Ë
    Ü_ËiN/  ã                  ó>  — d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lm Z m!Z! dd
l"m#Z# ddl$m%Z%m&Z& e
rddl'm(Z( ddl)m*Z* dZ+	 	 	 	 	 	 dd„Z,e G d„ d«      «       Z-	 	 	 	 	 	 	 	 dd„Z.y)z$MONGODB-OIDC Authentication helpers.é    )ÚannotationsN)Ú	dataclassÚfield)ÚTYPE_CHECKINGÚAnyÚMappingÚMutableMappingÚOptionalÚUnion)ÚBinary)Ú	remaining)	ÚCALLBACK_VERSIONÚHUMAN_CALLBACK_TIMEOUT_SECONDSÚ MACHINE_CALLBACK_TIMEOUT_SECONDSÚTIME_BETWEEN_CALLS_SECONDSÚOIDCCallbackÚOIDCCallbackContextÚOIDCCallbackResultÚOIDCIdPInfoÚ_OIDCProperties)ÚConfigurationErrorÚOperationFailure)Ú_AUTHENTICATION_FAILURE_CODE)ÚLockÚ_create_lock)ÚMongoCredential)Ú
ConnectionTÚ_OIDCAuthenticatorc                óÊ  — | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  �bd}|j
                  }|D ]9  }||d   k(  rd}Œ|j                  d«      sŒ |d   j                  |dd  «      sŒ8d}Œ; |st        d|d   › d|› �«      ‚t        ||¬«      | j                   _        | j                   j                  S )	NFr   Tz*.é   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )ÚusernameÚ
properties)
ÚcacheÚdatar!   Úmechanism_propertiesÚhuman_callbackÚallowed_hostsÚ
startswithÚendswithr   r   )ÚcredentialsÚaddressÚprincipal_namer"   Úfoundr'   Úpatts          ú`/var/www/pod-logistic/pod-api/venv/lib/python3.12/site-packages/pymongo/synchronous/auth_oidc.pyÚ_get_authenticatorr0   1   sö   € ð ×Ñ×ÒØ× Ñ ×%Ñ%Ð%ð !×)Ñ)€NØ×1Ñ1€Jð × Ñ Ð,ØˆØ"×0Ñ0ˆØ!ò 	ˆDØ�w˜q‘zÒ!Ø‘Ø—‘ Õ&¨7°1©:×+>Ñ+>¸tÀAÀB¸xÕ+HØ‘ð		ñ
 Ü$Ø)¨'°!©*¨Ð5]Ð^kÐ]lÐmóð ô
 0¸ÐT^Ô_€K×ÑÔØ×Ñ×!Ñ!Ð!ó    c                  ól  — e Zd ZU ded<   ded<    ed¬«      Zded<    ed¬«      Zded	<    ed¬«      Zd
ed<    ed¬«      Zded<   e	s ee
¬«      Zded<   n ee
¬«      Zded<    ed¬«      Zded<   d"d„Zd"d„Zd#d„Zd$d„Zd"d„Zd%d„Zd&d„Zd'd„Zd(d„Z	 	 	 	 	 	 d)d„Zd$d„Zd*d „Z	 	 	 	 	 	 d+d!„Zy),r   Ústrr!   r   r"   N)ÚdefaultúOptional[str]Úrefresh_tokenÚaccess_tokenzOptional[OIDCIdPInfo]Úidp_infor   ÚintÚtoken_gen_id)Údefault_factoryr   Úlockzthreading.LockÚfloatÚlast_call_timec                ó”   — | j                  |«       | j                  j                  r| j                  |«      S | j	                  |«      S )z(Handle a reauthenticate from the server.)Ú_invalidater"   ÚcallbackÚ_authenticate_machineÚ_authenticate_human)ÚselfÚconns     r/   Úreauthenticatez!_OIDCAuthenticator.reauthenticate]   sA   € ð 	×Ñ˜Ôà�?‰?×#Ò#Ø×-Ñ-¨dÓ3Ð3Ø×'Ñ'¨Ó-Ð-r1   c                óú   — |j                   }|r6|j                  «       r&|j                  }|r|d   r| j                  |_        |S | j
                  j                  r| j                  |«      S | j                  |«      S )z'Handle an initial authenticate request.Údone)	Úauth_ctxÚspeculate_succeededÚspeculative_authenticater:   Úoidc_token_gen_idr"   rA   rB   rC   )rD   rE   ÚctxÚresps       r/   Úauthenticatez_OIDCAuthenticator.authenticatef   ss   € ð �m‰mˆÙ�3×*Ñ*Ô,Ø×/Ñ/ˆDÙ˜˜VšØ)-×):Ñ):�Ô&Ø�ð
 �?‰?×#Ò#Ø×-Ñ-¨dÓ3Ð3Ø×'Ñ'¨Ó-Ð-r1   c                óV   — | j                   sy| j                  d| j                   i«      S )z-Get the appropriate speculative auth command.NÚjwt)r7   Ú_get_start_command)rD   s    r/   Úget_spec_auth_cmdz$_OIDCAuthenticator.get_spec_auth_cmdx   s*   € à× Ò ØØ×&Ñ&¨¨t×/@Ñ/@Ð'AÓBÐBr1   c                óÒ   — | j                   r	 | j                  |«      S | j                  |«      S # t        $ r-}| j                  |«      r| j	                  |«      cY d }~S ‚ d }~ww xY w©N)r7   Ú_sasl_start_jwtr   Ú_is_auth_errorrB   )rD   rE   Úes      r/   rB   z(_OIDCAuthenticator._authenticate_machine~   sj   € ð
 ×ÒðØ×+Ñ+¨DÓ1Ð1ð
 ×#Ñ# DÓ)Ð)øô	 $ò Ø×&Ñ& qÔ)Ø×5Ñ5°dÓ;Õ;Øûðús    Ž0 °	A&¹!A!ÁA&Á A!Á!A&c                óÖ  — | j                   r	 | j                  |«      S | j
                  r	 | j                  |«      S | j                  d «      }| j                  ||«      }| j                  ||«      S # t        $ r-}| j                  |«      r| j	                  |«      cY d }~S ‚ d }~ww xY w# t        $ r4}| j                  |«      rd | _        | j	                  |«      cY d }~S ‚ d }~ww xY wrU   )	r7   rV   r   rW   rC   r6   rR   Ú_run_commandÚ_sasl_continue_jwt)rD   rE   rX   ÚcmdÚ
start_resps        r/   rC   z&_OIDCAuthenticator._authenticate_humanŒ   sê   € ð
 ×ÒðØ×+Ñ+¨DÓ1Ð1ð ×ÒðØ×+Ñ+¨DÓ1Ð1ð ×%Ñ% dÓ+ˆØ×&Ñ& t¨SÓ1ˆ
à×&Ñ& t¨ZÓ8Ð8øô/ $ò Ø×&Ñ& qÔ)Ø×3Ñ3°DÓ9Õ9Øûðûô $ò Ø×&Ñ& qÔ)Ø)-�DÔ&Ø×3Ñ3°DÓ9Õ9Øûð	úsF   ŽA2 ¬B+ Á2	B(Á;!B#ÂB(Â"B#Â#B(Â+	C(Â4(C#ÃC(Ã"C#Ã#C(c                óŒ  — | j                   }|j                  d u}|r| j                  €y |j                  r|j                  }|j                  r|j                  }| j                  }|r|S €|sy |�s±|��®| j
                  5  | j                  }||k7  r|cd d d «       S t        j                  «       | j                  z
  }|t        k  rt        j                  t        |z
  «       t        j                  «       | _        |rt        }| j                  €J ‚t        t        «       xs t        «      }t        |t        | j                   | j                  | j                   j"                  ¬«      }t$        s0t'        j(                  «       j+                  d |j,                  |«      }	n|j-                  |«      }	t/        |	t0        «      st3        dt5        |	«      › �«      ‚|	j                   | _        |	j                  | _        | xj6                  dz  c_        d d d «       | j                  S | j                  S # 1 sw Y   | j                  S xY w)N)Útimeout_secondsÚversionr6   r8   r!   z8Callback result must be of type OIDCCallbackResult, not r    )r"   r&   r8   rA   r7   r<   Útimer>   r   Úsleepr   r9   r   r   r   r   r6   r!   Ú_IS_SYNCÚasyncioÚget_running_loopÚrun_in_executorÚfetchÚ
isinstancer   Ú
ValueErrorÚtyper:   )
rD   r"   Úis_humanÚcbÚ
prev_tokenÚ	new_tokenÚdeltaÚtimeoutÚcontextrN   s
             r/   Ú_get_access_tokenz$_OIDCAuthenticator._get_access_token­   s  € Ø—_‘_ˆ
ð ×,Ñ,°DÐ8ˆÙ˜Ÿ™Ð-Øà×ÒØ×$Ñ$ˆBØ×$Ò$Ø×*Ñ*ˆBà×&Ñ&ˆ
ÙØÐàˆ:™jØâ˜b™nØ—‘ñ #'ð !×-Ñ-�	Ø 
Ò*Ø$÷#'ñ #'ô Ÿ	™	› d×&9Ñ&9Ñ9�ØÔ5Ò5Ü—J‘JÔ9¸EÑAÔBÜ&*§i¡i£k�Ô#áÜ<�GØŸ=™=Ð4Ð4Ð4ä!¤)£+Ò"QÔ1QÓR�GÜ-Ø$+Ü,Ø"&×"4Ñ"4Ø!Ÿ]™]Ø!Ÿ_™_×5Ñ5ô�õ  Ü"×3Ñ3Ó5×EÑEÀdÈBÏHÉHÐV]Ó^‘DàŸ8™8 GÓ,�DÜ! $Ô(:Ô;Ü$ØRÔSWÐX\ÓS]ÐR^Ð_óð ð &*×%7Ñ%7�Ô"Ø$(×$5Ñ$5�Ô!Ø×!Ò! QÑ&Õ!÷G#'ðJ × Ñ Ð ˆt× Ñ Ð ÷K#'ðJ × Ñ Ð ús   ÂH/ÂE1H/È/Ic                ó”   — 	 |j                  d|d¬«      S # t        $ r(}| j                  |«      r| j                  |«       ‚ d }~ww xY w)Nz	$externalT)Ú	no_reauth)Úcommandr   rW   r@   )rD   rE   r\   rX   s       r/   rZ   z_OIDCAuthenticator._run_commandê   sK   € ð	Ø—<‘< ¨S¸D�<ÓAÐAøÜò 	Ø×"Ñ" 1Ô%Ø× Ñ  Ô&Øûð	ús   ‚ –	AŸ#AÁAc                óJ   — t        |t        «      sy|j                  t        k(  S )NF)rh   r   Úcoder   )rD   Úerrs     r/   rW   z!_OIDCAuthenticator._is_auth_errorò   s    € Ü˜#Ô/Ô0ØØ�x‰xÔ7Ñ7Ð7r1   c                óV   — |j                   xs d}|�|| j                  k  ry d | _        y )Nr   )rL   r:   r7   )rD   rE   r:   s      r/   r@   z_OIDCAuthenticator._invalidate÷   s2   € ð ×-Ñ-Ò2°ˆØÐ#¨°t×7HÑ7HÒ(HØØ ˆÕr1   c                ó  — d | _         d | _        t        j                  |d   «      }d|v rt	        di |¤Ž| _        | j                  «       }| j                  |_        | j                  d|i|«      }| j                  ||«      S )NÚpayloadÚissuerrQ   © )r7   r6   ÚbsonÚdecoder   r8   rr   r:   rL   Ú_get_continue_commandrZ   )rD   rE   r]   Ústart_payloadr7   r\   s         r/   r[   z%_OIDCAuthenticator._sasl_continue_jwtÿ   s„   € ð !ˆÔØ!ˆÔÜ(,¯©°J¸yÑ4IÓ(JˆØ�}Ñ$Ü'Ñ8¨-Ñ8ˆDŒMØ×-Ñ-Ó/ˆØ!%×!2Ñ!2ˆÔØ×(Ñ(¨%°Ð)>À
ÓKˆØ× Ñ   sÓ+Ð+r1   c                óŽ   — | j                  «       }| j                  |_        | j                  d|i«      }| j	                  ||«      S )NrQ   )rr   r:   rL   rR   rZ   )rD   rE   r7   r\   s       r/   rV   z"_OIDCAuthenticator._sasl_start_jwt  sF   € Ø×-Ñ-Ó/ˆØ!%×!2Ñ!2ˆÔØ×%Ñ% u¨lÐ&;Ó<ˆØ× Ñ   sÓ+Ð+r1   c                óx   — |€| j                   }|rd|i}ni }t        t        j                  |«      «      }dd|dœS )NÚnr    zMONGODB-OIDC)Ú	saslStartÚ	mechanismr{   )r!   r   r~   Úencode)rD   r{   r,   Úbin_payloads       r/   rR   z%_OIDCAuthenticator._get_start_command  sB   € Øˆ?Ø!Ÿ]™]ˆNÙØ Ð/‘à�ÜœTŸ[™[¨Ó1Ó2ˆØ¨^ÈÑTÐTr1   c                óP   — t        t        j                  |«      «      }d||d   dœS )Nr    ÚconversationId)ÚsaslContinuer{   rŠ   )r   r~   r‡   )rD   r{   r]   rˆ   s       r/   r€   z(_OIDCAuthenticator._get_continue_command  s0   € ô œTŸ[™[¨Ó1Ó2ˆàØ"Ø(Ð)9Ñ:ñ
ð 	
r1   )rE   r   ÚreturnúOptional[Mapping[str, Any]])rŒ   z"Optional[MutableMapping[str, Any]])rE   r   rŒ   úMapping[str, Any])rŒ   r5   )rE   r   r\   úMutableMapping[str, Any]rŒ   rŽ   )rx   Ú	ExceptionrŒ   Úbool)rE   r   rŒ   ÚNone)rE   r   r]   rŽ   rŒ   rŽ   )r{   r�   rŒ   r�   )r{   rŽ   r]   rŽ   rŒ   r�   )Ú__name__Ú
__module__Ú__qualname__Ú__annotations__r   r6   r7   r8   r:   rc   r   r<   r>   rF   rO   rS   rB   rC   rr   rZ   rW   r@   r[   rV   rR   r€   r}   r1   r/   r   r   N   sï   … àƒMØÓÙ#(°Ô#6€M�=Ó6Ù"'°Ô"5€L�-Ó5Ù&+°DÔ&9€HÐ#Ó9Ù aÔ(€L�#Ó(ÙÙ¨<Ô8ˆˆdÔ8á$°\ÔBˆˆnÓBá!¨!Ô,€N�EÓ,ó.ó.ó$Có*ó9óB;!ózó8ó
!ð,Øð,Ø,=ð,à	ó,ó,óUð
Ø(ð
Ø6Gð
à	!ô
r1   c                óv   — t        | |j                  «      }|r|j                  |«      S |j                  |«      S )z Authenticate using MONGODB-OIDC.)r0   r+   rF   rO   )r*   rE   rF   Úauthenticators       r/   Ú_authenticate_oidcr™   '  s9   € ô ' {°D·L±LÓA€MÙØ×+Ñ+¨DÓ1Ð1à×)Ñ)¨$Ó/Ð/r1   )r*   r   r+   ztuple[str, int]rŒ   r   )r*   r   rE   r   rF   r‘   rŒ   r�   )/Ú__doc__Ú
__future__r   rd   Ú	threadingra   Údataclassesr   r   Útypingr   r   r   r	   r
   r   r~   Úbson.binaryr   Úpymongo._csotr   Úpymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   Úpymongo.errorsr   r   Úpymongo.helpers_sharedr   Úpymongo.lockr   r   Úpymongo.auth_sharedr   Úpymongo.synchronous.poolr   rc   r0   r   r™   r}   r1   r/   ú<module>r§      s°   ðñ +Ý "ã Û Û ß (ß O× Oã Ý Ý #÷
÷ 
õ 
÷ @Ý ?ß +áÝ3Ý3à€ð"Ø ð"Ø+:ð"àó"ð: ÷U
ð U
ó ðU
ðp0Ø ð0Ø(2ð0ØDHð0à ô0r1   