/jO UdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZmZmZd d lmZd d lmZd d lmZmZd ZdZdededdfdZdae Zda edze!d<ejDe#Z$dedzfdZ%dedzfdZ&dedzfdZ'dedzfdZ(Gdde Z)e Z*da+e)dze!d<dZ,dedzfdZ-Gdde Z.e Z/da0e.dze!d <d!Z1dZ2da3dedzfd"Z4d#edefd$Z5d%eddfd&Z6d'e7eefde8dzfd(Z9de7eeffd)Z:de7ee7eefffd*Z;d+e7ee7eeffddfd,Zd#edzdedzfd3Z?y)4zVContains a helper to get the token from machine (env variable, secret or config file).N)Path)Lock) TypedDict) constants)DeviceCodeErrorOAuthErrorCode OIDCError) WeakFileLock)refresh_access_token)is_colab_enterpriseis_google_colabiipathcontentreturnc|jjddttjt |tj tjztjzt}tj|dd5}|j|ddd |jt|jjty#1swY?xYw#ttf$rYywxYw)ziWrite content to file, restricting both the file and its parent directory to owner-only on POSIX systems.T)parentsexist_okmodewutf-8encodingN)parentmkdir_SECRET_DIR_MODEosopenstrO_WRONLYO_CREATO_TRUNC_SECRET_FILE_MODEfdopenwritechmodOSErrorNotImplementedError)rrfdfs ^/root/repos/pocs/video-evals/.venv/lib/python3.12/site-packages/huggingface_hub/utils/_auth.py _write_secretr-%sKKdT8HI TBKK"**4rzzACT UB 2sW -   $% *+  ( )   sC*4C+C(+C=<C=F_GOOGLE_COLAB_SECRETc^txs"txstxs tS)a] Get token if user is logged in. Note: in most cases, you should use [`huggingface_hub.utils.build_hf_headers`] instead. This method is only useful if you want to retrieve the token for other purposes than sending an HTTP request. If `HF_OIDC_RESOURCE` is set (Trusted Publishers, typically in CI), a short-lived token obtained via OIDC token exchange takes precedence. Otherwise the token is retrieved from the `HF_TOKEN` environment variable, then from the token file in the Hugging Face home folder. Returns None if user is not logged in. To log in, use [`login`] or `hf auth login`. OAuth tokens obtained with the browser-based login come with a refresh token: when such a token is close to expiry, it is transparently refreshed and persisted before being returned. Note: if `HF_OIDC_RESOURCE` is set but the OIDC token exchange fails, this raises instead of returning `None`, opting into OIDC is explicit, so a failure surfaces as a clear error rather than a silent fallback. Returns: `str` or `None`: The token, `None` if it doesn't exist. )_get_token_from_oidc_get_token_from_environment_get_token_from_file_refreshed_get_token_from_google_colabr, get_tokenr6<s2,  * & ( * ) + * ( ) r5c(tr tryt5trtcdddS ddlm}ddlm} |jd}t|ad atcdddS#t$r YdddywxYw#|j$rtjddaYP|j$rt j#ddaYw|$r.}tjdt%|d daYd}~d}~wwxYw#1swYyxYw) zGet token from Google Colab secrets vault using `google.colab.userdata.get(...)`. Token is read from the vault only once per session and then stored in a global variable to avoid re-requesting access to the vault. Nr)userdata)ErrorHF_TOKENz Access to the secret `HF_TOKEN` has not been granted on this notebook. You will not be requested again. Please restart the session if you want to be prompted again.zThe secret `HF_TOKEN` does not exist in your Colab secrets. Run `huggingface_hub.login()` to authenticate (recommended but still optional to access public models or datasets).z@ Error while fetching `HF_TOKEN` secret value from your vault: 'z'.T)rr_GOOGLE_COLAB_SECRET_LOCK_IS_GOOGLE_COLAB_CHECKEDr. google.colabr8google.colab.errorsr9 ImportErrorget _clean_tokenNotebookAccessErrorwarningswarnSecretNotFoundErrorloggerinfor )r8 ColabErrortokenes r,r3r3Ys"   3 5 #($ $' ($($  - ? (LL,E#/#6 0$( #Q($($ ($($  ++ ( MMQ  $( ++ ( KKf $(  ( MM]^abc^d]eegh i#'  (E($($sj D A-BD- B6DBD&D*D,%DDD$D;DDDDcttjjdxstjjdS)Nr:HUGGING_FACE_HUB_TOKEN)rArenvironr@r4r5r,r1r1s-  z2^bjjnnE]6^ __r5c tttjj S#t $rYywxYw)N)rArr HF_TOKEN_PATH read_textFileNotFoundErrorr4r5r,_get_token_from_filerRs8D!8!89CCEFF s /2 >>c,eZdZUeed<eed<eed<y)_OidcTokenCacheresourcerI expires_atN__name__ __module__ __qualname__r __annotations__floatr4r5r,rTrTsM Jr5rT_OIDC_TOKEN_CACHEi,ctjjd}|syddlm}m}t 5tj}t*td|k(r|tdkrtdcdddStjjdxsd}|| td ||| }|d }t|jd d }|dnt}|||t||z dzda |cdddS#1swYyxYw)aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCENr)detect_provider oidc_loginrUrVrIHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rU subject_token access_token expires_inir)rUrIrV)rrMr@_oidcr`ra_OIDC_TOKEN_LOCKtime monotonicr]r int_OIDC_REFRESH_MARGINmax) rUr`ranowrcresultrIremargins r,r0r0szz~~01H 3 nn  )!*-9' 55$W- '9:Bd  _%6%>O  X]K~&L$78 $/5I J$7 ;;  =s;D6BDD c,eZdZUeed<eed<eed<y)_OAuthRefreshCache file_tokenresolved_token recheck_atNrWr4r5r,rqrqsOr5rq_OAUTH_REFRESH_CACHEiQc2t}|yt|S)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rR_refresh_oauth_token_if_neededrIs r,r2r2s "E } )% 00r5rIc t5tj}t}||dk(r||dkr|dcdddStfdt j Ddif\}}|j d}t|}|||4t}||k7r |cdddS|tzdacdddS|tz |kDr|tz dacdddS ttjdzd 5t j |i}|j d k7r!|j d xs}t|} nt|} | d }d | vrt|t| d znd} t!||| j dxs|| tk(r#t#t%tj&|t(j+d|dddd|t?|tz r | tz ndda|cdddS#1swY6xYw#t,$r} t/| t0rB| j2t4j6k(r%t(j9d| dt;d} nt=d| d|tz} | dacYd} ~ cdddSd} ~ wwxYw#1swYyxYw)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrrrtrsc3VK|] \}}|jdk(s||f"yw)hf_tokenN)r@).0namefieldsrIs r, z1_refresh_oauth_token_if_needed..s. v fV\V`V`akVlpuVudF^ vs) ) refresh_token)rrrsrtz.lock)timeoutr{rdre)rI token_namerrVzAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.r) _OAUTH_REFRESH_LOCKrhrunext_read_stored_tokens_fullitemsr@_parse_expires_atrR_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rj _save_tokenr-rrOrFrG Exception isinstancer error_coder INVALID_GRANTwarningr\_warn_refresh_failure_oncerl) rIrmcacherr~rrVcurrent_file_token new_tokennew_expires_atresponserJrts ` r,rwrws- Wiik$  |!4!=#lH[B[)* WW " v0H0J0P0P0R v 2J  F ?3 &v.  !6*:L"6!7 !-2D2M)#WW($"'!$;;$ 1WW4 - - 3#"'(+@@$ AWWD) i==GQST T1377 BG::j)U2 & : 6 ?%I%6v%>N3MBH ( 8IO[_gOgSXH\4J0K%KmqN'#-&.ll?&C&T}#1 ,-6%d9+B+B&CYOKK.  s0%B("B  B BC+C C C stored_tokensctjd}t|jD]A}|j |||j D]\}}|j |||Ctj}|j|tttj|jy)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr&r-rrrgetvalue)rrrkeyvaluebufs r,_save_stored_tokens_fullrs  & &T :F]//12/ :&' 399; /JC JJz3 . // ++-C LL$y667Hr5rc<t}||vryt||S)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rrA)rrs r,_get_token_by_namers'&'M&  j1 22r5)rrVrrVct}d|i}|||d<|t||d<|||<t|tj d|dt j y)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. r{NrrVz The token `z` has been saved to )rr rrFrGrr)rIrrrVrr~s r,rrsm"-.M% F "/":| &M*]+ KK+j\)=i>]>]=^_`r5cp|y|jddjddjxsdS)zuClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprxs r,rArAs8  } ==r " * *4 4 : : < DDr5)@__doc__rrloggingrrhrCpathlibr threadingrtypingrrrerrorsrr r _fixesr _oauth_devicer _runtimerrr$rr r-r<r;r.r[ getLoggerrXrFr6r3r1rRrTrgr]rkr0rqrrurrrr2rwrrrjrrrrrrrAr4r5r,rs{]  ?? /:    s  t  ! F#'cDj'   8 $3::7$cDj7$t`S4Z` cDji6,0?T)00cDj0ff26(4/6!1d 1`#`#`F%%%d38nt q4S> q$sDcN':";* IDd38n1D,E I$ I3333:3&AE_ca aa36:aRUX\R\a a:Ed EsTzEr5