EjL UdZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z ddl m Z ddlmZddlmZdd lmZdd lmZmZdd lmZGd d e dZej4ej4ej6ej6ej8ej8ej8ej8ej:ej:ej:ej:d Zee ee!gdffe"d<ejFejHdkrdndZ%dZ&e e'e ddfe"d<e'e(ejSZ*e e'e dfe"d<e+hdZ,e e+e e"d<de de fdZ-de de fdZ.d e dee e ffd!Z/Gd"d#Z0y)$av Digest authentication middleware for aiohttp client. This middleware implements HTTP Digest Authentication according to RFC 7616, providing a more secure alternative to Basic Authentication. It supports all standard hash algorithms including MD5, SHA, SHA-256, SHA-512 and their session variants, as well as both 'auth' and 'auth-int' quality of protection (qop) options. N)Callable)FinalLiteral TypedDict)URL)hdrs) ClientError)ClientHandlerType) ClientRequestClientResponse)PayloadcTeZdZUeed<eed<eed<eed<eed<eed<eed<y) DigestAuthChallengerealmnonceqop algorithmopaquedomainstaleN)__name__ __module__ __qualname__str__annotations__c/root/workspace/ytshorts/venv/lib/python3.12/site-packages/aiohttp/client_middleware_digest_auth.pyrrs% J J HN K K JrrF)total) MD5zMD5-SESSSHAzSHA-SESSSHA256z SHA256-SESSzSHA-256z SHA-256-SESSSHA512z SHA512-SESSzSHA-512z SHA-512-SESSz hashlib._HashDigestFunctions) z?(?:^|\s|,\s*)(\w+)(?:\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+)))?zC(?:^|\s|,\s*)((?>\w+))(?:\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+)))?)rrrrrrr.CHALLENGE_FIELDSSUPPORTED_ALGORITHMS>urirrcnoncerresponseusernameQUOTED_AUTH_FIELDSvaluereturncF|jddjddS)z=Escape backslashes and double quotes for HTTP quoted-strings.\\\"\"replacer/s r escape_quotesr9hs ==v & . .sE ::rcF|jddjddS)z>Unescape backslashes and double quotes in HTTP quoted-strings.r5r4r3r2r6r8s runescape_quotesr;ms == $ , ,VT ::rheaderci}tj|D]Q}|jd}|jd|jd}}|||r|S@| t|n|||<S|S)a Parse key-value pairs from the first challenge of a WWW-Authenticate header. This function handles the complex format of WWW-Authenticate header values, supporting both quoted and unquoted values, proper handling of commas in quoted values, and whitespace variations per RFC 7616. A single header may carry several challenges (https://www.rfc-editor.org/rfc/rfc7235#section-4.1). Parsing stops at the next auth-scheme token so a later challenge's parameters cannot overwrite the first challenge's values; a leading scheme token is skipped. Examples of supported formats: - key1="value1", key2=value2 - key1 = "value1" , key2="value, with, commas" - key1=value1,key2="value2" - realm="example.com", nonce="12345", qop="auth" Args: header: The header value string to parse Returns: Dictionary mapping parameter names to their values rr&)_HEADER_PAIRS_PATTERNfinditergroupr;)r<pairsmatchkey quoted_val unquoted_vals rparse_header_pairsrGrs2E&//7  kk!n#(;;q>5;;q>L  ,"6 L +5+AOJ '| c    Lrc eZdZdZ ddedededdfdZded ed ee d zdefd Z d edefd Z de defdZ dedede fdZy)DigestAuthMiddlewarea1 HTTP digest authentication middleware for aiohttp client. This middleware intercepts 401 Unauthorized responses containing a Digest authentication challenge, calculates the appropriate digest credentials, and automatically retries the request with the proper Authorization header. Features: - Handles all aspects of Digest authentication handshake automatically - Supports all standard hash algorithms: - MD5, MD5-SESS - SHA, SHA-SESS - SHA256, SHA256-SESS, SHA-256, SHA-256-SESS - SHA512, SHA512-SESS, SHA-512, SHA-512-SESS - Supports 'auth' and 'auth-int' quality of protection modes - Properly handles quoted strings and parameter parsing - Includes replay attack protection with client nonce count tracking - Supports preemptive authentication per RFC 7616 Section 3.6 Origin scoping: The credentials are scoped to the origin of the first request the middleware handles. A request to a different origin is passed through untouched, so it never receives a digest response computed from those credentials, unless that origin falls within a protection space the anchor origin advertised through the RFC 7616 ``domain`` directive. Make the first request through the middleware against the intended origin, as the anchor is pinned to it and not reset for the life of the instance. Standards compliance: - RFC 7616: HTTP Digest Access Authentication (primary reference) - RFC 2617: HTTP Authentication (deprecated by RFC 7616) - RFC 1945: Section 11.1 (username restrictions) Implementation notes: The core digest calculation is inspired by the implementation in https://github.com/requests/requests/blob/v2.18.4/requests/auth.py with added support for modern digest auth features and error handling. loginpassword preemptiver0Nc| td| tdd|vr td||_|jd|_|jd|_d|_d|_i|_||_g|_ d|_ y)Nz"None is not allowed as login valuez%None is not allowed as password value:z8A ":" is not allowed in username (RFC 1945#section-11.1)utf-8rr) ValueError _login_strencode _login_bytes_password_bytes_last_nonce_bytes _nonce_count _challenge _preemptive_protection_space_origin)selfrJrKrLs r__init__zDigestAuthMiddleware.__init__s =AB B  DE E %<WX X&+*/,,w*?-5__W-E!$/1!+,.#' rmethodurlbodyrc #$K|j}d|vr tdd|vr td|d}|d}|s td|jdd}|jdd }|j} |jd d} |j d } |j d } t |j } d}d }|rxd dhj|jdDchc]#}|js|j%c}}|std|d|vrdnd }|j d }| tvr$td| ddjtt| $dtdtf$fd #dtdtdtf#fd }dj|j| |jf}|jd| j }|dk(rFt!|t"r|j%d{}n|}#|}dj||f}#|}#|}| |j&k(r|xj(dz c_nd|_| |_|j(d}|j d }t+j,d jt/|j(j d | t1j2j d t5j6dgj9dd }|j d }| jj;d!r#dj|| |f}|r dj| ||||f}|||}n||dj| |f}t=|j>t=|t=|| |jA|d"}| rt=| |d <|r||d<||d#<||d$<g} |jCD];\}!}"|!tDvr| jG|!d%|"d&&| jG|!d'|"=d(dj| Scc}w7`w))a Build digest authorization header for the current challenge. Args: method: The HTTP method (GET, POST, etc.) url: The request URL body: The request body (used for qop=auth-int) Returns: A fully formatted Digest authorization header string Raises: ClientError: If the challenge is missing required parameters or contains unsupported values rz:Malformed Digest auth challenge: Missing 'realm' parameterrz:Malformed Digest auth challenge: Missing 'nonce' parameterzBSecurity issue: Digest auth challenge contains empty 'nonce' valuerrr!rrOrauthzauth-int,zEDigest auth error: Unsupported Quality of Protection (qop) value(s): z/Digest auth error: Unsupported hash algorithm: z. Supported algorithms: z, xr0cL|jjS)z.H+s1:'')002 2rsdc6dj||fS)zDRFC 7616 Section 3: KD(secret, data) = H(concat(secret, ":", data)).:)join)rirjrhs rKDz(DigestAuthMiddleware._encode..KD/sTYY1v&' 'rrlrNNr08xz-SESS)r-rrr*r,rncr+z="r4=zDigest )$rWr getupperrRr raw_path_qs intersectionsplitstripr%rmr)bytesrSrT isinstanceras_bytesrUrVhashlibsha1rtimectimeosurandomrfendswithr9rQdecodeitemsr.append)%r[r]r^r_ challengerrqop_rawalgorithm_originalrr nonce_bytes realm_bytespathr qop_bytesq valid_qopsrnA1A2 entity_bytes entity_hashHA1HA2ncvalue ncvalue_bytesr+ cnonce_bytesnoncebitresponse_digest header_fieldsrBfieldr/rhrgs% @@r_encodezDigestAuthMiddleware._encodes"OO ) #L  ) #L  '"'"T --r*&]];>&,,. x,ll7+ ll7+ 3x##  *-::$+MM#$6Dq!'')DJ![\c[de!+j 8*fC 7+I O +A)M))-3G)H(IK )3 3 35 3 (% (E (e ( YY));8L8LM N q ' . . 0 * $(%)]]_4 # L/KB ,-Bee $00 0    "  !D !,&&s+w/  HH))*11':JJL''0JJqM     )+cr }}W-  ??  % %g .DIIsK>?@C yym\9cJH!h/O diic0B&CDO &doo6"5)"5)'..0+  &3F&;M( # #&M% ")M$ &,M( #)//1 1LE5** wbq12 waw/0  1 5)*++SE< 5s&C%Q6)Q.?Q.DQ6Q3I Q6ct|}|jD]H}|j|st|t|k(s|ddk(ry|t|dk(sHyy)z Check if the given URL is within the current protection space. According to RFC 7616, a URI is in the protection space if any URI in the protection space is a prefix of it (after both have been made absolute). /TF)rrY startswithlen)r[r^ request_str space_strs r_in_protection_spacez)DigestAuthMiddleware._in_protection_spacesk#h // I)))4;3y>1Yr]c5I3y>*c1 rr,c l|jdk7ry|jjdd}|sy|jd\}}}|sy|j dk7ry|syt |x}syi|_tD]%}|j|x}||j |<'|jj} g|_ |j jdx} r| jD]} | jd} | s| jd r=|jjt| j!t#| e|jjtt#| |jst| g|_ t%|j S) z Takes the given response and tries digest-auth, if needed. Returns true if the original request must be resent. iFzwww-authenticatera digestrr4r)statusheadersrt partitionlowerrGrWr(r^originrYrxryrrrrmrbool) r[r, auth_headerr]sepr header_pairsrr/rrr*s r _authenticatez"DigestAuthMiddleware._authenticates ??c !&&**+=rB *44S9W <<>X %!37 ;; ;% /E%))%00=).& / $$&!#__((2 26 2||~ Aiin>>#&**11#fkk#c(6K2LM**11#c#h-@ A%%&)&k]D "DOO$$rrequesthandlerctK|jj}|j||_n:||jk7r+|j|js||d{Sd}t dD]}|dkDs3|j r{|j ro|j|jrT|j|j|j|jd{|jtj<||d{}|j|rn|J|S77L7#w)zRun the digest auth middleware.Nr>r)r^rrZrrangerXrWrr]r_rr AUTHORIZATIONr)r[rrrr, retry_counts r__call__zDigestAuthMiddleware.__call__s##% << !DL t|| #D,E,Egkk,R )) ) 8 KQ  OO--gkk:<@LLNNGKK=7 2 23 %W--H%%h/% *###3*7 .s=A$D8&D2'BD8'D4(*D8D6D8) D84D86D8)T)rrr__doc__rrr\rrrrrr rr r rrrrrIrIs%V ((( (  (8c,Cc,cc,73<9Oc,TWc,J(;%n;%;%z%$%/@% %rrI)1rr}rresysrcollections.abcrtypingrrryarlrrar client_exceptionsr client_middlewaresr client_reqrepr r payloadrrmd5r~sha256sha512r%dictrrzrcompile version_infor?r(tuplesortedkeysr) frozensetr.r9r;rGrIrrrrs $,,*18)5 ;; << nn>>~~NNnn>>~~NN Bc8UG_$<==> "#  '!G O4 % QRTWW  05VO