0jX J d Z ddlmZ ddlZddlZddlZddlZddlmZ ddl Z ddl
Z
ddl m Z m
Z
ddlmZmZmZ ddlmZ n'# e$ r ddlm Z m
Z
ddlmZmZ dd lmZ ddlmZ Y nw xY w ej e Zd@d
Zd Z d Z d@d
Z d Z d Z d Z!d Z" G d de
Z# G d de e$ Z% G d de% Z& G d de$ Z'edk rddl(Z(ddl)Z)dd l*m+Z+ ej, ej- e(j. e(j/ e d z xZ0Z1e02 d d!d"# e02 d$d%& e02 d'e3dd() e02 d*e3d+d,) e02 d-d.d/0 e02 d1dd20 e14 Z5 e+d3e5j6 ie5j7 Z8 e'e5j9 4 5 Z:e8; e5j< re5j< = ndd5> e5j? e:@ 6 7 ZA eB e)jC e:D eAd8 d9d:d;e5jE eAd< = d>? ddd dS # 1 swxY w Y dS dS )Aa$ A one-stop helper for desktop app to acquire an authorization code.
It starts a web server to listen redirect_uri, waiting for auth code.
It optionally opens a browser window to guide a human user to manually login.
After obtaining an auth code, the web server will automatically shut down.
) defaultdictN)Template)
HTTPServerBaseHTTPRequestHandler)urlparseparse_qs urlencodeescape)r r )r c t | 5 }| |d d cd d d S # 1 swxY w Y d S )Nportz
Open this link to Sign In
(You may want to use incognito window)
Abort
)auth_uriwelcome_templatecode)AuthCodeReceiverget_auth_responseget) listen_portr receivers _/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/msal/oauth2cli/authcode.pyobtain_auth_coder s { + + + x)) " * c&kk s *AA A c t d 5 } | D ]V}| dd d }| dk r d d d dS W d d d n # 1 swxY w Y n# t $ r Y nw xY wt
j d S )Nz/proc/1/cgroup: /Tz /.dockerenv)open readlinessplitstripIOErrorospathexists)fline cgroup_paths r _is_inside_dockerr( + s(
"
#
# q
"jja 0 0 3 9 9 ; ; $$&&#--
.
7>>- ( ((sA B A B
/ B <B
> B
BB BB
B#"B#c dd l } | }t |d|d }t |d|d }|dk od|v S )Nr systemreleaser linux microsoft)platformunamegetattrlower)r. r/
platform_namer+ s r is_wslr3 9 ss
OOO NN EE8U1X66<<>>MeYa117799G G # > w(>> c t }|j dvr"t d|j dS n,# t $ r t d Y dS w xY wt fddD r t d dS dd l}|r)| | }n| }|spt rbdd l
} | d
g }|dk }n# t $ r Y nw xY w|s- | d g }|d v }n# t $ r Y nw xY w|S )
zJBrowse uri with named browser. Default browser is customizable by $BROWSER)httphttpsz"Invalid URI scheme for browser: %sFzInvalid URI: %sc 3 K | ]}|v V d S N ).0cr s r z_browse..O s'
+
+Q1=
+
+
+
+
+
+r4 z
zInvalid characters in URIr Nwslviewz explorer.exe)r )
r schemeloggerwarning
ValueErrorany
webbrowserr r r3
subprocesscallFileNotFoundError)r browser_name
parsed_urirE browser_openedrF exit_codes ` r _browserM E s h''
$5 5 5 NN?AR S S S5 6 ((333uu
+
+
+
+(
+
+
+++ 2333u 3# 55::8DD $ 22 fhh "H(=>>I &!^NN D
'OO^X,F G G !*f!4$
s3 8> %A'&A': D
D%$D%+E
EEc > d | D S )z;Flatten parse_qs()'s single-item lists into the item itselfc z i | ]8\ }}|t |t rt | d k r|d n|9S )r? r )
isinstancelistlenr; kvs r
z_qs2kv..p sS Aq
z!T**As1vv{{qtt r4 items)qss r _qs2kvrZ n s+ HHJJ r4 c , | d S )N<)
startswithtexts r _is_htmlr` t s ??3 r4 c > d | D S )Nc 4 i | ]\ }}|t | S r: r
rS s r rV z_escape..y s$ = = =TQAvayy = = =r4 rW )key_value_pairss r _escaperd x s" = =_%:%:%<%< = = ==r4 c v t | t r#| st | n| S r9 )rP str isprintablereprr^ s r _printifyri { s2 #D#.. St7G7G7I7I S4:::tSr4 c . e Zd Zd Zd Zd ZddZd ZdS ) _AuthCodeHandlerc t t | j j }| dd g d }| dd g d }|dk r!| | j j d S |dk r| dd d S |r| d d d S | d
d d S ) Nwelcomer errortrueabortzAuthentication abortedFis_okzresponse_mode=query is not supported for authentication responses. This application operates in response_mode=form_post mode only.z_Authentication could not be completed. You can close this window and return to the application.)r r r# queryr _send_full_responseserver welcome_page)selfrY
welcome_param error_params r do_GETz_AuthCodeHandler.do_GET s
hty))/
0
0y4&11!4
ffWtf--a0 F " " $ $T[%= > > > > >
G
#
# $ $%=U $ K K K K K
$ $R
%
$ $q
%
r4 c t | j dd }| j | d }t
| }| d s| d r$| t | d S | dd d S ) NzContent-Lengthr utf-8r rn zInvalid POST requestFrq )
intheadersr rfilereaddecoder _process_auth_responserZ rt )rw content_length post_datarY s r do_POSTz_AuthCodeHandler.do_POST s T\ - -.> B BCCJOON33::7CC
i
66&>> JRVVG__ J ' 'r
3 3 3 3 3 $ $%;5 $ I I I I Ir4 c t d| | j j r<| j j | d k r| dd dS d|v r | j j n | j j }t |j rt | }n|}t t | }| |j
di | || j _ dS ) z:Process the auth response from either GET or POST request.zGot auth response: %sstatez>State mismatch. Waiting for next response... or you may abort.Frq r Nr: )rA debugru
auth_stater rt success_templateerror_templater` templaterd r rf safe_substitute
auth_response)rw r r safe_data filled_datas r r z'_AuthCodeHandler._process_auth_response s ,m<<< ; ! 6dk&<
@Q@QRY@Z@Z&Z&Z
$ $PX]
%
_
_
_
_
_ ]** 4404 0J
)**
* #M 2 2 ) %c955K $ $%=X%=%L%L %L%L M M M(5DK % % %r4 Tc | |rdnd t | rdnd}| d| | | j | d d S )N i z text/htmlz
text/plainz Content-typer| )
send_responser` send_header end_headerswfilewriteencode)rw bodyrr content_types r rt z$_AuthCodeHandler._send_full_response s %033S111&.tnnF{{, 666
W--.....r4 c P t j |gt t | R d S r9 )rA r mapri )rw formatargss r log_messagez _AuthCodeHandler.log_message s* V3c)T 2 2333333r4 N)T)__name__
__module__ __qualname__rz r r rt r r: r4 r rk rk sg * J J J6 6 6&/ / / /4 4 4 4 4r4 rk c $ e Zd Z fdZd Z xZS )_AuthCodeHttpServerc |\ }}|r%t j dk st rd| _ t t
| j |g|R i | d S )Nwin32F)sysr. r3 allow_reuse_addresssuperr __init__)rw server_addressr kwargs_r __class__s r r z _AuthCodeHttpServer.__init__ sg 4 -S\W,,,
(-D $1!4((1.R4RRR6RRRRRr4 c t d )Nz"Timeout. No auth response arrived.) RuntimeErrorrw s r handle_timeoutz"_AuthCodeHttpServer.handle_timeout s ?@@@r4 )r r r r r
__classcell__)r s @r r r sS S S S S SA A A A A A Ar4 r c e Zd Zej ZdS )_AuthCodeHttpServer6N)r r r socketAF_INET6address_familyr: r4 r r r s _NNNr4 r c F e Zd Zd dZd Zd
dZ d dZd Zd Zd Z dS ) r Nc t rdnd}t |pg | _ d|v rt nt } |||pdft
| _ d| _ dS )a Create a Receiver waiting for incoming auth response.
:param port:
The local web server will listen at http://...:
You need to use the same port when you register with your app.
If your Identity Provider supports dynamic port, you can use port=0 here.
Port 0 means to use an arbitrary unused port, per this official example:
https://docs.python.org/2.7/library/socketserver.html#asynchronous-mixins
:param scheduled_actions:
For example, if the input is
``[(10, lambda: print("Got stuck during sign in? Call 800-000-0000"))]``
then the receiver would call that lambda function after
waiting the response for 10 seconds.
z0.0.0.0 127.0.0.1r r FN)r( sorted_scheduled_actionsr r rk _server_closing)rw r scheduled_actionsaddressServers r r zAuthCodeReceiver.__init__ sn 1 2 2C)) #)):)@b"A"A ), %%=P vw 24DEE
r4 c & | j j d S )z*The port this server actually listening tor? )r r r s r get_portzAuthCodeReceiver.get_port s |*1--r4 c i }t j | j |f| }d|_ | t j }|rt j |z
|k rn t j d | sn| j rt j |z
| j d d k rY| j d \ }} | | j r+t j |z
| j d d k Y|rt j |z
|k n|pdS )a Wait and return the auth response. Raise RuntimeError when timeout.
:param str auth_uri:
If provided, this function will try to open a local browser.
Starting from 2026, the built-in http server will require response_mode=form_post.
:param int timeout: In seconds. None means wait indefinitely.
:param str state:
You may provide the state you used in auth_uri,
then we will use it to validate incoming response.
:param str welcome_template:
If provided, your end user will see it instead of the auth_uri.
When present, it shall be a plaintext or html template following
`Python Template string syntax `_,
and include some of these placeholders: $auth_uri and $abort_uri.
:param str success_template:
The page will be displayed when authentication was largely successful.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.1
:param str error_template:
The page will be displayed when authentication encountered error.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.2
:param callable auth_uri_callback:
A function with the shape of lambda auth_uri: ...
When a browser was unable to be launch, this function will be called,
so that the app could tell user to manually visit the auth_uri.
:param str browser_name:
If you did
``webbrowser.register("xyz", None, BackgroundBrowser("/path/to/browser"))``
beforehand, you can pass in the name "xyz" to use that browser.
The default value ``None`` means using default browser,
which is customizable by env var $BROWSER.
:return:
The auth response of the first leg of Auth Code flow,
typically {"code": "...", "state": "..."} or {"error": "...", ...}
See https://tools.ietf.org/html/rfc6749#section-4.1.2
and https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
Returns None when the state was mismatched, or when timeout occurred.
)targetr r Tr? r N)
threadingThread_get_auth_responsedaemonstarttimesleepis_aliver pop)rw timeoutr resulttbeginr callbacks r r z"AuthCodeReceiver.get_auth_response sF l *&6
K
K
K 18 ty{{U"W,,,, JqMMM::<<
*
e+d.Ea.H.KKK " 5 9 9! < < 8
*
e+d.Ea.H.KKK 29 ty{{U"W,,,, ~ r4 c
~ d | }
d |
} t d| |rLt t | j } | dd g d dk s
J d t |pd
|| | j
_ |r|r|
d z n|}
t d
|
z d} t |
| }n!# t d Y nxY w|sP|sCt d |
|| n ||
d}t |pd|z | j
_ t |pd|z | j
_ || j
_ i | j
_ || j
_ | j s-| j
| j
j rn| j -| | j
j d S )Nzhttp://localhost:{p})pz{loc}?error=abort)loczAbort by visit %s
response_moder form_postziThe built-in http server supports HTTP POST only. The auth_uri must be built with response_mode=form_post )r abort_uriz
?welcome=truez*Open a browser on this device to visit: %sF)rI z_browse(...) unsuccessfula Found no browser in current environment. If this program is being run inside a container which either (1) has access to host network (i.e. started by `docker run --net=host -it ...`), or (2) published port {port} to host network (i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), you can use browser on host to visit the following link. Otherwise, this auth attempt would either timeout (current timeout setting is {timeout}) or be aborted by CTRL+C. Auth URI: {auth_uri})r r r z`For your security: Do not share the contents of this page, the address bar, or take screenshots.z\Authentication complete. You can return to the application. Please close this browser tab.
zBAuthentication failed. $error: $error_description. ($error_uri).
)r r rA r r r rs r r r r rv inforM exceptionrB r r r r r r handle_requestupdate)rw r r r r r r r auth_uri_callbackrI netlocr params_urirK recommendations r r z#AuthCodeReceiver._get_auth_responseH s
(.. .AA'..6.:: ()444 K hx 0 0 677F::ov66q9[HHHJ IHH %--=-C$D$D$T$T %U %4 %4 ! ,1AOF_,,xD KKDtK L L L "N
>!(L!I!I!I
> !<=====!
,( ,NN H IO%)7 IO IR IR S S S S &%d+++{(01A 2~ lo} }) ) %&.~ 0d
SUc c 'e 'e # ' %' ""' -
L ' ' ) ) )|)
-
dl011111s D D3c F d| _ | j dS )zGEither call this eventually; or use the entire class as context managerTN)r r server_closer s r closezAuthCodeReceiver.close s#
!!#####r4 c | S r9 r: r s r __enter__zAuthCodeReceiver.__enter__ s r4 c . | d S r9 )r )rw exc_typeexc_valexc_tbs r __exit__zAuthCodeReceiver.__exit__ s
r4 )NNr9 )NNNNNNNN)
r r r r r r r r r r r: r4 r r r s ! ! ! ! F. . .
D D D D L MQIM " B2 B2 B2 B2H$ $ $
r4 r __main__r? )Client)levelz/The auth code received will be shown at stdout.)formatter_class descriptionz
--endpointz The auth endpoint for your app.z>https://login.microsoftonline.com/common/oauth2/v2.0/authorize)helpdefault client_idz!The client_id of your application)r z--portzThe port in redirect_uri)typer r z --timeout< zTimeout value, in secondz--hostr zThe host of redirect_uri)r r z--scopezThe scope listauthorization_endpointr
zhttp://{h}:{p})hr )scope redirect_urir zBSign In, or AbortzOh no. $errorzOh yeah. Got $coder )r r r r r r )indentr9 )F__doc__ collectionsr loggingr" r r stringr r r http.serverr r urllib.parser r r htmlr ImportErrorBaseHTTPServerurllibcgi getLoggerr rA r r( r3 rM rZ r` rd ri rk objectr r r argparsejsonoauth2r basicConfigINFOArgumentParser ArgumentDefaultsHelpFormatterr parser add_argumentr}
parse_argsr endpointr clientr r initiate_auth_code_flowr r r hostr flowprintdumpsr r r: r4 r r s! $ # # # # #
>>>>>>>>:::::::::: AAAAAAAA++++++++
8 $ $ ) ) ) ? ? ?& & & &R > > >T T T>4 >4 >4 >4 >4- >4 >4 >4BA A A A A*f A A A(% % % % %. % % %} } } } }v } } }B z Ggl++++(( > OOQ Q Q QA NN<P R R R NN;%HNIIINN8#q7QNRRRNN;S";UNVVVNN8[7QNRRRNN9d1ANBBB D
V-t}=t~
N
NF ty ) ) )
X--(,
<$*""$$$)0049@Q@Q@S@S0TT . jdj33*%T7 1Lw- 4
# s$ A !A%$A% B)JJ J