
     j                    l    S SK Jr  S SKrS SKJrJrJrJr   " S S5      rS
S jr	SS jr
 " S S	5      rg)    )annotationsN)ASGI3ApplicationASGIReceiveCallableASGISendCallableScopec                  0    \ rS rSrSrSSS jjrS	S jrSrg)
ProxyHeadersMiddleware   a  Middleware for handling known proxy headers

This middleware can be used when a known proxy is fronting the application,
and is trusted to be properly setting the `X-Forwarded-Proto` and
`X-Forwarded-For` headers with the connecting client information.

Modifies the `client` and `scheme` information so that they reference
the connecting client, rather that the connecting proxy.

References:
- <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#Proxies>
- <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For>
c                0    Xl         [        U5      U l        g N)app_TrustedHoststrusted_hosts)selfr   r   s      V/var/www/website/venv/lib/python3.13/site-packages/uvicorn/middleware/proxy_headers.py__init__ProxyHeadersMiddleware.__init__   s    *=9    c                  #    US   S:X  a  U R                  XU5      I S h  vN $ UR                  S5      nU(       a  US   OS nXPR                  ;   a  / n/ nUS    H7  u  pUS:X  a  UR                  U	5        M  US:X  d  M&  UR                  U	5        M9     [	        U5      S:X  aK  US   R                  S	5      R                  5       n
U
S
;   a#  US   S:X  a  U
R                  SS5      US'   OXS'   [	        U5      S:X  a>  US   R                  S	5      nU R                  R                  U5      u  pU(       a  X4US'   U R                  XU5      I S h  vN $  GN8 N7f)Ntypelifespanclientr   headerss   x-forwarded-protos   x-forwarded-for   latin1>   wswsshttphttps	websocketr   r   scheme)	r   getr   appendlendecodestripreplaceget_trusted_client_address)r   scopereceivesendclient_addrclient_hostx_forwarded_proto_valuesx_forwarded_for_valuesnamevaluex_forwarded_protox_forwarded_forhostports                 r   __call__ProxyHeadersMiddleware.__call__   sc    =J&%$777ii)(3k!n,,,46$24"$Y///,33E://*11%8	  0 +,1$<Q$?$F$Fx$P$V$V$X!$(FFV}3*;*C*CFD*Qh*;h)*a/"8";"B"B8"L!//JJ?[
 (,lE(OXXed333E 8D 4s)   EEAECEEEE)r   r   N)z	127.0.0.1)r   r   r   list[str] | strreturnNone)r)   r   r*   r   r+   r   r9   r:   )__name__
__module____qualname____firstlineno____doc__r   r6   __static_attributes__ r   r   r	   r	      s    :$4r   r	   c                j    U R                  S5       Vs/ s H  oR                  5       PM     sn$ s  snf )N,)splitr&   )r1   items     r   _parse_raw_hostsrF   B   s)    %*[[%56%5TJJL%5666s   0c                   U R                  S5      (       a]  U R                  S5      nUS:X  a  U S4$ U SU nXS-   S nU(       d  US4$ UR                  S5      (       d  U S4$  U[        USS 5      4$ U R	                  S5      S:X  a"  U R                  SS5      u  p$ U[        U5      4$ U S4$ ! [         a    US4s $ f = f! [         a    U S4s $ f = f)a  Parse a forwarded host value into host and optional port.

Accepts bare IPs, IPv4 `host:port`, and bracketed IPv6 `[host]:port`.
Any unrecognized or malformed value is treated conservatively and returned
without a port so trust checks do not silently normalize arbitrary input.
[]r   r   N:)
startswithfindint
ValueErrorcountrsplit)r1   bracket_endr4   	remainderr5   s        r   _parse_host_portrT   F   s    jjo"!8OQ{#/+,	7N##C((!8O	Yqr]+++ {{31\\#q)
	T?" !8O  	7N	  	!8O	s$   $B/ C /C ?C CCc                  6    \ rS rSrSrSS jrS	S jrS
S jrSrg)r   i   z(Container for trusted hosts and networksc                n   USS/4;   U l         [        5       U l        [        5       U l        [        5       U l        U R                   (       d  [        U[        5      (       a  [        U5      nU Hk  nSU;   a2   U R                  R                  [        R                  " U5      5        M;   U R                  R                  [        R                  " U5      5        Mm     g g ! [         a    U R                  R                  U5         M  f = f! [         a    U R                  R                  U5         M  f = f)N*/)always_trustsettrusted_literalsr   trusted_networks
isinstancestrrF   add	ipaddress
ip_networkrO   
ip_address)r   r   r4   s      r   r   _TrustedHosts.__init__l   s    "/C#<"?*-%QTQVTWTY   --- 0 ?%
 $;8--11)2F2Ft2LM
8**..y/C/CD/IJ &	 ! & 8--11$78 & 8--11$78s$   8/C*/D%DD%D43D4c                  ^ U R                   (       a  gU(       d  g [        R                  " U5      mTU R                  ;   a  g[	        U4S jU R
                   5       5      $ ! [         a    XR                  ;   s $ f = f)NTFc              3  .   >#    U  H
  nTU;   v   M     g 7fr   rA   ).0netips     r   	<genexpr>-_TrustedHosts.__contains__.<locals>.<genexpr>   s     B,ASrSy,As   )rZ   ra   rc   r   anyr]   rO   r\   )r   r4   ri   s     @r   __contains___TrustedHosts.__contains__   sp    	1%%d+BT'''BD,A,ABBB 	10000	1s   &A# A# #A>=A>c                    [        U5      nU R                  (       a  [        US   5      $ [        U5       H  n[        U5      u  pEX@;  d  M  XE4s  $    [        US   5      $ )zExtract the client address from x_forwarded_for header.

In general this is the first "untrusted" host in the forwarded for list.
r   )rF   rZ   rT   reversed)r   r3   x_forwarded_for_hosts	host_portr4   r5   s         r   r(   (_TrustedHosts.get_trusted_client_address   sh    
 !1 A#$9!$<== ""78I))4JDz! 9   5a 899r   )rZ   r   r\   r]   N)r   r8   r9   r:   )r4   z
str | Noner9   bool)r3   r_   r9   tuple[str, int])	r;   r<   r=   r>   r?   r   rm   r(   r@   rA   r   r   r   r   i   s    2%8N1 :r   r   )r1   r_   r9   z	list[str])r1   r_   r9   ru   )
__future__r   ra   uvicorn._typesr   r   r   r   r	   rF   rT   r   rA   r   r   <module>rx      s3    "  Y Y74 74t7 FL: L:r   