o
    hA                     @  sx  U d Z ddlmZ ddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZ dd	lmZmZ dd
lmZ ddlmZm Z m!Z!m"Z" ddl#m$Z$m%Z% ddl&m'Z' er}ddl(m)Z) ddl*m+Z+ dZ,dZ-zddl.Z/e0e1e2e/j34ddd dkrdZ-W n e5y   zddl/Z/W n e5y   dZ,Y nw Y nw dZ6dHddZ7dId!d"Z8dJd$d%Z9dKd)d*Z:dLd+d,Z;dLd-d.Z<dLd/d0Z=dLd1d2Z>e;e=eee<ej?e7d3d4ej?e7d5d4e>d6Z@d7eAd8< G d9d: d:ZBG d;d< d<eBZCG d=d> d>eBZDG d?d@ d@eBZEeDej?eCd3d4ej?eCd5d4eEej?eCd5d4dAZFdBeAdC< 	dMdNdFdGZGdS )OzAuthentication helpers.    )annotationsN)standard_b64decodestandard_b64encode)TYPE_CHECKINGAnyCallable	CoroutineMappingMutableMappingOptionalcast)quote)Binary)_authenticate_aws)_authenticate_oidc_get_authenticator)_getaddrinfo)MongoCredential_authenticate_scram_start_parse_scram_response_xor)ConfigurationErrorOperationFailure)saslprep)AsyncConnection)HelloTF.   )r      credentialsr   connr   	mechanismstrreturnNonec                    s  | j }|dkrd}tj}t| jd}nd}tj}t|| jd}| j}| j	}t
j}	|j}
|
rM|
 rMt|
ts=J |
jdusDJ |
j\}}|
j}nt| |\}}}|||I dH }|dusdJ |d }t|}t|d }|dk rztd	|d
 }|d }||stdd| }|jr|j\}}}}nd\}}}}|r||ks||krt||t||}|	|d| }|	|d| }||||f|_|| }d|||f}|	||| }dtt|| }d||f}t|	||| }d|d t|d}|||I dH }t|d }t
 |d |s!td|d sBd|d tdd}|||I dH }|d sDtddS dS )zAuthenticate using SCRAM.SCRAM-SHA-256sha256utf-8sha1Npayload   ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Key   ,s   p=   conversationIdZsaslContinuer/   r)      vz%Server returned an invalid signature.done    z%SASL conversation failed to complete.)!usernamehashlibr&   r   passwordencoder(   _password_digestsourcecachehmacHMACauth_ctxspeculate_succeeded
isinstance_ScramContext
scram_dataspeculative_authenticater   commandr   intr   
startswithdatapbkdf2_hmacr   digestjoinr   r   r   compare_digest) r   r    r!   r4   rH   	digestmodrF   r9   r:   _hmacctxnonce
first_barerescmdZserver_firstparsedZ
iterationssaltZrnonceZwithout_proofZ
client_keyZ
server_keyZcsaltZciterationsZsalted_passZ
stored_keyZauth_msgZ
client_sigZclient_proofZclient_finalZ
server_sig rT   L/var/www/html/venv/lib/python3.10/site-packages/pymongo/asynchronous/auth.py_authenticate_scramH   s~   



rV   r4   r6   c                 C  sp   t |ts	tdt|dkrtdt | ts!tdt|  t }|  d| }||	d |
 S )z0Get a password digest to use for authentication.z#password must be an instance of strr   zpassword can't be emptyz)username must be an instance of str, not z:mongo:r'   )r?   r"   	TypeErrorlen
ValueErrortyper5   md5updater7   	hexdigest)r4   r6   md5hashrF   rT   rT   rU   r8      s   

r8   rN   c                 C  s:   t ||}t }|  | | }||d | S )z*Get an auth key to use for authentication.r'   )r8   r5   r[   r\   r7   r]   )rN   r4   r6   rH   r^   rF   rT   rT   rU   	_auth_key   s
   
r_   hostnameoption
str | boolc                   s   |dv r| S t | dddtjtjdI dH d \}}}}}|dkr%| S z	t|tj}W n tjy<   |  Y S w |d  S )z2Canonicalize hostname following MIT-krb5 behavior.)FnoneNr   )familyrZ   protoflagsforward)r   socketIPPROTO_TCPAI_CANONNAMElowergetnameinfoNI_NAMEREQDgaierror)r`   ra   afsocktypere   	canonnameZsockaddrnamerT   rT   rU   _canonicalize_hostname   s*   
rs   c              
     s~  t stdz!| j}| j}| j}|jp|jd }t||jI dH }|j	d | }|j
dur6|d |j
 }|durstrSdt|t|f}tj||tjd\}}	n*d|v r`|dd\}
}n|d}
}tj|tj|
||d\}}	n
tj|tjd\}}	|tjkrtd	zt|	d
dkrtdt|	}dd|dd}|d|I dH }tdD ]3}t|	t|d }|dkrtdt|	pd
}d|d |d}|d|I dH }|tjkr nqtdt|	t|d dkrtdt|	t|	|dkrtdt|	}d|d |d}|d|I dH  W t|	 W dS t|	 w  tjy> } ztt|dd}~ww )zAuthenticate using GSSAPI.zEThe "kerberos" module must be installed to use GSSAPI authentication.r   N@:)gssflagsr.   )rv   userdomainr6   z&Kerberos context failed to initialize. z*Unknown kerberos failure in step function.GSSAPIZ	saslStartr!   r)   ZautoAuthorize	$external
   r)   r/   r0   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)HAVE_KERBEROSr   r4   r6   Zmechanism_propertiesZservice_hostaddressrs   Zcanonicalize_host_nameservice_nameZservice_realm_USE_PRINCIPALrI   r   kerberosZauthGSSClientInitZGSS_C_MUTUAL_FLAGsplitZAUTH_GSS_COMPLETEr   ZauthGSSClientStepZauthGSSClientResponserC   ranger"   ZauthGSSClientUnwrapZauthGSSClientWrapZauthGSSClientCleanZKrbError)r   r    r4   r6   propshostZserviceZ	principalresultrM   rw   rx   r)   rQ   response_excrT   rT   rU   _authenticate_gssapi   s   





r   c                   sP   | j }| j}| j}d| d|  }ddt|dd}|||I dH  dS )z(Authenticate using SASL PLAIN (RFC 4616) r.   PLAINr{   N)r9   r4   r6   r7   r   rC   )r   r    r9   r4   r6   r)   rQ   rT   rT   rU   _authenticate_plain@  s   r   c                   s>   |j }|r| rdS t| |j }|d|I dH  dS )z Authenticate using MONGODB-X509.Nr|   )r=   r>   _X509Contextr   speculate_commandrC   )r   r    rM   rQ   rT   rT   rU   _authenticate_x509O  s   r   c                   s   |j dkrB|jr|j}n| j}| }|d | j |d< |j||ddI d H dg }d|v r9t| |dI d H S t| |dI d H S t| |dI d H S )N   r   ZsaslSupportedMechsF)Zpublish_eventsr%   SCRAM-SHA-1)Zmax_wire_versionZnegotiated_mechsr9   Z	hello_cmdr4   rC   getrV   )r   r    Zmechsr9   rQ   rT   rT   rU   _authenticate_defaultZ  s   
r   r   )r!   r%   )rz   MONGODB-X509zMONGODB-AWSMONGODB-OIDCr   r   r%   DEFAULTz6Mapping[str, Callable[..., Coroutine[Any, Any, None]]]	_AUTH_MAPc                   @  sB   e Zd ZdddZedddZdddZdddZdddZdS )_AuthContextr   r   r   tuple[str, int]r#   r$   c                 C  s   || _ d | _|| _d S N)r   rB   r   )selfr   r   rT   rT   rU   __init__z  s   
z_AuthContext.__init__credsOptional[_AuthContext]c                 C  s$   t | j}|rtt|| |S d S r   )_SPECULATIVE_AUTH_MAPr   r!   r   r   )r   r   Zspec_clsrT   rT   rU   from_credentials  s   z_AuthContext.from_credentials"Optional[MutableMapping[str, Any]]c                 C  s   t r   )NotImplementedErrorr   rT   rT   rU   r     s   z_AuthContext.speculate_commandhelloHello[Mapping[str, Any]]c                 C  s   |j | _ d S r   )rB   )r   r   rT   rT   rU   parse_response  s   z_AuthContext.parse_responseboolc                 C  s
   t | jS r   )r   rB   r   rT   rT   rU   r>     s   
z _AuthContext.speculate_succeededN)r   r   r   r   r#   r$   )r   r   r   r   r#   r   r#   r   )r   r   r#   r$   )r#   r   )	__name__
__module____qualname__r   staticmethodr   r   r   r>   rT   rT   rT   rU   r   y  s    


r   c                      s(   e Zd Zd fd	d
ZdddZ  ZS )r@   r   r   r   r   r!   r"   r#   r$   c                   s   t  || d | _|| _d S r   )superr   rA   r!   )r   r   r   r!   	__class__rT   rU   r     s   
z_ScramContext.__init__r   c                 C  s.   t | j| j\}}}| jj|d< ||f| _|S Ndb)r   r   r!   r9   rA   )r   rN   rO   rQ   rT   rT   rU   r     s   
z_ScramContext.speculate_command)r   r   r   r   r!   r"   r#   r$   r   )r   r   r   r   r   __classcell__rT   rT   r   rU   r@     s    r@   c                   @     e Zd ZdddZdS )r   r#   MutableMapping[str, Any]c                 C  s&   ddd}| j jd ur| j j|d< |S )Nr.   r   )authenticater!   rw   )r   r4   )r   rQ   rT   rT   rU   r     s   
z_X509Context.speculate_commandN)r#   r   r   r   r   r   rT   rT   rT   rU   r         r   c                   @  r   )_OIDCContextr#   r   c                 C  s2   t | j| j}| }|d u rd S | jj|d< |S r   )r   r   r   Zget_spec_auth_cmdr9   )r   ZauthenticatorrQ   rT   rT   rU   r     s   z_OIDCContext.speculate_commandNr   r   rT   rT   rT   rU   r     r   r   )r   r   r%   r   r   zMapping[str, Any]r   reauthenticater   c                   sB   | j }t| }|dkrt| ||I dH  dS || |I dH  dS )zAuthenticate connection.r   N)r!   r   r   )r   r    r   r!   Z	auth_funcrT   rT   rU   r     s   r   )r   r   r    r   r!   r"   r#   r$   )r4   r"   r6   r"   r#   r"   )rN   r"   r4   r"   r6   r"   r#   r"   )r`   r"   ra   rb   r#   r"   )r   r   r    r   r#   r$   )F)r   r   r    r   r   r   r#   r$   )H__doc__
__future__r   	functoolsr5   r;   rh   base64r   r   typingr   r   r   r   r	   r
   r   r   urllib.parser   Zbson.binaryr   Zpymongo.asynchronous.auth_awsr   Zpymongo.asynchronous.auth_oidcr   r   Zpymongo.asynchronous.helpersr   Zpymongo.auth_sharedr   r   r   r   Zpymongo.errorsr   r   Zpymongo.saslprepr   Zpymongo.asynchronous.poolr   Zpymongo.hellor   r   r   Zwinkerberosr   tuplemaprD   __version__r   ImportErrorZ_IS_SYNCrV   r8   r_   rs   r   r   r   r   partialr   __annotations__r   r@   r   r   r   r   rT   rT   rT   rU   <module>   s   (
"

U

	

n


