o ejl2@sddlmZddlZddlZddlmZmZmZmZddl m Z ddl m Z m Z ddlZddlmZddlmZmZmZdd lmZd Zd Zd Zd ddZGdddeZGdddeZ d2d3ddZ d4dddddddd5d)d*Z +d6ddd,d7d.d/ZGd0d1d1Z dS)8) annotationsN)AnyCallable TypedDictcast)Path)Literal NotRequired)DefaultHttpx2Client) OAuthError OpenAIErrorSubjectTokenProviderError) to_threadz/urn:ietf:params:oauth:grant-type:token-exchangez#https://auth.openai.com/oauth/tokeniz$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token)jwtidc@seZdZUded<ded<dS)SubjectTokenProviderzLiteral['jwt', 'id'] token_typezCallable[[], str] get_tokenN)__name__ __module__ __qualname____annotations__rrU/var/www/html/choboyeo/PHP/venv/lib/python3.10/site-packages/openai/auth/_workload.pyrs  rc@s8eZdZUdZded< ded< ded< ded<d S) WorkloadIdentityz(Identity provider resource id in WIFAPI.stridentity_provider_idservice_account_idrproviderzNotRequired[float]refresh_buffer_secondsN)rrr__doc__rrrrrrs  r3/var/run/secrets/kubernetes.io/serviceaccount/tokentoken_file_path str | Pathreturncsdfdd }d|dS) aK Get a subject token provider for Kubernetes clusters with Workload Identity configured. Cloud providers typically mount the subject token as a file in the container. Args: token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. r%rc sz+td}|}|stdd|WdWS1s$wYWdStyB}z tdd||d}~ww)NrzThe token file at z is empty.z!Failed to read the token file at z: )openreadstripr Exception)ftokener#rrr9s  (z5k8s_service_account_token_provider..get_tokenrrrNr%rr)r#rrr.r"k8s_service_account_token_provider-s r1https://management.azure.com/z 2018-02-01$@) object_id client_id msi_res_id api_versiontimeout http_clientresourcerr4 str | Noner5r6r7r8floatr9httpx.Client | Nonecs$dfdd }d|dS) a Get a subject token provider for Azure Managed Identities. See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http Args: resource: the resource URI to request a token for. Defaults to `https://management.azure.com/` (Azure Resource Manager). object_id: the object ID of the managed identity to use, when multiple are assigned. client_id: the client ID of the managed identity to use, when multiple are assigned. msi_res_id: the ARM resource ID of the managed identity to use, when multiple are assigned. api_version: the Azure IMDS API version. Defaults to `2018-02-01`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. r%rc szrd}d}dur|d<dur|d<dur |d<dur0j||ddid}nt}|j||ddid}Wdn1sJwY|jr\td |j|d |}|d }|smtd |d tt|WSt y}ztd ||d}~ww)Nz5http://169.254.169.254/metadata/identity/oauth2/token)z api-versionr:r4r5r6Metadatatrueparamsheadersr8z4Failed to fetch Azure subject token from IMDS: HTTP response access_tokenz3Azure IMDS response did not include an access_tokenz/Failed to fetch Azure subject token from IMDS: ) gethttpxClientis_errorr status_codejsonrrr*)urlrArDclientdatar,r-r7r5r9r6r4r:r8rrr_s<     z8azure_managed_identity_token_provider..get_tokenrr/Nr0r)r:r4r5r6r7r8r9rrrOr%azure_managed_identity_token_providerFs rPhttps://api.openai.com/v1)r8r9audiencecsdfdd }d|dS) a5 Get a subject token provider for GCP VM instances using the instance metadata server. See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity Args: audience: the unique URI agreed upon by both the instance and the system verifying the instance's identity. Defaults to `https://api.openai.com/v1`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. r%rc szRd}di}durj||ddid}nt}|j||ddid}Wdn1s1wY|jrCtd|j|d|j}|sPtd|d|WStyf}ztd ||d}~ww) Nz]http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identityrRzMetadata-FlavorGoogler@z=Failed to fetch GCP subject token from metadata server: HTTP rCz+GCP metadata server returned an empty tokenz8Failed to fetch GCP subject token from metadata server: ) rFrGrHrIrrJtextr)r*)rLrArDrMr,r-rRr9r8rrrs*    z(gcp_id_token_provider..get_tokenrr/Nr0r)rRr8r9rrrUrgcp_id_token_providers rVc@seZdZeddd)d d Zd*d d Zd*ddZd+ddZd+ddZd,ddZ d-ddZ d*ddZ d.ddZ d.d d!Z d.d"d#Zd/d&d'Zd(S)0WorkloadIdentityAuthF)token_exchange_url _use_httpx2workload_identityrrXrrYboolcCsF||_||_||_d|_d|_d|_d|_t|_ t |j |_ dSNF) rZrXrY _cached_token"_cached_token_expires_at_monotonic"_cached_token_refresh_at_monotonic _refreshing threadingLock_lock Condition _condition)selfrZrXrYrrr__init__s zWorkloadIdentityAuth.__init__r%cCs|jX|jr|r|j|jr|s |s,|s,tt|jWdS|jrQ|jr:|j|js2|j}|rEt dtt|WdSd|_Wdn1s^wYz`| |j2|rtt dtt|jWdW|jd|_|j WdS1swYS1swYW|jd|_|j WddS1swYdS|jd|_|j Wdw1swYw)Nz)Token is unusable after refresh completedTF) rcr`_token_unusablerewait_needs_refreshrrr] RuntimeError_perform_refresh notify_all)rfr,rrrrsJ      * zWorkloadIdentityAuth.get_tokencst|jIdHSN)rrrfrrrget_token_asyncsz$WorkloadIdentityAuth.get_token_asyncNonecCs>|jd|_d|_d|_WddS1swYdSrn)rcr]r^r_rorrrinvalidate_tokens "z%WorkloadIdentityAuth.invalidate_tokencCsh|}t}|d}|j|d|_|||_||||_WddS1s-wYdS)N expires_inrE)_fetch_token_from_exchangetime monotonicrcr]r^_refresh_delay_secondsr_)rf token_datanowrsrrrrls  "z%WorkloadIdentityAuth._perform_refreshdict[str, Any]c Cs|}|jdd}t|}|dur#td|ddt|jr+tddnt }|"}|j |j t |||jd|jd d d d }||WdS1sVwYdS) NrrzUnsupported token type: z. Supported types: z, F)follow_redirectsrr) grant_type subject_tokensubject_token_typerrr3)rKr8)_get_subject_tokenrZSUBJECT_TOKEN_TYPESrFr joinkeysrYr rGrHpostrXTOKEN_EXCHANGE_GRANT_TYPE_handle_token_response)rfr}rr~exchange_clientrMrDrrrrts*  $z/WorkloadIdentityAuth._fetch_token_from_exchangerDhttpx.ResponsecCsz |jr|nd}Wn tyd}Ynw|jdvr"t||d|jrT|dur-td|d}|d}t|t r>|sBtdt|t t fsMtd|t |dStd |j) N)iii)rDbodyz4Token exchange succeeded but response body was emptyrErszThe workload identity provider returned an empty subject token)rZr )rfrr}rrrr"s  z'WorkloadIdentityAuth._get_subject_tokencCs|jdup|Srn)r]_token_expiredrorrrrh)sz$WorkloadIdentityAuth._token_unusablecC|jdurdSt|jkS)NT)r^rurvrorrrr, z#WorkloadIdentityAuth._token_expiredcCrr\)r_rurvrorrrrj1rz#WorkloadIdentityAuth._needs_refreshrsr<cCs*|jdt}t||d}t||dS)Nr r g)rZrFDEFAULT_REFRESH_BUFFER_SECONDSminmax)rfrsconfigured_buffereffective_bufferrrrrw6sz+WorkloadIdentityAuth._refresh_delay_secondsN)rZrrXrrYr[r0)r%rq)r%rz)rDrr%rz)r%r[)rsr<r%r<)rrrDEFAULT_TOKEN_EXCHANGE_URLrgrrprrrlrtrrrhrrjrwrrrrrWs         rW)r")r#r$r%r)r2)r:rr4r;r5r;r6r;r7rr8r<r9r=r%r)rQ)rRrr8r<r9r=r%r)! __future__rruratypingrrrrpathlibrtyping_extensionsrr rG_httpx2r _exceptionsr r r _utils._syncrrrrrrrr1rPrVrWrrrrsF     =,