
    &`i              	           d dl Z d dlmZ d dlmZmZmZ d dlmZm	Z
  e j        e          Z	 	 ddedeee                  deee                  fdZd	eeef         d
eeef         fdZdeded
ee         fdZdS )    N)
ModuleType)DictListOptional)authentication_constantsauthentication_utilsaiohttp_modulewhitelisted_exact_pathswhitelisted_path_prefixesc                 >      j         j         fd            }|S )an  Internal helper to create token auth middleware with provided modules.

    Args:
        aiohttp_module: The aiohttp module to use
        whitelisted_exact_paths: List of exact paths that don't require authentication
        whitelisted_path_prefixes: List of path prefixes that don't require authentication
    Returns:
        An aiohttp middleware function
    c                   K   t          j                    s ||            d{V S r	| j        v s)r8| j                            t	                              r ||            d{V S | j                            t          j        d          }|s%| j                            t          j	        d          }|s5| j
                            t          j                  }|rt          j        |z   }|sj                            dd          S t          j        |          sj                            dd          S  ||            d{V S )zMiddleware to validate bearer tokens when token authentication is enabled.

        In minimal Ray installations (without ray._raylet), this middleware is a no-op
        and passes all requests through without authentication.
        N   z*Unauthorized: Missing authentication token)statustext  z'Forbidden: Invalid authentication token)
auth_utilsis_token_auth_enabledpath
startswithtupleheadersgetr   AUTHORIZATION_HEADER_NAMERAY_AUTHORIZATION_HEADER_NAMEcookies AUTHENTICATION_TOKEN_COOKIE_NAMEAUTHORIZATION_BEARER_PREFIXwebResponsevalidate_request_token)requesthandlerauth_headertokenr	   r
   r   s       /home/jaya/work/projects/VOICE-AGENT/VIET/agent-env/lib/python3.11/site-packages/ray/_private/authentication/http_token_authentication.pytoken_auth_middlewarez8get_token_auth_middleware.<locals>.token_auth_middleware   s      /11 	* ))))))))) $ 	*8O(O(O% )P''.G(H(HII )P !))))))))) o))$>
 
  	!/--(F K  	O''(I E   -H5P   	!%..!M /    0== 	!%..!J /    WW%%%%%%%%%    )r   
middleware)r	   r
   r   r'   s   ``` r&   get_token_auth_middlewarer*      sD     "3& 3& 3& 3& 3& 3& #"3&j ! r(   user_headersreturnc                 "   t          j                    si S ddlm} t	          d |                                 D                       }|ri S |                                }|                                }|st          	                    d           |S )Nr   )AuthenticationTokenLoaderc              3   Z   K   | ]&}|                                 t          j        k    V  'd S )N)lowerr   r   ).0keys     r&   	<genexpr>z3get_auth_headers_if_auth_enabled.<locals>.<genexpr>]   sG         			/II     r(   zeToken authentication is enabled but no token was found. Requests to authenticated clusters will fail.)
r   r   ray._rayletr.   anykeysinstanceget_token_for_http_headerloggerwarning)r+   r.   has_user_authtoken_loaderauth_headerss        r&    get_auth_headers_if_auth_enabledr>   U   s    +-- 	555555   $$&&    M  	,5577L99;;L 
<	
 	
 	

 r(   r   bodyc                     | dk    r!d                     |t          j                  S | dk    r!d                     |t          j                  S dS )zCReturn a user-friendly authentication error message, if applicable.r   z*Authentication required: {body}

{details})r?   detailsr   z(Authentication failed: {body}

{details}N)formatr   3TOKEN_AUTH_ENABLED_BUT_NO_TOKEN_FOUND_ERROR_MESSAGETOKEN_INVALID_ERROR_MESSAGE)r   r?   s     r&    format_authentication_http_errorrE   r   sm     }}=DD,` E 
 
 	

 }};BB,H C 
 
 	

 4r(   )NN)loggingtypesr   typingr   r   r   ray._private.authenticationr   r   r   	getLogger__name__r9   strr*   r>   intrE    r(   r&   <module>rO      s:          ' ' ' ' ' ' ' ' ' '       
 
	8	$	$
 4859E! E!E!%d3i0E!  (S	2E! E! E! E!P4S> d3PS8n    :S        r(   