
    =hY              
         U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	m
Z
mZ ddlmZ ddlmZmZmZmZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZm Z m!Z! ddl"m#Z#m$Z$ ddl%m&Z& erddl'm(Z( ddl)m*Z* dZ+dZ,	 ddl-Z. e/ e0e1e.jd                  jg                  d      dd             dk\  rdZ, e5g d      Z6	  G d d      Z7 edg d      Z8	  edg d      Z9	  eddg      Z:	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d=dZ;d>d Z<d?d!Z=	 	 	 	 	 	 d@d"Z>dAd#Z?dBd$Z@dCd%ZAdDd&ZBdEd'ZCdEd(ZDdEd)ZEdEd*ZFdEd+ZGeCeFeEeeD ej                  e?d,-       ej                  e?d.-      eGd/ZId0eJd1<    G d2 d3      ZK G d4 d5eK      ZL G d6 d7eK      ZM G d8 d9eK      ZNeM ej                  eLd,-       ej                  eLd.-      eN ej                  eLd.-      d:ZOdeJd;<   	 dF	 	 	 	 	 	 	 dGd<ZPy# e4$ r 	 ddl.Z.n# e4$ r dZ+Y nw xY wY Kw xY w)HzAuthentication helpers.    )annotationsN)standard_b64decodestandard_b64encode)
namedtuple)TYPE_CHECKINGAnyCallableDictMappingMutableMappingOptionalcast)quote)Binary)SON)_authenticate_aws)_authenticate_oidc_get_authenticator_OIDCProperties)ConfigurationErrorOperationFailure)saslprep)Hello)
ConnectionTF.   )r      )	GSSAPI
MONGODB-CRMONGODB-OIDCMONGODB-X509MONGODB-AWSPLAINSCRAM-SHA-1SCRAM-SHA-256DEFAULTc                  @    e Zd ZdZ ed       ZddZddZddZd	dZ	y)
_Cachedatac                    d | _         y Nr)   selfs    \/var/www/html/phonemate/phone_mate_backend/venv/lib/python3.12/site-packages/pymongo/auth.py__init__z_Cache.__init__T   s	    	    c                0    t        |t              ryt        S )NT
isinstancer(   NotImplementedr.   others     r/   __eq__z_Cache.__eq__W   s    eV$r1   c                0    t        |t              ryt        S )NFr3   r6   s     r/   __ne__z_Cache.__ne__]   s    eV$r1   c                    | j                   S r,   )	_hash_valr-   s    r/   __hash__z_Cache.__hash__b   s    ~~r1   N)returnNone)r7   objectr>   bool)r>   int)
__name__
__module____qualname__	__slots__hashr<   r0   r8   r:   r=    r1   r/   r(   r(   O   s$    IXI
r1   r(   MongoCredential)	mechanismsourceusernamepasswordmechanism_propertiescacheGSSAPIPropertiesservice_namecanonicalize_host_nameservice_realm_AWSPropertiesaws_session_tokenMapping[str, Any]c           	         | dvr|t        |  d      | dk(  rw||dk7  rt        d      |j                  di       }|j                  dd	      }|j                  d
d      }|j                  d      }	t        |||	      }
t	        | d|||
d      S | dk(  r/|t        d      ||dk7  rt        d      t	        | d|ddd      S | dk(  r`||t        d      ||dk7  rt        d      |j                  di       }|j                  d      }t        |      }t	        | d|||d      S | dk(  r|j                  di       }|j                  d      }|j                  dd      }g d}|j                  d|      }|s|dk7  rt        d      t        |||      }t	        | d|||t                     S | dk(  r|xs |xs d}t	        | |||dd      S |xs |xs d }|t        d!      t	        | |||dt                     S )"z8Build and return a mechanism specific credentials tuple.)r!   r"   r    Nz requires a username.r   	$externalz:authentication source must be $external or None for GSSAPIauthmechanismpropertiesSERVICE_NAMEmongodbCANONICALIZE_HOST_NAMEFSERVICE_REALMrQ   r!   z+Passwords are not supported by MONGODB-X509z@authentication source must be $external or None for MONGODB-X509r"   z;username without a password is not supported by MONGODB-AWSz?authentication source must be $external or None for MONGODB-AWSAWS_SESSION_TOKEN)rV   r    request_token_callbackPROVIDER_NAME )z*.mongodb.netz*.mongodb-dev.netz*.mongodb-qa.netz*.mongodbgov.net	localhostz	127.0.0.1z::1allowed_hostsawsziauthentication with MONGODB-OIDC requires providing an request_token_callback or a provider_name of 'aws')r`   provider_namerd   r#   adminzA password is required.)r   
ValueErrorgetrP   rI   rU   r   r(   )mechrK   userpasswdextradatabase
propertiesrR   canonicalizerT   propsrV   	aws_propsr`   rf   default_allowedrd   
oidc_propssource_databases                      r/   _build_credentials_tuplerv   w   sq    BBt| D6)>!?@@x&K"7YZZYY8"=
!~~ni@!~~&>F"7 %#/'
 t[$tLL		$%RSS&K"7_``t[$dDII		$%bcc&K"7$Q  YY8"=
&NN+>?"5FG	t[$	4PP		YY8"=
!+0H!I";
 #H%-5*@${  %#9''


 t[$
FHUU	 ;H;t_dFD$OO 7H7>$%>??t_dFD&(SSr1   c           
         dj                  t        | |      D cg c]  \  }}t        ||z  g       c}}      S c c}}w )zXOR two byte strings together.r1   )joinzipbytes)firsecxys       r/   _xorr      s7    88C>1UAE7^>??>s   <
c                D    t        d | j                  d      D              S )z-Split a scram response into key, value pairs.c              3     K   | ]E  }t        j                  t         j                  t        t        f   |j	                  d d             G yw)   =   N)typingr   Tuplerz   split).0items     r/   	<genexpr>z(_parse_scram_response.<locals>.<genexpr>   s;      (D 	FLL.

40CD(s   AA   ,)dictr   )responses    r/   _parse_scram_responser      s%     NN4(  r1   c           	         | j                   }|j                  d      j                  dd      j                  dd      }t        t	        j
                  d            }d|z   dz   |z   }t        d	d
|fdt        d|z         fddddifg      }|||fS )Nutf-8r   s   =3Dr   s   =2C    s   n=s   ,r=	saslStartr   rJ   payloads   n,,autoAuthorizer   optionsskipEmptyExchangeT)rL   encodereplacer   osurandomr   r   )credentialsrJ   rL   rk   nonce
first_barecmds          r/   _authenticate_scram_startr      s     ##H??7#++D&9AA$ODrzz"~.E&.J
)$v
234 ,d34	
C *c!!r1   c                   | j                   }|dk(  r7d}t        j                  }t        | j                        j                  d      }n7d}t        j                  }t        || j                        j                  d      }| j                  }| j                  }t        j                  }	|j                  }
|
rL|
j                         r<t        |
t              sJ |
j                   J |
j                   \  }}|
j"                  }n"t%        | |      \  }}}|j'                  ||      }|J |d   }t)        |      }t+        |d         }|dk  rt-        d	      |d
   }|d   }|j/                  |      st-        d      d|z   }|j0                  r|j0                  \  }}}}nd\  }}}}|r
||k7  s||k7  r\t        j2                  ||t5        |      |      } |	|d|      j7                         } |	|d|      j7                         }||||f|_         ||      j7                         }dj9                  |||f      } |	|||      j7                         }dt;        t=        ||            z   }dj9                  ||f      }t;         |	|||      j7                               }t?        dd|d   fdtA        |      fg      }|j'                  ||      }t)        |d         }t        jB                  |d   |      st-        d      |d   sAt?        dd|d   fdtA        d      fg      }|j'                  ||      }|d   st-        d      yy)zAuthenticate using SCRAM.r%   sha256r   sha1Nr      ii   z+Server returned an invalid iteration count.   s   rz!Server returned an invalid nonce.s	   c=biws,r=)NNNNs
   Client Keys
   Server Keyr   s   p=saslContinuer   conversationId   vz%Server returned an invalid signature.doner1   z%SASL conversation failed to complete.)"rL   hashlibr   r   rM   r   r   _password_digestrK   rO   hmacHMACauth_ctxspeculate_succeededr4   _ScramContext
scram_dataspeculative_authenticater   commandr   rB   r   
startswithr*   pbkdf2_hmacr   digestrx   r   r   r   r   compare_digest) r   connrJ   rL   r   	digestmodr*   rK   rO   _hmacctxr   r   resr   server_firstparsed
iterationssaltrnoncewithout_proof
client_key
server_keycsaltciterationssalted_pass
stored_keyauth_msg
client_sigclient_proofclient_final
server_sigs                                    r/   _authenticate_scramr      s\   ##HO#NN	,,-44W=LL	+*>*>?FFwOFE IIE
--C
s&&(#}---~~)))NNz**!:;	!Rz3ll63'??y>L"<0FVD\"JDLMM$<DD\FU#BCC 6)Mzz5:ZZ2
J{5K2
J{ **C))&$8J48PR\];yAHHJ
;yAHHJ
 *dJ?
:&--/Jyy*lMBCHz8Y7>>@J-d:z.JKKL99m\:;L#E*h	$J$Q$Q$STJ
s#345|,-	
C ,,vs
#C"3y>2Fvd|Z8FGG v;#!3'7#89F3K(
 ll63'6{"#JKK  r1   c                6   t        |t              st        d      t        |      dk(  rt	        d      t        | t              st        d      t        j                         }|  d| }|j                  |j                  d             |j                         S )z0Get a password digest to use for authentication.z#password must be an instance of strr   zpassword can't be emptyz#username must be an instance of strz:mongo:r   )
r4   str	TypeErrorlenrh   r   md5updater   	hexdigest)rL   rM   md5hashr*   s       r/   r   r   ?  s    h$=>>
8}233h$=>>kkmGZwxj)DNN4;;w'(r1   c                    t        ||      }t        j                         }|  | | }|j                  |j	                  d             |j                         S )z*Get an auth key to use for authentication.r   )r   r   r   r   r   r   )r   rL   rM   r   r   r*   s         r/   	_auth_keyr   N  sO    h1FkkmGWXJvh'DNN4;;w'(r1   c                B   t        j                  | dddt         j                  t         j                        d   \  }}}}}	 t        j                  |t         j
                        }|d   j                         S # t         j                  $ r |j                         cY S w xY w)z2Canonicalize hostname following MIT-krb5 behavior.Nr   )socketgetaddrinfoIPPROTO_TCPAI_CANONNAMEgetnameinfoNI_NAMEREQDgaierrorlower)hostnameafsocktypeproto	canonnamesockaddrnames          r/   _canonicalize_hostnamer   W  s     06/A/A$1f00&2E2E00	,B%H!!!(F,>,>? 7==? ?? !  !s   $A8 8#BBc                   t         st        d      	 | j                  }| j                  }| j                  }|j
                  d   }|j                  rt        |      }|j                  dz   |z   }|j                  |dz   |j                  z   }|t        rOdj                  t        |      t        |      f      }t        j                  ||t        j                        \  }}	nrd|v r|j!                  dd      \  }
}n|d}}
t        j                  |t        j                  |
||      \  }}	n(t        j                  |t        j                        \  }}	|t        j"                  k7  rt%        d	      	 t        j&                  |	d
      dk7  rt%        d      t        j(                  |	      }t+        ddd|fdg      }|j-                  d|      }t/        d      D ]  }t        j&                  |	t1        |d               }|dk(  rt%        d      t        j(                  |	      xs d
}t+        dd|d   fd|fg      }|j-                  d|      }|t        j"                  k(  s n t%        d      t        j2                  |	t1        |d               dk7  rt%        d      t        j4                  |	t        j(                  |	      |      dk7  rt%        d      t        j(                  |	      }t+        dd|d   fd|fg      }|j-                  d|       t        j6                  |	       y# t        j6                  |	       w xY w# t        j8                  $ r}t%        t1        |            dd}~ww xY w)zAuthenticate using GSSAPI.zEThe "kerberos" module must be installed to use GSSAPI authentication.r   @N:)gssflagsr   )r   rk   domainrM   z&Kerberos context failed to initialize.rb   z*Unknown kerberos failure in step function.r   )rJ   r   r   r   rY   
   r   r   z+Kerberos authentication failed to complete.z0Unknown kerberos failure during GSS_Unwrap step.z.Unknown kerberos failure during GSS_Wrap step.)HAVE_KERBEROSr   rL   rM   rN   addressrS   r   rR   rT   _USE_PRINCIPALrx   r   kerberosauthGSSClientInitGSS_C_MUTUAL_FLAGr   AUTH_GSS_COMPLETEr   authGSSClientStepauthGSSClientResponser   r   ranger   authGSSClientUnwrapauthGSSClientWrapauthGSSClientCleanKrbError)r   r   rL   rM   rq   hostservice	principalresultr   rk   r   r   r   r   _excs                    r/   _authenticate_gssapir  f  se    S
 	
k3''''00 ||A'')$/D$$s*T1*me&9&99G  HHeHouX%GH	&88Y1K1K (?#+>>#q#9LD&#+T&D&88%77!% #44WxGaGabKFCX///"#KLL@	-
 ))#r2a7&'STT 44S9G$+((	C ||K5H 2Y!33CXi=P9QRR<*+WXX"88=C+)84D+EF"G,  <<S9X777# & ''TUU ++CXi5H1IJaO&'YZZ))#x/M/Mc/RT\]abb&'WXX44S9G'%x0@'AB(C LLc* '',H'', 3s3x(d23s8   E!M 5C/L- %B2L- M -MM M4M//M4c                    | j                   }| j                  }| j                  }d| d| j                         }t	        dddt        |      fdg      }|j                  ||       y)z(Authenticate using SASL PLAIN (RFC 4616) r   )rJ   r#   r   r   N)rK   rL   rM   r   r   r   r   )r   r   rK   rL   rM   r   r   s          r/   _authenticate_plainr
    sr    F##H##HhZtH:.668G
"w( 		
C 	LLr1   c                    |j                   }|r|j                         ryt        | |j                        j	                         }|j                  d|       y)z Authenticate using MONGODB-X509.NrY   )r   r   _X509Contextr   speculate_commandr   )r   r   r   r   s       r/   _authenticate_x509r    sC    
--C
s&&(
{DLL
1
C
C
ECLLc"r1   c                    | j                   }| j                  }| j                  }|j                  |ddi      }|d   }t	        |||      }t        dd|fd|fd|fg      }|j                  ||       y)zAuthenticate using MONGODB-CR.getnoncer   r   authenticater   rk   keyN)rK   rL   rM   r   r   r   )	r   r   rK   rL   rM   r   r   r  querys	            r/   _authenticate_mongo_crr    s    F##H##H||FZO4HWE
E8X
.C $vx&87E:JUTWLYZELLr1   c                R   |j                   dk\  r|j                  r|j                  }nU| j                  }|j                         }|dz   | j                  z   |d<   |j                  ||d      j                  dg       }d|v rt        | |d      S t        | |d      S t        | |d      S )N   r   saslSupportedMechsF)publish_eventsr%   r$   )max_wire_versionnegotiated_mechsrK   	hello_cmdrL   r   ri   r   )r   r   mechsrK   r   s        r/   _authenticate_defaultr    s    !  ))E ''F.."C(.{7K7K(KC$%LLULCGGH\^`aEe#&{D/JJ&{D-HH";mDDr1   r$   )rJ   r%   )r   r   r!   r"   r#   r$   r%   r&   z!Mapping[str, Callable[..., None]]	_AUTH_MAPc                  J    e Zd ZddZe	 	 	 	 	 	 dd       Zd	dZd
dZddZy)_AuthContextc                .    || _         d | _        || _        y r,   )r   r   r   )r.   r   r   s      r/   r0   z_AuthContext.__init__$  s    &EI%r1   c                t    t         j                  | j                        }|rt        t         || |            S y r,   )_SPECULATIVE_AUTH_MAPri   rJ   r   r!  )credsr   spec_clss      r/   from_credentialsz_AuthContext.from_credentials)  s2     ),,U__=hug&>??r1   c                    t         r,   )NotImplementedErrorr-   s    r/   r  z_AuthContext.speculate_command2  s    !!r1   c                &    |j                   | _         y r,   )r   )r.   hellos     r/   parse_responsez_AuthContext.parse_response5  s    (-(F(F%r1   c                ,    t        | j                        S r,   )rA   r   r-   s    r/   r   z _AuthContext.speculate_succeeded8  s    D1122r1   N)r   rI   r   tuple[str, int]r>   r?   )r%  rI   r   r.  r>   zOptional[_AuthContext]r>   z"Optional[MutableMapping[str, Any]])r+  zHello[Mapping[str, Any]]r>   r?   )r>   rA   )	rC   rD   rE   r0   staticmethodr'  r  r,  r   rH   r1   r/   r!  r!  #  sC    
 )8	 "G3r1   r!  c                  8     e Zd Z	 	 	 	 	 	 	 	 d fdZddZ xZS )r   c                B    t         |   ||       d | _        || _        y r,   )superr0   r   rJ   )r.   r   r   rJ   	__class__s       r/   r0   z_ScramContext.__init__=  s"     	g.9="r1   c                    t        | j                  | j                        \  }}}| j                  j                  |d<   ||f| _        |S )Ndb)r   r   rJ   rK   r   )r.   r   r   r   s       r/   r  z_ScramContext.speculate_commandD  sE    !:4;K;KT^^!\z3$$++D	 *-
r1   )r   rI   r   r.  rJ   r   r>   r?   r/  )rC   rD   rE   r0   r  __classcell__)r4  s   @r/   r   r   <  s-    #*#5D#QT#	#r1   r   c                      e Zd ZddZy)r  c                ~    t        ddg      }| j                  j                  | j                  j                  |d<   |S )Nr  )rJ   r!   rk   )r   r   rL   )r.   r   s     r/   r  z_X509Context.speculate_commandN  s?    &(EFG$$0**33CK
r1   N)r>   zMutableMapping[str, Any]rC   rD   rE   r  rH   r1   r/   r  r  M  s    r1   r  c                      e Zd ZddZy)_OIDCContextc                    t        | j                  | j                        }|j                  d      }|y | j                  j                  |d<   |S )NFr6  )r   r   r   auth_start_cmdrK   )r.   authenticatorr   s      r/   r  z_OIDCContext.speculate_commandV  sJ    *4+;+;T\\J**51;$$++D	
r1   Nr/  r:  rH   r1   r/   r<  r<  U  s    r1   r<  )r!   r$   r%   r    r&   r$  c                f    | j                   }t        |   }|dk(  rt        | ||       y || |       y)zAuthenticate connection.r    N)rJ   r  r   )r   r   reauthenticaterJ   	auth_funcs        r/   r  r  h  s7     %%I)$IN";n=+t$r1   )rj   r   rK   Optional[str]rk   r   rl   r   rm   rW   rn   rC  r>   rI   )r{   rz   r|   rz   r>   rz   )r   rz   r>   zDict[bytes, bytes])r   rI   rJ   r   r>   z-tuple[bytes, bytes, MutableMapping[str, Any]])r   rI   r   r   rJ   r   r>   r?   )rL   r   rM   r   r>   r   )r   r   rL   r   rM   r   r>   r   )r   r   r>   r   )r   rI   r   r   r>   r?   )F)r   rI   r   r   rA  rA   r>   r?   )Q__doc__
__future__r   	functoolsr   r   r   r   r   base64r   r   collectionsr   r   r   r	   r
   r   r   r   r   urllib.parser   bson.binaryr   bson.sonr   pymongo.auth_awsr   pymongo.auth_oidcr   r   r   pymongo.errorsr   r   pymongo.saslprepr   pymongo.hellor   pymongo.poolr   r   r   winkerberosr   tuplemaprB   __version__r   ImportError	frozenset
MECHANISMSr(   rI   rP   rU   rv   r   r   r   r   r   r   r   r  r
  r  r  r  partialr  __annotations__r!  r   r  r<  r$  r  rH   r1   r/   <module>r[     s    "    	   9 "	 	 	    . U U ? %#'	"Sh**005bq9:;vE 

 : . T ? S  6 ,/B.CD :MT
MTMT MT 	MT
 MT MT MT`@
" "-0"2"(TLnr3j"# E$ #(&$ $9$$%8MR&Y&&':oV$	0	, 	3 32L "< <  !$9$$]mL&Y&&}P  y  /J, (  LQ	% 	%(2	%DH	%		%a   s6   4G+ +H1G65H6H =H?H  HH