
    9i2,                         d dl Z 	 d dlmZ d dlZ ej
                  e      ZdZdZ	dZ
dZ eee	deg      Zg dZdZ G d	 d
e      Z G d de      Zd Zd Zd Zy# e$ r	 d dlmZ Y ]w xY w)    N)urlparsezlogin.microsoftonline.uszlogin.chinacloudapi.cnzlogin.microsoftonline.comzlogin-us.microsoftonline.com)zb2clogin.comzb2clogin.cnzb2clogin.uszb2clogin.dezciamlogin.comz.ciamlogin.comc                       e Zd Zd Zd Zy)AuthorityBuilderc                 \    |j                  d      | _        |j                  d      | _        y)zA helper to save caller from doing string concatenation.

        Usage is documented in :func:`application.ClientApplication.__init__`.
        /N)rstrip	_instancestrip_tenant)selfinstancetenants      A/var/www/html/venv/lib/python3.12/site-packages/msal/authority.py__init__zAuthorityBuilder.__init__#   s$    
 "-||C(    c                 N    dj                  | j                  | j                        S )Nzhttps://{}/{})formatr	   r   )r   s    r   __str__zAuthorityBuilder.__str__+   s    %%dnndllCCr   N)__name__
__module____qualname__r   r    r   r   r   r   "   s    )Dr   r   c                   B    e Zd ZdZ eg       Z	 	 	 ddZd Zd ZddZ	y)		AuthorityzThis class represents an (already-validated) authority.

    Once constructed, it contains members named "*_endpoint" for this instance.
    TODO: It will also cache the previously-validated authority instances.
    Nc                 $   || _         |r(t        j                  d|       | j                  |      }n)t        j                  d|       | j	                  |||      }	 t        || j                         }t        j                  d||       |d   | _        |d	   | _	        |j                  d
      | _        t        | j                        \  }	}	| _        y# t        $ r4 |rdj                  |      ndj                  |      dz   }t        |      w xY w)a`  Creates an authority instance, and also validates it.

        :param validate_authority:
            The Authority validation process actually checks two parts:
            instance (a.k.a. host) and tenant. We always do a tenant discovery.
            This parameter only controls whether an instance discovery will be
            performed.
        z$Initializing with OIDC authority: %sz%Initializing with Entra authority: %szUnable to get OIDC authority configuration for {url} because its OIDC Discovery endpoint is unavailable at {url}/.well-known/openid-configuration )urlzUnable to get authority configuration for {}. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant or https://tenant_name.ciamlogin.com or https://tenant_name.b2clogin.com/tenant.onmicrosoft.com/policy. z> Also please double check your tenant name or GUID is correct.zopenid_config("%s") = %sauthorization_endpointtoken_endpointdevice_authorization_endpointN)_http_clientloggerdebug_initialize_oidc_authority_initialize_entra_authoritytenant_discovery
ValueErrorr   r   r   getr   canonicalizer   )
r   authority_urlhttp_clientvalidate_authorityinstance_discoveryoidc_authority_urltenant_discovery_endpointopenid_configerror_message_s
             r   r   zAuthority.__init__7   s,    (LL?AST(,(G(G")$% LL@-P(,(H(H13E)G%	,,)!!#M" 	&(A=	R&34L&M#+,<=-:->->?^-_*()<)<=1dk'  	,
 &::@&EW&:XV
 &TUM ]++	,s   C =Dc                     t        |      \  }| _        }|j                         dk(  | _        d| _        d| _        |dz   S )NadfsTz!/.well-known/openid-configuration)r(   r   loweris_adfs_is_b2c_is_known_to_developer)r   r-   	authorityr   s       r   r#   z$Authority._initialize_oidc_authorityg   sE    +78J+K(	4=&||~/ '+#!$GGGr   c                 
    t        |t              rt        |      }t        |      \  } _        } j                  j                  t              }|j                         dk(  xr |  _        |j                  j                  d      }t         fdt        D              xs2 t        |      dk(  xr" |d   j                         j                  d       _         j                  xs  j                  xs |  _         j                  t"        v }|dv rdj%                  t&              n|}	|	rr|sp j                   sdt)        d	j%                   j                  |j                         j*                  |	      }
|
j-                  d
      dk(  rt/        d|z        |
d   }|S |j1                  dj%                  |rt        |j                        dk  r|n|j                   j                  rdnd            j3                         }|S )Nr3   r   c              3   Z   K   | ]"  }j                   j                  d |z          $ yw).N)r   endswith).0dr   s     r   	<genexpr>z8Authority._initialize_entra_authority.<locals>.<genexpr>}   s)      01DMM""37+s   (+      b2c_)NTz$https://{}/common/discovery/instancez"https://{}{}/oauth2/v2.0/authorizeerrorinvalid_instancezinvalid_instance: The authority you provided, %s, is not whitelisted. If it is indeed your legit customized domain name, you can turn off this check by passing in instance_discovery=Falser.   z2{prefix}{version}/.well-known/openid-configuration    z/v2.0)prefixversion)path)
isinstancer   strr(   r   r<   _CIAM_DOMAIN_SUFFIXr4   r5   rI   splitanyWELL_KNOWN_B2C_HOSTSlen
startswithr6   r7   WELL_KNOWN_AUTHORITY_HOSTSr   
WORLD_WIDE_instance_discoveryr    r'   r&   _replacegeturl)r   r)   r+   r,   r8   r   is_ciampartsis_known_to_microsoftinstance_discovery_endpointpayloadr.   s   `           r   r$   z%Authority._initialize_entra_authorityp   s    m%56.M+7+F(	4=&--(()<=||~/?K$$S) 5I  Ke*/IeAhnn&6&A&A&&I 	 '+ll&\dll&\J\F\# $1K K
 $|3	 'M&S&S' :L	 	$
 '%)D)D)4;;MM9>>3!!+	-G
 {{7#'99 /
 $$% % )00K(L% )( )2(:(:IPP%,Y^^1D1I6&^^"&,,BG Q  ); ) &( & )(r   c                    | j                   | j                  j                  vr|xs; | j                  j	                  dj                  | j                   |      d|d      }|j                  dk7  r/|j                          t        j                  |j                        S | j                  j                  j                  | j                          i S )Nz<https://{netloc}/common/userrealm/{username}?api-version=1.0)netlocusernamezapplication/json)Acceptzclient-request-id)headersi  )r   	__class__%_domains_without_user_realm_discoveryr    r'   r   status_coderaise_for_statusjsonloadstextadd)r   r^   correlation_idresponseresps        r   user_realm_discoveryzAuthority.user_realm_discovery   s     == T TT @t0044NUU==8 V =#5.<>  5  @D
 3&%%'zz$)),,NN@@DDT]]S	r   )TNN)NN)
r   r   r   __doc__setrb   r   r#   r$   rl   r   r   r   r   r   /   s5    
 -0G)  $##	.>`H/)br   r   c                    t        |       }|j                  dk(  r|j                  j                  d      }t	        |      dk\  r
|d   r|d   nd }|j
                  j                  t              rE|r|n1dj                  |j
                  j                  t        d      d         }||j
                  |fS t	        |      dk\  r|d   r||j
                  |d   fS t        d| z        )Nhttpsr   rA   rE   z{}.onmicrosoft.comr   a
  Your given address (%s) should consist of an https url with a minimum of one segment in a path: e.g. https://login.microsoftonline.com/{tenant} or https://{tenant_name}.ciamlogin.com/{tenant} or https://{tenant_name}.b2clogin.com/{tenant_name}.onmicrosoft.com/policy)r   schemerI   rM   rP   hostnamer<   rL   r   rsplitr&   )authority_or_auth_endpointr8   rX   
first_partr   s        r   r(   r(      s    34I7"$$S)!$UqU1XU1X4
&&':;#-Z3G3N3N""))*=qA!D4FF i00&88u:?uQxi00%(::
	U
 %	%& &r   c                 p     |j                   |fd| ddi|}t        j                  |j                        S )Nparamsz1.0)r   zapi-version)r'   re   rf   rg   )r   r*   rZ   kwargsrk   s        r   rT   rT      sA    ;??#*-eD D ::dii  r   c                 |    |j                   | fi |}|j                  dk(  rt        j                  |j                        S d|j                  cxk  rdk  r3n n0t        dj                  | |j                  |j                              |j                          t        d|j                  |j                  fz        )N   i  i  z7OIDC Discovery failed on {}. HTTP status: {}, Error: {}z)Unable to complete OIDC Discovery: %d, %s)	r'   rc   re   rf   rg   r&   r   rd   RuntimeError)r.   r*   rx   rk   s       r   r%   r%      s    ;??4??D3zz$))$$
d$$ RYY%II  	 	
3t7G7G6SSU Ur   )re   urllib.parser   ImportErrorlogging	getLoggerr   r!   AZURE_US_GOVERNMENTAZURE_CHINAAZURE_PUBLICrS   rn   rR   rO   rL   objectr   r   r(   rT   r%   r   r   r   <module>r      s    "%  
		8	$ 1 &*(
 "	"    ' 
Dv 
D@ @F&.!UY  "!"s   A A*)A*