U
    M8cZ*                     @   s  d dl Z d dlZd dlZd dlZd dlmZmZ d dlmZmZ d dl	Z
d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZ d d	lmZmZmZ eeZd
d Zdd Zdd Z dd Z!G dd deZ"G dd dZ#G dd dZ$G dd dZ%dS )    N)datetime	timedelta)
NamedTupleOptional)tzutc)UNSIGNED)total_seconds)Config)ClientErrorInvalidConfigErrorTokenRetrievalError)CachedPropertyJSONFileCacheSSOTokenLoaderc                   C   s   t t S N)r   nowr    r   r   3/tmp/pip-unpacked-wheel-ozje0y8b/botocore/tokens.py_utc_now$   s    r   c                 C   s   t | g}t|dS )N)	providers)SSOTokenProviderTokenProviderChain)sessionr   r   r   r   create_token_resolver(   s    r   c                 C   s   t | tr| dS | S )Nz%Y-%m-%dT%H:%M:%SZ)
isinstancer   strftimeobjr   r   r   _serialize_utc_timestamp/   s    

r   c                 C   s   t j| tdS )N)default)jsondumpsr   r   r   r   r   _sso_json_dumps5   s    r"   c                   @   s&   e Zd ZU eed< dZee ed< dS )FrozenAuthTokentokenN
expiration)__name__
__module____qualname__str__annotations__r%   r   r   r   r   r   r   r#   9   s   
r#   c                   @   sL   e Zd ZdZdZdZefddZdd Zdd	 Z	d
d Z
dd Zdd ZdS )DeferredRefreshableToken  iX  <   c                 C   s,   || _ || _|| _t | _d | _d | _d S r   )_time_fetcher_refresh_usingmethod	threadingLock_refresh_lock_frozen_token_next_refresh)selfr0   Zrefresh_usingtime_fetcherr   r   r   __init__G   s    
z!DeferredRefreshableToken.__init__c                 C   s   |    | jS r   )_refreshr4   r6   r   r   r   get_frozen_tokenQ   s    z)DeferredRefreshableToken.get_frozen_tokenc                 C   sB   |   }|sd S |dk}| j|r>z|   W 5 | j  X d S )N	mandatory)_should_refreshr3   acquirerelease_protected_refresh)r6   refresh_typeZblock_for_refreshr   r   r   r9   U   s    z!DeferredRefreshableToken._refreshc                 C   s   |   }|sd S z(|  }|t| jd | _|  | _W n. tk
rf   tj	d|dd |dkrb Y nX | 
 r~t| jddd S )Nsecondsz5Refreshing token failed during the %s refresh period.Texc_infor<   z$Token has expired and refresh failed)provider	error_msg)r=   r.   r   _attempt_timeoutr5   r/   r4   	Exceptionloggerwarning_is_expiredr   r0   )r6   rA   r   r   r   r   r@   c   s(    z+DeferredRefreshableToken._protected_refreshc                 C   s.   | j d krdS | j j}t||   }|dkS )NFr   )r4   r%   r   r.   )r6   r%   	remainingr   r   r   rL      s
    
z$DeferredRefreshableToken._is_expiredc                 C   sd   | j d krdS | j j}|d kr"d S |  }|| jk r8d S t|| }|| jk rRdS || jk r`dS d S )Nr<   Zadvisory)r4   r%   r.   r5   r   _mandatory_refresh_timeout_advisory_refresh_timeout)r6   r%   r   rM   r   r   r   r=      s    



z(DeferredRefreshableToken._should_refreshN)r&   r'   r(   rO   rN   rH   r   r8   r;   r9   r@   rL   r=   r   r   r   r   r+   >   s   
r+   c                   @   s   e Zd ZdddZdd ZdS )r   Nc                 C   s   |d krg }|| _ d S r   )
_providers)r6   r   r   r   r   r8      s    zTokenProviderChain.__init__c                 C   s(   | j D ]}| }|d k	r|  S qd S r   )rP   
load_token)r6   rF   r$   r   r   r   rQ      s
    

zTokenProviderChain.load_token)N)r&   r'   r(   r8   rQ   r   r   r   r   r      s   
r   c                   @   s   e Zd ZdZdZejejddddZ	ddgZ
dZeZd	efd
dZdd Zedd Zedd Zdd Zdd Zdd Zdd Zd	S )r   Zssor,   ~z.awscachesso_start_url
sso_regionZrefresh_tokenNc                 C   s<   || _ |d kr| j| jtd}|| _|| _t| jd| _d S )N)Z
dumps_func)rS   )_sessionDEFAULT_CACHE_CLS_SSO_TOKEN_CACHE_DIRr"   _now_cacher   _token_loader)r6   r   rS   r7   r   r   r   r8      s    zSSOTokenProvider.__init__c                 C   s   | j j}|di }|di }| j d}|s4d}||i }d|krLd S |d }||d }|sd| d| d}t|d	g }	| jD ]}
|
|kr|	|
 q|	rd| d
|	 d}t|d	||d |d dS )Nprofilessso_sessionsZprofiler   Zsso_sessionzThe profile "z7" is configured to use the SSO token provider but the "z+" sso_session configuration does not exist.)rG   zZ" is configured to use the SSO token provider but is missing the following configuration: .rU   rT   )session_namerU   rT   )rV   Zfull_configgetZget_config_variabler   _SSO_CONFIG_VARSappend)r6   Zloaded_configr\   r]   Zprofile_nameZprofile_configZsso_session_nameZ
sso_configrG   Zmissing_configsvarr   r   r   _load_sso_config   s6    


z!SSOTokenProvider._load_sso_configc                 C   s   |   S r   )rd   r:   r   r   r   _sso_config   s    zSSOTokenProvider._sso_configc                 C   s"   t | jd td}| jjd|dS )NrU   )Zregion_nameZsignature_versionzsso-oidc)config)r	   re   r   rV   Zcreate_client)r6   rf   r   r   r   _client   s
    zSSOTokenProvider._clientc                 C   s   | j j| j|d |d |d d}t|d d}| jd | jd |d	 |  | |d |d |d
 d}d|kr||d |d< td |S )NclientIdclientSecretrefreshToken)Z	grantTyperh   ri   rj   Z	expiresInrB   rT   rU   accessTokenregistrationExpiresAt)ZstartUrlZregionrk   	expiresAtrh   ri   rl   zSSO Token refresh succeeded)rg   Zcreate_token_GRANT_TYPEr   re   rY   rJ   info)r6   r$   responseZ
expires_in	new_tokenr   r   r   _attempt_create_token   s&    


z&SSOTokenProvider._attempt_create_tokenc                    s   d} fdd|D }|r2d| }t | d S tj d }t||   dkrjt d|  d S z|  W S  tk
r   t j	dd	d
 Y d S X d S )N)rj   rh   ri   rl   c                    s   g | ]}| kr|qS r   r   ).0kr$   r   r   
<listcomp>  s      z:SSOTokenProvider._refresh_access_token.<locals>.<listcomp>z+Unable to refresh SSO token: missing keys: rl   r   z"SSO token registration expired at z SSO token refresh attempt failedTrD   )
rJ   ro   dateutilparserparser   rY   rr   r
   rK   )r6   r$   keysZmissing_keysmsgZexpiryr   ru   r   _refresh_access_token  s    

z&SSOTokenProvider._refresh_access_tokenc                 C   s   | j d }| j d }td|  | j||d}tj|d }td|  t|| 	  }|| j
k r| |}|d k	r|}|d }| jj|||d t|d |dS )	NrT   r_   zLoading cached SSO token for )r_   rm   zCached SSO token expires at rk   )r%   )re   rJ   ro   r[   rw   rx   ry   debugr   rY   _REFRESH_WINDOWr|   Z
save_tokenr#   )r6   Z	start_urlr_   Z
token_dictr%   rM   Znew_token_dictr   r   r   
_refresher*  s*    



   zSSOTokenProvider._refresherc                 C   s"   | j d krd S t| j| j| jdS )N)r7   )re   r+   METHODr   rY   r:   r   r   r   rQ   @  s    
  zSSOTokenProvider.load_token)r&   r'   r(   r   r~   ospath
expanduserjoinrX   ra   rn   r   rW   r   r8   rd   r   re   rg   rr   r|   r   rQ   r   r   r   r   r      s(   *

r   )&r    loggingr   r1   r   r   typingr   r   Zdateutil.parserrw   Zdateutil.tzr   Zbotocorer   Zbotocore.compatr   Zbotocore.configr	   Zbotocore.exceptionsr
   r   r   Zbotocore.utilsr   r   r   	getLoggerr&   rJ   r   r   r   r"   r#   r+   r   r   r   r   r   r   <module>   s*   
a