
    Pe*                     2   d dl Z d dlZd dlZd dlZd dlmZmZ d dlmZmZ d dl	Z
d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZ d d	lmZmZmZ  ej6                  e      Zd
 Zd Zd Z d Z! G d de      Z" G d d      Z# G d d      Z$ G d d      Z%y)    N)datetime	timedelta)
NamedTupleOptional)tzutc)UNSIGNED)total_seconds)Config)ClientErrorInvalidConfigErrorTokenRetrievalError)CachedPropertyJSONFileCacheSSOTokenLoaderc                  <    t        j                  t                     S N)r   nowr        1/usr/lib/python3/dist-packages/botocore/tokens.py_utc_nowr   $   s    <<  r   c                 2    t        |       g}t        |      S )N)	providers)SSOTokenProviderTokenProviderChain)sessionr   s     r   create_token_resolverr   (   s    !I 	22r   c                 H    t        | t              r| j                  d      S | S )Nz%Y-%m-%dT%H:%M:%SZ)
isinstancer   strftimeobjs    r   _serialize_utc_timestampr#   /   s!    #x ||011Jr   c                 8    t        j                  | t              S )N)default)jsondumpsr#   r!   s    r   _sso_json_dumpsr(   5   s    ::c#;<<r   c                   ,    e Zd ZU eed<   dZee   ed<   y)FrozenAuthTokentokenN
expiration)__name__
__module____qualname__str__annotations__r,   r   r   r   r   r   r*   r*   9   s    J%)J")r   r*   c                   @    e Zd ZdZdZdZefdZd Zd Z	d Z
d Zd	 Zy
)DeferredRefreshableToken  iX  <   c                 |    || _         || _        || _        t        j                         | _        d | _        d | _        y r   )_time_fetcher_refresh_usingmethod	threadingLock_refresh_lock_frozen_token_next_refresh)selfr9   refresh_usingtime_fetchers       r   __init__z!DeferredRefreshableToken.__init__G   s:    )+ '^^-!!r   c                 :    | j                          | j                  S r   )_refreshr=   r?   s    r   get_frozen_tokenz)DeferredRefreshableToken.get_frozen_tokenQ   s    !!!r   c                     | j                         }|sy |dk(  }| j                  j                  |      r,	 | j                          | j                  j	                          y y # | j                  j	                          w xY w)N	mandatory)_should_refreshr<   acquire_protected_refreshrelease)r?   refresh_typeblock_for_refreshs      r   rD   z!DeferredRefreshableToken._refreshU   sv    ++- )K7%%&78-'')""**,	 9 ""**,s   A! !A=c                 Z   | j                         }|sy 	 | j                         }|t        | j                        z   | _        | j                         | _        | j                         rt        | j                  d      y # t        $ r! t        j                  d|d       |dk(  r Y Qw xY w)Nsecondsz5Refreshing token failed during the %s refresh period.Texc_inforH   z$Token has expired and refresh failed)provider	error_msg)rI   r7   r   _attempt_timeoutr>   r8   r=   	Exceptionloggerwarning_is_expiredr   r9   )r?   rM   r   s      r   rK   z+DeferredRefreshableToken._protected_refreshc   s     ++-	$$&C!$y9N9N'O!OD!%!4!4!6D %@    	NNG  
 {* +	s   AB   'B*)B*c                     | j                   y| j                   j                  }t        || j                         z
        }|dk  S )NFr   )r=   r,   r	   r7   )r?   r,   	remainings      r   rZ   z$DeferredRefreshableToken._is_expired   sD    %''22
!*t/A/A/C"CD	A~r   c                     | j                   y| j                   j                  }|y | j                         }|| j                  k  ry t	        ||z
        }|| j
                  k  ry|| j                  k  ryy )NrH   advisory)r=   r,   r7   r>   r	   _mandatory_refresh_timeout_advisory_refresh_timeout)r?   r,   r   r\   s       r   rI   z(DeferredRefreshableToken._should_refresh   s~    %''22
  "###!*s"23	t666777r   N)r-   r.   r/   r`   r_   rV   r   rB   rF   rD   rK   rZ   rI   r   r   r   r3   r3   >   s7     !(!(;C ""-8r   r3   c                       e Zd ZddZd Zy)r   Nc                     |g }|| _         y r   )
_providers)r?   r   s     r   rB   zTokenProviderChain.__init__   s    I#r   c                 R    | j                   D ]  }|j                         }||c S  y r   )rc   
load_token)r?   rT   r+   s      r   re   zTokenProviderChain.load_token   s3     	H'')E 	 r   r   )r-   r.   r/   rB   re   r   r   r   r   r      s    $
r   r   c                       e Zd ZdZdZej                  j                  ej                  j                  dddd            Z	ddgZ
dZeZd	ed	fd
Zd Zed        Zed        Zd Zd Zd Zd Zy	)r   ssor4   ~z.awscachesso_start_url
sso_regionrefresh_tokenNc                     || _         |!| j                  | j                  t              }|| _        || _        t        | j
                        | _        |xs | j                   j                  d      xs d| _	        y )N)
dumps_func)ri   profiler%   )
_sessionDEFAULT_CACHE_CLS_SSO_TOKEN_CACHE_DIRr(   _now_cacher   _token_loaderget_config_variable_profile_name)r?   r   ri   rA   profile_names        r   rB   zSSOTokenProvider.__init__   s|      =**))* + E !	+$++> }}00; 	r   c                    | j                   j                  }|j                  di       }|j                  di       }|j                  | j                  i       }d|vry |d   }|j                  |d       }|sd| j                   d| d}t	        |      g }| j
                  D ]  }	|	|vs|j                  |	        |rd| j                   d| d	}t	        |      ||d
   |d   dS )Nprofilessso_sessionssso_sessionzThe profile "z7" is configured to use the SSO token provider but the "z+" sso_session configuration does not exist.)rU   zZ" is configured to use the SSO token provider but is missing the following configuration: .rk   rj   )session_namerk   rj   )rp   full_configgetrw   r   _SSO_CONFIG_VARSappend)
r?   loaded_configrz   r{   profile_configsso_session_name
sso_configrU   missing_configsvars
             r   _load_sso_configz!SSOTokenProvider._load_sso_config   s3   11 $$Z4$((<!d&8&8"=.)-8!%%&6=
 2 23 4++;*< =01 
 %y99(( 	,C*$&&s+	,  2 23 4N"#1& 
 %y99 -$\2'8
 	
r   c                 "    | j                         S r   )r   rE   s    r   _sso_configzSSOTokenProvider._sso_config   s    $$&&r   c                 x    t        | j                  d   t              }| j                  j	                  d|      S )Nrk   )region_namesignature_versionzsso-oidc)config)r
   r   r   rp   create_client)r?   r   s     r   _clientzSSOTokenProvider._client   s9    ((6&
 }}**:f*EEr   c                 L   | j                   j                  | j                  |d   |d   |d         }t        |d         }| j                  d   | j                  d   |d	   | j                         |z   |d   |d   |d
   d}d|v r|d   |d<   t        j                  d       |S )NclientIdclientSecretrefreshToken)	grantTyper   r   r   	expiresInrP   rj   rk   accessTokenregistrationExpiresAt)startUrlregionr   	expiresAtr   r   r   zSSO Token refresh succeeded)r   create_token_GRANT_TYPEr   r   rs   rX   info)r?   r+   response
expires_in	new_tokens        r   _attempt_create_tokenz&SSOTokenProvider._attempt_create_token   s    <<,,&&:&~.~.	 - 
 x'<=
((9&&|4#M2z1j)!.1%*+B%C	
	 X%(0(@In%12r   c                    d}|D cg c]	  }||vs| }}|rd| }t         j                  |       y t        j                  j	                  |d         }t        || j                         z
        dk  rt         j                  d|        y 	 | j                  |      S c c}w # t        $ r t         j                  dd       Y y w xY w)	N)r   r   r   r   z+Unable to refresh SSO token: missing keys: r   r   z"SSO token registration expired at z SSO token refresh attempt failedTrR   )
rX   r   dateutilparserparser	   rs   r   r   rY   )r?   r+   keyskmissing_keysmsgexpirys          r   _refresh_access_tokenz&SSOTokenProvider._refresh_access_token  s    
 $(:a1E>::?~NCKK&&u-D'EF$))+-.!3KK<VHEF	--e44 ;  	NN=NM	s   	B B B% % CCc                    | j                   d   }| j                   d   }t        j                  d|        | j                  ||      }t        j
                  j                  |d         }t        j                  d|        t        || j                         z
        }|| j                  k  r8| j                  |      }|%|}|d   }| j                  j                  |||       t        |d   |      S )	Nrj   r~   zLoading cached SSO token for )r~   r   zCached SSO token expires at r   )r,   )r   rX   r   ru   r   r   r   debugr	   rs   _REFRESH_WINDOWr   
save_tokenr*   )r?   	start_urlr~   
token_dictr,   r\   new_token_dicts          r   
_refresherzSSOTokenProvider._refresher.  s    $$_5	''73L>BC''	'M
__**:k+BC
3J<@A!*tyy{":;	t+++!77
CN)+
'4
""--z .  }%*
 	
r   c                 t    | j                   y t        | j                  | j                  | j                        S )N)rA   )r   r3   METHODr   rs   rE   s    r   re   zSSOTokenProvider.load_tokenD  s1    #'KKtyy
 	
r   )r-   r.   r/   r   r   ospath
expanduserjoinrr   r   r   r   rq   r   rB   r   r   r   r   r   r   r   re   r   r   r   r   r      s    FO77--
S&%1 	 "K% "t
$%
N ' ' F F.0
,
r   r   )&r&   loggingr   r:   r   r   typingr   r   dateutil.parserr   dateutil.tzr   botocorer   botocore.compatr	   botocore.configr
   botocore.exceptionsr   r   r   botocore.utilsr   r   r   	getLoggerr-   rX   r   r   r#   r(   r*   r3   r   r   r   r   r   <module>r      s      	  ( '    ) " 
 I H			8	$!3=*j *
^ ^B ]
 ]
r   