o
    'hv.                     @  s  d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	m
Z
mZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lmZm Z  dd
l!m"Z" e	rjddl#m$Z$ ddl%m&Z& dZ'dddZ(eG dd dZ)dddZ*dS ) z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)AsyncConnection)MongoCredentialFcredentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                 C  s   | j jr| j jS | j}| j}|jd urFd}|j}|D ]}||d kr%d}q|dr7|d |dd  r7d}q|sFtd|d  d| t	||d| j _| j jS )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar!   mechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r   )r   r   principal_namer"   foundr'   patt r-   Z/var/www/html/olx_land/venv/lib/python3.10/site-packages/pymongo/asynchronous/auth_oidc.py_get_authenticator/   s&   
 r/   c                   @  s  e Zd ZU ded< ded< eddZded< eddZded	< eddZd
ed< eddZded< ee	j
dZded< eddZded< d<ddZd<ddZd=ddZd>d d!Zd<d"d#Zd?d$d%Zd@d(d)ZdAd-d.ZdBd0d1ZdCd3d4Zd>d5d6ZdDd8d9ZdEd:d;ZdS )Fr   strr!   r   r"   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryzthreading.Locklockfloatlast_call_timeconnr   r   Optional[Mapping[str, Any]]c                   s4   |  | | jjr| |I dH S | |I dH S )z(Handle a reauthenticate from the server.N)_invalidater"   callback_authenticate_machine_authenticate_human)selfr<   r-   r-   r.   reauthenticateW   s
   
z!_OIDCAuthenticator.reauthenticatec                   sZ   |j }|r| r|j}|r|d r| j|_|S | jjr%| |I dH S | |I dH S )z'Handle an initial authenticate request.doneN)	auth_ctxspeculate_succeededspeculative_authenticater7   oidc_token_gen_idr"   r?   r@   rA   )rB   r<   ctxrespr-   r-   r.   authenticate`   s   z_OIDCAuthenticator.authenticate"Optional[MutableMapping[str, Any]]c                 C  s   | j sdS | d| j iS )z-Get the appropriate speculative auth command.Njwt)r4   _get_start_command)rB   r-   r-   r.   get_spec_auth_cmdr   s   z$_OIDCAuthenticator.get_spec_auth_cmdMapping[str, Any]c              
     sl   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | |I d H S N)r4   _sasl_start_jwtr   _is_auth_errorr@   )rB   r<   er-   r-   r.   r@   x   s   
z(_OIDCAuthenticator._authenticate_machinec              
     s   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | jr^z	| |I d H W S  ty] } z| |rXd | _| |I d H W  Y d }~S  d }~ww | d }| ||I d H }| ||I d H S rQ   )	r4   rR   r   rS   rA   r3   rN   _run_command_sasl_continue_jwt)rB   r<   rT   cmd
start_respr-   r-   r.   rA      s.   
	

z&_OIDCAuthenticator._authenticate_humanc           
      C  sf  | j }|jd u}|r| jd u rd S |jr|j}|jr|j}| j}|r$|S |d u r,|s,d S |s|d ur| js | j}||krF|W  d    S t | j }|tk rXt	t|  t | _|rit
}| jd ushJ ntt pnt}t|t| j| j| j jd}||}	t|	tstdt|	 |	j| _|	j| _|  jd7  _W d    | jS 1 sw   Y  | jS )N)timeout_secondsversionr3   r5   r!   z8Callback result must be of type OIDCCallbackResult, not r    )r"   r&   r5   r?   r4   r9   timer;   r   sleepr   r6   r   r   r   r   r3   r!   fetch
isinstancer   
ValueErrortyper7   )
rB   r"   is_humancb
prev_token	new_tokendeltatimeoutcontextrJ   r-   r-   r.   _get_access_token   s\   




""z$_OIDCAuthenticator._get_access_tokenrW   MutableMapping[str, Any]c              
     sJ   z|j d|ddI d H W S  ty$ } z| |r| |  d }~ww )Nz	$externalT)	no_reauth)commandr   rS   r>   )rB   r<   rW   rT   r-   r-   r.   rU      s   

z_OIDCAuthenticator._run_commanderr	Exceptionboolc                 C  s   t |tsdS |jtkS )NF)r^   r   coder   )rB   rl   r-   r-   r.   rS      s   

z!_OIDCAuthenticator._is_auth_errorNonec                 C  s*   |j pd}|d ur|| jk rd S d | _d S )Nr   )rH   r7   r4   )rB   r<   r7   r-   r-   r.   r>      s   

z_OIDCAuthenticator._invalidaterX   c                   sf   d | _ d | _t|d }d|v rtdi || _|  }| j|_| 	d|i|}| 
||I d H S )NpayloadissuerrM   r-   )r4   r3   bsondecoder   r5   rh   r7   rH   _get_continue_commandrU   )rB   r<   rX   start_payloadr4   rW   r-   r-   r.   rV      s   z%_OIDCAuthenticator._sasl_continue_jwtc                   s2   |   }| j|_| d|i}| ||I d H S )NrM   )rh   r7   rH   rN   rU   )rB   r<   r4   rW   r-   r-   r.   rR     s
   z"_OIDCAuthenticator._sasl_start_jwtrq   c                 C  s:   |d u r| j }|rd|i}ni }tt|}dd|dS )Nnr    zMONGODB-OIDC)	saslStart	mechanismrq   )r!   r   rs   encode)rB   rq   r*   bin_payloadr-   r-   r.   rN     s   
z%_OIDCAuthenticator._get_start_commandc                 C  s   t t|}d||d dS )Nr    conversationId)saslContinuerq   r|   )r   rs   rz   )rB   rq   rX   r{   r-   r-   r.   ru     s
   z(_OIDCAuthenticator._get_continue_command)r<   r   r   r=   )r   rL   )r<   r   r   rP   )r   r2   )r<   r   rW   ri   r   rP   )rl   rm   r   rn   )r<   r   r   rp   )r<   r   rX   rP   r   rP   )rq   r=   r   ri   )rq   rP   rX   rP   r   ri   )__name__
__module____qualname____annotations__r   r3   r4   r5   r7   	threadingLockr9   r;   rC   rK   rO   r@   rA   rh   rU   rS   r>   rV   rR   rN   ru   r-   r-   r-   r.   r   L   s,   
 

	



!
:






r<   r   rC   rn   r=   c                   s2   t | |j}|r||I dH S ||I dH S )z Authenticate using MONGODB-OIDC.N)r/   r   rC   rK   )r   r<   rC   authenticatorr-   r-   r.   _authenticate_oidc   s
   r   )r   r   r   r   r   r   )r   r   r<   r   rC   rn   r   r=   )+__doc__
__future__r   r   r[   dataclassesr   r   typingr   r   r   r   r	   r
   rs   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.asynchronous.poolr   pymongo.auth_sharedr   _IS_SYNCr/   r   r   r-   r-   r-   r.   <module>   s*    ,
 T