o
    i#                     @   sT  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dl m!Z" e#e$Z%dZ&e'e&ej( e) Z*dZ+e,dZ-G dd de.Z/dede	e0e1f fddZ2G dd deZ3dS )    N)Any)Callable)Optional)Union)MAX_SPAN_META_VALUE_LEN)SimplifiedEndpointComputer)ASM_Environment)API_SECURITY)SPAN_DATA_NAMES)_asm_manual_keep)http)logger)NumericType)Service)configapi_security_callbacki   z-infc                   @   s   e Zd ZdS )TooLargeSchemaExceptionN)__name__
__module____qualname__ r   r   \/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_api_security/api_manager.pyr   &   s    r   vreturnc                 C   s   t | ttfrt| S t| S N)
isinstancelisttupledict)r   r   r   r   path_param_transform*   s   r   c                       s*  e Zd ZU dejefdejefdejefdeje	fdej
dfgZeeeeeeegef  f  ed< edejefd	ejd
d fg Zeeeeeeegef  f  ed< dZed  ed< edddZedddZd fddZdddZdddZdededee fddZ deddfddZ!  Z"S ) 
APIManagerREQUEST_HEADERS_NO_COOKIESREQUEST_COOKIESREQUEST_QUERYREQUEST_PATH_PARAMSREQUEST_BODYNBLOCK_COLLECTEDRESPONSE_HEADERS_NO_COOKIESRESPONSE_BODYc                 C   s   t | r|  S | S r   )callable)fr   r   r   <lambda>:   s    zAPIManager.<lambda>	COLLECTED	_instancer   c                 C   sT   | j d urtd| j d S dt_td| j |  | _ | j   td| j d S )Nz%s already enabledTzEnabling %sz
%s enabled)r-   logdebugr   
asm_config_api_security_activestartclsr   r   r   enable?   s   

zAPIManager.enablec                 C   sR   | j d u rtd| j d S dt_td| j | j   d | _ td| j d S )Nz%s not enabledFzDisabling %sz%s disabled)r-   r.   r/   r   r0   r1   stopr3   r   r   r   disableL   s   

zAPIManager.disablec                    sd   t t|   td| jj t | _	t
 | _dd lm  m} dd lm  m} || _|| _d S )Nz%s initializedr   )superr    __init__r.   r/   	__class__r   collectionsOrderedDict
_hashtabler   simplified_endpoint_computer#ddtrace.appsec._asm_request_contextappsec_asm_request_contextddtrace.appsec._metrics_metrics_asm_context)selfrA   rC   r:   r   r   r9   X   s   

zAPIManager.__init__c                 C   s    | j j| jdd | j  d S NT)global_callback)rD   remove_context_callback_schema_callbackr=   clearrE   r   r   r   _stop_servicee   s   zAPIManager._stop_servicec                 C   s   | j j| jdd d S rG   )rD   add_context_callbackrJ   rL   r   r   r   _start_servicei   s   zAPIManager._start_serviceenvpriorityc                 C   sR  |dkr	t jr	dS |jtj}|jtj}|dkp|dk}|jtj}|du rK|jdu rK|sK|j	
tj}|du rI|j	
tj}| j|}|}|du sW|du sW|du rn|s\|jr^dS tdt|t|t| dS t|||f}	t }
| j|	t}||
t j krdS |tu rt| jtkr| jjdd n| j|	 |
| j|	< dS )	z
        Rate limit per route.

        Returns:
            None: if missing route, method or status
            False: if sampled
            True: if we should collect
        r   F404i  NzHunsupported groupkey for api security [method %s] [route %s] [status %s])lastT)r0   _apm_tracing_enabledwaf_addressesgetr
   REQUEST_METHODRESPONSE_STATUSREQUEST_ROUTEblocked
entry_spanget_tagr   ENDPOINTURLr>   from_urlr.   r/   boolhashtime	monotonicr=   
M_INFINITY_api_security_sample_delaylenMAX_HASHTABLE_SIZEpopitemmove_to_end)rE   rP   rQ   methodstatusis_404routeendpointurlend_point_hashcurrent_timeprevious_timer   r   r   _should_collect_schemal   sD   	

z!APIManager._should_collect_schemac              	      s  |j d u stjs
d S |j |jr| jn| j} r#t fdd|D r%d S zP jj	d u r6|j jj	d u r6d}n jj	p;d|j jj	pAdf}t
j|v rLt
j}nt
j|v rUt
j}nt|}| ||}|d u ro| jdd|j W d S |stW d S W n ty   dddd	}tjt|d
d Y d S w ddd
ii}|D ]-\}}	}
tjs|dkrq|jt| t}|tu rtd| q|
d ur|
|}|||< q|j}|d u rd S ||}|d u rd S d}|j D ]E\}}d}z$t t!"t#j$|dd% & }t'|t(krt)| j*|< |d7 }W q ty#   ddd| d	}tjt|d
d Y qw ||_+| jd
||j |dkr?tj,sAt-  d S d S d S )Nc                 3   s     | ]\}}}| j v V  qd S r   )_meta).0_	meta_namerootr   r   	<genexpr>   s    z.APIManager._schema_callback.<locals>.<genexpr>)   r   Fr@      z:sample_request_failure)product
exec_limit	more_infoT)extraexc_infoPROCESSOR_SETTINGSzextract-schemar(   zno value for %s ),:)
separatorsr{   z:schema_failure:).spanr0   _api_security_feature_activer[   rZ   r&   r,   anycontextsampling_priority	constants	USER_KEEPUSER_REJECTmaxrs   rC   _report_api_security	framework	Exceptionr.   warningAPI_SECURITY_LOGS!_api_security_parse_response_bodyrU   rV   r
   	_sentinelr/   waf_callableapi_securityitemsbase64	b64encodegzipcompressjsondumpsencodedecoderf   r   r   rt   api_security_reportedrT   r   )rE   rP   	collected
prioritiesrQ   should_collectr   waf_payloadaddressrv   	transformvaluer   result
nb_schemasmetaschemab64_gzip_contentr   rx   r   rJ      s   



zAPIManager._schema_callback)r   N)#r   r   r   r	   r!   r   r"   r#   r$   r   r%   r&   r   r   strr   r   r   __annotations__r'   r(   r,   r-   classmethodr5   r7   r9   rM   rO   r   r   r`   rs   rJ   __classcell__r   r   rF   r   r    0   s*   
 




(
*

1r    )4r   r;   r   r   rb   typingr   r   r   r   ddtrace._trace._limitsr   *ddtrace._trace.processor.resource_renamingr   r?   r   ddtrace.appsec._constantsr	   r
   ddtrace.appsec._trace_utilsr   ddtrace.constantsr   ddtrace.extr   ddtrace.internalr   ddloggerddtrace.internal.compatr   ddtrace.internal.servicer   ddtrace.internal.settings.asmr   r0   
get_loggerr   r.   r   set_tag_rate_limitHOURobjectr   rg   floatrd   r   r   r   r   r   r    r   r   r   r   <module>   s<    
