
    l h-                    &   d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	m
Z
mZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lmZm Z  dd
l!m"Z" e	rddl#m$Z$ ddl%m&Z& dZ'	 	 	 	 	 	 ddZ(e G d d             Z)	 	 	 	 	 	 	 	 ddZ*y)z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)MongoCredential)
ConnectionT_OIDCAuthenticatorc                   | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  bd}|j
                  }|D ]9  }||d   k(  rd}|j                  d      s |d   j                  |dd        s8d}; |st        d|d    d|       t        ||      | j                   _        | j                   j                  S )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar   mechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r   )credentialsaddressprincipal_namer    foundr%   patts          /var/www/html/SchoolMeal/SchoolMeal/pds_admin_SchoolMeal/Backend/venv/lib/python3.12/site-packages/pymongo/synchronous/auth_oidc.py_get_authenticatorr.   /   s       %%% !))N11J   ,"00! 	Dwqz!&71:+>+>tABx+H		
 $)'!*5]^k]lm 
 0T^_K!!!    c                  ^   e Zd ZU ded<   ded<    ed      Zded<    ed      Zded	<    ed      Zd
ed<    ed      Zded<    ee	j                        Zded<    ed      Zded<   d!dZd!dZd"dZd#dZd!dZd$dZd%dZd&dZd'dZ	 	 	 	 	 	 d(dZd#dZd)dZ	 	 	 	 	 	 d*d Zy)+r   strr   r   r    N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryzthreading.Locklockfloatlast_call_timec                    | j                  |       | j                  j                  r| j                  |      S | j	                  |      S )z(Handle a reauthenticate from the server.)_invalidater    callback_authenticate_machine_authenticate_human)selfconns     r-   reauthenticatez!_OIDCAuthenticator.reauthenticateW   sA     	??##--d33''--r/   c                    |j                   }|r6|j                         r&|j                  }|r|d   r| j                  |_        |S | j
                  j                  r| j                  |      S | j                  |      S )z'Handle an initial authenticate request.done)	auth_ctxspeculate_succeededspeculative_authenticater8   oidc_token_gen_idr    r?   r@   rA   )rB   rC   ctxresps       r-   authenticatez_OIDCAuthenticator.authenticate`   ss     mm3**,//DV)-):):&
 ??##--d33''--r/   c                V    | j                   sy| j                  d| j                   i      S )z-Get the appropriate speculative auth command.Njwt)r5   _get_start_command)rB   s    r-   get_spec_auth_cmdz$_OIDCAuthenticator.get_spec_auth_cmdr   s*      &&t/@/@'ABBr/   c                    | j                   r	 | j                  |      S | j                  |      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY wN)r5   _sasl_start_jwtr   _is_auth_errorr@   )rB   rC   es      r-   r@   z(_OIDCAuthenticator._authenticate_machinex   sj    
 ++D11
 ##D))	 $ &&q)55d;;s    0 	A&!A!A& A!!A&c                   | j                   r	 | j                  |      S | j
                  r	 | j                  |      S | j                  d       }| j                  ||      }| j                  ||      S # t        $ r-}| j                  |      r| j	                  |      cY d }~S  d }~ww xY w# t        $ r4}| j                  |      rd | _        | j	                  |      cY d }~S  d }~ww xY wrS   )	r5   rT   r   rU   rA   r4   rP   _run_command_sasl_continue_jwt)rB   rC   rV   cmd
start_resps        r-   rA   z&_OIDCAuthenticator._authenticate_human   s    
 ++D11 ++D11 %%d+&&tS1
&&tZ88/ $ &&q)33D99 $ &&q))-D&33D99	sF   A2 B+ 2	B(;!B#B("B##B(+	C(4(C#C("C##C(c                    | j                   }|j                  d u}|r| j                  y |j                  r|j                  }|j                  r|j                  }| j                  }|r|S |sy |s{|x| j
                  5  | j                  }||k7  r|cd d d        S t        j                         | j                  z
  }|t        k  rt        j                  t        |z
         t        j                         | _        |rt        }| j                  J t        t               xs t              }t        |t        | j                   | j                  | j                   j"                        }|j%                  |      }	t'        |	t(              st+        dt-        |	             |	j                   | _        |	j                  | _        | xj.                  dz  c_        d d d        | j                  S | j                  S # 1 sw Y   | j                  S xY w)N)timeout_secondsversionr4   r6   r   z8Callback result must be of type OIDCCallbackResult, not r   )r    r$   r6   r?   r5   r:   timer<   r   sleepr   r7   r   r   r   r   r4   r   fetch
isinstancer   
ValueErrortyper8   )
rB   r    is_humancb
prev_token	new_tokendeltatimeoutcontextrL   s
             r-   _get_access_tokenz$_OIDCAuthenticator._get_access_token   s   __
 ,,D8-$$B$$**B&&
:jbn  ' !--	
*$ '  ' 		d&9&9955JJ9EAB&*iik#<G==444!)+"Q1QRG-$+,"&"4"4!]]!__55 xx(!$(:;$RSWX\S]R^_  &*%7%7"$($5$5!!!Q&!A 'D    t   E 'D    s   G9D;G99Hc                    	 |j                  d|d      S # t        $ r(}| j                  |      r| j                  |        d }~ww xY w)Nz	$externalT)	no_reauth)commandr   rU   r>   )rB   rC   rZ   rV   s       r-   rX   z_OIDCAuthenticator._run_command   sK    	<<SD<AA 	""1%  &	s    	A#AAc                J    t        |t              sy|j                  t        k(  S )NF)rb   r   coder   )rB   errs     r-   rU   z!_OIDCAuthenticator._is_auth_error   s     #/0xx777r/   c                V    |j                   xs d}||| j                  k  ry d | _        y )Nr   )rJ   r8   r5   )rB   rC   r8   s      r-   r>   z_OIDCAuthenticator._invalidate   s2     --2#t7H7H(H r/   c                   d | _         d | _        t        j                  |d         }d|v rt	        di || _        | j                         }| j                  |_        | j                  d|i|      }| j                  ||      S )NpayloadissuerrO    )r5   r4   bsondecoder   r6   rl   r8   rJ   _get_continue_commandrX   )rB   rC   r[   start_payloadr5   rZ   s         r-   rY   z%_OIDCAuthenticator._sasl_continue_jwt   s     !!"kk*Y*?@}$'8-8DM--/!%!2!2((%)>
K  s++r/   c                    | j                         }| j                  |_        | j                  d|i      }| j	                  ||      S )NrO   )rl   r8   rJ   rP   rX   )rB   rC   r5   rZ   s       r-   rT   z"_OIDCAuthenticator._sasl_start_jwt  sF    --/!%!2!2%%ul&;<  s++r/   c                x    || j                   }|rd|i}ni }t        t        j                  |            }dd|dS )Nnr   zMONGODB-OIDC)	saslStart	mechanismru   )r   r   rx   encode)rB   ru   r*   bin_payloads       r-   rP   z%_OIDCAuthenticator._get_start_command	  sB    ?!]]N/T[[12^TTr/   c                P    t        t        j                  |            }d||d   dS )Nr   conversationId)saslContinueru   r   )r   rx   r   )rB   ru   r[   r   s       r-   rz   z(_OIDCAuthenticator._get_continue_command  s0     T[[12"()9:
 	
r/   )rC   r   returnOptional[Mapping[str, Any]])r   z"Optional[MutableMapping[str, Any]])rC   r   r   Mapping[str, Any])r   r3   )rC   r   rZ   MutableMapping[str, Any]r   r   )rr   	Exceptionr   bool)rC   r   r   None)rC   r   r[   r   r   r   )ru   r   r   r   )ru   r   r[   r   r   r   )__name__
__module____qualname____annotations__r   r4   r5   r6   r8   	threadingLockr:   r<   rD   rM   rQ   r@   rA   rl   rX   rU   r>   rY   rT   rP   rz   rw   r/   r-   r   r   L   s    M#(#6M=6"'"5L-5&+D&9H#9a(L#( @D.@!!,NE,..$C*9B8!t8
!,,,=,	,,U
(
6G
	!
r/   c                v    t        | |j                        }|r|j                  |      S |j                  |      S )z Authenticate using MONGODB-OIDC.)r.   r)   rD   rM   )r(   rC   rD   authenticators       r-   _authenticate_oidcr     s9     '{DLLAM++D11))$//r/   )r(   r   r)   ztuple[str, int]r   r   )r(   r   rC   r   rD   r   r   r   )+__doc__
__future__r   r   r_   dataclassesr   r   typingr   r   r   r	   r
   r   rx   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.auth_sharedr   pymongo.synchronous.poolr   _IS_SYNCr.   r   r   rw   r/   r-   <module>r      s    + "   ( O O   #
 
 
 @ ?33" "+:"": N
 N
 N
b0 0(20DH0 0r/   