-:j:U bdZddlZddlZddlZddlZddlZddlmZddlmZddlm Z ddl m Z ddl m Z dd lmZmZmZmZmZmZmZmZmZmZmZdd lmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'ejPe)Z* d)d d dde+dzde,de,ddfdZ-d)de+dzddfdZ.d*de+de,ddfdZ/d+dZ0d+dZ1de%de2e+e+ffdZ3de%de+dzfdZ4d dde,ddfdZ5de+fdZ6d+dZ7d dde,ddfd Z8 d,de+de,d!e+dzd"e9dzde2e+e+ff d#Z:de+ddfd$Z;d"e+dzde+fd%Zd+d(Z?y)-z&Contains methods to log in to the Hub.N)datetime)getpass)Path) constants)DeviceCodeError) ANSI get_tokenis_google_colab is_notebooklist_credential_helpersloggingrun_subprocess select_choiceset_git_credentialtabulateunset_git_credential) _get_token_by_name_get_token_from_environment_get_token_from_file_get_token_from_google_colab_read_stored_tokens_full_save_stored_tokens_full _save_token _write_secretget_stored_tokens)OAuthTokenResponsepoll_device_tokenrequest_device_codeFT)add_to_git_credentialskip_if_logged_intokenr r!returnc|%|stjdt||y|rtjdt r t |yt |y)aLogin the machine to access the Hub. The `token` is persisted in cache and set as a git credential. Once done, the machine is logged in and the access token will be available across all `huggingface_hub` components. If `token` is not provided, a browser-based OAuth flow is used to authenticate: open a URL, enter a short code, and the token is retrieved and saved. In a terminal, you can also choose to paste an existing access token instead. To log in from outside of a script, one can also use `hf auth login` which is a cli command that wraps [`login`]. > [!TIP] > When the token is not passed, [`login`] will automatically detect if the script runs > in a notebook or not. However, this detection might not be accurate due to the > variety of notebooks that exists nowadays. If that is the case, you can always force > the UI by using [`notebook_login`] or [`interpreter_login`]. Args: token (`str`, *optional*): User access token to generate from https://huggingface.co/settings/token. add_to_git_credential (`bool`, defaults to `False`): If `True`, token will be set as git credential. If no git credential helper is configured, a warning will be displayed to the user. Only used when `token` is provided; ignored by the browser-based flow. skip_if_logged_in (`bool`, defaults to `True`): If `True`, do not prompt for token if user is already logged in. Set to `False` to force re-login. In CLI, use `--force` instead. Raises: [`ValueError`](https://docs.python.org/3/library/exceptions.html#ValueError) If an organization token is passed. Only personal account tokens are valid to log in. [`ValueError`](https://docs.python.org/3/library/exceptions.html#ValueError) If token is invalid. [`DeviceCodeError`] If the browser-based login fails (authorization denied, code expired, ...). NzThe token has not been saved to the git credentials helper. Pass `add_to_git_credential=True` in this function directly or `--add-to-git-credential` if using via `hf`CLI if you want to set the git credential as well.)r zy`add_to_git_credential=True` is only supported when a token is passed directly. It is ignored by the browser-based login.r!)loggerinfo_validate_and_save_tokenwarningr notebook_logininterpreter_login)r"r r!s X/var/www/html/tokenscope/api/venv/lib/python3.12/site-packages/huggingface_hub/_login.pyloginr-9s\T $ KK>  !>ST 8 }):;,=> token_namect tstjdy|sUtj tj fD]} t|jtjdn$t|tjd|dtt tdt tdy#t$rYwxYw)aLogout the machine from the Hub. Token is deleted from the machine and removed from git credential. Args: token_name (`str`, *optional*): Name of the access token to logout from. If `None`, will log out from all saved access tokens. Raises: [`ValueError`](https://docs.python.org/3/library/exceptions.html#ValueError): If the access token name is not found. NzNot logged in!z/Successfully logged out from all access tokens.z+Successfully logged out from access token: .zYou are automatically logged in using a Google Colab secret. To log out, you must unset the `HF_TOKEN` secret in your Colab settings.zToken has been deleted from your machine but you are still logged in. To log out, you must clear out both `HF_TOKEN` and `HUGGING_FACE_HUB_TOKEN` environment variables.)r rr&r)r HF_TOKEN_PATHHF_STORED_TOKENS_PATHrunlinkFileNotFoundErrorr'_logout_from_tokenrrOSErrorr)r/ file_paths r,logoutr9xs{#4#6'( #1193R3RS I Y&&(   EF:& A*QOP$%1 W  #$0 q  1%  sC C'&C'ct|}|std|dtjt ||t j d|t}|||k7rt jdyyy)a{Switch to a different access token. Args: token_name (`str`): Name of the access token to switch to. add_to_git_credential (`bool`, defaults to `False`): If `True`, token will be set as git credential. If no git credential helper is configured, a warning will be displayed to the user. If `token` is `None`, the value of `add_to_git_credential` is ignored and will be prompted again to the end user. Raises: [`ValueError`](https://docs.python.org/3/library/exceptions.html#ValueError): If the access token name is not found. z Access token  not found in zThe current active token is: NzfThe environment variable `HF_TOKEN` is set and will override the access token you've just switched to.) r ValueErrorrr3_set_active_tokenr&r'rr))r/r r"token_from_environments r, auth_switchr?s~ z *E = N9CbCbBcdeej"78 KK/ |<=8:).D.M t /N)r.ct}t}|sKtr+tj dtj dytj dyt d|jD}gd|rdgngz}d}g}|jD]z\}}|jdd }||k(r|}|d k7r |dd d |d dn|} ||k(rd nd|| g} |r)| jt|jd|j| |tt||trtj dy|tj dyy)zList all stored access tokens.zNo stored access tokens found.zMNote: Environment variable `HF_TOKEN` is set and is the current active token.zNo access tokens found.Nc3$K|]}d|v yw) expires_atN).0fieldss r, zauth_list..sS&|v-Ss) namer"expireshf_tokenz z*****rB)headersz Note: Environment variable `HF_TOKEN` is set and is the current active token independently from the stored tokens listed above.zm Note: No active token is set and no environment variable `HF_TOKEN` is found. Use `hf auth login` to log in.)r rrr&r'r)anyvaluesitemsgetappend_format_expirationprintr) current_token stored_tokens show_expiresrOcurrent_token_namerowsr/rEr" masked_tokenrows r, auth_listr^sgKM,.M  & ( KK8 9 NNj k  KK1 2SM+9M%)Drs 5SX ', '=2zS_`  JJ)&**\*BC D C (4 )*"$ P   # |  $r.ct}td|ddtd|ddtddd  t|d }tt|y #twxYw) zRun the Device Code OAuth flow: request a code, prompt the user to authorize it in a browser, poll for the token and save it.z, Open this URL in your browser: verification_uri_complete z And enter the code: user_codez Waiting for authorizationrNTendflushctdddS)Nr1rNTrc)rVrCr.r,z$_device_code_login..sU3TV^bEcr.) on_pendingN)rrVr_save_oauth_token) device_inforesponses r,_device_code_loginrlsu&'K :;Gb;c:ddf gh $[%=$>b AB )r>$[=cd h s A"" A.rkc |jd}t|dd|jd|r)ttjt|znd\}}t |x}rt j d|||fS)z\Validate and persist a token response from the device code flow, including refresh metadata. expires_in access_tokenF refresh_tokenN)r rprBzNote: )rSr(inttime_expiration_noter&r')rkrnr/usernamenotes r,ririsl+J3 #ll?39C3tyy{#c*o5 J  ))t) fTFO$ x r.c|jd}|sy|jdrytdt|dz}d|dS) zSHuman-readable note about the lifetime of a freshly obtained OAuth token, if known.rnNrpz;This token will be refreshed automatically when it expires.riQzThis token expires in z days. Log in again to renew it.)rSmaxrq)rkrndayss r,rsrs sJl+J ||O$L q#j/U* +D #D6)I JJr.r%c|r ttjdyttjdtdk(r t yt y)a  Displays a prompt to log in to the HF website and store the token. This is equivalent to [`login`] without passing a token when not run in a notebook. [`interpreter_login`] is useful if you want to force the use of the terminal prompt instead of a notebook flow. For more details, see [`login`]. Args: skip_if_logged_in (`bool`, defaults to `True`): If `True`, do not prompt for token if user is already logged in. Set to `False` to force re-login. In CLI, use `--force` instead. NIUser is already logged in. Use `hf auth login --force` to force re-login.z_Note: a token is already saved on this machine. Logging in again will replace the active token.r")r r&r'_prompt_login_method_paste_token_loginrlr%s r,r+r+sJY[4 _`{ uv(r.ctjtjjsytdddg}|dk(rdSdS)zXAsk the user how to log in: "browser" (default) or "token". Never prompts without a TTY.browserzHow would you like to log in?zLog in with your browserzPaste an access tokenrr")sysstdinisattyr)choices r,r{r{8sC yy 0 0 2 :=WYp? D EE5Fr.c |r ttjdy ddlm}m}t}tj|d}tj|d}||d |d |d tj|d d ||d t|} t|\}} dtj| dtj|d} t!|x} r| dtj| z } ||d| dy#t $rtdYywxYw#t$r8}||dtjt|dYd}~yd}~wwxYw#t$r8} ||dtjt| dYd} ~ yd} ~ wwxYw)a  Displays a prompt to log in to the HF website and store the token. This is equivalent to [`login`] without passing a token when run in a notebook. [`notebook_login`] is useful if you want to force the use of the notebook flow instead of a prompt in the terminal. For more details, see [`login`]. Args: skip_if_logged_in (`bool`, defaults to `True`): If `True`, do not prompt for token if user is already logged in. Set to `False` to force re-login. In CLI, use `--force` instead. Nrzr)HTMLdisplayFr%verification_urir`z
Hugging Face

To log in, open this URL and enter the code:

z[

rbz

z4
Waiting for authorization...
z-
Login failed: z
z
z"Login successful. Logged in as z (token: z ).z
z
z
)r r&r'IPython.displayrr ImportErrorr+rhtmlescaperrstrri Exceptionrs) r!rrrjrr`rker/rterrormessagerus r,r*r*OsY[4 _`1 &'K{{;/A#BC $ K8S,T U   555JK[J\]++k+6788I  K   DG HI$[1 0: H 34;;x3H2II\]a]h]his]t\uu~G))t)T$++d+,-- D8G9I. /0I E2. DT[[QTUVQWEXDYYfghi 6t{{3u:7N6O}]^_sAD'# E/F'D?>D? F .E>>F G.GGrprBcFddlm}|jdr td||}|d}|j dxsij dxsi}|j dx}rt j d |d nt j d |j d xsd |} t|| ||t| |t j dtrt jd| |fSt j d| d| |fS)aValidate a token against the Hub, save it to the stored tokens file and set it as active. The token is stored under its `displayName` from the whoami response, or `oauth-{username}` for OAuth tokens (which have no display name). Args: token (`str`): The access token. add_to_git_credential (`bool`): Whether to save the token to the git credential helpers. refresh_token (`str`, *optional*): OAuth refresh token to persist alongside the access token. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. Returns: `tuple[str, str]`: The token name and the username. r)whoamiapi_orgzDYou must use your personal account token, not an organization token.rHauth accessTokenrolezToken is valid (permission: ).zToken is valid. displayNamezoauth-)r"r/rprB)r/r zLogin successful.zNote: Environment variable`HF_TOKEN` is set and is the current active token independently from the token you've just configured.zThe current active token is: ``) hf_apir startswithr<rSr&r'rr=rr)) r"r rprBr token_infortaccess_token_inforr/s r,r(r(s0  "_``J&!H#/52::=IOR $$V,,t, 24&;< %&"&&}5L6(9LJe -\fgCXY KK#$"$ O x   4ZLBC x r.ct}||vry|j|}t||jdt k(rCt j d|dttjjdyy)zLogout from a specific access token. Args: token_name (`str`): The name of the access token to logout from. NrJzActive token 'z' has been deleted.T) missing_ok) rpoprrSrr&r)rrr2r4)r/rXrEs r,r6r6s{-.M&   z *F]+ zz*!5!77 |3FGH Y $ $%,,,=8r.c|sy t|}tj|j d}|t j kr|dS|S#t$rYywxYw)zAFormat an `expires_at` unix timestamp for display in `auth list`.rNz%Y-%m-%dz (expired))rqr<r fromtimestampstrftimerr)rB timestampdate_strs r,rUrUsf  O %%i099*EH&/$))+&=hZz "K8K s A AAct|}|std|dtj|r^t r?t |t jdddjtdznt jdtttj|t jdtjy ) z|Set the active access token. Args: token_name (`str`): The name of the token to set as active. zToken r;zCYour token has been saved in your configured git credential helpersz (,rz2Token has not been saved to git credential helper.zYour token has been saved to N)rr<rr3$_is_git_credential_helper_configuredrr&r'joinr r)rrr2)r/r r"s r,r=r=s z *E 6*^I<[<[;\]^^ / 1 u % KKUsxx 7 9:;2>?  NNO P$y../7 KK/ 0G0G/HIJr.ct}t|dkDrytr tyt t j dy)zCheck if a git credential helper is configured. Warns user if not the case (except for Google Colab where "store" is set by default by `huggingface_hub`). rTaCannot authenticate through git-credential as no helper is defined on your machine. You might have to re-authenticate when pushing to the Hugging Face Hub. Run the following command in your terminal in case you want to set the 'store' credential helper as default. git config --global credential.helper store Read https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage for more details.F)r lenr ,_set_store_as_git_credential_helper_globallyrVr red)helperss r,rrsL &'G 7|a46      r.c| tdy#tj$r}t|jd}~wwxYw)aSet globally the credential.helper to `store`. To be used only in Google Colab as we assume the user doesn't care about the git credential config. It is the only particular case where we don't want to display the warning message in [`notebook_login()`]. Related: - https://github.com/huggingface/huggingface_hub/issues/1043 - https://github.com/huggingface/huggingface_hub/issues/1051 - https://git-scm.com/docs/git-credential-store z+git config --global credential.helper storeN)r subprocessCalledProcessErrorr7stderr)excs r,rr s5"DE  ( ("cjj!!"s ;6;)N)F)r#N)NN)@__doc__rrrrrrrrpathlibrrNrerrorsrutilsr r r r r rrrrrr utils._authrrrrrrrrrutils._oauth_devicerrr get_logger__name__r&rboolr-r9r?r^rltuplerirsr+r{r|r*rqr(r6rUr=rrrCr.r,rs-  #       \[   H %<?#(" <? :<? <? <?  <?~' sTz' T' T C   :% Z $  2  uS#X  K1KcDjK 48DD81c1G15919191H!%! 3 3 3 :3 d 3  38_ 3 l>3>4>( L3: L# LKKK K6d>"r.