_j ddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZddlmZddlmZddlZddlmZmZmZmZmZddlmZddlmZdd lmZm Z ed Z!ej"e#Z$gd Z%Gd d e&eZ'e(ej)ej*zej+zZ,de&ddfdZ-e'j.j/e'j0j/gZ1de&ddfdZ2GddeZ3Gdde Z4GddeZ5dS)N)Enum)castDictListOptional TypedDictTypeVar)override) SecretStr)ServerAuthenticationProviderClientAuthProviderClientAuthHeaders UserIdentity AuthError)System)ChromaAuthError)OpenTelemetryGranularity trace_methodT)!TokenAuthenticationServerProviderTokenAuthClientProviderTokenTransportHeaderceZdZdZdZdZdS)rz. Accceptable token transport headers. AuthorizationzX-Chroma-TokenN)__name__ __module__ __qualname____doc__ AUTHORIZATIONX_CHROMA_TOKEN_/var/www/FlaskApp/flask-venv/lib/python3.11/site-packages/chromadb/auth/token_authn/__init__.pyrr(s$$M%NNNr"rtokenreturnctt|}td|DstddS)Nc3(K|] }|tvVdS)N)valid_token_chars).0cs r# z_check_token..:s(99!q%%999999r"zHInvalid token. Must contain only ASCII letters, digits, and punctuation.)strall ValueError)r$ token_strs r# _check_tokenr08sKE I 99y999 9 9  V     r" token_headercL|tvrtd|dtdS)Nz Invalid token transport header: z. Must be one of )allowed_token_headersr.)r1s r#_check_allowed_token_headersr4FsF000 6| 6 63 6 6   10r"cHeZdZdZdeddffd ZedefdZxZ S)rz Client auth provider for token-based auth. Header key will be either "Authorization" or "X-Chroma-Token" depending on `chroma_auth_token_transport_header`. If the header is "Authorization", the token is passed as a bearer token. systemr%Nct||j|_|jdt t |jj|_t|j |jj r9t|jj t|jj |_dStj|_dS)Nchroma_client_auth_credentials)super__init__settings _settingsrequirer r,r8_tokenr0get_secret_value"chroma_auth_token_transport_headerr4r_token_transport_headerr)selfr6 __class__s r#r:z TokenAuthClientProvider.__init__Vs     @AAAFO$R S STT T[1133444 ? = N (B   ,@B,,D ( ( (,@+MD ( ( (r"c|j}|jtjkrd|}|jjt |iS)NBearer )r>r?rArrvaluer )rBvals r# authenticatez$TokenAuthClientProvider.authenticatehsMk**,,  '+?+M M M!C//C  ( . #  r") rrrrrr:r rrH __classcell__rCs@r#rrNsNvN$NNNNNN$ /   X     r"rcveZdZUdZeed<eed<eeed<eeeed<eeed<dS)Userz A simple User class for use in this module only. If you need a generic way to represent a User, please use UserIdentity as this class keeps track of sensitive tokens. idroletenant databasestokensN)rrrrr,__annotations__rrr!r"r#rLrLrse GGG III SMS """" Ir"rLceZdZdZdeddffd Zedeje de e e fde fdZ xZS) ra Server authentication provider for token-based auth. The provider will - On initialization, read the users from the file specified in `chroma_server_authn_credentials_file`. This file must be a well-formed YAML file with a top-level array called `users`. Each user must have an `id` field and a `tokens` (string array) field. - On each request, check the token in the header specified by `chroma_auth_token_transport_header`. If the configured header is "Authorization", the token is expected to be a bearer token. - If the token is valid, the server will return the user identity associated with the token. r6r%Nc t||j|_|jjr8t |jjt |jj|_nt j|_i|_ | }t|dkr,tdddgd|dg|j |d<dSttttjd|d|_|jD]}d|vrt'd d |vrd|d <d |vrdg|d <|dD]^}t)|||j vr:|j ||kr)t'd |d |dd|j |||j |<_dS)N anonymous*r)rMrOrPrNrQ usersrQzUser missing tokensrOrPzToken z+ already in use: wanted to use it for user rMz! but it's already in use by user )r9r:r;r<r@r4rrAr_token_user_mappingread_creds_or_creds_filelenrLrryaml safe_loadjoin_usersr.r0)rBr6credsuserr$rCs r#r:z*TokenAuthenticationServerProvider.__init__s     ? = N (B   ,@B,,D ( (,@+MD (46 --// u::??15% az 222D $U1X . F4:t~dii6F6F'G'G'PQQ K 7 7Dt## !6777t##!$X$&&%(E[!h 7 7U###T555074??$BBB $T BB $ 8 ?BB 37(// 7 7 7r"z.TokenAuthenticationServerProvider.authenticateheadersc d |jj|vrt d|jjd||jj}|jt jkr:|dst dtj dd|}| }t|||j vrt dt|j |d|j |d |j |d  }|S#t$r4}td t!|Yd}~n~d}~wt"$rn}t%j|j}|d }|j}|j}tdt/|jd|d|Yd}~nd}~wwxYwt3jt7jddt;)NzAuthorization header 'z ' not foundrEz(Bearer not found in Authorization headerz^Bearer z%Invalid credentials: Token not found}rMrOrP)user_idrOrPz7TokenAuthenticationServerProvider.authenticate failed: zNTokenAuthenticationServerProvider.authenticate failed: Failed to authenticate z at :gMbP?g{Gzt?)rArFlowerkeysrrr startswithresubstripr0rZrloggerdebugrepr Exception traceback extract_tb __traceback__linenofilenametypertimesleeprandomuniformr) rBrcr$ user_identityetblast_call_stack line_numberrws r#authenticate_or_raisez7TokenAuthenticationServerProvider.authenticate_or_raises $ +17799OO\T-I-O\\\D8>DDFFGE+/C/QQQ'' 22P#$NOOO{B66KKMME    D444 GHHH(07=/6x@259+FM !     LLS$q''SS           %ao66B fO)0K&/H LLY*.q''*:YY@HYYKVYY          N5% ( (   s%EE G:*E?? G: A$G55G:)rrrrrr:rrALLr rr,rrrIrJs@r#rrs  .7v.7$.7.7.7.7.7.7`\8:R:V) T#s(^) ) ) ) X) ) ) ) ) r"r)6loggingr{rlstringryrsenumrtypingrrrrrr overridesr pydanticr r] chromadb.authr r rrrchromadb.configrchromadb.errorsr chromadb.telemetry.opentelemetryrrr getLoggerrro__all__r,rsetdigits ascii_letters punctuationr(r0rrFr r3r4rrLrr!r"r#rs AAAAAAAAAAAAAAAA #"""""++++++  GCLL  8 $ $    & & & & &3 & & &C (<