o
    hv.                     @  s  d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	m
Z
mZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lmZm Z  dd
l!m"Z" e	rjddl#m$Z$ ddl%m&Z& dZ'dddZ(eG dd dZ)dddZ*dS ) z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)AsyncConnection)MongoCredentialFcredentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                 C  s   | j jr| j jS | j}| j}|jd urFd}|j}|D ]}||d kr%d}q|dr7|d |dd  r7d}q|sFtd|d  d| t	||d| j _| j jS )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar!   Zmechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r   )r   r   principal_namer"   foundr&   patt r,   Q/var/www/html/venv/lib/python3.10/site-packages/pymongo/asynchronous/auth_oidc.py_get_authenticator/   s&   
 r.   c                   @  s  e Zd ZU ded< ded< eddZded< eddZded	< eddZd
ed< eddZded< ee	j
dZded< eddZded< d<ddZd<ddZd=ddZd>d d!Zd<d"d#Zd?d$d%Zd@d(d)ZdAd-d.ZdBd0d1ZdCd3d4Zd>d5d6ZdDd8d9ZdEd:d;ZdS )Fr   strr!   r   r"   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryzthreading.Locklockfloatlast_call_timeconnr   r   Optional[Mapping[str, Any]]c                   s4   |  | | jjr| |I dH S | |I dH S )z(Handle a reauthenticate from the server.N)_invalidater"   callback_authenticate_machine_authenticate_human)selfr;   r,   r,   r-   reauthenticateW   s
   
z!_OIDCAuthenticator.reauthenticatec                   sZ   |j }|r| r|j}|r|d r| j|_|S | jjr%| |I dH S | |I dH S )z'Handle an initial authenticate request.doneN)	Zauth_ctxZspeculate_succeededZspeculative_authenticater6   oidc_token_gen_idr"   r>   r?   r@   )rA   r;   ctxrespr,   r,   r-   authenticate`   s   z_OIDCAuthenticator.authenticate"Optional[MutableMapping[str, Any]]c                 C  s   | j sdS | d| j iS )z-Get the appropriate speculative auth command.Njwt)r3   _get_start_command)rA   r,   r,   r-   get_spec_auth_cmdr   s   z$_OIDCAuthenticator.get_spec_auth_cmdMapping[str, Any]c              
     sl   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | |I d H S N)r3   _sasl_start_jwtr   _is_auth_errorr?   )rA   r;   er,   r,   r-   r?   x   s   
z(_OIDCAuthenticator._authenticate_machinec              
     s   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | jr^z	| |I d H W S  ty] } z| |rXd | _| |I d H W  Y d }~S  d }~ww | d }| ||I d H }| ||I d H S rM   )	r3   rN   r   rO   r@   r2   rJ   _run_command_sasl_continue_jwt)rA   r;   rP   cmd
start_respr,   r,   r-   r@      s.   
	

z&_OIDCAuthenticator._authenticate_humanc           
      C  sf  | j }|jd u}|r| jd u rd S |jr|j}|jr|j}| j}|r$|S |d u r,|s,d S |s|d ur| js | j}||krF|W  d    S t | j }|tk rXt	t|  t | _|rit
}| jd ushJ ntt pnt}t|t| j| j| j jd}||}	t|	tstdt|	 |	j| _|	j| _|  jd7  _W d    | jS 1 sw   Y  | jS )N)Ztimeout_secondsversionr2   r4   r!   z8Callback result must be of type OIDCCallbackResult, not r    )r"   r%   r4   r>   r3   r8   timer:   r   sleepr   r5   r   r   r   r   r2   r!   fetch
isinstancer   
ValueErrortyper6   )
rA   r"   Zis_humancbZ
prev_tokenZ	new_tokendeltatimeoutcontextrF   r,   r,   r-   _get_access_token   s\   




""z$_OIDCAuthenticator._get_access_tokenrS   MutableMapping[str, Any]c              
     sJ   z|j d|ddI d H W S  ty$ } z| |r| |  d }~ww )Nz	$externalT)Z	no_reauth)commandr   rO   r=   )rA   r;   rS   rP   r,   r,   r-   rQ      s   

z_OIDCAuthenticator._run_commanderr	Exceptionboolc                 C  s   t |tsdS |jtkS )NF)rY   r   coder   )rA   rc   r,   r,   r-   rO      s   

z!_OIDCAuthenticator._is_auth_errorNonec                 C  s*   |j pd}|d ur|| jk rd S d | _d S )Nr   )rD   r6   r3   )rA   r;   r6   r,   r,   r-   r=      s   

z_OIDCAuthenticator._invalidaterT   c                   sf   d | _ d | _t|d }d|v rtdi || _|  }| j|_| 	d|i|}| 
||I d H S )NpayloadZissuerrI   r,   )r3   r2   bsondecoder   r4   r`   r6   rD   _get_continue_commandrQ   )rA   r;   rT   Zstart_payloadr3   rS   r,   r,   r-   rR      s   z%_OIDCAuthenticator._sasl_continue_jwtc                   s2   |   }| j|_| d|i}| ||I d H S )NrI   )r`   r6   rD   rJ   rQ   )rA   r;   r3   rS   r,   r,   r-   rN     s
   z"_OIDCAuthenticator._sasl_start_jwtrh   c                 C  s:   |d u r| j }|rd|i}ni }tt|}dd|dS )Nnr    zMONGODB-OIDC)Z	saslStartZ	mechanismrh   )r!   r   ri   encode)rA   rh   r)   bin_payloadr,   r,   r-   rJ     s   
z%_OIDCAuthenticator._get_start_commandc                 C  s   t t|}d||d dS )Nr    conversationId)ZsaslContinuerh   ro   )r   ri   rm   )rA   rh   rT   rn   r,   r,   r-   rk     s
   z(_OIDCAuthenticator._get_continue_command)r;   r   r   r<   )r   rH   )r;   r   r   rL   )r   r1   )r;   r   rS   ra   r   rL   )rc   rd   r   re   )r;   r   r   rg   )r;   r   rT   rL   r   rL   )rh   r<   r   ra   )rh   rL   rT   rL   r   ra   )__name__
__module____qualname____annotations__r   r2   r3   r4   r6   	threadingLockr8   r:   rB   rG   rK   r?   r@   r`   rQ   rO   r=   rR   rN   rJ   rk   r,   r,   r,   r-   r   L   s,   
 

	



!
:






r;   r   rB   re   r<   c                   s2   t | |j}|r||I dH S ||I dH S )z Authenticate using MONGODB-OIDC.N)r.   r   rB   rG   )r   r;   rB   Zauthenticatorr,   r,   r-   _authenticate_oidc   s
   rv   )r   r   r   r   r   r   )r   r   r;   r   rB   re   r   r<   )+__doc__
__future__r   rt   rV   dataclassesr   r   typingr   r   r   r   r	   r
   ri   Zbson.binaryr   Zpymongo._csotr   Zpymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   Zpymongo.errorsr   r   Zpymongo.helpers_sharedr   Zpymongo.asynchronous.poolr   Zpymongo.auth_sharedr   Z_IS_SYNCr.   r   rv   r,   r,   r,   r-   <module>   s*    ,
 T