gj *dZddlZddlmZddlmZddlmZddlm Z m Z dZ d Z Gd d e eZd edzfd Zde d e fdZddddee zdzde dzd e fdZddde de de dzd efdZdddddde de dzdee zdzde dzde dzd ef dZdS)uKeyless CI/CD authentication via OIDC token exchange ("Trusted Publishers"). A CI job proves its identity to the Hub with a short-lived OIDC id token minted by its CI provider (e.g. GitHub Actions), then exchanges it at ``POST {ENDPOINT}/oauth/token`` (RFC 8693) for a short-lived Hugging Face token — no long-lived ``HF_TOKEN`` secret to store. This module is self-contained: it only handles minting the provider id token and the exchange. It deliberately does not register a public API or a CLI verb; the integration point is the token resolution in ``utils/_auth.py`` (see ``_get_token_from_oidc``). Docs: https://huggingface.co/docs/hub/trusted-publishers N)Enum) constants) OIDCError) get_sessionhf_raise_for_statusz/urn:ietf:params:oauth:grant-type:token-exchangez)urn:ietf:params:oauth:token-type:id_tokenceZdZdZdZdS)ProviderzRCI providers that can mint an OIDC id token natively. GitHub Actions only for now.githubN)__name__ __module__ __qualname____doc__GITHUBY/var/www/app.qaans.com/backend/venv/lib/python3.11/site-packages/huggingface_hub/_oidc.pyr r (s\\ FFFrr returncdtjddkr tjSdS)zYDetect the CI provider able to mint an OIDC id token, or `None` if not in a supported CI.GITHUB_ACTIONStrueN)osenvirongetr rrrrdetect_providerr.s) z~~&''611 4raudiencecLtjd}tjd}|r|stdt |d|idd|i}t ||dS) zMint an OIDC id token from the GitHub Actions runtime. Relies on the `ACTIONS_ID_TOKEN_REQUEST_URL` / `ACTIONS_ID_TOKEN_REQUEST_TOKEN` env vars, which GitHub only injects when the job declares `permissions: id-token: write`. ACTIONS_ID_TOKEN_REQUEST_URLACTIONS_ID_TOKEN_REQUEST_TOKENzCannot request an OIDC id token from GitHub Actions. Make sure the workflow job sets `permissions: id-token: write`. See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connectr AuthorizationzBearer )paramsheadersvalue)rrrrrrjson)r request_url request_tokenresponses r_get_github_oidc_tokenr(5s *..!?@@KJNN#CDDM  m  M   }}  H% ";M";";<!H !!! ==??7 ##rproviderrr*c|p tj}|p t}ddtD}|t d|d|tjkrt|Std|d|d)aMint a raw OIDC id token (JWT) from the current CI provider. Args: provider (`str`, *optional*): CI provider to use. Auto-detected from the environment when omitted. audience (`str`, *optional*): The `aud` claim to request. Defaults to `constants.ENDPOINT` so it matches the endpoint that validates it (respects `HF_ENDPOINT`/staging). Returns: `str`: The raw id token (JWT) to pass to [`exchange_oidc_token`]. z, c3$K|] }|jV dS)N)r#).0ps r z!get_oidc_token..[s$44a!'444444rNzONo supported CI OIDC provider detected. Trusted Publishers currently supports: .zOIDC provider 'z#' is not supported yet. Supported: ) rENDPOINTrjoinr rrr(NotImplementedError)r*r supporteds rget_oidc_tokenr5Ls-9-H,?,,H 44844444Ivjsvvvwww8?""%h/// iii]fiii j jjr)endpoint subject_tokenresourcer6ct|p tjdtt ||d}t ||S)uExchange a CI OIDC id token for a short-lived Hugging Face token (RFC 8693). Args: subject_token (`str`): The raw OIDC id token (JWT) from the CI provider. Its `aud` claim must be the Hub URL. resource (`str`): What to scope the token to: a Hub repo (`namespace/name`, `datasets/namespace/name`, `spaces/namespace/name`, `kernels/namespace/name`) for a write token, or a bare Hub username for a read-only `gated-repos` token. endpoint (`str`, *optional*): Hub endpoint. Defaults to `constants.ENDPOINT` (respects `HF_ENDPOINT`/staging). Returns: `dict`: The token-exchange response, e.g. `{"access_token": "hf_jwt_…", "token_type": "bearer", "expires_in": 3600, ...}`. z /oauth/token) grant_typesubject_token_typer7r8)r$)rpostrr1_TOKEN_EXCHANGE_GRANT_TYPE_ID_TOKEN_TYPErr$)r7r8r6r's rexchange_oidc_tokenr?csj"}}!!  )y)7774"0*   "H!!! ==??r)r7r*rr6cl|p tj}|t||p|}t|||S)uMint a CI OIDC id token and exchange it for a Hugging Face token. Convenience wrapper around [`get_oidc_token`] + [`exchange_oidc_token`]. Returns the raw exchange response (it does not persist anything — the caller decides what to do with the token). Args: resource (`str`): Repo or username to scope the token to. See [`exchange_oidc_token`]. subject_token (`str`, *optional*): A pre-minted OIDC id token to exchange directly. Use this for CI providers not yet supported natively (e.g. GitLab): mint the id token in your job and pass it here. When omitted, the token is minted from the detected `provider`. provider (`str`, *optional*): CI provider. Auto-detected when omitted. Ignored when `subject_token` is provided. audience (`str`, *optional*): The `aud` claim to request. Defaults to the resolved `endpoint`, so it matches the endpoint that validates it. endpoint (`str`, *optional*): Hub endpoint. Defaults to `constants.ENDPOINT`. Returns: `dict`: The token-exchange response (`access_token`, `token_type`, `expires_in`, ...). Nr))r7r8r6)rr1r5r?)r8r7r*rr6s r oidc_loginrAsD>-9-H&8CWxXXX ]XX` a a aar)rrenumrrerrorsrutilsrrr=r>strr rr(r5dictr?rArrrrHs   33333333O<sD D$S$S$$$$.9=UYkkk3 5kd k^akkkk.VZ#d ^bB!%&* "b"b"b"b:"bnt# "b Dj "b Dj "b "b"b"b"b"b"br