AXjUddlmZddlZddlZddlmZmZddlmZddl Z ddl m Z ddl m Z dd lmZd gZej"eZd ed <ej*ZeZd ed<ddZddZddZGdd e j8Zy)) annotationsN) GeneratorAsyncGenerator)override) TokenCache)asyncify)OAUTH_API_BETA_HEADERAccessTokenAuthzlogging.Loggerlogzset[str]_warn_once_seenct5|tvr dddytj|dddtj|g|y#1swY xYw)z8Emit a log warning at most once per ``key`` per process.N)_warn_once_lockraddr warning)keymessageargss e/var/www/html/content_generation/venv/lib/python3.12/site-packages/anthropic/lib/credentials/_auth.py _warn_oncersG  / !   C  KK$ s AAAc$td|d|y)agWarn that an explicit ``api_key=`` / ``auth_token=`` argument shadows an explicit ``credentials=`` provider passed to the same constructor or ``copy()`` call. The static credential wins at the request-header level (``AccessTokenAuth.sync_auth_flow`` short-circuits on the pre-set header), which silently disables the credentials provider. zexplicit-shadow:z`%s=` was passed alongside `credentials=`; the static credential takes precedence and the credentials provider is silently disabled. Pass only one.Nr)params r(warn_explicit_static_shadows_credentialsrs  5'"   c&td|d||y)aWarn that an ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` from the environment is shadowing the SDK's profile / federation auto-discovery. Per the credential-precedence spec, a static-credential env var silently disables the auto-discovered federation and profile paths. Surface a one-shot warning so migrating users can see why their ``ANTHROPIC_PROFILE`` or WIF env vars are being ignored. z env-shadow:z%s is set and takes precedence over the SDK's profile / federation auto-discovery; unset %s to use the auto-discovered credential.Nr)env_vars r&warn_env_static_shadows_auto_discoveryr/s" gY J rcZeZdZdZdZd dZed dZd dZe d dZ e d dZ y)r uAdapts a :class:`TokenCache` to httpx's :class:`~httpx.Auth` protocol. Used by :meth:`anthropic.Anthropic.custom_auth` to inject ``Authorization: Bearer`` plus the OAuth beta header on every request, with proactive refresh handled by :class:`TokenCache`. Static credentials shadow federation: if the outgoing request already carries an ``X-Api-Key`` or ``Authorization`` header (set by the client's api_key / auth_token path), this auth flow is a no-op. That matches the Go SDK's ``authMiddleware`` and the documented precedence in the WIF user guide — a static ``ANTHROPIC_API_KEY`` shadows any credentials provider. Fc||_yN) _token_cache)self token_caches r__init__zAccessTokenAuth.__init__Qs 'rct|jjdxs|jjdS)Nz X-Api-Key Authorization)boolheadersget)requests r_has_static_credentialz&AccessTokenAuth._has_static_credentialTs0GOO'' 4\8K8KO8\]]rc\d||jd<|jjdd}|jdDcgc]#}|js|j%}}t|vr4|j tdj ||jd<yycc}w)NzBearer r(zanthropic-beta,z, )r*r+splitstripr appendjoin)r$r,token existing_betaflagexisting_flagss r_applyzAccessTokenAuth._applyXs-4UG+<(++,s?A AA N)r%rreturnNone)r, httpx.Requestr@r))r,rBr5strr@rA)r,rBr@z.Generator[httpx.Request, httpx.Response, None])r,rBr@z-AsyncGenerator[httpx.Request, httpx.Response]) __name__ __module__ __qualname____doc__requires_response_bodyr& staticmethodr-r9rr=r?rrr r AsX #(^^J   r)rrCrrCrobjectr@rA)rrCr@rA)rrCr@rA) __future__rlogging threadingtypingrrtyping_extensionsrhttpx_cacher_utilsr _constantsr __all__ getLoggerrDr __annotations__LockrsetrrrrAuthr rJrrr[sx",& -  'g''1^1 ).."E!   $:ejj:r