XjO 4UdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZmZmZd d lmZd d lmZd d lmZmZd ZdZdededdfdZdae Zda edze!d<ej"e#Z$dedzfdZ%dedzfdZ&dedzfdZ'dedzfdZ(Gdde Z)e Z*da+e)dze!d<dZ,dedzfdZ-Gdde Z.e Z/da0e.dze!d <d!Z1dZ2da3dedzfd"Z4d#edefd$Z5d%eddfd&Z6d'e7eefde8dzfd(Z9de7eeffd)Z:de7ee7eefffd*Z;d+e7ee7eeffddfd,Zd#edzdedzfd3Z?dS)4zVContains a helper to get the token from machine (env variable, secret or config file).N)Path)Lock) TypedDict) constants)DeviceCodeErrorOAuthErrorCode OIDCError) WeakFileLock)refresh_access_token)is_colab_enterpriseis_google_colabiipathcontentreturnc|jddttjt |tjtjztjzt}tj |dd5}| |dddn #1swxYwY | t|j tdS#ttf$rYdSwxYw)ziWrite content to file, restricting both the file and its parent directory to owner-only on POSIX systems.T)parentsexist_okmodewutf-8encodingN)parentmkdir_SECRET_DIR_MODEosopenstrO_WRONLYO_CREATO_TRUNC_SECRET_FILE_MODEfdopenwritechmodOSErrorNotImplementedError)rrfdfs LC:\Projects\Historical\venv\Lib\site-packages\huggingface_hub/utils/_auth.py _write_secretr-%s$KdT8HIII TBK"*4rzACT U UB 2sW - - -   $%%% *+++++ ( )     s$B((B,/B,49C//DDF_GOOGLE_COLAB_SECRETcrtp)tptp tS)a] Get token if user is logged in. Note: in most cases, you should use [`huggingface_hub.utils.build_hf_headers`] instead. This method is only useful if you want to retrieve the token for other purposes than sending an HTTP request. If `HF_OIDC_RESOURCE` is set (Trusted Publishers, typically in CI), a short-lived token obtained via OIDC token exchange takes precedence. Otherwise the token is retrieved from the `HF_TOKEN` environment variable, then from the token file in the Hugging Face home folder. Returns None if user is not logged in. To log in, use [`login`] or `hf auth login`. OAuth tokens obtained with the browser-based login come with a refresh token: when such a token is close to expiry, it is transparently refreshed and persisted before being returned. Note: if `HF_OIDC_RESOURCE` is set but the OIDC token exchange fails, this raises instead of returning `None`, opting into OIDC is explicit, so a failure surfaces as a clear error rather than a silent fallback. Returns: `str` or `None`: The token, `None` if it doesn't exist. )_get_token_from_oidc_get_token_from_environment_get_token_from_file_refreshed_get_token_from_google_colabr, get_tokenr6<s>,  * & ( ( * ) + + * ( ) ) r5chtrtrdSt5trtcdddS ddlm}ddlm}n#t$rYddddSwxYw | d}t|an#|j $rtjddaYn_|j$rt ddaYn8|$r1}tjdt%|d daYd}~nd}~wwxYwd atcdddS#1swxYwYdS) zGet token from Google Colab secrets vault using `google.colab.userdata.get(...)`. Token is read from the vault only once per session and then stored in a global variable to avoid re-requesting access to the vault. Nr)userdata)ErrorHF_TOKENz Access to the secret `HF_TOKEN` has not been granted on this notebook. You will not be requested again. Please restart the session if you want to be prompted again.zThe secret `HF_TOKEN` does not exist in your Colab secrets. Run `huggingface_hub.login()` to authenticate (recommended but still optional to access public models or datasets).z@ Error while fetching `HF_TOKEN` secret value from your vault: 'z'.T)rr_GOOGLE_COLAB_SECRET_LOCK_IS_GOOGLE_COLAB_CHECKEDr. google.colabr8google.colab.errorsr9 ImportErrorget _clean_tokenNotebookAccessErrorwarningswarnSecretNotFoundErrorloggerinfor )r8 ColabErrortokenes r,r3r3YsE    3 5 5t #($($ $ (' ($($($($($($($($  - - - - - - ? ? ? ? ? ? ?   ($($($($($($($($  (LL,,E#/#6#6 + ( ( ( MQ    $( + ( ( ( KKf   $(  ( ( ( Mh^abc^d^dhhh i i i#'  ( $( #Q($($($($($($($($($($($($($($($($($($swD' AD' A(D''A((D',$BD' D1D'3%DD'D'D D' D D''D+.D+cttjdptjdS)Nr:HUGGING_FACE_HUB_TOKEN)rArenvironr@r4r5r,r1r1s2  z22^bjnnE]6^6^ _ __r5c tttjS#t $rYdSwxYw)N)rArr HF_TOKEN_PATH read_textFileNotFoundErrorr4r5r,_get_token_from_filerRsND!899CCEEFFF tts7: AAc.eZdZUeed<eed<eed<dS)_OidcTokenCacheresourcerI expires_atN__name__ __module__ __qualname__r __annotations__floatr4r5r,rTrTs0MMM JJJr5rT_OIDC_TOKEN_CACHEi,cztjd}|sdSddlm}m}t 5tj}t;td|kr*|tdkrtdcdddStjdpd}||td ||| }|d }t|d d }|dnt}|||t||z dzda |cdddS#1swxYwYdS)aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCENr)detect_provider oidc_loginrUrVrIHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rU subject_token access_token expires_inir)rUrIrV)rrMr@_oidcr`ra_OIDC_TOKEN_LOCKtime monotonicr]r int_OIDC_REFRESH_MARGINmax) rUr`ranowrcresultrIremargins r,r0r0sz~~011H t33333333 n  )!*-99' 555$W- '9::Bd  __%6%6%>O  X]KKK~&L$7788 $/5I J$7 ; ;;   =sA D0 BD00D47D4c.eZdZUeed<eed<eed<dS)_OAuthRefreshCache file_tokenresolved_token recheck_atNrWr4r5r,rqrqs3OOOr5rq_OAUTH_REFRESH_CACHEiQcDt}|dSt|S)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rR_refresh_oauth_token_if_neededrIs r,r2r2s% " "E }t )% 0 00r5rIc t5tj}t}|,|dkr ||dkr|dcdddStfdt Ddif\}}|d}t|}|||@t}||kr|cdddS|tzdacdddS|tz |kr|tz dacdddS ttj dzd 5t |i}|d kr'|d p}t|} nt|} | d }d | vr%t|t| d znd} t!||| dp|| tkr't#t%tj|t(d|ddddn #1swxYwYn#t,$r} t/| t0rC| jt4jkr.t(d| dt;d} nt=d| d|tz} | dacYd} ~ cdddSd} ~ wwxYw||t?|tz| r | tz ndda|cdddS#1swxYwYdS)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrrrtrsc3XK|]$\}}|dk||fV%dS)hf_tokenNr@).0namefieldsrIs r, z1_refresh_oauth_token_if_needed..sF v v fV\V`V`akVlVlpuVuVudF^VuVuVuVu v vr5 refresh_token)rrrsrtz.lock)timeoutr{rdre)rI token_namerrVzAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.r) _OAUTH_REFRESH_LOCKrhrunext_read_stored_tokens_fullitemsr@_parse_expires_atrR_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rj _save_tokenr-rrOrFrG Exception isinstancer error_coder INVALID_GRANTwarningr\_warn_refresh_failure_oncerl) rIrmcacherrrrVcurrent_file_token new_tokennew_expires_atresponserJrts ` r,rwrwsZ WWikk$  |!4!=!=#lH[B[B[)* WWWWWWWW " v v v v0H0J0J0P0P0R0R v v v 2J   F ?33 &v..  !6*:L"6!7!7 !-2D2M2M)#WWWWWWWW($"'!$;;$$ 1WWWWWWWW4 - - 3 3#"'(+@@$$ AWWWWWWWWD) i=GQSTTT T T13377 BGG::j))U22 & : 6 6 ?%I%6v%>%>NN3MBBH ( 8IO[_gOgOgSXXH\4J0K0K%K%KmqN'#-&.ll?&C&C&T}#1 ,--66%d9+B&C&CYOOOKK R R R RSSS+ T T T T T T T T T T T T T T T,   !_-- ;!,.B^2^2^c^_ccc#5\\ ++v`a+v+v+vwww #:: 275`j#k#k LLLLLWWWWWWWWWv &$'--:HO!666a oWWWWWWWWWWWWWWWWWWszz%get_stored_tokens..qs- p p p7Iz6J :r22 p p pr5)rrr4r5r,get_stored_tokensrhs, q pMeMgMgMmMmMoMo p p ppr5cttj}|siSt jd |dfdDS#tjtf$r)}t d|icYd}~Sd}~wwxYw)zRead all sections of the stored tokens INI file, with all their fields. Beside `hf_token`, sections for OAuth tokens also carry `refresh_token` and `expires_at` (unix timestamp), used by [`get_token`] to transparently refresh them. N interpolationrrcVi|]%}|t|&Sr4)dictr)r}rconfigs r,rz,_read_stored_tokens_full..s/___z Dj!9!9::___r5z"Error parsing stored tokens file: ) rrrexists configparser ConfigParserreadsectionsr9UnicodeDecodeErrorrFerror) tokens_pathrJrs @r,rrts y677K       &T : : :F K' 222____V__M^M^____   2 3 =!==>>> s6A>>B=B82B=8B= stored_tokensctjd}t|D]N}||||D]\}}||||Otj}| |tttj |dS)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr&r-rrrgetvalue)rrrkeyvaluebufs r,_save_stored_tokens_fullrs  &T : : :F]//1122// :&&&' 399;; / /JC JJz3 . . . . / +--C LL$y677HHHHHr5rcTt}||vrdSt||S)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rrA)rrs r,_get_token_by_namers2&''M&&t  j1 2 22r5)rrVrrVct}d|i}|||d<|t||d<|||<t|td|dt jdS)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. r{NrrVz The token `z` has been saved to )rr rrFrGrr)rIrrrVrrs r,rrs"-..M% F "/":| &M*]+++ KK_j__i>]__`````r5c|dS|ddddpdS)zuClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprxs r,rArAsC  }t ==r " " * *4 4 4 : : < < DDr5)@__doc__rrloggingrrhrCpathlibr threadingrtypingrrrerrorsrr r _fixesr _oauth_devicer _runtimerrr$rr r-r<r;r.r[ getLoggerrXrFr6r3r1rRrTrgr]rkr0rqrrurrrr2rwrrrjrrrrrrrAr4r5r,rs]\\  ?????????? //////::::::::    s  t     ! DFF#'cDj'''  8 $ $3::7$cDj7$7$7$7$t`S4Z```` cDji466,0?T)0000cDj0000fdff26(4/666!1d 1111`#`#````F%%%%%%d38nt q4S> q q q q$sDcN':";* IDd38n1D,E I$ I I I I3333:3333&AE_caaa aa36:aRUX\R\a aaaa:Ed EsTzEEEEEEr5