o
    sDiN/                     @  s  d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lm Z m!Z! dd
l"m#Z# ddl$m%Z%m&Z& e
rvddl'm(Z( ddl)m*Z* dZ+dddZ,eG dd dZ-d ddZ.dS )!z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)Lock_create_lock)MongoCredential)
ConnectionTcredentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                 C  s   | j jr| j jS | j}| j}|jd urFd}|j}|D ]}||d kr%d}q|dr7|d |dd  r7d}q|sFtd|d  d| t	||d| j _| j jS )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar#   mechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r!   )r   r   principal_namer$   foundr)   patt r/   [/home/alumno/antzosa8961/venv/lib/python3.10/site-packages/pymongo/synchronous/auth_oidc.py_get_authenticator1   s&   
 r1   c                   @  s$  e Zd ZU ded< ded< eddZded< eddZded	< eddZd
ed< eddZded< e	s=ee
dZded< n	ee
dZded< eddZded< d=ddZd=ddZd>ddZd?d!d"Zd=d#d$Zd@d%d&ZdAd)d*ZdBd.d/ZdCd1d2ZdDd4d5Zd?d6d7ZdEd9d:ZdFd;d<ZdS )Gr!   strr#   r   r$   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryr   lockzthreading.Lockfloatlast_call_timeconnr   r    Optional[Mapping[str, Any]]c                 C  s&   |  | | jjr| |S | |S )z(Handle a reauthenticate from the server.)_invalidater$   callback_authenticate_machine_authenticate_human)selfr>   r/   r/   r0   reauthenticate]   s   


z!_OIDCAuthenticator.reauthenticatec                 C  sL   |j }|r| r|j}|r|d r| j|_|S | jjr!| |S | |S )z'Handle an initial authenticate request.done)	auth_ctxspeculate_succeededspeculative_authenticater9   oidc_token_gen_idr$   rA   rB   rC   )rD   r>   ctxrespr/   r/   r0   authenticatef   s   

z_OIDCAuthenticator.authenticate"Optional[MutableMapping[str, Any]]c                 C  s   | j sdS | d| j iS )z-Get the appropriate speculative auth command.Njwt)r6   _get_start_command)rD   r/   r/   r0   get_spec_auth_cmdx   s   z$_OIDCAuthenticator.get_spec_auth_cmdMapping[str, Any]c              
   C  sX   | j r'z| |W S  ty& } z| |r!| |W  Y d }~S  d }~ww | |S N)r6   _sasl_start_jwtr   _is_auth_errorrB   )rD   r>   er/   r/   r0   rB   ~   s   

z(_OIDCAuthenticator._authenticate_machinec              
   C  s   | j r'z| |W S  ty& } z| |r!| |W  Y d }~S  d }~ww | jrQz| |W S  tyP } z| |rKd | _| |W  Y d }~S  d }~ww | d }| ||}| ||S rS   )	r6   rT   r   rU   rC   r5   rP   _run_command_sasl_continue_jwt)rD   r>   rV   cmd
start_respr/   r/   r0   rC      s,   
	

z&_OIDCAuthenticator._authenticate_humanc           
      C  s  | j }|jd u}|r| jd u rd S |jr|j}|jr|j}| j}|r$|S |d u r,|s,d S |s|d ur| j | j}||krF|W  d    S t | j }|tk rXt	t|  t | _|rit
}| jd ushJ ntt pnt}t|t| j| j| j jd}tst d |j|}	n||}	t|	tstdt|	 |	j| _|	j| _|  jd7  _W d    | jS 1 sw   Y  | jS )N)timeout_secondsversionr5   r7   r#   z8Callback result must be of type OIDCCallbackResult, not r"   )r$   r(   r7   rA   r6   r;   timer=   r   sleepr   r8   r   r   r   r   r5   r#   _IS_SYNCasyncioget_running_looprun_in_executorfetch
isinstancer   
ValueErrortyper9   )
rD   r$   is_humancb
prev_token	new_tokendeltatimeoutcontextrL   r/   r/   r0   _get_access_token   s`   




%%z$_OIDCAuthenticator._get_access_tokenrY   MutableMapping[str, Any]c              
   C  sB   z	|j d|ddW S  ty  } z| |r| |  d }~ww )Nz	$externalT)	no_reauth)commandr   rU   r@   )rD   r>   rY   rV   r/   r/   r0   rW      s   

z_OIDCAuthenticator._run_commanderr	Exceptionboolc                 C  s   t |tsdS |jtkS )NF)rd   r   coder   )rD   rr   r/   r/   r0   rU      s   

z!_OIDCAuthenticator._is_auth_errorNonec                 C  s*   |j pd}|d ur|| jk rd S d | _d S )Nr   )rJ   r9   r6   )rD   r>   r9   r/   r/   r0   r@      s   

z_OIDCAuthenticator._invalidaterZ   c                 C  s^   d | _ d | _t|d }d|v rtdi || _|  }| j|_| 	d|i|}| 
||S )NpayloadissuerrO   r/   )r6   r5   bsondecoder   r7   rn   r9   rJ   _get_continue_commandrW   )rD   r>   rZ   start_payloadr6   rY   r/   r/   r0   rX      s   z%_OIDCAuthenticator._sasl_continue_jwtc                 C  s*   |   }| j|_| d|i}| ||S )NrO   )rn   r9   rJ   rP   rW   )rD   r>   r6   rY   r/   r/   r0   rT     s   z"_OIDCAuthenticator._sasl_start_jwtrw   c                 C  s:   |d u r| j }|rd|i}ni }tt|}dd|dS )Nnr"   zMONGODB-OIDC)	saslStart	mechanismrw   )r#   r   ry   encode)rD   rw   r,   bin_payloadr/   r/   r0   rP     s   
z%_OIDCAuthenticator._get_start_commandc                 C  s   t t|}d||d dS )Nr"   conversationId)saslContinuerw   r   )r   ry   r   )rD   rw   rZ   r   r/   r/   r0   r{     s
   z(_OIDCAuthenticator._get_continue_command)r>   r   r    r?   )r    rN   )r>   r   r    rR   )r    r4   )r>   r   rY   ro   r    rR   )rr   rs   r    rt   )r>   r   r    rv   )r>   r   rZ   rR   r    rR   )rw   r?   r    ro   )rw   rR   rZ   rR   r    ro   )__name__
__module____qualname____annotations__r   r5   r6   r7   r9   r_   r   r;   r=   rE   rM   rQ   rB   rC   rn   rW   rU   r@   rX   rT   rP   r{   r/   r/   r/   r0   r!   N   s0   
 

	



!
=





r>   r   rE   rt   r?   c                 C  s$   t | |j}|r||S ||S )z Authenticate using MONGODB-OIDC.)r1   r   rE   rM   )r   r>   rE   authenticatorr/   r/   r0   _authenticate_oidc'  s   

r   )r   r   r   r   r    r!   )r   r   r>   r   rE   rt   r    r?   )/__doc__
__future__r   r`   	threadingr]   dataclassesr   r   typingr   r   r   r   r	   r
   ry   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.lockr   r   pymongo.auth_sharedr   pymongo.synchronous.poolr   r_   r1   r!   r   r/   r/   r/   r0   <module>   s.    ,
 Y