vjISrSSKJr SSKrSSKrSSKrSSKrSSKrSSKr SSK r SSK J r J r SSKJr SSKJrJr SSKJr SrS rS rS rS rS rSrSr\S-rSrSrSr \ "SS9"SS55r!\ "SS9"SS55r"\ "SS9"SS55r#"SS\$5r%S:Sjr&S;Sjr'SS!jjr)S=S?S"jjr*S@S#jr+S=SAS$jjr,SBS%jr-S=SCS&jjr.S=SDS'jjr/SES(jr0SFS)jr1S=SGS*jjr2SHS+jr3SIS,jr4SJS-jr5S=SKS.jjr6SLS/jr7SMS0jr8SNS1jr9S2r:S3S4.SOS5jjr;SPS6jrSSS9jr?g)TaThe hosted playground's sign-in through WorkOS, and the session cookie it leaves behind. Two programs have to agree on this: the app's login gate, and the wake function that stands in for the app while no task is running. Whichever of the two the load balancer routes a request to has to be able to complete a sign-in, so both serve the same three routes from the functions here, and the app accepts a cookie the function set without a second sign-in. The wake function's package is built from this file and its own, so everything here is standard library only, the call to WorkOS included. WorkOS proves who a person is and which organization they belong to. The playground decides who may enter: only members of the one organization named in settings. The WorkOS access token is read once, when the sign-in completes, and thrown away; what the playground keeps is its own cookie. A cookie value and a sign-in ``state`` share one format: a JSON record, base64url encoded, a dot, and an HMAC-SHA256 over the encoded record under the session secret. The record's ``kind`` keeps the two apart, so neither can stand in for the other. A cookie's expiry is fixed when it is issued; using the playground does not extend it. When it lapses while the WorkOS session is still alive, the person goes to WorkOS and straight back without typing anything. ``/login`` answers with a page rather than a bare redirect. A link scraper never signs in, so the page a pasted link unfurls from is this one, and it carries the preview tags; a browser moves on to WorkOS at once. ) annotationsN)asdict dataclass)escape)AnyOptional) urlencode quber_sessionzhttps://playground.qubera.aiz/static/link-card.pngiivu Qubera — extraction playgroundz~Upload a financial filing and ask a question. Every figure in the answer is cited to the page and the table cell it came from.iizhttps://api.workos.comT)frozencB\rSrSr%SrS\S'S\S'S\S'S\S'Srg ) WorkOSEzWhat both programs need to run a sign-in: the WorkOS environment's API key and client ID, the one organization whose members may enter, and the secret that signs the cookie and the ``state``.strapi_key client_idorganization_idsession_secretN__name__ __module__ __qualname____firstlineno____doc____annotations____static_attributes__r6/home/mande/repo/quber/src/quber/playground/session.pyrrEs7LNrrcL\rSrSr%SrS\S'S\S'S\S'S\S'S\S'S rg ) IdentityQzWho a session belongs to, as WorkOS reported it at sign-in. ``sid`` is the WorkOS session id, which sign-out needs to end that session too.ruser_idemailrrolesidrNrrrr r"r"Qs$LL J I Hrr"c\\rSrSr%SrS\S'SrS\S'SrS\S'SrS\S 'Sr S \S 'S r g) SignIn]zHow a return from WorkOS ends. Accepted: a redirect to the page the person asked for, with a cookie. Refused or failed: a page, no cookie.intstatusN Optional[str]locationtokenpageOptional[Identity]identityr) rrrrrrr.r/r0r2rrrr r)r)]s8N K"Hm"E=D-#'H 'rr)c\rSrSrSrSrg) SignInErroriz#WorkOS did not confirm the sign-in.rN)rrrrrrrrr r4r4is-rr4c[R"UR5UR5[R5R 5$N)hmacnewencodehashlibsha256 hexdigest)secretbodys r signaturer@ms. 88FMMOT[[]GNN C M M OOrcT[R"US[U5*S---5$)N=)base64urlsafe_b64decodelen)texts r b64decoderHqs'  # #D33t9*q.+A$A BBrc[R"[R"USS9R 55R 5R S5nUS[X53$)N),:) separatorsrB.)rDurlsafe_b64encodejsondumpsr:decoderstripr@)r>recordr?s r r:r:usR  # #DJJv*$M$T$T$V W ^ ^ ` g ghk lDV1Yv,- ..rcU(aURS5S:wagURS5upE[R"[ X5U5(dg[ R "[U55n[U[5(aURS5U:wagURS5n[U[5(aXsbUO[R"5::agU$![a gf=f)zThe record inside ``token`` when its signature holds, it is of ``kind``, and it has not expired. ``now=None`` checks against the clock; pass ``float("-inf")`` to ignore the expiry.rMNkindexpires)countsplitr8compare_digestr@rOloadsrH ValueError isinstancedictgetr+time)r>r/rVnowr?givenrSrWs r rQrQzs EKK$)++c"KD   y6 > >IdO, fd # #vzz&'9T'Ajj#G gs # #w/3tyy{'[ M sC(( C54C5c[UbUO[R"55[-n[USS0[ U5ESU0E5$)NrVsessionrW)r+r`SESSION_SECONDSr:r)r>r2rarWs r issuerfs@#diik:_LG &69Ux0@U)WU VVrc Ucg[[US5[US5[US5[US5[US5S9$![a gf=f)Nr$r%rr&r'r$r%rr&r')r"rKeyError)rSs r identity_ofrjso ~ y)*fWo&'8 9:VF^$F5M"    sAA AAc[[XSU55nUb&[R"URU5(dgU$)zThe identity in a live session cookie for ``organization_id``, or None. A cookie issued under another organization is refused like an expired one.rdN)rjrQr8rZr)r>rr/rar2s r verifyrls= 6&C@AHt2283K3K_]] Orc @[[XS[S555$)zThe identity in a cookie whose signature holds, expired or not. Sign-out reads the WorkOS session id this way, so a person whose cookie has just lapsed can still end their WorkOS session.rdz-inf)rjrQfloat)r>r/s r signed_identityros vfYf F GGrc[UbUO[R"55[-n[US[ U5US.5$)Nstate)rVnextrW)r+r` STATE_SECONDSr: safe_next)r> next_pathrarWs r state_forrvs7#diik:]JG &7Ii4HU\] ^^rcl[XSU5nUcg[[URSS555$)zHThe return page a ``state`` carries, or None when it is forged or stale.rqNrr)rQrtrr_)r>rqrarSs r next_from_staterys3 F7C 0F ~ SFB/0 11rczU(a4URS5(aURS5(dSU;aU$g)zHThe page to land on after sign-in: a path on this site, never elsewhere./z//\) startswith)raws r rtrts0 s~~c""3>>$+?+?DPSO rcUSU3$)zThe site a request came in on. The callback and the sign-out return both hang off it, so the hosted playground and a developer machine each get their own; WorkOS accepts only the ones registered in its dashboard.z://r)schemehosts r base_urlrsXS rc |[URUS-SS[URX#5S.5n[SU3$)Nz /callbackcodeauthkit)r redirect_uri response_typeproviderrqz/user_management/authorize?)r rrvr WORKOS_API)configbaseruraquerys r authorize_urlrsL )) ;.#!v44iE   E\4UG <L "% &E lub) *C zz#$(>(>>*-C&8c UH EFFDHHT2&'.. !!&"- .  H #eF4I4I8.Ydl mm# 7c H 5667s E44FFc [U[US9$)zThe Set-Cookie value for a session, as the app and the wake function both send it: HttpOnly, SameSite=Lax, and Secure on HTTPS, which is every hosted request.secure) cookie_valuere)r/rs r cookie_headerr:s v >>rc[SSUS9$)Nrxrr)rrs r clear_cookie_headerrAs Af --rcz[SU3SU3SSS/nU(aURS5 SRU5$)NrBzMax-Age=zPath=/HttpOnlyz SameSite=LaxSecurez; )COOKIEappendjoin)r/max_agerrs r rrEsBxq HWI"6*n ]E  X 99U raA {title} {head}
Qubera

{eyebrow}

{heading}

{message}

{action}
rx)headc [R[U5U[USS9[U5[U5[U5[USS9[U5S9$)aOne card on the paper background, with the Qubera mark and wordmark, in the design system's type and colors. Self-contained apart from the fonts and ``mark_src``, because the wake function serves it while nothing under the app's /static/ answers; each program passes a mark it can serve.Tquote)titlermarkeyebrowheadingmessagehrefaction)_PAGEformatrrrrrrrrrs r r0r0sT <<Um  HD )www D %f~   rc r[XU5nS[USS9S3n[SSSSS UU[5S -U-S 9$) zpThe page ``/login`` answers with: preview tags for link scrapers, and an immediate move to WorkOS for a browser.z+uQubera — sign inSign inzTaking you to sign inzMThe playground is for invited members. Your browser should move on by itself.zContinue to sign in r)rrr0link_preview_tags)rrrurrrefreshs r login_pagersZ6 3F;F6QUC $:%]^1  rc  [SSSSSSUS9$)Nu!Qubera — sign-in did not finishruThe sign-in didn’t finishzMIt could not be confirmed, or it took longer than 15 minutes. Start it again.z Sign in againrrr)rs r rrs$ 1-_  rc:[[-n[[SS9n[[SS9nSSU4SSSS[S -4SS U4SS U4SS U4SS U4SSS[ [ 54SS[ [54SSU4SSSU4SSU4SSU4SSU4/nSRSU55$)zFThe Open Graph and Twitter Card tags, one per line, for a page's head.Trname description)propertyzog:typewebsite)rz og:site_nameQuberarzog:urlr{zog:titlezog:descriptionzog:imagezog:image:secure_url)rz og:image:typez image/pngzog:image:widthzog:image:heightz og:image:alt)rz twitter:cardsummary_large_imagez twitter:titleztwitter:descriptionz twitter:imageztwitter:image:altrc3@# UHupnSUSUSUS3v M g7f)zrrrr/r-rarrr1)r>rr/r-rr1)r>rrur-rarrr)r>rrqr-rarrr-)r~r-rr)rrrrrr) rrrrrur-rarrr)r'rrrrr)rrrrrr)rrrr)rrrrrr-rqr-rrrarrr))r/rrboolrr)rrrr)r/rrr+rrrr)rrrrrrrrrrrrrrrrrr) rrrrrur-rrrr)r%rrrrrrr)rrrr)rr)@r __future__rrDr;r8rOr` urllib.errorrurllib.request dataclassesrrhtmlrtypingrr urllib.parser rrrrrrr SESSION_HOURSrersrrrr"r) Exceptionr4r@rHr:rQrfrjrlrorvryrtrrrrrrrrrrr0rrrrrrr rsy:#  ) "  *( / < $& %  $ $    $(((.).PC/ JN %-07F.W  UY "%.;BQH_ 2  =C: 4( &n &n &n &n  &n  &n  &n &nR?.1 z         6"  `r