lKjP+dZddlmZddlmZddlmZddlmZddlmZddl m Z ddl m Z dd l mZdd lmZdd lmZdd lmZdd lmZddlmZerddlmZGdde j4ZeGddeZGddeZy)zuOpenID Connect RP-Initiated Logout 1.0 implementation. https://openid.net/specs/openid-connect-rpinitiated-1_0.html ) annotations) dataclass)field) TYPE_CHECKING)Any)jwt) JoseError)KeySet) JWSRegistry)add_params_to_uri)Endpoint)EndpointRequest)InvalidRequestError) OAuth2RequestceZdZdZddZy)_NonExpiringClaimsRegistryz1Claims registry that skips expiration validation.cy)N)selfvalues u/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/authlib/oidc/rpinitiated/end_session.py validate_expz'_NonExpiringClaimsRegistry.validate_exp!s N)rintreturnNone)__name__ __module__ __qualname____doc__rrrrrrs ;  rrcleZdZUdZeddZded<dZded<dZded <dZ ded <e d d Z y) EndSessionRequestzValidated end session request data. This object is returned by :meth:`EndSessionEndpoint.validate_request` and contains all the validated information from the logout request. NF)defaultreprz dict | Noneid_token_claims str | None redirect_uri logout_hint ui_localesc|jduS)z7Whether user confirmation is recommended before logout.N)r%rs rneeds_confirmationz$EndSessionRequest.needs_confirmation2s##t++r)rbool) rrrr rr%__annotations__r'r(r)propertyr,rrrr"r"%sJ $)E#BO[B#L*#"K"!J ! ,,rr"c|eZdZdZdZd dZ ddZddZddZ ddZ ddZ dd Z dd Z dd Z y )EndSessionEndpointaQOpenID Connect RP-Initiated Logout endpoint. This endpoint follows a two-phase pattern for interactive flows: 1. Call ``server.validate_endpoint_request("end_session")`` to validate the request and get an :class:`EndSessionRequest` 2. Check ``end_session_request.needs_confirmation`` and show UI if needed 3. Call ``server.create_endpoint_response("end_session", end_session_request)`` to execute logout and create the response Example usage:: class MyEndSessionEndpoint(EndSessionEndpoint): def get_server_jwks(self): return load_jwks() def end_session(self, end_session_request): session.clear() server.register_endpoint(MyEndSessionEndpoint) @app.route("/logout", methods=["GET", "POST"]) def logout(): try: req = server.validate_endpoint_request("end_session") except OAuth2Error as error: return server.handle_error_response(None, error) if req.needs_confirmation and request.method == "GET": return render_template("confirm_logout.html", client=req.client) return server.create_endpoint_response( "end_session", req ) or render_template("logged_out.html") For non-interactive usage (no confirmation page), use the standard pattern:: @app.route("/logout", methods=["GET", "POST"]) def logout(): return server.create_endpoint_response("end_session") or render_template( "logged_out.html" ) end_sessionc|jj}|jd}|jd}|jd}|jd}|jd}|jd}d} |r|j|} d} |r|jj |} n| r|j | } |r;| r9| jd} t| tr| gn| xsg} || vr td d} |r<| r:|j| |r(| s|j||| |r|} |rt| d|i} t|| | | || S) zValidate an end session request. :param request: The OAuth2Request to validate :returns: EndSessionRequest with validated data :raises InvalidRequestError: If validation fails id_token_hint client_idpost_logout_redirect_uristater(r)Naudz&'client_id' does not match 'aud' claim)requestclientr%r'r(r))payloaddataget_validate_id_token_hintserver query_client#resolve_client_from_id_token_claims isinstancestrr"_is_valid_post_logout_redirect_uri&is_post_logout_redirect_uri_legitimater r")rr9r<r4r5r6r7r(r)r%r:r8aud_listr's rvalidate_requestz#EndSessionEndpoint.validate_requestmso##1 HH[) #'88,F#G !hh}- XXl+  "::=IO [[--i8F ==oNF !%%e,C *3 4u39"H()*RSS  $770 >>5v{ 4L0?OP  +%#!   rcf|}|j||jrddd|jfgfSy)aCreate the end session HTTP response. Executes the logout via :meth:`end_session`, then returns a redirect response if a valid redirect_uri is present, or None to let the application provide its own response. :param validated_request: The validated EndSessionRequest :returns: Tuple of (status_code, body, headers) for redirect, or None i.LocationN)r2r')rvalidated_requestreqs rcreate_responsez"EndSessionEndpoint.create_responses>"3    j#*:*:;<< <rc|j}t|trtj|} t j |||j}tddi}|j|jt|jS#t$r}t|j|d}~wwxYw)z4Validate that the OP was the issuer of the ID Token.) algorithms essentialF)nbfN)get_server_jwksrBdictr import_key_setrdecodeget_algorithmsrvalidateclaimsr r description)rr4jwkstokenclaims_registryexcs rr>z*EndSessionEndpoint._validate_id_token_hints ##% dD !((.D @JJ}dt?R?R?TUE8k5=QRO  $ $U\\ 2ELL!! @%coo6C ? @sAB B?$B::B?c||jd}t|tr|jj |Sy)zResolve client from id_token aud claim. When aud is a single string, resolves the client directly. When aud is a list, returns None (ambiguous case). Override for custom resolution logic. r8N)r=rBrCr?r@)rr%r8s rrAz6EndSessionEndpoint.resolve_client_from_id_token_claimss6!!%( c3 ;;++C0 0rcB|jjdg}||vS)z?Check if post_logout_redirect_uri is registered for the client.post_logout_redirect_uris)client_metadatar=)rr:r6registered_uriss rrDz5EndSessionEndpoint._is_valid_post_logout_redirect_uris)!00445PRTU'?::rcy)aWConfirm redirect_uri legitimacy when no id_token_hint is provided. Override if you have alternative confirmation mechanisms, e.g.:: def is_post_logout_redirect_uri_legitimate(self, ...): return client and client.is_trusted By default returns False (no redirection without id_token_hint). Fr)rr9r6r:r(s rrEz9EndSessionEndpoint.is_post_logout_redirect_uri_legitimates&rct)z>Return the server's JSON Web Key Set for validating ID tokens.NotImplementedErrorr+s rrRz"EndSessionEndpoint.get_server_jwkss !##rc|j}t|trtj|}t j |Dcgc]}|jc}Scc}w)zReturn the list of allowed algorithms for ID token validation. By default, returns all algorithms compatible with the keys in the JWKS. Override to restrict to specific algorithms. )rRrBrSr rTr filter_algorithmsname)rrZalgs rrVz!EndSessionEndpoint.get_algorithmssU ##% dD !((.D$/$A$A$$GH$GS$GHHHs A#ct)a|Terminate the user's session. Implement this method to perform the actual logout logic, such as clearing session data, revoking tokens, etc. Use ``end_session_request.logout_hint`` to help identify the user (e.g. email, username) when no ``id_token_hint`` is provided. :param end_session_request: The validated EndSessionRequest re)rend_session_requests rr2zEndSessionEndpoint.end_sessions "##rN)r9rrr")rKr"rz-tuple[int, Any, list[tuple[str, str]]] | None)r4rCrrS)r%rSrz Any | None)r6rCrr-)r9rr6rCr(r&rr-)rz dict | KeySet)rz list[str])rlr"rr)rrrr ENDPOINT_NAMErGrMr>rArDrErRrVr2rrrr1r1<s,\"ME N!2 6&"( ;03; ;#&    *$ I $rr1N)r __future__r dataclassesrrtypingrrjoserfcrjoserfc.errorsr joserfc.jwkr joserfc.jwsr authlib.common.urlsr authlib.oauth2.rfc6749.endpointr rauthlib.oauth2.rfc6749.errorsrauthlib.oauth2.rfc6749.requestsrJWTClaimsRegistryrr"r1rrrrzst #! $#14;== !6!6  ,, ,,a$a$r