
    	]j"                         d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ  G d dej*                        Z G d de      Z G d de      Z G d de      Zy)    )	timedelta)Any)AutoOneToOneField)models)gettext_lazy)Organization)TokenBackend)
TokenError)RefreshToken)api_settingsc                   L   e Zd ZdZ eeddej                        Z ej                   e
d      dd      Z ej                   e
d      d	d
      Z ej                   e
d      dd      Z ej                   e
d      d      Z ej                   e
d      d      Zd Zy)JWTSettingsz5Organization-specific JWT settings for authenticationjwtT)related_nameprimary_key	on_deletezJWT API tokens enabledz9Enable JWT API token authentication for this organization)default	help_textz!JWT API token time to live (days)( z+Number of days before JWT API tokens expirezlegacy API tokens enabledFz<Enable legacy API token authentication for this organizationz
created at)auto_now_addz
updated at)auto_nowc                 8    | j                   j                  |      S )N)organizationhas_permission)selfusers     F/root/env/lib/python3.12/site-packages/label_studio/jwt_auth/models.pyr   zJWTSettings.has_permission%   s      //55    N)__name__
__module____qualname____doc__r   r   r   
DO_NOTHINGr   BooleanField_api_tokens_enabledIntegerFieldapi_token_ttl_dayslegacy_api_tokens_enabledDateTimeField
created_at
updated_atr    r   r   r   r      s    ?$\SWcictctuL,,,	
"#M
 -,,	
-.?
 !4 3 3	
%&P! &%%aoDIJ%%%aoEJ6r   r   c                   T     e Zd ZdZdeeef   def fdZdeeef   def fdZ xZ	S )LSTokenBackendaW  A custom JWT token backend that truncates tokens before storing in the database.

    Extends simlpe jwt's TokenBackend to provide methods for generating both
    truncated tokens (header + payload only) and full tokens (header + payload + signature).
    This preserves privacy of the token by not exposing the signature to the frontend.
    payloadreturnc                 n    t         |   |      j                  d      \  }}}dj                  ||g      S )a$  Encode a payload into a truncated JWT token string.

        Args:
            payload: Dictionary containing the JWT claims to encode

        Returns:
            A truncated JWT string containing only the header and payload portions,
            with the signature section removed
        .)superencodesplitjoin)r   r0   header	signature	__class__s       r   r5   zLSTokenBackend.encode1   s9     &+W^G%<%B%B3%G"xx)**r   c                 "    t         |   |      S )zEncode a payload into a complete JWT token string.

        Args:
            payload: Dictionary containing the JWT claims to encode

        Returns:
            A complete JWT string containing header, payload and signature portions
        )r4   r5   )r   r0   r:   s     r   encode_fullzLSTokenBackend.encode_full>   s     w~g&&r   )
r   r    r!   r"   dictstrr   r5   r<   __classcell__r:   s   @r   r/   r/   )   sC    +d38n + +	'4S> 	'c 	' 	'r   r/   c            
            e Zd ZdZ ed      Z eej                  ej                  ej                  ej                  ej                  ej                  ej                  ej                        ZdefdZ fdZ xZS )
LSAPITokena=  API token that utilizes JWT, but stores a truncated version and expires
    based on user settings

    This token class extends RefreshToken to provide organization-specific token
    lifetimes and support for truncated tokens. It uses the LSTokenBackend to
    securely store the token (without the signature).
    r   )daysr1   c                 T    | j                         j                  | j                        S )zGet the complete JWT token string (including the signature).

        Returns:
            The full JWT token string with header, payload and signature
        )get_token_backendr<   r0   )r   s    r   get_full_jwtzLSAPIToken.get_full_jwt`   s"     %%'33DLLAAr   c                 @    | j                          t        | 	         S )zBlacklist this token.

        Raises:
            rest_framework_simplejwt.exceptions.TokenError: If the token is already blacklisted.
        )check_blacklistr4   	blacklist)r   r:   s    r   rI   zLSAPIToken.blacklisth   s     	w ""r   )r   r    r!   r"   r   lifetimer/   simple_jwt_settings	ALGORITHMSIGNING_KEYVERIFYING_KEYAUDIENCEISSUERJWK_URLLEEWAYJSON_ENCODER_token_backendr>   rF   rI   r?   r@   s   @r   rB   rB   J   s~     i(H#%%''))$$""##""((	NBc B# #r   rB   c                   "     e Zd ZdZ fdZ xZS )TruncatedLSAPITokenzHandles JWT tokens that contain only header and payload (no signature).
    Used when frontend has access to truncated refresh tokens only.c                     |j                  d      }t        |      dkD  rdj                  |dd       }nt        |      dk  rt        d      |dz   dz   }t	        |   |g|ddi| y)z^Initialize a truncated token, ensuring it has exactly 2 parts before adding a dummy signature.r3      NzInvalid Label Studio token+xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxverifyF)r6   lenr7   r
   r4   __init__)r   tokenargskwargspartsr:   s        r   r\   zTruncatedLSAPIToken.__init__v   su     C u:>HHU2AY'EZ!^9:: x(>t>u>v>r   )r   r    r!   r"   r\   r?   r@   s   @r   rV   rV   r   s    G? ?r   rV   N)datetimer   typingr   annoying.fieldsr   	django.dbr   django.utils.translationr   r%   organizations.modelsr   !rest_framework_simplejwt.backendsr	   #rest_framework_simplejwt.exceptionsr
   rest_framework_simplejwt.tokensr   r   rK   Modelr   r/   rB   rV   r-   r   r   <module>rk      sY      -  6 - : : 8 O6&,, 66'\ 'B%# %#P?* ?r   