
    *h2                        S r SSKJr  S/rSSKJrJrJrJr  SSK	J
r
JrJr  SSKJrJrJrJrJrJrJr  SSKJr  S	S
KJr  S	SKJrJr  S	SKJr  \(       a  S	SKJr   " S S5      rg)z6Implementing support for MySQL Authentication Plugins.    )annotationsMySQLAuthenticator)TYPE_CHECKINGAnyDictOptional   )InterfaceErrorNotSupportedErrorget_exception)AUTH_SWITCH_STATUSDEFAULT_CHARSET_IDDEFAULT_MAX_ALLOWED_PACKET
ERR_STATUSEXCHANGE_FURTHER_STATUS
MFA_STATUS	OK_STATUS)HandShakeType   )logger)MySQLAuthPluginget_auth_plugin)MySQLProtocol)MySQLSocketc                     \ rS rSrSrSS jr\SS j5       r\SS j5       rSS jr	   S         SS jjr
      SS	 jr      SS
 jrSSSSS\SS\SSSSSS4                                   SS jjrSrg)r   8   z$Implements the authentication phase.c                X    SU l         0 U l        0 U l        SU l        SU l        SU l        g)zConstructor. FN)	_username
_passwords_plugin_config_ssl_enabled_auth_strategy_auth_plugin_classselfs    Z/var/www/auris/envauris/lib/python3.13/site-packages/mysql/connector/aio/authentication.py__init__MySQLAuthenticator.__init__;   s0     *,.0"'9=15    c                    U R                   $ )z&Signals whether or not SSL is enabled.)r"   r%   s    r'   ssl_enabledMySQLAuthenticator.ssl_enabledD   s        r*   c                    U R                   $ )a  Custom arguments that are being provided to the authentication plugin.

The parameters defined here will override the ones defined in the
auth plugin itself.

The plugin config is a read-only property - the plugin configuration
provided when invoking `authenticate()` is recorded and can be queried
by accessing this property.

Returns:
    dict: The latest plugin configuration provided when invoking
          `authenticate()`.
)r!   r%   s    r'   plugin_config MySQLAuthenticator.plugin_configI   s     """r*   c                :    U R                   R                  U5        g)z,Update the 'plugin_config' instance variableN)r!   update)r&   configs     r'   update_plugin_config'MySQLAuthenticator.update_plugin_configZ   s    ""6*r*   Nc                    Uc  U R                   nUc  U R                  n[        R                  " SU5        [	        XS9" UU R
                  R                  US5      U R                  S9U l        g)a\  Switch the authorization plugin.

Args:
    new_strategy_name: New authorization plugin name to switch to.
    strategy_class: New authorization plugin class to switch to
                    (has higher precedence than the authorization plugin name).
    username: Username to be used - if not defined, the username
              provided when `authentication()` was invoked is used.
    password_factor: Up to three levels of authentication (MFA) are allowed,
                     hence you can choose the password corresponding to the 1st,
                     2nd, or 3rd factor - 1st is the default.
NzSwitching to strategy %s)plugin_nameauth_plugin_classr   )r,   )	r   r$   r   debugr   r    getr,   r#   )r&   new_strategy_namestrategy_classusernamepassword_factors        r'   _switch_auth_strategy(MySQLAuthenticator._switch_auth_strategy^   sk    & ~~H!!44N/1BC-)
 OO4((
r*   c                  #    SnUS   [         :X  Ga?  X0R                  ;  a  [        S5      e[        R                  " U5      u  pEU R                  XCS9  [        R                  " SX0R                  R                  5        U R                  R                  " X40 U R                  D6I Sh  vN nUS   [        :X  aE  [        R                  " U5      nU R                  R                  " X40 U R                  D6I Sh  vN nUS   [        :X  a  [        R                  " S5        U$ US   [         :X  a  [#        U5      eUS-  nUS   [         :X  a  GM?  [        R$                  " S	5        g N No7f)
a  Handle MFA (Multi-Factor Authentication) response.

Up to three levels of authentication (MFA) are allowed.

Args:
    sock: Pointer to the socket connection.
    pkt: MFA response.

Returns:
    ok_packet: If last server's response is an OK packet.
    None: If last server's response isn't an OK packet and no ERROR was raised.

Raises:
    InterfaceError: If got an invalid N factor.
    errors.ErrorTypes: If got an ERROR response.
r	      z5Failed Multi Factor Authentication (invalid N factor))r>   zMFA %i factor %sNzMFA completed succesfullyr   z"MFA terminated with a no ok packet)r   r    r
   r   parse_auth_next_factorr?   r   r9   r#   nameauth_switch_responser!   r   parse_auth_more_dataauth_more_responser   r   r   warning)r&   sockpktn_factorr;   	auth_datas         r'   _mfa_n_factor MySQLAuthenticator._mfa_n_factor   sW    * !f
".$K  ,9+O+OPS+T(&&'8&SLL+X7J7J7O7OP++@@#'#6#6 C 1v00)>>sC	 //BB'+':':  1v"89
1v##C((MH7 !f
": 	;<)s,   B'E-)E)*AE-;E+<AE-E-+E-c                  #    US   [         :X  a  [        U5      S:X  a  [        S5      eUS   [         :X  an  [        R                  " S5        [
        R                  " U5      u  p4U R                  U5        U R                  R                  " X40 U R                  D6I Sh  vN nUS   [        :X  a[  [        R                  " S5        [
        R                  " U5      nU R                  R                  " X40 U R                  D6I Sh  vN nUS   [        :X  a-  [        R                  " SU R                  R                  5        U$ US   [         :X  aZ  [        R                  " S5        [        R                  " S	U R                  R                  5        U R#                  X5      I Sh  vN $ US   [$        :X  a  ['        U5      eg GN' N N"7f)
a  Handle server's response.

Args:
    sock: Pointer to the socket connection.
    pkt: Server's response after completing the `HandShakeResponse`.

Returns:
    ok_packet: If last server's response is an OK packet.
    None: If last server's response isn't an OK packet and no ERROR was raised.

Raises:
    errors.ErrorTypes: If got an ERROR response.
    NotSupportedError: If got Authentication with old (insecure) passwords.
rB      zAuthentication with old (insecure) passwords is not supported. For more information, lookup Password Hashing in the latest MySQL manualz+Server's response is an auth switch requestNzExchanging further packetsz%s completed succesfullyz$Starting multi-factor authenticationzMFA 1 factor %s)r   lenr   r   r9   r   parse_auth_switch_requestr?   r#   rE   r!   r   rF   rG   r   rD   r   rM   r   r   )r&   rI   rJ   r;   rL   s        r'   _handle_server_response*MySQLAuthenticator._handle_server_response   s    & q6''CHM#>  q6''LLFG+8+R+RSV+W(&&'89++@@#'#6#6 C q6,,LL56%::3?I++>>#'#6#6 C q6YLL3T5H5H5M5MNJq6ZLL?@LL*D,?,?,D,DE++D666q6Z$$/ 7s8   BG G!A'GG
	B G)G*G
GGr   r   Fc                  #    X0l         XEUS.U l        Xl        Xl        [        R
                  " UUUUUU	UUUUUU R                  U R                  S9u  nU l        U(       a  SSU4OSSU4nUR                  " U/UQ76 I Sh  vN   [        UR                  U5      I Sh  vN 5      nU R                  UU5      I Sh  vN nUc  [        S5      SeU$  NQ N5 N7f)a  Perform the authentication phase.

During re-authentication you must set `is_change_user_request` to True.

Args:
    sock: Pointer to the socket connection.
    handshake: Initial handshake.
    username: Account's username.
    password1: Account's password factor 1.
    password2: Account's password factor 2.
    password3: Account's password factor 3.
    database: Initial database name for the connection.
    charset: Client charset (see [1]), only the lower 8-bits.
    client_flags: Integer representing client capabilities flags.
    ssl_enabled: Boolean indicating whether SSL is enabled,
    max_allowed_packet: Maximum packet size.
    auth_plugin: Authorization plugin name.
    auth_plugin_class: Authorization plugin class (has higher precedence
                       than the authorization plugin name).
    conn_attrs: Connection attributes.
    is_change_user_request: Whether is a `change user request` operation or not.
    read_timeout: Timeout in seconds upto which the connector should wait for
                  the server to reply back before raising an ReadTimeoutError.
    write_timeout: Timeout in seconds upto which the connector should spend to
                   send data to the server before raising an WriteTimeoutError.

Returns:
    ok_packet: OK packet.

Raises:
    InterfaceError: If OK packet is NULL.
    ReadTimeoutError: If the time taken for the server to reply back exceeds
                      'read_timeout' (if set).
    WriteTimeoutError: If the time taken to send data packets to the server
                       exceeds 'write_timeout' (if set).

References:
    [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/                page_protocol_basic_character_set.html#a_protocol_character_set
)r   r	      )	handshaker=   passworddatabasecharsetclient_flagsmax_allowed_packetauth_pluginr8   
conn_attrsis_change_user_requestr,   r/   r   NzGot a NULL ok_pkt)r   r    r"   r$   r   	make_authr,   r/   r#   writebytesreadrS   r
   )r&   rI   rW   r=   	password1	password2	password3rY   rZ   r[   r,   r\   r]   r8   r^   r_   read_timeoutwrite_timeoutresponse_payload	send_argsrJ   ok_pkts                         r'   authenticateMySQLAuthenticator.authenticate   s     z "')D'"3 1>0G0G%1#/!#9((,,1
-$-& & =!m, 	
 jj)6I666 $))L11233D#>>> !454? 	7 2>s6   B CCC C!C>C?CCC)r$   r#   r    r!   r"   r   )returnNone)rn   bool)rn   Dict[str, Any])r3   rq   rn   ro   )NNr   )
r;   strr<   Optional[str]r=   rs   r>   intrn   ro   )rI   r   rJ   rb   rn   zOptional[bytes])$rI   r   rW   r   r=   rr   rd   rr   re   rr   rf   rr   rY   rs   rZ   rt   r[   rt   r,   rp   r\   rt   r]   rs   r8   rs   r^   zOptional[Dict[str, str]]r_   rp   rg   Optional[int]rh   ru   rn   rb   )__name__
__module____qualname____firstlineno____doc__r(   propertyr,   r/   r4   r?   rM   rS   r   r   rl   __static_attributes__ r*   r'   r   r   8   s   .6 ! ! # # + )-"&  
 
 & 
  	 

  
 
 
D44 4 
	4l55 5 
	5v "&)!"<%)+//3',&*'+%bb !b 	b
 b b b  b b b b  b #b )b -b  !%!b" $#b$ %%b& 
'b br*   N)rz   
__future__r   __all__typingr   r   r   r   errorsr
   r   r   protocolr   r   r   r   r   r   r   typesr   r   pluginsr   r   r   networkr   r   r}   r*   r'   <module>r      sP   : = "
  5 5 E E   "  5 #$W Wr*   