OKiXddlZddlZddlZddlmZmZddlmZddlm Z m Z ddl m Z ddl mZddlmZej"eZdZd Zd Zd Zd Zd ZdZ ddZy)N)urlsafe_b64decodeurlsafe_b64encode)sha256parse_http_listparse_keqv_list)settings)ImproperlyConfigured) force_bytesc.t|}t|S)zb Convert a WWW-Authentication header into a dict that can be used in a JSON response. r)headeritemss P/var/www/aura-ras/venv/lib/python3.12/site-packages/mozilla_django_oidc/utils.pyparse_www_authenticate_headerrs F #E 5 !!c |rtt||dStt|S#t$rtdj |wxYw)z` Load an attribute from the django settings. :raises: ImproperlyConfigured rzSetting {0} not found)getattrr AttributeErrorr format)attrargss rimport_from_settingsrsSI 8T473 3x&& I"#:#A#A$#GHHIs (($A c$|j|S)z"Return the absolute URL of a path.)build_absolute_uri)requestpaths r absolutifyr's  % %d ++rcRd}tj|t|jS)aTreturn True if the user is authenticated. This is necessary because in Django 1.10 the `user.is_authenticated` stopped being a method and is now a property. Actually `user.is_authenticated()` actually works, thanks to a backwards compat trick in Django. But in Django 2.0 it will cease to work as a callable method. zH`is_authenticated()` is going to be removed in mozilla-django-oidc v 2.x)warningswarnDeprecationWarningis_authenticated)usermsgs rr"r",s% UC MM#)*   rcntt|jd}|jd}|S)aReturn a URL-Safe, base64 encoded version of bytes_like_obj Implements base64urlencode as described in https://datatracker.ietf.org/doc/html/rfc7636#appendix-A This function is not used by the OpenID client; it's just for testing PKCE related functions. utf-8=)rr decoderstrip)bytes_like_objss rbase64_url_encoder,:s0 +n56==gFA  A Hrc|}t|dz}|dk(r|dz }n|dk(r|dz }n|dk7r tdt|jdS) aReturn the bytes encoded in a URL-Safe, base64 encoded string. Implements inverse of base64urlencode as described in https://datatracker.ietf.org/doc/html/rfc7636#appendix-A This function is not used by the OpenID client; it's just for testing PKCE related functions. z==r'rzInvalid base64 stringr&)len ValueErrorrencode)string_like_objr+sizes rbase64_url_decoder6Es] A q6A:D qy T   S 011 QXXg. //rc|dk(r|S|dk(r1tt|jdjSt d)alReturn a code_challege, which proves knowledge of the code_verifier. The code challenge is generated according to method which must be one of the methods defined in https://datatracker.ietf.org/doc/html/rfc7636#section-4.2: - plain: code_challenge = code_verifier - S256: code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) plainS256asciiz0code challenge method must be 'plain' or 'S256'.)r,rr3digestr2) code_verifiermethods rgenerate_code_challenger>WsL 6   (<( {nonce, code_verifier}. Each entry includes the time when it was added. The dictionary can contain multiple state -> {nonce, code_verifier} mappings to allow parallel logins with multiple browser sessions. To keep the session space to a reasonable size, the dictionary is kept at 50 state -> {nonce, code_verifier} mappings maximum. noncecode_challengeN oidc_statesOIDC_MAX_STATES2zLUser has more than {} "oidc_states" in his session, deleting the oldest one!added_on)r<r@rE) getsession isinstancedictrr1LOGGERinfortimer) rstateparamsr<r@limit oldest_stateoldest_added_on item_stateitems r+add_state_and_verifier_and_nonce_to_sessionrTks. JJw E  &M,E FF FGOO+: &4*, & !!2B 7E 7??= )*e3  ''-ve}  ))+ ' > D D F 3 JJ/1) "&z"2 3  .|<'IIK-GOOM"5)r)N)loggingrLrbase64rrhashlibrurllib.requestrr django.confr django.core.exceptionsr django.utils.encodingr getLogger__name__rJrrrr"r,r6r>rTrrr_sa 7; 7-   8 $" I, ! 0$M*+/5r