
    [jY              
         U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	m
Z
mZ ddlmZ ddlmZmZmZmZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZm Z m!Z! ddl"m#Z#m$Z$ ddl%m&Z& erddl'm(Z( ddl)m*Z* dZ+dZ,	 ddl-Z. e/ e0e1e.j2        3                    d          dd                             dk    rdZ,n# e4$ r 	 ddl.Z.n# e4$ r dZ+Y nw xY wY nw xY w e5g d          Z6	  G d d          Z7 edg d          Z8	  edg d          Z9	  eddg          Z:	 dWd(Z;dXd,Z<dYd/Z=dZd3Z>d[d7Z?d\d:Z@d]d<ZAd^d>ZBd_d?ZCd_d@ZDd_dAZEd_dBZFd_dCZGeCeFeEeeD ejH        e?dDE           ejH        e?dFE          eGdGZIdHeJdI<    G dJ dK          ZK G dL dMeK          ZL G dN dOeK          ZM G dP dQeK          ZNeM ejH        eLdDE           ejH        eLdFE          eN ejH        eLdFE          dRZOd%eJdS<   	 d`dadVZPdS )bzAuthentication helpers.    )annotationsN)standard_b64decodestandard_b64encode)
namedtuple)TYPE_CHECKINGAnyCallableDictMappingMutableMappingOptionalcast)quote)Binary)SON)_authenticate_aws)_authenticate_oidc_get_authenticator_OIDCProperties)ConfigurationErrorOperationFailure)saslprep)Hello)
ConnectionTF.   )r      )	GSSAPI
MONGODB-CRMONGODB-OIDCMONGODB-X509MONGODB-AWSPLAINSCRAM-SHA-1SCRAM-SHA-256DEFAULTc                  H    e Zd ZdZ ed           ZddZddZdd	ZddZ	dS )_CachedatareturnNonec                    d | _         d S Nr)   selfs    P/var/www/app.qaans.com/backend/venv/lib/python3.11/site-packages/pymongo/auth.py__init__z_Cache.__init__T   s    			    otherobjectboolc                >    t          |t                    rdS t          S )NT
isinstancer(   NotImplementedr0   r4   s     r1   __eq__z_Cache.__eq__W   s    eV$$ 	4r3   c                >    t          |t                    rdS t          S )NFr8   r;   s     r1   __ne__z_Cache.__ne__]   s    eV$$ 	5r3   intc                    | j         S r.   )	_hash_valr/   s    r1   __hash__z_Cache.__hash__b   s
    ~r3   N)r+   r,   )r4   r5   r+   r6   )r+   r?   )
__name__
__module____qualname__	__slots__hashrA   r2   r<   r>   rB    r3   r1   r(   r(   O   sv        IXI         
     r3   r(   MongoCredential)	mechanismsourceusernamepasswordmechanism_propertiescacheGSSAPIPropertiesservice_namecanonicalize_host_nameservice_realm_AWSPropertiesaws_session_tokenmechstrrK   Optional[str]userpasswdextraMapping[str, Any]databaser+   c           	        | dvr|t          |  d          | dk    r||dk    rt          d          |                    di           }|                    dd	          }|                    d
d          }|                    d          }	t          |||	          }
t	          | d|||
d          S | dk    r<|t          d          ||dk    rt          d          t	          | d|ddd          S | dk    ry||t          d          ||dk    rt          d          |                    di           }|                    d          }t          |          }t	          | d|||d          S | dk    r|                    di           }|                    d          }|                    dd          }g d}|                    d|          }|s|dk    rt          d          t          |||          }t	          | d|||t                                S | dk    r|p|pd}t	          | |||dd          S |p|pd }|t          d!          t	          | |||dt                                S )"z8Build and return a mechanism specific credentials tuple.)r!   r"   r    Nz requires a username.r   	$externalz:authentication source must be $external or None for GSSAPIauthmechanismpropertiesSERVICE_NAMEmongodbCANONICALIZE_HOST_NAMEFSERVICE_REALMrQ   r!   z+Passwords are not supported by MONGODB-X509z@authentication source must be $external or None for MONGODB-X509r"   z;username without a password is not supported by MONGODB-AWSz?authentication source must be $external or None for MONGODB-AWSAWS_SESSION_TOKEN)rV   r    request_token_callbackPROVIDER_NAME )z*.mongodb.netz*.mongodb-dev.netz*.mongodb-qa.netz*.mongodbgov.net	localhostz	127.0.0.1z::1allowed_hostsawsziauthentication with MONGODB-OIDC requires providing an request_token_callback or a provider_name of 'aws')rg   provider_namerk   r#   adminzA password is required.)r   
ValueErrorgetrP   rI   rU   r   r(   )rW   rK   rZ   r[   r\   r^   
propertiesrR   canonicalizerT   propsrV   	aws_propsrg   rm   default_allowedrk   
oidc_propssource_databases                      r1   _build_credentials_tuplerx   w   s    BBBt| D!?!?!?@@@x&K"7"7YZZZYY8"==
!~~ni@@!~~&>FF"77 %#/'
 
 
 t[$tLLL			$%RSSS&K"7"7_```t[$dDIII			$%bccc&K"7"7$Q   YY8"==
&NN+>??"5FGGG	t[$	4PPP			YY8"==
!+0H!I!I";;
 
 
 #HH% 	-5*@*@${   %#9''
 
 


 t[$
FHHUUU	 ;H;t_dFD$OOO 7H7>$%>???t_dFD&((SSSr3   firbytessecc                \    d                     d t          | |          D                       S )zXOR two byte strings together.r3   c                :    g | ]\  }}t          ||z  g          S rH   )rz   ).0xys      r1   
<listcomp>z_xor.<locals>.<listcomp>   s(    >>>1UAE7^^>>>r3   )joinzip)ry   r{   s     r1   _xorr      s+    88>>C>>>???r3   responseDict[bytes, bytes]c                Z    t          d |                     d          D                       S )z-Split a scram response into key, value pairs.c              3     K   | ]I}t          j        t           j        t          t          f         |                    d d                    V  JdS )   =   N)typingr   Tuplerz   split)r~   items     r1   	<genexpr>z(_parse_scram_response.<locals>.<genexpr>   s[         	FL.

40C0CDD     r3      ,)dictr   )r   s    r1   _parse_scram_responser      s<      NN4((     r3   credentialsrJ   -tuple[bytes, bytes, MutableMapping[str, Any]]c           	     D   | j         }|                    d                              dd                              dd          }t          t	          j        d                    }d|z   dz   |z   }t          d	d
|fdt          d|z             fddddifg          }|||fS )Nutf-8r   s   =3Dr   s   =2C    s   n=s   ,r=	saslStartr   rJ   payloads   n,,autoAuthorizer   optionsskipEmptyExchangeT)rL   encodereplacer   osurandomr   r   )r   rJ   rL   rZ   nonce
first_barecmds          r1   _authenticate_scram_startr      s     #H??7##++D&99AA$OODrz"~~..E&.J
)$v
2334 ,d34	
 C *c!!r3   connr   r,   c                p   | j         }|dk    r6d}t          j        }t          | j                                      d          }n6d}t          j        }t          || j                                      d          }| j        }| j	        }t          j        }	|j        }
|
rF|
                                r2t          |
t                    sJ |
j        J |
j        \  }}|
j        }n*t%          | |          \  }}}|                    ||          }|J |d         }t)          |          }t+          |d                   }|dk     rt-          d	          |d
         }|d         }|                    |          st-          d          d|z   }|j        r|j        \  }}}}nd\  }}}}|r||k    s||k    rmt          j        ||t5          |          |          } |	|d|                                          } |	|d|                                          }||||f|_         ||                                          }d                    |||f          } |	|||                                          }dt;          t=          ||                    z   }d                    ||f          }t;           |	|||                                                    }t?          dd|d         fdtA          |          fg          }|                    ||          }t)          |d                   }t          j!        |d         |          st-          d          |d         sVt?          dd|d         fdtA          d          fg          }|                    ||          }|d         st-          d          dS dS )zAuthenticate using SCRAM.r%   sha256r   sha1Nr      ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Keyr   s   p=saslContinuer   conversationId   vz%Server returned an invalid signature.doner3   z%SASL conversation failed to complete.)"rL   hashlibr   r   rM   r   r   _password_digestrK   rO   hmacHMACauth_ctxspeculate_succeededr9   _ScramContext
scram_dataspeculative_authenticater   commandr   r?   r   
startswithr*   pbkdf2_hmacr   digestr   r   r   r   r   compare_digest) r   r   rJ   rL   r   	digestmodr*   rK   rO   _hmacctxr   r   resr   server_firstparsed
iterationssaltrnoncewithout_proof
client_key
server_keycsaltciterationssalted_pass
stored_keyauth_msg
client_sigclient_proofclient_final
server_sigs                                    r1   _authenticate_scramr      s   #HO##N	,--44W==L	+*>??FFwOOFE IE
-C
 (s&&(( (#}-----~)))Nz*!:;	!R!Rz3ll63''???y>L"<00FVD\""JDLMMM$<DD\FU## DBCCC 6)Mz L5:Z2
J{{5K2
J{  @**C*C)&$8J48P8PR\]]U;yAAHHJJ
U;yAAHHJJ
 *dJ?
:&&--//Jyy*lMBCCHz8Y77>>@@J-d:z.J.JKKKL99m\:;;L#EE*h	$J$J$Q$Q$S$STTJ
s#345|,,-	
 C ,,vs
#
#C"3y>22Fvd|Z88 HFGGG v; 
L#!3'7#89F3KK(
 
 ll63''6{ 	L"#JKKK
L 
L	L 	Lr3   rL   rM   c                   t          |t                    st          d          t          |          dk    rt	          d          t          | t                    st          d          t          j                    }|  d| }|                    |                    d                     |	                                S )z0Get a password digest to use for authentication.z#password must be an instance of strr   zpassword can't be emptyz#username must be an instance of strz:mongo:r   )
r9   rX   	TypeErrorlenro   r   md5updater   	hexdigest)rL   rM   md5hashr*   s       r1   r   r   ?  s    h$$ ?=>>>
8}}2333h$$ ?=>>>kmmG))x))DNN4;;w''(((r3   r   c                    t          ||          }t          j                    }|  | | }|                    |                    d                     |                                S )z*Get an auth key to use for authentication.r   )r   r   r   r   r   r   )r   rL   rM   r   r   r*   s         r1   	_auth_keyr   N  sa    h11FkmmG'X'v''DNN4;;w''(((r3   hostnamec                <   t          j        | dddt           j        t           j                  d         \  }}}}}	 t          j        |t           j                  }n)# t           j        $ r |                                cY S w xY w|d                                         S )z2Canonicalize hostname following MIT-krb5 behavior.Nr   )socketgetaddrinfoIPPROTO_TCPAI_CANONNAMEgetnameinfoNI_NAMEREQDgaierrorlower)r   afsocktypeproto	canonnamesockaddrnames          r1   _canonicalize_hostnamer   W  s     06/A$1f0&2E0 00	,B%H!!(F,>??? ! ! !     ! 7==??s   A #B Bc                4   t           st          d          	 | j        }| j        }| j        }|j        d         }|j        rt          |          }|j        dz   |z   }|j	        |dz   |j	        z   }|t          rVd                    t          |          t          |          f          }t          j        ||t          j                  \  }}	nld|v r|                    dd          \  }
}n|d}}
t          j        |t          j        |
||          \  }}	n#t          j        |t          j                  \  }}	|t          j        k    rt%          d	          	 t          j        |	d
          dk    rt%          d          t          j        |	          }t+          ddd|fdg          }|                    d|          }t/          d          D ]}t          j        |	t1          |d                             }|dk    rt%          d          t          j        |	          pd
}t+          dd|d         fd|fg          }|                    d|          }|t          j        k    r nt%          d          t          j        |	t1          |d                             dk    rt%          d          t          j        |	t          j        |	          |          dk    rt%          d          t          j        |	          }t+          dd|d         fd|fg          }|                    d|           t          j        |	           dS # t          j        |	           w xY w# t          j        $ r"}t%          t1          |                    dd}~ww xY w)zAuthenticate using GSSAPI.zEThe "kerberos" module must be installed to use GSSAPI authentication.r   @N:)gssflagsr   )r   rZ   domainrM   z&Kerberos context failed to initialize.ri   z*Unknown kerberos failure in step function.r   )rJ   r   r   r   r`   
   r   r   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)HAVE_KERBEROSr   rL   rM   rN   addressrS   r   rR   rT   _USE_PRINCIPALr   r   kerberosauthGSSClientInitGSS_C_MUTUAL_FLAGr   AUTH_GSS_COMPLETEr   authGSSClientStepauthGSSClientResponser   r   rangerX   authGSSClientUnwrapauthGSSClientWrapauthGSSClientCleanKrbError)r   r   rL   rM   rs   hostservice	principalresultr   rZ   r   r   r   r   _excs                    r1   _authenticate_gssapir  f  s    
 S
 
 	
k3''0 |A' 	0)$//D$s*T1*me&99G   HHeHoouX%GHH	&8Y1K   (??#+>>#q#9#9LD&&#+T&D&8%7!%   #4WxGabbbKFCX///"#KLLL@	-
 )#r22a77&'STTT 4S99G$+((	 C ||K55H 2YY V V!3CXi=P9Q9QRRR<<*+WXXX"8==C+)84D+EF"G,   <<S99X777E 8 ''TUUU +CXi5H1I1IJJaOO&'YZZZ)#x/Mc/R/RT\]]abbb&'WXXX4S99G'%x0@'AB( C LLc*** ',,,,,H',,,, 3 3 3s3xx((d23s1   EM& GM 7M& M##M& &N5NNc                    | j         }| j        }| j        }d| d|                                 }t	          dddt          |          fdg          }|                    ||           dS )z(Authenticate using SASL PLAIN (RFC 4616) r   )rJ   r#   r   r   N)rK   rL   rM   r   r   r   r   )r   r   rK   rL   rM   r   r   s          r1   _authenticate_plainr    s    F#H#H.h..H..6688G
"w( 		
 C 	LLr3   c                    |j         }|r|                                rdS t          | |j                                                  }|                    d|           dS )z Authenticate using MONGODB-X509.Nr`   )r   r   _X509Contextr   speculate_commandr   )r   r   r   r   s       r1   _authenticate_x509r    s`    
-C
 s&&(( 
{DL
1
1
C
C
E
ECLLc"""""r3   c                    | j         }| j        }| j        }|                    |ddi          }|d         }t	          |||          }t          dd|fd|fd|fg          }|                    ||           dS )zAuthenticate using MONGODB-CR.getnoncer   r   authenticater   rZ   keyN)rK   rL   rM   r   r   r   )	r   r   rK   rL   rM   r   r   r  querys	            r1   _authenticate_mongo_crr    s    F#H#H||FZO44HWE
E8X
.
.C $vx&87E:JUTWLYZZELLr3   c                R   |j         dk    r|j        r|j        }nW| j        }|                                }|dz   | j        z   |d<   |                    ||d                              dg           }d|v rt          | |d          S t          | |d          S t          | |d          S )N   r   saslSupportedMechsF)publish_eventsr%   r$   )max_wire_versionnegotiated_mechsrK   	hello_cmdrL   r   rp   r   )r   r   mechsrK   r   s        r1   _authenticate_defaultr#    s    !!  	b)EE 'F..""C(.{7K(KC$%LLULCCGGH\^`aaEe##&{D/JJJ&{D-HHH";mDDDr3   r$   )rJ   r%   )r   r   r!   r"   r#   r$   r%   r&   z!Mapping[str, Callable[..., None]]	_AUTH_MAPc                  F    e Zd ZddZedd
            ZddZddZddZdS )_AuthContextr   rI   r   tuple[str, int]r+   r,   c                0    || _         d | _        || _        d S r.   )r   r   r   )r0   r   r   s      r1   r2   z_AuthContext.__init__$  s    &EI%r3   credsOptional[_AuthContext]c                    t                               | j                  }|rt          t           || |                    S d S r.   )_SPECULATIVE_AUTH_MAPrp   rJ   r   r&  )r)  r   spec_clss      r1   from_credentialsz_AuthContext.from_credentials)  sC     ),,U_== 	@hhug&>&>???tr3   "Optional[MutableMapping[str, Any]]c                    t           r.   )NotImplementedErrorr/   s    r1   r  z_AuthContext.speculate_command2  s    !!r3   helloHello[Mapping[str, Any]]c                    |j         | _         d S r.   )r   )r0   r2  s     r1   parse_responsez_AuthContext.parse_response5  s    (-(F%%%r3   r6   c                *    t          | j                  S r.   )r6   r   r/   s    r1   r   z _AuthContext.speculate_succeeded8  s    D1222r3   N)r   rI   r   r'  r+   r,   )r)  rI   r   r'  r+   r*  r+   r/  )r2  r3  r+   r,   )r+   r6   )	rC   rD   rE   r2   staticmethodr.  r  r5  r   rH   r3   r1   r&  r&  #  s           
    \" " " "G G G G3 3 3 3 3 3r3   r&  c                  (     e Zd Zd fd	ZddZ xZS )r   r   rI   r   r'  rJ   rX   r+   r,   c                h    t                                          ||           d | _        || _        d S r.   )superr2   r   rJ   )r0   r   r   rJ   	__class__s       r1   r2   z_ScramContext.__init__=  s1     	g...9="r3   r/  c                r    t          | j        | j                  \  }}}| j        j        |d<   ||f| _        |S )Ndb)r   r   rJ   rK   r   )r0   r   r   r   s       r1   r  z_ScramContext.speculate_commandD  s=    !:4;KT^!\!\z3$+D	 *-
r3   )r   rI   r   r'  rJ   rX   r+   r,   r7  )rC   rD   rE   r2   r  __classcell__)r<  s   @r1   r   r   <  sQ        # # # # # #       r3   r   c                      e Zd ZddZdS )r  r+   MutableMapping[str, Any]c                ^    t          ddg          }| j        j        | j        j        |d<   |S )Nr  )rJ   r!   rZ   )r   r   rL   )r0   r   s     r1   r  z_X509Context.speculate_commandN  s6    &(EFGG$0*3CK
r3   N)r+   rA  rC   rD   rE   r  rH   r3   r1   r  r  M  s(             r3   r  c                      e Zd ZddZdS )_OIDCContextr+   r/  c                    t          | j        | j                  }|                    d          }|d S | j        j        |d<   |S )NFr>  )r   r   r   auth_start_cmdrK   )r0   authenticatorr   s      r1   r  z_OIDCContext.speculate_commandV  sG    *4+;T\JJ**511;4$+D	
r3   Nr7  rC  rH   r3   r1   rE  rE  U  s(             r3   rE  )r!   r$   r%   r    r&   r,  reauthenticater6   c                x    | j         }t          |         }|dk    rt          | ||           dS  || |           dS )zAuthenticate connection.r    N)rJ   r$  r   )r   r   rI  rJ   	auth_funcs        r1   r  r  h  sQ     %I)$IN"";n=====	+t$$$$$r3   )rW   rX   rK   rY   rZ   rX   r[   rX   r\   r]   r^   rY   r+   rI   )ry   rz   r{   rz   r+   rz   )r   rz   r+   r   )r   rI   rJ   rX   r+   r   )r   rI   r   r   rJ   rX   r+   r,   )rL   rX   rM   rX   r+   rX   )r   rX   rL   rX   rM   rX   r+   rX   )r   rX   r+   rX   )r   rI   r   r   r+   r,   )F)r   rI   r   r   rI  r6   r+   r,   )Q__doc__
__future__r   	functoolsr   r   r   r   r   base64r   r   collectionsr   r   r   r	   r
   r   r   r   r   urllib.parser   bson.binaryr   bson.sonr   pymongo.auth_awsr   pymongo.auth_oidcr   r   r   pymongo.errorsr   r   pymongo.saslprepr   pymongo.hellor   pymongo.poolr   r   r   winkerberosr   tuplemapr?   __version__r   ImportError	frozenset
MECHANISMSr(   rI   rP   rU   rx   r   r   r   r   r   r   r   r  r  r  r  r#  partialr$  __annotations__r&  r   r  rE  r,  r  rH   r3   r1   <module>rc     s      " " " " " "       				   9 9 9 9 9 9 9 9 " " " " " "	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	                   . . . . . . U U U U U U U U U U ? ? ? ? ? ? ? ? % % % % % % (######''''''	""""uSSh*0055bqb9::;;vEE       Y
 
 
 
 :       . *TTT  ? :SSS   6 ,/B.CDD :MT MT MT MT`@ @ @ @
   " " " "(TL TL TL TLn         r3 r3 r3 r3j   "# # # #       E E E E$ #(&$ $9$%8MRRR&Y&':oVVV$	0 	0	 	 	 	 	3 3 3 3 3 3 3 32    L   "    <       <    !$9$]mLLL&Y&}PPP  y /JJJ, ,      LQ	% 	% 	% 	% 	% 	% 	%s6   ?C C"CC"CC"CC"!C"