a

�,�hy/�@
s�dZd
dl
mZ
dg
Zd
dlZd
dlmZmZmZm	Z	
ddl
mZmZm
Z

ddlmZmZmZmZmZmZmZ
dd	lmZ
d
dlmZ
d
dlmZmZ
d
d
lmZ
er�d
dlmZ
Gdd�d�ZdS)z6Implementing support for MySQL Authentication Plugins.�)
�annotations�MySQLAuthenticatorN)�
TYPE_CHECKING�Any�Dict�Optional�)�InterfaceError�NotSupportedError�
get_exception)�AUTH_SWITCH_STATUS�DEFAULT_CHARSET_ID�DEFAULT_MAX_ALLOWED_PACKET�
ERR_STATUS�EXCHANGE_FURTHER_STATUS�
MFA_STATUS�	OK_STATUS)
�
HandShakeType�
)
�logger)�MySQLAuthPlugin�get_auth_plugin)
�
MySQLProtocol)
�MySQLSocketc@
s�eZ
dZd
Zdd�
dd�Zedd�
dd��
Zed	d�
d
d��
Zd%dddddd�dd�Zdddd�dd�Z	dddd�dd�Z
dddddededdddfddddddddddddd dd!dd"�d#d$�Z
dS)&rz$Implements the authentication phase.�None)
�returnc

C
s(d
|_i|_
i|_d|_d|_d|_dS)zConstructor.�FN)�	_username�
_passwords�_plugin_config�_ssl_enabled�_auth_strategy�_auth_plugin_class�
�self�r%�U/opt/nydus/tmp/pip-target-wkfpz8uv/lib64/python/mysql/connector/aio/authentication.py�__init__=s




zMySQLAuthenticator.__init__�boolc


C
s|jS)
z&Signals whether or not SSL is enabled.)
r r#r%r%r&�ssl_enabledFszMySQLAuthenticator.ssl_enabledzDict[str, Any]c


C
s|jS)
a�
Custom arguments that are being provided to the authentication plugin.

        The parameters defined here will override the ones defined in the
        auth plugin itself.

        The plugin config is a read-only property - the plugin configuration
        provided when invoking `authenticate()` is recorded and can be queried
        by accessing this property.

        Returns:
            dict: The latest plugin configuration provided when invoking
                  `authenticate()`.
        )
rr#r%r%r&�
plugin_configKsz MySQLAuthenticator.plugin_configNr�strz
Optional[str]�int)�new_strategy_name�strategy_class�username�password_factorrcC
sP|d
ur|j}|d
ur|j
}t�d|
�
t|
|d�||j�|d�|jd�|_d
S)a�Switch the authorization plugin.

        Args:
            new_strategy_name: New authorization plugin name to switch to.
            strategy_class: New authorization plugin class to switch to
                            (has higher precedence than the authorization plugin name).
            username: Username to be used - if not defined, the username
                      provided when `authentication()` was invoked is used.
            password_factor: Up to three levels of authentication (MFA) are allowed,
                             hence you can choose the password corresponding to the 1st,
                             2nd, or 3rd factor - 1st is the default.
        NzSwitching to strategy %s)Zplugin_name�auth_plugin_classr)
r))	rr"r�debugrr�getr)r!)r$r-r.r/r0r%r%r&�_switch_auth_strategy\s



�

�z(MySQLAuthenticator._switch_auth_strategyr�byteszOptional[bytes])�sock�pktrc�
s�d
}|dtkr�||j
v
r"td�
�
t�|�
\}}|j||d�
t�d||jj	�
|jj
|
|fi|j�
�
IdH}|dtkr�t�
|�
}|jj|
|fi|j�
�
IdH}|dtkr�t�d�

|S|dtkr�t|�
�
|d7}qt�d	�

dS)
aHandle MFA (Multi-Factor Authentication) response.

        Up to three levels of authentication (MFA) are allowed.

        Args:
            sock: Pointer to the socket connection.
            pkt: MFA response.

        Returns:
            ok_packet: If last server's response is an OK packet.
            None: If last server's response isn't an OK packet and no ERROR was raised.

        Raises:
            InterfaceError: If got an invalid N factor.
            errors.ErrorTypes: If got an ERROR response.
        r�z5Failed Multi Factor Authentication (invalid N factor))
r0zMFA %i factor %sNzMFA completed succesfullyrz"MFA terminated with a no ok packet)rrr	rZparse_auth_next_factorr4rr2r!�name�auth_switch_responserr�parse_auth_more_data�auth_more_responserrr�warning)r$r6r7Zn_factorr-�	auth_datar%r%r&�
_mfa_n_factor~s:




�


�
�



�
�






z MySQLAuthenticator._mfa_n_factorc�
s
|d
tkr t
|�
dkr td�
�
|d
tkrlt�d�

t�|�
\}}|�|�

|jj	|
|fi|j
�
�
IdH}|d
tkr�t�d�

t�|�
}|jj
|
|fi|j
�
�
IdH}|d
tkr�t�d|jj�
|S|d
tk�
rt�d�

t�d	|jj�
|�|
|�IdHS|d
tk�
rt|�
�
dS)
a�
Handle server's response.

        Args:
            sock: Pointer to the socket connection.
            pkt: Server's response after completing the `HandShakeResponse`.

        Returns:
            ok_packet: If last server's response is an OK packet.
            None: If last server's response isn't an OK packet and no ERROR was raised.

        Raises:
            errors.ErrorTypes: If got an ERROR response.
            NotSupportedError: If got Authentication with old (insecure) passwords.
        r8�z�Authentication with old (insecure) passwords is not supported. For more information, lookup Password Hashing in the latest MySQL manualz+Server's response is an auth switch requestNzExchanging further packetsz%s completed succesfullyz$Starting multi-factor authenticationzMFA 1 factor %s)r�lenr
rr2rZparse_auth_switch_requestr4r!r:rrr;r<rr9rr?rr)r$r6r7r-r>r%r%r&�_handle_server_response�s>

�






�
�





�
�






z*MySQLAuthenticator._handle_server_responserr
FrzOptional[Dict[str, str]]r)r6�	handshaker/�	password1�	password2�	password3�database�charset�client_flags�max_allowed_packet�auth_pluginr1�
conn_attrs�is_change_user_requestr*rc�
s�||_|||d
�|_
t�|�
|_||_tj||||||	|
|||
||j|j	d�
\}|_
|r\dnd}|
j|g
|�
R�IdH
t|
�
�IdH�
}|�|
|�IdH}|dur�td�
d�|S)a
Perform the authentication phase.

        During re-authentication you must set `is_change_user_request` to True.

        Args:
            sock: Pointer to the socket connection.
            handshake: Initial handshake.
            username: Account's username.
            password1: Account's password factor 1.
            password2: Account's password factor 2.
            password3: Account's password factor 3.
            database: Initial database name for the connection.
            charset: Client charset (see [1]), only the lower 8-bits.
            client_flags: Integer representing client capabilities flags.
            max_allowed_packet: Maximum packet size.
            auth_plugin: Authorization plugin name.
            auth_plugin_class: Authorization plugin class (has higher precedence
                               than the authorization plugin name).
            conn_attrs: Connection attributes.
            is_change_user_request: Whether is a `change user request` operation or not.
            plugin_config: Custom configuration to be passed to the auth plugin
                           when invoked. The parameters defined here will override the
                           ones defined in the auth plugin itself.

        Returns:
            ok_packet: OK packet.

        Raises:
            InterfaceError: If OK packet is NULL.

        References:
            [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/                page_protocol_basic_character_set.html#a_protocol_character_set
        )rr�)
rCr/�passwordrGrHrIrJrKr1rLrMr)r*)r
r
)NNNzGot a NULL ok_pkt)rr�copy�deepcopyrr"rZ	make_authr)r*r!�writer5�readrBr	)r$r6rCr/rDrErFrGrHrIrJrKr1rLrMr*Zresponse_payloadZ	send_argsr7Zok_pktr%r%r&�authenticate�s45















�



zMySQLAuthenticator.authenticate)NNr)�__name__�
__module__�__qualname__�__doc__r'�propertyr)r*r4r?rBr
rrTr%r%r%r&r:s2
	



�"6;










�) rX�
__future__r�__all__rP�typingrrrr�errorsr	r
r�protocolrr
rrrrr�typesrrZpluginsrrr�networkrrr%r%r%r&�<module>s
$