-:jO UdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZmZmZd d lmZd d lmZd d lmZmZd ZdZdededdfdZdae Zda edze!d<ejDe#Z$dedzfdZ%dedzfdZ&dedzfdZ'dedzfdZ(Gdde Z)e Z*da+e)dze!d<dZ,dedzfdZ-Gdde Z.e Z/da0e.dze!d <d!Z1dZ2da3dedzfd"Z4d#edefd$Z5d%eddfd&Z6d'e7eefde8dzfd(Z9de7eeffd)Z:de7ee7eefffd*Z;d+e7ee7eeffddfd,Zd#edzdedzfd3Z?y)4zVContains a helper to get the token from machine (env variable, secret or config file).N)Path)Lock) TypedDict) constants)DeviceCodeErrorOAuthErrorCode OIDCError) WeakFileLock)refresh_access_token)is_colab_enterpriseis_google_colabiipathcontentreturnc|jjddttjt |tj tjztjzt}tj|d5}|j|ddd |jt|jjty#1swY?xYw#ttf$rYywxYw)ziWrite content to file, restricting both the file and its parent directory to owner-only on POSIX systems.T)parentsexist_okmodewN)parentmkdir_SECRET_DIR_MODEosopenstrO_WRONLYO_CREATO_TRUNC_SECRET_FILE_MODEfdopenwritechmodOSErrorNotImplementedError)rrfdfs ]/var/www/html/tokenscope/api/venv/lib/python3.12/site-packages/huggingface_hub/utils/_auth.py _write_secretr*%sKKdT8HI TBKK"**4rzzACT UB 2s q   $% *+  ( )   s C(4C)C&)C;:C;F_GOOGLE_COLAB_SECRETc^txs"txstxs tS)a] Get token if user is logged in. Note: in most cases, you should use [`huggingface_hub.utils.build_hf_headers`] instead. This method is only useful if you want to retrieve the token for other purposes than sending an HTTP request. If `HF_OIDC_RESOURCE` is set (Trusted Publishers, typically in CI), a short-lived token obtained via OIDC token exchange takes precedence. Otherwise the token is retrieved from the `HF_TOKEN` environment variable, then from the token file in the Hugging Face home folder. Returns None if user is not logged in. To log in, use [`login`] or `hf auth login`. OAuth tokens obtained with the browser-based login come with a refresh token: when such a token is close to expiry, it is transparently refreshed and persisted before being returned. Note: if `HF_OIDC_RESOURCE` is set but the OIDC token exchange fails, this raises instead of returning `None`, opting into OIDC is explicit, so a failure surfaces as a clear error rather than a silent fallback. Returns: `str` or `None`: The token, `None` if it doesn't exist. )_get_token_from_oidc_get_token_from_environment_get_token_from_file_refreshed_get_token_from_google_colabr) get_tokenr3:s2,  * & ( * ) + * ( ) r2c(tr tryt5trtcdddS ddlm}ddlm} |jd}t|ad atcdddS#t$r YdddywxYw#|j$rtjddaYP|j$rt j#ddaYw|$r.}tjdt%|d daYd}~d}~wwxYw#1swYyxYw) zGet token from Google Colab secrets vault using `google.colab.userdata.get(...)`. Token is read from the vault only once per session and then stored in a global variable to avoid re-requesting access to the vault. Nr)userdata)ErrorHF_TOKENz Access to the secret `HF_TOKEN` has not been granted on this notebook. You will not be requested again. Please restart the session if you want to be prompted again.zThe secret `HF_TOKEN` does not exist in your Colab secrets. Run `huggingface_hub.login()` to authenticate (recommended but still optional to access public models or datasets).z@ Error while fetching `HF_TOKEN` secret value from your vault: 'z'. You are not authenticated with the Hugging Face Hub in this notebook. If the error persists, please let us know by opening an issue on GitHub (https://github.com/huggingface/huggingface_hub/issues/new).T)rr_GOOGLE_COLAB_SECRET_LOCK_IS_GOOGLE_COLAB_CHECKEDr+ google.colabr5google.colab.errorsr6 ImportErrorget _clean_tokenNotebookAccessErrorwarningswarnSecretNotFoundErrorloggerinfor)r5 ColabErrortokenes r)r0r0Ws-   3 5 #-$ $' -$-$  - ? (LL,E#/#6 :$( #[-$-$ -$-$  ++ ( MMQ  $( ++ ( KKf $(  ( MMSTWXYTZS[\OO  $(  (E-$-$sj D A-BD- B6DBD&D*D,%DDD$D;DDDDcttjjdxstjjdS)Nr7HUGGING_FACE_HUB_TOKEN)r>renvironr=r1r2r)r.r.s-  z2^bjjnnE]6^ __r2c tttjj S#t $rYywxYw)N)r>rr HF_TOKEN_PATH read_textFileNotFoundErrorr1r2r)_get_token_from_filerOs8D!8!89CCEFF s /2 >>c,eZdZUeed<eed<eed<y)_OidcTokenCacheresourcerF expires_atN__name__ __module__ __qualname__r__annotations__floatr1r2r)rQrQsM Jr2rQ_OIDC_TOKEN_CACHEi,ctjjd}|syddlm}m}t 5tj}t*td|k(r|tdkrtdcdddStjjdxsd}|| td ||| }|d }t|jd d }|dnt}|||t||z dzda |cdddS#1swYyxYw)aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCENr)detect_provider oidc_loginrRrSrFHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rR subject_token access_token expires_inir)rRrFrS)rrJr=_oidcr]r^_OIDC_TOKEN_LOCKtime monotonicrZr int_OIDC_REFRESH_MARGINmax) rRr]r^nowr`resultrFrbmargins r)r-r-szz~~01H 3 nn  )!*-9' 55$W- '9:Bd  _%6%>O  X]K~&L$78 $/5I J$7 ;;  =s;D6BDD c,eZdZUeed<eed<eed<y)_OAuthRefreshCache file_tokenresolved_token recheck_atNrTr1r2r)rnrnsOr2rn_OAUTH_REFRESH_CACHEiQc2t}|yt|S)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rO_refresh_oauth_token_if_neededrFs r)r/r/s "E } )% 00r2rFc t5tj}t}||dk(r||dkr|dcdddStfdt j Ddif\}}|j d}t|}|||4t}||k7r |cdddS|tzdacdddS|tz |kDr|tz dacdddS ttjdzd 5t j |i}|j d k7r!|j d xs}t|} nt|} | d }d | vrt|t| d znd} t!||| j dxs|| tk(r#t#t%tj&|t(j+d|dddd|t?|tz r | tz ndda|cdddS#1swY6xYw#t,$r} t/| t0rB| j2t4j6k(r%t(j9d| dt;d} nt=d| d|tz} | dacYd} ~ cdddSd} ~ wwxYw#1swYyxYw)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrorqrpc3VK|] \}}|jdk(s||f"yw)hf_tokenN)r=).0namefieldsrFs r) z1_refresh_oauth_token_if_needed.. s. v fV\V`V`akVlpuVudF^ vs) ) refresh_token)rorprqz.lock)timeoutrxrarb)rF token_namer}rSzAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.r) _OAUTH_REFRESH_LOCKrerrnext_read_stored_tokens_fullitemsr=_parse_expires_atrO_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rg _save_tokenr*rrLrCrD Exception isinstancer error_coder INVALID_GRANTwarningrY_warn_refresh_failure_onceri) rFrjcacherr{r}rScurrent_file_token new_tokennew_expires_atresponserGrqs ` r)rtrts- Wiik$  |!4!=#lH[B[)* WW " v0H0J0P0P0R v 2J  F ?3 &v.  !6*:L"6!7 !-2D2M)#WW($"'!$;;$ 1WW4 - - 3#"'(+@@$ AWWD) i==GQST T1377 BG::j)U2 & : 6 ?%I%6v%>N3MBH ( 8IO[_gOgSXH\4J0K%KmqN'#-&.ll?&C&T}#1 ,-6%d9+B+B&CYOKK.  s0#B&"B B BC#C<CC stored_tokensctjd}t|jD]A}|j |||j D]\}}|j |||Ctj}|j|tttj|jy)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr#r*rrrgetvalue)rrrkeyvaluebufs r)_save_stored_tokens_fullrs  & &T :F]//12/ :&' 399; /JC JJz3 . // ++-C LL$y667Hr2rc<t}||vryt||S)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rr>)rrs r)_get_token_by_namers'&'M&  j1 22r2)r}rSr}rSct}d|i}|||d<|t||d<|||<t|tj d|dt j y)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. rxNr}rSz The token `z` has been saved to )rrrrCrDrr)rFrr}rSrr{s r)rrsm"-.M% F "/":| &M*]+ KK+j\)=i>]>]=^_`r2cp|y|jddjddjxsdS)zuClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprus r)r>r>s8  } ==r " * *4 4 : : < DDr2)@__doc__rrloggingrrer@pathlibr threadingrtypingrrrerrorsrr r _fixesr _oauth_devicer _runtimerrr!rrr*r9r8r+rX getLoggerrUrCr3r0r.rOrQrdrZrhr-rnrrrrrrr/rtrrrgrrrrrrr>r1r2r)rs{]  ?? /:    s  t  ! F#'cDj'   8 $3::<$cDj<$~`S4Z` cDji6,0?T)00cDj0ff26(4/6!1d 1`#`#`F%%%d38nt q4S> q$sDcN':";& IDd38n1D,E I$ I3333:3&AE_ca aa36:aRUX\R\a a:Ed EsTzEr2