o 6Wj}@sUddlmZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z m Z m Z mZmZddlmZddlZddlmZmZddlmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,dd l-m.Z.e/e0Z1d e2d <e rdd l3m4Z4gd Z5d*ddZ6dZ7dZ8dZ9dZ:dZ;d+ddZGd$d%d%Z?Gd&d'd'Z@Gd(d)d)e?ZAdS),) annotationsN) TYPE_CHECKINGAnyDictUnionOptionalcast)override) AccessTokenIdentityTokenProvider) ENV_SCOPE ENV_PROFILE ENV_BASE_URLENV_AUTH_TOKENENV_CONFIG_DIRTOKEN_ENDPOINTDEFAULT_BASE_URLENV_WORKSPACE_IDENV_ORGANIZATION_IDOAUTH_API_BETA_HEADERENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_IDTOKEN_EXCHANGE_TIMEOUTENV_IDENTITY_TOKEN_FILEGRANT_TYPE_REFRESH_TOKENMANDATORY_REFRESH_SECONDS _user_agent_require_https_active_profile_config_file_path_credentials_file_pathresolve_identity_token_path)AnthropicErrorzlogging.Loggerlog)WorkloadIdentityCredentials) StaticTokenEnvTokenCredentialsFileInMemoryConfigIdentityTokenFilevaluersourceOptional[pathlib.Path]return Optional[int]c Cs`|durdSzt|WSttfy/}z|durd|nd}t|d|d|d}~ww)z@Parse a credentials-file ``expires_at`` field into Unix seconds.Nzcredentials file at credentialsz has invalid 'expires_at' u; expected an integer Unix timestamp in seconds. The SDK does not parse ISO8601 — convert with int(datetime.timestamp()) before writing the file.)int TypeError ValueErrorr$)r,r-errwherer7s/home/esfera/Documents/content_generation/venv/lib/python3.10/site-packages/anthropic/lib/credentials/_providers.py_coerce_expires_at2s r9 oauth_tokenz1.0oidc_federation user_oauthconfigDict[str, Any]authNonecCsddd }||d t||d t||d t|d }|tkrL||dt||dt||dt|dsHtj t }|rJd|d|d<dSdSdS|t krX||dtdSdS)uFill empty profile fields from corresponding ANTHROPIC_* env vars. The profile file is authoritative — this only fills fields the file left unset. Empty-string env values are treated as unset. targetr>keystrenv_varr/r@cSs.||stj|}|r|||<dSdSdSN)getosenviron)rArBrDvr7r7r8fillUs   z$_fill_missing_from_env..fillbase_urlorganization_id workspace_idtypefederation_rule_idservice_account_idscopeidentity_tokenfile)r-pathN)rAr>rBrCrDrCr/r@) rrrrFAUTH_TYPE_OIDC_FEDERATIONrrr rGrHrAUTH_TYPE_USER_OAUTH)r=r?rJ auth_typerIr7r7r8_fill_missing_from_envNs$          rXc@s*eZdZdZdddZdd dd dZdS)r'zQAn :class:`AccessTokenProvider` that always returns a fixed token with no expiry.tokenrCr/r@cC ||_dSrE)_token)selfrYr7r7r8__init__p zStaticToken.__init__F force_refreshr`boolr cCs~t|jddS)NrY expires_at)r r[)r\r`r7r7r8__call__sszStaticToken.__call__N)rYrCr/r@r`rar/r )__name__ __module__ __qualname____doc__r]rdr7r7r7r8r'ms r'c@s.eZdZdZefdddZdd dd dZdS)r(zQAn :class:`AccessTokenProvider` that reads ``ANTHROPIC_AUTH_TOKEN`` at call time.rDrCr/r@cCrZrE)_env_var)r\rDr7r7r8r]{r^zEnvToken.__init__Fr_r`rar cCs6~tj|j}|durtd|jdt|ddS)NzEnvironment variable zN is not set. Set it or pass an explicit `credentials=` provider to the client.rb)rGrHrFrjr$r )r\r`r,r7r7r8rd~s  zEnvToken.__call__N)rDrCr/r@re)rfrgrhrirr]rdr7r7r7r8r(xsr(c@seZdZdZ d@dddAd d ZedBd dZedCddZedDddZdEddZ dFddZ dGddZ dHddZ dHd d!Z dId#d$ZdJd%d&ZdJd'd(ZdKd*d+ZdHd,d-Zd.d/dLd3d4Zd.d/dMd6d7ZdNd9d:Zd.d/dMd;d<ZdOd>d?ZdS)Pr)uAn :class:`AccessTokenProvider` backed by a named profile. A profile is a pair of files under the config directory (``~/.config/anthropic/`` by default; override with ``ANTHROPIC_CONFIG_DIR``): * ``configs/.json`` — non-secret. Holds the nested ``"authentication"`` object (discriminated by its ``"type"`` field), plus top-level ``organization_id``, ``workspace_id``, and ``base_url``. The ``authentication`` object may contain a ``credentials_path`` field overriding the credentials file location. * ``credentials/.json`` — secret (0600). Holds ``access_token``, ``expires_at``, and (for ``user_oauth`` with a ``client_id``) ``refresh_token``. The split keeps secret material out of files that may need to be readable by config-only consumers, and lets the SDK enforce 0600 on the credentials file without locking out config readers. Dispatches on the ``authentication.type`` discriminator: ``"oidc_federation"`` OIDC workload identity federation. Lazily constructs a :class:`WorkloadIdentityCredentials` delegate from the nested auth fields plus the top-level ``organization_id`` and calls it to perform the jwt-bearer exchange. ``"user_oauth"`` Output of an interactive PKCE login. If the auth block has a ``client_id``, performs ``refresh_token`` grants on expiry and writes the new tokens back to the credentials file (atomic replace, refresh-token rotation supported). Without a ``client_id``, the credentials file is treated as externally rotated — the SDK re-reads it on every invocation and returns whatever ``access_token`` is there, no refresh grant attempted. This is the pattern for a sidecar/daemon that mints the access token out-of-band. Args: profile: Profile name. ``None`` resolves via ``ANTHROPIC_PROFILE`` env → ``/active_config`` pointer file → ``"default"``. N) http_clientprofile Optional[str]rkOptional[httpx.Client]r/r@cCsN|dur|nt|_t|j|_d|_||_d|_d|_d|_t |_ d|_ dSrE) r_profiler _config_path_bound_base_url _http_client_owned_http_client_config_credentials_pathr _base_url_workload_delegate)r\rlrkr7r7r8r]s  zCredentialsFile.__init__rCcC|jSrE)ror\r7r7r8rlzCredentialsFile.profile pathlib.PathcCrxrE)rpryr7r7r8 config_pathrzzCredentialsFile.config_pathcCs(|}|d}|rt|dSdS)uThe ``base_url`` declared in the profile config file, if any. Returns ``None`` when the config has no top-level ``base_url`` key — callers should fall back to their own default rather than the provider's bound/default value, so a profile that *doesn't* pin a host never overrides an explicit client setting. Loads the config on first access. rK/N) _load_configrFrCrstrip)r\r=rawr7r7r8resolved_base_urls z!CredentialsFile.resolved_base_urlrKcCsZ|d}t||jdd||_|jdur+||j|_t|j|jdddSdS)aAdopt the owning client's ``base_url`` as a fallback for the token exchange. Slots between the config file's own ``base_url`` field and the hard-coded default; a ``base_url`` in the config file still wins. The owning client binds exactly once at construction; sharing one instance across clients with different ``base_url`` values is unsupported and silently picks the last bind when the config file doesn't pin a host. r} : base_urlfieldN)rrrprqrt_resolve_base_urlrv)r\rKboundr7r7r8 bind_base_urls  zCredentialsFile.bind_base_urlr=r>cCs0|drt|ddS|jdur|jStS)u+base_url precedence: top-level config field → bound (the owning client's base_url, via :meth:`bind_base_url`) → default. Validated against the scheme/TLS rules so a malicious config with ``base_url="http://evil/"`` can't exfiltrate the assertion or refresh token.rKr}N)rFrCrrqrr\r=r7r7r8rs  z!CredentialsFile._resolve_base_urlDict[str, str]cCs<|}i}|dtkr|d}|rt||d<|S)zReturn headers derived from the config file (e.g. ``workspace_id``). Eagerly reads the config if not yet loaded. The returned dict is suitable for merging into the client's default headers. rNrMzanthropic-workspace-id)r~ _auth_blockrFrUrC)r\r=headersrMr7r7r8 extra_headerss  zCredentialsFile.extra_headersc Cs|jdur|jSz |jjdd}Wn9ty1}ztd|jd|jdtdtd |d}~wtt fyJ}z td |jd ||d}~wwzt |}Wnt j yk}z td |jd ||d}~wwt |tstd |jd t|jd td|}|d}t |tstd |jdtdtdtd|}t|||||_t|j|jdd|d}|rtt||_nt|j|_||_|S)zPRead and cache the config file, resolving ``base_url`` and ``credentials_path``.Nutf-8encodingzConfig file not found at (profile z). Set z' to select a different profile, or set z" to relocate the config directory.zConfig file at  could not be read:  is not valid JSON: z! must contain a JSON object, not .r>authenticationzV is missing the 'authentication' object. Expected shape: {"authentication": {"type": ""|" ", ...}, ...}rrcredentials_path)rtrp read_textFileNotFoundErrorr$rorrOSErrorUnicodeDecodeErrorjsonloadsJSONDecodeError isinstancedictrNrfrrFrUrVrXrrvrpathlibPathrC expanduserrur!)r\rr5 raw_configr=raw_authr?r r7r7r8r~sb           zCredentialsFile._load_configc Cs|jdusJ|j}tjdkr{z tj|dd}Wn/ty1}z td|d|jd|d}~wtyG}z td|d ||d}~wwt|j rVtd|d t |j }|d @rotd|d |d d|d|d@r{t d|||z|j dd}Wn1ty}z td|d|jd|d}~wttfy}z td|d||d}~wwzt|}Wntjy}z td|d||d}~ww|d}|dur|tkr|jdusJ|jdd}td|dtd||S)ujRead the credentials file. Re-reads on every call — daemons rotate it. On Unix, verifies the file is not group/world-readable. World-readable credentials files are refused outright; group-readable files log a warning but are accepted. The check is skipped on Windows where POSIX mode bits don't carry the same meaning. NposixF)follow_symlinkszCredentials file not found at rz).Credentials file at z could not be accessed: zu is a symlink; refusing to follow (move the real file into place to keep secret material on the expected filesystem).z is world-readable (mode z#oz); run `chmod 600 z` before retrying.8zMCredentials file at %s is group-readable (mode %#o); consider `chmod 600 %s`.rrrrrNrzcredentials file has type z ; expected z for authentication.type )rurGnamestatrr$rorS_ISLNKst_modeS_IMODEr%warningrrrrrrFCREDENTIALS_FILE_TYPErt) r\rT file_statr5modercredsactualrWr7r7r8_read_credentialsAsn     z!CredentialsFile._read_credentials httpx.ClientcCs.|jdur|jS|jdurtjtd|_|jS)zFReturn an ``httpx.Client``, lazily creating (and tracking) one we own.N)timeout)rrrshttpxClientrryr7r7r8_get_http_client{s  z CredentialsFile._get_http_clientcCs6|jdur |jd|_|jdur|jdSdS)z3Close the owned ``httpx.Client`` if we created one.N)rscloserwryr7r7r8rs   zCredentialsFile.closecCsd|_d|_dS)aDrop the cached config so the next call re-reads it from disk. ``CredentialsFile`` caches the parsed config across calls to keep the hot path cheap; a daemon that rotates a profile in place (e.g. flips ``"type": "user_oauth"`` to ``"type": "oidc_federation"``) will not be picked up automatically. Callers that need to react to such changes can call ``reload()`` to force a fresh read on the next ``__call__``. N)rtrwryr7r7r8reloads zCredentialsFile.reloaddatac Cs&|jdusJ|jj}|jddddtj|d|jjddd\}}z0z t|dt|t j |d d  d t |Wt |nt |wt||jWntykzt|WtyjYwwzt|tj}zt |Wt |WdSt |wtyYdSw) z;Atomic write to the credentials file (NOT the config file).NTi)parentsexist_okrrz.tmp)dirprefixsuffixi)indentr)ruparentmkdirtempfilemkstemprrGfchmodwriterdumpsencodefsyncrreplace BaseExceptionunlinkropenO_RDONLY)r\rrfdtmpdir_fdr7r7r8_atomic_write_credentialss8         z)CredentialsFile._atomic_write_credentialscCs|}td|dS)zEReturn the cached ``authentication`` sub-object from the config file.r>r)r~rrr7r7r8rszCredentialsFile._auth_blockFr_r`rar c Csb|}|d}|tkr|j||dS|tkr|j||dStd|d|jdtdtd )NrNr_Unknown authentication.type  at . Expected  or r)rrFrU_call_oidc_federationrV_call_user_oauthr$rp)r\r`r?rWr7r7r8rds zCredentialsFile.__call__r?c Csddlm}m}|}|d}|std|jd|d}|s2t|d|j}t||dS|d } | sH|d |j d t d |jt|d|j}|sc|d urct |krct||dSt | |d} z| j|jt| dttdd} Wntjy} z|d| | d } ~ ww| jdkr|| dd| } | d}|s|d| dd}zt|}Wnttfy} z |d|d| d } ~ wwtt |}| d p| }t|d<t|d<||d<||d<||d <||t||dS)zInteractive-login profile. With a ``client_id`` in the auth block, we run the refresh_token grant on expiry; without one, we treat the credentials file as externally rotated and just read it fresh. r )WorkloadIdentityError_raise_token_endpoint_error access_tokenrz is missing 'access_token'. client_idrcrb refresh_tokenzcredentials file for profile z (authentication.type z/ with client_id) must include 'refresh_token': N) grant_typerrzapplication/json)z Content-Typezanthropic-betaz User-Agent)rrz3user_oauth refresh failed to reach token endpoint: zuser_oauth refresh failed)message_prefixz2user_oauth refresh response missing 'access_token' expires_iniz5user_oauth refresh response has invalid 'expires_in' z(; expected an integer number of seconds.versionrN) _workloadrrrrFr$rur9r rorVtimerrpostrvrrrr HTTPError status_coderr2r3r4CREDENTIALS_FILE_VERSIONrr)r\r?r`rrrrrrcrbodyrespr5payload new_accessraw_expires_inrnew_expires_at new_refreshr7r7r8rs                  z CredentialsFile._call_user_oauthOptional[Dict[str, Any]]c Cs\|jdusJ|jsdSz|WSty-}zt|jtr(WYd}~dSd}~ww)u``_read_credentials`` variant that returns ``None`` on absence instead of raising — used by the federation disk-cache path where a missing credentials file just means "exchange now". N)ruexistsrr$r __cause__r)r\r5r7r7r8_read_credentials_if_exists+s   z+CredentialsFile._read_credentials_if_existsc Cs|jdur |||_|jdur|S|}|sQ|durQ|d}|d}z|rD|durDtt|tkrDtt |t |dWSWn t t fyPYnw|}z| i|p\itt|j|jdW|Sty}z td|WYd}~|Sd}~ww)Nrrcrb)rrNrrcz?federation token disk-cache write-back failed (best-effort): %s)rw_build_workload_delegaterurrFrfloatrr rCr2r3r4rrrrYrcrr%debug)r\r?r`cachedrrcrYr5r7r7r8r:sH       z%CredentialsFile._call_oidc_federationr&c Cs ddlm}m}|d}|jdusJ|jd}|r|s)|dtd|j|d}|dur[|d}|d krCtd |d |d }|sZtd |jd|jd|dnd}|rct |nt } || |||d|jd|d| d} | |j | S)Nr rr&rOrLz%config file with authentication.type zS must include 'authentication.federation_rule_id' and top-level 'organization_id': rRr-rSzidentity_token source z- is not supported; only 'file' is implementedrTz@identity_token source 'file' requires a non-empty path; profile rz has identity_token=rrPrMrQidentity_token_providerrOrLrPrMrQrk) rrr&rFrtrUrpr$ror+rrrv) r\r?rr&rOrLidentity_token_cfgr-identity_token_pathproviderdelegater7r7r8rhsP        z(CredentialsFile._build_workload_delegaterE)rlrmrkrnr/r@r/rCr/r{)r/rm)rKrCr/r@)r=r>r/rC)r/rr/r>)r/rr/r@)rr>r/r@re)r?r>r`rar/r )r/rr?r>r/r&)rfrgrhrir]propertyrlr|rrrrr~rrrrrrrdrrrrr7r7r7r8r)s6+      3 :   & X.r)c@s4eZdZdZddddZedd d Zdd dZdS)r+zAn :class:`IdentityTokenProvider` that reads a JWT from a file on every call. Kubernetes projected service-account tokens (and similar) are rotated in place, so the file MUST be re-read on every invocation rather than cached. NrT$Union[str, 'os.PathLike[str]', None]r/r@cCs*t|}|durtdtd||_dS)Nz;No identity token file path given. Pass `path=` or set the z environment variable.)r"r$r_path)r\rTresolvedr7r7r8r]s   zIdentityTokenFile.__init__r{cCrxrE)r ryr7r7r8rTrzzIdentityTokenFile.pathrCc Csz |jjdd}Wn\ty!}z td|jd|d}~wty9}z td|jd|d|d}~wtyN}z td|jd |d}~wttfyg}z td|jd ||d}~ww|sstd|jd |S) Nrrz!Identity token file not found at rzIdentity token file at z" is not readable by this process: z;. Check the file mode and the effective uid of the process.zIdentity token path zF is a directory, not a file. Point at the projected token file itself.rz is empty. If this is a Kubernetes projected service-account token, check the volume mount and the serviceAccountToken projection audience.) r rstriprr$PermissionErrorIsADirectoryErrorrr)r\contentr5r7r7r8rds8  zIdentityTokenFile.__call__rE)rTr r/r@rr)rfrgrhrir]r rTrdr7r7r7r8r+s   r+cs^eZdZdZedZddddd dZedddZ edddZ edfdd Z Z S)r*uAn :class:`AccessTokenProvider` driven by an in-memory config dict (same shape as ``configs/.json``) rather than files on disk. Intended for callers that want to construct an :class:`anthropic.Anthropic` client with a fully programmatic credentials setup — equivalent to the Go SDK's ``option.WithConfig`` / TypeScript SDK's ``ClientOptions.config``. Both ``authentication.type`` discriminator values are supported: ``"oidc_federation"`` ``authentication.credentials_path`` is **optional**. If set, exchanged tokens are cached to / read from that file (same atomic 0600 write as :class:`CredentialsFile`). If omitted, every call performs a fresh jwt-bearer exchange with no on-disk cache. ``"user_oauth"`` ``authentication.credentials_path`` is **required** — it is where the access/refresh tokens live. Behaviour is identical to a file-backed :class:`CredentialsFile` profile of the same shape. The implementation subclasses :class:`CredentialsFile` so the dispatch, refresh-grant, disk-cache and atomic-write logic are shared verbatim; only config loading and identity-token resolution are overridden. zN)rrkr=r>rOptional[IdentityTokenProvider]rkrnr/r@cCs|d}t|tstdtdtdtd|}|d}|ttfvr3td|dtd td |d }|tkrF|sFtd td d|_|j|_ d|_ ||_ d|_ d|_ ||_||_|rjtt|nd|_|||_t|jdddS)Nrzaconfig dict is missing the 'authentication' object. Expected shape: {"authentication": {"type": "rrr>rNrrrrrzauthentication.type z requires 'authentication.credentials_path' (where the access/refresh tokens live). For profile-based resolution, use CredentialsFile instead.z zconfig: base_urlr)rFrrr$rUrVrro_IN_MEMORY_PATHrprqrrrsrw!_identity_token_provider_overridertrrrCrrurrvr)r\r=rrkrr?rWrr7r7r8r]sF         zInMemoryConfig.__init__cCs|jdusJ|jSrE)rtryr7r7r8r~szInMemoryConfig._load_configcCs d|_dSrE)rwryr7r7r8rs zInMemoryConfig.reloadr?r&c s|jdur t|Sddlm}m}|d}|jdusJ|jd}|r)|s1|dtd||j|||d|jd|d | d }| |j |S) Nr rrOrLz%config dict with authentication.type zQ must include 'authentication.federation_rule_id' and top-level 'organization_id'rPrMrQr) rsuperrrrr&rFrtrUrrrv)r\r?rr&rOrLr __class__r7r8r s*       z'InMemoryConfig._build_workload_delegate)r=r>rrrkrnr/r@rrr) rfrgrhrirrrr]r r~rr __classcell__r7r7rr8r*s -  r*)r,rr-r.r/r0)r=r>r?r>r/r@)B __future__rrGrrrloggingrrtypingrrrrrrtyping_extensionsr r_typesr r _constantsr rrrrrrrrrrrrrrrrrrr r!r" _exceptionsr$ getLoggerrfr%__annotations__rr&__all__r9rCONFIG_FILE_VERSIONrrUrVrXr'r(r)r+r*r7r7r7r8sD  `     .