o
    h@                     @  st  U d Z ddlmZ ddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZmZmZmZ dd	lmZmZ dd
lmZ ddl m!Z! ddl"m#Z#m$Z$ ddl%m&Z& er{ddl'm(Z( ddl)m*Z* dZ+dZ,zddl-Z.e/e0e1e.j23ddd dkrdZ,W n e4y   zddl.Z.W n e4y   dZ+Y nw Y nw dZ5dHddZ6dId!d"Z7dJd$d%Z8dKd)d*Z9dLd+d,Z:dLd-d.Z;dLd/d0Z<dLd1d2Z=e:e<e!e#e;ej>e6d3d4ej>e6d5d4e=d6Z?d7e@d8< G d9d: d:ZAG d;d< d<eAZBG d=d> d>eAZCG d?d@ d@eAZDeCej>eBd3d4ej>eBd5d4eDej>eBd5d4dAZEdBe@dC< 	dMdNdFdGZFdS )OzAuthentication helpers.    )annotationsN)standard_b64decodestandard_b64encode)TYPE_CHECKINGAnyCallableMappingMutableMappingOptionalcast)quote)Binary)MongoCredential_authenticate_scram_start_parse_scram_response_xor)ConfigurationErrorOperationFailure)saslprep)_authenticate_aws)_authenticate_oidc_get_authenticator)_getaddrinfo)Hello)
ConnectionTF.   )r      credentialsr   connr   	mechanismstrreturnNonec                  C  sx  | j }|dkrd}tj}t| jd}nd}tj}t|| jd}| j}| j	}t
j}	|j}
|
rL|
 rLt|
ts<J |
jdusCJ |
j\}}|
j}nt| |\}}}|||}|dus`J |d }t|}t|d }|dk rvtd	|d
 }|d }||stdd| }|jr|j\}}}}nd\}}}}|r||ks||krt||t||}|	|d| }|	|d| }||||f|_|| }d|||f}|	||| }dtt|| }d||f}t|	||| }d|d t|d}|||}t|d }t
 |d |std|d s8d|d tdd}|||}|d s:tddS dS )zAuthenticate using SCRAM.SCRAM-SHA-256sha256utf-8sha1Npayload   ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Key   ,s   p=   conversationIdZsaslContinuer.   r(      vz%Server returned an invalid signature.done    z%SASL conversation failed to complete.)!usernamehashlibr%   r   passwordencoder'   _password_digestsourcecachehmacHMACauth_ctxspeculate_succeeded
isinstance_ScramContext
scram_dataspeculative_authenticater   commandr   intr   
startswithdatapbkdf2_hmacr   digestjoinr   r   r   compare_digest) r   r   r    r3   rG   	digestmodrE   r8   r9   _hmacctxnonce
first_barerescmdZserver_firstparsedZ
iterationssaltZrnonceZwithout_proofZ
client_keyZ
server_keyZcsaltZciterationsZsalted_passZ
stored_keyZauth_msgZ
client_sigZclient_proofZclient_finalZ
server_sig rS   K/var/www/html/venv/lib/python3.10/site-packages/pymongo/synchronous/auth.py_authenticate_scramG   s|   



rU   r3   r5   c                 C  sp   t |ts	tdt|dkrtdt | ts!tdt|  t }|  d| }||	d |
 S )z0Get a password digest to use for authentication.z#password must be an instance of strr   zpassword can't be emptyz)username must be an instance of str, not z:mongo:r&   )r>   r!   	TypeErrorlen
ValueErrortyper4   md5updater6   	hexdigest)r3   r5   md5hashrE   rS   rS   rT   r7      s   

r7   rM   c                 C  s:   t ||}t }|  | | }||d | S )z*Get an auth key to use for authentication.r&   )r7   r4   rZ   r[   r6   r\   )rM   r3   r5   rG   r]   rE   rS   rS   rT   	_auth_key   s
   
r^   hostnameoption
str | boolc                 C  s~   |dv r| S t | dddtjtjdd \}}}}}|dkr!| S z	t|tj}W n tjy8   |  Y S w |d  S )z2Canonicalize hostname following MIT-krb5 behavior.)FnoneNr   )familyrY   protoflagsforward)r   socketIPPROTO_TCPAI_CANONNAMElowergetnameinfoNI_NAMEREQDgaierror)r_   r`   afsocktyperd   	canonnameZsockaddrnamerS   rS   rT   _canonicalize_hostname   s(   rr   c              
   C  sb  t stdz| j}| j}| j}|jp|jd }t||j}|j	d | }|j
dur2|d |j
 }|durotrOdt|t|f}tj||tjd\}}	n*d|v r\|dd\}
}n|d}
}tj|tj|
||d\}}	n
tj|tjd\}}	|tjkrtd	zt|	d
dkrtdt|	}dd|dd}|d|}tdD ]0}t|	t|d }|dkrtdt|	pd
}d|d |d}|d|}|tjkr nqtdt|	t|d dkrtdt|	t|	|dkrtdt|	}d|d |d}|d| W t|	 W dS t|	 w  tjy0 } ztt|dd}~ww )zAuthenticate using GSSAPI.zEThe "kerberos" module must be installed to use GSSAPI authentication.r   @N:)gssflagsr-   )ru   userdomainr5   z&Kerberos context failed to initialize. z*Unknown kerberos failure in step function.GSSAPIZ	saslStartr    r(   ZautoAuthorize	$external
   r(   r.   r/   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)HAVE_KERBEROSr   r3   r5   Zmechanism_propertiesZservice_hostaddressrr   Zcanonicalize_host_nameservice_nameZservice_realm_USE_PRINCIPALrH   r   kerberosZauthGSSClientInitZGSS_C_MUTUAL_FLAGsplitZAUTH_GSS_COMPLETEr   ZauthGSSClientStepZauthGSSClientResponserB   ranger!   ZauthGSSClientUnwrapZauthGSSClientWrapZauthGSSClientCleanZKrbError)r   r   r3   r5   propshostZserviceZ	principalresultrL   rv   rw   r(   rP   response_excrS   rS   rT   _authenticate_gssapi   s   





r   c                 C  sH   | j }| j}| j}d| d|  }ddt|dd}||| dS )z(Authenticate using SASL PLAIN (RFC 4616) r-   PLAINrz   N)r8   r3   r5   r6   r   rB   )r   r   r8   r3   r5   r(   rP   rS   rS   rT   _authenticate_plain=  s   r   c                 C  s6   |j }|r| rdS t| |j }|d| dS )z Authenticate using MONGODB-X509.Nr{   )r<   r=   _X509Contextr   speculate_commandrB   )r   r   rL   rP   rS   rS   rT   _authenticate_x509L  s
   r   c                 C  s|   |j dkr8|jr|j}n| j}| }|d | j |d< |j||dddg }d|v r2t| |dS t| |dS t| |dS )N   r   ZsaslSupportedMechsF)Zpublish_eventsr$   SCRAM-SHA-1)Zmax_wire_versionZnegotiated_mechsr8   Z	hello_cmdr3   rB   getrU   )r   r   Zmechsr8   rP   rS   rS   rT   _authenticate_defaultW  s   
r   r   )r    r$   )ry   MONGODB-X509zMONGODB-AWSMONGODB-OIDCr   r   r$   DEFAULTz!Mapping[str, Callable[..., None]]	_AUTH_MAPc                   @  sB   e Zd ZdddZedddZdddZdddZdddZdS )_AuthContextr   r   r   tuple[str, int]r"   r#   c                 C  s   || _ d | _|| _d S N)r   rA   r   )selfr   r   rS   rS   rT   __init__u  s   
z_AuthContext.__init__credsOptional[_AuthContext]c                 C  s$   t | j}|rtt|| |S d S r   )_SPECULATIVE_AUTH_MAPr   r    r   r   )r   r   Zspec_clsrS   rS   rT   from_credentialsz  s   z_AuthContext.from_credentials"Optional[MutableMapping[str, Any]]c                 C  s   t r   )NotImplementedErrorr   rS   rS   rT   r     s   z_AuthContext.speculate_commandhelloHello[Mapping[str, Any]]c                 C  s   |j | _ d S r   )rA   )r   r   rS   rS   rT   parse_response  s   z_AuthContext.parse_responseboolc                 C  s
   t | jS r   )r   rA   r   rS   rS   rT   r=     s   
z _AuthContext.speculate_succeededN)r   r   r   r   r"   r#   )r   r   r   r   r"   r   r"   r   )r   r   r"   r#   )r"   r   )	__name__
__module____qualname__r   staticmethodr   r   r   r=   rS   rS   rS   rT   r   t  s    


r   c                      s(   e Zd Zd fd	d
ZdddZ  ZS )r?   r   r   r   r   r    r!   r"   r#   c                   s   t  || d | _|| _d S r   )superr   r@   r    )r   r   r   r    	__class__rS   rT   r     s   
z_ScramContext.__init__r   c                 C  s.   t | j| j\}}}| jj|d< ||f| _|S Ndb)r   r   r    r8   r@   )r   rM   rN   rP   rS   rS   rT   r     s   
z_ScramContext.speculate_command)r   r   r   r   r    r!   r"   r#   r   )r   r   r   r   r   __classcell__rS   rS   r   rT   r?     s    r?   c                   @     e Zd ZdddZdS )r   r"   MutableMapping[str, Any]c                 C  s&   ddd}| j jd ur| j j|d< |S )Nr-   r   )authenticater    rv   )r   r3   )r   rP   rS   rS   rT   r     s   
z_X509Context.speculate_commandN)r"   r   r   r   r   r   rS   rS   rS   rT   r         r   c                   @  r   )_OIDCContextr"   r   c                 C  s2   t | j| j}| }|d u rd S | jj|d< |S r   )r   r   r   Zget_spec_auth_cmdr8   )r   ZauthenticatorrP   rS   rS   rT   r     s   z_OIDCContext.speculate_commandNr   r   rS   rS   rS   rT   r     r   r   )r   r   r$   r   r   zMapping[str, Any]r   reauthenticater   c                 C  s4   | j }t| }|dkrt| || dS || | dS )zAuthenticate connection.r   N)r    r   r   )r   r   r   r    Z	auth_funcrS   rS   rT   r     s
   r   )r   r   r   r   r    r!   r"   r#   )r3   r!   r5   r!   r"   r!   )rM   r!   r3   r!   r5   r!   r"   r!   )r_   r!   r`   ra   r"   r!   )r   r   r   r   r"   r#   )F)r   r   r   r   r   r   r"   r#   )G__doc__
__future__r   	functoolsr4   r:   rg   base64r   r   typingr   r   r   r   r	   r
   r   urllib.parser   Zbson.binaryr   Zpymongo.auth_sharedr   r   r   r   Zpymongo.errorsr   r   Zpymongo.saslprepr   Zpymongo.synchronous.auth_awsr   Zpymongo.synchronous.auth_oidcr   r   Zpymongo.synchronous.helpersr   Zpymongo.hellor   Zpymongo.synchronous.poolr   r~   r   Zwinkerberosr   tuplemaprC   __version__r   ImportErrorZ_IS_SYNCrU   r7   r^   rr   r   r   r   r   partialr   __annotations__r   r?   r   r   r   r   rS   rS   rS   rT   <module>   s   $	"

S

	

n


