
    ]*iN/                    >   d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lm Z m!Z! dd
l"m#Z# ddl$m%Z%m&Z& e
rddl'm(Z( ddl)m*Z* dZ+	 	 	 	 	 	 ddZ,e G d d             Z-	 	 	 	 	 	 	 	 ddZ.y)z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)Lock_create_lock)MongoCredential)
ConnectionT_OIDCAuthenticatorc                   | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  bd}|j
                  }|D ]9  }||d   k(  rd}|j                  d      s |d   j                  |dd        s8d}; |st        d|d    d|       t        ||      | j                   _        | j                   j                  S )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar!   mechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r   )credentialsaddressprincipal_namer"   foundr'   patts          W/home/alumno/antonio/venv/lib/python3.12/site-packages/pymongo/synchronous/auth_oidc.py_get_authenticatorr0   1   s       %%% !))N11J   ,"00! 	Dwqz!&71:+>+>tABx+H		
 $)'!*5]^k]lm 
 0T^_K!!!    c                  l   e Zd ZU ded<   ded<    ed      Zded<    ed      Zded	<    ed      Zd
ed<    ed      Zded<   e	s ee
      Zded<   n ee
      Zded<    ed      Zded<   d"dZd"dZd#dZd$dZd"dZd%dZd&dZd'dZd(dZ	 	 	 	 	 	 d)dZd$dZd*d Z	 	 	 	 	 	 d+d!Zy),r   strr!   r   r"   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryr   lockzthreading.Lockfloatlast_call_timec                    | j                  |       | j                  j                  r| j                  |      S | j	                  |      S )z(Handle a reauthenticate from the server.)_invalidater"   callback_authenticate_machine_authenticate_human)selfconns     r/   reauthenticatez!_OIDCAuthenticator.reauthenticate]   sA     	??##--d33''--r1   c                    |j                   }|r6|j                         r&|j                  }|r|d   r| j                  |_        |S | j
                  j                  r| j                  |      S | j                  |      S )z'Handle an initial authenticate request.done)	auth_ctxspeculate_succeededspeculative_authenticater:   oidc_token_gen_idr"   rA   rB   rC   )rD   rE   ctxresps       r/   authenticatez_OIDCAuthenticator.authenticatef   ss     mm3**,//DV)-):):&
 ??##--d33''--r1   c                V    | j                   sy| j                  d| j                   i      S )z-Get the appropriate speculative auth command.Njwt)r7   _get_start_command)rD   s    r/   get_spec_auth_cmdz$_OIDCAuthenticator.get_spec_auth_cmdx   s*      &&t/@/@'ABBr1   c                    | j                   r	 | j                  |      S | j                  |      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY wN)r7   _sasl_start_jwtr   _is_auth_errorrB   )rD   rE   es      r/   rB   z(_OIDCAuthenticator._authenticate_machine~   sj    
 ++D11
 ##D))	 $ &&q)55d;;s    0 	A&!A!A& A!!A&c                   | j                   r	 | j                  |      S | j
                  r	 | j                  |      S | j                  d       }| j                  ||      }| j                  ||      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY w# t        $ r4}| j                  |      rd | _        | j	                  |      cY d }~S  d }~ww xY wrU   )	r7   rV   r   rW   rC   r6   rR   _run_command_sasl_continue_jwt)rD   rE   rX   cmd
start_resps        r/   rC   z&_OIDCAuthenticator._authenticate_human   s    
 ++D11 ++D11 %%d+&&tS1
&&tZ88/ $ &&q)33D99 $ &&q))-D&33D99	sF   A2 B+ 2	B(;!B#B("B##B(+	C(4(C#C("C##C(c                   | j                   }|j                  d u}|r| j                  y |j                  r|j                  }|j                  r|j                  }| j                  }|r|S |sy |s|| j
                  5  | j                  }||k7  r|cd d d        S t        j                         | j                  z
  }|t        k  rt        j                  t        |z
         t        j                         | _        |rt        }| j                  J t        t               xs t              }t        |t        | j                   | j                  | j                   j"                        }t$        s0t'        j(                         j+                  d |j,                  |      }	n|j-                  |      }	t/        |	t0              st3        dt5        |	             |	j                   | _        |	j                  | _        | xj6                  dz  c_        d d d        | j                  S | j                  S # 1 sw Y   | j                  S xY w)N)timeout_secondsversionr6   r8   r!   z8Callback result must be of type OIDCCallbackResult, not r    )r"   r&   r8   rA   r7   r<   timer>   r   sleepr   r9   r   r   r   r   r6   r!   _IS_SYNCasyncioget_running_looprun_in_executorfetch
isinstancer   
ValueErrortyper:   )
rD   r"   is_humancb
prev_token	new_tokendeltatimeoutcontextrN   s
             r/   _get_access_tokenz$_OIDCAuthenticator._get_access_token   s   __
 ,,D8-$$B$$**B&&
:jbn #' !--	
*$#' #' 		d&9&9955JJ9EAB&*iik#<G==444!)+"Q1QRG-$+,"&"4"4!]]!__55  "335EEdBHHV]^D88G,D!$(:;$RSWX\S]R^_  &*%7%7"$($5$5!!!Q&!G#'J    t   K#'J    s   H/E1H//Ic                    	 |j                  d|d      S # t        $ r(}| j                  |      r| j                  |        d }~ww xY w)Nz	$externalT)	no_reauth)commandr   rW   r@   )rD   rE   r\   rX   s       r/   rZ   z_OIDCAuthenticator._run_command   sK    	<<SD<AA 	""1%  &	s    	A#AAc                J    t        |t              sy|j                  t        k(  S )NF)rh   r   coder   )rD   errs     r/   rW   z!_OIDCAuthenticator._is_auth_error   s     #/0xx777r1   c                V    |j                   xs d}||| j                  k  ry d | _        y )Nr   )rL   r:   r7   )rD   rE   r:   s      r/   r@   z_OIDCAuthenticator._invalidate   s2     --2#t7H7H(H r1   c                   d | _         d | _        t        j                  |d         }d|v rt	        di || _        | j                         }| j                  |_        | j                  d|i|      }| j                  ||      S )NpayloadissuerrQ    )r7   r6   bsondecoder   r8   rr   r:   rL   _get_continue_commandrZ   )rD   rE   r]   start_payloadr7   r\   s         r/   r[   z%_OIDCAuthenticator._sasl_continue_jwt   s     !!(,Jy4I(J}$'8-8DM--/!%!2!2((%)>
K  s++r1   c                    | j                         }| j                  |_        | j                  d|i      }| j	                  ||      S )NrQ   )rr   r:   rL   rR   rZ   )rD   rE   r7   r\   s       r/   rV   z"_OIDCAuthenticator._sasl_start_jwt  sF    --/!%!2!2%%ul&;<  s++r1   c                x    || j                   }|rd|i}ni }t        t        j                  |            }dd|dS )Nnr    zMONGODB-OIDC)	saslStart	mechanismr{   )r!   r   r~   encode)rD   r{   r,   bin_payloads       r/   rR   z%_OIDCAuthenticator._get_start_command  sB    ?!]]N/T[[12^TTr1   c                P    t        t        j                  |            }d||d   dS )Nr    conversationId)saslContinuer{   r   )r   r~   r   )rD   r{   r]   r   s       r/   r   z(_OIDCAuthenticator._get_continue_command  s0     T[[12"()9:
 	
r1   )rE   r   returnOptional[Mapping[str, Any]])r   z"Optional[MutableMapping[str, Any]])rE   r   r   Mapping[str, Any])r   r5   )rE   r   r\   MutableMapping[str, Any]r   r   )rx   	Exceptionr   bool)rE   r   r   None)rE   r   r]   r   r   r   )r{   r   r   r   )r{   r   r]   r   r   r   )__name__
__module____qualname____annotations__r   r6   r7   r8   r:   rc   r   r<   r>   rF   rO   rS   rB   rC   rr   rZ   rW   r@   r[   rV   rR   r   r}   r1   r/   r   r   N   s    M#(#6M=6"'"5L-5&+D&9H#9a(L#(<8d8$\BnB!!,NE,..$C*9B;!z8
!,,,=,	,,U
(
6G
	!
r1   c                v    t        | |j                        }|r|j                  |      S |j                  |      S )z Authenticate using MONGODB-OIDC.)r0   r+   rF   rO   )r*   rE   rF   authenticators       r/   _authenticate_oidcr   '  s9     '{DLLAM++D11))$//r1   )r*   r   r+   ztuple[str, int]r   r   )r*   r   rE   r   rF   r   r   r   )/__doc__
__future__r   rd   	threadingra   dataclassesr   r   typingr   r   r   r	   r
   r   r~   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.lockr   r   pymongo.auth_sharedr   pymongo.synchronous.poolr   rc   r0   r   r   r}   r1   r/   <module>r      s    + "    ( O O   #
 
 
 @ ? +33" "+:"": U
 U
 U
p0 0(20DH0 0r1   