Ë
    Ü_Ëie0  ã                  ó>  — d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lm Z m!Z! dd
l"m#Z# ddl$m%Z%m&Z& e
rddl'm(Z( ddl)m*Z* dZ+	 	 	 	 	 	 dd„Z,e G d„ d«      «       Z-	 	 	 	 	 	 	 	 dd„Z.y)z$MONGODB-OIDC Authentication helpers.é    )ÚannotationsN)Ú	dataclassÚfield)ÚTYPE_CHECKINGÚAnyÚMappingÚMutableMappingÚOptionalÚUnion)ÚBinary)Ú	remaining)	ÚCALLBACK_VERSIONÚHUMAN_CALLBACK_TIMEOUT_SECONDSÚ MACHINE_CALLBACK_TIMEOUT_SECONDSÚTIME_BETWEEN_CALLS_SECONDSÚOIDCCallbackÚOIDCCallbackContextÚOIDCCallbackResultÚOIDCIdPInfoÚ_OIDCProperties)ÚConfigurationErrorÚOperationFailure)Ú_AUTHENTICATION_FAILURE_CODE)ÚLockÚ_async_create_lock)ÚAsyncConnection)ÚMongoCredentialFÚ_OIDCAuthenticatorc                óÊ  — | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  �bd}|j
                  }|D ]9  }||d   k(  rd}Œ|j                  d«      sŒ |d   j                  |dd  «      sŒ8d}Œ; |st        d|d   › d|› �«      ‚t        ||¬«      | j                   _        | j                   j                  S )	NFr   Tz*.é   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )ÚusernameÚ
properties)
ÚcacheÚdatar!   Úmechanism_propertiesÚhuman_callbackÚallowed_hostsÚ
startswithÚendswithr   r   )ÚcredentialsÚaddressÚprincipal_namer"   Úfoundr'   Úpatts          úa/var/www/pod-logistic/pod-api/venv/lib/python3.12/site-packages/pymongo/asynchronous/auth_oidc.pyÚ_get_authenticatorr0   1   sö   € ð ×Ñ×ÒØ× Ñ ×%Ñ%Ð%ð !×)Ñ)€NØ×1Ñ1€Jð × Ñ Ð,ØˆØ"×0Ñ0ˆØ!ò 	ˆDØ�w˜q‘zÒ!Ø‘Ø—‘ Õ&¨7°1©:×+>Ñ+>¸tÀAÀB¸xÕ+HØ‘ð		ñ
 Ü$Ø)¨'°!©*¨Ð5]Ð^kÐ]lÐmóð ô
 0¸ÐT^Ô_€K×ÑÔØ×Ñ×!Ñ!Ð!ó    c                  óx  — e Zd ZU ded<   ded<    ed¬«      Zded<    ed¬«      Zded	<    ed¬«      Zd
ed<    ed¬«      Zded<   e	s ee
¬«      Zded<   n ee
¬«      Zded<    ed¬«      Zded<   d"d„Zd"d„Zd#d„Zd$d„Zd"d„Zd%d„Z	 	 	 	 	 	 d&d„Zd'd„Zd(d„Z	 	 	 	 	 	 d)d„Zd$d„Zd*d „Z	 	 	 	 	 	 d+d!„Zy),r   Ústrr!   r   r"   N)ÚdefaultúOptional[str]Úrefresh_tokenÚaccess_tokenzOptional[OIDCIdPInfo]Úidp_infor   ÚintÚtoken_gen_id)Údefault_factoryr   Úlockzthreading.LockÚfloatÚlast_call_timec              ƒ  óÄ   K  — | j                  |«       | j                  j                  r| j                  |«      ƒ d{  –—† S | j	                  |«      ƒ d{  –—† S 7 Œ7 Œ­w)z(Handle a reauthenticate from the server.N)Ú_invalidater"   ÚcallbackÚ_authenticate_machineÚ_authenticate_human)ÚselfÚconns     r/   Úreauthenticatez!_OIDCAuthenticator.reauthenticate]   sT   è ø€ ð 	×Ñ˜Ôà�?‰?×#Ò#Ø×3Ñ3°DÓ9×9Ð9Ø×-Ñ-¨dÓ3×3Ð3ð :øØ3ús!   ‚<A ¾A¿A ÁAÁA ÁA c              ƒ  ó*  K  — |j                   }|r6|j                  «       r&|j                  }|r|d   r| j                  |_        |S | j
                  j                  r| j                  |«      ƒ d{  –—† S | j                  |«      ƒ d{  –—† S 7 Œ7 Œ­w)z'Handle an initial authenticate request.ÚdoneN)	Úauth_ctxÚspeculate_succeededÚspeculative_authenticater:   Úoidc_token_gen_idr"   rA   rB   rC   )rD   rE   ÚctxÚresps       r/   Úauthenticatez_OIDCAuthenticator.authenticatef   s†   è ø€ ð �m‰mˆÙ�3×*Ñ*Ô,Ø×/Ñ/ˆDÙ˜˜VšØ)-×):Ñ):�Ô&Ø�ð
 �?‰?×#Ò#Ø×3Ñ3°DÓ9×9Ð9Ø×-Ñ-¨dÓ3×3Ð3ð :øØ3ús$   ‚A/BÁ1BÁ2BÂ
BÂBÂBc                óV   — | j                   sy| j                  d| j                   i«      S )z-Get the appropriate speculative auth command.NÚjwt)r7   Ú_get_start_command)rD   s    r/   Úget_spec_auth_cmdz$_OIDCAuthenticator.get_spec_auth_cmdx   s*   € à× Ò ØØ×&Ñ&¨¨t×/@Ñ/@Ð'AÓBÐBr1   c              ƒ  ó  K  — | j                   r	 | j                  |«      ƒ d {  –—† S | j                  |«      ƒ d {  –—† S 7 Œ# t        $ r6}| j                  |«      r| j	                  |«      ƒ d {  –—†7  cY d }~S ‚ d }~ww xY w7 ŒH­w©N)r7   Ú_sasl_start_jwtr   Ú_is_auth_errorrB   )rD   rE   Úes      r/   rB   z(_OIDCAuthenticator._authenticate_machine~   s‚   è ø€ ð
 ×ÒðØ!×1Ñ1°$Ó7×7Ð7ð
 ×)Ñ)¨$Ó/×/Ð/ð 8ùÜ#ò Ø×&Ñ& qÔ)Ø!%×!;Ñ!;¸DÓ!A×AÐAÕAØûðúð 0ús_   ‚B�A ¤A¥A ¨B½B¾BÁA Á	BÁ%A>Á2A5Á3A>Á7BÁ8BÁ=A>Á>BÂBc              ƒ  óR  K  — | j                   r	 | j                  |«      ƒ d {  –—† S | j
                  r	 | j                  |«      ƒ d {  –—† S | j                  d «      }| j                  ||«      ƒ d {  –—† }| j                  ||«      ƒ d {  –—† S 7 Œo# t        $ r6}| j                  |«      r| j	                  |«      ƒ d {  –—†7  cY d }~S ‚ d }~ww xY w7 Œ�# t        $ r=}| j                  |«      r&d | _        | j	                  |«      ƒ d {  –—†7  cY d }~S ‚ d }~ww xY w7 Œ­7 Œ•­wrU   )	r7   rV   r   rW   rC   r6   rR   Ú_run_commandÚ_sasl_continue_jwt)rD   rE   rX   ÚcmdÚ
start_resps        r/   rC   z&_OIDCAuthenticator._authenticate_humanŒ   s  è ø€ ð
 ×ÒðØ!×1Ñ1°$Ó7×7Ð7ð ×ÒðØ!×1Ñ1°$Ó7×7Ð7ð ×%Ñ% dÓ+ˆØ×,Ñ,¨T°3Ó7×7ˆ
à×,Ñ,¨T°:Ó>×>Ð>ð1 8ùÜ#ò Ø×&Ñ& qÔ)Ø!%×!9Ñ!9¸$Ó!?×?Ð?Õ?Øûðúð 8ùÜ#ò Ø×&Ñ& qÔ)Ø)-�DÔ&Ø!%×!9Ñ!9¸$Ó!?×?Ð?Õ?Øûð	úð 8øà>úsÆ   ‚D'�B ¤B¥B ¨D'¶C Á
CÁC Á'D'Á5D#Á6D'ÂD%ÂD'ÂB Â	CÂ%CÃCÃCÃ	CÃ
D'ÃCÃCÃD'ÃC Ã	D Ã#,DÄDÄDÄD ÄD'ÄDÄD Ä D'Ä%D'c              ƒ  ó  K  — | j                   }|j                  d u}|r| j                  €y |j                  r|j                  }|j                  r|j                  }| j                  }|r|S €|sy |�sÙ|��Ö| j
                  4 ƒd {  –—†  | j                  }||k7  r|cd d d «      ƒd {  –—†  S t        j                  «       | j                  z
  }|t        k  r$t        j                  t        |z
  «      ƒ d {  –—†  t        j                  «       | _        |rt        }| j                  €J ‚t        t        «       xs t        «      }t        |t         | j"                  | j                  | j                   j$                  ¬«      }t&        s8t        j(                  «       j+                  d |j,                  |«      ƒ d {  –—† }	n|j-                  |«      }	t/        |	t0        «      st3        dt5        |	«      › �«      ‚|	j"                  | _        |	j                  | _        | xj6                  dz  c_        d d d «      ƒd {  –—†  | j                  S | j                  S 7 �ŒÒ7 �Œ²7 �Œf7 Œ¥7 Œ'# 1 ƒd {  –—†7  sw Y   | j                  S xY w­w)N)Útimeout_secondsÚversionr6   r8   r!   z8Callback result must be of type OIDCCallbackResult, not r    )r"   r&   r8   rA   r7   r<   Útimer>   r   ÚasyncioÚsleepr   r9   r   r   r   r   r6   r!   Ú_IS_SYNCÚget_running_loopÚrun_in_executorÚfetchÚ
isinstancer   Ú
ValueErrorÚtyper:   )
rD   r"   Úis_humanÚcbÚ
prev_tokenÚ	new_tokenÚdeltaÚtimeoutÚcontextrN   s
             r/   Ú_get_access_tokenz$_OIDCAuthenticator._get_access_token­   sK  è ø€ Ø—_‘_ˆ
ð ×,Ñ,°DÐ8ˆÙ˜Ÿ™Ð-Øà×ÒØ×$Ñ$ˆBØ×$Ò$Ø×*Ñ*ˆBà×&Ñ&ˆ
ÙØÐàˆ:™jØâ˜b™nØ—y‘y÷ #'ñ #'ð !×-Ñ-�	Ø 
Ò*Ø$÷#'÷ #'ñ #'ô Ÿ	™	› d×&9Ñ&9Ñ9�ØÔ5Ò5Ü!Ÿ-™-Ô(BÀUÑ(JÓK×KÐKÜ&*§i¡i£k�Ô#áÜ<�GØŸ=™=Ð4Ð4Ð4ä!¤)£+Ò"QÔ1QÓR�GÜ-Ø$+Ü,Ø"&×"4Ñ"4Ø!Ÿ]™]Ø!Ÿ_™_×5Ñ5ô�õ  Ü!(×!9Ñ!9Ó!;×!KÑ!KÈDÐRT×RZÑRZÐ\cÓ!d×d‘DàŸ8™8 GÓ,�DÜ! $Ô(:Ô;Ü$ØRÔSWÐX\ÓS]ÐR^Ð_óð ð &*×%7Ñ%7�Ô"Ø$(×$5Ñ$5�Ô!Ø×!Ò! QÑ&Õ!÷G#'÷ #'ðJ × Ñ Ð ˆt× Ñ Ð ðK#'ùð #'ùð Lùð  eøð5#'ø÷ #'÷ #'ð #'ðJ × Ñ Ð üs�   ‚BJÂIÂJÂI&ÂJÂ*IÂ+JÂ0A	I&Ã9IÃ:CI&Æ<I"Æ=A4I&È1JÈ<I$È=JÉJÉI&É"I&É$JÉ&JÉ,I/É-JÉ4Jc              ƒ  ó°   K  — 	 |j                  d|d¬«      ƒ d {  –—† S 7 Œ# t        $ r(}| j                  |«      r| j                  |«       ‚ d }~ww xY w­w)Nz	$externalT)Ú	no_reauth)Úcommandr   rW   r@   )rD   rE   r\   rX   s       r/   rZ   z_OIDCAuthenticator._run_commandê   sT   è ø€ ð	ØŸ™ k°3À$˜ÓG×GÐGÐGùÜò 	Ø×"Ñ" 1Ô%Ø× Ñ  Ô&Øûð	üs0   ‚A„" › œ" ŸA " ¢	A«#AÁAÁAc                óJ   — t        |t        «      sy|j                  t        k(  S )NF)rh   r   Úcoder   )rD   Úerrs     r/   rW   z!_OIDCAuthenticator._is_auth_errorô   s    € Ü˜#Ô/Ô0ØØ�x‰xÔ7Ñ7Ð7r1   c                óV   — |j                   xs d}|�|| j                  k  ry d | _        y )Nr   )rL   r:   r7   )rD   rE   r:   s      r/   r@   z_OIDCAuthenticator._invalidateù   s2   € ð ×-Ñ-Ò2°ˆØÐ#¨°t×7HÑ7HÒ(HØØ ˆÕr1   c              ƒ  ó4  K  — d | _         d | _        t        j                  |d   «      }d|v rt	        di |¤Ž| _        | j                  «       ƒ d {  –—† }| j                  |_        | j                  d|i|«      }| j                  ||«      ƒ d {  –—† S 7 ŒC7 Œ­w)NÚpayloadÚissuerrQ   © )r7   r6   ÚbsonÚdecoder   r8   rr   r:   rL   Ú_get_continue_commandrZ   )rD   rE   r]   Ústart_payloadr7   r\   s         r/   r[   z%_OIDCAuthenticator._sasl_continue_jwt  s™   è ø€ ð !ˆÔØ!ˆÔÜ(,¯©°J¸yÑ4IÓ(JˆØ�}Ñ$Ü'Ñ8¨-Ñ8ˆDŒMØ!×3Ñ3Ó5×5ˆØ!%×!2Ñ!2ˆÔØ×(Ñ(¨%°Ð)>À
ÓKˆØ×&Ñ& t¨SÓ1×1Ð1ð 6øð 2ús$   ‚ABÁBÁ>BÂBÂBÂBc              ƒ  ó¾   K  — | j                  «       ƒ d {  –—† }| j                  |_        | j                  d|i«      }| j	                  ||«      ƒ d {  –—† S 7 ŒB7 Œ­w)NrQ   )rr   r:   rL   rR   rZ   )rD   rE   r7   r\   s       r/   rV   z"_OIDCAuthenticator._sasl_start_jwt  s[   è ø€ Ø!×3Ñ3Ó5×5ˆØ!%×!2Ñ!2ˆÔØ×%Ñ% u¨lÐ&;Ó<ˆØ×&Ñ& t¨SÓ1×1Ð1ð 6øð 2ús!   ‚A–A—=AÁAÁAÁAc                óx   — |€| j                   }|rd|i}ni }t        t        j                  |«      «      }dd|dœS )NÚnr    zMONGODB-OIDC)Ú	saslStartÚ	mechanismr{   )r!   r   r~   Úencode)rD   r{   r,   Úbin_payloads       r/   rR   z%_OIDCAuthenticator._get_start_command  sB   € Øˆ?Ø!Ÿ]™]ˆNÙØ Ð/‘à�ÜœTŸ[™[¨Ó1Ó2ˆØ¨^ÈÑTÐTr1   c                óP   — t        t        j                  |«      «      }d||d   dœS )Nr    ÚconversationId)ÚsaslContinuer{   rŠ   )r   r~   r‡   )rD   r{   r]   rˆ   s       r/   r€   z(_OIDCAuthenticator._get_continue_command  s0   € ô œTŸ[™[¨Ó1Ó2ˆàØ"Ø(Ð)9Ñ:ñ
ð 	
r1   )rE   r   ÚreturnúOptional[Mapping[str, Any]])rŒ   z"Optional[MutableMapping[str, Any]])rE   r   rŒ   úMapping[str, Any])rŒ   r5   )rE   r   r\   úMutableMapping[str, Any]rŒ   rŽ   )rx   Ú	ExceptionrŒ   Úbool)rE   r   rŒ   ÚNone)rE   r   r]   rŽ   rŒ   rŽ   )r{   r�   rŒ   r�   )r{   rŽ   r]   rŽ   rŒ   r�   )Ú__name__Ú
__module__Ú__qualname__Ú__annotations__r   r6   r7   r8   r:   rd   r   r<   r>   rF   rO   rS   rB   rC   rr   rZ   rW   r@   r[   rV   rR   r€   r}   r1   r/   r   r   N   s	  … àƒMØÓÙ#(°Ô#6€M�=Ó6Ù"'°Ô"5€L�-Ó5Ù&+°DÔ&9€HÐ#Ó9Ù aÔ(€L�#Ó(ÙÙÐ+=Ô>ˆˆdÔ>á$Ð5GÔHˆˆnÓHá!¨!Ô,€N�EÓ,ó4ó4ó$Có0ó?óB;!ðzØ#ðØ*Bðà	óó8ó
!ð2Ø#ð2Ø1Bð2à	ó2ó2óUð
Ø(ð
Ø6Gð
à	!ô
r1   c              ƒ  ó¦   K  — t        | |j                  «      }|r|j                  |«      ƒ d{  –—† S |j                  |«      ƒ d{  –—† S 7 Œ7 Œ­w)z Authenticate using MONGODB-OIDC.N)r0   r+   rF   rO   )r*   rE   rF   Úauthenticators       r/   Ú_authenticate_oidcr™   )  sL   è ø€ ô ' {°D·L±LÓA€MÙØ"×1Ñ1°$Ó7×7Ð7à"×/Ñ/°Ó5×5Ð5ð 8øà5ús!   ‚-A¯A°AÁAÁ	AÁA)r*   r   r+   ztuple[str, int]rŒ   r   )r*   r   rE   r   rF   r‘   rŒ   r�   )/Ú__doc__Ú
__future__r   rb   Ú	threadingra   Údataclassesr   r   Útypingr   r   r   r	   r
   r   r~   Úbson.binaryr   Úpymongo._csotr   Úpymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   Úpymongo.errorsr   r   Úpymongo.helpers_sharedr   Úpymongo.lockr   r   Úpymongo.asynchronous.poolr   Úpymongo.auth_sharedr   rd   r0   r   r™   r}   r1   r/   ú<module>r§      s°   ðñ +Ý "ã Û Û ß (ß O× Oã Ý Ý #÷
÷ 
õ 
÷ @Ý ?ß 1áÝ9Ý3à€ð"Ø ð"Ø+:ð"àó"ð: ÷W
ð W
ó ðW
ðt6Ø ð6Ø(7ð6ØIMð6à ô6r1   