
    FCf^                       U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	m
Z
mZ ddlmZ ddlmZmZmZmZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZmZmZm Z m!Z!m"Z" ddl#m$Z$m%Z% ddl&m'Z' erddl(m)Z) ddl*m+Z+ dZ,dZ-	 ddl.Z/ e0 e1e2e/jf                  ji                  d      dd             dk\  rdZ- e6g d      Z7	  G d d      Z8 edg d      Z9	  edg d      Z:	  eddg      Z;	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d<dZ<d=dZ=d>d Z>	 	 	 	 	 	 d?d!Z?d@d"Z@dAd#ZAdBd$ZBdCd%ZCdDd&ZDdDd'ZEdDd(ZFdDd)ZGdDd*ZHeDeGeFeeeE ej                  e@d+,       ej                  e@d-,      eHd.	ZJd/eKd0<    G d1 d2      ZL G d3 d4eL      ZM G d5 d6eL      ZN G d7 d8eL      ZOeN ej                  eMd+,       ej                  eMd-,      eO ej                  eMd-,      d9ZPdeKd:<   	 dE	 	 	 	 	 	 	 dFd;ZQy# e5$ r 	 ddl/Z/n# e5$ r dZ,Y nw xY wY Lw xY w)GzAuthentication helpers.    )annotationsN)standard_b64decodestandard_b64encode)
namedtuple)TYPE_CHECKINGAnyCallableDictMappingMutableMappingOptionalcast)quote)Binary)_authenticate_aws)_authenticate_oidc_get_authenticator_OIDCAzureCallback_OIDCGCPCallback_OIDCProperties_OIDCTestCallback)ConfigurationErrorOperationFailure)saslprep)Hello)
ConnectionTF.   )r      )	GSSAPI
MONGODB-CRMONGODB-OIDCMONGODB-X509MONGODB-AWSPLAINSCRAM-SHA-1SCRAM-SHA-256DEFAULTc                  @    e Zd ZdZ ed       ZddZddZddZd	dZ	y)
_Cachedatac                    d | _         y Nr+   selfs    L/var/www/highfloat_scraper/venv/lib/python3.12/site-packages/pymongo/auth.py__init__z_Cache.__init__Z   s	    	    c                0    t        |t              ryt        S )NT
isinstancer*   NotImplementedr0   others     r1   __eq__z_Cache.__eq__]   s    eV$r3   c                0    t        |t              ryt        S )NFr5   r8   s     r1   __ne__z_Cache.__ne__c   s    eV$r3   c                    | j                   S r.   )	_hash_valr/   s    r1   __hash__z_Cache.__hash__h   s    ~~r3   N)returnNone)r9   objectr@   bool)r@   int)
__name__
__module____qualname__	__slots__hashr>   r2   r:   r<   r?    r3   r1   r*   r*   U   s$    IXI
r3   r*   MongoCredential)	mechanismsourceusernamepasswordmechanism_propertiescacheGSSAPIPropertiesservice_namecanonicalize_host_nameservice_realm_AWSPropertiesaws_session_tokenMapping[str, Any]c           	        | dvr|t        |  d      | dk(  r||dk7  rt        d      |j                  di       }|j                  dd	      }t        |j                  d
d            }|j                  d      }	t	        |||	      }
t        | d|||
d      S | dk(  r/|t        d      ||dk7  rt        d      t        | d|ddd      S | dk(  r`||t        d      ||dk7  rt        d      |j                  di       }|j                  d      }t        |      }t        | d|||d      S | dk(  rC|j                  di       }|j                  d      }|j                  d      }|j                  d      }|j                  dd      }g d}|j                  d|      }d}|d}t        |      |s|r|t        |      |r|rd }t        |      |m|d!k(  r|d"}t        |      t               }nY|d#k(  rd}|st        d$      t        |      }n9|d%k(  rd}|st        d&      t        |      }nt        d'|       t        |      t        ||||||(      }t        | d|||t                     S | d)k(  r|xs |xs d}t        | |||dd      S |xs |xs d*}|t        d+      t        | |||dt                     S ),z8Build and return a mechanism specific credentials tuple.)r#   r$   r"   Nz requires a username.r    	$externalz:authentication source must be $external or None for GSSAPIauthmechanismpropertiesSERVICE_NAMEmongodbCANONICALIZE_HOST_NAMEFSERVICE_REALMrS   r#   z+Passwords are not supported by MONGODB-X509z@authentication source must be $external or None for MONGODB-X509r$   z;username without a password is not supported by MONGODB-AWSz?authentication source must be $external or None for MONGODB-AWSAWS_SESSION_TOKEN)rX   r"   OIDC_CALLBACKOIDC_HUMAN_CALLBACKENVIRONMENTTOKEN_RESOURCE )z*.mongodb.netz*.mongodb-dev.netz*.mongodb-qa.netz*.mongodbgov.net	localhostz	127.0.0.1z::1ALLOWED_HOSTSzVauthentication with MONGODB-OIDC requires providing either a callback or a environmentz)password is not supported by MONGODB-OIDCz5cannot set both OIDC_CALLBACK and OIDC_HUMAN_CALLBACKtestz;test environment for MONGODB-OIDC does not support usernameazurezTAzure environment for MONGODB-OIDC requires a TOKEN_RESOURCE auth mechanism propertygcpzOGCP provider for MONGODB-OIDC requires a TOKEN_RESOURCE auth mechanism propertyz+unrecognized ENVIRONMENT for MONGODB-OIDC: )callbackhuman_callbackenvironmentallowed_hoststoken_resourcerN   r%   adminzA password is required.)r   
ValueErrorgetrC   rR   rK   rW   r   r   r   r   r*   )mechrM   userpasswdextradatabase
propertiesrT   canonicalizerV   propsrX   	aws_propsrl   rm   environrp   default_allowedro   msg
oidc_propssource_databases                         r1   _build_credentials_tupler   }   sn    BBt| D6)>!?@@x&K"7YZZYY8"=
!~~ni@JNN+CUKL"7 %#/'
 t[$tLL		$%RSS&K"7_``t[$dDII		$%bcc&K"7$Q  YY8"=
&NN+>?"5FG	t[$	4PP		YY8"=
>>/2#(=>../#(8"=
 #Hd 	 =C$S))~"(--NM(-- & #WC,S11,.G#%,n  .n=E!%,i  ,N;(+VW^V_)`aa$S))$)')

 t[$
FHUU	 ;H;t_dFD$OO 7H7>$%>??t_dFD&(SSr3   c           
         dj                  t        | |      D cg c]  \  }}t        ||z  g       c}}      S c c}}w )zXOR two byte strings together.r3   )joinzipbytes)firsecxys       r1   _xorr      s3    88C>1UAE7^>??>s   <
c                D    t        d | j                  d      D              S )z-Split a scram response into key, value pairs.c              3     K   | ]E  }t        j                  t         j                  t        t        f   |j	                  d d             G yw)   =   N)typingr   Tupler   split).0items     r1   	<genexpr>z(_parse_scram_response.<locals>.<genexpr>   s;       	FLL.

40CDs   AA   ,)dictr   )responses    r1   _parse_scram_responser      s%     NN4(  r3   c                   | j                   }|j                  d      j                  dd      j                  dd      }t        t	        j
                  d            }d|z   dz   |z   }d	|t        d
|z         d	ddid}|||fS )Nutf-8r   s   =3Dr   s   =2C    s   n=s   ,r=r   s   n,,skipEmptyExchangeT)	saslStartrL   payloadautoAuthorizeoptions)rN   encodereplacer   osurandomr   )credentialsrL   rN   ru   nonce
first_barecmds          r1   _authenticate_scram_startr      s     ##H??7#++D&9AA$ODrzz"~.E&.J &:-.'.C *c!!r3   c                Z   | j                   }|dk(  r7d}t        j                  }t        | j                        j                  d      }n7d}t        j                  }t        || j                        j                  d      }| j                  }| j                  }t        j                  }	|j                  }
|
rL|
j                         r<t        |
t              sJ |
j                   J |
j                   \  }}|
j"                  }n"t%        | |      \  }}}|j'                  ||      }|J |d   }t)        |      }t+        |d         }|dk  rt-        d	      |d
   }|d   }|j/                  |      st-        d      d|z   }|j0                  r|j0                  \  }}}}nd\  }}}}|r
||k7  s||k7  r\t        j2                  ||t5        |      |      } |	|d|      j7                         } |	|d|      j7                         }||||f|_         ||      j7                         }dj9                  |||f      } |	|||      j7                         }dt;        t=        ||            z   }dj9                  ||f      }t;         |	|||      j7                               }d|d   t?        |      d}|j'                  ||      }t)        |d         }t        j@                  |d   |      st-        d      |d   s5d|d   t?        d      d}|j'                  ||      }|d   st-        d      yy)zAuthenticate using SCRAM.r'   sha256r   sha1Nr      ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Keyr   s   p=r   conversationIdsaslContinuer   r      vz%Server returned an invalid signature.doner3   z%SASL conversation failed to complete.)!rN   hashlibr   r   rO   r   r   _password_digestrM   rQ   hmacHMACauth_ctxspeculate_succeededr6   _ScramContext
scram_dataspeculative_authenticater   commandr   rD   r   
startswithr,   pbkdf2_hmacr   digestr   r   r   r   compare_digest) r   connrL   rN   r   	digestmodr,   rM   rQ   _hmacctxr   r   resr   server_firstparsed
iterationssaltrnoncewithout_proof
client_key
server_keycsaltciterationssalted_pass
stored_keyauth_msg
client_sigclient_proofclient_final
server_sigs                                    r1   _authenticate_scramr     s:   ##HO#NN	,,-44W=LL	+*>*>?FFwOFE IIE
--C
s&&(#}---~~)))NNz**!:;	!Rz3ll63'??y>L"<0FVD\"JDLMM$<DD\FU#BCC 6)Mzz5:ZZ2
J{5K2
J{ **C))&$8J48PR\];yAHHJ
;yAHHJ
 *dJ?
:&--/Jyy*lMBCHz8Y7>>@J-d:z.JKKL99m\:;L#E*h	$J$Q$Q$STJ ./,'C
 ,,vs
#C"3y>2Fvd|Z8FGG v;!"23c{

 ll63'6{"#JKK  r3   c                6   t        |t              st        d      t        |      dk(  rt	        d      t        | t              st        d      t        j                         }|  d| }|j                  |j                  d             |j                         S )z0Get a password digest to use for authentication.z#password must be an instance of strr   zpassword can't be emptyz#username must be an instance of strz:mongo:r   )
r6   str	TypeErrorlenrr   r   md5updater   	hexdigest)rN   rO   md5hashr,   s       r1   r   r   e  s    h$=>>
8}233h$=>>kkmGZwxj)DNN4;;w'(r3   c                    t        ||      }t        j                         }|  | | }|j                  |j	                  d             |j                         S )z*Get an auth key to use for authentication.r   )r   r   r   r   r   r   )r   rN   rO   r   r   r,   s         r1   	_auth_keyr   t  sO    h1FkkmGWXJvh'DNN4;;w'(r3   c                B   t        j                  | dddt         j                  t         j                        d   \  }}}}}	 t        j                  |t         j
                        }|d   j                         S # t         j                  $ r |j                         cY S w xY w)z2Canonicalize hostname following MIT-krb5 behavior.Nr   )socketgetaddrinfoIPPROTO_TCPAI_CANONNAMEgetnameinfoNI_NAMEREQDgaierrorlower)hostnameafsocktypeproto	canonnamesockaddrnames          r1   _canonicalize_hostnamer   }  s     06/A/A$1f00&2E2E00	,B%H!!!(F,>,>? 7==? ?? !  !s   $A8 8#BBc                   t         st        d      	 | j                  }| j                  }| j                  }|j
                  d   }|j                  rt        |      }|j                  dz   |z   }|j                  |dz   |j                  z   }|t        rOdj                  t        |      t        |      f      }t        j                  ||t        j                        \  }}	nrd|v r|j!                  dd      \  }
}n|d}}
t        j                  |t        j                  |
||      \  }}	n(t        j                  |t        j                        \  }}	|t        j"                  k7  rt%        d	      	 t        j&                  |	d
      dk7  rt%        d      t        j(                  |	      }dd|dd}|j+                  d|      }t-        d      D ]}  }t        j&                  |	t/        |d               }|dk(  rt%        d      t        j(                  |	      xs d
}d|d   |d}|j+                  d|      }|t        j"                  k(  s} n t%        d      t        j0                  |	t/        |d               dk7  rt%        d      t        j2                  |	t        j(                  |	      |      dk7  rt%        d      t        j(                  |	      }d|d   |d}|j+                  d|       t        j4                  |	       y# t        j4                  |	       w xY w# t        j6                  $ r}t%        t/        |            dd}~ww xY w)zAuthenticate using GSSAPI.zEThe "kerberos" module must be installed to use GSSAPI authentication.r   @N:)gssflagsr   )r   ru   domainrO   z&Kerberos context failed to initialize.rf   z*Unknown kerberos failure in step function.r    r   rL   r   r   r[   
   r   r   r   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)HAVE_KERBEROSr   rN   rO   rP   addressrU   r   rT   rV   _USE_PRINCIPALr   r   kerberosauthGSSClientInitGSS_C_MUTUAL_FLAGr   AUTH_GSS_COMPLETEr   authGSSClientStepauthGSSClientResponser   ranger   authGSSClientUnwrapauthGSSClientWrapauthGSSClientCleanKrbError)r   r   rN   rO   r{   hostservice	principalresultr   ru   r   r   r   r   _excs                    r1   _authenticate_gssapir    s<    S
 	
e3''''00 ||A'')$/D$$s*T1*me&9&99G  HHeHouX%GH	&88Y1K1K (?#+>>#q#9LD&#+T&D&88%77!% #44WxGaGabKFCX///"#KLL:	-
 ))#r2a7&'STT 44S9G%"!"	C ||K5H 2Y V!33CXi=P9QRR<*+WXX"88=C %&&./?&@&
  <<S9X777V" ''TUU ++CXi5H1IJaO&'YZZ))#x/M/Mc/RT\]abb&'WXX44S9G !"*+;"<"C
 LLc* '',H'', 3s3x(d23s8   E!L% 5CL B&L 5L% L""L% %M8MMc                    | j                   }| j                  }| j                  }d| d| j                         }ddt	        |      dd}|j                  ||       y)z(Authenticate using SASL PLAIN (RFC 4616) r   r%   r   N)rM   rN   rO   r   r   r   )r   r   rM   rN   rO   r   r   s          r1   _authenticate_plainr    se    F##H##HhZtH:.668G'?	C 	LLr3   c                    |j                   }|r|j                         ryt        | |j                        j	                         }|j                  d|       y)z Authenticate using MONGODB-X509.Nr[   )r   r   _X509Contextr   speculate_commandr   )r   r   r   r   s       r1   _authenticate_x509r  
  sC    
--C
s&&(
{DLL
1
C
C
ECLLc"r3   c                    | j                   }| j                  }| j                  }|j                  |ddi      }|d   }t	        |||      }d|||d}|j                  ||       y)zAuthenticate using MONGODB-CR.getnoncer   r   )authenticateru   r   keyN)rM   rN   rO   r   r   )	r   r   rM   rN   rO   r   r   r  querys	            r1   _authenticate_mongo_crr    sm    F##H##H||FZO4HWE
E8X
.C 5MELLr3   c                R   |j                   dk\  r|j                  r|j                  }nU| j                  }|j                         }|dz   | j                  z   |d<   |j                  ||d      j                  dg       }d|v rt        | |d      S t        | |d      S t        | |d      S )N   r   saslSupportedMechsF)publish_eventsr'   r&   )max_wire_versionnegotiated_mechsrM   	hello_cmdrN   r   rs   r   )r   r   mechsrM   r   s        r1   _authenticate_defaultr(  $  s    !  ))E ''F.."C(.{7K7K(KC$%LLULCGGH\^`aEe#&{D/JJ&{D-HH";mDDr3   r&   )rL   r'   )	r    r!   r#   r$   r"   r%   r&   r'   r(   z!Mapping[str, Callable[..., None]]	_AUTH_MAPc                  J    e Zd ZddZe	 	 	 	 	 	 dd       Zd	dZd
dZddZy)_AuthContextc                .    || _         d | _        || _        y r.   )r   r   r   )r0   r   r   s      r1   r2   z_AuthContext.__init__C  s    &EI%r3   c                t    t         j                  | j                        }|rt        t         || |            S y r.   )_SPECULATIVE_AUTH_MAPrs   rL   r   r+  )credsr   spec_clss      r1   from_credentialsz_AuthContext.from_credentialsH  s2     ),,U__=hug&>??r3   c                    t         r.   )NotImplementedErrorr/   s    r1   r  z_AuthContext.speculate_commandQ  s    !!r3   c                &    |j                   | _         y r.   )r   )r0   hellos     r1   parse_responsez_AuthContext.parse_responseT  s    (-(F(F%r3   c                ,    t        | j                        S r.   )rC   r   r/   s    r1   r   z _AuthContext.speculate_succeededW  s    D1122r3   N)r   rK   r   tuple[str, int]r@   rA   )r/  rK   r   r8  r@   zOptional[_AuthContext]r@   z"Optional[MutableMapping[str, Any]])r5  zHello[Mapping[str, Any]]r@   rA   )r@   rC   )	rE   rF   rG   r2   staticmethodr1  r  r6  r   rJ   r3   r1   r+  r+  B  sC    
 )8	 "G3r3   r+  c                  8     e Zd Z	 	 	 	 	 	 	 	 d fdZddZ xZS )r   c                B    t         |   ||       d | _        || _        y r.   )superr2   r   rL   )r0   r   r   rL   	__class__s       r1   r2   z_ScramContext.__init__\  s"     	g.9="r3   c                    t        | j                  | j                        \  }}}| j                  j                  |d<   ||f| _        |S Ndb)r   r   rL   rM   r   )r0   r   r   r   s       r1   r  z_ScramContext.speculate_commandc  sE    !:4;K;KT^^!\z3$$++D	 *-
r3   )r   rK   r   r8  rL   r   r@   rA   r9  )rE   rF   rG   r2   r  __classcell__)r>  s   @r1   r   r   [  s-    #*#5D#QT#	#r3   r   c                      e Zd ZddZy)r  c                n    ddd}| j                   j                  | j                   j                  |d<   |S )Nr   r#   )r  rL   ru   )r   rN   )r0   r   s     r1   r  z_X509Context.speculate_commandm  s8     ~>$$0**33CK
r3   N)r@   zMutableMapping[str, Any]rE   rF   rG   r  rJ   r3   r1   r  r  l  s    r3   r  c                      e Zd ZddZy)_OIDCContextc                    t        | j                  | j                        }|j                         }|y | j                  j                  |d<   |S r@  )r   r   r   get_spec_auth_cmdrM   )r0   authenticatorr   s      r1   r  z_OIDCContext.speculate_commandu  sH    *4+;+;T\\J--/;$$++D	
r3   Nr9  rE  rJ   r3   r1   rG  rG  t  s    r3   rG  )r#   r&   r'   r"   r(   r.  c                f    | j                   }t        |   }|dk(  rt        | ||       y || |       y)zAuthenticate connection.r"   N)rL   r)  r   )r   r   reauthenticaterL   	auth_funcs        r1   r  r    s7     %%I)$IN";n=+t$r3   )rt   r   rM   Optional[str]ru   r   rv   r   rw   rY   rx   rN  r@   rK   )r   r   r   r   r@   r   )r   r   r@   zDict[bytes, bytes])r   rK   rL   r   r@   z-tuple[bytes, bytes, MutableMapping[str, Any]])r   rK   r   r   rL   r   r@   rA   )rN   r   rO   r   r@   r   )r   r   rN   r   rO   r   r@   r   )r   r   r@   r   )r   rK   r   r   r@   rA   )F)r   rK   r   r   rL  rC   r@   rA   )R__doc__
__future__r   	functoolsr   r   r   r   r   base64r   r   collectionsr   r   r   r	   r
   r   r   r   r   urllib.parser   bson.binaryr   pymongo.auth_awsr   pymongo.auth_oidcr   r   r   r   r   r   pymongo.errorsr   r   pymongo.saslprepr   pymongo.hellor   pymongo.poolr   r   r   winkerberosr  tuplemaprD   __version__r   ImportError	frozenset
MECHANISMSr*   rK   rR   rW   r   r   r   r   r   r   r   r   r  r  r  r  r(  partialr)  __annotations__r+  r   r  rG  r.  r  rJ   r3   r1   <module>re     s    "    	   9 "	 	 	   .  @ %#'	"Sh**005bq9:;vE 

 : . T ? S  6 ,/B.CD :sT
sTsT sT 	sT
 sT sT sTl@
" "-0"2"$PLfl3^# E$ #(&$& $9$$%8MR&Y&&':oV$
0	, 
3 32L "< <  !$9$$]mL&Y&&}P  y  /J, (  LQ	% 	%(2	%DH	%		%S   s6   4G, ,H2G76H7H>H HHH