
    ^h/                         S r SSKrSSKrSSKrSSKJr  SSKJr  SSKJ	r	  SSK
Jr  SS	KJrJr   " S
 S\	5      r " S S\5      r\rg)z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler   )allow_unauthenticated)passwd_checkset_passwordc                   L    \ rS rSrSrS	S jrS	S jr\S 5       r\S 5       r	Sr
g)
LoginFormHandler   zdThe basic tornado login handler

accepts login form, passed to IdentityProvider.process_login_form.
Nc                     U R                  U R                  S[        U R                  SU R                  S95      US95        g)zRender the login form.z
login.htmlnextdefault)r   messageN)writerender_templater   get_argumentbase_url)selfr   s     S/home/james-whalen/.local/lib/python3.13/site-packages/jupyter_server/auth/login.py_renderLoginFormHandler._render   sC    

   1 1&$-- 1 PQ ! 	
    c                     Uc  U R                   nUR                  SS5      nSU;   a*  UR                  S5      u  p4nU SUR                  S5       3n[	        U5      nUR
                  (       d>  UR                  (       d-  UR                  S-   R                  U R                   5      (       d  SnUR
                  (       d  UR                  (       a  UR
                   SUR                   3nUR                  5       nU R                  (       a  U R                  U:H  nO;U R                  (       a*  [        [        R                  " U R                  U5      5      nU(       d   U R                  R!                  SU-  5        UnU R#                  U5        g)	zRedirect if url is on our PATH

Full-domain redirects are allowed if they pass our CORS origin checks.

Otherwise use default (self.base_url if unspecified).
N\z%5C:z:///Fz!Not allowing login redirect to %r)r   replace	partitionlstripr   schemenetlocpath
startswithlowerallow_originallow_origin_patboolrematchlogwarningredirect)	r   urlr   r#   _restparsedalloworigins	            r   _redirect_safeLoginFormHandler._redirect_safe!   s/    ?mmG kk$& #:!mmC0OFtHCC 012C# MMV]]FKK#4E3Q3QRVR_R_3`3`E}}"MM?#fmm_=$$ --7E** $*?*?!HIE  !Ds!JKcr   c                     U R                   (       a,  U R                  SU R                  S9nU R                  U5        gU R	                  5         g)zGet the login form.r   r   N)current_userr   r   r6   r   )r   next_urls     r   getLoginFormHandler.getN   s=     (((GH)LLNr   c                 p   U R                   R                  U 5      =ol        Uc#  U R                  S5        U R	                  SS0S9  gU R
                  R                  SUR                   S35        U R                   R                  X5        U R                  SU R                  S	9nU R                  U5        g)
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r   r   )identity_providerprocess_login_formr9   
set_statusr   r-   infousernameset_login_cookier   r   r6   )r   userr:   s      r   postLoginFormHandler.postW   s     $(#9#9#L#LT#RR <OOC LL'+@!ALBdmm_K89//;$$VT]]$CH%r   )r9   N)__name__
__module____qualname____firstlineno____doc__r   r6   r   r;   rI   __static_attributes__ r   r   r   r      s:    

+Z   & &r   r   c                       \ rS rSrSr\S 5       rS r\S 5       r	\
SS j5       r\R                  " S\R                  5      r\
S	 5       r\
S
 5       r\
S 5       r\
S 5       r\
S 5       r\
S 5       r\
SS j5       r\
S 5       r\
S 5       rSrg)LegacyLoginHandlerf   zLegacy LoginHandler, implementing most custom auth configuration.

Deprecated in jupyter-server 2.0.
Login configuration has moved to IdentityProvider.
c                 8    U R                  U R                  5      $ rK   )password_from_settingssettings)r   s    r   hashed_password"LegacyLoginHandler.hashed_passwordm   s    **4==99r   c                     [        X5      $ )zCheck a passwd.)r	   )r   abs      r   r	   LegacyLoginHandler.passwd_checkq   s    A!!r   c                    U R                  SSS9nU R                  SSS9nU R                  U R                  5      (       Ga  U R                  U R                  U5      (       a8  U(       d1  U R                  U [        R                  " 5       R                  5        GO3U R                  (       a  U R                  U:X  a  U R                  U [        R                  " 5       R                  5        U(       a  [        U R                  SS5      (       a  U R                  R                  SS5      n[        R                  R                  US5      n[!        U R                  S	5      (       a'  [#        X$S
9=U R                  l        U R                  S'   U R$                  R'                  SU-  5        O#U R)                  S5        U R+                  SS0S9  gU R                  SU R,                  S9nU R/                  U5        g)zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.jsonrY   )config_filezWrote hashed password to %sr>   r?   r@   rA   Nr   )r   get_login_availablerX   r	   rY   rG   uuiduuid4hextokengetattrrB   r;   osr%   joinhasattrr
   r-   rE   rD   r   r   r6   )r   typed_passwordrb   rd   re   r:   s         r   rI   LegacyLoginHandler.postu   s    **:r*B(((D##DMM22  !5!5~FF|%%dDJJL,<,<=

n <%%dDJJL,<,<=GD,B,BD[]b$c$c!%!2!2<!DJ"$'',,z;W"XKt557HII(O..>zAZ HHMM"?+"MN$g/D%EF$$VT]]$CH%r   Nc                 j   UR                   R                  S0 5      nUR                  SS5        UR                   R                  SUR                  R                  S:H  5      (       a  UR                  SS5        UR                  SUR
                  5        UR                  " UR                  U40 UD6  U$ )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer%   )rX   r;   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idrr   s       r   rG   #LegacyLoginHandler.set_login_cookie   s     !))--.>C!!*d3 1I1IW1TUU%%h5!!&'*:*:;!!'"5"5wQ.Qr   ztoken\s+(.+)c                     UR                  SS5      nU(       dW  U R                  R                  UR                  R                  R                  SS5      5      nU(       a  UR                  S5      nU$ )z{Get the user token from a request

Default:

- in URL parameters: ?token=<token>
- in header: Authorization: token <token>
rj   ra   Authorizationr   )r   auth_header_patr,   rx   headersr;   group)r|   r}   
user_tokenms       r   	get_tokenLegacyLoginHandler.get_token   s]     ))'26
##))'//*A*A*E*EoWY*Z[AWWQZ
r   c                 .    U R                  U5      (       + $ )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedr|   r}   s     r   should_check_origin&LegacyLoginHandler.should_check_origin   s     --g666r   c                 P    [        USS5      c  UR                    [        USS5      $ )r   _user_idN_token_authenticatedF)rk   r9   r   s     r   r   )LegacyLoginHandler.is_token_authenticated   s,     7J-5  w 6>>r   c                    [        USS5      (       a  UR                  $ U R                  U5      nU R                  U5      nU=(       d    UnU(       a  XC:w  a  U R	                  X5        SUl        Uce  UR                  UR                  5      b6  UR                  R                  SUR                  5        UR                  5         UR                  (       d  SnXAl        U$ )r   r   NTz(Clearing invalid/expired login cookie %s	anonymous)rk   r   get_user_tokenget_user_cookierG   r   
get_cookier{   r-   r.   clear_login_cookielogin_available)r|   r}   token_user_idcookie_user_idr~   s        r   get_userLegacyLoginHandler.get_user   s    
 7J--###**73,,W5  1> ($$W6 ,0G(? !!'"5"56B##$NPWPcPcd**,** & #r   c                     UR                   R                  S0 5      nUR                  " UR                  40 UD6nU(       a  UR	                  5       nU$ )r   get_secure_cookie_kwargs)rX   r;   get_secure_cookier{   decode)r|   r}   r   r~   s       r   r   "LegacyLoginHandler.get_user_cookie   sO     $+#3#3#7#78RTV#W ++G,?,?\C[\nn&Gr   c                 t   UR                   nU(       d  gU R                  U5      nSnX2:X  a2  UR                  R                  SUR                  R
                  5        SnU(       aS  U R                  U5      nUc=  [        R                  " 5       R                  nUR                  R                  SU 35        U$ g)r   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )rj   r   r-   debugrx   	remote_ipr   rg   rh   ri   rE   )r|   r}   rj   r   authenticatedr~   s         r   r   !LegacyLoginHandler.get_user_token   s     ]]7+
KKB)) !M ))'2G**,**  NwiX Nr   c                 p   UR                   (       df  SnUc  UR                  R                  U S35        UR                  (       d1  UR                  (       d  UR                  R                  U S35        gggUR                  (       d.  UR                  (       d  UR                  R                  S5        ggg)r   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr-   r.   r`   rj   )r|   appssl_optionsr.   s       r   validate_security$LegacyLoginHandler.validate_security  s     vvTG"7)+^ _`<<		i  C C )2<
 ciiGGOOT '0r   c                 &    UR                  SS5      $ )r   r`   ra   )r;   r|   rX   s     r   rW   )LegacyLoginHandler.password_from_settings  s     ||J++r   c                 f    [        U R                  U5      =(       d    UR                  S5      5      $ )r   rj   )r*   rW   r;   r   s     r   rf   &LegacyLoginHandler.get_login_available#  s(     C..x8QHLL<QRRr   rR   rK   )rL   rM   rN   rO   rP   propertyrY   r	   r   rI   classmethodrG   r+   compile
IGNORECASEr   r   r   r   r   r   r   r   rW   rf   rQ   rR   r   r   rT   rT   f   s    : :" & &4 
 
 jj"--@O " 7 7 ? ? " "H    >  " , , S Sr   rT   )rP   rl   r+   rg   urllib.parser   tornado.escaper   base.handlersr   	decoratorr   securityr	   r
   r   rT   LoginHandlerrR   r   r   <module>r      sJ    ; 
 	  ! % * , 0R&~ R&jAS) ASJ "r   