o
    {gK-                     @  s  d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	m
Z
mZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lmZm Z  dd
l!m"Z" e	rjddl#m$Z$ ddl%m&Z& dZ'dddZ(eG dd dZ)dddZ*dS ) z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)MongoCredential)
ConnectionTcredentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                 C  s   | j jr| j jS | j}| j}|jsDd}|j}|D ]}||d kr#d}q|dr5|d |dd  r5d}q|sDtd|d  d| t	||d| j _| j jS )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar!   mechanism_propertiesenvironmentallowed_hosts
startswithendswithr   r   )r   r   principal_namer"   foundr'   patt r-   z/var/www/bot.gig.net.ua/public_html/telegram/P1/HellBot/venv/lib/python3.10/site-packages/pymongo/synchronous/auth_oidc.py_get_authenticator/   s&    r/   c                   @  s  e Zd ZU ded< ded< eddZded< eddZded	< eddZd
ed< eddZded< ee	j
dZded< eddZded< d<ddZd<ddZd=ddZd>d d!Zd<d"d#Zd?d$d%Zd@d(d)ZdAd-d.ZdBd0d1ZdCd3d4Zd>d5d6ZdDd8d9ZdEd:d;ZdS )Fr   strr!   r   r"   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryzthreading.Locklockfloatlast_call_timeconnr   r   Optional[Mapping[str, Any]]c                 C  s&   |  | | jjr| |S | |S )z(Handle a reauthenticate from the server.)_invalidater"   callback_authenticate_machine_authenticate_human)selfr<   r-   r-   r.   reauthenticateW   s   


z!_OIDCAuthenticator.reauthenticatec                 C  sL   |j }|r| r|j}|r|d r| j|_|S | jjr!| |S | |S )z'Handle an initial authenticate request.done)	auth_ctxspeculate_succeededspeculative_authenticater7   oidc_token_gen_idr"   r?   r@   rA   )rB   r<   ctxrespr-   r-   r.   authenticate`   s   

z_OIDCAuthenticator.authenticate"Optional[MutableMapping[str, Any]]c                 C  s   | j sdS | d| j iS )z-Get the appropriate speculative auth command.Njwt)r4   _get_start_command)rB   r-   r-   r.   get_spec_auth_cmdr   s   z$_OIDCAuthenticator.get_spec_auth_cmdMapping[str, Any]c              
   C  sX   | j r'z| |W S  ty& } z| |r!| |W  Y d }~S  d }~ww | |S N)r4   _sasl_start_jwtr   _is_auth_errorr@   )rB   r<   er-   r-   r.   r@   x   s   

z(_OIDCAuthenticator._authenticate_machinec              
   C  s   | j r'z| |W S  ty& } z| |r!| |W  Y d }~S  d }~ww | jrQz| |W S  tyP } z| |rKd | _| |W  Y d }~S  d }~ww | d }| ||}| ||S rQ   )	r4   rR   r   rS   rA   r3   rN   _run_command_sasl_continue_jwt)rB   r<   rT   cmd
start_respr-   r-   r.   rA      s,   
	

z&_OIDCAuthenticator._authenticate_humanc           
      C  s\  | j }|jd u}|r| jd u rd S |jr|j}|jr|j}| j}|r$|S |d u r,|s,d S |s|d ur| jn | j}||krF|W  d    S t | j }|tk rXt	t|  t | _|rit
}| jd ushJ ntt pnt}t|t| j| j| j jd}||}	t|	tstd|	j| _|	j| _|  jd7  _W d    | jS 1 sw   Y  | jS )N)timeout_secondsversionr3   r5   r!   z2Callback result must be of type OIDCCallbackResultr    )r"   human_callbackr5   r?   r4   r9   timer;   r   sleepr   r6   r   r   r   r   r3   r!   fetch
isinstancer   
ValueErrorr7   )
rB   r"   is_humancb
prev_token	new_tokendeltatimeoutcontextrJ   r-   r-   r.   _get_access_token   sX   




  z$_OIDCAuthenticator._get_access_tokenrW   MutableMapping[str, Any]c              
   C  sB   z	|j d|ddW S  ty  } z| |r| |  d }~ww )Nz	$externalT)	no_reauth)commandr   rS   r>   )rB   r<   rW   rT   r-   r-   r.   rU      s   

z_OIDCAuthenticator._run_commanderr	Exceptionboolc                 C  s   t |tsdS |jtkS )NF)r_   r   coder   )rB   rl   r-   r-   r.   rS      s   

z!_OIDCAuthenticator._is_auth_errorNonec                 C  s*   |j pd}|d ur|| jk rd S d | _d S )Nr   )rH   r7   r4   )rB   r<   r7   r-   r-   r.   r>      s   

z_OIDCAuthenticator._invalidaterX   c                 C  s^   d | _ d | _t|d }d|v rtdi || _|  }| j|_| 	d|i|}| 
||S )NpayloadissuerrM   r-   )r4   r3   bsondecoder   r5   rh   r7   rH   _get_continue_commandrU   )rB   r<   rX   start_payloadr4   rW   r-   r-   r.   rV      s   z%_OIDCAuthenticator._sasl_continue_jwtc                 C  s*   |   }| j|_| d|i}| ||S )NrM   )rh   r7   rH   rN   rU   )rB   r<   r4   rW   r-   r-   r.   rR     s   z"_OIDCAuthenticator._sasl_start_jwtrq   c                 C  s:   |d u r| j }|rd|i}ni }tt|}dd|dS )Nnr    zMONGODB-OIDC)	saslStart	mechanismrq   )r!   r   rs   encode)rB   rq   r*   bin_payloadr-   r-   r.   rN     s   
z%_OIDCAuthenticator._get_start_commandc                 C  s   t t|}d||d dS )Nr    conversationId)saslContinuerq   r|   )r   rs   rz   )rB   rq   rX   r{   r-   r-   r.   ru     s
   z(_OIDCAuthenticator._get_continue_command)r<   r   r   r=   )r   rL   )r<   r   r   rP   )r   r2   )r<   r   rW   ri   r   rP   )rl   rm   r   rn   )r<   r   r   rp   )r<   r   rX   rP   r   rP   )rq   r=   r   ri   )rq   rP   rX   rP   r   ri   )__name__
__module____qualname____annotations__r   r3   r4   r5   r7   	threadingLockr9   r;   rC   rK   rO   r@   rA   rh   rU   rS   r>   rV   rR   rN   ru   r-   r-   r-   r.   r   L   s,   
 

	



!
8





r<   r   rC   rn   r=   c                 C  s$   t | |j}|r||S ||S )z Authenticate using MONGODB-OIDC.)r/   r   rC   rK   )r   r<   rC   authenticatorr-   r-   r.   _authenticate_oidc  s   

r   )r   r   r   r   r   r   )r   r   r<   r   rC   rn   r   r=   )+__doc__
__future__r   r   r\   dataclassesr   r   typingr   r   r   r   r	   r
   rs   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.auth_sharedr   pymongo.synchronous.poolr   _IS_SYNCr/   r   r   r-   r-   r-   r.   <module>   s*    ,
 P