
    DhJ                     r   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
Zd dlmZ d dl
mZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7 d d	l8m9Z9 d d
l:m;Z; d dl<m=Z=m>Z>  ej~                  e@      ZAd<dZB G d de'      ZCd ZDd ZEd ZFeFZG G d de      ZH G d de)      ZI G d deI      ZJ G d de      ZK G d deeK      ZL G d deeL      ZM G d deL      ZN G d  d!e&      ZO G d" d#e!      ZP G d$ d%e       ZQ G d& d'e$      ZR G d( d)e+      ZS G d* d+e      ZT G d, d-e      ZU G d. d/e      ZV G d0 d1e      ZW G d2 d3e      ZX G d4 d5e      ZY G d6 d7e      ZZ G d8 d9eK      Z[ G d: d;e,      Z\y)=    N)deepcopy)sha1)UNSIGNED)compat_shell_split)Config)%!_DEFAULT_ADVISORY_REFRESH_TIMEOUTAssumeRoleCredentialFetcherAssumeRoleProvider!AssumeRoleWithWebIdentityProviderBaseAssumeRoleCredentialFetcherBotoProviderCachedCredentialFetcherCanonicalNameCredentialSourcerConfigNotFoundConfigProviderContainerMetadataFetcherContainerProviderCredentialResolverCredentialRetrievalErrorCredentialsEnvProviderInstanceMetadataProviderInvalidConfigErrorMetadataRetrievalErrorOriginalEC2ProviderPartialCredentialsErrorProcessProviderProfileProviderBuilderReadOnlyCredentialsRefreshableCredentialsRefreshWithMFAUnsupportedErrorSharedCredentialProviderSSOProviderSSOTokenLoaderUnauthorizedSSOTokenErrorUnknownCredentialError_get_client_creator
_local_now_parse_if_needed_serialize_if_neededparseresolve_imds_endpoint_mode)tzutc)	AioConfig)AioSSOTokenProvider)AioContainerMetadataFetcherAioInstanceMetadataFetcherc                      j                  d      xs d} j                  d      } j                  d      } j                         j                  d      du} j                  d      t               t        d}|i }t               }t               }	t        t        || j                         |      	      }
t         ||
      }t         fdt         |      ||t        ||	|
g      |      }||g}|j                  ||      }t               t!               |	|
g}||z   |z   }|r&|j#                  |       t$        j'                  d       t)        |      }|S )zCreate a default credential resolver.
    This creates a pre-configured credential resolver
    that includes the default lookup chain for
    credentials.
    profiledefaultmetadata_service_timeoutmetadata_service_num_attemptsNec2_metadata_service_endpoint)r7   "ec2_metadata_service_endpoint_modeec2_credential_refresh_window)timeoutnum_attempts
user_agentconfig)iam_role_fetcher)cacheregion_namec                       j                   S N)full_config)sessions   y/var/www/fastuser/data/www/generator.snapmosaic.io/flask_app/venv/lib/python3.12/site-packages/aiobotocore/credentials.py<lambda>z,create_credential_resolver.<locals>.<lambda>h   s    G//     )load_configclient_creatorr?   profile_namecredential_sourcerprofile_provider_builderrJ   disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.)	providers)get_config_variableinstance_variablesgetr,   r   AioEnvProviderAioContainerProviderAioInstanceMetadataProviderr1   r<   AioProfileProviderBuilderAioAssumeRoleProviderr'   !AioCanonicalNameCredentialSourcerrO   AioOriginalEC2ProviderAioBotoProviderremoveloggerdebugAioCredentialResolver)rD   r?   r@   rJ   metadata_timeoutr;   rN   imds_configenv_providercontainer_providerinstance_metadata_providerrL   assume_role_providerpre_profileprofile_providerspost_profilerO   resolvers   `                 rE   create_credential_resolverri   A   s    ..y9FYL223MN../NOL11377	B$N *1)D)D+*
 /I/
 *KK }!#L-/!<3$%))+	
"  9u+  1/*7K@!<-/IJ
 ":	 	K 1::!) ; 
 	 "	L //,>I  	&8	

 %y9HOrG   c                   *    e Zd Zd Zd Zd Zd Zd Zy)rV   c                 $     t        | fd      S )Nc                  0     j                   j                  S rB   _sessionrC   selfs   rE   rF   zDAioProfileProviderBuilder._create_process_provider.<locals>.<lambda>        9 9 rG   )rJ   rH   )AioProcessProviderrp   rJ   s   ` rE   _create_process_providerz2AioProfileProviderBuilder._create_process_provider   s    !%9
 	
rG   c                 R    | j                   j                  d      }t        ||      S )Ncredentials_file)rJ   creds_filename)rn   rP   AioSharedCredentialProvider)rp   rJ   credential_files      rE   "_create_shared_credential_providerz<AioProfileProviderBuilder._create_shared_credential_provider   s*    --;;<NO*%*
 	
rG   c                 R    | j                   j                  d      }t        ||      S )Nconfig_file)rJ   config_filename)rn   rP   AioConfigProvider)rp   rJ   r|   s      rE   _create_config_providerz1AioProfileProviderBuilder._create_config_provider   s)    mm77F %'
 	
rG   c                 z     t         fdt         j                   j                         j                  ||      S )Nc                  0     j                   j                  S rB   rm   ro   s   rE   rF   zIAioProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>   rq   rG   )rH   rI   r?   rJ   rN   )$AioAssumeRoleWithWebIdentityProviderr'   rn   _region_name_cache)rp   rJ   rN   s   `  rE   _create_web_identity_providerz7AioProfileProviderBuilder._create_web_identity_provider   s9    39.t00 ++%-
 	
rG   c                      t         fd j                  j                  | j                   j                  t         j                   j                  |            S )Nc                  0     j                   j                  S rB   rm   ro   s   rE   rF   z@AioProfileProviderBuilder._create_sso_provider.<locals>.<lambda>   rq   rG   )r?   rJ   )rH   rI   rJ   r?   token_cachetoken_provider)AioSSOProviderrn   create_clientr   _sso_token_cacher/   rs   s   ` rE   _create_sso_providerz.AioProfileProviderBuilder._create_sso_provider   sN    9==66%++--.++)
 	
rG   N)__name__
__module____qualname__rt   rz   r   r   r    rG   rE   rV   rV      s    


	

rG   rV   c                 T   K   t        |       }|j                          d {   S 7 wrB   )ri   load_credentials)rD   rh   s     rE   get_credentialsr      s%     )'2H**,,,,s   (&(c                       fd}|S )Nc                     K   4 d {   }  | j                   di  d {   }d d d       d {    d   }|d   |d   |d   t        |d         dS 7 O7 77 )# 1 d {  7  sw Y   9xY ww)Nr   AccessKeyIdSecretAccessKeySessionToken
Expiration
access_key
secret_keytokenexpiry_timer   )assume_roler*   )stsresponsecredentialsclientparamss      rE   refreshz-create_assume_role_refresher.<locals>.refresh   s      	7 	7S,S__6v66H	7 	7}- &m4%&78 0/L0IJ	
 	
	76	7 	7 	7 	7sQ   A5AA5A AA A5A&A5A A5 A2&A)'A2.A5r   )r   r   r   s   `` rE   create_assume_role_refresherr      s    
 NrG   c                 :     G d d      } ||       j                   S )Nc                       e Zd Zd Zd Zy)/create_mfa_serial_refresher.<locals>._Refresherc                      || _         d| _        y )NF)_refresh_has_been_called)rp   r   s     rE   __init__z8create_mfa_serial_refresher.<locals>._Refresher.__init__   s    #DM$)D!rG   c                 x   K   | j                   r
t               d| _         | j                          d {   S 7 wNT)r   r!   r   ro   s    rE   callz4create_mfa_serial_refresher.<locals>._Refresher.call   s4     $$ 566$(D!(((s   1:8:N)r   r   r   r   r   r   rG   rE   
_Refresherr      s    	*	)rG   r   )r   )actual_refreshr   s     rE   create_mfa_serial_refresherr      s    ) ) n%***rG   c                       e Zd Zd Zy)AioCredentialsc                 `   K   t        | j                  | j                  | j                        S wrB   )r   r   r   r   ro   s    rE   get_frozen_credentialsz%AioCredentials.get_frozen_credentials   s&     "OOT__djj
 	
s   ,.N)r   r   r   r   r   rG   rE   r   r      s    
rG   r   c                        e Zd Z fdZed        Zej                  d        Zed        Zej                  d        Zed        Zej                  d        Zd Z	d	 Z
d
 Z xZS )AioRefreshableCredentialsc                 V    t        |   |i | t        j                         | _        y rB   )superr   asyncioLock_refresh_lockrp   argskwargs	__class__s      rE   r   z"AioRefreshableCredentials.__init__   s#    $)&)$\\^rG   c                     t        d      NzAmissing call to self._refresh. Use get_frozen_credentials instead)NotImplementedError_access_keyro   s    rE   r   z$AioRefreshableCredentials.access_key       "1
 	
rG   c                     || _         y rB   )r   rp   values     rE   r   z$AioRefreshableCredentials.access_key  
     rG   c                     t        d      r   )r   _secret_keyro   s    rE   r   z$AioRefreshableCredentials.secret_key  r   rG   c                     || _         y rB   )r   r   s     rE   r   z$AioRefreshableCredentials.secret_key  r   rG   c                     t        d      r   )r   _tokenro   s    rE   r   zAioRefreshableCredentials.token  r   rG   c                     || _         y rB   )r   r   s     rE   r   zAioRefreshableCredentials.token(  s	    rG   c                   K   | j                  | j                        sy | j                  j                         s| j                  4 d {    | j                  | j                        s	 d d d       d {    y | j                  | j                        }| j                  |       d {    	 d d d       d {    y | j                  | j                        rm| j                  4 d {    | j                  | j                        s	 d d d       d {    y | j                  d       d {    d d d       d {    y y 7 7 7 7 # 1 d {  7  sw Y   y xY w7 {7 Q7 87 *# 1 d {  7  sw Y   y xY ww)N)is_mandatoryT)refresh_needed_advisory_refresh_timeoutr   locked_mandatory_refresh_timeout_protected_refresh)rp   is_mandatory_refreshs     rE   r   z"AioRefreshableCredentials._refresh,  s    ""4#A#AB !!((*)) 	 	**4+I+IJ	 	 	 (,':':33($ --!5 .    	 	 	   !@!@A )) A A**4+J+JKA A A --4-@@@	A A A B	 		 	 	 	A A A	A A A As   AF	E
FE*F5E6F;0E+E,E1F<E=0F-E).F1E1FE+FE14E-5E19FE/FFEFE&EE&"F+F-E1/F1F7E:8F?Fc                   K   	 | j                          d {   }| j	                  |       t        | j                  | j                  | j                        | _	        | j                         r"d}t        j                  |       t        |      y 7 x# t        $ r$ |rdnd}t        j                  d|d       |r Y y w xY ww)N	mandatoryadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)_refresh_using	Exceptionr\   warning_set_from_datar   r   r   r   _frozen_credentials_is_expiredRuntimeError)rp   r   metadataperiod_namemsgs        rE   r   z,AioRefreshableCredentials._protected_refreshE  s     	!0022H$ 	H%#6d..$
  ;  NN3s## - 3 	)5+:KNN,	     !	s8   CB BB A4CB *B?<C>B??Cc                 V   K   | j                          d {    | j                  S 7 wrB   )r   r   ro   s    rE   r   z0AioRefreshableCredentials.get_frozen_credentialse  s&     mmo''' 	s   )'))r   r   r   r   propertyr   setterr   r   r   r   r   __classcell__r   s   @rE   r   r      s    ,     ! !     ! !   \\ A2$@(rG   r   c                   *     e Zd ZefdZd fd	Z xZS )!AioDeferredRefreshableCredentialsc                     || _         d | _        d | _        d | _        d | _        || _        t        j                         | _        || _	        d | _
        y rB   )r   r   r   r   _expiry_time_time_fetcherr   r   r   methodr   )rp   refresh_usingr   time_fetchers       rE   r   z*AioDeferredRefreshableCredentials.__init__k  sN    + )$\\^#' rG   c                 <    | j                   yt        | 	  |      S r   )r   r   r   )rp   
refresh_inr   s     rE   r   z0AioDeferredRefreshableCredentials.refresh_neededv  s"    ##+w%j11rG   rB   )r   r   r   r(   r   r   r   r   s   @rE   r   r   j  s    ;E 	(2 2rG   r   c                       e Zd Zd Zd Zd Zy)AioCachedCredentialFetcherc                     K   t        d      w)Nz_get_credentials())r   ro   s    rE   _get_credentialsz+AioCachedCredentialFetcher._get_credentials}  s     !"677s   c                 >   K   | j                          d {   S 7 wrB   )_get_cached_credentialsro   s    rE   fetch_credentialsz,AioCachedCredentialFetcher.fetch_credentials  s     113333   c                    K   | j                         }|*| j                          d{   }| j                  |       nt        j	                  d       |d   }t        |d   d      }|d   |d   |d	   |d
S 7 Pw)zGet up-to-date credentials.

        This will check the cache for up-to-date credentials, calling assume
        role if none are available.
        Nz*Credentials for role retrieved from cache.r   r   T)isor   r   r   r   )_load_from_cacher   _write_to_cacher\   r]   r*   )rp   r   creds
expirations       rE   r   z2AioCachedCredentialFetcher._get_cached_credentials  s      ((*!2244H  *LLEF')%*=4H
. 12>*%	
 	
 5s   &A;A9AA;N)r   r   r   r   r   r   r   rG   rE   r   r   |  s    84
rG   r   c                       e Zd Zy)"AioBaseAssumeRoleCredentialFetcherN)r   r   r   r   rG   rE   r  r    s     	rG   r  c                       e Zd Zd Zd Zy)AioAssumeRoleCredentialFetcherc                    K   | j                         }| j                          d{   }|4 d{   } |j                  di | d{   cddd      d{    S 7 :7 17 7 # 1 d{  7  sw Y   yxY ww)'Get credentials by calling assume role.Nr   )_assume_role_kwargs_create_clientr   )rp   r   r   r   s       rE   r   z/AioAssumeRoleCredentialFetcher._get_credentials  s|     ))+**,, 	3 	3S(2622	3 	3 	3 -	32	3 	3 	3 	3sf   $A>A!
A>A#A>A)A%A)A>A'A>#A>%A)'A>)A;/A20A;7A>c                    K   | j                   j                          d{   }| j                  d|j                  |j                  |j
                        S 7 7w)z2Create an STS client using the source credentials.Nr   )aws_access_key_idaws_secret_access_keyaws_session_token)_source_credentialsr   _client_creatorr   r   r   )rp   frozen_credentialss     rE   r  z-AioAssumeRoleCredentialFetcher._create_client  s`      **AACC 	 ##0;;"4"?"?066	 $ 
 	
 Ds   AA8AN)r   r   r   r   r  r   rG   rE   r
  r
    s    3

rG   r
  c                   2     e Zd Z	 	 	 d fd	Zd Zd Z xZS )-AioAssumeRoleWithWebIdentityCredentialFetcherc                 <    || _         t        | 	  |||||       y )N)
extra_argsr?   expiry_window_seconds)_web_identity_token_loaderr   r   )rp   rI   web_identity_token_loaderrole_arnr  r?   r  r   s          rE   r   z6AioAssumeRoleWithWebIdentityCredentialFetcher.__init__  s/     +D'!"7 	 	
rG   c                   K   | j                         }t        t              }| j                  d|      4 d{   } |j                  di | d{   cddd      d{    S 7 /7 7 	# 1 d{  7  sw Y   yxY ww)r  )signature_versionr   r=   Nr   )r  r.   r   r  assume_role_with_web_identity)rp   r   r=   r   s       rE   r   z>AioAssumeRoleWithWebIdentityCredentialFetcher._get_credentials  s     ))+ X6''f'= 	H 	H===GGG	H 	H 	HG	H 	H 	H 	HsV   8BA*BA0A,A0B$A.%B,A0.B0B6A97B>Bc                 Z    t        | j                        }| j                         }||d<   |S )zAGet the arguments for assume role based on current configuration.WebIdentityToken)r   _assume_kwargsr  )rp   assume_role_kwargsidentity_tokens      rE   r  zAAioAssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs  s3    %d&9&9:88:1?-.!!rG   )NNN)r   r   r   r   r   r  r   r   s   @rE   r  r    s     "
(H"rG   r  c                   D     e Zd Zej                  d fd
Zd Zd Z xZS )rr   )popenc                ,    t        |   |i |d|i y )Nr(  )r   r   )rp   r(  r   r   r   s       rE   r   zAioProcessProvider.__init__  s    $6&66rG   c                 *   K    j                   y  j                         d {   }|j                  d      %t        j	                  | fd j
                        S t        |d   |d   |j                  d       j
                        S 7 hw)Nr   c                  &    j                         S rB   )_retrieve_credentials_using)credential_processrp   s   rE   rF   z)AioProcessProvider.load.<locals>.<lambda>  s    889KL rG   r   r   r   )r   r   r   r   )_credential_processr,  rR   r   create_from_metadataMETHODr   )rp   
creds_dictr-  s   ` @rE   loadzAioProcessProvider.load  s     !55%;;<NOO
>>-(4,AAL  !,/!,/..);;	
 	
 Ps   $BBA)Bc                   K   t        |      } | j                  |t        j                  t        j                  d d {   }|j	                          d {   \  }}|j
                  dk7  r&t        | j                  |j                  d            t        j                  j                  j                  |j                  d            }|j                  dd      }|dk7  rt        | j                  d| d	      	 |d
   |d   |j                  d      |j                  d      dS 7 7 # t        $ r}t        | j                  d|       d }~ww xY ww)N)stdoutstderrr   utf-8provider	error_msgVersionz<Version key not provided>   zUnsupported version 'z8' for credential process provider, supported versions: 1r   r   r   r   r   z"Missing required key in response: )r   _popen
subprocessPIPEcommunicate
returncoder   r0  decodebotocorecompatjsonloadsrR   KeyError)	rp   r-  process_listpr4  r5  parsedversiones	            rE   r,  z.AioProcessProvider._retrieve_credentials_using  sJ     **<=$++*//*//
 
  !}}.<<1*g0F  %%++FMM',BC**Y(DEa<*+G9 56 7 	$]3$%67N3%zz,7	 '
 /,  	*>qcB 	sH   >E D+ED-B&E *D/ *E-E/	E8EEE)	r   r   r   r   create_subprocess_execr   r2  r,  r   r   s   @rE   rr   rr     s    $+$B$B 7
(!rG   rr   c                       e Zd Zd Zy)rU   c                    K   | j                   }|j                          d {   }|sy t        j                  d|d          t        j                  || j                  |j                        }|S 7 Nw)Nz#Found credentials from IAM Role: %s	role_namer   r   )_role_fetcherretrieve_iam_role_credentialsr\   infor   r/  r0  )rp   fetcherr   r  s       rE   r2  z AioInstanceMetadataProvider.load  su     $$ >>@@18K3H	
 *>>;;!?? ? 

  As    A3A1AA3Nr   r   r   r2  r   rG   rE   rU   rU     s    rG   rU   c                       e Zd Zd Zy)rS   c                 n  K   | j                   j                  | j                  d   d      }|rt        j	                  d       | j                         } |d      }|d   }|/t        |      }t        |d   |d   |d   ||| j                  	      S t        |d   |d   |d   | j                  
      S y w)Nr    z+Found credentials in environment variables.F)require_expiryr   r   r   )r   r   r   )
environrR   _mappingr\   rS  _create_credentials_fetcherr+   r   r0  r   )rp   r   rT  r   r   s        rE   r2  zAioEnvProvider.load/  s     \\%%dmmL&A2F
KKEF668G!7K%m4K&#K00--(");;  "L)L)G${{	  s   B3B5NrU  r   rG   rE   rS   rS   .  s    rG   rS   c                       e Zd Zd Zy)rY   c                 V  K   d| j                   v rt        j                  j                  | j                   d         }| j	                  |      }| j
                  |v rKt        j                  d       || j
                     }|| j                     }t        ||| j                        S y y w)NAWS_CREDENTIAL_FILEz)Found credentials in AWS_CREDENTIAL_FILE.rZ  )_environospath
expanduser_parser
ACCESS_KEYr\   rS  
SECRET_KEYr   r0  )rp   	full_pathr  r   r   s        rE   r2  zAioOriginalEC2Provider.loadN  s      DMM1**34I LL+E%'GH"4??3
"4??3
%
4;;  ( s   B'B)NrU  r   rG   rE   rY   rY   M  s    rG   rY   c                       e Zd Zd Zy)rx   c                   K   	 | j                  | j                        }| j                  |v r|| j                     }| j                  |v rtt
        j                  d| j                         | j                  || j                  | j                        \  }}| j                  |      }t        |||| j                        S y y # t        $ r Y y w xY ww)Nz0Found credentials in shared credentials file: %srZ  )_ini_parser_creds_filenamer   _profile_namerf  r\   rS  _extract_creds_from_mappingrg  _get_session_tokenr   r0  )rp   available_credsr=   r   r   r   s         rE   r2  z AioSharedCredentialProvider.loada  s     	"..t/C/CDO 0$T%7%78F&(F(( *.)I)IDOOT__*&
J //7%
E$++  ) 1  		s(   CC  B!C 	C	CCCNrU  r   rG   rE   rx   rx   `  s    rG   rx   c                       e Zd Zd Zy)r~   c                   K   	 | j                  | j                        }| j                  |d   v r|d   | j                     }| j                  |v rtt
        j                  d| j                         | j                  || j                  | j                        \  }}| j                  |      }t        |||| j                        S y y # t        $ r Y y w xY ww)Nprofilesz$Credentials found in config file: %srZ  )_config_parser_config_filenamer   rm  rf  r\   rS  rn  rg  ro  r   r0  )rp   rC   profile_configr   r   r   s         rE   r2  zAioConfigProvider.loadw  s     	--d.C.CDK Z!88(4T5G5GHN.0:)) *.)I)I"DOOT__*&
J //?%
E$++  1 #  		s(   CC B'C	CCCCNrU  r   rG   rE   r~   r~   v  s    rG   r~   c                       e Zd Zd Zy)rZ   c                   K   | j                   | j                  v r| j                  | j                      g}n| j                  }|D ]  }	 | j                  |      }d|v s|d   }| j
                  |v s.t        j                  d|       | j                  || j
                  | j                        \  }}t        ||| j                        c S  y # t        $ r Y w xY ww)Nr   z)Found credentials in boto config file: %srZ  )BOTO_CONFIG_ENVra  DEFAULT_CONFIG_FILENAMESrk  r   rf  r\   rS  rn  rg  r   r0  )rp   potential_locationsfilenamer=   r   r   r   s          rE   r2  zAioBotoProvider.load  s     4==0#'==1E1E#F"G"&"?"?+ 	H))(3 &$]3??k1KKCX .2-M-M#T__doo.*J
 *"Jt{{ 	 " s7   ACCCC2AC	CCCCNrU  r   rG   rE   rZ   rZ     s    rG   rZ   c                   0    e Zd Zd Zd Zd Zd Zd Zd Zy)rW   c                   K   | j                         | _        | j                  j                  di       }|j                  | j                  i       }| j	                  |      r#| j                  | j                         d {   S y 7 w)Nrs  )_load_config_loaded_configrR   rm  _has_assume_role_config_vars_load_creds_via_assume_role)rp   rs  r3   s      rE   r2  zAioAssumeRoleProvider.load  su     "//1&&**:r:,,t1126,,W599$:L:LMMM 6Ms   A=B?B Bc                   K   | j                  |      }| j                  ||       d {   }i }|j                  d      }|||d<   |j                  d      }|||d<   |j                  d      }|||d<   |j                  d      }|||d<   t        | j                  ||d	   || j
                  | j                  
      }	|	j                  }
|t        |
      }
t        | j                  |
t              S 7 ͭw)Nrole_session_nameRoleSessionNameexternal_id
ExternalId
mfa_serialSerialNumberduration_secondsDurationSecondsr  )rI   source_credentialsr  r  mfa_prompterr?   )r   r   r   )_get_role_config_resolve_source_credentialsrR   r
  r  	_prompterr?   r   r   r   r0  r(   )rp   rJ   role_configr  r  r  r  r  r  rT  	refreshers              rE   r  z1AioAssumeRoleProvider._load_creds_via_assume_role  s$    ++L9#'#C#C$
 
 
'OO,?@(,=J()!oom4"'2J|$ __\2
!)3J~&&??+=>',<J()0//1 ,!**
 --	!3I>I
 1;;##
 	
I
s   'C9C7CC9c                    K   |j                  d      }|| j                  ||       d {   S |d   }| j                  j                  |       | j	                  |       d {   S 7 =7 w)Ncredential_sourcesource_profile)rR    _resolve_credentials_from_source_visited_profilesappend!_resolve_credentials_from_profile)rp   r  rJ   r  r  s        rE   r  z1AioAssumeRoleProvider._resolve_source_credentials  sz     'OO,?@(>>!<   %%56%%n5;;NKKK Ls!   )A-A)8A-$A+%A-+A-c                   K   | j                   j                  di       }||   }| j                  |      r| j                  s| j	                  |      S | j                  |      s| j                  |      sU| j                  j                  |d      }t        |      }|j                          d {   }|d}t        ||z        |S | j                  |       d {   S 7 27 w)Nrs  TrM   z.The source profile "%s" must have credentials.r9  )r  rR   _has_static_credentials_profile_provider_builder(_resolve_static_credentials_from_profiler  rO   r^   r   r   r  )rp   rJ   rs  r3   rf   profile_chainr   error_messages           rE   r  z7AioAssumeRoleProvider._resolve_credentials_from_profile  s     &&**:r:<( ((122@@II))
227; $ > > H H)!% !I ! 22CDM - > > @@K"D  )+l:  55lCCC A Ds$   B-C&/C"0-C&C$C&$C&c                     	 t        |d   |d   |j                  d            S # t        $ r%}t        | j                  t        |            d }~ww xY w)Nr  r  r  )r   r   r   )r8  cred_var)r   rR   rF  r   r0  str)rp   r3   rK  s      rE   r  z>AioAssumeRoleProvider._resolve_static_credentials_from_profile  s_    		!"#67"#:;kk"56 
  	)s1v 	s   "% 	A AAc                 |   K   | j                   j                  |       d {   }|t        |d|z        |S 7 w)NzBNo credentials found in credential_source referenced in profile %sr7  )_credential_sourcerr  r   )rp   r  rJ   r   s       rE   r  z6AioAssumeRoleProvider._resolve_credentials_from_source  sX      !44GG
 
 **$&23  
s   <:<N)	r   r   r   r2  r  r  r  r  r  r   rG   rE   rW   rW     s$    N*
X	LD:
rG   rW   c                       e Zd Zd Zd Zy)r   c                 >   K   | j                          d {   S 7 wrB   )_assume_role_with_web_identityro   s    rE   r2  z)AioAssumeRoleWithWebIdentityProvider.load"  s     88::::r   c                 T  K   | j                  d      }|sy | j                  |      }| j                  d      }|sd}t        |      i }| j                  d      }|||d<   t        | j                  |||| j
                        }t        | j                  |j                        S w)	Nweb_identity_token_filer  zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r  r  r  )rI   r  r  r  r?   rP  )	_get_config_token_loader_clsr   r  r  r?   r   r0  r   )rp   
token_pathtoken_loaderr  r9  r  r  rT  s           rE   r  zCAioAssumeRoleWithWebIdentityProvider._assume_role_with_web_identity%  s     %%&?@
--j9##J/H  %y99
 ,,-@A(,=J()?//&2!**
 1;;!33
 	
s   B&B(N)r   r   r   r2  r  r   rG   rE   r   r   !  s    ;"
rG   r   c                       e Zd Zd Zd Zy)rX   c                    K   | j                  |      }t        |t              r|j                          d{   S |j	                          d{   S 7 7 w)a  Loads source credentials based on the provided configuration.

        :type source_name: str
        :param source_name: The value of credential_source in the config
            file. This is the canonical name of the credential provider.

        :rtype: Credentials
        N)_get_provider
isinstancer^   r   r2  )rp   source_namesources      rE   r  z4AioCanonicalNameCredentialSourcer.source_credentialsK  sM      ##K0f3400222[[]"" 3"s!   5AAAAAAc                     | j                  |      }|j                         dv r$| j                  d      }|||S t        ||g      S |t	        |      |S )a#  Return a credential provider by its canonical name.

        :type canonical_name: str
        :param canonical_name: The canonical name of the provider.

        :raises UnknownCredentialError: Raised if no
            credential provider by the provided name
            is found.
        )sharedconfigsharedcredentialszassume-role)name)_get_provider_by_canonical_namelower_get_provider_by_methodr^   r&   )rp   canonical_namer8  rd   s       rE   r  z/AioCanonicalNameCredentialSourcer._get_providerY  sv     77G !%JJ#'#?#?#N #/
 #//
 -.BH-MNN(n==rG   N)r   r   r   r  r  r   rG   rE   rX   rX   J  s    #$rG   rX   c                   0     e Zd Z fdZd Zd Zd Z xZS )rT   c                 x    t        |   |i | t        | j                  t              rt               | _        y y rB   )r   r   r  _fetcherr   r0   r   s      rE   r   zAioContainerProvider.__init__  s5    $)&) dmm%=>79DM ?rG   c                    K   | j                   | j                  v s| j                  | j                  v r| j                          d {   S y 7 wrB   )ENV_VARra  ENV_VAR_FULL_retrieve_or_failro   s    rE   r2  zAioContainerProvider.load  sB     <<4==(D,=,=,N//111 -O1s   AAAAc           
        K   | j                         r3| j                  j                  | j                  | j                           }n| j                  | j
                     }| j                         }| j                  ||      } |        d {   }t        |d   |d   |d   | j                  t        |d         |      S 7 4w)Nr   r   r   r   )r   r   r   r   r   r   )_provided_relative_urir  full_urlra  r  r  _build_headers_create_fetcherr   r0  r)   )rp   full_uriheadersrT  r  s        rE   r  z&AioContainerProvider._retrieve_or_fail  s     &&(}}--dmmDLL.IJH}}T%6%67H%%'&&x9i(\*\*.;;(})=>!
 	
  s   B	CC 5Cc                       fd}|S )Nc                    K   	 j                   j                         d {   } | d   | d   | d   | d	   d
S 7 # t        $ r=}t        j	                  d|d       t        j                  t        |            d }~ww xY ww)N)r  z'Error retrieving container metadata: %sTr   r7  r   r   Tokenr   r   )r  retrieve_full_urir   r\   r]   r   r0  r  )r   rK  r  r  rp   s     rE   fetch_credsz9AioContainerProvider._create_fetcher.<locals>.fetch_creds  s     
!%!@!@g "A "  '}5&'89!'*'5	  * =q4   /![[CF 	s1   B ? =? B? 	B8B  BBr   )rp   r  r  r  s   ``` rE   r  z$AioContainerProvider._create_fetcher  s    	& rG   )r   r   r   r   r2  r  r  r   r   s   @rE   rT   rT     s    :2
"rG   rT   c                       e Zd Zd Zy)r^   c                    K   | j                   D ]@  }t        j                  d|j                         |j	                          d{   }|>|c S  y7 w)zw
        Goes through the credentials chain, returning the first ``Credentials``
        that could be loaded.
        zLooking for credentials via: %sN)rO   r\   r]   r0  r2  )rp   r8  r  s      rE   r   z&AioCredentialResolver.load_credentials  sQ       	HLL:HOOL"--/)E 		  *s   AAAAAN)r   r   r   r   r   rG   rE   r^   r^     s    rG   r^   c                   @     e Zd ZdZ	 	 	 	 	 d fd	Zd Zd Zd Z xZS )AioSSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZc                     || _         || _        || _        || _        || _        || _        |	| _        |
| _        t        | %  ||       y rB   )
r  _sso_region
_role_name_account_id
_start_url_token_loader_token_provider_sso_session_namer   r   )rp   	start_url
sso_regionrO  
account_idrI   r  r?   r  r   sso_session_namer   s              rE   r   z AioSSOCredentialFetcher.__init__  sS      .%#%#)-!1 56rG   c                 ,   | j                   | j                  d}| j                  r| j                  |d<   n| j                  |d<   t	        j
                  |dd      }t        |j                  d            j                         }| j                  |      S )N)roleName	accountIdsessionNamestartUrlT),:)	sort_keys
separatorsr6  )
r  r  r  r  rD  dumpsr   encode	hexdigest_make_file_safe)rp   r   argument_hashs      rE   _create_cache_keyz)AioSSOCredentialFetcher._create_cache_key  s    ))
 !!"&"8"8D#Dzz$$:FT[[12<<>##M22rG   c                     |dz  }t         j                   j                  |t                     }|j                  | j                        S )Ng     @@)datetimefromtimestampr-   strftime_UTC_DATE_FORMAT)rp   timestamp_mstimestamp_seconds	timestamps       rE   _parse_timestampz(AioSSOCredentialFetcher._parse_timestamp  s?    (61%%334EuwO	!!$"7"788rG   c           	        K   t        t        | j                        }| j                  d|      4 d{   }| j                  r=| j                  j                         }|j                          d{   j                  }n| j                  | j                        d   }| j                  | j                  |d}	  |j                  di | d{   }|d   }d|d   |d	   |d
   | j!                  |d         dd}|cddd      d{    S 7 7 7 E# |j                  j                  $ r t               w xY w7 2# 1 d{  7  sw Y   yxY ww)z4Get credentials by calling SSO get role credentials.)r  r@   ssor   NaccessToken)r  r  r  roleCredentialsaccessKeyIdsecretAccessKeysessionTokenr  )r   r   r   r   )ProviderTyper   r   )r   r   r  r  r  
load_tokenget_frozen_tokenr   r  r  r  r  get_role_credentials
exceptionsUnauthorizedExceptionr%   r  )rp   r=   r   initial_token_datar   r   r   r   s           rE   r   z(AioSSOCredentialFetcher._get_credentials  sl    &((
 ''f'= 	 	##%)%9%9%D%D%F"1BBDDKK**4??;MJ !OO!--$F
2!<!<!<!Fv!FF ##45K !&#.}#='23D'E$/$?"&"7"7#L1#	 
K ;	 	 	 E G$$:: 2/112	 	 	 	s   3EDE:E3D4AE<DDD+EEE EED$D==E EEE	EE)NNNNN)	r   r   r   r  r   r  r  r   r   r   s   @rE   r  r    s.    + "7.39#rG   r  c                       e Zd Zd Zy)r   c                 :  K   | j                         }|sy |d   |d   |d   |d   | j                  t        | j                        | j                  d}d|v r|d   |d<   | j
                  |d	<   t        di |}t        | j                  |j                  
      S w)Nsso_start_urlr  sso_role_namesso_account_id)r?   )r  r  rO  r  rI   r  r?   sso_sessionr  r   rP  r   )
_load_sso_configr  r$   _token_cacher?   r  r  r   r0  r   )rp   
sso_configfetcher_kwargssso_fetchers       rE   r2  zAioSSOProvider.load  s     **,
 $O4$\2#O4$%56"22*1B1BCZZ
 J&1;M1JN-./3/C/CN+,-??0;;%77
 	
s   BBNrU  r   rG   rE   r   r     s    
rG   r   )NN)]r   r  rD  loggingrb  r=  copyr   hashlibr   botocore.compatrB  r   r   botocore.configr   botocore.credentialsr   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   dateutil.tzr-   aiobotocore.configr.   aiobotocore.tokensr/   aiobotocore.utilsr0   r1   	getLoggerr   r\   ri   rV   r   r   r   create_aio_mfa_serial_refresherr   r   r   r   r  r
  r  rr   rU   rS   rY   rx   r~   rZ   rW   r   rX   rT   r^   r  r   r   rG   rE   <module>r     s       	      . "& & & & & & & & & &N  ( 2
 
		8	$Xv,
 6 ,
^-
"+& #> 
[ 
i( 6 i(X2(A 2$
!8 
<	#%?	
!C
.&"&&"R9 9x": $[ >0 &": , 0l 4v. vr&
+L &
R3(F 3l1, 1h. ,Q8 Qh
[ 
rG   