o
    ÿÑÐb´  ã                   @   s<   d dl Z d dlmZ ddlmZmZmZ G dd„ deƒZdS )é    N)Údefault_json_headersé   )ÚTokenEndpointÚInvalidRequestErrorÚUnsupportedTokenTypeErrorc                   @   s<   e Zd ZdZdZdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Z	dS )ÚIntrospectionEndpointz‰Implementation of introspection endpoint which is described in
    `RFC7662`_.

    .. _RFC7662: https://tools.ietf.org/html/rfc7662
    Zintrospectionc                 C   sD   |j }d|vr
tƒ ‚| d¡}|r|| jvrtƒ ‚|  |d ||¡S )aw  The protected resource calls the introspection endpoint using an HTTP
        ``POST`` request with parameters sent as
        "application/x-www-form-urlencoded" data. The protected resource sends a
        parameter representing the token along with optional parameters
        representing additional context that is known by the protected resource
        to aid the authorization server in its response.

        token
            **REQUIRED**  The string value of the token. For access tokens, this
            is the ``access_token`` value returned from the token endpoint
            defined in OAuth 2.0. For refresh tokens, this is the
            ``refresh_token`` value returned from the token endpoint as defined
            in OAuth 2.0.

        token_type_hint
            **OPTIONAL**  A hint about the type of the token submitted for
            introspection.
        ÚtokenÚtoken_type_hint)Úformr   ÚgetZSUPPORTED_TOKEN_TYPESr   Úquery_token)ÚselfÚrequestÚclientÚparamsÚ
token_type© r   úc/var/www/secure340b-portal/env/lib/python3.10/site-packages/authlib/oauth2/rfc7662/introspection.pyÚ authenticate_endpoint_credential   s   
z6IntrospectionEndpoint.authenticate_endpoint_credentialc                 C   s*   |   |¡}|  ||¡}|  |¡}d|tfS )zpValidate introspection request and create the response.

        :returns: (status_code, body, headers)
        éÈ   )Zauthenticate_endpoint_clientr   Úcreate_introspection_payloadr   )r   r   r   Z
credentialÚbodyr   r   r   Úcreate_endpoint_response0   s   


z.IntrospectionEndpoint.create_endpoint_responsec                 C   sL   |sddiS |  ¡ }|t ¡ k s|jrddiS |  |¡}d|vr$d|d< |S )NÚactiveFT)Zget_expires_atÚtimeZrevokedÚintrospect_token)r   r   Z
expires_atÚpayloadr   r   r   r   @   s   
z2IntrospectionEndpoint.create_introspection_payloadc                 C   ó   t ƒ ‚)aµ  Get the token from database/storage by the given token string.
        Developers should implement this method::

            def query_token(self, token, token_type_hint, client):
                if token_type_hint == 'access_token':
                    tok = Token.query_by_access_token(token)
                elif token_type_hint == 'refresh_token':
                    tok = Token.query_by_refresh_token(token)
                else:
                    tok = Token.query_by_access_token(token)
                    if not tok:
                        tok = Token.query_by_refresh_token(token)

                if check_client_permission(client, tok):
                    return tok
        ©ÚNotImplementedError)r   r   r	   r   r   r   r   r   O   s   z!IntrospectionEndpoint.query_tokenc                 C   r   )a5  Read given token and return its introspection metadata as a
        dictionary following `Section 2.2`_::

            def introspect_token(self, token):
                active = is_token_active(token)
                return {
                    'active': active,
                    'client_id': token.client_id,
                    'token_type': token.token_type,
                    'username': get_token_username(token),
                    'scope': token.get_scope(),
                    'sub': get_token_user_sub(token),
                    'aud': token.client_id,
                    'iss': 'https://server.example.com/',
                    'exp': token.expires_at,
                    'iat': token.issued_at,
                }

        .. _`Section 2.2`: https://tools.ietf.org/html/rfc7662#section-2.2
        r   )r   r   r   r   r   r   b   s   z&IntrospectionEndpoint.introspect_tokenN)
Ú__name__Ú
__module__Ú__qualname__Ú__doc__ZENDPOINT_NAMEr   r   r   r   r   r   r   r   r   r   
   s    r   )r   Zauthlib.constsr   Zrfc6749r   r   r   r   r   r   r   r   Ú<module>   s    