o
    diݧ                     @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlZ	d dlm
Z
 d dlmZmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8 d dl9m:Z: d d	l;m<Z< d d
l=m>Z> d dl?m@Z@mAZAmBZB eCeDZEdBddZFG dd de'ZGdd ZHdd ZIdd ZJeJZKG dd deZLG dd de)ZMG dd deeMZNG dd deZOG dd deeOZPG d d! d!eePZQG d"d# d#ePZRG d$d% d%e&ZSG d&d' d'e!ZTG d(d) d)e ZUG d*d+ d+e$ZVG d,d- d-e+ZWG d.d/ d/eZXG d0d1 d1eZYG d2d3 d3eZZG d4d5 d5eZ[G d6d7 d7eZ\G d8d9 d9eZ]G d:d; d;eZ^G d<d= d=e,eOZ_G d>d? d?e-Z`d@dA ZadS )C    N)deepcopy)UNSIGNED)compat_shell_splittotal_seconds)Config)&!_DEFAULT_ADVISORY_REFRESH_TIMEOUTAssumeRoleCredentialFetcherAssumeRoleProvider!AssumeRoleWithWebIdentityProviderBaseAssumeRoleCredentialFetcherBotoProviderCachedCredentialFetcherCanonicalNameCredentialSourcerConfigNotFoundConfigProviderContainerMetadataFetcherContainerProviderCredentialResolverCredentialRetrievalErrorCredentialsDeferredRefreshableCredentialsEnvProviderInstanceMetadataProviderInvalidConfigErrorMetadataRetrievalErrorOriginalEC2ProviderPartialCredentialsErrorProcessProviderProfileProviderBuilderReadOnlyCredentialsRefreshableCredentialsRefreshWithMFAUnsupportedErrorSharedCredentialProviderSSOCredentialFetcherSSOProviderSSOTokenLoaderUnauthorizedSSOTokenErrorUnknownCredentialError
_local_now_parse_if_needed_serialize_if_neededparseresolve_imds_endpoint_mode)register_feature_idregister_feature_ids)resolve_awaitable)	AioConfig)AioSSOTokenProvider)AioContainerMetadataFetcherAioInstanceMetadataFetchercreate_nested_clientc              	      s    dpd}  d}  d}  ddu}  dt t  dd}|du r/i }t }t }	tt|| 	 |d	d
}
t
 ||d}t fddt |||t||	|
g|d}||g}|j||d}t t |	|
g}|| | }|r|| td t|d}|S )zCreate a default credential resolver.
    This creates a pre-configured credential resolver
    that includes the default lookup chain for
    credentials.
    profiledefaultmetadata_service_timeoutmetadata_service_num_attemptsNec2_metadata_service_endpointec2_metadata_v1_disabled)r9   "ec2_metadata_service_endpoint_modeec2_credential_refresh_windowr:   )timeoutnum_attempts
user_agentconfig)iam_role_fetcher)cacheregion_namec                      s    j S N)full_config sessionrF   K/home/ubuntu/.local/lib/python3.10/site-packages/aiobotocore/credentials.py<lambda>l   s    z,create_credential_resolver.<locals>.<lambda>)load_configclient_creatorrB   profile_namecredential_sourcerprofile_provider_builderrM   disable_env_varszWSkipping environment variable credential check because profile name was explicitly set.)	providers)get_config_variableinstance_variablesgetr,   r   AioEnvProviderAioContainerProviderAioInstanceMetadataProviderr3   r?   AioProfileProviderBuilderAioAssumeRoleProvider_get_client_creator!AioCanonicalNameCredentialSourcerrR   AioOriginalEC2ProviderAioBotoProviderremoveloggerdebugAioCredentialResolver)rH   rB   rC   rM   metadata_timeoutr>   rQ   imds_configenv_providercontainer_providerinstance_metadata_providerrO   assume_role_providerpre_profileprofile_providerspost_profilerR   resolverrF   rG   rI   create_credential_resolverB   sx   

	


rm   c                   @   4   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdS )rY   c                    s   t | fdddS )Nc                          j jS rD   _sessionrE   rF   selfrF   rI   rJ          zDAioProfileProviderBuilder._create_process_provider.<locals>.<lambda>)rM   rK   )AioProcessProviderrs   rM   rF   rr   rI   _create_process_provider   s   
z2AioProfileProviderBuilder._create_process_providerc                 C      | j d}t||dS )Ncredentials_file)rM   creds_filename)rq   rS   AioSharedCredentialProvider)rs   rM   credential_filerF   rF   rI   "_create_shared_credential_provider   
   z<AioProfileProviderBuilder._create_shared_credential_providerc                 C   rx   )Nconfig_file)rM   config_filename)rq   rS   AioConfigProvider)rs   rM   r   rF   rF   rI   _create_config_provider   r~   z1AioProfileProviderBuilder._create_config_providerc                    s&   t  fddt j j j||dS )Nc                      ro   rD   rp   rF   rr   rF   rI   rJ      rt   zIAioProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>)rK   rL   rB   rM   rQ   )$AioAssumeRoleWithWebIdentityProviderr[   rq   _region_name_cache)rs   rM   rQ   rF   rr   rI   _create_web_identity_provider   s   
z7AioProfileProviderBuilder._create_web_identity_providerc                    s2   t  fdd jj| j jt j j|ddS )Nc                      ro   rD   rp   rF   rr   rF   rI   rJ      rt   z@AioProfileProviderBuilder._create_sso_provider.<locals>.<lambda>)rB   rM   )rK   rL   rM   rB   token_cachetoken_provider)AioSSOProviderrq   create_clientr   _sso_token_cacher1   rv   rF   rr   rI   _create_sso_provider   s   
z.AioProfileProviderBuilder._create_sso_providerN)__name__
__module____qualname__rw   r}   r   r   r   rF   rF   rF   rI   rY      s    rY   c                    s   t | }| I d H S rD   )rm   load_credentials)rH   rl   rF   rF   rI   get_credentials   s   r   c                        fdd}|S )Nc               	      sz    4 I d H } | j di I d H }W d   I d H  n1 I d H s#w   Y  |d }|d |d |d t|d dS )Nr   AccessKeyIdSecretAccessKeySessionToken
Expiration)
access_key
secret_keytokenexpiry_timerF   )assume_roler*   )stsresponsecredentialsclientparamsrF   rI   refresh   s   (
z-create_assume_role_refresher.<locals>.refreshrF   )r   r   r   rF   r   rI   create_assume_role_refresher   s   r   c                 C   s   G dd d}|| j S )Nc                   @      e Zd Zdd Zdd ZdS )z/create_mfa_serial_refresher.<locals>._Refresherc                 S   s   || _ d| _d S )NF)_refresh_has_been_called)rs   r   rF   rF   rI   __init__   s   
z8create_mfa_serial_refresher.<locals>._Refresher.__init__c                    s"   | j rt d| _ |  I d H S )NT)r   r!   r   rr   rF   rF   rI   call   s
   z4create_mfa_serial_refresher.<locals>._Refresher.callN)r   r   r   r   r   rF   rF   rF   rI   
_Refresher   s    r   )r   )actual_refreshr   rF   rF   rI   create_mfa_serial_refresher   s   
r   c                   @   rn   )AioCredentialsc                 C      | j S rD   )
account_idrr   rF   rF   rI   get_account_id      zAioCredentials.get_account_idc                 C   r   rD   )r   rr   rF   rF   rI   get_access_key   r   zAioCredentials.get_access_keyc                 C   r   rD   )r   rr   rF   rF   rI   get_secret_key  r   zAioCredentials.get_secret_keyc                 C   r   rD   )r   rr   rF   rF   rI   	get_token  r   zAioCredentials.get_tokenc                    s   t | j| j| j| jS rD   )r   r   r   r   r   rr   rF   rF   rI   get_frozen_credentials	  s   z%AioCredentials.get_frozen_credentialsN)r   r   r   r   r   r   r   r   rF   rF   rF   rI   r      s    r   c                       s   e Zd Z fddZdd Zdd Zdd Zd	d
 Zedd Z	e	j
dd Z	edd Zej
dd Zedd Zej
dd Zedd Zej
dd Zdd Zdd Zdd Z  ZS )AioRefreshableCredentialsc                    s    t  j|i | t | _d S rD   )superr   asyncioLock_refresh_lockrs   argskwargs	__class__rF   rI   r     s   z"AioRefreshableCredentials.__init__c                       |   I d H  | jS rD   )r   _account_idrr   rF   rF   rI   r        z(AioRefreshableCredentials.get_account_idc                    r   rD   )r   _access_keyrr   rF   rF   rI   r     r   z(AioRefreshableCredentials.get_access_keyc                    r   rD   )r   _secret_keyrr   rF   rF   rI   r     r   z(AioRefreshableCredentials.get_secret_keyc                    r   rD   )r   _tokenrr   rF   rF   rI   r      r   z#AioRefreshableCredentials.get_tokenc                 C      t d)NzKmissing call to self._refresh. Use get_frozen_credentials or get_access_key)NotImplementedErrorr   rr   rF   rF   rI   r   &     z$AioRefreshableCredentials.access_keyc                 C   
   || _ d S rD   )r   rs   valuerF   rF   rI   r   /     
c                 C   r   )NzSmissing call to self._refresh. Use get_frozen_credentials or get_secret_key instead)r   r   rr   rF   rF   rI   r   3  r   z$AioRefreshableCredentials.secret_keyc                 C   r   rD   )r   r   rF   rF   rI   r   <  r   c                 C   r   )NzNmissing call to self._refresh. Use get_frozen_credentials or get_token instead)r   r   rr   rF   rF   rI   r   @  r   zAioRefreshableCredentials.tokenc                 C   r   rD   )r   r   rF   rF   rI   r   I  r   c                 C   r   )NzSmissing call to self._refresh. Use get_frozen_credentials or get_account_id instead)r   r   rr   rF   rF   rI   r   M  r   z$AioRefreshableCredentials.account_idc                 C   r   rD   )r   r   rF   rF   rI   r   V  r   c              	      s&  |  | js	d S | j sP| j4 I d H . |  | js(	 W d   I d H  d S |  | j}| j|dI d H  	 W d   I d H  d S 1 I d H sIw   Y  d S |  | jr| j4 I d H ' |  | jsp	 W d   I d H  d S | jddI d H  W d   I d H  d S 1 I d H sw   Y  d S d S )N)is_mandatoryT)refresh_needed_advisory_refresh_timeoutr   locked_mandatory_refresh_timeout_protected_refresh)rs   is_mandatory_refreshrF   rF   rI   r   Z  s0   
0
.z"AioRefreshableCredentials._refreshc                    s   zt |  I d H }W n ty'   |rdnd}tjd|dd |r$ Y d S w | | t| j| j| j	| j
| _|  rHd}t| t|d S )N	mandatoryadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)r/   _refresh_using	Exceptionr`   warning_set_from_datar   r   r   r   r   _frozen_credentials_is_expiredRuntimeError)rs   r   metadataperiod_namemsgrF   rF   rI   r   s  s0   

z,AioRefreshableCredentials._protected_refreshc                    r   rD   )r   r   rr   rF   rF   rI   r     r   z0AioRefreshableCredentials.get_frozen_credentials)r   r   r   r   r   r   r   r   propertyr   setterr   r   r   r   r   r   __classcell__rF   rF   r   rI   r     s2    







!r   c                   @   s   e Zd ZefddZdS )!AioDeferredRefreshableCredentialsc                 C   sD   || _ d | _d | _d | _d | _d | _|| _t | _	|| _
d | _d S rD   )r   r   r   r   r   _expiry_time_time_fetcherr   r   r   methodr   )rs   refresh_usingr   time_fetcherrF   rF   rI   r     s   

z*AioDeferredRefreshableCredentials.__init__N)r   r   r   r(   r   rF   rF   rF   rI   r     s    r   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )AioCachedCredentialFetcherc                    s
   t d)Nz_get_credentials())r   rr   rF   rF   rI   _get_credentials  s   z+AioCachedCredentialFetcher._get_credentialsc                       |   I d H S rD   )_get_cached_credentialsrr   rF   rF   rI   fetch_credentials     z,AioCachedCredentialFetcher.fetch_credentialsc                    st   |   }|du r|  I dH }| | ntd |d }t|d dd}|d |d |d	 ||d
d}|S )zGet up-to-date credentials.

        This will check the cache for up-to-date credentials, calling assume
        role if none are available.
        Nz*Credentials for role retrieved from cache.r   r   T)isor   r   r   	AccountIdr   r   r   r   r   )_load_from_cacher   _write_to_cacher`   ra   r*   rU   )rs   r   creds
expirationr   rF   rF   rI   r     s   
z2AioCachedCredentialFetcher._get_cached_credentialsN)r   r   r   r   r   r   rF   rF   rF   rI   r     s    r   c                   @   s   e Zd ZdS )"AioBaseAssumeRoleCredentialFetcherN)r   r   r   rF   rF   rF   rI   r     s    r   c                   @   r   )AioAssumeRoleCredentialFetcherc              	      s   t | j |  }|  I dH }|4 I dH }|jdi |I dH }| | |W  d  I dH  S 1 I dH s:w   Y  dS )'Get credentials by calling assume role.NrF   )r.   feature_ids_assume_role_kwargs_create_clientr   _add_account_id_to_response)rs   r   r   r   r   rF   rF   rI   r     s   

0z/AioAssumeRoleCredentialFetcher._get_credentialsc                    s*   | j  I dH }| jd|j|j|jdS )z2Create an STS client using the source credentials.Nr   )aws_access_key_idaws_secret_access_keyaws_session_token)_source_credentialsr   _client_creatorr   r   r   )rs   frozen_credentialsrF   rF   rI   r     s   z-AioAssumeRoleCredentialFetcher._create_clientN)r   r   r   r   r   rF   rF   rF   rI   r     s    
r   c                       s4   e Zd Z			d fdd	Zdd Zdd Z  ZS )	-AioAssumeRoleWithWebIdentityCredentialFetcherNc                    s    || _ t j|||||d d S )N)
extra_argsrB   expiry_window_seconds)_web_identity_token_loaderr   r   )rs   rL   web_identity_token_loaderrole_arnr  rB   r  r   rF   rI   r     s   	
z6AioAssumeRoleWithWebIdentityCredentialFetcher.__init__c              	      s   t | j |  }ttd}| jd|d4 I dH }|jdi |I dH }| | |W  d  I dH  S 1 I dH s=w   Y  dS )r   )signature_versionr   r@   NrF   )r.   r   r   r0   r   r  assume_role_with_web_identityr   )rs   r   r@   r   r   rF   rF   rI   r      s   


0z>AioAssumeRoleWithWebIdentityCredentialFetcher._get_credentialsc                 C   s   t | j}|  }||d< |S )zAGet the arguments for assume role based on current configuration.WebIdentityToken)r   _assume_kwargsr  )rs   assume_role_kwargsidentity_tokenrF   rF   rI   r     s   
zAAioAssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargs)NNN)r   r   r   r   r   r   r   rF   rF   r   rI   r    s    r  c                       s4   e Zd Zejd fdd
Zdd Zdd Z  ZS )ru   )popenc                   s   t  j|i |d|i d S )Nr  )r   r   )rs   r  r   r   r   rF   rI   r     s   zAioProcessProvider.__init__c                    s   j   d u r
d S td  I d H }td |dd ur.t| fddjS t|d |d |dj|d	d
S )NCREDENTIALS_PROFILE_PROCESSCREDENTIALS_PROCESSr   c                      s
     S rD   )_retrieve_credentials_usingrF   credential_processrs   rF   rI   rJ   $  s   
 z)AioProcessProvider.load.<locals>.<lambda>r   r   r   r   )r   r   r   r   r   )_credential_processr-   r  rU   r   create_from_metadataMETHODr   )rs   
creds_dictrF   r  rI   load  s(   zAioProcessProvider.loadc           	   
      s   t |}| j|tjtjdI d H }| I d H \}}|jdkr+t| j|ddt	j
j|d}|dd}|dkrJt| jd| d	dz|d
 |d |d|d| |dW S  tyv } z
t| jd| dd }~ww )N)stdoutstderrr   zutf-8provider	error_msgVersionz<Version key not provided>   zUnsupported version 'z8' for credential process provider, supported versions: 1r   r   r   r   r   z"Missing required key in response: )r   _popen
subprocessPIPEcommunicate
returncoder   r  decodebotocorecompatjsonloadsrU   _get_account_idKeyError)	rs   r  process_listpr  r  parsedversionerF   rF   rI   r  0  s>   


z.AioProcessProvider._retrieve_credentials_using)	r   r   r   r   create_subprocess_execr   r  r  r   rF   rF   r   rI   ru     s    ru   c                   @      e Zd Zdd ZdS )rX   c                    sN   | j }| I d H }|sd S td td|d  tj|| j|jd}|S )NCREDENTIALS_IMDSz#Found credentials from IAM Role: %s	role_namer   r   )_role_fetcherretrieve_iam_role_credentialsr-   r`   infor   r  r  )rs   fetcherr   r   rF   rF   rI   r  V  s   z AioInstanceMetadataProvider.loadNr   r   r   r  rF   rF   rF   rI   rX   U      rX   c                   @   r5  )rV   c              	      s   | j | jd d}|rQtd |  }|dd}td |d }|d ur?t|}t|d |d |d	 ||| j	|d
 dS t
|d |d |d	 | j	|d
 dS d S )Nr    z+Found credentials in environment variables.F)require_expiryCREDENTIALS_ENV_VARSr   r   r   r   )r   r   r   r   r   )environrU   _mappingr`   r;  _create_credentials_fetcherr-   r+   r   r  r   )rs   r   r<  r   r   rF   rF   rI   r  i  s6   


zAioEnvProvider.loadNr=  rF   rF   rF   rI   rV   h  r>  rV   c                   @   r5  )r]   c                    sh   d| j v r2tj| j d }| |}| j|v r0td || j }|| j }t	||| j
dS d S d S )NAWS_CREDENTIAL_FILEz)Found credentials in AWS_CREDENTIAL_FILE.r   )_environospath
expanduser_parser
ACCESS_KEYr`   r;  
SECRET_KEYr   r  )rs   	full_pathr   r   r   rF   rF   rI   r    s   





	zAioOriginalEC2Provider.loadNr=  rF   rF   rF   rI   r]     r>  r]   c                   @   r5  )r{   c                    s   z|  | j}W n
 ty   Y d S w | j|v rM|| j }| j|v rOtd| j | || j| j\}}| 	|}| 
|}td t|||| j|dS d S d S )Nz0Found credentials in shared credentials file: %sCREDENTIALS_PROFILErB  )_ini_parser_creds_filenamer   _profile_namerM  r`   r;  _extract_creds_from_mappingrN  _get_session_tokenr-  r-   r   r  )rs   available_credsr@   r   r   r   r   rF   rF   rI   r    s8   





z AioSharedCredentialProvider.loadNr=  rF   rF   rF   rI   r{     r>  r{   c                   @   r5  )r   c                    s   z|  | j}W n
 ty   Y d S w | j|d v rS|d | j }| j|v rQtd| j | || j| j\}}| 	|}| 
|}td t|||| j|dS d S d S )Nprofilesz$Credentials found in config file: %srP  rB  )_config_parser_config_filenamer   rS  rM  r`   r;  rT  rN  rU  r-  r-   r   r  )rs   rE   profile_configr   r   r   r   rF   rF   rI   r    s8   



zAioConfigProvider.loadNr=  rF   rF   rF   rI   r     r>  r   c                   @   r5  )r^   c              	      s   | j | jv r| j| j  g}n| j}|D ]?}z| |}W n	 ty&   Y qw d|v rS|d }| j|v rStd| | || j| j	\}}t
d t||| jd  S qd S )Nr   z)Found credentials in boto config file: %sCREDENTIALS_BOTO2_CONFIG_FILErG  )BOTO_CONFIG_ENVrH  DEFAULT_CONFIG_FILENAMESrQ  r   rM  r`   r;  rT  rN  r-   r   r  )rs   potential_locationsfilenamer@   r   r   r   rF   rF   rI   r    s2   


zAioBotoProvider.loadNr=  rF   rF   rF   rI   r^     r>  r^   c                   @   s<   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd ZdS )rZ   c                    sH   |   | _| jdi }|| ji }| |r"| | jI d H S d S )NrW  )_load_config_loaded_configrU   rS  _has_assume_role_config_vars_load_creds_via_assume_role)rs   rW  r5   rF   rF   rI   r    s   

zAioAssumeRoleProvider.loadc                    s   |  |}| ||I d H }i }|d}|d ur||d< |d}|d ur+||d< |d}|d ur8||d< |d}|d urE||d< t| j||d	 || j| jd
}	| j |	_	|	j
}
|d uret|
}
| jd t| j t| j|
tdS )Nrole_session_nameRoleSessionNameexternal_id
ExternalId
mfa_serialSerialNumberduration_secondsDurationSecondsr	  )rL   source_credentialsr	  r  mfa_prompterrB   CREDENTIALS_STS_ASSUME_ROLE)r   r   r   )_get_role_config_resolve_source_credentialsrU   r   r  	_prompterrB   _feature_idscopyr   r   r   addr.   r   r  r(   )rs   rM   role_configrl  r  rd  rf  rh  rj  r<  	refresherrF   rF   rI   rc    sJ   






z1AioAssumeRoleProvider._load_creds_via_assume_rolec                    sb   | d}|d ur| jd | ||I d H S |d }| j| | jd | |I d H S )Ncredential_source"CREDENTIALS_PROFILE_NAMED_PROVIDERsource_profile"CREDENTIALS_PROFILE_SOURCE_PROFILE)rU   rr  rt   _resolve_credentials_from_source_visited_profilesappend!_resolve_credentials_from_profile)rs   ru  rM   rw  ry  rF   rF   rI   rp  )  s   

z1AioAssumeRoleProvider._resolve_source_credentialsc                    s   | j di }|| }| jd | |r| js| |S | |s)| |sK| jj|dd}t	|}|
 I d H }|d u rId}t|| d|S | |I d H S )NrW  rP  TrP   z.The source profile "%s" must have credentials.r   )ra  rU   rr  rt  _has_static_credentials_profile_provider_builder(_resolve_static_credentials_from_profilerb  rR   rb   r   r   rc  )rs   rM   rW  r5   rj   profile_chainr   error_messagerF   rF   rI   r~  6  s8   
z7AioAssumeRoleProvider._resolve_credentials_from_profilec              
   C   sJ   zt |d |d |ddW S  ty$ } z	t| jt|dd }~ww )Nr   r   r   )r   r   r   )r  cred_var)r   rU   r.  r   r  str)rs   r5   r3  rF   rF   rI   r  V  s   
z>AioAssumeRoleProvider._resolve_static_credentials_from_profilec                    sN   | j |I d H }|d u rt|d| d| j|}|r%| j| |S )Nz@No credentials found in credential_source referenced in profile r  )_credential_sourcerrl  r   NAMED_PROVIDER_FEATURE_MAPrU   rr  rt  )rs   rw  rM   r   named_provider_feature_idrF   rF   rI   r{  b  s"   
z6AioAssumeRoleProvider._resolve_credentials_from_sourceN)	r   r   r   r  rc  rp  r~  r  r{  rF   rF   rF   rI   rZ     s    / rZ   c                   @   r   )r   c                    r   rD   )_assume_role_with_web_identityrr   rF   rF   rI   r  y  r   z)AioAssumeRoleWithWebIdentityProvider.loadc                    s   |  d}|s
d S | |}|  d}|sd}t|di }|  d}|d ur,||d< t| j|||| jd}| j |_| j	d t
| j t| j|jd	S )
Nweb_identity_token_filer	  zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r  rd  re  )rL   r  r	  r  rB   "CREDENTIALS_STS_ASSUME_ROLE_WEB_IDr8  )_get_config_token_loader_clsr   r  r  rB   rr  rs  r   rt  r.   r   r  r   )rs   
token_pathtoken_loaderr	  r   r  rd  r<  rF   rF   rI   r  |  s8   





zCAioAssumeRoleWithWebIdentityProvider._assume_role_with_web_identityN)r   r   r   r  r  rF   rF   rF   rI   r   x  s    r   c                   @   r   )r\   c                    s2   |  |}t|tr| I dH S | I dH S )a  Loads source credentials based on the provided configuration.

        :type source_name: str
        :param source_name: The value of credential_source in the config
            file. This is the canonical name of the credential provider.

        :rtype: Credentials
        N)_get_provider
isinstancerb   r   r  )rs   source_namesourcerF   rF   rI   rl    s
   
	
z4AioCanonicalNameCredentialSourcer.source_credentialsc                 C   sV   |  |}| dv r | d}|dur |du r|S t||gS |du r)t|d|S )a#  Return a credential provider by its canonical name.

        :type canonical_name: str
        :param canonical_name: The canonical name of the provider.

        :raises UnknownCredentialError: Raised if no
            credential provider by the provided name
            is found.
        )sharedconfigsharedcredentialszassume-roleN)name)_get_provider_by_canonical_namelower_get_provider_by_methodrb   r'   )rs   canonical_namer  rh   rF   rF   rI   r    s   



z/AioCanonicalNameCredentialSourcer._get_providerN)r   r   r   rl  r  rF   rF   rF   rI   r\     s    r\   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	rW   c                    s.   t  j|i | t| jtrt | _d S d S rD   )r   r   r  _fetcherr   r2   r   r   rF   rI   r     s   zAioContainerProvider.__init__c                    s,   | j | jv s| j| jv r|  I d H S d S rD   )ENV_VARrH  ENV_VAR_FULL_retrieve_or_failrr   rF   rF   rI   r    s   zAioContainerProvider.loadc              
      st   |   r| j| j| j }n| j| j }| |}| I d H }t|d |d |d | jt	|d ||
ddS )Nr   r   r   r   r   )r   r   r   r   r   r   r   )_provided_relative_urir  full_urlrH  r  r  _create_fetcherr   r  r)   rU   )rs   full_urir<  r   rF   rF   rI   r    s   

z&AioContainerProvider._retrieve_or_failc                    s    fdd}|S )Nc               
      s   z  } jj | dI d H }td W n ty3 } ztjd|dd tjt	|dd }~ww |d |d |d	 |d
 |
ddS )N)headersCREDENTIALS_HTTPz'Error retrieving container metadata: %sTr   r  r   r   Tokenr   r   r   )_build_headersr  retrieve_full_urir-   r   r`   ra   r   r  r  rU   )r  r   r3  r  rs   rF   rI   fetch_creds  s,   
z9AioContainerProvider._create_fetcher.<locals>.fetch_credsrF   )rs   r  r   r   r  rF   r  rI   r    s   z$AioContainerProvider._create_fetcher)r   r   r   r   r  r  r  r   rF   rF   r   rI   rW     s
    rW   c                   @   r5  )rb   c                    s>   | j D ]}td|j | I dH }|dur|  S qdS )zw
        Goes through the credentials chain, returning the first ``Credentials``
        that could be loaded.
        zLooking for credentials via: %sN)rR   r`   ra   r  r  )rs   r  r   rF   rF   rI   r     s   
	z&AioCredentialResolver.load_credentialsN)r   r   r   r   rF   rF   rF   rI   rb     r>  rb   c                   @   r5  )AioSSOCredentialFetcherc              	      sB  t t| jd}| jd|d4 I dH }| jr%| j }| I dH j}n!| | j	}|d }t
j|d }t||   }|dkrFt | j| j|d}zt| j |jdi |I dH }	W n |jjyl   t w |	d	 }
d|
d
 |
d |
d | |
d | jdd}
|
W  d  I dH  S 1 I dH sw   Y  dS )z4Get credentials by calling SSO get role credentials.)r
  rC   ssor  NaccessToken	expiresAtr   )roleName	accountIdr  roleCredentialsaccessKeyIdsecretAccessKeysessionTokenr   )r   r   r   r   r   )ProviderTyper   rF   )r   r   _sso_regionr  _token_provider
load_tokenget_frozen_tokenr   _token_loader
_start_urldateutilparserr+   r   r   r&   
_role_namer   r.   r   get_role_credentials
exceptionsUnauthorizedException_parse_timestamp)rs   r@   r   initial_token_datar   
token_dictr   	remainingr   r   r   rF   rF   rI   r   +  sL   

0z(AioSSOCredentialFetcher._get_credentialsN)r   r   r   r   rF   rF   rF   rI   r  (  s    r  c                   @   r5  )r   c                    s   |   }|s	d S |d |d |d |d | jt| jd| jd}d|v }|r9|d |d< | j|d	< | jd
 n| jd tdi |}| j	 |_
|rU| jd n| jd t| j t| j|jdS )Nsso_start_url
sso_regionsso_role_namesso_account_id)rB   )	start_urlr  r7  r   rL   r  rB   sso_sessionsso_session_namer   CREDENTIALS_PROFILE_SSOCREDENTIALS_PROFILE_SSO_LEGACYCREDENTIALS_SSOCREDENTIALS_SSO_LEGACYr8  rF   )_load_sso_configr  r%   _token_cacherB   r  rr  rt  r  rs  r   r.   r   r  r   )rs   
sso_configfetcher_kwargssso_session_in_configsso_fetcherrF   rF   rI   r  ]  s8   
	

zAioSSOProvider.loadNr=  rF   rF   rF   rI   r   \  r>  r   c                    r   )zCreate a client creator function for use in credential providers.

    This is the async version of botocore.credentials._get_client_creator that
    uses aiobotocore's create_nested_client.
    c                    s*   d i}|j di | t| fi |S )NrC   rF   )updater4   )service_namer   create_client_kwargsrC   rH   rF   rI   rL     s   z+_get_client_creator.<locals>.client_creatorrF   )rH   rC   rL   rF   r  rI   r[     s   r[   )NN)br   loggingrI  r$  rs  r   botocore.compatr)  dateutil.parserr  r   r   r   botocore.configr   botocore.credentialsr   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   botocore.useragentr-   r.   aiobotocore._helpersr/   aiobotocore.configr0   aiobotocore.tokensr1   aiobotocore.utilsr2   r3   r4   	getLoggerr   r`   rm   rY   r   r   r   create_aio_mfa_serial_refresherr   r   r   r   r   r   r  ru   rX   rV   r]   r{   r   r^   rZ   r   r\   rW   rb   r  r   r[   rF   rF   rF   rI   <module>   sr    (

^/ 

!

+@" -67
4&