gjO 4UdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZmZmZd d lmZd d lmZd d lmZmZd ZdZdededdfdZdae Zda edze!d<ej"e#Z$dedzfdZ%dedzfdZ&dedzfdZ'dedzfdZ(Gdde Z)e Z*da+e)dze!d<dZ,dedzfdZ-Gdde Z.e Z/da0e.dze!d <d!Z1dZ2da3dedzfd"Z4d#edefd$Z5d%eddfd&Z6d'e7eefde8dzfd(Z9de7eeffd)Z:de7ee7eefffd*Z;d+e7ee7eeffddfd,Zd#edzdedzfd3Z?dS)4zVContains a helper to get the token from machine (env variable, secret or config file).N)Path)Lock) TypedDict) constants)DeviceCodeErrorOAuthErrorCode OIDCError) WeakFileLock)refresh_access_token)is_colab_enterpriseis_google_colabiipathcontentreturnc |jddttjt |tjtjztjzt}tj |d5}| |dddn #1swxYwY | t|j tdS#ttf$rYdSwxYw)ziWrite content to file, restricting both the file and its parent directory to owner-only on POSIX systems.T)parentsexist_okmodewN)parentmkdir_SECRET_DIR_MODEosopenstrO_WRONLYO_CREATO_TRUNC_SECRET_FILE_MODEfdopenwritechmodOSErrorNotImplementedError)rrfdfs _/var/www/app.qaans.com/backend/venv/lib/python3.11/site-packages/huggingface_hub/utils/_auth.py _write_secretr*%sKdT8HIII TBK"*4rzACT U UB 2s  q   $%%% *+++++ ( )     s$B&&B*-B*29C--DDF_GOOGLE_COLAB_SECRETcrtp)tptp tS)a] Get token if user is logged in. Note: in most cases, you should use [`huggingface_hub.utils.build_hf_headers`] instead. This method is only useful if you want to retrieve the token for other purposes than sending an HTTP request. If `HF_OIDC_RESOURCE` is set (Trusted Publishers, typically in CI), a short-lived token obtained via OIDC token exchange takes precedence. Otherwise the token is retrieved from the `HF_TOKEN` environment variable, then from the token file in the Hugging Face home folder. Returns None if user is not logged in. To log in, use [`login`] or `hf auth login`. OAuth tokens obtained with the browser-based login come with a refresh token: when such a token is close to expiry, it is transparently refreshed and persisted before being returned. Note: if `HF_OIDC_RESOURCE` is set but the OIDC token exchange fails, this raises instead of returning `None`, opting into OIDC is explicit, so a failure surfaces as a clear error rather than a silent fallback. Returns: `str` or `None`: The token, `None` if it doesn't exist. )_get_token_from_oidc_get_token_from_environment_get_token_from_file_refreshed_get_token_from_google_colabr) get_tokenr3:s>,  * & ( ( * ) + + * ( ) ) r2chtrtrdSt5trtcdddS ddlm}ddlm}n#t$rYddddSwxYw | d}t|an#|j $rtjddaYn_|j$rt ddaYn8|$r1}tjdt%|d daYd}~nd}~wwxYwd atcdddS#1swxYwYdS) zGet token from Google Colab secrets vault using `google.colab.userdata.get(...)`. Token is read from the vault only once per session and then stored in a global variable to avoid re-requesting access to the vault. Nr)userdata)ErrorHF_TOKENz Access to the secret `HF_TOKEN` has not been granted on this notebook. You will not be requested again. Please restart the session if you want to be prompted again.zThe secret `HF_TOKEN` does not exist in your Colab secrets. Run `huggingface_hub.login()` to authenticate (recommended but still optional to access public models or datasets).z@ Error while fetching `HF_TOKEN` secret value from your vault: 'z'. You are not authenticated with the Hugging Face Hub in this notebook. If the error persists, please let us know by opening an issue on GitHub (https://github.com/huggingface/huggingface_hub/issues/new).T)rr_GOOGLE_COLAB_SECRET_LOCK_IS_GOOGLE_COLAB_CHECKEDr+ google.colabr5google.colab.errorsr6 ImportErrorget _clean_tokenNotebookAccessErrorwarningswarnSecretNotFoundErrorloggerinfor)r5 ColabErrortokenes r)r0r0WsY    3 5 5t #-$-$ $ (' -$-$-$-$-$-$-$-$  - - - - - - ? ? ? ? ? ? ?   -$-$-$-$-$-$-$-$  (LL,,E#/#6#6 + ( ( ( MQ    $( + ( ( ( KKf   $(  ( ( ( MOTWXYTZTZOOO    $(  ($( #[-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$swD' AD' A(D''A((D',$BD' D1D'3%DD'D'D D' D D''D+.D+cttjdptjdS)Nr7HUGGING_FACE_HUB_TOKEN)r>renvironr=r1r2r)r.r.s2  z22^bjnnE]6^6^ _ __r2c tttjS#t $rYdSwxYw)N)r>rr HF_TOKEN_PATH read_textFileNotFoundErrorr1r2r)_get_token_from_filerOsND!899CCEEFFF tts7: AAc.eZdZUeed<eed<eed<dS)_OidcTokenCacheresourcerF expires_atN__name__ __module__ __qualname__r__annotations__floatr1r2r)rQrQs0MMM JJJr2rQ_OIDC_TOKEN_CACHEi,cztjd}|sdSddlm}m}t 5tj}t;td|kr*|tdkrtdcdddStjdpd}||td ||| }|d }t|d d }|dnt}|||t||z dzda |cdddS#1swxYwYdS)aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCENr)detect_provider oidc_loginrRrSrFHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rR subject_token access_token expires_inir)rRrFrS)rrJr=_oidcr]r^_OIDC_TOKEN_LOCKtime monotonicrZr int_OIDC_REFRESH_MARGINmax) rRr]r^nowr`resultrFrbmargins r)r-r-sz~~011H t33333333 n  )!*-99' 555$W- '9::Bd  __%6%6%>O  X]KKK~&L$7788 $/5I J$7 ; ;;   =sA D0 BD00D47D4c.eZdZUeed<eed<eed<dS)_OAuthRefreshCache file_tokenresolved_token recheck_atNrTr1r2r)rnrns3OOOr2rn_OAUTH_REFRESH_CACHEiQcDt}|dSt|S)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rO_refresh_oauth_token_if_neededrFs r)r/r/s% " "E }t )% 0 00r2rFc t5tj}t}|,|dkr ||dkr|dcdddStfdt Ddif\}}|d}t|}|||@t}||kr|cdddS|tzdacdddS|tz |kr|tz dacdddS ttj dzd 5t |i}|d kr'|d p}t|} nt|} | d }d | vr%t|t| d znd} t!||| dp|| tkr't#t%tj|t(d|ddddn #1swxYwYn#t,$r} t/| t0rC| jt4jkr.t(d| dt;d} nt=d| d|tz} | dacYd} ~ cdddSd} ~ wwxYw||t?|tz| r | tz ndda|cdddS#1swxYwYdS)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrorqrpc3XK|]$\}}|dk||fV%dS)hf_tokenNr=).0namefieldsrFs r) z1_refresh_oauth_token_if_needed.. sF v v fV\V`V`akVlVlpuVuVudF^VuVuVuVu v vr2 refresh_token)rorprqz.lock)timeoutrxrarb)rF token_namer~rSzAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.r) _OAUTH_REFRESH_LOCKrerrnext_read_stored_tokens_fullitemsr=_parse_expires_atrO_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rg _save_tokenr*rrLrCrD Exception isinstancer error_coder INVALID_GRANTwarningrY_warn_refresh_failure_onceri) rFrjcacherr|r~rScurrent_file_token new_tokennew_expires_atresponserGrqs ` r)rtrtsZ WWikk$  |!4!=!=#lH[B[B[)* WWWWWWWW " v v v v0H0J0J0P0P0R0R v v v 2J   F ?33 &v..  !6*:L"6!7!7 !-2D2M2M)#WWWWWWWW($"'!$;;$$ 1WWWWWWWW4 - - 3 3#"'(+@@$$ AWWWWWWWWD) i=GQSTTT T T13377 BGG::j))U22 & : 6 6 ?%I%6v%>%>NN3MBBH ( 8IO[_gOgOgSXXH\4J0K0K%K%KmqN'#-&.ll?&C&C&T}#1 ,--66%d9+B&C&CYOOOKK R R R RSSS+ T T T T T T T T T T T T T T T,   !_-- ;!,.B^2^2^c^_ccc#5\\ ++v`a+v+v+vwww #:: 275`j#k#k LLLLLWWWWWWWWWv &$'--:HO!666a oWWWWWWWWWWWWWWWWWWszz%get_stored_tokens..ts- p p p7Iz6J :r22 p p pr2)rrr1r2r)get_stored_tokensrks, q pMeMgMgMmMmMoMo p p ppr2cnttj}|siSt jd |fdDS#tj$r)}t d|icYd}~Sd}~wwxYw)zRead all sections of the stored tokens INI file, with all their fields. Beside `hf_token`, sections for OAuth tokens also carry `refresh_token` and `expires_at` (unix timestamp), used by [`get_token`] to transparently refresh them. N interpolationcVi|]%}|t|&Sr1)dictr)rzrconfigs r)rz,_read_stored_tokens_full..s/___z Dj!9!9::___r2z"Error parsing stored tokens file: ) rrrexists configparser ConfigParserreadsectionsr6rCerror) tokens_pathrGrs @r)rrws y677K       &T : : :F K   ____V__M^M^____   =!==>>> s4A<<B4 B/)B4/B4 stored_tokensctjd}t|D]N}||||D]\}}||||Otj}| |tttj |dS)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr#r*rrrgetvalue)rrrkeyvaluebufs r)_save_stored_tokens_fullrs  &T : : :F]//1122// :&&&' 399;; / /JC JJz3 . . . . / +--C LL$y677HHHHHr2rcTt}||vrdSt||S)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rr>)rrs r)_get_token_by_namers2&''M&&t  j1 2 22r2)r~rSr~rSct}d|i}|||d<|t||d<|||<t|td|dt jdS)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. rxNr~rSz The token `z` has been saved to )rrrrCrDrr)rFrr~rSrr|s r)rrs"-..M% F "/":| &M*]+++ KK_j__i>]__`````r2c|dS|ddddpdS)zuClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprus r)r>r>sC  }t ==r " " * *4 4 4 : : < < DDr2)@__doc__rrloggingrrer@pathlibr threadingrtypingrrrerrorsrr r _fixesr _oauth_devicer _runtimerrr!rrr*r9r8r+rX getLoggerrUrCr3r0r.rOrQrdrZrhr-rnrrrrrrr/rtrrrgrrrrrrr>r1r2r)rs]\\  ?????????? //////::::::::    s  t     ! DFF#'cDj'''  8 $ $3::<$cDj<$<$<$<$~`S4Z```` cDji466,0?T)0000cDj0000fdff26(4/666!1d 1111`#`#````F%%%%%%d38nt q4S> q q q q$sDcN':";& IDd38n1D,E I$ I I I I3333:3333&AE_caaa aa36:aRUX\R\a aaaa:Ed EsTzEEEEEEr2