o Tj=@sUddlmZddlZddlZddlmZmZmZmZm Z m Z ddl m Z ddl mZmZmZmZddlZddlmZddlmZmZdd lmZmZmZdd lmZd Zd Zd Z dddZ!Gddde Z"Gddde Z#e#Z$de%d<Gddde Z&ede#e&Z'dddAd!d"Z( #dBdCd&d'Z) (dDdddd)d*dd+dEd6d7Z* 8dFd*dd9dGd;d<Z+Gd=d>d>ee'Z,Gd?d@d@e,e#Z-dS)H) annotationsN)AnyGenericTypeVarCallable TypedDictcast)Path)Literal TypeAlias NotRequiredoverride)is_dict)DefaultHttpx2Client_loaded_legacy_httpx) OAuthError OpenAIErrorSubjectTokenProviderError) to_threadz/urn:ietf:params:oauth:grant-type:token-exchangez#https://auth.openai.com/oauth/tokeniz$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token)jwtidc@seZdZUded<ded<dS)SubjectTokenProviderzLiteral['jwt', 'id'] token_typezCallable[[], str] get_tokenN)__name__ __module__ __qualname____annotations__rrX/home/dinkstrade/pdmp-scanner/venv/lib/python3.10/site-packages/openai/auth/_workload.pyrs  rc@s8eZdZUdZded< ded< ded< ded<d S) WorkloadIdentityz(Identity provider resource id in WIFAPI.stridentity_provider_idservice_account_idrproviderNotRequired[float]refresh_buffer_secondsNrrr__doc__rrrrr r!s  r!r SubjectTokenWorkloadIdentityc@s2eZdZUdZded<ded<ded<ded<d S) X509WorkloadIdentityzJAuthenticate with the client certificate configured on the HTTP transport.zLiteral['x509']typer"r#r$r&r'Nr(rrrr r+1s  r+_WorkloadIdentityT)r'r#r"r$r' float | NonereturncCs d||d}|dur||d<|S)zHConfigure X.509 workload identity without handling certificate material.x509)r,r#r$Nr'r)r#r$r'identityrrr x509_workload_identity=sr23/var/run/secrets/kubernetes.io/serviceaccount/tokentoken_file_path str | Pathcsdfdd }d|dS) aK Get a subject token provider for Kubernetes clusters with Workload Identity configured. Cloud providers typically mount the subject token as a file in the container. Args: token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. r/r"c sz+td}|}|stdd|WdWS1s$wYWdStyB}z tdd||d}~ww)NrzThe token file at z is empty.z!Failed to read the token file at z: )openreadstripr Exception)ftokener4rr rZs  (z5k8s_service_account_token_provider..get_tokenrrrNr/r"r)r4rrr>r "k8s_service_account_token_providerNs rAhttps://management.azure.com/z 2018-02-01$@) object_id client_id msi_res_id api_versiontimeout http_clientresourcerD str | NonerErFrGrHfloatrIhttpx2.Client | Nonecs$dfdd }d|dS) a Get a subject token provider for Azure Managed Identities. See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http Args: resource: the resource URI to request a token for. Defaults to `https://management.azure.com/` (Azure Resource Manager). object_id: the object ID of the managed identity to use, when multiple are assigned. client_id: the client ID of the managed identity to use, when multiple are assigned. msi_res_id: the ARM resource ID of the managed identity to use, when multiple are assigned. api_version: the Azure IMDS API version. Defaults to `2018-02-01`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx2.Client instance to use for requests. If not provided, a new client will be created for each request. r/r"c szrd}d}dur|d<dur|d<dur |d<dur0j||ddid}nt}|j||ddid}Wdn1sJwY|jr\td |j|d |}|d }|smtd |d tt|WSt y}ztd ||d}~ww)Nz5http://169.254.169.254/metadata/identity/oauth2/token)z api-versionrJrDrErFMetadatatrueparamsheadersrHz4Failed to fetch Azure subject token from IMDS: HTTP response access_tokenz3Azure IMDS response did not include an access_tokenz/Failed to fetch Azure subject token from IMDS: ) gethttpx2Clientis_errorr status_codejsonrr"r:)urlrQrTclientdatar<r=rGrErIrFrDrJrHrr rs<     z8azure_managed_identity_token_provider..get_tokenrr?Nr@r)rJrDrErFrGrHrIrrr_r %azure_managed_identity_token_providergs r`https://api.openai.com/v1)rHrIaudiencecsdfdd }d|dS) a6 Get a subject token provider for GCP VM instances using the instance metadata server. See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity Args: audience: the unique URI agreed upon by both the instance and the system verifying the instance's identity. Defaults to `https://api.openai.com/v1`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx2.Client instance to use for requests. If not provided, a new client will be created for each request. r/r"c szRd}di}durj||ddid}nt}|j||ddid}Wdn1s1wY|jrCtd|j|d|j}|sPtd|d|WStyf}ztd ||d}~ww) Nz]http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identityrbzMetadata-FlavorGooglerPz=Failed to fetch GCP subject token from metadata server: HTTP rSz+GCP metadata server returned an empty tokenz8Failed to fetch GCP subject token from metadata server: ) rVrWrXrYrrZtextr9r:)r\rQrTr]r<r=rbrIrHrr rs*    z(gcp_id_token_provider..get_tokenrr?Nr@r)rbrHrIrrrer gcp_id_token_providers rfc@seZdZeddd5d d Zd6d dZd6ddZd7d8ddZd9ddZd:ddZ d;ddZ dd'd(Z d>d)d*Zd>d+d,Zd?d-d.Zd@d1d2ZdAd3d4ZdS)B_WorkloadIdentityAuthTtoken_exchange_url _use_httpx2workload_identityr-rir"rjboolr/NonecCsL||_||_||_d|_d|_d|_d|_d|_t |_ t |j |_ dSNF) rkrirj_follow_redirects _cached_token"_cached_token_expires_at_monotonic"_cached_token_refresh_at_monotonic _refreshing threadingLock_lock Condition _conditionselfrkrirjrrr __init__s z_WorkloadIdentityAuth.__init__cCs|jX|jr|r|j|jr|s |s,|s,tt|jWdS|jrQ|jr:|j|js2|j}|rEt dtt|WdSd|_Wdn1s^wYz`| |j2|rtt dtt|jWdW|jd|_|j WdS1swYS1swYW|jd|_|j WddS1swYdS|jd|_|j Wdw1swYw)Nz)Token is unusable after refresh completedTF) rvrs_token_unusablerxwait_needs_refreshrr"rp RuntimeError_perform_refresh notify_allrzr<rrr rsJ      * z_WorkloadIdentityAuth.get_tokencst|jIdHSN)rrrzrrr get_token_asyncsz%_WorkloadIdentityAuth.get_token_asyncNr<rKcCsb|j$|dur|j|kr WddSd|_d|_d|_WddS1s*wYdSr)rvrprqrrrrrr invalidate_tokens"z&_WorkloadIdentityAuth.invalidate_tokencCs|}||dSr)_fetch_token_from_exchange _store_token)rz token_datarrr r sz&_WorkloadIdentityAuth._perform_refreshrdict[str, Any]cCs`t}|d}|j|d|_|||_||||_WddS1s)wYdS)N expires_inrU)time monotonicrvrprq_refresh_delay_secondsrr)rzrnowrrrr rs  "z"_WorkloadIdentityAuth._store_tokencCstd)Nz>Workload identity authentication must implement token exchange)NotImplementedErrorrrrr rsz0_WorkloadIdentityAuth._fetch_token_from_exchangerThttpx2.ResponsecCsz |jr|nd}Wn tyd}Ynw|jdvr"t||d|jrR|dur-tdt|s5td|d}|d}t |t rF|sJtd|| |dStd |j) N)iii)rTbodyz4Token exchange succeeded but response body was emptyz@Token exchange succeeded but response body was not a JSON objectrUrzPreserve the established subject-token request retry behavior.Trrzrrrr _can_retry_requestJsz(_WorkloadIdentityAuth._can_retry_requestcCr)rNrrrrr _prepare_retry_requestOsz,_WorkloadIdentityAuth._prepare_retry_request)rkr-rir"rjrlr/rmr@r)r<rKr/rm)r/rm)rrr/rmr/r)rTrr/r)rrr/rL)r/rl)rrLr/rL)rrr/rl)rrr/rm)rrrDEFAULT_TOKEN_EXCHANGE_URLr{rrrrrrrrr|rr~rrrrrrr rgs$            rgcs>eZdZedddfd d ZedddZdddZZS)WorkloadIdentityAuthTrhrkr!rir"rjrlr/rmcstj|||ddS)N)rkrirj)superr{ry __class__rr r{Us  zWorkloadIdentityAuth.__init__rc Cs|}|jdd}t|}|dur#td|ddt|js)tnd}|dur3| nt dd}|"}|j |j t |||jd|jd d d d }||WdS1s_wYdS) Nr%rzUnsupported token type: z. Supported types: z, F)follow_redirectsr#r$) grant_type subject_tokensubject_token_typer#r$rC)r[rH)_get_subject_tokenrkSUBJECT_TOKEN_TYPESrVrjoinkeysrjrrXrpostriTOKEN_EXCHANGE_GRANT_TYPEr)rzrrr legacy_httpxexchange_clientr]rTrrr rbs.  $z/WorkloadIdentityAuth._fetch_token_from_exchangecCs$|jd}|d}|std|S)Nr%rz>The workload identity provider returned an empty subject token)rkr)rzr%rrrr r~s  z'WorkloadIdentityAuth._get_subject_token)rkr!rir"rjrlr/rmrr@) rrrrr{r rr __classcell__rrrr rTs r)r#r"r$r"r'r.r/r+)r3)r4r5r/r)rB)rJr"rDrKrErKrFrKrGr"rHrLrIrMr/r)ra)rbr"rHrLrIrMr/r). __future__rrrttypingrrrrrrpathlibr typing_extensionsr r r r rW_utilsr_httpx2rr _exceptionsrrr _utils._syncrrrrrrr!r*rr+r-r2rAr`rfrgrrrrr sV       =,