Ë
    OK¸i¯(  ã                   óè   — d dl Z d dlmZ d dlmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZmZ  G d„ de«      Zd„ Z G d„ de«      Z G d„ de«      Zy)é    N)Ú	urlencode)Úauth)ÚSuspiciousOperation)ÚHttpResponseNotAllowedÚHttpResponseRedirect)Úresolve_url)Úreverse)Úget_random_string)Úurl_has_allowed_host_and_scheme)Úimport_string)ÚView)Ú
absolutifyÚ+add_state_and_verifier_and_nonce_to_sessionÚgenerate_code_challengeÚimport_from_settingsc                   óX   — e Zd ZdZdgZed„ «       Zed„ «       Zed„ «       Z	d„ Z
d„ Zd„ Zy	)
ÚOIDCAuthenticationCallbackViewz1OIDC client authentication callback HTTP endpointÚgetc                 ó   — t        | g|¢­Ž S ©N©r   ©ÚattrÚargss     úP/var/www/aura-ras/venv/lib/python3.12/site-packages/mozilla_django_oidc/views.pyÚget_settingsz+OIDCAuthenticationCallbackView.get_settings   ó   € ä# DÐ0¨4Ò0Ð0ó    c                 ó&   — | j                  dd«      S )NÚLOGIN_REDIRECT_URL_FAILUREú/©r   ©Úselfs    r   Úfailure_urlz*OIDCAuthenticationCallbackView.failure_url   s   € à× Ñ Ð!=¸sÓCÐCr   c                 óŒ   — | j                   j                  j                  dd «      }|xs t        | j	                  dd«      «      S )NÚoidc_login_nextÚLOGIN_REDIRECT_URLr!   )ÚrequestÚsessionr   r   r   )r$   Únext_urls     r   Úsuccess_urlz*OIDCAuthenticationCallbackView.success_url#   s?   € ð —<‘<×'Ñ'×+Ñ+Ð,=¸tÓDˆØÒTœ; t×'8Ñ'8Ð9MÈsÓ'SÓTÐTr   c                 ó,   — t        | j                  «      S r   )r   r%   r#   s    r   Úlogin_failurez,OIDCAuthenticationCallbackView.login_failure*   s   € Ü# D×$4Ñ$4Ó5Ð5r   c                 óh  — t        | j                  dd «      }|r|j                  r|| j                  k7  r*t	        j
                  | j                  | j                  «       | j                  dd«      }t        j                  «       |z   | j                  j                  d<   t        | j                  «      S )NÚuserÚ"OIDC_RENEW_ID_TOKEN_EXPIRY_SECONDSi„  Úoidc_id_token_expiration)Úgetattrr)   Úis_authenticatedr0   r   Úloginr   Útimer*   r   r,   )r$   Úrequest_userÚexpiration_intervals      r   Úlogin_successz,OIDCAuthenticationCallbackView.login_success-   s•   € ô ˜tŸ|™|¨V°TÓ:ˆáØ×0Ò0Ø˜tŸy™yÒ(ä�J‰J�t—|‘| T§Y¡YÔ/ð #×/Ñ/Ø0°'ó
Ðô �I‰I‹KÐ-Ñ-ð 	�‰×ÑÐ7Ñ8ô $ D×$4Ñ$4Ó5Ð5r   c                 ó–  — |j                   j                  d«      rÄd|j                   v rcd|j                  v rU|j                   d   |j                  d   v r7|j                  d   |j                   d   = |j                  j                  «        |j                  j
                  rt        j                  |«       |j                  j
                  rJ ‚| j                  «       S d|j                   v �rLd|j                   v �r=d|j                  vr| j                  «       S |j                   j                  d«      }||j                  d   vrd}t        |«      ‚|j                  d   |   j                  d«      }|j                  d   |   d   }|j                  d   |= |j                  j                  «        |j                  j                  |j                  j                  «      |_        |||dœ}t        j                  d	i |¤Ž| _        | j                  r&| j                  j                  r| j                  «       S | j                  «       S )
z1Callback handler for OIDC authorization code flowÚerrorÚstateÚoidc_statesÚcodez7OIDC callback state not found in session `oidc_states`!Úcode_verifierÚnonce)r)   r@   r?   © )ÚGETr   r*   Úsaver0   r4   r   Úlogoutr.   r   Ú	__class__Úsession_keyÚauthenticateÚ	is_activer9   )r$   r)   r<   Úmsgr?   r@   Úkwargss          r   r   z"OIDCAuthenticationCallbackView.getC   só  € ð �;‰;�?‰?˜7Ô#ð ˜7Ÿ;™;Ñ&Ø! W§_¡_Ñ4Ø—K‘K Ñ(¨G¯O©O¸MÑ,JÑJà—O‘O MÑ2°7·;±;¸wÑ3GÐHØ—‘×$Ñ$Ô&ð �|‰|×,Ò,Ü—‘˜GÔ$Ø—|‘|×4Ò4Ð4Ð4ðN ×!Ñ!Ó#Ð#ðM �w—{‘{Ò" w°'·+±+Ò'=à G§O¡OÑ3Ø×)Ñ)Ó+Ð+ð —K‘K—O‘O GÓ,ˆEØ˜GŸO™O¨MÑ:Ñ:ØO�Ü)¨#Ó.Ð.ð $ŸO™O¨MÑ:¸5ÑA×EÑEÀoÓVˆMØ—O‘O MÑ2°5Ñ9¸'ÑBˆEØ—‘ Ñ.¨uÐ5ð �O‰O× Ñ Ô"ð
 &Ÿo™o×7Ñ7¸¿¹×8SÑ8SÓTˆGŒOð #ØØ!.ñˆFô ×)Ñ)Ñ3¨FÑ3ˆDŒIà�yŠy˜TŸY™Y×0Ò0Ø×)Ñ)Ó+Ð+Ø×!Ñ!Ó#Ð#r   N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__Úhttp_method_namesÚstaticmethodr   Úpropertyr%   r,   r.   r9   r   rA   r   r   r   r      sZ   „ Ù;à˜Ðàñ1ó ð1ð ñDó ðDð ñUó ðUò6ò6ó,=$r   r   c                 ó  — | j                   j                  |«      }|re|t        d| j                  «       «      dœ}t	        t        dg «      «      }|j                  | j                  «       «       ||d<   t        di |¤Ž}|r|S y)a4  Retrieves next url from request

    Note: This verifies that the url is safe before returning it. If the url
    is not safe, this returns None.

    :arg HttpRequest request: the http request
    :arg str redirect_field_name: the name of the field holding the next url

    :returns: safe url or None

    ÚOIDC_REDIRECT_REQUIRE_HTTPS)ÚurlÚrequire_httpsÚOIDC_REDIRECT_ALLOWED_HOSTSÚallowed_hostsNrA   )rB   r   r   Ú	is_secureÚlistÚappendÚget_hostr   )r)   Úredirect_field_namer+   rJ   ÚhostsÚis_safes         r   Úget_next_urlr_   ƒ   s†   € ð �{‰{�‰Ð2Ó3€HÙàÜ1Ø-¨w×/@Ñ/@Ó/Bóñ
ˆô Ô)Ð*GÈÓLÓMˆØ�‰�W×%Ñ%Ó'Ô(Ø"'ˆˆÑä1Ñ;°FÑ;ˆÙØˆOØr   c                   óD   ‡ — e Zd ZdZdgZˆ fd„Zed„ «       Zd„ Zd„ Z	ˆ xZ
S )ÚOIDCAuthenticationRequestViewz(OIDC client authentication HTTP endpointr   c                 ó„   •— t        t        | �
  |i |¤Ž | j                  d«      | _        | j                  d«      | _        y )NÚOIDC_OP_AUTHORIZATION_ENDPOINTÚOIDC_RP_CLIENT_ID)Úsuperra   Ú__init__r   ÚOIDC_OP_AUTH_ENDPOINTrd   )r$   r   rJ   rE   s      €r   rf   z&OIDCAuthenticationRequestView.__init__§   s@   ø€ ÜÔ+¨TÑ;¸TÐLÀVÒLà%)×%6Ñ%6Ð7WÓ%XˆÔ"Ø!%×!2Ñ!2Ð3FÓ!GˆÕr   c                 ó   — t        | g|¢­Ž S r   r   r   s     r   r   z*OIDCAuthenticationRequestView.get_settings­   r   r   c           	      ój  — t        | j                  dd«      «      }| j                  dd«      }| j                  dd«      }d| j                  dd	«      | j                  t        |t	        |«      «      |d
œ}|j                  | j                  |«      «       | j                  dd«      r.t        | j                  dd«      «      }|j                  d|i«       | j                  dd«      rr| j                  dd«      }d|cxk  rdk  st        d«      ‚ t        d«      ‚t        |«      }| j                  dd«      }	t        ||	«      }
|j                  |
|	dœ«       nd}t        ||||«       t        ||«      |j                  d<   t        |«      }dj                  | j                  |¬«      }t        |«      S )z7OIDC client authentication initialization HTTP endpointÚOIDC_STATE_SIZEé    ÚOIDC_REDIRECT_FIELD_NAMEÚnextÚ OIDC_AUTHENTICATION_CALLBACK_URLÚoidc_authentication_callbackr>   ÚOIDC_RP_SCOPESzopenid email)Úresponse_typeÚscopeÚ	client_idÚredirect_urir<   ÚOIDC_USE_NONCETÚOIDC_NONCE_SIZEr@   ÚOIDC_USE_PKCEFÚOIDC_PKCE_CODE_VERIFIER_SIZEé@   é+   é€   z/code_verifier_length must be between 43 and 128ÚOIDC_PKCE_CODE_CHALLENGE_METHODÚS256)Úcode_challengeÚcode_challenge_methodNr'   z{url}?{query})rT   Úquery)r
   r   rd   r   r	   ÚupdateÚget_extra_paramsÚ
ValueErrorr   r   r_   r*   r   Úformatrg   r   )r$   r)   r<   r\   Úreverse_urlÚparamsr@   Úcode_verifier_lengthr?   r   r~   r€   Úredirect_urls                r   r   z!OIDCAuthenticationRequestView.get±   s×  € ä! $×"3Ñ"3Ð4EÀrÓ"JÓKˆØ"×/Ñ/Ð0JÈFÓSÐØ×'Ñ'Ø.Ð0Nó
ˆð
 $Ø×&Ñ&Ð'7¸ÓHØ×/Ñ/Ü& w´¸Ó0DÓEØñ
ˆð 	�‰�d×+Ñ+¨GÓ4Ô5à×ÑÐ-¨tÔ4Ü% d×&7Ñ&7Ð8IÈ2Ó&NÓOˆEØ�M‰M˜7 EÐ*Ô+à×Ñ˜_¨eÔ4Ø#'×#4Ñ#4Ð5SÐUWÓ#XÐ ð Ð.Ô5°#Ò5Ü Ð!RÓSÐSð 6Ü Ð!RÓSÐSô .Ð.BÓCˆMØ$(×$5Ñ$5Ø1°6ó%Ð!ô 5ØÐ4óˆNð
 �M‰Mà&4Ø-Bñõð !ˆMä3Ø�U˜F Mô	
ô .:¸'ÐCVÓ-Wˆ�‰Ð)Ñ*ä˜&Ó!ˆØ&×-Ñ-Ø×*Ñ*°%ð .ó 
ˆô $ LÓ1Ð1r   c                 ó&   — | j                  di «      S )NÚOIDC_AUTH_REQUEST_EXTRA_PARAMSr"   ©r$   r)   s     r   r‚   z.OIDCAuthenticationRequestView.get_extra_paramsî   s   € Ø× Ñ Ð!AÀ2ÓFÐFr   )rK   rL   rM   rN   rO   rf   rP   r   r   r‚   Ú__classcell__)rE   s   @r   ra   ra   ¢   s4   ø„ Ù2à˜ÐôHð ñ1ó ð1ò;2özGr   ra   c                   óD   — e Zd ZdZddgZed„ «       Zed„ «       Zd„ Z	d„ Z
y)	ÚOIDCLogoutViewzLogout helper viewr   Úpostc                 ó   — t        | g|¢­Ž S r   r   r   s     r   r   zOIDCLogoutView.get_settings÷   r   r   c                 ó8   — t        | j                  dd«      «      S )z*Return the logout url defined in settings.ÚLOGOUT_REDIRECT_URLr!   )r   r   r#   s    r   rˆ   zOIDCLogoutView.redirect_urlû   s   € ô ˜4×,Ñ,Ð-BÀCÓHÓIÐIr   c                 óÐ   — | j                   }|j                  j                  r:| j                  dd«      }|r t	        |«      |«      }t        j                  |«       t        |«      S )úLog out the user.ÚOIDC_OP_LOGOUT_URL_METHODÚ )rˆ   r0   r4   r   r   r   rD   r   )r$   r)   Ú
logout_urlÚlogout_from_ops       r   r�   zOIDCLogoutView.post   s\   € à×&Ñ&ˆ
à�<‰<×(Ò(ð "×.Ñ.Ð/JÈBÓOˆNÙØ:œ]¨>Ó:¸7ÓC�
ô �K‰K˜Ô ä# JÓ/Ð/r   c                 ó`   — | j                  dd«      r| j                  |«      S t        dg«      S )r”   ÚALLOW_LOGOUT_GET_METHODFÚPOST)r   r�   r   r‹   s     r   r   zOIDCLogoutView.get  s/   € à×ÑÐ6¸Ô>Ø—9‘9˜WÓ%Ð%Ü% v hÓ/Ð/r   N)rK   rL   rM   rN   rO   rP   r   rQ   rˆ   r�   r   rA   r   r   rŽ   rŽ   ò   sA   „ Ùà ˜Ðàñ1ó ð1ð ñJó ðJò0ó 0r   rŽ   )r6   Úurllib.parser   Údjango.contribr   Údjango.core.exceptionsr   Údjango.httpr   r   Údjango.shortcutsr   Údjango.urlsr	   Údjango.utils.cryptor
   Údjango.utils.httpr   Údjango.utils.module_loadingr   Údjango.views.genericr   Úmozilla_django_oidc.utilsr   r   r   r   r   r_   ra   rŽ   rA   r   r   ú<module>r§      sa   ðÛ Ý "å Ý 6ß DÝ (Ý Ý 1Ý =Ý 5Ý %÷ó ôj$ Tô j$òZô>MG Dô MGô`"0�Tõ "0r   