| Current File : //proc/self/root/lib/python3/dist-packages/twisted/web/_auth/__pycache__/wrapper.cpython-312.pyc |
�
Ϫ�f�! � � � d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl m
Z
ddl m Z ddl
mZmZ ee� G d � d
� � Z ee� G d � d � � Zy
)a�
A guard implementation which supports HTTP header-based authentication
schemes.
If no I{Authorization} header is supplied, an anonymous login will be
attempted by using a L{Anonymous} credentials object. If such a header is
supplied and does not contain allowed credentials, or if anonymous login is
denied, a 401 will be sent in the response along with I{WWW-Authenticate}
headers for each of the allowed authentication schemes.
� )� implementer)�error)� Anonymous)�Logger)�proxyForInterface)�util)� IResource�_UnsafeErrorPagec �, � e Zd ZdZdZd� Zd� Zd� Zd� Zy)�UnauthorizedResourcez6
Simple IResource to escape Resource dispatch
Tc � � || _ y �N)�_credentialFactories)�self� factoriess �;/usr/lib/python3/dist-packages/twisted/web/_auth/wrapper.py�__init__z UnauthorizedResource.__init__# s
� �$-��!� c � ��� d� ���fd�}d� �|j d� | j D ]@ }|j |� }|j j d ||j
|� � �B |j dk( ryy) z=
Send www-authenticate headers to the client
c �H � t | t � r| j d� S | S )N�ascii)�
isinstance�str�encode��ss r � ensureBytesz0UnauthorizedResource.render.<locals>.ensureBytes+ s � �(2�1�c�(:�1�8�8�G�$� A�� Ar c �� �� g }|j � D ]2 \ }} �|� } �|� }|j |dz �|� z � �4 dj | dj |� g� S )N� =� s , )�items�append�join)�scheme� challenge�lst�k�vr � quoteStrings ��r �generateWWWAuthenticatez<UnauthorizedResource.render.<locals>.generateWWWAuthenticate. sk �� ��C�!���)�
6���1� ��N�� ��N���
�
�1�t�8�k�!�n�4�5�
6� �9�9�f�e�j�j��o� 6�7� 7r c �R � d| j dd� j dd� z dz S )N� "� \s \\s \")�replacer s r r) z0UnauthorizedResource.render.<locals>.quoteString6 s* � ��!�)�)�E�6�2�:�:�4��H�H�4�O� Or i� s www-authenticates HEADr s Unauthorized)�setResponseCoder � getChallenge�responseHeaders� addRawHeaderr$ �method)r �requestr* �factr% r r) s @@r �renderzUnauthorizedResource.render& s� �� �
B� 8� P� � � ��$��-�-� �D� �)�)�'�2�I� � #� #� 0� 0�#�%<�T�[�[�)�%T�
� �
�>�>�W� $�� r c � � | S )z+
Disable resource dispatch
� �r �pathr4 s r �getChildWithDefaultz(UnauthorizedResource.getChildWithDefaultC s � � � r c � � t � �r ��NotImplementedError�r r: �childs r �putChildz UnauthorizedResource.putChildI � � �!�#�#r N) �__name__�
__module__� __qualname__�__doc__�isLeafr r6 r; rA r8 r r r r s" � �� �F�.� �:� $r r c �X � e Zd ZdZdZ e� Zd� Zd� Zd� Z d� Z
d� Z d� Z d � Z
d
� Zd � Zy )
�HTTPAuthSessionWrapperaa
Wrap a portal, enforcing supported header-based authentication schemes.
@ivar _portal: The L{Portal} which will be used to retrieve L{IResource}
avatars.
@ivar _credentialFactories: A list of L{ICredentialFactory} providers which
will be used to decode I{Authorization} headers into L{ICredentials}
providers.
Fc � � || _ || _ y)a[
Initialize a session wrapper
@type portal: C{Portal}
@param portal: The portal that will authenticate the remote client
@type credentialFactories: C{Iterable}
@param credentialFactories: The portal that will authenticate the
remote client based on one submitted C{ICredentialFactory}
N)�_portalr )r �portal�credentialFactoriess r r z HTTPAuthSessionWrapper.__init__^ s � � �� �$7��!r c � � |j d� }|s,t j | j t � � � S | j |� \ }}|�t
| j � S |j ||� }t j | j |� � S # t j $ r t
| j � cY S t $ r+ | j j d� t ddd� cY S w xY w)a
Get the L{IResource} which the given request is authorized to receive.
If the proper authorization headers are present, the resource will be
requested from the portal. If not, an anonymous login attempt will be
made.
s
authorizationz+Unexpected failure from credentials factory�� �Internal Error� )� getHeaderr �DeferredResource�_loginr �_selectParseHeaderr r �decoder � LoginFailed�
BaseException�_log�failurer
)r r4 �
authheader�factory�
respString� credentialss r �_authorizedResourcez*HTTPAuthSessionWrapper._authorizedResourcel s� � � �&�&�'7�8�
���(�(����Y�[�)A�B� B� "� 5� 5�j� A���� �?�'��(A�(A�B� B� C�!�.�.��W�=�K� �(�(����[�)A�B� B��
� � � C�'��(A�(A�B� B� � ?� �I�I� � � K� L�#�C�)9�2�>� >� ?�s �,B" �"(C?� 0C?�>C?c �B � | j |� j |� S )z�
Find the L{IResource} avatar suitable for the given request, if
possible, and render it. Otherwise, perhaps render an error page
requiring authorization or describing an internal server failure.
)r_ r6 )r r4 s r r6 z HTTPAuthSessionWrapper.render� s � � �'�'��0�7�7��@�@r c � � |j j d|j j � � | j |� S )a\
Inspect the Authorization HTTP header, and return a deferred which,
when fired after successful authentication, will return an authorized
C{Avatar}. On authentication failure, an C{UnauthorizedResource} will
be returned, essentially halting further dispatch on the wrapped
resource and all children
r )�postpath�insert�prepath�popr_ r9 s r r; z*HTTPAuthSessionWrapper.getChildWithDefault� s8 � � ��� � ��7�?�?�#6�#6�#8�9��'�'��0�0r c � � | j j |dt � }|j | j | j
� |S )z�
Get the L{IResource} avatar for the given credentials.
@return: A L{Deferred} which will be called back with an L{IResource}
avatar or which will errback if authentication fails.
N)rK �loginr � addCallbacks�_loginSucceeded� _loginFailed)r r^ �ds r rT z HTTPAuthSessionWrapper._login� s; � �
�L�L� � �{�D�)� <�� ���t�+�+�T�->�->�?��r c �Z ��� |\ }}� G ��fd�dt t d� � � �|� S )z�
Handle login success by wrapping the resulting L{IResource} avatar
so that the C{logout} callback will be invoked when rendering is
complete.
c �0 �� � e Zd ZdZ�fd�Z� �fd�Z� xZS )�?HTTPAuthSessionWrapper._loginSucceeded.<locals>.ResourceWrappera�
Wrap an L{IResource} so that whenever it or a child of it
completes rendering, the cred logout hook will be invoked.
An assumption is made here that exactly one L{IResource} from
among C{avatar} and all of its children will be rendered. If
more than one is rendered, C{logout} will be invoked multiple
times and probably earlier than desired.
c �H �� �| j j ||� � S )z�
Pass through the lookup to the wrapped resource, wrapping
the result in L{ResourceWrapper} to ensure C{logout} is
called when rendering of the child is complete.
)�resourcer; )r �namer4 �ResourceWrappers �r r; zSHTTPAuthSessionWrapper._loginSucceeded.<locals>.ResourceWrapper.getChildWithDefault� s! �� � '�t�}�}�'H�'H��w�'W�X�Xr c �f �� |j � j �fd�� t �| �
|� S )z�
Hook into response generation so that when rendering has
finished completely (with or without error), C{logout} is
called.
c � �� �� S r r8 )�ign�logouts �r �<lambda>zXHTTPAuthSessionWrapper._loginSucceeded.<locals>.ResourceWrapper.render.<locals>.<lambda>� s �� �6�8� r )� notifyFinish�addBoth�superr6 )r r4 � __class__rv s ��r r6 zFHTTPAuthSessionWrapper._loginSucceeded.<locals>.ResourceWrapper.render� s, �� � �$�$�&�.�.�/C�D� �w�~�g�.�.r )rC rD rE rF r; r6 �
__classcell__)r{ rr rv s @��r rr rn � s �� �
�
Y�
/�
/r rr rp )r r )r �args� interface�avatarrr rv s @@r ri z&HTTPAuthSessionWrapper._loginSucceeded� s2 �� � %)�!� �6�6� /� /� �:� F� /�8 �v�&�&r c �� � |j t j t j � rt | j
� S | j j d|�� t ddd� S )z�
Handle login failure by presenting either another challenge (for
expected authentication/authorization-related failures) or a server
error page (for anything else).
zGHTTPAuthSessionWrapper.getChildWithDefault encountered unexpected error)rZ rO rP rQ ) �checkr � UnauthorizedrW r r rY rZ r
)r �results r rj z#HTTPAuthSessionWrapper._loginFailed� s` � � �<�<��*�*�E�,=�,=� >�'��(A�(A�B� B� �I�I� � �#� �
�
�
$�C�)9�2�>� >r c � � |j d� }|d j � }| j D ]) }|j |k( s�|dj |dd � fc S y)aV
Choose an C{ICredentialFactory} from C{_credentialFactories}
suitable to use to decode the given I{Authenticate} header.
@return: A two-tuple of a factory and the remaining portion of the
header value to be decoded or a two-tuple of L{None} if no
factory can decode the header value.
r r � N)NN)�split�lowerr r$ r# )r �header�elementsr$ r5 s r rU z)HTTPAuthSessionWrapper._selectParseHeader� sd � � �<�<��%���!��"�"�$���-�-� 7�D��{�{�f�$� �d�i�i���� � 5�6�6� 7� r c � � t � �r r= r? s r rA z HTTPAuthSessionWrapper.putChild� rB r N)rC rD rE rF rG r rY r r_ r6 r; rT ri rj rU rA r8 r r rI rI N sE � � � �F� �8�D� 8� C�0A� 1� �$'�L?� � $r rI N)rF �zope.interfacer � twisted.credr �twisted.cred.credentialsr �twisted.loggerr �twisted.python.componentsr � twisted.webr �twisted.web.resourcer r
r rI r8 r r �<module>r� sa ��
� '� � .� !� 7� � <�
�Y��/$� /$� �/$�d
�Y��]$� ]$� �]$r