U
    n/e+                     @   s  d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
Zd dlmZ d dl
mZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7 d d	l8m9Z9 d d
l:m;Z; d dl<m=Z= d dl>m?Z?m@Z@ eAeBZCdAddZDG dd de'ZEdd ZFdd ZGdd ZHeHZIG dd deZJG dd de)ZKG dd deKZLG dd deZMG dd  d eeMZNG d!d" d"eeNZOG d#d$ d$eNZPG d%d& d&e&ZQG d'd( d(e!ZRG d)d* d*e ZSG d+d, d,e$ZTG d-d. d.e+ZUG d/d0 d0eZVG d1d2 d2eZWG d3d4 d4eZXG d5d6 d6eZYG d7d8 d8eZZG d9d: d:eZ[G d;d< d<eZ\G d=d> d>eMZ]G d?d@ d@e,Z^dS )B    N)deepcopy)sha1)UNSIGNED)compat_shell_split)Config)%!_DEFAULT_ADVISORY_REFRESH_TIMEOUTAssumeRoleCredentialFetcherAssumeRoleProvider!AssumeRoleWithWebIdentityProviderBaseAssumeRoleCredentialFetcherBotoProviderCachedCredentialFetcherCanonicalNameCredentialSourcerConfigNotFoundConfigProviderContainerMetadataFetcherContainerProviderCredentialResolverCredentialRetrievalErrorCredentialsEnvProviderInstanceMetadataProviderInvalidConfigErrorMetadataRetrievalErrorOriginalEC2ProviderPartialCredentialsErrorProcessProviderProfileProviderBuilderReadOnlyCredentialsRefreshableCredentialsRefreshWithMFAUnsupportedErrorSharedCredentialProviderSSOProviderSSOTokenLoaderUnauthorizedSSOTokenErrorUnknownCredentialError_get_client_creator
_local_now_parse_if_needed_serialize_if_neededparseresolve_imds_endpoint_mode)tzutc)resolve_awaitable)	AioConfig)AioSSOTokenProvider)AioContainerMetadataFetcherAioInstanceMetadataFetcherc              	      s    dpd}  d}  d}  ddk	}  dt td}|dkrVi }t }t }	tt|| 	 |dd	}
t
 ||d
}t fddt |||t||	|
g|d}||g}|j||d}t t |	|
g}|| | }|r|| td t|d}|S )zCreate a default credential resolver.
    This creates a pre-configured credential resolver
    that includes the default lookup chain for
    credentials.
    profiledefaultZmetadata_service_timeoutZmetadata_service_num_attemptsNec2_metadata_service_endpoint)r4   Z"ec2_metadata_service_endpoint_modeZec2_credential_refresh_window)timeoutnum_attempts
user_agentconfig)Ziam_role_fetcher)cacheregion_namec                      s    j S N)full_config sessionr=   ;/tmp/pip-unpacked-wheel-8mnez3y6/aiobotocore/credentials.py<lambda>i       z,create_credential_resolver.<locals>.<lambda>)load_configclient_creatorr9   profile_nameZcredential_sourcerprofile_provider_builderrE   disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.)	providers)get_config_variableZinstance_variablesgetr+   r   AioEnvProviderAioContainerProviderAioInstanceMetadataProviderr1   r7   AioProfileProviderBuilderAioAssumeRoleProviderr&   !AioCanonicalNameCredentialSourcerrI   AioOriginalEC2ProviderAioBotoProviderremoveloggerdebugAioCredentialResolver)r?   r9   r:   rE   Zmetadata_timeoutr6   rH   Zimds_configZenv_providerZcontainer_providerZinstance_metadata_providerrF   assume_role_providerZpre_profileprofile_providersZpost_profilerI   resolverr=   r>   r@   create_credential_resolverB   sv    


	  


r[   c                   @   s4   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdS )rO   c                    s   t | fdddS )Nc                      s    j jS r;   _sessionr<   r=   selfr=   r@   rA      rB   zDAioProfileProviderBuilder._create_process_provider.<locals>.<lambda>)rE   rC   )AioProcessProviderr_   rE   r=   r^   r@   _create_process_provider   s    
z2AioProfileProviderBuilder._create_process_providerc                 C   s   | j d}t||dS )NZcredentials_file)rE   Zcreds_filename)r]   rJ   AioSharedCredentialProvider)r_   rE   Zcredential_filer=   r=   r@   "_create_shared_credential_provider   s
    z<AioProfileProviderBuilder._create_shared_credential_providerc                 C   s   | j d}t||dS )Nconfig_file)rE   Zconfig_filename)r]   rJ   AioConfigProvider)r_   rE   re   r=   r=   r@   _create_config_provider   s
    z1AioProfileProviderBuilder._create_config_providerc                    s&   t  fddt j j j||dS )Nc                      s    j jS r;   r\   r=   r^   r=   r@   rA      rB   zIAioProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>)rC   rD   r9   rE   rH   )$AioAssumeRoleWithWebIdentityProviderr&   r]   Z_region_name_cache)r_   rE   rH   r=   r^   r@   _create_web_identity_provider   s    
 z7AioProfileProviderBuilder._create_web_identity_providerc                    s2   t  fdd jj| j jt j j|ddS )Nc                      s    j jS r;   r\   r=   r^   r=   r@   rA      rB   z@AioProfileProviderBuilder._create_sso_provider.<locals>.<lambda>)r9   rE   )rC   rD   rE   r9   Ztoken_cachetoken_provider)AioSSOProviderr]   Zcreate_clientri   Z_sso_token_cacher/   ra   r=   r^   r@   _create_sso_provider   s    
z.AioProfileProviderBuilder._create_sso_providerN)__name__
__module____qualname__rb   rd   rg   rj   rm   r=   r=   r=   r@   rO      s
   rO   c                    s   t | }| I d H S r;   )r[   load_credentials)r?   rZ   r=   r=   r@   get_credentials   s    rr   c                    s    fdd}|S )Nc               
      sZ    4 I d H } | j f I d H }W 5 Q I d H R X |d }|d |d |d t|d dS )Nr   AccessKeyIdSecretAccessKeySessionToken
Expiration
access_key
secret_keytokenexpiry_time)assume_roler)   )stsresponsecredentialsclientparamsr=   r@   refresh   s    "
z-create_assume_role_refresher.<locals>.refreshr=   )r   r   r   r=   r   r@   create_assume_role_refresher   s    r   c                 C   s   G dd d}|| j S )Nc                   @   s   e Zd Zdd Zdd ZdS )z/create_mfa_serial_refresher.<locals>._Refresherc                 S   s   || _ d| _d S )NF)_refresh_has_been_called)r_   r   r=   r=   r@   __init__   s    z8create_mfa_serial_refresher.<locals>._Refresher.__init__c                    s    | j rt d| _ |  I d H S NT)r   r    r   r^   r=   r=   r@   call   s    z4create_mfa_serial_refresher.<locals>._Refresher.callN)rn   ro   rp   r   r   r=   r=   r=   r@   
_Refresher   s   r   )r   )Zactual_refreshr   r=   r=   r@   create_mfa_serial_refresher   s    r   c                   @   s   e Zd Zdd ZdS )AioCredentialsc                    s   t | j| j| jS r;   )r   rx   ry   rz   r^   r=   r=   r@   get_frozen_credentials   s
      z%AioCredentials.get_frozen_credentialsN)rn   ro   rp   r   r=   r=   r=   r@   r      s   r   c                       s   e Zd Z fddZedd Zejdd Zedd Zejdd Zed	d
 Zejdd
 Zdd Z	dd Z
dd Z  ZS )AioRefreshableCredentialsc                    s   t  j|| t | _d S r;   )superr   asyncioLock_refresh_lockr_   argskwargs	__class__r=   r@   r      s    z"AioRefreshableCredentials.__init__c                 C   s   t d| jS NzAmissing call to self._refresh. Use get_frozen_credentials instead)NotImplementedError_access_keyr^   r=   r=   r@   rx     s    z$AioRefreshableCredentials.access_keyc                 C   s
   || _ d S r;   )r   r_   valuer=   r=   r@   rx     s    c                 C   s   t d| jS r   )r   _secret_keyr^   r=   r=   r@   ry     s    z$AioRefreshableCredentials.secret_keyc                 C   s
   || _ d S r;   )r   r   r=   r=   r@   ry     s    c                 C   s   t d| jS r   )r   _tokenr^   r=   r=   r@   rz      s    zAioRefreshableCredentials.tokenc                 C   s
   || _ d S r;   )r   r   r=   r=   r@   rz   )  s    c              
      s   |  | jsd S | j s| j4 I d H T |  | jsJW 5 Q I d H R  d S |  | j}| j|dI d H  W 5 Q I d H R  d S Q I d H R X n^|  | jr| j4 I d H 8 |  | jsW 5 Q I d H R  d S | jddI d H  W 5 Q I d H R X d S )N)is_mandatoryT)refresh_neededZ_advisory_refresh_timeoutr   lockedZ_mandatory_refresh_timeout_protected_refresh)r_   Zis_mandatory_refreshr=   r=   r@   r   -  s$    
"z"AioRefreshableCredentials._refreshc                    s   zt |  I d H }W n8 tk
rN   |r.dnd}tjd|dd |rH Y d S X | | t| j| j| j	| _
|  rd}t| t|d S )N	mandatoryZadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)r-   _refresh_using	ExceptionrU   warningZ_set_from_datar   r   r   r   _frozen_credentialsZ_is_expiredRuntimeError)r_   r   metadataZperiod_namemsgr=   r=   r@   r   F  s.    
  
z,AioRefreshableCredentials._protected_refreshc                    s   |   I d H  | jS r;   )r   r   r^   r=   r=   r@   r   g  s    z0AioRefreshableCredentials.get_frozen_credentials)rn   ro   rp   r   propertyrx   setterry   rz   r   r   r   __classcell__r=   r=   r   r@   r      s    





!r   c                       s*   e Zd ZefddZd fdd	Z  ZS )!AioDeferredRefreshableCredentialsc                 C   s>   || _ d | _d | _d | _d | _|| _t | _|| _	d | _
d S r;   )r   r   r   r   Z_expiry_timeZ_time_fetcherr   r   r   methodr   )r_   refresh_usingr   time_fetcherr=   r=   r@   r   m  s    
z*AioDeferredRefreshableCredentials.__init__Nc                    s   | j d krdS t |S r   )r   r   r   )r_   Z
refresh_inr   r=   r@   r   x  s    
z0AioDeferredRefreshableCredentials.refresh_needed)N)rn   ro   rp   r'   r   r   r   r=   r=   r   r@   r   l  s   r   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )AioCachedCredentialFetcherc                    s   t dd S )Nz_get_credentials())r   r^   r=   r=   r@   _get_credentials  s    z+AioCachedCredentialFetcher._get_credentialsc                    s   |   I d H S r;   )_get_cached_credentialsr^   r=   r=   r@   fetch_credentials  s    z,AioCachedCredentialFetcher.fetch_credentialsc                    sf   |   }|dkr*|  I dH }| | n
td |d }t|d dd}|d |d |d	 |d
S )zGet up-to-date credentials.

        This will check the cache for up-to-date credentials, calling assume
        role if none are available.
        Nz*Credentials for role retrieved from cache.r   rv   T)Zisors   rt   ru   rw   )Z_load_from_cacher   Z_write_to_cacherU   rV   r)   )r_   r~   creds
expirationr=   r=   r@   r     s    
z2AioCachedCredentialFetcher._get_cached_credentialsN)rn   ro   rp   r   r   r   r=   r=   r=   r@   r   ~  s   r   c                   @   s   e Zd ZdS )"AioBaseAssumeRoleCredentialFetcherN)rn   ro   rp   r=   r=   r=   r@   r     s   r   c                   @   s   e Zd Zdd Zdd ZdS )AioAssumeRoleCredentialFetcherc                    sX   |   }|  I dH }|4 I dH &}|jf |I dH W  5 Q I dH R  S Q I dH R X dS )'Get credentials by calling assume role.N)_assume_role_kwargs_create_clientr|   )r_   r   r   r}   r=   r=   r@   r     s    z/AioAssumeRoleCredentialFetcher._get_credentialsc                    s(   | j  I dH }| jd|j|j|jdS )z2Create an STS client using the source credentials.Nr}   )aws_access_key_idaws_secret_access_keyaws_session_token)Z_source_credentialsr   _client_creatorrx   ry   rz   )r_   Zfrozen_credentialsr=   r=   r@   r     s    z-AioAssumeRoleCredentialFetcher._create_clientN)rn   ro   rp   r   r   r=   r=   r=   r@   r     s   r   c                       s.   e Zd Zd fdd	Zdd Zdd Z  ZS )	-AioAssumeRoleWithWebIdentityCredentialFetcherNc                    s    || _ t j|||||d d S )N)
extra_argsr9   expiry_window_seconds)_web_identity_token_loaderr   r   )r_   rD   web_identity_token_loaderrole_arnr   r9   r   r   r=   r@   r     s    
z6AioAssumeRoleWithWebIdentityCredentialFetcher.__init__c                    s^   |   }ttd}| jd|d4 I dH &}|jf |I dH W  5 Q I dH R  S Q I dH R X dS )r   )signature_versionr}   r8   N)r   r.   r   r   Zassume_role_with_web_identity)r_   r   r8   r   r=   r=   r@   r     s    
z>AioAssumeRoleWithWebIdentityCredentialFetcher._get_credentialsc                 C   s   t | j}|  }||d< |S )zAGet the arguments for assume role based on current configuration.ZWebIdentityToken)r   Z_assume_kwargsr   )r_   Zassume_role_kwargsZidentity_tokenr=   r=   r@   r     s    
zAAioAssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs)NNN)rn   ro   rp   r   r   r   r   r=   r=   r   r@   r     s      	r   c                       s4   e Zd Zejd fdd
Zdd Zdd Z  ZS )r`   )popenc                   s   t  j||d|i d S )Nr   )r   r   )r_   r   r   r   r   r=   r@   r     s    zAioProcessProvider.__init__c                    sj   j   d krd S  I d H }|dd k	rJt| fddjS t|d |d |djdS )Nr{   c                      s
     S r;   )_retrieve_credentials_usingr=   credential_processr_   r=   r@   rA     rB   z)AioProcessProvider.load.<locals>.<lambda>rx   ry   rz   )rx   ry   rz   r   )Z_credential_processr   rK   r   create_from_metadataMETHODr   )r_   Z
creds_dictr=   r   r@   load  s     zAioProcessProvider.loadc           	   
      s   t |}| j|tjtjdI d H }| I d H \}}|jdkrTt| j|ddt	j
j|d}|dd}|dkrt| jd| d	dz$|d
 |d |d|ddW S  tk
r } zt| jd| dW 5 d }~X Y nX d S )N)stdoutstderrr   utf-8provider	error_msgVersionz<Version key not provided>   zUnsupported version 'z8' for credential process provider, supported versions: 1rs   rt   ru   rv   rw   z"Missing required key in response: )r   Z_popen
subprocessPIPEcommunicate
returncoder   r   decodebotocorecompatjsonloadsrK   KeyError)	r_   r   Zprocess_listpr   r   parsedversioner=   r=   r@   r     s<      
 
z.AioProcessProvider._retrieve_credentials_using)	rn   ro   rp   r   Zcreate_subprocess_execr   r   r   r   r=   r=   r   r@   r`     s   r`   c                   @   s   e Zd Zdd ZdS )rN   c                    sD   | j }| I d H }|sd S td|d  tj|| j|jd}|S )Nz#Found credentials from IAM Role: %s	role_namer   r   )Z_role_fetcherZretrieve_iam_role_credentialsrU   infor   r   r   )r_   fetcherr   r   r=   r=   r@   r      s     z AioInstanceMetadataProvider.loadNrn   ro   rp   r   r=   r=   r=   r@   rN     s   rN   c                   @   s   e Zd Zdd ZdS )rL   c                    s   | j | jd d}|rtd |  }|dd}|d }|d k	rnt|}t|d |d |d ||| jd	S t	|d |d |d | jd
S d S d S )Nrx    z+Found credentials in environment variables.F)Zrequire_expiryr{   ry   rz   )r   r   r   )
environrK   _mappingrU   r   Z_create_credentials_fetcherr*   r   r   r   )r_   rx   r   r   r{   r=   r=   r@   r   2  s.    

	zAioEnvProvider.loadNr   r=   r=   r=   r@   rL   1  s   rL   c                   @   s   e Zd Zdd ZdS )rR   c                    sh   d| j kr`tj| j d }| |}| j|krdtd || j }|| j }t	||| j
dS nd S d S )NZAWS_CREDENTIAL_FILEz)Found credentials in AWS_CREDENTIAL_FILE.r   )_environospath
expanduser_parser
ACCESS_KEYrU   r   
SECRET_KEYr   r   )r_   	full_pathr   rx   ry   r=   r=   r@   r   Q  s    





  zAioOriginalEC2Provider.loadNr   r=   r=   r=   r@   rR   P  s   rR   c                   @   s   e Zd Zdd ZdS )rc   c                    s   z|  | j}W n tk
r&   Y d S X | j|kr|| j }| j|krtd| j | || j| j\}}| 	|}t
|||| jdS d S )Nz0Found credentials in shared credentials file: %sr   )_ini_parserZ_creds_filenamer   _profile_namer   rU   r   _extract_creds_from_mappingr   _get_session_tokenr   r   )r_   Zavailable_credsr8   rx   ry   rz   r=   r=   r@   r   d  s.    


  
   z AioSharedCredentialProvider.loadNr   r=   r=   r=   r@   rc   c  s   rc   c                   @   s   e Zd Zdd ZdS )rf   c                    s   z|  | j}W n tk
r&   Y d S X | j|d kr|d | j }| j|krtd| j | || j| j\}}| 	|}t
|||| jdS nd S d S )Nprofilesz$Credentials found in config file: %sr   )Z_config_parserZ_config_filenamer   r   r   rU   r   r   r   r   r   r   )r_   r<   Zprofile_configrx   ry   rz   r=   r=   r@   r   z  s0    
  
   zAioConfigProvider.loadNr   r=   r=   r=   r@   rf   y  s   rf   c                   @   s   e Zd Zdd ZdS )rS   c              	      s   | j | jkr| j| j  g}n| j}|D ]|}z| |}W n tk
rP   Y q&Y nX d|kr&|d }| j|kr&td| | || j| j	\}}t
||| jd  S q&d S )Nr   z)Found credentials in boto config file: %sr   )ZBOTO_CONFIG_ENVr   ZDEFAULT_CONFIG_FILENAMESr   r   r   rU   r   r   r   r   r   )r_   Zpotential_locationsfilenamer8   r   rx   ry   r=   r=   r@   r     s2    

     zAioBotoProvider.loadNr   r=   r=   r=   r@   rS     s   rS   c                   @   s<   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd ZdS )rP   c                    sF   |   | _| jdi }|| ji }| |rB| | jI d H S d S )Nr   )Z_load_config_loaded_configrK   r   _has_assume_role_config_vars_load_creds_via_assume_role)r_   r   r2   r=   r=   r@   r     s
    

zAioAssumeRoleProvider.loadc                    s   |  |}| ||I d H }i }|d}|d k	r:||d< |d}|d k	rT||d< |d}|d k	rn||d< |d}|d k	r||d< t| j||d	 || j| jd
}	|	j}
|d k	rt|
}
t	| j
|
tdS )Nrole_session_nameRoleSessionNameexternal_idZ
ExternalId
mfa_serialZSerialNumberduration_secondsZDurationSecondsr   )rD   source_credentialsr   r   Zmfa_prompterr9   )r   r   r   )Z_get_role_config_resolve_source_credentialsrK   r   r   Z	_prompterr9   r   r   r   r   r'   )r_   rE   role_configr  r   r  r  r  r  r   Z	refresherr=   r=   r@   r    sD    
 




z1AioAssumeRoleProvider._load_creds_via_assume_rolec                    sH   | d}|d k	r$| ||I d H S |d }| j| | |I d H S )Ncredential_sourcesource_profile)rK    _resolve_credentials_from_sourceZ_visited_profilesappend!_resolve_credentials_from_profile)r_   r	  rE   r
  r  r=   r=   r@   r    s    
 
z1AioAssumeRoleProvider._resolve_source_credentialsc                    s   | j di }|| }| |r0| js0| |S | |sD| |s| jj|dd}t|}| I d H }|d krd}t	|| d|S | 
|I d H S )Nr   TrG   z.The source profile "%s" must have credentials.r   )r   rK   Z_has_static_credentialsZ_profile_provider_builder(_resolve_static_credentials_from_profiler   rI   rW   rq   r   r  )r_   rE   r   r2   rY   Zprofile_chainr   error_messager=   r=   r@   r    s4    
z7AioAssumeRoleProvider._resolve_credentials_from_profilec              
   C   sX   zt |d |d |ddW S  tk
rR } zt| jt|dW 5 d }~X Y nX d S )Nr   r   r   )rx   ry   rz   )r   Zcred_var)r   rK   r   r   r   str)r_   r2   r   r=   r=   r@   r    s     z>AioAssumeRoleProvider._resolve_static_credentials_from_profilec                    s.   | j |I d H }|d kr*t|d| d|S )NzBNo credentials found in credential_source referenced in profile %sr   )Z_credential_sourcerr  r   )r_   r
  rE   r   r=   r=   r@   r    s    
z6AioAssumeRoleProvider._resolve_credentials_from_sourceN)	rn   ro   rp   r   r  r  r  r  r  r=   r=   r=   r@   rP     s   ,rP   c                   @   s   e Zd Zdd Zdd ZdS )rh   c                    s   |   I d H S r;   )_assume_role_with_web_identityr^   r=   r=   r@   r   %  s    z)AioAssumeRoleWithWebIdentityProvider.loadc                    s|   |  d}|sd S | |}|  d}|s8d}t|di }|  d}|d k	rV||d< t| j|||| jd}t| j|jdS )	NZweb_identity_token_filer   zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r  r  r  )rD   r   r   r   r9   r   )	Z_get_configZ_token_loader_clsr   r   r   r9   r   r   r   )r_   Z
token_pathtoken_loaderr   r   r   r  r   r=   r=   r@   r  (  s0    





zCAioAssumeRoleWithWebIdentityProvider._assume_role_with_web_identityN)rn   ro   rp   r   r  r=   r=   r=   r@   rh   $  s   rh   c                   @   s   e Zd Zdd Zdd ZdS )rQ   c                    s0   |  |}t|tr"| I dH S | I dH S )a  Loads source credentials based on the provided configuration.

        :type source_name: str
        :param source_name: The value of credential_source in the config
            file. This is the canonical name of the credential provider.

        :rtype: Credentials
        N)_get_provider
isinstancerW   rq   r   )r_   Zsource_namesourcer=   r=   r@   r  N  s    	

z4AioCanonicalNameCredentialSourcer.source_credentialsc                 C   sV   |  |}| dkr@| d}|dk	r@|dkr4|S t||gS |dkrRt|d|S )a#  Return a credential provider by its canonical name.

        :type canonical_name: str
        :param canonical_name: The canonical name of the provider.

        :raises UnknownCredentialError: Raised if no
            credential provider by the provided name
            is found.
        )ZsharedconfigZsharedcredentialszassume-roleN)name)Z_get_provider_by_canonical_namelowerZ_get_provider_by_methodrW   r%   )r_   canonical_namer   rX   r=   r=   r@   r  \  s    



z/AioCanonicalNameCredentialSourcer._get_providerN)rn   ro   rp   r  r  r=   r=   r=   r@   rQ   M  s   rQ   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	rM   c                    s&   t  j|| t| jtr"t | _d S r;   )r   r   r  _fetcherr   r0   r   r   r=   r@   r     s    zAioContainerProvider.__init__c                    s*   | j | jks| j| jkr&|  I d H S d S r;   )ENV_VARr   ENV_VAR_FULL_retrieve_or_failr^   r=   r=   r@   r     s    zAioContainerProvider.loadc                    st   |   r| j| j| j }n| j| j }|  }| ||}| I d H }t|d |d |d | j	t
|d |dS )Nrx   ry   rz   r{   )rx   ry   rz   r   r{   r   )Z_provided_relative_urir  full_urlr   r  r  Z_build_headers_create_fetcherr   r   r(   )r_   full_uriheadersr   r   r=   r=   r@   r    s    
z&AioContainerProvider._retrieve_or_failc                    s    fdd}|S )Nc               
      s~   zj j dI d H } W nD tk
r^ } z&tjd|dd tjt|dW 5 d }~X Y nX | d | d | d | d	 d
S )N)r"  z'Error retrieving container metadata: %sTr   r   rs   rt   Tokenrv   rw   )r  Zretrieve_full_urir   rU   rV   r   r   r  )r~   r   r!  r"  r_   r=   r@   fetch_creds  s(        z9AioContainerProvider._create_fetcher.<locals>.fetch_credsr=   )r_   r!  r"  r%  r=   r$  r@   r     s    z$AioContainerProvider._create_fetcher)rn   ro   rp   r   r   r  r   r   r=   r=   r   r@   rM     s   rM   c                   @   s   e Zd Zdd ZdS )rW   c                    s<   | j D ]0}td|j | I dH }|dk	r|  S qdS )zw
        Goes through the credentials chain, returning the first ``Credentials``
        that could be loaded.
        zLooking for credentials via: %sN)rI   rU   rV   r   r   )r_   r   r   r=   r=   r@   rq     s    

z&AioCredentialResolver.load_credentialsN)rn   ro   rp   rq   r=   r=   r=   r@   rW     s   rW   c                       s:   e Zd ZdZd fdd	Zdd Zdd Zd	d
 Z  ZS )AioSSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZNc                    sB   || _ || _|| _|| _|| _|| _|	| _|
| _t 	|| d S r;   )
r   _sso_region
_role_name_account_id
_start_url_token_loader_token_provider_sso_session_namer   r   )r_   	start_url
sso_regionr   
account_idrD   r  r9   r   rk   sso_session_namer   r=   r@   r     s    z AioSSOCredentialFetcher.__init__c                 C   sV   | j | jd}| jr | j|d< n
| j|d< tj|ddd}t|d }| 	|S )N)roleName	accountIdZsessionNameZstartUrlT),:)	sort_keys
separatorsr   )
r(  r)  r-  r*  r   dumpsr   encode	hexdigestZ_make_file_safe)r_   r   Zargument_hashr=   r=   r@   _create_cache_key  s    
z)AioSSOCredentialFetcher._create_cache_keyc                 C   s$   |d }t j |t }|| jS )Ng     @@)datetimefromtimestampr,   strftime_UTC_DATE_FORMAT)r_   Ztimestamp_msZtimestamp_seconds	timestampr=   r=   r@   _parse_timestamp  s    z(AioSSOCredentialFetcher._parse_timestampc                    s   t t| jd}| jd|d4 I dH }| jrH| j }| I dH j}n| | j	d }| j
| j|d}z|jf |I dH }W n |jjk
r   t Y nX |d }d|d |d	 |d
 | |d dd}|W  5 Q I dH R  S Q I dH R X dS )z4Get credentials by calling SSO get role credentials.)r   r:   Zssor   NaccessToken)r2  r3  rB  ZroleCredentialsZaccessKeyIdZsecretAccessKeyZsessionTokenr   )rs   rt   ru   rv   )ZProviderTyper   )r   r   r'  r   r,  Z
load_tokenZget_frozen_tokenrz   r+  r*  r(  r)  Zget_role_credentials
exceptionsZUnauthorizedExceptionr$   rA  )r_   r8   r   Zinitial_token_datarz   r   r~   r   r=   r=   r@   r     s8    
z(AioSSOCredentialFetcher._get_credentials)NNNNN)	rn   ro   rp   r?  r   r;  rA  r   r   r=   r=   r   r@   r&    s   	     r&  c                   @   s   e Zd Zdd ZdS )rl   c                    sx   |   }|sd S |d |d |d |d | jt| jd| jd}d|kr^|d |d< | j|d	< tf |}t| j|j	d
S )NZsso_start_urlr/  Zsso_role_nameZsso_account_id)r9   )r.  r/  r   r0  rD   r  r9   Zsso_sessionr1  rk   r   )
Z_load_sso_configr   r#   Z_token_cacher9   r,  r&  r   r   r   )r_   Z
sso_configZfetcher_kwargsZsso_fetcherr=   r=   r@   r   "  s&    
	

zAioSSOProvider.loadNr   r=   r=   r=   r@   rl   !  s   rl   )NN)_r   r<  r   loggingr   r   copyr   hashlibr   Zbotocore.compatr   r   r   Zbotocore.configr   Zbotocore.credentialsr   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   Zdateutil.tzr,   Zaiobotocore._helpersr-   Zaiobotocore.configr.   Zaiobotocore.tokensr/   Zaiobotocore.utilsr0   r1   	getLoggerrn   rU   r[   rO   rr   r   r   Zcreate_aio_mfa_serial_refresherr   r   r   r   r   r   r   r`   rN   rL   rR   rc   rf   rS   rP   rh   rQ   rM   rW   r&  rl   r=   r=   r=   r@   <module>   sj   '

[/m
 
 
)<y)64T