o
    i+                     @   sx   d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZ G d	d
 d
e	ZG dd deZeZdS )z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler   )passwd_checkset_passwordc                   @   s4   e Zd ZdZdddZdddZdd Zd	d
 ZdS )LoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc              	   C   s*   |  | jdt| jd| jd|d dS )zRender the login form.z
login.htmlnextdefault)r
   messageN)writerender_templater   get_argumentbase_url)selfr    r   T/var/www/edux/Edux_v2/venv/lib/python3.10/site-packages/jupyter_server/auth/login.py_render   s   zLoginFormHandler._renderc                 C   s   |du r| j }|dd}t|}|js|jd | j sPd}|jrD|j d|j }| }| jr8| j|k}n| j	rDt
t| j	|}|sP| jd|  |}| | dS )zRedirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        N\z%5C/Fz://z!Not allowing login redirect to %r)r   replacer   netlocpath
startswithschemelowerallow_originallow_origin_patboolrematchlogwarningredirect)r   urlr   parsedalloworiginr   r   r   _redirect_safe   s"   zLoginFormHandler._redirect_safec                 C   s0   | j r| jd| jd}| | dS |   dS )zGet the login form.r
   r   N)current_userr   r   r*   r   )r   next_urlr   r   r   get?   s   zLoginFormHandler.getc                 C   sz   | j |  }| _|du r| d | jddid dS | jd|j d | j | | | j	d| j
d	}| | dS )
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r
   r   )identity_providerprocess_login_formr+   
set_statusr   r#   infousernameset_login_cookier   r   r*   )r   userr,   r   r   r   postG   s   
zLoginFormHandler.postN)__name__
__module____qualname____doc__r   r*   r-   r9   r   r   r   r   r	      s    


 r	   c                   @   s   e Zd ZdZedd Zdd Zdd Zedd	d
Z	e
de
jZedd Zedd Zedd Zedd Zedd Zedd ZedddZedd Zedd ZdS )LegacyLoginHandlerzLegacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 C   s   |  | jS r:   )password_from_settingssettings)r   r   r   r   hashed_password\   s   z"LegacyLoginHandler.hashed_passwordc                 C   s
   t ||S )zCheck a passwd.)r   )r   abr   r   r   r   `   s   
zLegacyLoginHandler.passwd_checkc                 C   s  | j ddd}| j ddd}| | jrt| | j|r'|s'| | t j nM| j	re| j	|kre| | t j |rdt
| jddrd| jdd}tj|d}t||d	 | j_| jd< | jd
|  n| d | jddid dS | j d| jd}| | dS )zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.json)config_filezWrote hashed password to %sr.   r/   r0   r1   Nr
   )r   get_login_availablerA   r   rB   r7   uuiduuid4hextokengetattrr2   r-   osr   joinr   r#   r5   r4   r   r   r*   )r   typed_passwordrG   rI   rJ   r,   r   r   r   r9   d   s*   

zLegacyLoginHandler.postNc                 C   sd   |j di }|dd |j d|jjdkr|dd |d|j |j|j|fi | |S )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer   )rA   r-   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idrT   r   r   r   r7   }   s   z#LegacyLoginHandler.set_login_cookieztoken\s+(.+)c                 C   s:   | dd}|s| j|jjdd}|r|d}|S )zGet the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        rO   rF   Authorizationr   )r   auth_header_patr"   rZ   headersr-   group)r^   r_   
user_tokenmr   r   r   	get_token   s   

zLegacyLoginHandler.get_tokenc                 C   s   |  | S )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedr^   r_   r   r   r   should_check_origin      z&LegacyLoginHandler.should_check_originc                 C   s"   t |dddu r|j t |ddS )rh   _user_idN_token_authenticatedF)rP   r+   rj   r   r   r   ri      s   z)LegacyLoginHandler.is_token_authenticatedc                 C   s   t |ddr	|jS | |}| |}|p|}|r&||kr#| || d|_|du rC||jdur>|j	d|j |
  |jsCd}||_|S )rh   rm   NTz(Clearing invalid/expired login cookie %s	anonymous)rP   rm   get_user_tokenget_user_cookier7   rn   
get_cookier]   r#   r$   clear_login_cookielogin_available)r^   r_   token_user_idcookie_user_idr`   r   r   r   get_user   s"   

zLegacyLoginHandler.get_userc                 C   s2   |j di }|j|jfi |}|r| }|S )rh   get_secure_cookie_kwargs)rA   r-   get_secure_cookier]   decode)r^   r_   rx   r`   r   r   r   rq      s
   z"LegacyLoginHandler.get_user_cookiec                 C   st   |j }|sdS | |}d}||kr|jd|jj d}|r8| |}|du r6t j	}|j
d|  |S dS )rh   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )rO   rg   r#   debugrZ   	remote_iprq   rL   rM   rN   r5   )r^   r_   rO   re   authenticatedr`   r   r   r   rp      s(   


z!LegacyLoginHandler.get_user_tokenc                 C   sr   |j s'd}|du r|j| d |js#|js%|j| d dS dS dS |js5|js7|jd dS dS dS )rh   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr#   r$   rE   rO   )r^   appssl_optionsr$   r   r   r   validate_security   s   z$LegacyLoginHandler.validate_securityc                 C   s   | ddS )rh   rE   rF   )r-   r^   rA   r   r   r   r@     rl   z)LegacyLoginHandler.password_from_settingsc                 C   s   t | |p
|dS )rh   rO   )r    r@   r-   r   r   r   r   rK     s   z&LegacyLoginHandler.get_login_availabler:   )r;   r<   r=   r>   propertyrB   r   r9   classmethodr7   r!   compile
IGNORECASErb   rg   rk   ri   rw   rq   rp   r   r@   rK   r   r   r   r   r?   U   s6    




$


r?   )r>   rQ   r!   rL   urllib.parser   tornado.escaper   base.handlersr   securityr   r   r	   r?   LoginHandlerr   r   r   r   <module>   s    F D