o 6Wj@sUddlmZddlZddlZddlmZmZddlmZddl Z ddl m Z ddl m Z dd lmZd gZeeZd ed <eZeZd ed<dddZd ddZd!ddZGdd d e jZdS)") annotationsN) GeneratorAsyncGenerator)override) TokenCache)asyncify)OAUTH_API_BETA_HEADERAccessTokenAuthzlogging.Loggerlogzset[str]_warn_once_seenkeystrmessageargsobjectreturnNonecGs^t|tvr WddSt|Wdn1swYtj|g|RdS)z8Emit a log warning at most once per ``key`` per process.N)_warn_once_lockr addr warning)rrrrn/home/esfera/Documents/content_generation/venv/lib/python3.10/site-packages/anthropic/lib/credentials/_auth.py _warn_onces rparamcCstd|d|dS)agWarn that an explicit ``api_key=`` / ``auth_token=`` argument shadows an explicit ``credentials=`` provider passed to the same constructor or ``copy()`` call. The static credential wins at the request-header level (``AccessTokenAuth.sync_auth_flow`` short-circuits on the pre-set header), which silently disables the credentials provider. zexplicit-shadow:z`%s=` was passed alongside `credentials=`; the static credential takes precedence and the credentials provider is silently disabled. Pass only one.Nr)rrrr(warn_explicit_static_shadows_credentialss renv_varcCstd|d||dS)aWarn that an ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` from the environment is shadowing the SDK's profile / federation auto-discovery. Per the credential-precedence spec, a static-credential env var silently disables the auto-discovered federation and profile paths. Surface a one-shot warning so migrating users can see why their ``ANTHROPIC_PROFILE`` or WIF env vars are being ignored. z env-shadow:z%s is set and takes precedence over the SDK's profile / federation auto-discovery; unset %s to use the auto-discovered credential.Nr)rrrr&warn_env_static_shadows_auto_discovery/s  rc@sReZdZdZdZdddZedd d ZdddZe dddZ e dddZ dS)r uAdapts a :class:`TokenCache` to httpx's :class:`~httpx.Auth` protocol. Used by :meth:`anthropic.Anthropic.custom_auth` to inject ``Authorization: Bearer`` plus the OAuth beta header on every request, with proactive refresh handled by :class:`TokenCache`. Static credentials shadow federation: if the outgoing request already carries an ``X-Api-Key`` or ``Authorization`` header (set by the client's api_key / auth_token path), this auth flow is a no-op. That matches the Go SDK's ``authMiddleware`` and the documented precedence in the WIF user guide — a static ``ANTHROPIC_API_KEY`` shadows any credentials provider. F token_cacherrrcCs ||_dSN) _token_cache)selfr rrr__init__Qs zAccessTokenAuth.__init__request httpx.RequestboolcCst|jdp |jdS)Nz X-Api-Key Authorization)r'headersget)r%rrr_has_static_credentialTsz&AccessTokenAuth._has_static_credentialtokenrcCs\d||jd<|jdd}dd|dD}t|vr,|td||jd<dSdS) NzBearer r(zanthropic-betacSsg|] }|r|qSr)strip).0flagrrr csz*AccessTokenAuth._apply..,z, )r)r*splitr appendjoin)r#r%r, existing_betaexisting_flagsrrr_applyXs  zAccessTokenAuth._apply.Generator[httpx.Request, httpx.Response, None]ccs6||r |VdS|j}||||VdSr!)r+r" get_tokenr8r#r%r,rrrsync_auth_flowhs    zAccessTokenAuth.sync_auth_flow-AsyncGenerator[httpx.Request, httpx.Response]cCs@||r |VdSt|jjIdH}||||VdSr!)r+r r"r:r8r;rrrasync_auth_flowqs   zAccessTokenAuth.async_auth_flowN)r rrr)r%r&rr')r%r&r,rrr)r%r&rr9)r%r&rr=) __name__ __module__ __qualname____doc__requires_response_bodyr$ staticmethodr+r8rr<r>rrrrr As    )rrrrrrrr)rrrr)rrrr) __future__rlogging threadingtypingrrtyping_extensionsrhttpx_cacher_utilsr _constantsr __all__ getLoggerr?r __annotations__Lockrsetr rrrAuthr rrrrs"