's user-agent (typically a web
browser) and capable of receiving incoming requests (via redirection)
from the authorization server::

    +----------+
    | Resource |
    |   Owner  |
    |          |
    +----------+
         ^
         |
        (B)
    +----|-----+          Client Identifier      +---------------+
    |         -+----(A)-- & Redirection URI ---->|               |
    |  User-   |                                 | Authorization |
    |  Agent  -+----(B)-- User authenticates --->|     Server    |
    |          |                                 |               |
    |         -+----(C)-- Authorization Code ---<|               |
    +-|----|---+                                 +---------------+
      |    |                                         ^      v
     (A)  (C)                                        |      |
      |    |                                         |      |
      ^    v                                         |      |
    +---------+                                      |      |
    |         |>---(D)-- Authorization Code ---------'      |
    |  Client |          & Redirection URI                  |
    |         |                                             |
    |         |<---(E)----- Access Token -------------------'
    +---------+       (w/ Optional Refresh Token)
client_secret_basicclient_secret_post0   codeauthorization_codec                     [        U 5      $ )a  The client constructs the request URI by adding the following
parameters to the query component of the authorization endpoint URI
using the "application/x-www-form-urlencoded" format.
Per `Section 4.1.1`_.

response_type
     REQUIRED.  Value MUST be set to "code".

client_id
    REQUIRED.  The client identifier as described in Section 2.2.

redirect_uri
    OPTIONAL.  As described in Section 3.1.2.

scope
    OPTIONAL.  The scope of the access request as described by
    Section 3.3.

state
     RECOMMENDED.  An opaque value used by the client to maintain
     state between the request and callback.  The authorization
     server includes this value when redirecting the user-agent back
     to the client.  The parameter SHOULD be used for preventing
     cross-site request forgery as described in Section 10.12.

The client directs the resource owner to the constructed URI using an
HTTP redirection response, or by other means available to it via the
user-agent.

For example, the client directs the user-agent to make the following
HTTP request using TLS (with extra line breaks for display purposes
only):

.. code-block:: http

    GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz
    &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1
    Host: server.example.com

The authorization server validates the request to ensure that all
required parameters are present and valid.  If the request is valid,
the authorization server authenticates the resource owner and obtains
an authorization decision (by asking the resource owner or by
establishing approval via other means).

.. _`Section 4.1.1`: https://tools.ietf.org/html/rfc6749#section-4.1.1
)#validate_code_authorization_requestselfs    j/home/james-whalen/.local/lib/python3.13/site-packages/authlib/oauth2/rfc6749/grants/authorization_code.pyvalidate_authorization_request5AuthorizationCodeGrant.validate_authorization_request@   s    ` 3488    redirect_uric                 x   U(       d	  [        US9eX R                  l        U R                  5       nU R	                  X0R                  5        SU4/nU R                  R
                  R                  (       a1  UR                  SU R                  R
                  R                  45        [        X5      nSU4/nSSU4$ )a/  If the resource owner grants the access request, the authorization
server issues an authorization code and delivers it to the client by
adding the following parameters to the query component of the
redirection URI using the "application/x-www-form-urlencoded" format.
Per `Section 4.1.2`_.

code
    REQUIRED.  The authorization code generated by the
    authorization server. The authorization code MUST expire
    shortly after it is issued to mitigate the risk of leaks. A
    maximum authorization code lifetime of 10 minutes is
    RECOMMENDED. The client MUST NOT use the authorization code
    more than once. If an authorization code is used more than
    once, the authorization server MUST deny the request and SHOULD
    revoke (when possible) all tokens previously issued based on
    that authorization code.  The authorization code is bound to
    the client identifier and redirection URI.
state
    REQUIRED if the "state" parameter was present in the client
    authorization request.  The exact value received from the
    client.

For example, the authorization server redirects the user-agent by
sending the following HTTP response.

.. code-block:: http

    HTTP/1.1 302 Found
    Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
           &state=xyz

.. _`Section 4.1.2`: https://tools.ietf.org/html/rfc6749#section-4.1.2

:param redirect_uri: Redirect to the given URI for the authorization
:param grant_user: if resource owner granted the request, pass this
    resource owner, otherwise pass None.
:returns: (status_code, body, headers)
r!   r   stateLocationi.   )	r   requestusergenerate_authorization_codesave_authorization_codepayloadr$   appendr   )r   r!   
grant_userr   paramsuriheaderss          r   create_authorization_response4AuthorizationCodeGrant.create_authorization_responser   s    N #>>&//1$$T<<84.!<<%%MM7DLL$8$8$>$>?@5$%Br    c                 h   U R                  5       n[        R                  SU5        UR                  U R                  5      (       d  [        SU R                   S35      eU R                  R                  R                  S5      nUc  [        S5      eU R                  X!5      nU(       d  [        S5      e[        R                  SU5        U R                  R                  R                  nUR                  5       nU(       a  XE:w  a  [        S	5      eXR                  l        X0R                  l        g)
a  The client makes a request to the token endpoint by sending the
following parameters using the "application/x-www-form-urlencoded"
format per `Section 4.1.3`_:

grant_type
     REQUIRED.  Value MUST be set to "authorization_code".

code
     REQUIRED.  The authorization code received from the
     authorization server.

redirect_uri
     REQUIRED, if the "redirect_uri" parameter was included in the
     authorization request as described in Section 4.1.1, and their
     values MUST be identical.

client_id
     REQUIRED, if the client is not authenticating with the
     authorization server as described in Section 3.2.1.

If the client type is confidential or the client was issued client
credentials (or assigned other authentication requirements), the
client MUST authenticate with the authorization server as described
in Section 3.2.1.

For example, the client makes the following HTTP request using TLS:

.. code-block:: http

    POST /token HTTP/1.1
    Host: server.example.com
    Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
    Content-Type: application/x-www-form-urlencoded

    grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA
    &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb

.. _`Section 4.1.3`: https://tools.ietf.org/html/rfc6749#section-4.1.3
zValidate token request of %rz0The client is not authorized to use 'grant_type='r   NzMissing 'code' in request.zInvalid 'code' in request.z!Validate token redirect_uri of %rz"Invalid 'redirect_uri' in request.)"authenticate_token_endpoint_clientlogdebugcheck_grant_type
GRANT_TYPEr   r'   formgetr	   query_authorization_coder   r+   r!   get_redirect_uriclientr   )r   r>   r   r   r!   original_redirect_uris         r   validate_token_request-AuthorizationCodeGrant.validate_token_request   s   Z 88:		0&9&&t77)B4??BSSTU  ||  $$V,<%&BCC
 "::4H!#$@AA 			5v>||++88 2 C C E \%J#$HII %*<'r    c                    U R                   R                  nU R                   R                  nU R                  U5      nU(       d  [	        S5      eX0R                   l        UR                  5       nU R                  UUUR                  S5      S9n[        R                  SXQ5        U R                  U5        U R                  U5        SXPR                  4$ )a&  If the access token request is valid and authorized, the
authorization server issues an access token and optional refresh
token as described in Section 5.1.  If the request client
authentication failed or is invalid, the authorization server returns
an error response as described in Section 5.2. Per `Section 4.1.4`_.

An example successful response:

.. code-block:: http

    HTTP/1.1 200 OK
    Content-Type: application/json
    Cache-Control: no-store
    Pragma: no-cache

    {
        "access_token":"2YotnFZFEjr1zCsicMWpAA",
        "token_type":"example",
        "expires_in":3600,
        "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
        "example_parameter":"example_value"
    }

:returns: (status_code, body, headers)

.. _`Section 4.1.4`: https://tools.ietf.org/html/rfc6749#section-4.1.4
z!There is no 'user' for this code.refresh_token)r(   scopeinclude_refresh_tokenzIssue token %r to %r   )r'   r>   r   authenticate_userr   r(   	get_scoper   r8   r6   r7   
save_tokendelete_authorization_codeTOKEN_RESPONSE_HEADER)r   r>   r   r(   rD   tokens         r   create_token_response,AuthorizationCodeGrant.create_token_response   s    : $$!\\<<%%&89#$GHH ",,.##"("9"9/"J $ 

 			(%8&&'9:E5555r    c                 ,    [        U R                  5      $ )z"The method to generate "code" value for authorization code data.
Developers may rewrite this method, or customize the code length with::

    class MyAuthorizationCodeGrant(AuthorizationCodeGrant):
        AUTHORIZATION_CODE_LENGTH = 32  # default is 48
)r   AUTHORIZATION_CODE_LENGTHr   s    r   r)   2AuthorizationCodeGrant.generate_authorization_code$  s     d<<==r    c                     [        5       e)a  Save authorization_code for later use. Developers MUST implement
it in subclass. Here is an example::

    def save_authorization_code(self, code, request):
        client = request.client
        item = AuthorizationCode(
            code=code,
            client_id=client.client_id,
            redirect_uri=request.payload.redirect_uri,
            scope=request.payload.scope,
            user_id=request.user.id,
        )
        item.save()
NotImplementedError)r   r   r'   s      r   r*   .AuthorizationCodeGrant.save_authorization_code-  s     "##r    c                     [        5       e)aT  Get authorization_code from previously savings. Developers MUST
implement it in subclass::

    def query_authorization_code(self, code, client):
        return Authorization.get(code=code, client_id=client.client_id)

:param code: a string represent the code.
:param client: client related to this code.
:return: authorization_code object
rS   )r   r   r>   s      r   r<   /AuthorizationCodeGrant.query_authorization_code>  s     "##r    c                     [        5       e)a  Delete authorization code from database or cache. Developers MUST
implement it in subclass, e.g.::

    def delete_authorization_code(self, authorization_code):
        authorization_code.delete()

:param authorization_code: the instance of authorization_code
rS   r   r   s     r   rJ   0AuthorizationCodeGrant.delete_authorization_codeK  s     "##r    c                     [        5       e)a!  Authenticate the user related to this authorization_code. Developers
MUST implement this method in subclass, e.g.::

    def authenticate_user(self, authorization_code):
        return User.get(authorization_code.user_id)

:param authorization_code: AuthorizationCode object
:return: user
rS   rY   s     r   rG   (AuthorizationCodeGrant.authenticate_userV  s     "##r     N)__name__
__module____qualname____firstlineno____doc__TOKEN_ENDPOINT_AUTH_METHODSrP   RESPONSE_TYPESr9   r   strr1   r   r@   rM   r)   r*   r<   rJ   rG   __static_attributes__r]   r    r   r   r      s     F $9:N"O !#XN%J09d4 # 4 l H= H=T .6 .6`>$"$	$
$r    r   c                    U R                   nUR                  R                  n[        R	                  SU5        Uc	  [        SS9eU R                  R                  U5      nU(       d	  [        SS9eU R                  X5      nUR                  R                  nUR                  U5      (       d  [        SU S3US9eX0R                   l        [        S 5       n U" X5        U$ ! [         a  nXGl        UeS nAff = f)	Nz$Validate authorization request of %rzMissing 'client_id' parameter.)descriptionz)The client does not exist on this server.z3The client is not authorized to use 'response_type=r4   r#   c                 $    U R                  5         g )N)validate_requested_scope)grantr!   s     r   &validate_authorization_request_payloadSvalidate_code_authorization_request.<locals>.validate_authorization_request_payload}  s    &&(r    )r'   r+   	client_idr6   r7   r   serverquery_client#validate_authorization_redirect_uriresponse_typecheck_response_typer   r>   r   r
   r!   )rk   r'   rn   r>   r!   rr   rl   errors           r   r   r   c  s   mmG))III4i@ 8
 	
 \\&&y1F C
 	
 <<WMLOO11M%%m44%A-PQR%
 	

 "MM) ).uC   )s   C" "
C9,C44C9)loggingauthlib.common.securityr   authlib.common.urlsr   errorsr   r   r   r	   r
   r   hooksr   baser   r   r   	getLoggerr^   r6   r   r   r]   r    r   <module>r|      sV     2 1 & ' & (   ,  ,  $!L$Y(BDV L$^
#r    