8?jddlZddlZddlZddlmZddlZddlZddl Z ddl Z ddl Z ddl mZddlmZmZmZmZddlZddlZddlmZmZmZddlmZddlmZddlm Z ddl!m"Z"er ddl#Z#dd l#m$Z$n ddl#Z#dd l#m$Z$n#e%e&f$rdZ$YnwxYwej'e(Z)gd Z* dd l+m,Z-d Z.n #e%$rd Z.YnwxYwedZ/GddeZ0GddZ1dS)N)asynccontextmanager) TYPE_CHECKINGMappingOptionalUnion)_exponential_backoff_helpers exceptions) transport) Credentials)mtls) TimeoutError) ClientTimeout)zmtls.googleapis.comzmtls.sandbox.googleapis.comzp.googleapis.com)RequestTFcKtj|fdfd} |WVdS#wxYw)a timeout_guard is an asynchronous context manager to apply a timeout to an asynchronous block of code. Args: timeout (float): The time in seconds before the context manager times out. Raises: google.auth.exceptions.TimeoutError: If the code within the context exceeds the provided timeout. Usage: async with timeout_guard(10) as with_timeout: await with_timeout(async_function()) cxdStjz }|z }|dkrtdd|S)Nrz3Context manager exceeded the configured timeout of s.)time monotonicr)elapsed remainingstart total_timeouts SC:\Projects\Historical\venv\Lib\site-packages\google/auth/aio/transport/sessions.py_remaining_timez&timeout_guard.._remaining_timePs[  4.""U*!G+ >>WmWWW cK }tj||d{V}|S#tjtf$r}td|dd|d}~wwxYw)NzThe operation z$ exceeded the configured timeout of r)asynciowait_forr)cororresponseerrs r with_timeoutz#timeout_guard..with_timeout[s '))I$-dI>>>>>>>>HO$l3   \\\=\\\  s&,AAAN)rr)timeoutr#rrrs @@@r timeout_guardr%>s N  EM       s 9 AceZdZdZdejjjfdZe dZ dZ e dZ e dZ e ejejjjdZe ejejjjd Zd Zejedd Zejed ZejedZd S)_SyncCredentialsAdapteragAdapts synchronous credentials to the asynchronous credentials interface. :class:`AsyncAuthorizedSession` wraps :class:`google.auth.credentials.Credentials` (e.g. application default credentials) with this adapter so that they can be used with an asynchronous transport. Calls are delegated to the wrapped credentials using a synchronous transport, and blocking calls such as refreshing the access token run in a worker thread so that the event loop is not blocked. Args: credentials (google.auth.credentials.Credentials): The synchronous credentials to adapt. credentialsc0||_d|_d|_dSN) _credentials_sync_request_instance_pending_refresh)selfr(s r__init__z _SyncCredentialsAdapter.__init__{s&''+#AErc\|jddlm}||_|jS)Nr)requests)r,google.auth.transportr1r)r. sync_requestss r _sync_requestz%_SyncCredentialsAdapter._sync_requests=  & . H G G G G G*7*?*?*A*AD '**rc|jAt|jdr.|jj$|jjdSdSdSdS)Nsession)r,hasattrr6closer.s rr8z_SyncCredentialsAdapter.closes^  ' 33Y?? 4+3?  ' / 5 5 7 7 7 7 7 4 3 3 3??rc|jjS)zhOptional[str]: The bearer token that can be used in HTTP headers to make authenticated requests.)r+tokenr9s rr;z_SyncCredentialsAdapter.tokens &&rc|jjS)zOptional[datetime]: When the token expires and is no longer valid. If this is None, the token is assumed to never expire.)r+expiryr9s rr=z_SyncCredentialsAdapter.expirys ''rc|jjSr*)r+validr9s rr?z_SyncCredentialsAdapter.valids &&rc|jjSr*)r+expiredr9s rrAz_SyncCredentialsAdapter.expireds ((rcK|j|jr;tjtj|jj|j|_tj|jd{VdS)a^Refreshes the wrapped credentials, joining a refresh already in flight. The refresh is shielded from cancellation: a caller that is cancelled while waiting (e.g. because of a timeout) stops waiting, but the refresh completes so that the next caller joins it rather than starting a second, concurrent refresh. N) r-doner create_task to_threadr+refreshr4shieldr9s r_refresh_sharedz'_SyncCredentialsAdapter._refresh_shareds  (D,A,F,F,H,H ($+$7!$"3";T=OPP%%D !nT233333333333rNcBK|j||dS)N)r;)r+apply)r.headersr;s rrJz_SyncCredentialsAdapter.applys( u55555rc>K|d{VdSr*)rH)r.requests rrFz_SyncCredentialsAdapter.refreshs0""$$$$$$$$$$$rcK|jjs|d{Vtj|jj|j|||d{VdSr*)r+r?rHrrEbefore_requestr4)r.rMmethodurlrKs rrOz&_SyncCredentialsAdapter.before_requests & )&&(( ( ( ( ( ( ( (   ,                 rr*)__name__ __module__ __qualname____doc__googleauthr(r r/propertyr4r8r;r=r copy_docstringr?rArHrJrFrOrrr'r'ls  EFK$;$GEEEE++X+888''X' ((X( XV[4@AA''BAX'XV[4@AA))BAX) 4 4 4X[))666*)6X[))%%*)%X[))   *)    rr'ceZdZdZ ddeeejjjfde e j fdZ ddZ dde je je jfdeded e ed e eeefd ed eeefd e ede jfdZejedde je je jfded e ed e eeefd ed eeefd e ede jfdZejedde je je jfded e ed e eeefd ed eeefd e ede jfdZejedde je je jfded e ed e eeefd ed eeefd e ede jfdZejedde je je jfded e ed e eeefd ed eeefd e ede jfdZejedde je je jfded e ed e eeefd ed eeefd e ede jfdZedZ ddZ!dS)AsyncAuthorizedSessionakThis is an asynchronous implementation of :class:`google.auth.requests.AuthorizedSession` class. We utilize an instance of a class that implements :class:`google.auth.aio.transport.Request` configured by the caller or otherwise default to `google.auth.aio.transport.aiohttp.Request` if the external aiohttp package is installed. A Requests Session class with credentials. This class is used to perform asynchronous requests to API endpoints that require authorization:: import aiohttp from google.auth.aio.transport import sessions async with sessions.AsyncAuthorizedSession(credentials) as authed_session: response = await authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. Args: credentials (Union[google.auth.aio.credentials.Credentials, google.auth.credentials.Credentials]): The credentials to add to the request. Synchronous credentials (e.g. application default credentials) are also supported. auth_request (Optional[google.auth.aio.transport.Request]): An instance of a class that implements :class:`~google.auth.aio.transport.Request` used to make requests and refresh credentials. If not passed, an instance of :class:`~google.auth.aio.transport.aiohttp.Request` is created. Raises: - google.auth.exceptions.TransportError: If `auth_request` is `None` and the external package `aiohttp` is not installed. - google.auth.exceptions.InvalidType: If the provided credentials are not of type `google.auth.aio.credentials.Credentials` or `google.auth.credentials.Credentials`. Nr( auth_requestct|tjjjrt |}n:t|ts%t jdt|d||_ |}|strt}d|_ d|_ d|_d|_g|_|t jd||_d|_d|_d|_d|_d|_dS)Nz#The configured credentials of type zs are invalid and must be of type `google.auth.aio.credentials.Credentials` or `google.auth.credentials.Credentials`Fzv`auth_request` must either be configured or the external package `aiohttp` must be installed to use the default value.r) isinstancerVrWr(r r'r InvalidTypetyper+AIOHTTP_INSTALLEDAiohttpRequest_is_mtls_mtls_init_task _cached_cert_client_cert_callback_old_auth_requestsTransportError _auth_request_mtls_rotation_lock_mtls_check_counter_mtls_reconfig_counter _refresh_lock_refresh_counter)r.r(r]rjs rr/zAsyncAuthorizedSession.__init__s  k6;#:#F G G 1+>>KKK55 (}d;6G6G}}} *5$  -!2 -*,,M # %)";=  +I +;? #$ &'#59 !rcKj._fd}tj|_ jd{VS#t$r d_wxYw)aConfigure the client certificate and key for SSL connection. This method configures mTLS if client certificates are explicitly enabled (via GOOGLE_API_USE_CLIENT_CERTIFICATE=true) or auto-enabled (when the env variable is unset and workload certificates are discovered). In these cases, the underlying transport will be reconfigured to use mTLS. Note: This function does nothing if the `aiohttp` library is not installed. Important: Calling this method will close any ongoing API requests associated with the current session. To ensure a smooth transition, it is recommended to call this during session initialization. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. Nc Ktjtjjjjd{V}|sdS tj d{V\}}}|rotrKt j tr0tjtj ||d{V}tj|}tj|} j }t| _ j|t% jdkr jd} t'|dr0|} t+j| r| d{Vn#t.$rYnwxYw jdt% jdknd}t3jdt6| _|r | _dSd _dS#t.$r} t=j| } | | d} ~ wwxYw) N)ssl) connector)r6rr8Fa9Attempted to establish mTLS, but a custom async transport was provided. google-auth cannot automatically configure custom transports for mTLS. Falling back to standard TLS. If your custom transport is not manually configured for mTLS, you may encounter 401 Unauthorized errors when using Certificate-Bound Tokens.) r _run_in_executorrVrWr _mtls_helpercheck_use_client_certget_client_cert_and_keyrbr_rjrcmake_client_cert_ssl_contextaiohttp TCPConnector ClientSessionrhappendlenr7r8inspect isawaitable Exceptionpopwarningswarn UserWarningrdrfr MutualTLSChannelError)use_client_certis_mtlscertkey ssl_contextrs new_sessionold_auth_requestoldest_auth_requestres caught_excnew_excclient_cert_callbackr.s r _do_configurezDAsyncAuthorizedSession.configure_mtls_channel.._do_configure3s(,(=K)6L))######'F42 #:;OPPPPPPPP #,! .22!150E $ A411++++++K)0(<(M(M(MI*1*?)*T*T*TK/3/A,1? 1T1T1TD. 3::;KLLL"%d&=">">"B"B6:6Ma6P 3!)'./BG'L'L%6.A.G.G.I.I+2+>s+C+C)625IIIIIII'0!)!)!)$(D!) $ 7 ; ;A > > >#&d&=">">"B"B',G$M!B !, %,DM1,0))),0))) 222(>zJJG!z12sDC/G',AE-,G'- E:7G'9E::A"G'G'' H 1HH )rergrrD BaseException)r.rrs`` rconfigure_mtls_channelz-AsyncAuthorizedSession.configure_mtls_channels2   ')=D &< 2< 2< 2< 2< 2< 2|$+#6}}#G#GD  ------- -   #'D  s AArPrQdatarKmax_allowed_timer$total_attemptsreturnc 4K|dd} jrJjs1 tjjd{Vn#t $rYnwxYwt j|} |t|ni} tj } j j j t|4d{V} | jj|| d{Vd}t$&t'|t$r|j|jnd}n+t'|t*t,frt-|}| 23d{V}| j||| |fi|d{Vjt0jvrn>6 dddd{Vn#1d{VswxYwYjt4jkr;| dkr4 |Ttj | z }t9d||z }|dkr$t:jj dnd}|duo?t'|tBj"j#tBj"j$fptK|dfd }t|4d{V}||d{V}dddd{Vn#1d{VswxYwYnm#t tj&f$rTtKd rB '}tQj)|r|d{Vn#t $rYnwxYwwxYw||StKd rB '}tQj)|r|d{Vn#t $rYnwxYw|Qt9d|tj | z z }|dkr$t:jj d | d z|d<j*|f|||||d |d{VSS)a Args: method (str): The http method used to make the request. url (str): The URI to be requested. data (Optional[bytes]): The payload or body in HTTP request. headers (Optional[Mapping[str, str]]): Request headers. timeout (float, aiohttp.ClientTimeout): The amount of time in seconds to wait for the server response with each individual request. max_allowed_time (float): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. total_attempts (int): The total number of retry attempts. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timeout error will be raised after such request completes. Returns: google.auth.aio.transport.Response: The HTTP response. Raises: google.auth.exceptions.TimeoutError: If the method does not complete within the configured `max_allowed_time` or the request exceeds the configured `timeout`. google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel reconfiguration fails for any reason during certificate rotation. _auth_retry_countrN)rgrtz6Timeout exceeded before credential refresh could beginreadc Kd} jrftjjr t fdt D}|r jtj _ j4d{V j krn tj j jd{V\}}|||kr j} td j? js jd{Vn#t&$rYnwxYwd _ fdd{V xjdz c_nB#t&$r5}td|t/jd|d}~wwxYw | _n#| _wxYw|tdnptd nU#t.jt.jt4t6t8f$r%}td |Yd}~nd}~wwxYw xj dz c_ dddd{Vn#1d{VswxYwY jtj _ j4d{V j krt d n j!" j#d{V xjdz c_n#tH$r@t d |r j kr cYcdddd{VSYnet.j%tMt.d t&f$r9}t d| cYd}~cdddd{VSd}~wwxYwdddd{Vn#1d{VswxYwY r SdS)NFc3TK|]"}|kpd|zV#dS).N)endswith).0prefixhostnames r zNAsyncAuthorizedSession.request.._recover_auth_state..sY7"7")/%-$6%G'/'8'8v'F'F7"7"7"7"7"7"rz;Client certificate has changed, reconfiguring mTLS channel.c fSr*rZ)call_cert_bytescall_key_bytessrzMAsyncAuthorizedSession.request.._recover_auth_state..'s._recover_auth_statesk+0(=aF'-|'<'0B0H$1I0T4F3K5L5L594N1? 164;LL9C5656568<7K7W?C?S?X?X?Z?Z9E=EDHDXABABABABABABABABDM=E=E=E@D=EOS8L:>:U:U9:9:9:9:9:;6;656565656565656 594O4OST4T4O4O4O7@1=1=1=4;MM8`89565656;E:Z8\;6;6;<5= 1=5P9G594N4N8F594N565656564L3S4;LL9W56565656 5$9$9$93(;!8!8!8$+MM(Q%&%&%&-=%8+/+F+D,E,E08/"?"?"?"?"?"?"?"?"?"?"?"?"?"?(,E,E %/$;$+J8JI$V$V("!4!4!4%,MM(f()%&%&%&,4OOOOOA"?"?"?"?"?"?"?"?"?"?"?"?"?"?0!41"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?"?H(,#+O#tsI&*G.?I&:E DE D%"E$D%%9EF* F)0FFF*"I&* F33;I&.-IH;6I&;II&& I03I0#'O %L0O3N,4OO )N,3N'N,O'N,,O O O r8z,Timeout exceeded before retrying the requestr)rrKrr$r)+rrerCrrGrrAsyncExponentialBackoffdictrrrorlrmr%r+rOrjrr_totalintfloat status_coder DEFAULT_RETRYABLE_STATUS_CODES http_client UNAUTHORIZEDmaxrVrWr r collectionsabcIterator AsyncIterabler7CancelledErrorr8rrrM)r.rPrQrrKrr$rkwargsrretriesrequest_headers start_timer#actual_timeout_rremaining_timerauth_with_timeoutearly_return_responserrrrrr!s` ` @@@@@rrMzAsyncAuthorizedSession.requestysZ#JJ':A>>   (<(A(A(C(C  nT%9::::::::::    '>)   ,3+>$w---B^%% #'#8 !%!9$($?! !122       l,!00&_        %(N(Z-O-O(29-2KQTGc5\22 0!&w#       a!-&D&VT?NNT"" 'y/WWWEX#7                           0  ;#; ; ; 1$$n'3"&."2"2Z"?),S2BW2L)M)M)S00"(+"8"E"E X##1 *.#'t#3$" (_5{7TU1#400 !N$N$N$N$N$N$N$N$N$N$N$` -^<<@Q6G6G//1177111111-"7#9:x11!!"*.."2"2C&2377*&) (!!! D!)4008W--&nn..".s33&"%IIIIIII$#/%(-1A1AJ1NO&&N&,,$k4AAJ/@!.C*+)T\ #%3##1           sA!! A.-A.BF6$F"*9F66 GG%B````L!%/3"+"D/8/Q(1(Lccccuo c '#s(+, c  cum+,c! c  ccccJ Y_W!%/3"+"D/8/Q(1(L2 2 2 uo2 '#s(+, 2  2 um+, 2 ! 2   2 2 2 2 hY_W!%/3"+"D/8/Q(1(L2 2 2 uo2 '#s(+, 2  2 um+, 2 ! 2   2 2 2 2 hY_W!%/3"+"D/8/Q(1(L2 2 2 uo2 '#s(+, 2  2 um+, 2 ! 2   2 2 2 2 hY_W!%/3"+"D/8/Q(1(L2 2 2 uo2 '#s(+, 2  2 um+, 2 ! 2   2 2 2 2 hY_W!%/3"+"D/8/Q(1(L2 2 2 uo2 '#s(+, 2  2 um+, 2 ! 2   2 2 2 2 hX,,,,,,rr\)2rcollections.abcrr http.clientclientrrloggingr urllib.parserr contextlibrtypingrrrrgoogle.auth.credentialsrV"google.auth.transport._mtls_helper google.authrr r google.auth.aior google.auth.aio.credentialsr google.auth.aio.transportr google.auth.exceptionsrrzrrAttributeError getLoggerrRrr!google.auth.aio.transport.aiohttprrcrbr%r'r\rZrrrs!!!!!! ******::::::::::::))))BBBBBBBBBB%%%%%%333333******////// NNN%%%%%%%)))))))  (  ' H % %KKKKKK***Za a a a a ka a a Hv ,v ,v ,v ,v ,v ,v ,v ,v ,v ,s$1 A<< BB B))B32B3