o G'h5@sddlmZddlmZddlmZddlmZddlmZddlmZddlm Z ddlm Z dd lm Z dd l m Z dd l mZdd l mZdd lmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlm Z ddl!m"Z"ddl!m#Z#e e$e dfZ%de&de&ddfd d!Z' " " "  # "d:d$e(d%e(d&e(d'ee%d(e(d)e(dee e&e&ffd*d+Z) " " "  # "d:d$e(d%e(d&e(d'ee%d(e(d)e(defd,d-Z*de&de&dee&fd.d/Z+de e$dffd0d1Z,d&e(de e$ee$ffd2d3Z-de e$dffd4d5Z.d&e(de e$dffd6d7Z/ " # "d;d'e%d%e(d&e(d(e(d)e(de e&e&e$ff d8d9Z0dS)<)datetime)timezonewrapssplit)Any)Optional)Sequence)Tuple)Union) current_app)g)request) BadRequest)config) CSRFError)FreshTokenRequired)InvalidHeaderError)InvalidQueryParamError)NoAuthorizationError)UserLookupError)custom_verification_for_token)has_user_lookup) user_lookup)verify_token_not_blocklisted)verify_token_type) decode_token)get_unverified_jwt_headersN jwt_headerjwt_datareturncCsP|d}t|tr|std||dStttj}||kr&td||dS)NfreshzFresh token required) isinstanceboolrr timestampnowrutc)rr r"r&r(XC:\Users\shubh\Videos\agent\nova\Lib\site-packages\flask_jwt_extended/view_decorators.py_verify_token_is_fresh"s   r*FToptionalr"refresh locations verify_typeskip_revocation_checkc CstjtjvrdSzt|||||d\}}}Wnty1|s it_it_ddit_ dt_ YdSwt ||t_ |t_|t_|t_ ||fS)aJ Verify that a valid JWT is present in the request, unless ``optional=True`` in which case no JWT is also considered valid. :param optional: If ``True``, do not raise an error if no JWT is present in the request. Defaults to ``False``. :param fresh: If ``True``, require a JWT marked as ``fresh`` in order to be verified. Defaults to ``False``. :param refresh: If ``True``, requires a refresh JWT to access this endpoint. If ``False``, requires an access JWT to access this endpoint. Defaults to ``False`` :param locations: A location or list of locations to look for the JWT in this request, for example ``'headers'`` or ``['headers', 'cookies']``. Defaults to ``None`` which indicates that JWTs will be looked for in the locations defined by the ``JWT_TOKEN_LOCATION`` configuration option. :param verify_type: If ``True``, the token type (access or refresh) will be checked according to the ``refresh`` argument. If ``False``, type will not be checked and both access and refresh tokens will be accepted. :param skip_revocation_check: If ``True``, revocation status of the token will be *not* checked. If ``False``, revocation status of the token will be checked. :return: A tuple containing the jwt_header and the jwt_data if a valid JWT is present in the request. If ``optional=True`` and no JWT is in the request, ``None`` will be returned instead. Raise an exception if an invalid JWT is in the request. N)r,r.r/ loaded_user) rmethodrZexempt_methods_decode_jwt_from_requestrrZ_jwt_extended_jwtZ_jwt_extended_jwt_headerZ_jwt_extended_jwt_userZ_jwt_extended_jwt_location _load_user) r+r"r,r-r.r/r r jwt_locationr(r(r)verify_jwt_in_request-s0 -   r5csfdd}|S)a A decorator to protect a Flask endpoint with JSON Web Tokens. Any route decorated with this will require a valid JWT to be present in the request (unless optional=True, in which case no JWT is also valid) before the endpoint can be called. :param optional: If ``True``, allow the decorated endpoint to be accessed if no JWT is present in the request. Defaults to ``False``. :param fresh: If ``True``, require a JWT marked with ``fresh`` to be able to access this endpoint. Defaults to ``False``. :param refresh: If ``True``, requires a refresh JWT to access this endpoint. If ``False``, requires an access JWT to access this endpoint. Defaults to ``False``. :param locations: A location or list of locations to look for the JWT in this request, for example ``'headers'`` or ``['headers', 'cookies']``. Defaults to ``None`` which indicates that JWTs will be looked for in the locations defined by the ``JWT_TOKEN_LOCATION`` configuration option. :param verify_type: If ``True``, the token type (access or refresh) will be checked according to the ``refresh`` argument. If ``False``, type will not be checked and both access and refresh tokens will be accepted. :param skip_revocation_check: If ``True``, revocation status of the token will be *not* checked. If ``False``, revocation status of the token will be checked. cs$tfdd}|S)Ncs&tt|i|SN)r5r Z ensure_sync)argskwargs)fnr"r-r+r,r/r.r(r) decorators z0jwt_required..wrapper..decoratorr)r9r:r"r-r+r,r/r.)r9r)wrapperszjwt_required..wrapperr()r+r"r,r-r.r/r<r(r;r) jwt_requiredys+ r=cCsDtsdS|tj}t||}|durd|}t|||d|iS)Nz user_lookup returned None for {}r0)rrZidentity_claim_keyrformatr)rr identityuser error_msgr(r(r)r3s    r3c stj}tjtj|dd}|std|dritd|}fdd|D}t |dkrEd d |d |d d }t||d}t |dkrad|d|d d }t ||d}|dfS|}t |dkrd|d|d}t ||d}|dfS)N,zMissing z Headerz,\s*cs g|] }|dkr|qS)rr).0s header_typer(r) s z,_decode_jwt_from_headers.. Missing 'z ' type in 'z' header. Expected 'z: z 'rzBad z header. Expected 'z: ') r header_namerGrheadersgetstriprrlenr)rL auth_headerZ field_valuesZ jwt_headersmsgparts encoded_tokenr(rFr)_decode_jwt_from_headerssB      rUcCs|r tj}tj}tj}n tj}tj}tj}tj |}|s$t d |tj rJtj tjvrJtj |d}|s@tjr@tj |d}|sFtd||fSd}||fS)NzMissing cookie "{}"zMissing CSRF token)rZrefresh_cookie_nameZrefresh_csrf_header_nameZrefresh_csrf_field_nameZaccess_cookie_nameZaccess_csrf_header_nameZaccess_csrf_field_namercookiesrNrr>Z csrf_protectr1Zcsrf_request_methodsrMZcsrf_check_formformr)r,Z cookie_keyZcsrf_header_keyZcsrf_field_keyrTZ csrf_valuer(r(r)_decode_jwt_from_cookiess&  rXcCsdtj}tj}tj|}|std|d||s&td|d|d|t |d}|dfS)NrJz' query paramaterz#Invalid value for query parameter 'z%'. Expected the value to start with '') rZquery_string_nameZquery_string_value_prefixrr7rNr startswithrrP) param_nameprefixvaluerTr(r(r)_decode_jwt_from_query_strings  r^cCshtjstd|r tj}ntj}ztjotj|d}|s tW|dfSty3td |dw)Nz/Invalid content-type. Must be application/json.zMissing "{}" key in json data.) rZis_jsonrrZrefresh_json_keyZjson_keyjsonrNrr>)r,Z token_keyrTr(r(r)_decode_jwt_from_jsons$ r`c st|tr|g}|s tj}g}|D]A}|dkr#||fddfq|dkr/||tfq|dkr;||tfq|dkrK||fddfqtd|d g}d}|D]0\}} z| \} } t| | }|} t | } Wnt y}z |t|WYd}~qYd}~ww|st |d krd j d |dd |d d |d}t |t |d|rt||rt| ||st| |t| ||| | fS)NrVctSr6)rXr(r,r(r)>z*_decode_jwt_from_request..Z query_stringrMr_crar6)r`r(rbr(r)rcHrdrYz' is not a valid locationrIz5Missing JWT in {start_locs} or {end_locs} ({details})z, z; )Z start_locsZend_locsdetailsr)r#strrZtoken_locationappendr^rU RuntimeErrorrrrrPr>joinrr*rr)r-r"r,r.r/Zget_encoded_token_functionslocationerrorsZ decoded_tokenZget_encoded_token_functionrTZ csrf_tokenr4reerr_msgr(rbr)r2*sf           r2)FFFNTF)FTF)1rr functoolsrrertypingrr r r r Zflaskr rrZwerkzeug.exceptionsrZflask_jwt_extended.configrZflask_jwt_extended.exceptionsrrrrrrZ!flask_jwt_extended.internal_utilsrrrrrZflask_jwt_extended.utilsrrrgZ LocationTypedictr*r$r5r=r3rUrXr^r`r2r(r(r(r)s                            M 8 ,