j6hUddlmZddlZddlZddlmZddlmZmZm Z m Z ddl m Z ddl Z ddlmZmZddlmZmZmZmZmZmZmZmZd d lmZed eZd Zd ZdZddZ ddZ!ddddZ"gdZ#ejHe%Z&de'd<GddeZ(GddZ)ddddd ddZ*y) ) annotationsN) TracebackType)AnyDictTypeOptional)override) AccessTokenIdentityTokenProvider)TOKEN_ENDPOINTDEFAULT_BASE_URLGRANT_TYPE_JWT_BEAREROAUTH_API_BETA_HEADERFEDERATION_BETA_HEADERTOKEN_EXCHANGE_TIMEOUT _user_agent_require_https)AnthropicError,i@icv|jjdxs|jjd}|S)Nz Request-Idz request-id)headersget)resprids V/var/www/html/venv/lib/python3.12/site-packages/anthropic/lib/credentials/_workload.py _request_idr,s/)),7Y4<<;K;KL;YC Jc|yt|tr4t|tkr|S|dtdt|tz dzSt|tri}dD]}||vs||||<|Sy)zHTruncate a token-endpoint error body for safe inclusion in an exception.Nz... )errorerror_description error_uri) isinstancestrlen_MAX_ERROR_BODY_CHARSdict)bodykeptkeys r _redact_bodyr-1s |$ t9- -K**+c$iBW6W5XXd.eee$!>Cd{ IS ? r )hintc |j}t|}|d|jd|}|r|d|}t ||j|t |#t$r|j}YawxYw)uRaise a redacted :class:`WorkloadIdentityError` from a non-200 token-endpoint response. Shared between the jwt-bearer exchange path in this module and the refresh_token grant path in :mod:`_providers`. ``hint`` is an optional caller-supplied diagnostic appended verbatim to the error message (after the redacted body). Callers gate it on the response status and their own state — this helper does not inspect ``resp`` for it. z (HTTP ):   status_coder* request_id)json ValueErrortextr-r3WorkloadIdentityErrorr)rmessage_prefixr.payloadredactedmessages r_raise_token_endpoint_errorr=Csyy{G$H (8(8'9XJGG IQtf% $$ t$   ))sAA43A4)WorkloadIdentityCredentialsr8exchange_federation_assertionzlogging.LoggerlogcveZdZUdZded<ded<ded<dddd  d fd Zed fd ZxZS)r8zERaised when the OIDC token exchange (``POST /v1/oauth/token``) fails. Optional[int]r3rr* Optional[str]r4Nr2cNt||||_||_||_yN)super__init__r3r*r4)selfr<r3r*r4 __class__s rrGzWorkloadIdentityError.__init__is( !& $r c`t|}|jr|d|jdS|S)Nz [request_id=])rF__str__r4)rHbaserIs rrLzWorkloadIdentityError.__str__vs3w  ??V=(9; ; r ) r<r&r3rBr*rr4rCreturnNonerNr&) __name__ __module__ __qualname____doc____annotations__rGr rL __classcell__)rIs@rr8r8bskO I &*$( % %# %  % " %  %r r8ceZdZdZddddd ddZeddZeddZddZddZ dd Z dd Z d d dd Z y)r>uExchanges an external OIDC JWT for an Anthropic access token via the RFC 7523 ``jwt-bearer`` grant. This is an :class:`AccessTokenProvider`: calling it performs a *fresh* token exchange. Wrap in a :class:`TokenCache` (done automatically when passed as ``credentials=`` to :class:`anthropic.Anthropic`) to avoid exchanging on every request. Args: organization_id: The organization's raw UUID string (organizations do not use tagged IDs). workspace_id: Optional ``wrkspc_*`` tagged ID, or the literal ``"default"`` to scope the token to the organization's default workspace. When omitted the server picks the rule's sole enabled workspace, else the org default if the rule covers it. Required when the rule enables more than one non-default workspace, or to target a specific workspace other than the one the server would pick. The minted token is workspace-scoped: per-request workspace selection (the ``anthropic-workspace-id`` header) is not supported for federation tokens — switching workspaces requires a new token exchange with a different ``workspace_id``. N)service_account_id workspace_idscope http_clientc||_||_||_||_||_||_d|_|'tjt|_ d|_ y||_ d|_ y)N)timeoutTF) _identity_token_provider_federation_rule_id_organization_id_service_account_id _workspace_id_scope_bound_base_urlhttpxClientr _http_client_owns_http_client)rHidentity_token_providerfederation_rule_idorganization_idrXrYrZr[s rrGz$WorkloadIdentityCredentials.__init__sp)@%#5 /#5 )  /3   % 5K LD %)D " +D %*D "r c|jSrE)rcrHs rrZz!WorkloadIdentityCredentials.scopes {{r c*|jxstSrE)rdrrms r _base_urlz%WorkloadIdentityCredentials._base_urls##7'77r cN|jd}t|d||_y)aSet the API ``base_url`` the token exchange POSTs to. Called by :class:`anthropic.Anthropic` when this object is passed as ``credentials=``, so callers don't pass the same URL twice. For standalone use (no client) or tests, call this directly. /base_url)fieldN)rstriprrd)rHrrbounds r bind_base_urlz)WorkloadIdentityCredentials.bind_base_urls$$uJ/$r cR|jr|jjyy)z7Close the underlying ``httpx.Client`` if we created it.N)rhrgcloserms rrxz!WorkloadIdentityCredentials.closes"  ! !    # # % "r c|SrErms r __enter__z%WorkloadIdentityCredentials.__enter__s r c$|jyrE)rx)rHexc_typeexctbs r__exit__z$WorkloadIdentityCredentials.__exit__s r F) force_refreshc~|j}t|jdtkDr.t dt|jddtdt ||j |jd}|j|j|d<|j|j|d<|jt} |jj||tdtd  }t%|}t|j&t(kDr6t d t(dt|j&d|j*||j*dk\r7d}|j*dk(rd}|j|dz }|dz }t-|d| |j/} | j7d} | Bt9| j;dk7r&t d| d|j*t3| | | d} t=| d } tC| t=tEjD| z"S#t j"$r}t d |d ||d}~wwxYw#t0$rD}t3|j4} t d|j*d| |j*| ||d}~wwxYw#t>t@t0f$r(}t d!|j*t3| ||d}~wwxYw)#Nzutf-8zIdentity token assertion is z bytes, which exceeds the u-byte limit. This is almost certainly not a JWT — check that the identity-token path points at the projected token, not a key or cert.) grant_type assertionrjrkrXrYzapplication/json)zanthropic-betaz Content-Typez User-Agent)r5rzFailed to reach token endpoint z: z%Token endpoint response body exceeds z bytes (got z); refusing to parse.)r3r4iiz9Ensure your federation rule matches your identity token. zIf your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the workspace_id= argument. zaView your authentication events in the Workload identity page of Claude Console for more details.zToken exchange failed)r9r.z2Token endpoint returned non-JSON response (status r0r2 token_typebearerz/Token endpoint returned unsupported token_type z (expected 'Bearer'). access_token expires_inzLToken endpoint response missing required fields (access_token / expires_in).)token expires_at)#r^r'encode_MAX_ASSERTION_BYTESr8rr_r`rarbror rgpost_JWT_BEARER_BETA_HEADERrre HTTPErrorrcontent_MAX_TOKEN_RESPONSE_BYTESr3r=r5r6r-r7rr&lowerintKeyError TypeErrorr time)rHrjwtr*urlrerrr4r.datar;rrrs r__call__z$WorkloadIdentityCredentials.__call__sB ++- szz'" #&: :'.s3::g3F/G.HHb'()ab 0"&":":#44    # # /)-)A)AD% &    )#'#5#5D   01 a$$))&=$6"--*D!& t|| 8 8'78Q7RSDLL)**?A ,,%     s " #'D3&R%%-FD {{ '=T[_ ` 99;DXXl+  !c*o&;&;&=&I'A*Ode ,,!$'%   (ET,/0J3tyy{3Cj3PQQ} a'*I#bQTPU(VW]` ` a@ #DII.H'DTEUEUDVVYZbYcd ,,%     ,)Z0 '^ ,,!$'%     sH .II.J>I+I&&I+. J;7?J66J;>K:#K55K:)rir rjr&rkr&rXrCrYrCrZrCr[Optional[httpx.Client]rNrO)rNrCrP)rrr&rNrO)rNrO)rNz'WorkloadIdentityCredentials')r}zOptional[Type[BaseException]]r~zOptional[BaseException]rzOptional[TracebackType]rNrO)rboolrNr ) rQrRrSrTrGpropertyrZrorvrxr{rrrzr rr>r>~s:-1&*#.2!+"7!+ !+  !+ * !+$!+!+,!+ !+F88 %& /% $   16bRr r>)rXrYrrr[ctfd|||||}||j| ||jS#|jwxYw)aSPerform a single RFC 7523 ``jwt-bearer`` exchange and return the resulting :class:`AccessToken`. This is a one-shot convenience wrapper around :class:`WorkloadIdentityCredentials` for callers that already have the assertion JWT in hand and just want the Anthropic access token back (no caching, no provider plumbing). cSrErz)rsrz/exchange_federation_assertion..Ss r )rirjrkrXrYr[)r>rvrx)rrjrkrXrYrrr[credss` rr?r?AsT" ( 1-'-!  E H%w  s AA)rhttpx.ResponserNrC)r*rrNr)rrr9r&r.rCrNrO)rr&rjr&rkr&rXrCrYrCrrrCr[rrNr )+ __future__rrloggingtypesrtypingrrrrtyping_extensionsr re_typesr r _constantsr rrrrrrr _exceptionsrrr(rrrr-r=__all__ getLoggerrQr@rUr8r>r?rzr rrs" ,,& 6   * 3315K4LM !# $ei4 d'g''1^1N8@R@RP)-"&"*.  &   (r