
    0j&                         d Z ddlZddlZddlmZ ddlmZmZ ddlZddl	m
Z
mZmZmZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ d	Z ej        e          Z G d
 d          ZdS )z[
Copyright (c) Microsoft Corporation. All rights reserved.
Licensed under the MIT License.
    N)isawaitable)AnyOptional)ClientCredentialsCredentialsJsonWebTokenTokenProtocol)PUBLICCloudEnvironment)FederatedIdentityCredentialsManagedIdentityCredentialsTokenCredentials)ConfidentialClientApplicationManagedIdentityClientSystemAssignedManagedIdentityUserAssignedManagedIdentitycommonc            
          e Zd ZdZ	 ddee         dee         fdZdee         fdZ	ddee
         dee         fd	Zdd
de
de
de
dz  dee         fdZdede
de
defdZdede
defdZdede
de
defdZdede
fdZdede
de
defdZddee
ef         de
defdZdede
defdZdeez  defdZde
dz  de
fdZdS )TokenManagerz8Manages authentication tokens for the Teams application.Ncredentialscloudc                 L    || _         |pt          | _        i | _        d | _        d S N)_credentialsr
   _cloud_confidential_clients_by_tenant_managed_identity_client)selfr   r   s      j/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/microsoft_teams/apps/token_manager.py__init__zTokenManager.__init__'   s-    
 (ovY[,IM%%%    returnc                    K   |                      | j        j        |                     d| j        j                             d{V S )z%Refresh the bot authentication token.N	tenant_id)
_get_tokenr   	bot_scope_resolve_tenant_idlogin_tenant)r   s    r   get_bot_tokenzTokenManager.get_bot_token1   s^      __K!T-D-DT4;Kc-d-d % 
 
 
 
 
 
 
 
 	
r!   r%   c                    K   |                      | j        j        |                     |t                               d{V S )a'  
        Get or refresh a Graph API token.

        Args:
            tenant_id: If provided, gets a tenant-specific token. Otherwise uses app's default.
            force: Force refresh even if token is not expired

        Returns:
            The graph token or None if not available
        r$   N)r&   r   graph_scoper(   DEFAULT_TENANT_FOR_GRAPH_TOKEN)r   r%   s     r   get_graph_tokenzTokenManager.get_graph_token7   s\       __K#t/F/FyRp/q/q % 
 
 
 
 
 
 
 
 	
r!   )caller_namescoper/   c                  K   | j         }| j         !|rt                              d|            d S t          |t                    r|                     |||           d {V S t          |t                    r|                     ||           d {V S t          |t                    r| 	                    |||           d {V S t          |t                    r|                     |||           d {V S d S )NzNo credentials provided for )r   loggerdebug
isinstancer   "_get_token_with_client_credentialsr    _get_token_with_managed_identityr   "_get_token_with_federated_identityr   _get_token_with_token_provider)r   r0   r%   r/   r   s        r   r&   zTokenManager._get_tokenF   s@      '$ KIKIIJJJ4k#455 	\@@eU^_________%?@@ 	\>>{ERRRRRRRRR%ABB 	\@@eU^_________%566 	\<<[%QZ[[[[[[[[[tr!   c                    K   |                      ||          t          j        fd           d{V }|                     |          S )z2Get token using ClientCredentials (client secret).c                  0                          g          S r   acquire_token_for_clientconfidential_clientr0   s   r   <lambda>zATokenManager._get_token_with_client_credentials.<locals>.<lambda>d       '@@%II r!   N)_get_confidential_clientasyncio	to_thread_handle_token_response)r   r   r0   r%   	token_resr>   s     `  @r   r5   z/TokenManager._get_token_with_client_credentialsY   sw       #;;KSS +2*;IIIII+
 +
 %
 %
 %
 %
 %
 %
	 **9555r!   c                    K   |                      |          |                    d          t          j        fd           d{V }|                     |          S )zCGet token using ManagedIdentityCredentials (direct, no federation).z	/.defaultc                  0                                    S )Nresourcer;   )	mi_clientrI   s   r   r?   z?TokenManager._get_token_with_managed_identity.<locals>.<lambda>t   s    I666II r!   N)_get_managed_identity_clientremovesuffixrB   rC   rD   )r   r   r0   rE   rJ   rI   s       @@r   r6   z-TokenManager._get_token_with_managed_identityi   s       55kBB	 %%k22*1*;IIIII+
 +
 %
 %
 %
 %
 %
 %
	 **9555r!   c                    K   |                      |           d{V }t          |j        d|i| j        j         d|           t          j        fd           d{V }|                     |d          S )z?Get token using Federated Identity Credentials (two-step flow).Nclient_assertion/client_credential	authorityc                  0                          g          S r   r;   r=   s   r   r?   zATokenManager._get_token_with_federated_identity.<locals>.<lambda>   r@   r!   zFIC Step 2 failed)error_prefix)_acquire_managed_identity_tokenr   	client_idr   login_endpointrB   rC   rD   )r   r   r0   r%   mi_tokenrE   r>   s     `   @r   r7   z/TokenManager._get_token_with_federated_identityy   s       ==kJJJJJJJJ <!18<3AAiAA
 
 
 +2*;IIIII+
 +
 %
 %
 %
 %
 %
 %
	 **9CV*WWWr!   c                 l  K   |                      |          t          j        fd           d{V }|                    d          sct                              d           |                    dt          d                    }t          |t                    st          |          }||d         S )zBAcquire managed identity token for federated identity credentials.c                  0                          d          S )Nzapi://AzureADTokenExchangerH   r;   )rJ   s   r   r?   z>TokenManager._acquire_managed_identity_token.<locals>.<lambda>   s    I66@\6]] r!   Naccess_tokenz-FIC Step 1 failed: Could not acquire MI tokenerrorzError retrieving MI token)	rK   rB   rC   getr2   r\   
ValueErrorr4   BaseException)r   r   mi_token_resr\   rJ   s       @r   rU   z,TokenManager._acquire_managed_identity_token   s       55kBB	-4->]]]].
 .
 (
 (
 (
 (
 (
 (
 // 	LLHIII $$Wj9T.U.UVVEe]33 *"5))KN++r!   c                    K   |                     ||          }t          |          r	| d{V }n|}t          |          S )z/Get token using custom token provider function.N)tokenr   r   )r   r   r0   r%   rb   r[   s         r   r8   z+TokenManager._get_token_with_token_provider   sS       !!%33u 	!!&;;;;;;LL LL)))r!    rE   rT   c                    |                     dd          r|d         }t          |          S |r| dnd}t                              | d           t                              d|            |                     dd          }t          |t                    st          |          }|                     d	d
          }t                              |           |)z'Handle token response from MSAL client.r[   Nz: rc   zCould not acquire access tokenz
TokenRes: r\   zError retrieving tokenerror_descriptionz Error retrieving token from MSAL)r]   r   r2   r\   r3   r4   r_   r^   )r   rE   rT   r[   	error_msgr\   re   s          r   rD   z#TokenManager._handle_token_response   s    ==.. 	$^4L---/;C<++++ILLIEEEFFFLL1i11222MM'+CDDEe]33 *"5)) ).ACe f fLL*+++Kr!   c                     | j                             |          }|r|S t          |j        |j        | j        j         d|           }|| j         |<   |S )zBGet or create ConfidentialClientApplication for ClientCredentials.rO   rP   )r   r]   r   rV   client_secretr   rW   )r   r   r%   cached_clientclients        r   rA   z%TokenManager._get_confidential_client   ss     <@@KK 	!  0M!)73AAiAA1
 1
 1

 ;A,Y7r!   c                 @   | j         r| j         S t          |t                    r9|j        dk    rt	                      }n4|j        p|j        }t          |          }nt          |j                  }t          |t          j
                              | _         | j         S )zcGet or create ManagedIdentityClient for ManagedIdentityCredentials or FederatedIdentityCredentials.system)rV   )http_client)r   r4   r   managed_identity_typer   managed_identity_client_idrV   r   r   requestsSession)r   r   managed_identitymi_client_ids       r   rK   z)TokenManager._get_managed_identity_client   s     ( 	100 k#?@@ 	\0H<<#@#B#B  *E^I^#>#V#V#V    ;[EZ[[[(= (**)
 )
 )
% ,,r!   default_tenant_idc                 4    |p| j         r| j         j        ndp|S )NF)r   r%   )r   r%   rt   s      r   r(   zTokenManager._resolve_tenant_id   s'    nD<MXT.88SXn]nnr!   r   )rc   )__name__
__module____qualname____doc__r   r   r   r    r	   r*   strr.   r&   r   r5   r   r6   r   r7   rU   r   r8   dictr   rD   r   rA   r   rK   r(    r!   r   r   r   $   s       BB
 -1N Nk*N ()N N N N
Xm%< 
 
 
 

 
x} 
Q^H_ 
 
 
 
  HL  %(:=*	-	    &6&6 6 	6
 
6 6 6 6 6/6 6 
	6 6 6 6 X1X X 	X
 
X X X X0,A] ,be , , , ,$*%* * 	*
 
* * * *  S#X c [h    $4E RU Zw    -58TT-	- - - -6oC$J o3 o o o o o or!   r   )ry   rB   logginginspectr   typingr   r   rp   microsoft_teams.apir   r   r   r	   *microsoft_teams.api.auth.cloud_environmentr
   r   $microsoft_teams.api.auth.credentialsr   r   r   msalr   r   r   r   r-   	getLoggerrv   r2   r   r|   r!   r   <module>r      s{   
                                     P O O O O O O O         
            "* 		8	$	$Lo Lo Lo Lo Lo Lo Lo Lo Lo Lor!   