4V=jmddlmZddlZddlmZddlmZddlmZddlmZddl m Z dd l m Z dd l m Z dd l m Z dd l mZdd l mZddl mZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlm Z ddlm!Z!dd l"m#Z#dd!l"m$Z$ej%rdd"l&m'Z'd,d-d)Z(Gd*d+Z)dS).) annotationsN)datetime) timedelta)timezone) HTTPStatus) CallbackDict) ContentRange)ContentSecurityPolicy)Headers) HeaderSet)ResponseCacheControl)WWWAuthenticateCOEPCOOP)dump_age) dump_cookie) dump_header)dump_options_header) http_date)HTTP_STATUS_CODES) parse_age)parse_cache_control_header)parse_content_range_header)parse_csp_header) parse_date)parse_options_header)parse_set_header) quote_etag) unquote_etag)get_content_type)header_property) _CacheControlnamestrdoc str | Nonereturnpropertyc@d fd }d fd }t||| S) NselfResponser*r cddfd }tj|S)N header_setr r*Nonecr|sjvr j=dS|r|j<dSdSNheaders to_header)r0r&r-s FC:\PYTHON\_runtimes\venv\Lib\site-packages\werkzeug/sansio/response.py on_updatez._set_property..fget..on_update*sW <$$,"6"6L&&& <%/%9%9%;%; T""" < <)r0r r*r1)r r5get)r-r8r&s` r7fgetz_set_property..fget)sI < < < < < < <   0 0 6 6 BBBr9value5None | (str | dict[str, str | int] | t.Iterable[str])r1c|s |j=dSt|tr ||j<dSt||j<dSr3)r5 isinstancer'r)r-r<r&s r7fsetz_set_property..fset2s[ 4 T""" s # # 4!&DL   !,U!3!3DL   r9r()r-r.r*r )r-r.r<r=r*r1)r+)r&r(r;r@s` r7 _set_propertyrB(s\CCCCCC 4 4 4 4 4 4 D$C ( ( ((r9ceZdZUdZdZdZded<dZded< dddZddZ e ddZ e j ddZ e ddZ e j ddZ ddZ ddd-Z ddd.Ze dd/Ze dd0Zej dd1Ze dd3Zeed4d56Zed7d eed86Zeed9d:6Zed;d eed<6Zeed=d>6Zeed?d@6ZeedAdB6ZedCd e e!dD6Z"edEd e e!dF6Z#edGd e e!dH6Z$e ddJZ%e%j ddLZ%e&dMdN6Z'e&dOdP6Z(e&dQdR6Z)e ddTZ*dddWZ+ddYZ,eedZd[6Z-e dd]Z.e.j dd_Z.e ddaZ/e/j ddcZ/e/j0dddZ/e ddfZ1e1j ddhZ1e ddiZ2e2j ddjZ2e ddkZ3e3j ddmZ3edne4e5dopZ6edqe4e5drpZ7eedsdt6Z8edue4e5dvpZ9edweedxpZ:ee;dydzd{e;j<d|}Z=ee>d~dde>j<d}Z?d S)r.aRepresents the non-IO parts of an HTTP response, specifically the status and headers but not the body. This class is not meant for general use. It should only be used when implementing WSGI, ASGI, or another HTTP application spec. Werkzeug provides a WSGI implementation at :cls:`werkzeug.wrappers.Response`. :param status: The status code for the response. Either an int, in which case the default status message is added, or a string in the form ``{code} {message}``, like ``404 Not Found``. Defaults to 200. :param headers: A :class:`~werkzeug.datastructures.Headers` object, or a list of ``(key, value)`` tuples that will be converted to a ``Headers`` object. :param mimetype: The mime type (content type without charset or other parameters) of the response. If the value starts with ``text/`` (or matches some other special cases), the charset will be added to create the ``content_type``. :param content_type: The full content type of the response. Overrides building the value from ``mimetype``. .. versionchanged:: 3.0 The ``charset`` attribute was removed. .. versionadded:: 2.0 z text/plainr)default_mimetypeir r5Nstatusint | str | HTTPStatus | NoneJt.Mapping[str, str | t.Iterable[str]] | t.Iterable[tuple[str, str]] | Nonemimetype content_typer*r1ct|tr||_n*|st|_nt||_|&|d|jvr|j}|t |d}|}| ||jd<||j}||_dS)N content-typeutf-8 Content-Type)r?r r5rEr#default_statusrF)r-rFr5rIrJs r7__init__zResponse.__init__os gw ' ' ,"DLL ,"99DLL"7++DL  N$,$F$F0#+Hg>>#L  #+7DL ( >(F r9r'cBdt|jd|jdS)N)type__name__rFr-s r7__repr__zResponse.__repr__s&94::&99$+9999r9intc|jS)z!The HTTP status code as a number.) _status_coderUs r7 status_codezResponse.status_codes   r9codec||_dSr3)rF)r-r[s r7rZzResponse.status_codes  r9c|jS)z!The HTTP status code as a string.)_statusrUs r7rFzResponse.statuss |r9r<str | int | HTTPStatuscJ||\|_|_dSr3) _clean_statusr^rYr-r<s r7rFzResponse.statuss%*.*<*.on_update@s!+>t}a+P+PDL ( ( (r9rLrn)rrr*r1)rr5r:r )r-r8rs` r7mimetype_paramszResponse.mimetype_params7s] Q Q Q Q Q Q !!1!1."!E!E F Fq IAy)))r9LocationzThe Location response-header field is used to redirect the recipient to a location other than the Request-URI for completion of the request or identification of a new resource.rAAgea The Age response-header field conveys the sender's estimate of the amount of time since the response (or its revalidation) was generated at the origin server. Age values are non-negative decimal integers, representing time in seconds.rNzThe Content-Type entity-header field indicates the media type of the entity-body sent to the recipient or, in the case of the HEAD method, the media type that would have been sent had the request been a GET.zContent-LengthaThe Content-Length entity-header field indicates the size of the entity-body, in decimal number of OCTETs, sent to the recipient or, in the case of the HEAD method, the size of the entity-body that would have been sent had the request been a GET.zContent-LocationzThe Content-Location entity-header field MAY be used to supply the resource location for the entity enclosed in the message when that entity is accessible from a location separate from the requested resource's URI.zContent-EncodingabThe Content-Encoding entity-header field is used as a modifier to the media-type. When present, its value indicates what additional content codings have been applied to the entity-body, and thus what decoding mechanisms must be applied in order to obtain the media-type referenced by the Content-Type header field.z Content-MD5alThe Content-MD5 entity-header field, as defined in RFC 1864, is an MD5 digest of the entity-body for the purpose of providing an end-to-end message integrity check (MIC) of the entity-body. (Note: a MIC is good for detecting accidental modification of the entity-body in transit, but is not proof against malicious attacks.)DatezThe Date general-header field represents the date and time at which the message was originated, having the same semantics as orig-date in RFC 822. .. versionchanged:: 2.0 The datetime object is timezone-aware. Expiresa The Expires entity-header field gives the date/time after which the response is considered stale. A stale cache entry may not normally be returned by a cache. .. versionchanged:: 2.0 The datetime object is timezone-aware. z Last-ModifiedzThe Last-Modified entity-header field indicates the date and time at which the origin server believes the variant was last modified. .. versionchanged:: 2.0 The datetime object is timezone-aware. datetime | Nonec|jd}|dS t|}n#t$rt |cYSwxYwt jtjt|zS)aTThe Retry-After response-header field can be used with a 503 (Service Unavailable) response to indicate how long the service is expected to be unavailable to the requesting client. Time in seconds until expiration or date. .. versionchanged:: 2.0 The datetime object is timezone-aware. retry-afterN)seconds) r5r:rWrgrrnowrutcr)r-r<rs r7 retry_afterzResponse.retry_afters   // =4 %%jjGG % % %e$$ $ $ $ %|HL))Ig,F,F,FFFs0A  A datetime | int | str | Nonec|d|jvr|jd=dSt|trt|}nt |}||jd<dS)Nrz Retry-After)r5r?rrr'rbs r7rzResponse.retry_aftersa = ,,L/ F x ( ( e$$EEJJE&+ ]###r9VaryzThe Vary field value indicates the set of request-header fields that fully determines, while the response is fresh, whether a cache is permitted to use the response to reply to a subsequent request without revalidation.zContent-LanguagezThe Content-Language entity-header field describes the natural language(s) of the intended audience for the enclosed entity. Note that this might not be equivalent to all the languages used within the entity-body.AllowaRThe Allow entity-header field lists the set of methods supported by the resource identified by the Request-URI. The purpose of this field is strictly to inform the recipient of valid methods associated with the resource. An Allow header field MUST be present in a 405 (Method Not Allowed) response.rcldfd }tjd|tS)zThe Cache-Control general-header field is used to specify directives that MUST be obeyed by all caching mechanisms along the request/response chain. cache_controlr%r*r1cr|sdjvr jd=dS|r|jd<dSdS)N cache-controlz Cache-Controlr4)rr-s r7r8z)Response.cache_control..on_updates[  J_ %D%DL111 J0=0G0G0I0I _--- J Jr9r)rr%r*r1)rr5r:r)r-r8s` r7rzResponse.cache_controlsS J J J J J J * L  _ - -y:N   r9etagweakc6t|||jd<dS)z8Set the etag, and override the old one if there was one.ETagN)r!r5)r-rrs r7set_etagzResponse.set_etags)$55 Vr9$tuple[str, bool] | tuple[None, None]cPt|jdS)z{Return a tuple in the form ``(etag, is_weak)``. If there is no ETag the return value is ``(None, None)``. r)r"r5r:rUs r7get_etagzResponse.get_etags"DL,,V44555r9z Accept-RangeszThe `Accept-Ranges` header. Even though the name would indicate that multiple values are supported, it must be one string token only. The values ``'bytes'`` and ``'none'`` are common. .. versionadded:: 0.7r cd fd }tjd|}|tddd|}|S) zThe ``Content-Range`` header as a :class:`~werkzeug.datastructures.ContentRange` object. Available even if the header is not set. .. versionadded:: 0.7 rngr r*r1cX|s jd=dS|jd<dSN content-rangez Content-Ranger4)rr-s r7r8z)Response.content_range..on_updates6 @L11103  _---r9rNr8)rr r*r1)rr5r:r r-r8rvs` r7 content_rangezResponse.content_rangesj @ @ @ @ @ @ ( (8(8(I(I9 U U :dD$)DDDB r9ContentRange | str | Nonec|s |jd=dSt|tr ||jd<dS||jd<dSrr5r?r'r6rbs r7rzResponse.content_range%sZ > _--- s # # >,1DL ) ) ),1OO,=,=DL ) ) )r9rctjjd}|td}d fd }||_|S) aThe ``WWW-Authenticate`` header parsed into a :class:`.WWWAuthenticate` object. Modifying the object will modify the header value. This header is not set by default. To set this header, assign an instance of :class:`.WWWAuthenticate` to this attribute. .. code-block:: python response.www_authenticate = WWWAuthenticate( "basic", {"realm": "Authentication Required"} ) Multiple values for this header can be sent to give the client multiple options. Assign a list to set multiple headers. However, modifying the items in the list will not automatically update the header values, and accessing this attribute will only ever return the first value. To unset this header, assign ``None`` or use ``del``. .. versionchanged:: 2.3 This attribute can be assigned to set the header. A list can be assigned to set multiple header values. Use ``del`` to unset the header. .. versionchanged:: 2.3 :class:`WWWAuthenticate` is no longer a ``dict``. The ``token`` attribute was added for auth challenges that use a token instead of parameters. WWW-AuthenticateNbasicr<rr*r1c|_dSr3www_authenticater<r-s r7r8z,Response.www_authenticate..on_updateRs$)D ! ! !r9r<rr*r1)r from_headerr5r: _on_update)r-r<r8s` r7rzResponse.www_authenticate0se: +DL,<,<=O,P,PQQ =#G,,E * * * * * *% r9.WWWAuthenticate | list[WWWAuthenticate] | Nonec|s`dSt|trojd|d|ddD]/}jd|0dSjd|d fd }||_dS) Nrrrr<rr*r1c|_dSr3rrs r7r8z,Response.www_authenticate..on_updatehs(-%%%r9r)rr?listr5setr6r~r)r-r<itemr8s` r7rzResponse.www_authenticateXs )%%% t $ $ ) L  /q1C1C1E1E F F Fabb  G G   !3T^^5E5EFFFF G G L  /1B1B C C C . . . . . . )E   r9c,d|jvr |jd=dSdS)Nrr5rUs r7rzResponse.www_authenticatens(  - - /000 . -r9r cd fd }tjd|}|td|}|S) a<The ``Content-Security-Policy`` header as a :class:`~werkzeug.datastructures.ContentSecurityPolicy` object. Available even if the header is not set. The Content-Security-Policy header adds an additional layer of security to help detect and mitigate certain types of attacks. cspr r*r1cX|s jd=dS|jd<dSNcontent-security-policyzContent-Security-Policyr4rr-s r7r8z3Response.content_security_policy..on_updates8 JL!:;;;:=--// 6777r9rNrrr r*r1rr5r:r rs` r7content_security_policyz Response.content_security_policyuse J J J J J J dl../HII9 U U :&tyAAAB r9"ContentSecurityPolicy | str | Nonec|s |jd=dSt|tr ||jd<dS||jd<dSrrrbs r7rz Response.content_security_policysa H 6777 s # # H6;DL2 3 3 36;oo6G6GDL2 3 3 3r9cd fd }tjd|}|td|}|S) aiThe ``Content-Security-policy-report-only`` header as a :class:`~werkzeug.datastructures.ContentSecurityPolicy` object. Available even if the header is not set. The Content-Security-Policy-Report-Only header adds a csp policy that is not enforced but is reported thereby helping detect certain types of attacks. rr r*r1cX|s jd=dS|jd<dSN#content-security-policy-report-onlyz#Content-Security-policy-report-onlyr4rs r7r8z?Response.content_security_policy_report_only..on_updates8 VL!FGGGFImmoo BCCCr9rNrrrrs` r7#content_security_policy_report_onlyz,Response.content_security_policy_report_onlysl V V V V V V  L  B C CY   :&tyAAAB r9c|s |jd=dSt|tr ||jd<dS||jd<dSrrrbs r7rz,Response.content_security_policy_report_onlysa T BCCC s # # TBGDL> ? ? ?BG//BSBSDL> ? ? ?r9cd|jvS)zWhether credentials can be shared by the browser to JavaScript code. As part of the preflight request it indicates whether credentials can be used on the cross origin request. Access-Control-Allow-CredentialsrrUs r7 access_control_allow_credentialsz)Response.access_control_allow_credentialss 2T\AAr9 bool | Nonec\|dur d|jd<dS|jdddS)NTtruer)r5poprbs r7rz)Response.access_control_allow_credentialss= D==?EDL; < < < L  ? F F F F Fr9zAccess-Control-Allow-Headersz8Which headers can be sent with the cross origin request.) load_func dump_funcr(zAccess-Control-Allow-Methodsz7Which methods can be used for the cross origin request.zAccess-Control-Allow-OriginzEThe origin or '*' for any origin that may make cross origin requests.zAccess-Control-Expose-Headersz>Which headers can be shared by the browser to JavaScript code.zAccess-Control-Max-AgezIThe maximum age in seconds the access control settings can be cached for.zCross-Origin-Opener-Policyc t|Sr3rr<s r7zResponse. U r9c|jSr3rrs r7rzResponse. r9zAllows control over sharing of browsing context group with cross-origin documents. Values must be a member of the :class:`werkzeug.http.COOP` enum.)rrdefaultr(zCross-Origin-Embedder-Policyc t|Sr3rrs r7rzResponse.rr9c|jSr3rrs r7rzResponse.rr9zPrevents a document from loading any cross-origin resources that do not explicitly grant the document permission. Values must be a member of the :class:`werkzeug.http.COEP` enum.)NNNN) rFrGr5rHrIr)rJr)r*r1)r*r')r*rW)r[rWr*r1)r<r_r*r1)r<r_r*rc) rnNNroNFFNF)rpr'r<r'rqrrrsrtrur)rvr)rwrxryrxrzr)r{rxr*r1)roNFFNF)rpr'rur)rvr)rwrxryrxrzr)r{rxr*r1)r*rx)r*r))r<r'r*r1)r*r)r*r)r<rr*r1)r*r)F)rr'rrxr*r1)r*r)r*r )r<rr*r1)r*r)r<rr*r1)r*r1)r*r )r<rr*r1)r<rr*r1)@rT __module__ __qualname____doc__rOrE__annotations__rrPrVr+rZsetterrFrarrrrIrr$r'locationrragerJrWcontent_lengthcontent_locationcontent_encoding content_md5rrdaters last_modifiedrrBvarycontent_languageallowrrr accept_rangesrrdeleterrrrr raccess_control_allow_headersaccess_control_allow_methodsaccess_control_allow_originaccess_control_expose_headersaccess_control_max_ager UNSAFE_NONEcross_origin_opener_policyrcross_origin_embedder_policyr9r7r.r.@sh8N$0////O15##'8::::!!!X!X ]DDD]D####@*.7;!#!8 8 8 8 8 z!#!" " " " " H    X  X_HHH_H * * *X *$s# H /      C(?3' #L%_       N,s+ .,s+ '/#& 'K ?    Do    G$O    MGGGXG* , , , , = 4   D%} 2 M    E   X 666666666 )OC( !   MX,>>>>%%%X%N))))*1111 X(#HHH$#HX.)/TTT0/TBBBXB&,GGG-,G $3?&" F $$$ $3?&" E $$$ #7/#"6% S### %4O'" L %%%!-_  W "7!6$++++  W """$9?4#8&++++  - $$$   r9r.r3)r&r'r(r)r*r+)* __future__rtypingtrrrhttprdatastructuresr r r r r rrrrrrrrrrrrrrrrr r!r"utilsr#r$ TYPE_CHECKINGdatastructures.cache_controlr%rBr.r r9r7rs""""""))))))))))))222222$$$$$$&&&&&&111111,,,,,,&&&&&&$$$$$$------------######''''''######$$$$$$######?=<<<<<<)))))0{ { { { { { { { { { r9