o
    ^i/                     @   s   d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	lmZmZ G d
d de	ZG dd deZeZdS )z5Tornado handlers for logging into the Jupyter Server.    N)urlparse)
url_escape   )JupyterHandler   )allow_unauthenticated)passwd_checkset_passwordc                   @   s<   e Zd ZdZdddZdddZedd Zed	d
 ZdS )LoginFormHandlerzlThe basic tornado login handler

    accepts login form, passed to IdentityProvider.process_login_form.
    Nc              	   C   s*   |  | jdt| jd| jd|d dS )zRender the login form.z
login.htmlnextdefault)r   messageN)writerender_templater   get_argumentbase_url)selfr    r   T/home/ubuntu/hpml_nyu/venv/lib/python3.10/site-packages/jupyter_server/auth/login.py_render   s   zLoginFormHandler._renderc           	      C   s   |du r| j }|dd}d|v r#|d\}}}| d|d }t|}|js6|js6|jd | j sld}|js>|jr`|j d|j }|	 }| j
rT| j
|k}n| jr`tt| j|}|sl| jd|  |}| | dS )	zRedirect if url is on our PATH

        Full-domain redirects are allowed if they pass our CORS origin checks.

        Otherwise use default (self.base_url if unspecified).
        N\z%5C:z:///Fz!Not allowing login redirect to %r)r   replace	partitionlstripr   schemenetlocpath
startswithlowerallow_originallow_origin_patboolrematchlogwarningredirect)	r   urlr   r   _restparsedalloworiginr   r   r   _redirect_safe!   s(   zLoginFormHandler._redirect_safec                 C   s0   | j r| jd| jd}| | dS |   dS )zGet the login form.r   r   N)current_userr   r   r0   r   )r   next_urlr   r   r   getN   s   zLoginFormHandler.getc                 C   sz   | j |  }| _|du r| d | jddid dS | jd|j d | j | | | j	d| j
d	}| | dS )
zPost a login.N  errorInvalid credentialsr   zUser z logged in.r   r   )identity_providerprocess_login_formr1   
set_statusr   r'   infousernameset_login_cookier   r   r0   )r   userr2   r   r   r   postW   s   
zLoginFormHandler.postN)	__name__
__module____qualname____doc__r   r0   r   r3   r?   r   r   r   r   r
      s    


-
r
   c                   @   s   e Zd ZdZedd Zdd Zedd Ze	dd	d
Z
edejZe	dd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dddZe	dd Ze	dd ZdS )LegacyLoginHandlerzLegacy LoginHandler, implementing most custom auth configuration.

    Deprecated in jupyter-server 2.0.
    Login configuration has moved to IdentityProvider.
    c                 C   s   |  | jS r@   )password_from_settingssettings)r   r   r   r   hashed_passwordm   s   z"LegacyLoginHandler.hashed_passwordc                 C   s
   t ||S )zCheck a passwd.)r   )r   abr   r   r   r   q   s   
zLegacyLoginHandler.passwd_checkc                 C   s  | j ddd}| j ddd}| | jrz| | j|r'|s'| | t j nS| j	rk| j	|krk| | t j |rjt
| jddrj| jdd}tj|d}t| jd	rbt||d
 | j_| jd< | jd|  n| d | jddid dS | j d| jd}| | dS )zPost a login form.password r   new_passwordallow_password_changeF
config_dirzjupyter_server_config.jsonrH   )config_filezWrote hashed password to %sr4   r5   r6   r7   Nr   )r   get_login_availablerG   r   rH   r=   uuiduuid4hextokengetattrr8   r3   osr   joinhasattrr	   r'   r;   r:   r   r   r0   )r   typed_passwordrM   rO   rP   r2   r   r   r   r?   u   s(   

zLegacyLoginHandler.postNc                 C   sd   |j di }|dd |j d|jjdkr|dd |d|j |j|j|fi | |S )z9Call this on handlers to set the login cookie for successcookie_optionshttponlyTsecure_cookiehttpssecurer   )rG   r3   
setdefaultrequestprotocolr   set_secure_cookiecookie_name)clshandleruser_idr[   r   r   r   r=      s   z#LegacyLoginHandler.set_login_cookieztoken\s+(.+)c                 C   s:   | dd}|s| j|jjdd}|r|d}|S )zGet the user token from a request

        Default:

        - in URL parameters: ?token=<token>
        - in header: Authorization: token <token>
        rU   rL   Authorizationr   )r   auth_header_patr&   ra   headersr3   group)re   rf   
user_tokenmr   r   r   	get_token   s   

zLegacyLoginHandler.get_tokenc                 C   s   |  | S )+DEPRECATED in 2.0, use IdentityProvider API)is_token_authenticatedre   rf   r   r   r   should_check_origin      z&LegacyLoginHandler.should_check_originc                 C   s"   t |dddu r|j t |ddS )ro   _user_idN_token_authenticatedF)rV   r1   rq   r   r   r   rp      s   z)LegacyLoginHandler.is_token_authenticatedc                 C   s   t |ddr	|jS | |}| |}|p|}|r&||kr#| || d|_|du rC||jdur>|j	d|j |
  |jsCd}||_|S )ro   rt   NTz(Clearing invalid/expired login cookie %s	anonymous)rV   rt   get_user_tokenget_user_cookier=   ru   
get_cookierd   r'   r(   clear_login_cookielogin_available)re   rf   token_user_idcookie_user_idrg   r   r   r   get_user   s"   

zLegacyLoginHandler.get_userc                 C   s2   |j di }|j|jfi |}|r| }|S )ro   get_secure_cookie_kwargs)rG   r3   get_secure_cookierd   decode)re   rf   r   rg   r   r   r   rx      s
   z"LegacyLoginHandler.get_user_cookiec                 C   st   |j }|sdS | |}d}||kr|jd|jj d}|r8| |}|du r6t j	}|j
d|  |S dS )ro   NFz0Accepting token-authenticated connection from %sTz8Generating new user_id for token-authenticated request: )rU   rn   r'   debugra   	remote_iprx   rR   rS   rT   r;   )re   rf   rU   rl   authenticatedrg   r   r   r   rw      s(   


z!LegacyLoginHandler.get_user_tokenc                 C   sr   |j s'd}|du r|j| d |js#|js%|j| d dS dS dS |js5|js7|jd dS dS dS )ro   z<WARNING: The Jupyter server is listening on all IP addressesNz3 and not using encryption. This is not recommended.zK and not using authentication. This is highly insecure and not recommended.z`All authentication is disabled.  Anyone who can connect to this server will be able to run code.)ipr'   r(   rK   rU   )re   appssl_optionsr(   r   r   r   validate_security  s   z$LegacyLoginHandler.validate_securityc                 C   s   | ddS )ro   rK   rL   )r3   re   rG   r   r   r   rF     rs   z)LegacyLoginHandler.password_from_settingsc                 C   s   t | |p
|dS )ro   rU   )r$   rF   r3   r   r   r   r   rQ   #  s   z&LegacyLoginHandler.get_login_availabler@   )rA   rB   rC   rD   propertyrH   r   r   r?   classmethodr=   r%   compile
IGNORECASEri   rn   rr   rp   r~   rx   rw   r   rF   rQ   r   r   r   r   rE   f   s8    





$


rE   )rD   rW   r%   rR   urllib.parser   tornado.escaper   base.handlersr   	decoratorr   securityr   r	   r
   rE   LoginHandlerr   r   r   r   <module>   s    U F