0j9ddlZ ddlmZn#e$r ddlmZYnwxYwddlZejeZdZdZ dZ dZ dZ dZ dZeed d d e d d dede e e g ZgdZdZdZdZGddeZGddeZdZdZdZdS)N)urlparsezlogin.microsoftonline.uszlogin.chinacloudapi.cnzlogin.microsoftonline.comzlogin.sovcloud-identity.frzlogin.sovcloud-identity.dezlogin.sovcloud-identity.sgzlogin.microsoft.comzlogin.windows.netzsts.windows.netz login.partner.microsoftonline.cnzlogin.microsoftonline.dezlogin-us.microsoftonline.comzlogin.usgovcloudapi.net)z b2clogin.comz b2clogin.cnz b2clogin.usz b2clogin.dez ciamlogin.comz.ciamlogin.comc&|tvr|ntS)N)WELL_KNOWN_AUTHORITY_HOSTS WORLD_WIDEinstances V/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/msal/authority.py_get_instance_discovery_hostr -s#===88:McFdt|S)Nz$https://{}/common/discovery/instance)formatr rs r _get_instance_discovery_endpointr1s% 1 8 8$X.. 0 00r ceZdZdZdZdS)AuthorityBuildercn|d|_|d|_dS)zA helper to save caller from doing string concatenation. Usage is documented in :func:`application.ClientApplication.__init__`. /N)rstrip _instancestrip_tenant)selfrtenants r __init__zAuthorityBuilder.__init__7s. "--||C(( r cBd|j|jS)Nz https://{}/{})r rr)rs r __str__zAuthorityBuilder.__str__?s%%dndlCCCr N)__name__ __module__ __qualname__rrr r rr6s7)))DDDDDr rcPeZdZdZegZ d dZdZdZd dZ dZ dS) AuthorityzThis class represents an (already-validated) authority. Once constructed, it contains members named "*_endpoint" for this instance. TODO: It will also cache the previously-validated authority instances. TNc||_||_|r||}n||||} t ||j}nM#t $r@|rd|nd|dz}t |wxYw|d|_|d|_ |d|_ |d|_ t|j \} } |_ |jr=|s+t d |j| d Sd S) a`Creates an authority instance, and also validates it. :param validate_authority: The Authority validation process actually checks two parts: instance (a.k.a. host) and tenant. We always do a tenant discovery. This parameter only controls whether an instance discovery will be performed. zUnable to get OIDC authority configuration for {url} because its OIDC Discovery endpoint is unavailable at {url}/.well-known/openid-configuration )urlzUnable to get authority configuration for {}. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant or https://tenant_name.ciamlogin.com or https://tenant_name.b2clogin.com/tenant.onmicrosoft.com/policy. z> Also please double check your tenant name or GUID is correct.issuerauthorization_endpointtoken_endpointdevice_authorization_endpointavThe issuer '{iss}' does not match the authority '{auth}' or a known pattern. When using the 'oidc_authority' parameter in ClientApplication, the authority will be validated against the issuer from {auth}/.well-known/openid-configuration .If using a known Entra authority (e.g. login.microsoftonline.com) the 'authority' parameter should be used instead of 'oidc_authority'. )issauthN) _http_client_oidc_authority_url_initialize_oidc_authority_initialize_entra_authoritytenant_discovery ValueErrorr get_issuerr%r&r' canonicalizerhas_valid_issuer) r authority_url http_clientvalidate_authorityinstance_discoveryoidc_authority_urltenant_discovery_endpoint openid_config error_message_s r rzAuthority.__init__Ks(#5  G(,(G(G")$)$ % %)-(H(H13E)G)G % ,,)!##MM , , , & '::@&EW&:X:X:XV  &&T UM]++ + ,%((22 &34L&M#+,<=-:->->?^-_-_*()<==1dk  # AD,A,A,C,C A f,>f??AA A A A A As AA Bct|\}|_}|dk|_d|_d|_|dzS)NadfsTz!/.well-known/openid-configuration)r2rloweris_adfs_is_b2c_is_known_to_developer)rr8 authorityrs r r,z$Authority._initialize_oidc_authoritysJ+78J+K+K( 4=&||~~/  '+#!$GGGr c,t|trt|}t|\}_}jt }|dko| _|j d}tfdtDp?t|dko,|dd_jp jp| _jt"v}|dvrt%jn|} | rq|sojsht'dj|j j| } | d d krt/d |z| d } ng|d |rt|j dkr|n|j jrdnd} | S)Nr>rc3RK|]!}jd|zV"dS.N)rendswith).0drs r z8Authority._initialize_entra_authority..sH01DM " "37 + +r b2c_)NTz"https://{}{}/oauth2/v2.0/authorizeerrorinvalid_instancezinvalid_instance: The authority you provided, %s, is not known. If it is a valid domain name known to you, you can turn off this check by passing in instance_discovery=Falser9z2{prefix}{version}/.well-known/openid-configurationz/v2.0)prefixversion)path) isinstancerstrr2rrH_CIAM_DOMAIN_SUFFIXr?r@rUsplitanyWELL_KNOWN_B2C_HOSTSlen startswithrArBrr_instance_discoveryr r*r0r/_replacegeturl) rr4r6r7rCris_ciampartsis_known_to_microsoftinstance_discovery_endpointpayloadr9s ` r r-z%Authority._initialize_entra_authoritysa m%5 6 6 / ..M+7 +F+F( 4=&-(()<==||~~/?K $$S))5IKe**/IeAhnn&6&6&A&A&&I&I '+l&\dl&\J\F\# $ 1K K$|33'G M'''9K $ ' % )-)D )4;;M9>33!+ --G {{7##'999 / $ $%%%)00K(L % %(1(:(:IPP%,,Y^1D1D1I1I66&^"&,;BBGQ);)) &(( &)(r cZ|j|jjvr|p8|jd|j|d|d}|jdkr-|tj |j S|jj |jiS)Nz> 5 @ @D 3&&%%'''z$),,, N @ D DT] S S S r c|jr|jsdS|jd|jdkrdSt|j}t|j}|jr|jndsdSt vrdSd}|dkrN|dzd}dd|vr5|t vrdS|jr|jnd}||krdS|j|jkr|j |j krdStfd tDrdSdS) a] Returns True if the issuer from OIDC discovery is valid for this authority. An issuer is valid if one of the following is true: - It exactly matches the authority URL (with/without trailing slash) - It has the same scheme and host as the authority (path can be different) - The issuer host is a well-known Microsoft authority host - The issuer host is a regional variant of a well-known host (e.g., westus2.login.microsoft.com) - For CIAM, hosts that end with well-known B2C hosts (e.g., tenant.b2clogin.com) are accepted as valid issuers FrTNrGrrQrRc3HK|]}d|zVdSrF)rH)rIh issuer_hosts r rKz-Authority.has_valid_issuer..s5KK{##C!G,,KKKKKKr ) r1r+rrhostnamer?rfindschemergrZr[)r issuer_parsedauthority_parsed dot_indexpotential_baseauthority_hostrzs @r r3zAuthority.has_valid_issuers| 4#; 5 <  s # #t'?'F'Fs'K'K K K4 .. #D$<==8E8NXm,22444TX  5 4 4 44 $$S)) q==(Q8N+jyj111!%???4GWF_!g!1!:!@!@!B!B!Beg!^334  #}'; ; ;  #}'; ; ;4 KKKK6JKKK K K 4ur )TNN)NN) rrr__doc__setrlrr,r-rvr3rr r r!r!Cs -0CGG) $## 7A7A7A7ApHHH-)-)-)^ 77777r r!ct|}|jdkr|jr|jd}t |dkr|dr|dnd}|jtrG|r|n8d|j tdd}||j|fSt |dkr|dr||j|dfStd|z)NhttpsrrMrQz{}.onmicrosoft.comraYour given address (%s) should consist of an https url with hostname and a minimum of one segment in a path: e.g. https://login.microsoftonline.com/{tenant} or https://{tenant_name}.ciamlogin.com/{tenant} or https://{tenant_name}.b2clogin.com/{tenant_name}.onmicrosoft.com/policy) rr}r{rUrYr\rHrXr rsplitr/)authority_or_auth_endpointrCrb first_partrs r r2r2s344I7""y'9"$$S))!$UqU1XU1XX4   & &': ; ; 9#-FZZ3G3N3N"))*=qAA!D4F4FFi0&8 8 u::??uQx?i0%(: :  U %  % & &&r c Z|j|fd|ddi|}tj|jS)Nparamsz1.0)r%z api-version)r0rorprq)r#r5rdkwargsrus r r^r^sK ;?#  *-eDD    D :di  r c P|j|fi|}|jdkrtj|jSd|jcxkrdkr1nn.t d||j|j|td|j|jfz)Niiz7OIDC Discovery failed on {}. HTTP status: {}, Error: {}z)Unable to complete OIDC Discovery: %d, %s) r0rmrorprqr/r rn RuntimeError)r9r5rrus r r.r."s ;?4 ? ? ? ?D 3z$)$$$ d$$$$$$$$$RYY %   I    3t7G6SS U UUr )ro urllib.parser ImportErrorlogging getLoggerrloggerAZURE_US_GOVERNMENTDEPRECATED_AZURE_CHINA AZURE_PUBLIC AZURE_GOV_FR AZURE_GOV_DE AZURE_GOV_SGr frozensetrr[rXr robjectrr!r2r^r.rr r rs "%%%%%%%"""!!!!!!!!"  8 $ $11* + + + ( &Y&"( 'NNN000 D D D D Dv D D DB&&&.!!!UUUUUs