qhhSrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK J r SSK J r J r SSKJrJrJr SSKJr SrS rS rS S 0r"S S5rg)z oauthlib.oauth2.rfc6749 ~~~~~~~~~~~~~~~~~~~~~~~ This module is an implementation of various logic needed for consuming OAuth 2.0 RFC6749. N)generate_token)tokens)InsecureTransportErrorTokenExpiredError)parse_token_responseprepare_token_request prepare_token_revocation_request)is_secure_transport auth_headerquerybodyz Content-Typez!application/x-www-form-urlencodedc\rSrSrSrSr\SSSSSSSSS\SSS4Sjr\ S5r Sr S r S r SS jrSS jrSSjrSSjrSSjrS SjrS!SjrSSjrSrS SjrS SS\S4SjrSrSrSrSrg)"Client$amBase OAuth2 client responsible for access token management. This class also acts as a generic interface providing methods common to all client types such as ``prepare_authorization_request`` and ``prepare_token_revocation_request``. The ``prepare_x_request`` methods are the recommended way of interacting with clients (as opposed to the abstract prepare uri/body/etc methods). They are recommended over the older set because they are easier to use (more consistent) and add a few additional security checks, such as HTTPS and state checking. Some of these methods require further implementation only provided by the specific purpose clients such as :py:class:`oauthlib.oauth2.MobileApplicationClient` and thus you should always seek to use the client class matching the OAuth workflow you need. For Python, this is usually :py:class:`oauthlib.oauth2.WebApplicationClient`. refresh_tokenBearerNc ,XlX lX0lX@lXPlX`lXplU=(d 0UlXlXl Xl Xl Xl Xl XlSUlSUlSUlUR%UR5 g)amInitialize a client with commonly used attributes. :param client_id: Client identifier given by the OAuth provider upon registration. :param default_token_placement: Tokens can be supplied in the Authorization header (default), the URL query component (``query``) or the request body (``body``). :param token_type: OAuth 2 token type. Defaults to Bearer. Change this if you specify the ``access_token`` parameter and know it is of a different token type, such as a MAC, JWT or SAML token. Can also be supplied as ``token_type`` inside the ``token`` dict parameter. :param access_token: An access token (string) used to authenticate requests to protected resources. Can also be supplied inside the ``token`` dict parameter. :param refresh_token: A refresh token (string) used to refresh expired tokens. Can also be supplied inside the ``token`` dict parameter. :param mac_key: Encryption key used with MAC tokens. :param mac_algorithm: Hashing algorithm for MAC tokens. :param token: A dict of token attributes such as ``access_token``, ``token_type`` and ``expires_at``. :param scope: A list of default scopes to request authorization for. :param state: A CSRF protection string used during authorization. :param redirect_url: The redirection endpoint on the client side to which the user returns after authorization. :param state_generator: A no argument state generation callable. Defaults to :py:meth:`oauthlib.common.generate_token`. :param code_verifier: PKCE parameter. A cryptographically random string that is used to correlate the authorization request to the token request. :param code_challenge: PKCE parameter. A challenge derived from the code verifier that is sent in the authorization request, to be verified against later. :param code_challenge_method: PKCE parameter. A method that was used to derive code challenge. Defaults to "plain" if not present in the request. N) client_iddefault_token_placement token_type access_tokenrmac_key mac_algorithmtokenscopestate_generatorstate redirect_url code_verifiercode_challengecode_challenge_methodcode expires_in _expires_atpopulate_token_attributes)selfrrrrrrrrrrrrrr r!kwargss V/var/www/html/env/lib/python3.13/site-packages/oauthlib/oauth2/rfc6749/clients/base.py__init__Client.__init__8s@#'>$$(* *[b  . (*,%:"  &&tzz2c4URURS.$)a'Supported token types and their respective methods Additional tokens can be supported by extending this dictionary. The Bearer token spec is stable and safe to use. The MAC token spec is not yet stable and support for MAC tokens is experimental and currently matching version 00 of the spec. )rMAC)_add_bearer_token_add_mac_token)r&s r( token_typesClient.token_typess ,,&&  r+c[S5e)z,Abstract method used to create request URIs.*Must be implemented by inheriting classes.NotImplementedErrorr&argsr's r(prepare_request_uriClient.prepare_request_uri!"NOOr+c[S5e)z.Abstract method used to create request bodies.r3r4r6s r(prepare_request_bodyClient.prepare_request_bodyr:r+c[S5e)z4Abstract method used to parse redirection responses.r3r4r6s r(parse_request_uri_response!Client.parse_request_uri_responser:r+GETc [U5(d [5eU=(d URnURR 5VVs0sHupxUR 5U_M n nnUR R 5U ;a[SUR -5eUR(d+URRS5(d [S5eUR(a-UR[R"5:a [5eXR R 5"XUXE40UD6$s snnf)aAdd token to the request uri, body or authorization header. The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type. For example, the "bearer" token type defined in [`I-D.ietf-oauth-v2-bearer`_] is utilized by simply including the access token string in the request: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: Bearer mF_9.B5f-4.1JqM while the "mac" token type defined in [`I-D.ietf-oauth-v2-http-mac`_] is utilized by issuing a MAC key together with the access token which is used to sign certain components of the HTTP requests: .. code-block:: http GET /resource/1 HTTP/1.1 Host: example.com Authorization: MAC id="h480djs93hd8", nonce="274312:dj83hs9s", mac="kDZvddkndxvhGRXZhvuDjEWhGeE=" .. _`I-D.ietf-oauth-v2-bearer`: https://tools.ietf.org/html/rfc6749#section-12.2 .. _`I-D.ietf-oauth-v2-http-mac`: https://tools.ietf.org/html/rfc6749#section-12.2 zUnsupported token type: %srzMissing access token.)r rrr0itemslowerr ValueErrorrrgetr$timer) r&uri http_methodr headerstoken_placementr'kvcase_insensitive_token_typess r( add_tokenClient.add_tokensF#3''(* *)IT-I-I&*%5%5%;%;%=(?%=TQAGGIqL%= %(?$$&*FF9DOOKL L!!TZZ^^N%C%C45 5    0 0499; >#% %+OO,A,A,CDSW[ELiagi i(?s Ec .[U5(d [5eU=(d UR5UlU=(d URUlUc UR OUnUR "U4URX@RS.UD6nU[S4$)aPrepare the authorization request. This is the first step in many OAuth flows in which the user is redirected to a certain authorization URL. This method adds required parameters to the authorization URL. :param authorization_url: Provider authorization endpoint URL. :param state: CSRF protection string. Will be automatically created if not provided. The generated state is available via the ``state`` attribute. Clients should verify that the state is unchanged and present in the authorization response. This verification is done automatically if using the ``authorization_response`` parameter with ``prepare_token_request``. :param redirect_url: Redirect URL to which the user will be returned after authorization. Must be provided unless previously setup with the provider. If provided then it must also be provided in the token request. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). ) redirect_urirr)r rrrrrr8FORM_ENC_HEADERS)r&authorization_urlrrrr'auth_urls r(prepare_authorization_request$Client.prepare_authorization_requests4##455(* *4d224 (=D,=,=#m ++ 5,0,=,=zz5-35)2--r+c [U5(d [5eU=(d URnU(aURX$S9 U=(d URUlUR "SUURS.UD6nU[ U4$)arPrepare a token creation request. Note that these requests usually require client authentication, either by including client_id or a set of provider specific authentication credentials. :param token_url: Provider token creation endpoint URL. :param authorization_response: The full redirection URL string, i.e. the location to which the user was redirected after successful authorization. Used to mine credentials needed to obtain a token in this step, such as authorization code. :param redirect_url: The redirect_url supplied with the authorization request (if there was one). :param state: :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra parameters. Default ''. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). )r)r rR)r rrr?rr<rT)r& token_urlauthorization_responserrr r's r(rClient.prepare_token_requests*#9--(* *# !  + +& , 5(=D,=,=((Sd6:6G6GSKQS*D00r+c [U5(d [5eUc UROUnUR"SUX$S.UD6nU[U4$)aiPrepare an access token refresh request. Expired access tokens can be replaced by new access tokens without going through the OAuth dance if the client obtained a refresh token. This refresh token and authentication credentials can be used to obtain a new access token, and possibly a new refresh token. :param token_url: Provider token refresh endpoint URL. :param refresh_token: Refresh token string. :param body: Existing request body (URL encoded string) to embed parameters into. This may contain extra parameters. Default ''. :param scope: List of scopes to request. Must be equal to or a subset of the scopes granted when obtaining the refresh token. If none is provided, the ones provided in the constructor are used. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). )r rrrZ)r rrprepare_refresh_bodyrT)r&r[rr rr's r(prepare_refresh_token_request$Client.prepare_refresh_token_request&s\(#9--(* *$m ((]d7D]U[]*D00r+c T[U5(d [5e[X4X4US.UD6$)aUPrepare a token revocation request. :param revocation_url: Provider token revocation endpoint URL. :param token: The access or refresh token to be revoked (string). :param token_type_hint: ``"access_token"`` (default) or ``"refresh_token"``. This is optional and if you wish to not pass it you must provide ``token_type_hint=None``. :param body: :param callback: A jsonp callback such as ``package.callback`` to be invoked upon receiving the response. Not that it should not include a () suffix. :param kwargs: Additional parameters to included in the request. :returns: The prepared request tuple with (url, headers, body). Note that JSONP request may use GET requests as the parameters will be added to the request URL query as opposed to the request body. An example of a revocation request .. code-block:: http POST /revoke HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token An example of a jsonp revocation request .. code-block:: http GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW and an error response .. code-block:: javascript package.myCallback({"error":"unsupported_token_type"}); Note that these requests usually require client credentials, client_id in the case for public clients and provider specific authentication credentials for confidential clients. )token_type_hintr callback)r rr )r&revocation_urlrrcr rdr's r(r 'Client.prepare_token_revocation_requestCs;`#>22(* */:@Oem:28: :r+c Uc UROUn[XS9UlURUR5 UR$)a{Parse the JSON response body. If the access token request is valid and authorized, the authorization server issues an access token as described in `Section 5.1`_. A refresh token SHOULD NOT be included. If the request failed client authentication or is invalid, the authorization server returns an error response as described in `Section 5.2`_. :param body: The response body from the token request. :param scope: Scopes originally requested. If none is provided, the ones provided in the constructor are used. :return: Dictionary of token parameters. :raises: Warning if scope has changed. :py:class:`oauthlib.oauth2.errors.OAuth2Error` if response is invalid. These response are json encoded and could easily be parsed without the assistance of OAuthLib. However, there are a few subtle issues to be aware of regarding the response which are helpfully addressed through the raising of various errors. A successful response should always contain **access_token** The access token issued by the authorization server. Often a random string. **token_type** The type of the token issued as described in `Section 7.1`_. Commonly ``Bearer``. While it is not mandated it is recommended that the provider include **expires_in** The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value. **scope** Providers may supply this in all responses but are required to only if it has changed since the authorization request. .. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1 .. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2 .. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1 )r)rrrr%)r&r rr's r(parse_request_body_response"Client.parse_request_body_responsezs<`$m )$<  &&tzz2zzr+c U=(d URnUc UROUn[UR4XUS.UD6$)aPrepare an access token request, using a refresh token. If the authorization server issued a refresh token to the client, the client makes a refresh request to the token endpoint by adding the following parameters using the `application/x-www-form-urlencoded` format in the HTTP request entity-body: :param refresh_token: REQUIRED. The refresh token issued to the client. :param scope: OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner. Note that if none is provided, the ones provided in the constructor are used if any. )r rr)rrrrefresh_token_key)r&r rrr's r(r_Client.prepare_refresh_bodysN &;);); #m $T%;%;L$3@LDJL Lr+c(U[:Xa"[R"URU5nOcU[:Xa"[R "URU5nO7U[ :Xa"[R"URU5nO [S5eXU4$)zDAdd a bearer token to the request uri, body or authorization header.Invalid token placement.) AUTH_HEADERrprepare_bearer_headersr URI_QUERYprepare_bearer_uriBODYprepare_bearer_bodyrE)r&rHrIr rJrKs r(r.Client._add_bearer_tokens} k )33D4E4EwOG  )++D,=,=sCC  $--d.?.?FD78 8T!!r+cSnUS:d [S5eUS::d [S5e[R"S5n[R"U5n[R "X25(d [S5eX lU$)aCreate PKCE **code_verifier** used in computing **code_challenge**. See `RFC7636 Section 4.1`_ :param length: REQUIRED. The length of the code_verifier. The client first creates a code verifier, "code_verifier", for each OAuth 2.0 [RFC6749] Authorization Request, in the following manner: .. code-block:: text code_verifier = high-entropy cryptographic random STRING using the unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~" from Section 2.3 of [RFC3986], with a minimum length of 43 characters and a maximum length of 128 characters. .. _`RFC7636 Section 4.1`: https://tools.ietf.org/html/rfc7636#section-4.1 N+z*Length must be greater than or equal to 43z(Length must be less than or equal to 128z^[A-Zaa-z0-9-._~]z)code_verifier contains invalid characters)rErecompilesecrets token_urlsafesearchr)r&lengthrallowed_characterss r(create_code_verifierClient.create_code_verifiersw$ |IJ J}GH HZZ(;<--f5 yy+;;HI I*r+cSnUS:Xa [S5eUS:XaSnX lUnX0lUS:Xa[R"5nUR UR SS95 UR5n[R[R"U55nURSS5RS S 5RS S 5nX0lU$) aCreate PKCE **code_challenge** derived from the **code_verifier**. See `RFC7636 Section 4.2`_ :param code_verifier: REQUIRED. The **code_verifier** generated from `create_code_verifier()`. :param code_challenge_method: OPTIONAL. The method used to derive the **code_challenge**. Acceptable values include `S256`. DEFAULT is `plain`. The client then creates a code challenge derived from the code verifier by using one of the following transformations on the code verifier:: plain code_challenge = code_verifier S256 code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) If the client is capable of using `S256`, it MUST use `S256`, as `S256` is Mandatory To Implement (MTI) on the server. Clients are permitted to use `plain` only if they cannot support `S256` for some technical reason and know via out-of-band configuration that the server supports `plain`. The plain transformation is for compatibility with existing deployments and for constrained environments that can't use the S256 transformation. .. _`RFC7636 Section 4.2`: https://tools.ietf.org/html/rfc7636#section-4.2 NzInvalid code_verifierplainS256ascii)encoding+-/_=rS) rEr!r hashlibsha256updateencodedigestbytesdecodebase64urlsafe_b64encodereplace)r&rr!r h sha256_vals r(create_code_challengeClient.create_code_challenges6 D 45 5 D ($+ !)> &*N"0  F * A HH]))7); <J"\\&*B*B:*NON+33C=EEc3OWWX[]_`N"0 r+c U[:wa [S5e[R"URUUR U4XCUUR S.UD6nXU4$)zAdd a MAC token to the request authorization header. Warning: MAC token support is experimental as the spec is not yet stable. rn)rJr exthash_algorithm)rorErprepare_mac_headerrrr)r&rHrIr rJrKrr's r(r/Client._add_mac_token)sg k )78 8++D,=,=s,0LL+YOVgj;?;M;MYQWYT!!r+cZ[R"S[5 URU5$)Nz=Please switch to the public method populate_token_attributes.)warningswarnDeprecationWarningr%r&responses r(_populate_attributesClient._populate_attributes7s( 34F H--h77r+c>SU;aURS5Ulgg)z2Add attributes from an auth code response to self.r"N)rFr"rs r(populate_code_attributesClient.populate_code_attributes<s! X  V,DI r+cSU;aURS5UlSU;aURS5UlSU;aURS5UlSU;aFURS5Ul[ R "5[ UR5-UlSU;a [ URS55UlSU;aURS5UlSU;aURS5Ul gg! SUlNE=f) z6Add attributes from a token exchange response to self.rrrr# expires_atNrr) rFrrrr#rGintr$rrrs r(r% Client.populate_token_attributesBs X % ( ^ D  8 #&ll<8DO 8 #&ll<8DO#yy{S-AAD  8 # (#&x||L'A#B   #<< 2DL h &!)o!>D  '  (#' s (D D )r$rrr"r r!rrr#rrrrrrrrr)rANNN)NNN)NNNrS)NrSN)rrSN)N)rSNN)__name__ __module__ __qualname____firstlineno____doc__rkrorr)propertyr0r8r<r?rOrWrr`r rhr_r.rrr/rrr%__static_attributes__rZr+r(rr$s"(*5$"##"!/# $'+R3h    PPPDH"&4ilFJ?C$.LGKBD 1DFJ591<\`5:n3jL*>B8<" "H/b/4$#[d "8 - ?r+r)rrrryr{rGroauthlib.commonroauthlib.oauth2.rfc6749roauthlib.oauth2.rfc6749.errorsrr"oauthlib.oauth2.rfc6749.parametersrrr oauthlib.oauth2.rfc6749.utilsr rorqrsrTrrZr+r(rsc  **>   7 x?x?r+