sPjl2LddlmZddlZddlZddlmZmZmZmZddl m Z ddl m Z m Z ddlZddlmZddlmZmZmZdd lmZd Zd Zd Zd ddZGddeZGddeZ d ddZ dddddddd d dZ d!ddd d"dZGddZ y)#) annotationsN)AnyCallable TypedDictcast)Path)Literal NotRequired)DefaultHttpx2Client) OAuthError OpenAIErrorSubjectTokenProviderError) to_threadz/urn:ietf:params:oauth:grant-type:token-exchangez#https://auth.openai.com/oauth/tokeniz$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token)jwtidc"eZdZUded<ded<y)SubjectTokenProviderzLiteral['jwt', 'id'] token_typezCallable[[], str] get_tokenN)__name__ __module__ __qualname____annotations__Z/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/openai/auth/_workload.pyrrs$$  rrc@eZdZUdZded< ded< ded< ded<y ) WorkloadIdentityz(Identity provider resource id in WIFAPI.stridentity_provider_idservice_account_idrproviderzNotRequired[float]refresh_buffer_secondsN)rrr__doc__rrrrrrs&2GE""..rrcdfd }d|dS)aK Get a subject token provider for Kubernetes clusters with Workload Identity configured. Cloud providers typically mount the subject token as a file in the container. Args: token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. c td5}|jj}|stdd|cdddS#1swYyxYw#t$r}tdd||d}~wwxYw)NrzThe token file at z is empty.z!Failed to read the token file at z: )openreadstripr Exception)ftokenetoken_file_paths rrz5k8s_service_account_token_provider..get_token9s oos+ q(36HHYYc4dee      o+.OP_O``bcdbe,fgmn n os4 A1A  A AAA A6A11A6rrrreturnr r)r0rs` r"k8s_service_account_token_providerr4-so i 88rz 2018-02-01$@) object_id client_id msi_res_id api_versiontimeout http_clientc2dfd }d|dS)a Get a subject token provider for Azure Managed Identities. See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http Args: resource: the resource URI to request a token for. Defaults to `https://management.azure.com/` (Azure Resource Manager). object_id: the object ID of the managed identity to use, when multiple are assigned. client_id: the client ID of the managed identity to use, when multiple are assigned. msi_res_id: the ARM resource ID of the managed identity to use, when multiple are assigned. api_version: the Azure IMDS API version. Defaults to `2018-02-01`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. c d} d}  |d<|d<  |d<  j||ddi }n4tj5}|j||ddi }dddjrt d |j | |j }|jd }|s t d | tt|S#1swYoxYw#t$r}t d ||d}~wwxYw)Nz5http://169.254.169.254/metadata/identity/oauth2/token)z api-versionresourcer6r7r8Metadatatrueparamsheadersr:z4Failed to fetch Azure subject token from IMDS: HTTP response access_tokenz3Azure IMDS response did not include an access_tokenz/Failed to fetch Azure subject token from IMDS: ) gethttpxClientis_errorr status_codejsonrr r,)urlrBrEclientdatar.r/r9r7r;r8r6r>r:s rrz8azure_managed_identity_token_provider..get_token_sC jIC5@h%WF$&/{#$&/{#%'1|$&&??3v TZG[el?m\\^mv%zz#fzSYFZdkzlHm  /J8K_K_J`a%==?DHH^,E/IT\U# #mm j+.]^_]`,abhi i js1A C C%A-CCC C<(C77C<rr1r2r)r>r6r7r8r9r:r;rs``````` r%azure_managed_identity_token_providerrPFs2jj@ i 88r)r:r;c"dfd }d|dS)a5 Get a subject token provider for GCP VM instances using the instance metadata server. See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity Args: audience: the unique URI agreed upon by both the instance and the system verifying the instance's identity. Defaults to `https://api.openai.com/v1`. timeout: the request timeout in seconds. Defaults to 10.0. http_client: optional httpx.Client instance to use for requests. If not provided, a new client will be created for each request. c d}di}j||ddi}n4tj5}|j||ddi}dddjrt d|j ||j j}|s t d||S#1swYZxYw#t$r}t d ||d}~wwxYw) Nz]http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identityaudiencezMetadata-FlavorGooglerAz=Failed to fetch GCP subject token from metadata server: HTTP rDz+GCP metadata server returned an empty tokenz8Failed to fetch GCP subject token from metadata server: ) rGrHrIrJrrKtextr+r,) rMrBrErNr.r/rSr;r:s rrz(gcp_id_token_provider..get_tokens sqC (+F&&??3vHY[cGdnu?v\\^vv%zz#fGXZbFcmtzuHv  /ST\ThThSij%MM'')E/0]hpqqLvv s+.fghfi,jkqr r ss/4B4B(AB4(B1-B44 C=C  Crr1r2r)rSr:r;rs``` rgcp_id_token_providerrVs$s.Y 77rc~eZdZedd ddZddZddZddZddZddZ dd Z dd Z dd Z dd Z dd ZddZy)WorkloadIdentityAuthF)token_exchange_url _use_httpx2c||_||_||_d|_d|_d|_d|_tj|_ tj|j|_ yNF) workload_identityrYrZ _cached_token"_cached_token_expires_at_monotonic"_cached_token_refresh_at_monotonic _refreshing threadingLock_lock Condition _condition)selfr]rYrZs r__init__zWorkloadIdentityAuth.__init__s`"3"4&)-@D/@D/!&^^% #--djj9rc|j5|jrG|jr7|jj |jr|jr7|js3|j s#t t|jcdddS|jrs|jr'|jj |jr'|j}|jr tdt t|cdddSd|_ddd |j|j5|jr tdt t|jcddd|j5d|_|jjdddS#1swYxYw#1swYSxYw#1swYnxYw |j5d|_|jjdddy#1swYyxYw#|j5d|_|jjdddw#1swYwxYwxYw)Nz)Token is unusable after refresh completedTF) rdra_token_unusablerfwait_needs_refreshrr r^ RuntimeError_perform_refresh notify_all)rgr.s rrzWorkloadIdentityAuth.get_tokens ZZ $""t';';'=$$&""t';';'='')$2E2E2GC!3!34  $ $&&OO((*&&**'')&'RSSC' $ $ $D  $" -  ! ! # 5'')&'RSSC!3!34 5 5  -#( **, - -1 $ $0 - -  5 5 5  -#( **, - - - -#( **, - - -sxAG!9G$>G#6G#G3H,5G H,"GG G G%!H,5"H  H), I09"I$ I0$I- )I0cHKt|jd{S7wN)rrrgs rget_token_asyncz$WorkloadIdentityAuth.get_token_asyncst~~....s " "cp|j5d|_d|_d|_dddy#1swYyxYwrq)rdr^r_r`rrs rinvalidate_tokenz%WorkloadIdentityAuth.invalidate_tokens6 ZZ ;!%D 6:D 36:D 3 ; ; ;s,5c|j}tj}|d}|j5|d|_||z|_||j |z|_dddy#1swYyxYw)N expires_inrF)_fetch_token_from_exchangetime monotonicrdr^r__refresh_delay_secondsr`)rg token_datanowrws rrnz%WorkloadIdentityAuth._perform_refreshsy446 nn - ZZ d!+N!;D 69J6FD 369DThe workload identity provider returned an empty subject token)r]r)rgr#rs rrz'WorkloadIdentityAuth._get_subject_token"s6))*5--/ ^_ _rcB|jduxs|jSrq)r^_token_expiredrrs rrjz$WorkloadIdentityAuth._token_unusable)s!!!T)BT-@-@-BBrc^|jytj|jk\S)NT)r_ryrzrrs rrz#WorkloadIdentityAuth._token_expired,s)  2 2 :~~4#J#JJJrc^|jytj|jk\Sr\)r`ryrzrrs rrlz#WorkloadIdentityAuth._needs_refresh1s)  2 2 :~~4#J#JJJrc~|jjdt}t||dz }t ||z dS)Nr$r g)r]rGDEFAULT_REFRESH_BUFFER_SECONDSminmax)rgrwconfigured_buffereffective_buffers rr{z+WorkloadIdentityAuth._refresh_delay_seconds6sB 22667OQop0*q.A: 00#66rN)r]rrYr rZboolr2)r3None)r3dict[str, Any])rEzhttpx.Responser3r)r3r)rwrr3r)rrrDEFAULT_TOKEN_EXCHANGE_URLrhrrsrurnrxrrrjrrlr{rrrrXrXsh #=! :,: :  :$-:/; d92 0CK K 7rrX)z3/var/run/secrets/kubernetes.io/serviceaccount/token)r0z str | Pathr3r)zhttps://management.azure.com/)r>r r6 str | Noner7rr8rr9r r:rr;httpx.Client | Noner3r)zhttps://api.openai.com/v1)rSr r:rr;rr3r)! __future__rryrbtypingrrrrpathlibrtyping_extensionsr r rH_httpx2r _exceptionsr rr _utils._syncrrrrrrrr4rPrVrXrrrrs:" 112 )LL$MB!% 2 5 !9! /y / #X9994499! !#'+999999 99  99  9999%9999z0)8'+ )8)8)8% )8  )8XK7K7r