@Xj1@ddlmZddlZddlZddlmZmZmZmZddl m Z ddl m Z m Z ddlZddlmZmZmZddlmZd Zd Zd Zd d dZGddeZGddeZ d ddZ dddddddd ddZ d ddd d!dZGddZy)") annotationsN)AnyCallable TypedDictcast)Path)Literal NotRequired) OAuthError OpenAIErrorSubjectTokenProviderError) to_threadz/urn:ietf:params:oauth:grant-type:token-exchangez#https://auth.openai.com/oauth/tokeniz$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token)jwtidc"eZdZUded<ded<y)SubjectTokenProviderzLiteral['jwt', 'id'] token_typezCallable[[], str] get_tokenN)__name__ __module__ __qualname____annotations__[/var/www/html/content_generation/venv/lib/python3.12/site-packages/openai/auth/_workload.pyrrs$$  rrc@eZdZUdZded< ded< ded< ded<y ) WorkloadIdentityz(Identity provider resource id in WIFAPI.stridentity_provider_idservice_account_idrproviderzNotRequired[float]refresh_buffer_secondsN)rrr__doc__rrrrrrs&2GE""..rrcdfd }d|dS)aK Get a subject token provider for Kubernetes clusters with Workload Identity configured. Cloud providers typically mount the subject token as a file in the container. Args: token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. c td5}|jj}|stdd|cdddS#1swYyxYw#t$r}tdd||d}~wwxYw)NrzThe token file at z is empty.z!Failed to read the token file at z: )openreadstripr Exception)ftokenetoken_file_paths rrz5k8s_service_account_token_provider..get_token8s oos+q(36HHYYc4dee ,++  o+.OP_O``bcdbe,fgmn n os4 A1A  A AAA A6A11A6rrrreturnrr)r/rs` r"k8s_service_account_token_providerr3,so i 88rz 2018-02-01$@) object_id client_id msi_res_id api_versiontimeout http_clientc2dfd }d|dS)a Get a subject token provider for Azure Managed Identities. See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http Args: resource: the resource URI to request a token for. Defaults to `https://management.azure.com/` (Azure Resource Manager). object_id: the object ID of the managed identity to use, when multiple are assigned. client_id: the client ID of the managed identity to use, when multiple are assigned. msi_res_id: the ARM resource ID of the managed identity to use, when multiple are assigned. api_version: the Azure IMDS API version. Defaults to `2018-02-01`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. c d} d}  |d<|d<  |d<  j||ddi }n4tj5}|j||ddi }dddjrt d |j | |j }|jd }|s t d | tt|S#1swYoxYw#t$r}t d ||d}~wwxYw)Nz5http://169.254.169.254/metadata/identity/oauth2/token)z api-versionresourcer5r6r7Metadatatrueparamsheadersr9z4Failed to fetch Azure subject token from IMDS: HTTP response access_tokenz3Azure IMDS response did not include an access_tokenz/Failed to fetch Azure subject token from IMDS: ) gethttpxClientis_errorr status_codejsonrrr+)urlrArDclientdatar-r.r8r6r:r7r5r=r9s rrz8azure_managed_identity_token_provider..get_token^s7 jIC5@h%WF$&/{#$&/{#%'1|$&&??3v TZG[el?m\\^v%zz#fzSYFZdkzlH$  /J8K_K_J`a%==?DHH^,E/IT\U# #$^ j+.]^_]`,abhi i js1A C C%A-CCC C<(C77C<rr0r1r)r=r5r6r7r8r9r:rs``````` r%azure_managed_identity_token_providerrOEs2jj@ i 88r)r9r:c"dfd }d|dS)a5 Get a subject token provider for GCP VM instances using the instance metadata server. See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity Args: audience: the unique URI agreed upon by both the instance and the system verifying the instance's identity. Defaults to `https://api.openai.com/v1`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. c d}di}j||ddi}n4tj5}|j||ddi}dddjrt d|j ||j j}|s t d||S#1swYZxYw#t$r}t d ||d}~wwxYw) Nz]http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identityaudiencezMetadata-FlavorGoogler@z=Failed to fetch GCP subject token from metadata server: HTTP rCz+GCP metadata server returned an empty tokenz8Failed to fetch GCP subject token from metadata server: ) rFrGrHrIrrJtextr*r+) rLrArDrMr-r.rRr:r9s rrz(gcp_id_token_provider..get_tokens sqC (+F&&??3vHY[cGdnu?v\\^v%zz#fGXZbFcmtzuH$  /ST\ThThSij%MM'')E/0]hpqqL$^ s+.fghfi,jkqr r ss/4B4B(AB4(B1-B44 C=C  Crr0r1r)rRr9r:rs``` rgcp_id_token_providerrUs$s.Y 77rcxeZdZed ddZddZddZddZddZddZ ddZ dd Z dd Z dd Z dd Zdd Zy)WorkloadIdentityAuth)token_exchange_urlc||_||_d|_d|_d|_d|_t j|_t j|j|_ yNF) workload_identityrX _cached_token"_cached_token_expires_at_monotonic"_cached_token_refresh_at_monotonic _refreshing threadingLock_lock Condition _condition)selfr[rXs r__init__zWorkloadIdentityAuth.__init__sX "3"4)-@D/@D/!&^^% #--djj9rc|j5|jrG|jr7|jj |jr|jr7|js3|j s#t t|jcdddS|jrs|jr'|jj |jr'|j}|jr tdt t|cdddSd|_ddd |j|j5|jr tdt t|jcddd|j5d|_|jjdddS#1swYxYw#1swYSxYw#1swYnxYw |j5d|_|jjdddy#1swYyxYw#|j5d|_|jjdddw#1swYwxYwxYw)Nz)Token is unusable after refresh completedTF) rbr__token_unusablerdwait_needs_refreshrrr\ RuntimeError_perform_refresh notify_all)rer-s rrzWorkloadIdentityAuth.get_tokens ZZ""t';';'=$$&""t';';'='')$2E2E2GC!3!34 Z&&OO((*&&**'')&'RSSC'Z $D " -  ! ! #'')&'RSSC!3!34 #( **,1Z0  #( **,#( **,sxAG!9G$>G#6G#G3H,5G H,"GG G G%!H,5"H  H), I09"I$ I0$I- )I0cHKt|jd{S7wN)rrres rget_token_asyncz$WorkloadIdentityAuth.get_token_asyncst~~....s " "cp|j5d|_d|_d|_dddy#1swYyxYwro)rbr\r]r^rps rinvalidate_tokenz%WorkloadIdentityAuth.invalidate_tokens+ ZZ!%D 6:D 36:D 3ZZs,5c|j}tj}|d}|j5|d|_||z|_||j |z|_dddy#1swYyxYw)N expires_inrE)_fetch_token_from_exchangetime monotonicrbr\r]_refresh_delay_secondsr^)re token_datanowrus rrlz%WorkloadIdentityAuth._perform_refreshsj446 nn - ZZ!+N!;D 69J6FD 369DThe workload identity provider returned an empty subject token)r[r )rer"r~s rrz'WorkloadIdentityAuth._get_subject_tokens6))*5--/ ^_ _rcB|jduxs|jSro)r\_token_expiredrps rrhz$WorkloadIdentityAuth._token_unusable%s!!!T)BT-@-@-BBrc^|jytj|jk\S)NT)r]rwrxrps rrz#WorkloadIdentityAuth._token_expired(s)  2 2 :~~4#J#JJJrc^|jytj|jk\SrZ)r^rwrxrps rrjz#WorkloadIdentityAuth._needs_refresh-s)  2 2 :~~4#J#JJJrc~|jjdt}t||dz }t ||z dS)Nr#r g)r[rFDEFAULT_REFRESH_BUFFER_SECONDSminmax)reruconfigured_buffereffective_buffers rryz+WorkloadIdentityAuth._refresh_delay_seconds2sB 22667OQop0*q.A: 00#66rN)r[rrXrr1)r2None)r2dict[str, Any])rDzhttpx.Responser2r)r2bool)rurr2r)rrrDEFAULT_TOKEN_EXCHANGE_URLrfrrqrsrlrvrrrhrrjryrrrrWrWs[ #= :,: : -:/; d90 0CK K 7rrW)z3/var/run/secrets/kubernetes.io/serviceaccount/token)r/z str | Pathr2r)zhttps://management.azure.com/)r=rr5 str | Noner6rr7rr8rr9rr:httpx.Client | Noner2r)zhttps://api.openai.com/v1)rRrr9rr:rr2r) __future__rrwr`typingrrrrpathlibrtyping_extensionsr r rG _exceptionsr r r _utils._syncrrrrrrrr3rOrUrWrrrrs7" 112 LL$MB!% 2 5 !9! /y / #X9994499! !#'+999999 99  99  9999%9999z0)8'+ )8)8)8% )8  )8XH7H7r