
    =hC%                       d Z ddlmZ ddlZddlmZmZ ddlmZm	Z	m
Z
mZmZmZ ddlZddlmZ ddlmZ ddlmZmZ erdd	lmZ dd
lmZ e G d d             Z	 dZdZdZ	 	 	 	 	 	 ddZe G d d             Z	 	 	 	 	 	 	 	 ddZ y)z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyCallableMappingMutableMappingOptional)Binary)SON)ConfigurationErrorOperationFailure)MongoCredential)
Connectionc                  ,    e Zd ZU ded<   ded<   ded<   y)_OIDCPropertieszOptional[Callable[..., dict]]request_token_callbackOptional[str]provider_namez	list[str]allowed_hostsN)__name__
__module____qualname____annotations__     a/var/www/html/phonemate/phone_mate_backend/venv/lib/python3.12/site-packages/pymongo/auth_oidc.pyr   r       s    99  r   r      i,     _OIDCAuthenticatorc                   | j                   j                  r| j                   j                  S | j                  }| j                  }|j                  sbd}|j
                  }|D ]9  }||d   k(  rd}|j                  d      s |d   j                  |dd        s8d}; |st        d|d    d|       t        ||      | j                   _        | j                   j                  S )	NFr   Tz*.r    zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar#   mechanism_propertiesr   r   
startswithendswithr   r!   )credentialsaddressprincipal_namer$   foundr   patts          r   _get_authenticatorr/   .   s       %%% !))N11J ##"00!Dwqz!&71:+>+>tABx+H	 "
 $)'!*5]^k]lm 
 0T^_K!!!r   c                     e Zd ZU ded<   ded<    ed      Zded<    ed      Zded	<    ed      Zd
ed<    ed      Zded<    ee	j                        Zded<   dddZddZddZdddZ	 	 	 	 	 	 ddZd dZd dZ	 	 	 	 	 	 d!dZy)"r!   strr#   r   r$   N)defaultr   refresh_tokenaccess_tokenzOptional[dict]idp_infor   inttoken_gen_id)default_factoryzthreading.Locklockc                   | j                   }|r|j                  nd }d}| j                  }|r|S |s|sy |s|| j                  5  | j                  }||k7  r|cd d d        S |dk(  r<t        t
        | j                  d} || j                  |      }| j                  |       | xj                  dz  c_	        d d d        | j                  S | j                  S # 1 sw Y   | j                  S xY w)Nhuman)timeout_secondsversionr3   r    )
r$   r   r4   r9   CALLBACK_TIMEOUT_SECONDSCALLBACK_VERSIONr3   r5   validate_request_token_responser7   )	selfuse_callbackr$   cbcb_type
prev_token	new_tokencontextresps	            r   get_current_tokenz$_OIDCAuthenticator.get_current_tokenU   s    __
 3?Z..D&&
Jbn !--	
*$  g%+C#3)-););G
 dmmW5D88>!!Q&!% (    t   ) (    s   C!ACC+c                    t        |t              st        d      d|vrt        d      g d}|D ]  }||vst        d| d       |d   | _        |j	                  d      | _        y )Nz%OIDC callback returned invalid resultr4   z,OIDC callback did not return an access_token)r4   r3   expires_in_secondsz%Unexpected field in callback result ""r3   )
isinstancedict
ValueErrorr4   getr3   )rA   rH   expectedkeys       r   r@   z2_OIDCAuthenticator.validate_request_token_responsez   sx    $%DEE%KLLJC(" #HQ!OPP  !0!XXo6r   c           
         i }| j                   }|r||d<   t        dddt        t        j                  |            fdg      S )z8Get a SASL start command with an optional principal namen	saslStartr    	mechanismzMONGODB-OIDCpayload)autoAuthorizer    )r#   r   r   bsonencode)rA   rY   r,   s      r   principal_step_cmdz%_OIDCAuthenticator.principal_step_cmd   sO     )GCL -F4;;w#789$	
 	
r   c                    | j                   | j                         S | j                  |      }|sy t        t	        j
                  d|i            }t        ddd|fg      S )NjwtrU   rW   rY   )r5   r]   rI   r   r[   r\   r   )rA   rB   tokenbin_payloads       r   auth_start_cmdz!_OIDCAuthenticator.auth_start_cmd   sh    == **,,&&|4T[[%89 -K(
 	
r   c                V    	 |j                  d|d      S # t        $ r	 d | _         w xY w)Nz	$externalT)	no_reauth)commandr   r4   )rA   conncmds      r   run_commandz_OIDCAuthenticator.run_command   s6    	<<SD<AA 	 $D	s    (c                J   |j                   xs d}|| j                  k  r| j                  r	 | j                  |      S d| _        | j
                  }d| _        | j                         }| j                  ||      }|J t        j                  |d         }d|v r|| _        | j
                  |k7  rd| _        d| _
        | j                  r	 | j                  ||      S | j                  ||      S # t        $ r Y w xY w# t        $ r d| _
        | j                  |      cY S w xY w)z(Handle a reauthenticate from the server.r   NrY   issuer)oidc_token_gen_idr7   r4   authenticater   r5   r]   rh   r[   decoder3   finish_auth)rA   rf   prev_idprev_idp_inforg   rH   server_resps          r   reauthenticatez!_OIDCAuthenticator.reauthenticate   s=    ((-Ad'''T->->((.. ! %%'c* KKY8{"'DM ==M) $D!%D /''d33 d++C $ 6 $ /%)"((../s#   C/ C> /	C;:C;>!D"!D"c                H   |j                   }d }|r|j                         r|j                  }n&| j                         }|J | j	                  ||      }|J |d   r| j
                  |_        y t        j                  |d         }d|v r|| _	        | j                  ||      S )NdonerY   rj   )auth_ctxspeculate_succeededspeculative_authenticaterb   rh   r7   rk   r[   rm   r5   rn   )rA   rf   ctxrg   rH   rq   s         r   rl   z_OIDCAuthenticator.authenticate   s    mm3**,//D%%'C?"?##D#.D<%)%6%6D" KKY8{"'DMd++r   c                   |d   }| j                         }| j                  |_        t        t	        j
                  d|i            }t        dd|fd|fg      }| j                  ||      }|J |d   st        d      |S )NconversationIdr_   )saslContinuer    rY   rt   z%SASL conversation failed to complete.)	rI   r7   rk   r   r[   r\   r   rh   r   )rA   	orig_resprf   conversation_idr`   ra   rg   rH   s           r   rn   z_OIDCAuthenticator.finish_auth   s     $$45&&(!%!2!2T[[%89#!?3K(
 c*F|"#JKKr   )T)rB   boolreturnr   )rH   Mapping[str, Any]r   None)r   zSON[str, Any])rB   r~   r   zOptional[SON[str, Any]])rf   r   rg   zMutableMapping[str, Any]r   Optional[Mapping[str, Any]])rf   r   r   r   )r|   r   rf   r   r   r   )r   r   r   r   r   r3   r4   r5   r7   	threadingLockr9   rI   r@   r]   rb   rh   rr   rl   rn   r   r   r   r!   r!   K   s    M#(#6M=6"'"5L-5$T2Hn2a(L#( @D.@#!J7 
$
"%=	$),V,,*2<	$r   c                v    t        | |j                        }|r|j                  |      S |j                  |      S )z Authenticate using MONGODB-OIDC.)r/   r+   rr   rl   )r*   rf   rr   authenticators       r   _authenticate_oidcr     s9     '{DLLAM++D11))$//r   )r*   r   r+   ztuple[str, int]r   r!   )r*   r   rf   r   rr   r~   r   r   )!__doc__
__future__r   r   dataclassesr   r   typingr   r   r   r	   r
   r   r[   bson.binaryr   bson.sonr   pymongo.errorsr   r   pymongo.authr   pymongo.poolr   r   TOKEN_BUFFER_MINUTESr>   r?   r/   r!   r   r   r   r   <module>r      s    + "  ( R R    ?,'    < !  " "+:"": } } }@0 0(20DH0 0r   