Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-06-25 08:26
📄 __init__.py	0 B	2020-09-21 22:03
📄 _helpers.py # Copyright 2017 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. import getpass import sys def get_user_password(text): """Get password from user. Override this function with a different logic if you are using this library outside a CLI. Args: text: message for the password prompt. Returns: password string. """ return getpass.getpass(text) def is_interactive(): """Check if we are in an interractive environment. If the rapt token needs refreshing, the user needs to answer the challenges. If the user is not in an interractive environment, the challenges can not be answered and we just wait for timeout for no reason. Returns: True if is interactive environment, False otherwise. """ return sys.stdin.isatty()	1.29 KB	2020-09-21 22:03
📄 _reauth_client.py # Copyright 2018 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Client for interacting with the Reauth HTTP API. This module provides the ability to do the following with the API: 1. Get a list of challenges needed to obtain additional authorization. 2. Send the result of the challenge to obtain a rapt token. 3. A modified version of the standard OAuth2.0 refresh grant that takes a rapt token. """ import json from six.moves import urllib from google_reauth import errors _REAUTH_API = 'https://reauth.googleapis.com/v2/sessions' def _handle_errors(msg): """Raise an exception if msg has errors. Args: msg: parsed json from http response. Returns: input response. Raises: ReauthAPIError """ if 'error' in msg: raise errors.ReauthAPIError(msg['error']['message']) return msg def _endpoint_request(http_request, path, body, access_token): _, content = http_request( uri='{0}{1}'.format(_REAUTH_API, path), method='POST', body=json.dumps(body), headers={'Authorization': 'Bearer {0}'.format(access_token)} ) response = json.loads(content) _handle_errors(response) return response def get_challenges( http_request, supported_challenge_types, access_token, requested_scopes=None): """Does initial request to reauth API to get the challenges. Args: http_request (Callable): callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) supported_challenge_types (Sequence[str]): list of challenge names supported by the manager. access_token (str): Access token with reauth scopes. requested_scopes (list[str]): Authorized scopes for the credentials. Returns: dict: The response from the reauth API. """ body = {'supportedChallengeTypes': supported_challenge_types} if requested_scopes: body['oauthScopesForDomainPolicyLookup'] = requested_scopes return _endpoint_request( http_request, ':start', body, access_token) def send_challenge_result( http_request, session_id, challenge_id, client_input, access_token): """Attempt to refresh access token by sending next challenge result. Args: http_request (Callable): callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) session_id (str): session id returned by the initial reauth call. challenge_id (str): challenge id returned by the initial reauth call. client_input: dict with a challenge-specific client input. For example: ``{'credential': password}`` for password challenge. access_token (str): Access token with reauth scopes. Returns: dict: The response from the reauth API. """ body = { 'sessionId': session_id, 'challengeId': challenge_id, 'action': 'RESPOND', 'proposalResponse': client_input, } return _endpoint_request( http_request, '/{0}:continue'.format(session_id), body, access_token) def refresh_grant( http_request, client_id, client_secret, refresh_token, token_uri, scopes=None, rapt=None, headers={}): """Implements the OAuth 2.0 Refresh Grant with the addition of the reauth token. Args: http_request (Callable): callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) client_id (str): client id to get access token for reauth scope. client_secret (str): client secret for the client_id refresh_token (str): refresh token to refresh access token token_uri (str): uri to refresh access token scopes (str): scopes required by the client application as a comma-joined list. rapt (str): RAPT token headers (dict): headers for http request Returns: Tuple[str, dict]: http response and parsed response content. """ parameters = { 'grant_type': 'refresh_token', 'client_id': client_id, 'client_secret': client_secret, 'refresh_token': refresh_token, } if scopes: parameters['scope'] = scopes if rapt: parameters['rapt'] = rapt body = urllib.parse.urlencode(parameters) response, content = http_request( uri=token_uri, method='POST', body=body, headers=headers) return response, content	4.96 KB	2020-09-21 22:03
📄 challenges.py # Copyright 2017 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. import abc import base64 import sys import pyu2f.convenience.authenticator import pyu2f.errors import pyu2f.model import six from google_reauth import _helpers, errors REAUTH_ORIGIN = 'https://accounts.google.com' @six.add_metaclass(abc.ABCMeta) class ReauthChallenge(object): """Base class for reauth challenges.""" @property @abc.abstractmethod def name(self): """Returns the name of the challenge.""" pass @property @abc.abstractmethod def is_locally_eligible(self): """Returns true if a challenge is supported locally on this machine.""" pass @abc.abstractmethod def obtain_challenge_input(self, metadata): """Performs logic required to obtain credentials and returns it. Args: metadata: challenge metadata returned in the 'challenges' field in the initial reauth request. Includes the 'challengeType' field and other challenge-specific fields. Returns: response that will be send to the reauth service as the content of the 'proposalResponse' field in the request body. Usually a dict with the keys specific to the challenge. For example, {'credential': password} for password challenge. """ pass class PasswordChallenge(ReauthChallenge): """Challenge that asks for user's password.""" @property def name(self): return 'PASSWORD' @property def is_locally_eligible(self): return True def obtain_challenge_input(self, unused_metadata): passwd = _helpers.get_user_password('Please enter your password:') if not passwd: passwd = ' ' # avoid the server crashing in case of no password :D return {'credential': passwd} class SecurityKeyChallenge(ReauthChallenge): """Challenge that asks for user's security key touch.""" @property def name(self): return 'SECURITY_KEY' @property def is_locally_eligible(self): return True def obtain_challenge_input(self, metadata): sk = metadata['securityKey'] challenges = sk['challenges'] app_id = sk['applicationId'] challenge_data = [] for c in challenges: kh = c['keyHandle'].encode('ascii') key = pyu2f.model.RegisteredKey( bytearray(base64.urlsafe_b64decode(kh))) challenge = c['challenge'].encode('ascii') challenge = base64.urlsafe_b64decode(challenge) challenge_data.append({'key': key, 'challenge': challenge}) try: api = pyu2f.convenience.authenticator.CreateCompositeAuthenticator( REAUTH_ORIGIN) response = api.Authenticate(app_id, challenge_data, print_callback=sys.stderr.write) return {'securityKey': response} except pyu2f.errors.U2FError as e: if e.code == pyu2f.errors.U2FError.DEVICE_INELIGIBLE: sys.stderr.write('Ineligible security key.\n') elif e.code == pyu2f.errors.U2FError.TIMEOUT: sys.stderr.write( 'Timed out while waiting for security key touch.\n') else: raise e except pyu2f.errors.NoDeviceFoundError: sys.stderr.write('No security key found.\n') return None class SamlChallenge(ReauthChallenge): """Challenge that asks the users to browse to their ID Providers.""" @property def name(self): return 'SAML' @property def is_locally_eligible(self): return True def obtain_challenge_input(self, metadata): # Magic Arch has not fully supported returning a proper dedirect URL # for programmatic SAML users today. So we error our here and request # users to complete a web login. raise errors.ReauthSamlLoginRequiredError() AVAILABLE_CHALLENGES = { challenge.name: challenge for challenge in [ SecurityKeyChallenge(), PasswordChallenge(), SamlChallenge() ] }	4.62 KB	2020-09-21 22:03
📄 errors.py # Copyright 2017 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """A module that provides rapt authentication errors.""" class ReauthError(Exception): """Base exception for reauthentication.""" pass class HttpAccessTokenRefreshError(Exception): """Error (with HTTP status) trying to refresh an expired access token.""" def __init__(self, message, status=None): super(HttpAccessTokenRefreshError, self).__init__(message) self.status = status class ReauthUnattendedError(ReauthError): """An exception for when reauth cannot be answered.""" def __init__(self): super(ReauthUnattendedError, self).__init__( 'Reauthentication challenge could not be answered because you are ' 'not in an interactive session.') class ReauthFailError(ReauthError): """An exception for when reauth failed.""" def __init__(self, message=None): super(ReauthFailError, self).__init__( 'Reauthentication challenge failed. {0}'.format(message)) class ReauthAPIError(ReauthError): """An exception for when reauth API returned something we can't handle.""" def __init__(self, api_error): super(ReauthAPIError, self).__init__( 'Reauthentication challenge failed due to API error: {0}.'.format( api_error)) class ReauthAccessTokenRefreshError(ReauthError): """An exception for when we can't get an access token for reauth.""" def __init__(self, message=None, status=None): super(ReauthAccessTokenRefreshError, self).__init__( 'Failed to get an access token for reauthentication. {0}'.format( message)) self.status = status class ReauthSamlLoginRequiredError(ReauthError): """An exception for when web login is required to complete reauth. This applies to SAML users who are required to login through their IDP to complete reauth. """ def __init__(self): super(ReauthSamlLoginRequiredError, self).__init__( 'SAML login is required for the current account to complete ' 'reauthentication.')	2.59 KB	2020-09-21 22:03
📄 reauth.py # Copyright 2017 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """A module that provides functions for handling rapt authentication. Reauth is a process of obtaining additional authentication (such as password, security token, etc.) while refreshing OAuth 2.0 credentials for a user. Credentials that use the Reauth flow must have the reauth scope, ``https://www.googleapis.com/auth/accounts.reauth``. This module provides a high-level function for executing the Reauth process, :func:`refresh_access_token`, and lower-level helpers for doing the individual steps of the reauth process. Those steps are: 1. Obtaining a list of challenges from the reauth server. 2. Running through each challenge and sending the result back to the reauth server. 3. Refreshing the access token using the returned rapt token. """ from __future__ import absolute_import from __future__ import division from __future__ import print_function import json import sys from google_reauth import challenges from google_reauth import errors from google_reauth import _helpers from google_reauth import _reauth_client from six.moves import http_client from six.moves import range _REAUTH_SCOPE = 'https://www.googleapis.com/auth/accounts.reauth' _REAUTH_NEEDED_ERROR = 'invalid_grant' _REAUTH_NEEDED_ERROR_INVALID_RAPT = 'invalid_rapt' _REAUTH_NEEDED_ERROR_RAPT_REQUIRED = 'rapt_required' _AUTHENTICATED = 'AUTHENTICATED' _CHALLENGE_REQUIRED = 'CHALLENGE_REQUIRED' _CHALLENGE_PENDING = 'CHALLENGE_PENDING' def _run_next_challenge(msg, http_request, access_token): """Get the next challenge from msg and run it. Args: msg: Reauth API response body (either from the initial request to https://reauth.googleapis.com/v2/sessions:start or from sending the previous challenge response to https://reauth.googleapis.com/v2/sessions/id:continue) http_request: callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) access_token: reauth access token Returns: rapt token. Raises: errors.ReauthError if reauth failed """ for challenge in msg['challenges']: if challenge['status'] != 'READY': # Skip non-activated challneges. continue c = challenges.AVAILABLE_CHALLENGES.get( challenge['challengeType'], None) if not c: raise errors.ReauthFailError( 'Unsupported challenge type {0}. Supported types: {1}' .format(challenge['challengeType'], ','.join(list(challenges.AVAILABLE_CHALLENGES.keys()))) ) if not c.is_locally_eligible: raise errors.ReauthFailError( 'Challenge {0} is not locally eligible' .format(challenge['challengeType'])) client_input = c.obtain_challenge_input(challenge) if not client_input: return None return _reauth_client.send_challenge_result( http_request, msg['sessionId'], challenge['challengeId'], client_input, access_token) return None def _obtain_rapt(http_request, access_token, requested_scopes, rounds_num=5): """Given an http request method and reauth access token, get rapt token. Args: http_request: callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) access_token: reauth access token requested_scopes: scopes required by the client application rounds_num: max number of attempts to get a rapt after the next challenge, before failing the reauth. This defines total number of challenges + number of additional retries if the chalenge input wasn't accepted. Returns: rapt token. Raises: errors.ReauthError if reauth failed """ msg = None for _ in range(0, rounds_num): if not msg: msg = _reauth_client.get_challenges( http_request, list(challenges.AVAILABLE_CHALLENGES.keys()), access_token, requested_scopes) if msg['status'] == _AUTHENTICATED: return msg['encodedProofOfReauthToken'] if not (msg['status'] == _CHALLENGE_REQUIRED or msg['status'] == _CHALLENGE_PENDING): raise errors.ReauthAPIError( 'Challenge status {0}'.format(msg['status'])) if not _helpers.is_interactive(): raise errors.ReauthUnattendedError() msg = _run_next_challenge(msg, http_request, access_token) # If we got here it means we didn't get authenticated. raise errors.ReauthFailError() def get_rapt_token(http_request, client_id, client_secret, refresh_token, token_uri, scopes=None): """Given an http request method and refresh_token, get rapt token. Args: http_request: callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) client_id: client id to get access token for reauth scope. client_secret: client secret for the client_id refresh_token: refresh token to refresh access token token_uri: uri to refresh access token scopes: scopes required by the client application Returns: rapt token. Raises: errors.ReauthError if reauth failed """ sys.stderr.write('Reauthentication required.\n') # Get access token for reauth. response, content = _reauth_client.refresh_grant( http_request=http_request, client_id=client_id, client_secret=client_secret, refresh_token=refresh_token, token_uri=token_uri, scopes=_REAUTH_SCOPE, headers={'Content-Type': 'application/x-www-form-urlencoded'}) try: content = json.loads(content) except (TypeError, ValueError): raise errors.ReauthAccessTokenRefreshError( 'Invalid response {0}'.format(_substr_for_error_message(content))) if response.status != http_client.OK: raise errors.ReauthAccessTokenRefreshError( _get_refresh_error_message(content), response.status) if 'access_token' not in content: raise errors.ReauthAccessTokenRefreshError( 'Access token missing from the response') # Get rapt token from reauth API. rapt_token = _obtain_rapt( http_request, content['access_token'], requested_scopes=scopes) return rapt_token def _rapt_refresh_required(content): """Checks if the rapt refresh is required. Args: content: refresh response content Returns: True if rapt refresh is required. """ try: content = json.loads(content) except (TypeError, ValueError): return False return ( content.get('error') == _REAUTH_NEEDED_ERROR and (content.get('error_subtype') == _REAUTH_NEEDED_ERROR_INVALID_RAPT or content.get('error_subtype') == _REAUTH_NEEDED_ERROR_RAPT_REQUIRED)) def _get_refresh_error_message(content): """Constructs an error from the http response. Args: response: http response content: parsed response content Returns: error message to show """ error_msg = 'Invalid response.' if 'error' in content: error_msg = content['error'] if 'error_description' in content: error_msg += ': ' + content['error_description'] return error_msg def _substr_for_error_message(content): """Returns content string to include in the error message""" return content if len(content) <= 100 else content[0:97] + "..." def refresh_access_token( http_request, client_id, client_secret, refresh_token, token_uri, rapt=None, scopes=None, headers=None): """Refresh the access_token using the refresh_token. Args: http_request: callable to run http requests. Accepts uri, method, body and headers. Returns a tuple: (response, content) client_id: client id to get access token for reauth scope. client_secret: client secret for the client_id refresh_token: refresh token to refresh access token token_uri: uri to refresh access token scopes: scopes required by the client application Returns: Tuple[str, str, str, Optional[str], Optional[str], Optional[str]]: The rapt token, the access token, new refresh token, expiration, token id and response content returned by the token endpoint. Raises: errors.ReauthError if reauth failed errors.HttpAccessTokenRefreshError it access token refresh failed """ response, content = _reauth_client.refresh_grant( http_request=http_request, client_id=client_id, client_secret=client_secret, refresh_token=refresh_token, token_uri=token_uri, rapt=rapt, headers=headers) if response.status != http_client.OK: # Check if we need a rapt token or if the rapt token is invalid. # Once we refresh the rapt token, retry the access token refresh. # If we did refresh the rapt token and still got an error, then the # refresh token is expired or revoked. if (_rapt_refresh_required(content)): rapt = get_rapt_token( http_request, client_id, client_secret, refresh_token, token_uri, scopes=scopes, ) # retry with refreshed rapt response, content = _reauth_client.refresh_grant( http_request=http_request, client_id=client_id, client_secret=client_secret, refresh_token=refresh_token, token_uri=token_uri, rapt=rapt, headers=headers) try: content = json.loads(content) except (TypeError, ValueError): raise errors.HttpAccessTokenRefreshError( 'Invalid response {0}'.format(_substr_for_error_message(content)), response.status) if response.status != http_client.OK: raise errors.HttpAccessTokenRefreshError( _get_refresh_error_message(content), response.status) access_token = content['access_token'] refresh_token = content.get('refresh_token', None) expires_in = content.get('expires_in', None) id_token = content.get('id_token', None) return rapt, content, access_token, refresh_token, expires_in, id_token	10.99 KB	2020-09-21 22:03
📄 reauth_creds.py # Copyright 2017 Google Inc. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Two factor Oauth2Credentials.""" import datetime import json import logging from oauth2client import _helpers from oauth2client import client from oauth2client import transport from google_reauth import errors from google_reauth import reauth _LOGGER = logging.getLogger(__name__) class Oauth2WithReauthCredentials(client.OAuth2Credentials): """Credentials object that extends OAuth2Credentials with reauth support. This class provides the same functionality as OAuth2Credentials, but adds the support for reauthentication and rapt tokens. These credentials should behave the same as OAuth2Credentials when the credentials don't use rauth. """ def __init__(self, args, kwargs): """Create an instance of Oauth2WithReauthCredentials. A Oauth2WithReauthCredentials has an extra rapt_token.""" self.rapt_token = kwargs.pop('rapt_token', None) super(Oauth2WithReauthCredentials, self).__init__(args, kwargs) @classmethod def from_json(cls, json_data): """Overrides.""" data = json.loads(_helpers._from_bytes(json_data)) if ((data.get('token_expiry') and not isinstance(data['token_expiry'], datetime.datetime))): try: data['token_expiry'] = datetime.datetime.strptime( data['token_expiry'], client.EXPIRY_FORMAT) except ValueError: data['token_expiry'] = None kwargs = {} for param in ('revoke_uri', 'id_token', 'id_token_jwt', 'token_response', 'scopes', 'token_info_uri', 'rapt_token'): value = data.get(param, None) if value is not None: kwargs[param] = value retval = cls( data['access_token'], data['client_id'], data['client_secret'], data['refresh_token'], data['token_expiry'], data['token_uri'], data['user_agent'], kwargs ) retval.invalid = data['invalid'] return retval @classmethod def from_OAuth2Credentials(cls, original): """Instantiate a Oauth2WithReauthCredentials from OAuth2Credentials.""" json = original.to_json() return cls.from_json(json) def _do_refresh_request(self, http): """Refresh the access_token using the refresh_token. Args: http: An object to be used to make HTTP requests. rapt_refreshed: If we did or did not already refreshed the rapt token. Raises: oauth2client.client.HttpAccessTokenRefreshError: if the refresh fails. """ headers = self._generate_refresh_request_headers() _LOGGER.info('Refreshing access_token') def http_request(uri, method, body, headers): response, content = transport.request( http, uri, method=method, body=body, headers=headers) content = _helpers._from_bytes(content) return response, content try: self._update(*reauth.refresh_access_token( http_request, self.client_id, self.client_secret, self.refresh_token, self.token_uri, rapt=self.rapt_token, scopes=list(self.scopes), headers=headers)) except (errors.ReauthAccessTokenRefreshError, errors.HttpAccessTokenRefreshError) as e: self.invalid = True if self.store: self.store.locked_put(self) raise client.HttpAccessTokenRefreshError(e, status=e.status) def _update(self, rapt, content, access_token, refresh_token=None, expires_in=None, id_token=None): if rapt: self.rapt_token = rapt self.token_response = content self.access_token = access_token self.refresh_token = ( refresh_token if refresh_token else self.refresh_token) if expires_in: delta = datetime.timedelta(seconds=int(expires_in)) self.token_expiry = delta + client._UTCNOW() else: self.token_expiry = None self.id_token_jwt = id_token self.id_token = ( client._extract_id_token(id_token) if id_token else None) self.invalid = False if self.store: self.store.locked_put(self)	5.03 KB	2020-09-21 22:03

Terminal