
    [jC%                       d Z ddlmZ ddlZddlmZmZ ddlmZm	Z	m
Z
mZmZmZ ddlZddlmZ ddlmZ ddlmZmZ erdd	lmZ dd
lmZ e G d d                      Z	 dZdZdZddZe G d d                      ZddZ dS ) z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyCallableMappingMutableMappingOptional)Binary)SON)ConfigurationErrorOperationFailure)MongoCredential)
Connectionc                  .    e Zd ZU ded<   ded<   ded<   dS )_OIDCPropertieszOptional[Callable[..., dict]]request_token_callbackOptional[str]provider_namez	list[str]allowed_hostsN)__name__
__module____qualname____annotations__     U/var/www/app.qaans.com/backend/venv/lib/python3.11/site-packages/pymongo/auth_oidc.pyr   r       s6         9999    r   r      i,     credentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                   | j         j        r| j         j        S | j        }| j        }|j        std}|j        }|D ]K}||d         k    rd}|                    d          r%|d                             |dd                    rd}L|st          d|d          d|           t          ||          | j         _        | j         j        S )	NFr   Tz*.r    zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar'   mechanism_propertiesr   r   
startswithendswithr   r%   )r!   r"   principal_namer(   foundr   patts          r   _get_authenticatorr1   .   s     & %% !)N1J # "0! 	 	Dwqz!!&& 71:+>+>tABBx+H+H  	$m'!*mm^kmm  
 0T^___K!!r   c                     e Zd ZU ded<   ded<    ed          Zded<    ed          Zded	<    ed          Zd
ed<    ed          Zded<    ee	j
                  Zded<   d)d*dZd+dZd,dZd)d-dZd.d$Zd/d%Zd/d&Zd0d(ZdS )1r%   strr'   r   r(   N)defaultr   refresh_tokenaccess_tokenzOptional[dict]idp_infor   inttoken_gen_id)default_factoryzthreading.LocklockTuse_callbackboolr$   c                x   | j         }|r|j        nd }d}| j        }|r|S |s|sd S |s|| j        5  | j        }||k    r|cd d d            S |dk    r;t          t
          | j        d} || j        |          }|                     |           | xj	        dz  c_	        d d d            n# 1 swxY w Y   | j        S )Nhuman)timeout_secondsversionr5   r    )
r(   r   r6   r;   CALLBACK_TIMEOUT_SECONDSCALLBACK_VERSIONr5   r7   validate_request_token_responser9   )	selfr<   r(   cbcb_type
prev_token	new_tokencontextresps	            r   get_current_tokenz$_OIDCAuthenticator.get_current_tokenU   sb   _
 3?HZ..D&
 	 	J 	4 	'bn ' ' !-	
**$' ' ' ' ' ' ' ' g%%+C#3)-); G
 2dmW55D88>>>!!Q&!!%' ' ' ' ' ' ' ' ' ' ' ' ' ' '(   s   B*AB**B.1B.rK   Mapping[str, Any]Nonec                   t          |t                    st          d          d|vrt          d          g d}|D ]}||vrt          d| d          |d         | _        |                    d          | _        d S )Nz%OIDC callback returned invalid resultr6   z,OIDC callback did not return an access_token)r6   r5   expires_in_secondsz%Unexpected field in callback result ""r5   )
isinstancedict
ValueErrorr6   getr5   )rE   rK   expectedkeys       r   rD   z2_OIDCAuthenticator.validate_request_token_responsez   s    $%% 	FDEEE%%KLLLJJJ 	Q 	QC("" !O!O!O!OPPP # !0!XXo66r   SON[str, Any]c           
         i }| j         }|r||d<   t          dddt          t          j        |                    fdg          S )z8Get a SASL start command with an optional principal namen	saslStartr    	mechanismzMONGODB-OIDCpayload)autoAuthorizer    )r'   r   r   bsonencode)rE   r_   r.   s      r   principal_step_cmdz%_OIDCAuthenticator.principal_step_cmd   s[      	*)GCL -F4;w#7#7889$	
 
 	
r   Optional[SON[str, Any]]c                    | j         |                                 S |                     |          }|sd S t          t	          j        d|i                    }t          ddd|fg          S )Njwtr[   r]   r_   )r7   rc   rL   r   ra   rb   r   )rE   r<   tokenbin_payloads       r   auth_start_cmdz!_OIDCAuthenticator.auth_start_cmd   s|    = **,,,&&|44 	4T[%8899 -K(
 
 	
r   connr   cmdMutableMapping[str, Any]Optional[Mapping[str, Any]]c                `    	 |                     d|d          S # t          $ r	 d | _         w xY w)Nz	$externalT)	no_reauth)commandr   r6   )rE   rj   rk   s      r   run_commandz_OIDCAuthenticator.run_command   sE    	<<SD<AAA 	 	 	 $D	s    -c                F   |j         pd}|| j        k     r-| j        r&	 |                     |          S # t          $ r Y nw xY wd| _        | j        }d| _        |                                 }|                     ||          }|J t          j	        |d                   }d|v r|| _        | j        |k    rd| _        d| _
        | j
        rC	 |                     ||          S # t          $ r d| _
        |                     |          cY S w xY w|                     ||          S )z(Handle a reauthenticate from the server.r   Nr_   issuer)oidc_token_gen_idr9   r6   authenticater   r7   rc   rq   ra   decoder5   finish_auth)rE   rj   prev_idprev_idp_infork   rK   server_resps          r   reauthenticatez!_OIDCAuthenticator.reauthenticate   sm    (-Ad'''T->'((...#    ! %%''c** KY88{""'DM =M)) $D!%D  	//''d333# / / /%)"((...../ d+++s   2 
??C! !&D
	D
c                V   |j         }d }|r|                                r|j        }n.|                                 }|J |                     ||          }|J |d         r| j        |_        d S t          j        |d                   }d|v r|| _	        | 
                    ||          S )Ndoner_   rs   )auth_ctxspeculate_succeededspeculative_authenticateri   rq   r9   rt   ra   rv   r7   rw   )rE   rj   ctxrk   rK   rz   s         r   ru   z_OIDCAuthenticator.authenticate   s    m 	/3**,, 	//DD%%''C???##D#..D< 	%)%6D"4 KY88{""'DMd+++r   	orig_respc                *   |d         }|                                  }| j        |_        t          t	          j        d|i                    }t          dd|fd|fg          }|                     ||          }|J |d         st          d          |S )NconversationIdrf   )saslContinuer    r_   r}   z%SASL conversation failed to complete.)	rL   r9   rt   r   ra   rb   r   rq   r   )rE   r   rj   conversation_idrg   rh   rk   rK   s           r   rw   z_OIDCAuthenticator.finish_auth   s     $$45&&((!%!2T[%8899#!?3K(
 
 c**F| 	L"#JKKKr   )T)r<   r=   r$   r   )rK   rM   r$   rN   )r$   rX   )r<   r=   r$   rd   )rj   r   rk   rl   r$   rm   )rj   r   r$   rm   )r   rM   rj   r   r$   rm   )r   r   r   r   r   r5   r6   r7   r9   	threadingLockr;   rL   rD   rc   ri   rq   r{   ru   rw   r   r   r   r%   r%   K   so        MMM#(5#6#6#6M6666"'%"5"5"5L5555$uT222H2222a(((L(((( 5@@@D@@@@#! #! #! #! #!J7 7 7 7 
 
 
 
$
 
 
 
 
"   ), ), ), ),V, , , ,,     r   rj   r   r{   r=   rm   c                    t          | |j                  }|r|                    |          S |                    |          S )z Authenticate using MONGODB-OIDC.)r1   r"   r{   ru   )r!   rj   r{   authenticators       r   _authenticate_oidcr     sE     '{DLAAM 0++D111))$///r   )r!   r   r"   r#   r$   r%   )r!   r   rj   r   r{   r=   r$   rm   )!__doc__
__future__r   r   dataclassesr   r   typingr   r   r   r	   r
   r   ra   bson.binaryr   bson.sonr   pymongo.errorsr   r   pymongo.authr   pymongo.poolr   r   TOKEN_BUFFER_MINUTESrB   rC   r1   r%   r   r   r   r   <module>r      s   + * " " " " " "     ( ( ( ( ( ( ( ( R R R R R R R R R R R R R R R R              ? ? ? ? ? ? ? ? (,,,,,,''''''         < !  " " " ": } } } } } } } }@0 0 0 0 0 0r   