
    FCf6                    $   d Z ddlmZ ddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZ ddlmZ ddlZddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZ ddlm Z  erddl!m"Z" ddl#m$Z$ e G d d             Z%e G d d             Z&e G d d             Z' G d dejP                        Z)e G d d             Z*	 dZ+dZ,dZ-dZ.dZ/	 	 	 	 	 	 d(dZ0 G d  d!e)      Z1 G d" d#e)      Z2 G d$ d%e)      Z3e G d& d             Z4	 	 	 	 	 	 	 	 d)d'Z5y)*z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)quote)Binary)_get_azure_response)	remaining)_get_gcp_response)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)MongoCredential)
Connectionc                  P    e Zd ZU ded<    ed      Zded<    ed      Zded<   y)	OIDCIdPInfostrissuerNdefaultOptional[str]clientIdzOptional[list[str]]requestScopes)__name__
__module____qualname____annotations__r   r   r        Q/var/www/highfloat_scraper/venv/lib/python3.12/site-packages/pymongo/auth_oidc.pyr   r   '   s&    K#D1Hm1).t)<M&<r$   r   c                  d    e Zd ZU ded<   ded<   ded<    ed      Zd	ed
<    ed      Zded<   y)OIDCCallbackContextfloattimeout_secondsr   usernameintversionNr   r   refresh_tokenOptional[OIDCIdPInfo]idp_info)r   r    r!   r"   r   r-   r/   r#   r$   r%   r'   r'   .   s1    ML#(#6M=6&+D&9H#9r$   r'   c                  P    e Zd ZU ded<    ed      Zded<    ed      Zded<   y)	OIDCCallbackResultr   access_tokenNr   zOptional[float]expires_in_secondsr   r-   )r   r    r!   r"   r   r3   r-   r#   r$   r%   r1   r1   7   s'    */*==#(#6M=6r$   r1   c                  6    e Zd ZdZej
                  dd       Zy)OIDCCallbackz)A base class for defining OIDC callbacks.c                     y)z/Convert the given BSON value into our own type.Nr#   )selfcontexts     r%   fetchzOIDCCallback.fetchA   s    r$   Nr8   r'   returnr1   )r   r    r!   __doc__abcabstractmethodr9   r#   r$   r%   r5   r5   >   s    3> >r$   r5   c                      e Zd ZU  ed      Zded<    ed      Zded<    ed      Zded<    ee      Z	d	ed
<    ed      Z
ded<   dZded<   y)_OIDCPropertiesNr   zOptional[OIDCCallback]callbackhuman_callbackr   environmentdefault_factoryz	list[str]allowed_hoststoken_resource r   r*   )r   r    r!   r   rA   r"   rB   rC   listrF   rG   r*   r#   r$   r%   r@   r@   F   sY    ',T':H$:-24-@N*@!&t!4K4$T:M9:$)$$7NM7Hcr$   r@      i,     <   g?_OIDCAuthenticatorc                   | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  sbd}|j
                  }|D ]9  }||d   k(  rd}|j                  d      s |d   j                  |dd        s8d}; |st        d|d    d|       t        ||      | j                   _        | j                   j                  S )	NFr   Tz*.rK   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )r*   
properties)
cachedatar*   mechanism_propertiesrC   rF   
startswithendswithr   rM   )credentialsaddressprincipal_namerO   foundrF   patts          r%   _get_authenticatorrZ   Y   s       %%% !))N11J !!"00! 	Dwqz!&71:+>+>tABx+H		
 $)'!*5]^k]lm 
 0T^_K!!!r$   c                      e Zd ZddZy)_OIDCTestCallbackc                    t         j                  j                  d      }|st        d      t	        |      5 }t        |j                         j                               cd d d        S # 1 sw Y   y xY w)NOIDC_TOKEN_FILEzIMONGODB-OIDC with an "test" provider requires "OIDC_TOKEN_FILE" to be setr2   )osenvirongetRuntimeErroropenr1   readstrip)r7   r8   
token_filefids       r%   r9   z_OIDCTestCallback.fetchw   sd    ZZ^^$56
[  * 	G%388:3C3C3EF	G 	G 	Gs   (A**A3Nr:   )r   r    r!   r9   r#   r$   r%   r\   r\   v   s    Gr$   r\   c                      e Zd ZddZddZy)_OIDCAzureCallbackc                $    t        |      | _        y Nr   rG   r7   rG   s     r%   __init__z_OIDCAzureCallback.__init__       #N3r$   c                ~    t        | j                  |j                  |j                        }t	        |d   |d         S )Nr2   
expires_in)r2   r3   )r   rG   r*   r)   r1   r7   r8   resps      r%   r9   z_OIDCAzureCallback.fetch   s>    "4#6#68H8H'JaJab!n-$|BT
 	
r$   NrG   r   r;   Noner:   r   r    r!   ro   r9   r#   r$   r%   rj   rj      s    4
r$   rj   c                      e Zd ZddZddZy)_OIDCGCPCallbackc                $    t        |      | _        y rl   rm   rn   s     r%   ro   z_OIDCGCPCallback.__init__   rp   r$   c                `    t        | j                  |j                        }t        |d         S )Nr2   r_   )r   rG   r)   r1   rs   s      r%   r9   z_OIDCGCPCallback.fetch   s*     !4!4g6M6MN!tN/CDDr$   Nru   r:   rw   r#   r$   r%   ry   ry      s    4Er$   ry   c                  ^   e Zd ZU ded<   ded<    ed      Zded<    ed      Zded	<    ed      Zd
ed<    ed      Zded<    ee	j                        Zded<    ed      Zded<   d!dZd!dZd"dZd#dZd!dZd$dZd%dZd&dZd'dZ	 	 	 	 	 	 d(dZd#dZd)dZ	 	 	 	 	 	 d*d Zy)+rM   r   r*   r@   rO   Nr   r   r-   r2   r.   r/   r   r+   token_gen_idrD   zthreading.Locklockr(   last_call_timec                    | j                  |       | j                  j                  r| j                  |      S | j	                  |      S )z(Handle a reauthenticate from the server.)_invalidaterO   rA   _authenticate_machine_authenticate_human)r7   conns     r%   reauthenticatez!_OIDCAuthenticator.reauthenticate   sA     	??##--d33''--r$   c                    |j                   }|r6|j                         r&|j                  }|r|d   r| j                  |_        |S | j
                  j                  r| j                  |      S | j                  |      S )z'Handle an initial authenticate request.done)	auth_ctxspeculate_succeededspeculative_authenticater}   oidc_token_gen_idrO   rA   r   r   )r7   r   ctxrt   s       r%   authenticatez_OIDCAuthenticator.authenticate   ss     mm3**,//DV)-):):&
 ??##--d33''--r$   c                V    | j                   sy| j                  d| j                   i      S )z-Get the appropriate speculative auth command.Njwt)r2   _get_start_command)r7   s    r%   get_spec_auth_cmdz$_OIDCAuthenticator.get_spec_auth_cmd   s*      &&t/@/@'ABBr$   c                    | j                   r	 | j                  |      S | j                  |      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY wrl   )r2   _sasl_start_jwtr   _is_auth_errorr   )r7   r   es      r%   r   z(_OIDCAuthenticator._authenticate_machine   sj    
 ++D11
 ##D))	 $ &&q)55d;;s    0 	A&!A!A& A!!A&c                   | j                   r	 | j                  |      S | j
                  r	 | j                  |      S | j                  d       }| j                  ||      }| j                  ||      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY w# t        $ r4}| j                  |      rd | _        | j	                  |      cY d }~S  d }~ww xY wrl   )	r2   r   r   r   r   r-   r   _run_command_sasl_continue_jwt)r7   r   r   cmd
start_resps        r%   r   z&_OIDCAuthenticator._authenticate_human   s    
 ++D11 ++D11 %%d+&&tS1
&&tZ88/ $ &&q)33D99 $ &&q))-D&33D99	sF   A2 B+ 2	B(;!B#B("B##B(+	C(4(C#C("C##C(c                   | j                   }|j                  d u}|r| j                  y |j                  r|j                  }|j                  r|j                  }| j                  }|r|S |sy |so|l| j
                  5  | j                  }||k7  r|cd d d        S t        j                         | j                  z
  }|t        k  rt        j                  t        |z
         t        j                         | _        |rt        }| j                  J t        t               xs t              }t        |t        | j                   | j                  | j                   j"                        }|j%                  |      }	t'        |	t(              st+        d      |	j                   | _        |	j                  | _        | xj,                  dz  c_        d d d        | j                  S | j                  S # 1 sw Y   | j                  S xY w)N)r)   r,   r-   r/   r*   z2Callback result must be of type OIDCCallbackResultrK   )rO   rB   r/   rA   r2   r~   timer   TIME_BETWEEN_CALLS_SECONDSsleepHUMAN_CALLBACK_TIMEOUT_SECONDSr+   r    MACHINE_CALLBACK_TIMEOUT_SECONDSr'   CALLBACK_VERSIONr-   r*   r9   
isinstancer1   
ValueErrorr}   )
r7   rO   is_humancb
prev_token	new_tokendeltatimeoutr8   rt   s
             r%   _get_access_tokenz$_OIDCAuthenticator._get_access_token   s   __
 ,,D8-$$B$$**B&&
:jbn ' !--	
*$' ' 		d&9&9955JJ9EAB&*iik#<G==444!)+"Q1QRG-$+,"&"4"4!]]!__55 xx(!$(:;$%YZZ%)%7%7"$($5$5!!!Q&!='@    t   A'@    s   G-D/G--Hc                    	 |j                  d|d      S # t        $ r(}| j                  |      r| j                  |        d }~ww xY w)Nz	$externalT)	no_reauth)commandr   r   r   )r7   r   r   r   s       r%   r   z_OIDCAuthenticator._run_command(  sK    	<<SD<AA 	""1%  &	s    	A#AAc                J    t        |t              sy|j                  t        k(  S )NF)r   r   coder   )r7   errs     r%   r   z!_OIDCAuthenticator._is_auth_error0  s     #/0xx777r$   c                V    |j                   xs d}||| j                  k  ry d | _        y )Nr   )r   r}   r2   )r7   r   r}   s      r%   r   z_OIDCAuthenticator._invalidate5  s2     --2#t7H7H(H r$   c                   d | _         d | _        t        j                  |d         }d|v rt	        di || _        | j                         }| j                  |_        | j                  d|i|      }| j                  ||      S )Npayloadr   r   r#   )r2   r-   bsondecoder   r/   r   r}   r   _get_continue_commandr   )r7   r   r   start_payloadr2   r   s         r%   r   z%_OIDCAuthenticator._sasl_continue_jwt=  s     !!"kk*Y*?@}$'8-8DM--/!%!2!2((%)>
K  s++r$   c                    | j                         }| j                  |_        | j                  d|i      }| j	                  ||      S )Nr   )r   r}   r   r   r   )r7   r   r2   r   s       r%   r   z"_OIDCAuthenticator._sasl_start_jwtJ  sF    --/!%!2!2%%ul&;<  s++r$   c                x    || j                   }|rd|i}ni }t        t        j                  |            }dd|dS )NnrK   zMONGODB-OIDC)	saslStart	mechanismr   )r*   r   r   encode)r7   r   rW   bin_payloads       r%   r   z%_OIDCAuthenticator._get_start_commandP  sB    ?!]]N/T[[12^TTr$   c                P    t        t        j                  |            }d||d   dS )NrK   conversationId)saslContinuer   r   )r   r   r   )r7   r   r   r   s       r%   r   z(_OIDCAuthenticator._get_continue_commandZ  s0     T[[12"()9:
 	
r$   )r   r   r;   Optional[Mapping[str, Any]])r;   z"Optional[MutableMapping[str, Any]])r   r   r;   Mapping[str, Any])r;   r   )r   r   r   MutableMapping[str, Any]r;   r   )r   	Exceptionr;   bool)r   r   r;   rv   )r   r   r   r   r;   r   )r   r   r;   r   )r   r   r   r   r;   r   )r   r    r!   r"   r   r-   r2   r/   r}   	threadingLockr~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r$   r%   rM   rM      s    M#(#6M=6"'"5L-5&+D&9H#9a(L#( @D.@!!,NE,..$C*9B6!p8
!,,,=,	,,U
(
6G
	!
r$   c                v    t        | |j                        }|r|j                  |      S |j                  |      S )z Authenticate using MONGODB-OIDC.)rZ   rV   r   r   )rU   r   r   authenticators       r%   _authenticate_oidcr   e  s9     '{DLLAM++D11))$//r$   )rU   r   rV   ztuple[str, int]r;   rM   )rU   r   r   r   r   r   r;   r   )6r<   
__future__r   r=   r`   r   r   dataclassesr   r   typingr   r   r   r	   r
   r   urllib.parser   r   bson.binaryr   pymongo._azure_helpersr   pymongo._csotr   pymongo._gcp_helpersr   pymongo.errorsr   r   pymongo.helpersr   pymongo.authr   pymongo.poolr   r   r'   r1   ABCr5   r@   TOKEN_BUFFER_MINUTESr   r   r   r   rZ   r\   rj   ry   rM   r   r#   r$   r%   <module>r      sa   + " 
 	   ( O O    6 # 2 ? 8,' = = = : : : 7 7 7>377 >    < !'  #%    " "+:"":G G
 
E| E L
 L
 L
^0 0(20DH0 0r$   