pygitweb 0.1.0__py3-none-any.whl

pygitweb/addproject_permissions_test.py

@@ -0,0 +1,114 @@
+from collections.abc import Generator
+from unittest.mock import patch
+
+import pytest
+from fastapi.testclient import TestClient
+
+from pygitweb.auth_config import AuthConfig, LocalUser
+from pygitweb.main import app
+from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
+
+_ADDPROJECTS_AUTH = AuthConfig(
+	auth_mode="local",
+	local_users=[LocalUser(user="admin", password="secret"), LocalUser(user="viewer", password="secret")],
+	oauth_permissions=PermissionsMap.model_validate({
+		"*": [],
+		PERMISSION_ADD_PROJECTS: ["admin"],
+	}),
+)
+
+
+@pytest.fixture
+def client() -> Generator[TestClient, None, None]:
+	with TestClient(app) as c:
+		yield c
+
+
+@pytest.fixture
+def addprojects_auth() -> Generator[AuthConfig, None, None]:
+	with (
+		patch("pygitweb.auth_config.auth_config", _ADDPROJECTS_AUTH),
+		patch("pygitweb.auth.auth_config", _ADDPROJECTS_AUTH),
+		patch("pygitweb.main.auth_config", _ADDPROJECTS_AUTH),
+	):
+		yield _ADDPROJECTS_AUTH
+
+
+def _login(client: TestClient, username: str) -> None:
+	client.post(
+		"/login",
+		data={"username": username, "password": "secret", "next": "/"},
+		follow_redirects=False,
+	)
+
+
+def test_projectnamevalid_open_when_auth_disabled(client: TestClient) -> None:
+	from pygitweb.config import settings
+
+	with (
+		patch.object(settings, "AUTH", False),
+		patch("pygitweb.main.project_visible_in_list", return_value=False),
+	):
+		r = client.get("/projectnamevalid", params={"name": "newproj"})
+	assert r.status_code == 200
+
+
+def test_addproject_page_open_when_auth_disabled(client: TestClient) -> None:
+	from pygitweb.config import settings
+
+	with patch.object(settings, "AUTH", False):
+		r = client.get("/addproject")
+	assert r.status_code == 200
+
+
+def test_projectnamevalid_401_without_login(client: TestClient, addprojects_auth: AuthConfig) -> None:
+	from pygitweb.config import settings
+
+	with patch.object(settings, "AUTH", True):
+		r = client.get("/projectnamevalid", params={"name": "newproj"})
+	assert r.status_code == 401
+
+
+def test_projectnamevalid_allowed_with_grant(client: TestClient, addprojects_auth: AuthConfig) -> None:
+	from pygitweb.config import settings
+
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.main.project_visible_in_list", return_value=False),
+	):
+		_login(client, "admin")
+		r = client.get("/projectnamevalid", params={"name": "newproj"})
+	assert r.status_code == 200
+
+
+def test_projectnamevalid_forbidden_without_grant(client: TestClient, addprojects_auth: AuthConfig) -> None:
+	from pygitweb.config import settings
+
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.main.project_visible_in_list", return_value=False),
+	):
+		_login(client, "viewer")
+		r = client.get("/projectnamevalid", params={"name": "newproj"})
+	assert r.status_code == 403
+
+
+def test_addproject_page_readable_without_grant(client: TestClient, addprojects_auth: AuthConfig) -> None:
+	from pygitweb.config import settings
+
+	with patch.object(settings, "AUTH", True):
+		_login(client, "viewer")
+		r = client.get("/addproject")
+	assert r.status_code == 200
+
+
+def test_addproject_post_forbidden_without_grant(client: TestClient, addprojects_auth: AuthConfig) -> None:
+	from pygitweb.config import settings
+
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.main.project_visible_in_list", return_value=False),
+	):
+		_login(client, "viewer")
+		r = client.post("/addproject", data={"project_name": "newproj"}, follow_redirects=False)
+	assert r.status_code == 403

pygitweb/api/action.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+from fastapi import Request
+from starlette.responses import Response
+
+
+class Action(ABC):
+	"""
+	Action: A per-project action provided by a plugin.
+
+	``project`` is the project path/slug as used in URLs (under PROJECTROOT).
+	"""
+
+	@abstractmethod
+	def action_name(self) -> str: ...
+
+	@abstractmethod
+	def action(self, project: str, req: Request | None = None) -> Response | None: ...

pygitweb/api/plugins/project_zip.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import os
+import tempfile
+import zipfile
+from pathlib import Path
+
+from pygitweb.api.project import Project
+from pygitweb.tasks import create_board_for_project
+
+
+class ProjectZip(Project):
+	def __init__(
+		self,
+		path: os.PathLike[str] | str,
+		zip_content: bytes,
+		create_task_board: bool = False,
+		do_maintenance: bool = False,
+	) -> None:
+		self.path: str = str(Path(path))
+		with tempfile.TemporaryDirectory() as tmpdir:
+			zip_path = os.path.join(tmpdir, "repo.zip")
+			with open(zip_path, "wb") as file_obj:
+				file_obj.write(zip_content)
+			with zipfile.ZipFile(zip_path, "r") as zip_file:
+				zip_file.extractall(tmpdir)
+			repo_root: str = self._discover_repo_root(tmpdir)
+			super().__init__(
+				path=self.path,
+				remote_url=repo_root,
+				create_task_board=False,
+				do_maintenance=do_maintenance,
+			)
+		if create_task_board:
+			create_board_for_project(Path(self.path).name, name="Tasks", description="")
+
+	@staticmethod
+	def _discover_repo_root(tmpdir: str) -> str:
+		for name in os.listdir(tmpdir):
+			if name == "repo.zip":
+				continue
+			candidate = os.path.join(tmpdir, name)
+			if os.path.isdir(candidate) and os.path.isdir(os.path.join(candidate, ".git")):
+				return candidate
+		if os.path.isdir(os.path.join(tmpdir, ".git")):
+			return tmpdir
+		subdirs: list[str] = [
+			name for name in os.listdir(tmpdir) if name != "repo.zip" and os.path.isdir(os.path.join(tmpdir, name))
+		]
+		if len(subdirs) == 1:
+			return os.path.join(tmpdir, subdirs[0])
+		for name in os.listdir(tmpdir):
+			if name != "repo.zip":
+				candidate = os.path.join(tmpdir, name)
+				if os.path.isdir(candidate):
+					return candidate
+		return tmpdir
+
+	@classmethod
+	def form_content(cls) -> str:
+		return (
+			'<label class="form-label" for="repo_zip">Upload .zip (git repo)</label>'
+			'<div class="dropzone border rounded p-4 text-center" id="dropzone" style="min-height: 120px;">'
+			'<input type="file" class="form-control d-none" id="repo_zip" name="repo_zip" accept=".zip" '
+			"data-dropzone-target>"
+			'<div class="dropzone-placeholder text-muted" data-dropzone-placeholder>'
+			"Drag a .zip file here or click to choose."
+			"</div>"
+			'<div class="dropzone-filename d-none text-start small mt-2" data-dropzone-filename></div>'
+			"</div>"
+		)

pygitweb/api/project.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import contextlib
+import os
+import subprocess
+from pathlib import Path
+from types import TracebackType
+
+import pygit2
+
+from pygitweb.config import settings
+from pygitweb.tasks import create_board_for_project
+
+
+class Project:
+	"""
+	Plugin API: Project - the root class for a project which is always a directory, and _may_ contain a git repository.
+	"""
+
+	def __init__(
+		self,
+		path: os.PathLike[str] | str,
+		remote_url: str | None = None,
+		create_task_board: bool = False,
+		do_maintenance: bool = False,
+	) -> None:
+		self.path: str = str(Path(path))
+		self.remote_url: str | None = remote_url
+		os.makedirs(self.path)
+		if self.remote_url:
+			pygit2.clone_repository(self.remote_url, self.path, bare=True)
+		else:
+			pygit2.init_repository(self.path, bare=True)
+		self.repo: pygit2.Repository = pygit2.Repository(self.path)
+		if create_task_board:
+			create_board_for_project(Path(self.path).name, name="Tasks", description="")
+		if do_maintenance:
+			with contextlib.suppress(subprocess.SubprocessError, FileNotFoundError):
+				subprocess.run(
+					[settings.GIT, "-C", self.path, "maintenance", "start"],
+					capture_output=True,
+					timeout=60,
+				)
+
+	def __enter__(self) -> Project:
+		return self
+
+	def __exit__(
+		self,
+		exc_type: type[BaseException] | None,
+		exc_value: BaseException | None,
+		traceback: TracebackType | None,
+	) -> None:
+		self.repo.free()
+
+	def __del__(self) -> None:
+		self.repo.free()
+
+	@classmethod
+	def form_content(cls) -> str:
+		return (
+			'<label class="form-label" for="pull_from_remote">Pull from remote</label>'
+			'<input type="url" class="form-control" id="pull_from_remote" name="pull_from_remote" '
+			'placeholder="https://example.com/repo.git or ssh://git@host/repo.git or git://host/repo.git">'
+			'<small class="form-hint">Optional. Use an <code>ssh://</code>, <code>git://</code>, '
+			"or <code>https://</code> URL to clone an existing repository.</small>"
+		)

pygitweb/api/subpage.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+
+class Subpage(ABC):
+	"""
+	Subpage: A per-project subpage provided by a plugin.
+	"""
+
+	@abstractmethod
+	def subpage_name(self) -> str: ...
+
+	def link_name(self, project: str) -> str | None:
+		return None
+
+	def subpage_html(self, project: str) -> str | None:
+		return None
+
+	def summary_value_suffix_html(self, project: str, project_enc: str) -> str | None:
+		"""Optional HTML appended after the subpage \"view\" link on the project summary table."""
+		return None

pygitweb/auth.py

@@ -0,0 +1,387 @@
+"""
+Authentication: local password login and OAuth2 authorization-code (browser).
+
+FastAPI security integration
+----------------------------
+- ``OAuth2PasswordBearer`` + ``APIKeyCookie``: extract PyGitWeb's opaque session id from
+  ``Authorization: Bearer`` or the login cookie. This is *not* an IdP JWT; OpenAPI still
+  documents the password ``/token`` flow that mints these session ids.
+- ``OAuth2PasswordRequestForm``: local ``POST /token`` only (resource-owner password grant).
+- External IdP login (Google/GitHub) uses standard authorization-code redirects implemented
+  in ``auth_oauth``; ``OAuth2AuthorizationCodeBearer`` is intentionally not used because
+  clients never receive or send the provider's access token—only our session id.
+"""
+
+from __future__ import annotations
+
+import hmac
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Form, HTTPException, Query, status
+from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.security import APIKeyCookie, OAuth2PasswordBearer, OAuth2PasswordRequestForm
+from pydantic import BaseModel
+
+from pygitweb.auth_config import (
+	auth_config,
+	is_auth_configured,
+	is_local_auth_available,
+	is_oauth_auth_available,
+)
+from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, oauth_router
+from pygitweb.config import settings
+from pygitweb.gravatar import gravatar_url
+from pygitweb.password_hash import verify_password
+from pygitweb.permissions import Permission, PermissionPrincipal
+from pygitweb.sessions import create_session, get_session, revoke_session
+from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env
+
+ACCESS_TOKEN_COOKIE_NAME = "pygitweb_access_token"
+LOGIN_COOKIE_MAX_AGE = 60 * 60 * 24 * 7
+
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
+_access_token_cookie = APIKeyCookie(name=ACCESS_TOKEN_COOKIE_NAME, auto_error=False)
+
+TAG_AUTH = "auth"
+TAG_AUTH_LOCAL = "auth - local"
+TAG_AUTH_OAUTH = "auth - OAuth"
+
+auth_router = APIRouter()
+auth_router.include_router(oauth_router)
+
+
+class User(BaseModel):
+	username: str
+	email: str | None = None
+
+
+def principal_from_session(token: str | None) -> PermissionPrincipal | None:
+	if not token:
+		return None
+	rec = get_session(token)
+	if rec is None:
+		return None
+	return PermissionPrincipal(username=rec.username, email=rec.email)
+
+
+def has_permission(
+	permission: Permission,
+	project: str | None = None,
+	*,
+	token: str | None = None,
+) -> bool:
+	if not settings.AUTH:
+		return True
+	principal = principal_from_session(token)
+	if principal is None:
+		return False
+	return auth_config.oauth_permissions.has_permission(principal.identity, permission, project)
+
+
+def ensure_permission(
+	permission: Permission,
+	project: str | None = None,
+	*,
+	token: str | None,
+) -> None:
+	ensure_active_user_if_auth_enabled(token)
+	if has_permission(permission, project, token=token):
+		return
+	raise HTTPException(
+		status_code=status.HTTP_403_FORBIDDEN,
+		detail="Insufficient permissions",
+	)
+
+
+def require_permission(
+	permission: Permission,
+	*,
+	project_from_query: bool = False,
+	project_from_form: bool = False,
+) -> object:
+	"""Return a FastAPI dependency that enforces ``permission`` when auth is enabled."""
+
+	if project_from_query:
+
+		def _dep_query_project(
+			token: Annotated[str | None, Depends(access_token_from_request)],
+			project: Annotated[str, Query()],
+		) -> None:
+			ensure_permission(permission, project, token=token)
+
+		return _dep_query_project
+
+	if project_from_form:
+
+		def _dep_form_project(
+			token: Annotated[str | None, Depends(access_token_from_request)],
+			project: Annotated[str, Form()],
+		) -> None:
+			ensure_permission(permission, project, token=token)
+
+		return _dep_form_project
+
+	def _dep(
+		token: Annotated[str | None, Depends(access_token_from_request)],
+	) -> None:
+		ensure_permission(permission, None, token=token)
+
+	return _dep
+
+
+def get_local_user(username: str) -> User | None:
+	if not settings.AUTH or not is_local_auth_available(auth_config):
+		return None
+	for entry in auth_config.local_users:
+		if not entry.pass_hash and not entry.password:
+			continue
+		if hmac.compare_digest(entry.user, username):
+			return User(username=entry.user, email=entry.email)
+	return None
+
+
+def authenticate_local_user(username: str, password: str) -> User | None:
+	if auth_config.auth_mode not in ("local", "both"):
+		return None
+	for entry in auth_config.local_users:
+		if not hmac.compare_digest(entry.user, username):
+			continue
+		if entry.pass_hash:
+			if not verify_password(password, entry.pass_hash, config_salt=auth_config.salt):
+				return None
+			return User(username=entry.user, email=entry.email)
+		if entry.password is not None and hmac.compare_digest(entry.password, password):
+			return User(username=entry.user, email=entry.email)
+		return None
+	return None
+
+
+def decode_access_token(token: str) -> User | None:
+	if not settings.AUTH:
+		return None
+	rec = get_session(token)
+	if rec is None:
+		return None
+	return User(username=rec.username)
+
+
+def safe_next_url(next_raw: str | None) -> str:
+	n = (next_raw or "/").strip()
+	if not n.startswith("/") or n.startswith("//"):
+		return "/"
+	return n
+
+
+def access_token_from_request(
+	bearer: Annotated[str | None, Depends(oauth2_scheme)],
+	cookie_token: Annotated[str | None, Depends(_access_token_cookie)],
+) -> str | None:
+	b = bearer.strip() if bearer else None
+	c = cookie_token.strip() if cookie_token else None
+	return b or c
+
+
+def ensure_active_user_if_auth_enabled(token: str | None) -> None:
+	if not settings.AUTH:
+		return
+	if not is_auth_configured(auth_config):
+		raise HTTPException(
+			status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+			detail="Authentication enabled but auth.json is not configured",
+		)
+	if not token:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	if decode_access_token(token) is None:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+
+
+def require_active_user_if_auth_enabled(
+	token: Annotated[str | None, Depends(access_token_from_request)],
+) -> None:
+	ensure_active_user_if_auth_enabled(token)
+
+
+@auth_router.get(
+	"/login",
+	response_class=HTMLResponse,
+	tags=[TAG_AUTH],
+	summary="Sign-in page",
+	description="HTML sign-in page. Shows local and/or OAuth options depending on auth.json.",
+)
+async def login_page(
+	next: Annotated[str, Query()] = "/",
+) -> HTMLResponse:
+	if not settings.AUTH:
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Authentication is disabled")
+	next_safe = safe_next_url(next)
+	pre = PREAMBLE.render(title=f"{settings.SITE_NAME} - Sign in", site_name=settings.SITE_NAME)
+	body = env.get_template("login.html").render(
+		site_name=settings.SITE_NAME,
+		next=next_safe,
+		error=None,
+		local_available=is_local_auth_available(auth_config),
+		oauth_available=is_oauth_auth_available(auth_config),
+		oauth_provider=str(auth_config.oauth_provider).strip() or "OAuth",
+	)
+	return HTMLResponse(f"{pre}{body}{POSTAMBLE}")
+
+
+@auth_router.post(
+	"/login",
+	response_model=None,
+	tags=[TAG_AUTH_LOCAL],
+	summary="Local sign-in (form)",
+	description="Browser form login. Sets the pygitweb_access_token session cookie on success.",
+	responses={303: {"description": "Redirect to next URL with session cookie set"}},
+)
+async def login_form_submit(
+	username: Annotated[str, Form()],
+	password: Annotated[str, Form()],
+	next: Annotated[str, Form()] = "/",
+) -> HTMLResponse | RedirectResponse:
+	if not settings.AUTH:
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Authentication is disabled")
+	if not is_local_auth_available(auth_config):
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Local sign-in is not enabled")
+	next_safe = safe_next_url(next)
+	user = authenticate_local_user(username.strip(), password)
+	if user is None:
+		pre = PREAMBLE.render(title=f"{settings.SITE_NAME} - Sign in", site_name=settings.SITE_NAME)
+		body = env.get_template("login.html").render(
+			site_name=settings.SITE_NAME,
+			next=next_safe,
+			error="Incorrect username or password.",
+			local_available=True,
+			oauth_available=is_oauth_auth_available(auth_config),
+			oauth_provider=str(auth_config.oauth_provider).strip() or "OAuth",
+		)
+		return HTMLResponse(f"{pre}{body}{POSTAMBLE}")
+	sid = create_session(user.username, email=user.email, auth_method="local")
+	resp = RedirectResponse(url=next_safe, status_code=303)
+	resp.set_cookie(
+		key=ACCESS_TOKEN_COOKIE_NAME,
+		value=sid,
+		httponly=True,
+		samesite="lax",
+		max_age=LOGIN_COOKIE_MAX_AGE,
+		path="/",
+	)
+	return resp
+
+
+@auth_router.get(
+	"/logout",
+	tags=[TAG_AUTH],
+	summary="Sign out",
+	description="Revokes the current session (cookie or Bearer) and clears auth cookies.",
+	responses={303: {"description": "Redirect to next URL"}},
+)
+async def logout_page(
+	token: Annotated[str | None, Depends(access_token_from_request)],
+	next: Annotated[str, Query()] = "/",
+) -> RedirectResponse:
+	revoke_session(token)
+	resp = RedirectResponse(url=safe_next_url(next), status_code=303)
+	resp.delete_cookie(key=ACCESS_TOKEN_COOKIE_NAME, path="/")
+	resp.delete_cookie(key=OAUTH_STATE_COOKIE_NAME, path="/")
+	return resp
+
+
+@auth_router.post(
+	"/token",
+	tags=[TAG_AUTH_LOCAL],
+	summary="Obtain session token (local)",
+	description=(
+		"OAuth2 password flow for API clients. Returns an opaque session id as access_token; "
+		"use Authorization: Bearer on protected routes. Not an identity-provider JWT."
+	),
+)
+async def login(form_data: Annotated[OAuth2PasswordRequestForm, Depends()]) -> dict[str, str]:
+	if not settings.AUTH:
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Authentication is disabled")
+	if not is_local_auth_available(auth_config):
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Local sign-in is not enabled")
+	user = authenticate_local_user(form_data.username, form_data.password)
+	if user is None:
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Incorrect username or password")
+	sid = create_session(user.username, email=user.email, auth_method="local")
+	return {"access_token": sid, "token_type": "bearer"}
+
+
+@auth_router.get(
+	"/auth/status",
+	tags=[TAG_AUTH],
+	summary="Auth status (navbar)",
+	description="Lightweight JSON for the navbar script. Does not return 401 when anonymous.",
+)
+async def auth_status(
+	token: Annotated[str | None, Depends(access_token_from_request)],
+) -> dict[str, bool | str | None]:
+	if not settings.AUTH:
+		return {"auth_enabled": False, "username": None, "gravatar_url": None}
+	if not token:
+		return {"auth_enabled": True, "username": None, "gravatar_url": None}
+	rec = get_session(token)
+	if rec is None:
+		return {"auth_enabled": True, "username": None, "gravatar_url": None}
+	avatar = gravatar_url(rec.email) if rec.email else None
+	return {"auth_enabled": True, "username": rec.username, "gravatar_url": avatar}
+
+
+@auth_router.get(
+	"/user",
+	response_class=HTMLResponse,
+	response_model=None,
+	tags=[TAG_AUTH],
+	summary="Account page",
+	description="HTML account page for the signed-in user.",
+)
+async def user_account_page(
+	token: Annotated[str | None, Depends(access_token_from_request)],
+) -> HTMLResponse | RedirectResponse:
+	if not settings.AUTH:
+		pre = PREAMBLE.render(title=f"{settings.SITE_NAME} - Account", site_name=settings.SITE_NAME)
+		body = '<p class="text-muted">Authentication is not enabled on this server.</p>'
+		return HTMLResponse(f"{pre}{body}{POSTAMBLE}")
+	if not is_auth_configured(auth_config):
+		raise HTTPException(
+			status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+			detail="Authentication is misconfigured",
+		)
+	u = decode_access_token(token or "") if token else None
+	if u is None:
+		return RedirectResponse(url="/login?next=/user", status_code=303)
+	pre = PREAMBLE.render(title=f"{settings.SITE_NAME} - Account", site_name=settings.SITE_NAME)
+	body = env.get_template("user_profile.html").render(username=u.username, site_name=settings.SITE_NAME)
+	return HTMLResponse(f"{pre}{body}{POSTAMBLE}")
+
+
+@auth_router.get(
+	"/users/me",
+	response_model=User,
+	tags=[TAG_AUTH],
+	summary="Current user",
+	description="Returns the username for the current session (cookie or Bearer).",
+)
+async def read_users_me(
+	token: Annotated[str | None, Depends(access_token_from_request)],
+) -> User:
+	if not settings.AUTH:
+		raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Authentication is disabled")
+	ensure_active_user_if_auth_enabled(token)
+	u = decode_access_token(token or "")
+	if u is None:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	return u