
    	]j(
                         d dl Z d dlmZ d dlmZ d dlmZ  e j                  e      Z	 G d de      Z
 G d de      Zy)	    N)OpenApiAuthenticationExtension)TokenAuthentication)AuthenticationFailedc                   "     e Zd ZdZ fdZ xZS )TokenAuthenticationPhaseoutzTokenAuthentication with features to help phase out legacy token auth

    Logs usage and triggers a 401 if legacy token auth is not enabled for the organization.c                 l   ddl m} ddlm} t        
|   |      }||\  }}|j                  |        |d      }|ru|s|\  }}|j                  }|r|j                  nd}	|r!|j                  j                  st        d      t        j                  d|j                  |	|j                  d	       |S )
z/Authenticate the request and log if successful.r   )CurrentContext)flag_setN8fflag__feature_develop__prompts__dia_1829_jwt_token_authziAuthentication token no longer valid: legacy token authentication has been disabled for this organizationz Legacy token authentication used)user_idorganization_idendpoint)extra)core.current_requestr	   core.feature_flagsr
   superauthenticateset_useractive_organizationidjwtlegacy_api_tokens_enabledr   loggerinfopath)selfrequestr	   r
   auth_resultuser_JWT_ACCESS_TOKEN_ENABLEDorgorg_id	__class__s             D/root/env/lib/python3.12/site-packages/label_studio/jwt_auth/auth.pyr   z(TokenAuthenticationPhaseout.authenticate   s    7/g*73 "!GD!##D)#+,f#g #)@!GD!**C"SVVF CGG==*  KK2"&''fRYR^R^_       )__name__
__module____qualname____doc__r   __classcell__)r$   s   @r%   r   r   
   s    _ r&   r   c                       e Zd ZdZdZd Zy)JWTAuthSchemez)jwt_auth.auth.TokenAuthenticationPhaseoutTokenc                     ddddddddd	S )
NapiKeyAuthorizationheadera  The token (or API key) must be passed as a request header. You can find your user token on the User Account page in Label Studio. Example: <br><pre><code class="language-bash">curl https://label-studio-host/api/projects -H "Authorization: Token [your-token]"</code></pre>api_keyLABEL_STUDIO_API_KEYzToken )nameenvprefix)typer5   indescriptionzx-fern-header )r   auto_schemas     r%   get_security_definitionz%JWTAuthScheme.get_security_definition2   s*    # "-"
 	
r&   N)r'   r(   r)   target_classr5   r=   r;   r&   r%   r-   r-   .   s    >LD
r&   r-   )loggingdrf_spectacular.extensionsr   rest_framework.authenticationr   rest_framework.exceptionsr   	getLoggerr'   r   r   r-   r;   r&   r%   <module>rD      s>     E = :			8	$!"5 !H
2 
r&   