vj]dZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z ddl m Z e rddlZddlZej"eZej(dZej(dZej(d Zej(dZd ZGd d e ZGd deZGddej:ZGddeZdZ dZ!GddeZ"de#fdZ$de#de#fdZ%de#de#fdZ&de#de#de#fdZ'y)z2Utilities for Regional Access Boundary management.N) NamedTupleOptional TYPE_CHECKING)_helpers)hours)minuteszx-allowed-locationsceZdZUdZeeed<eejed<eejed<ejed<y)_RegionalAccessBoundaryDataaData container for a Regional Access Boundary snapshot. Attributes: encoded_locations (Optional[str]): The encoded Regional Access Boundary string. expiry (Optional[datetime.datetime]): The hard expiration time of the boundary data. cooldown_expiry (Optional[datetime.datetime]): The time until which further lookups are skipped. cooldown_duration (datetime.timedelta): The current duration for the exponential cooldown. encoded_locationsexpirycooldown_expirycooldown_durationN) __name__ __module__ __qualname____doc__rstr__annotations__datetime timedelta^/var/www/html/venv/lib/python3.12/site-packages/google/auth/_regional_access_boundary_utils.pyr r 5sA }$ X&& ''h//00)))rr c`eZdZdZdZdZdZdZdZddZ d Z d Z d Z d Z d ZdZdZy)_RegionalAccessBoundaryManagerzManages the Regional Access Boundary state and its background refresh. The actual data is held in an immutable `_RegionalAccessBoundaryData` object and is swapped atomically to ensure thread-safe, lock-free reads. ctdddt|_t|_t j |_d|_y)NrrrrF) r )DEFAULT_REGIONAL_ACCESS_BOUNDARY_COOLDOWN_data%_RegionalAccessBoundaryRefreshManagerrefresh_manager threadingLock _update_lock-_use_blocking_regional_access_boundary_lookupselfs r__init__z'_RegionalAccessBoundaryManager.__init__Ls?0" G   EF%NN,=B:rcD|jj}d|d<|S)z9Pickle helper that serializes the _update_lock attribute.Nr'__dict__copyr*states r __getstate__z+_RegionalAccessBoundaryManager.__getstate__Ws# ""$ $n rcl|jj|tj|_y)z;Pickle helper that deserializes the _update_lock attribute.N)r.updater%r&r'r0s r __setstate__z+_RegionalAccessBoundaryManager.__setstate__]s# U#%NN,rct|tstS|j|jk(xr|j|jk(S)z!Checks if two managers are equal.) isinstancerNotImplementedr"r()r*others r__eq__z%_RegionalAccessBoundaryManager.__eq__bsF%!?@! ! JJ%++ % CBBBBC rcd|_y)zEnables blocking Regional Access Boundary lookup. When enabled, the Regional Access Boundary lookup will be performed synchronously in the calling thread instead of asynchronously in a background thread. TN)r(r)s renable_blocking_lookupz5_RegionalAccessBoundaryManager.enable_blocking_lookupls >B:rNc<|sd}t||dt|_y)aSManually sets the regional access boundary to the client provided initial values. Args: encoded_locations (Optional[str]): The encoded locations string. expiry (Optional[datetime.datetime]): The expiry time for the boundary. If encoded_locations is not provided, expiry is ignored. Nr )r r!r")r*rrs r$set_initial_regional_access_boundaryzC_RegionalAccessBoundaryManager.set_initial_regional_access_boundaryus$!F0/ G   rc|j}|jrA|j5tj|jkr|j|t <y|j t dy)a\Applies the Regional Access Boundary header to the provided dictionary. If the boundary is valid, the 'x-allowed-locations' header is added or updated. Otherwise, the header is removed to ensure no stale data is sent. Args: headers (MutableMapping[str, str]): The headers dictionary to update. N)r"rrrutcnow _REGIONAL_ACCESS_BOUNDARY_HEADERpop)r*headersrab_datas r apply_headersz,_RegionalAccessBoundaryManager.apply_headerssR::  % % OO 'HOO,=,O8@8R8RG4 5 KK8$ ?rc|j}|jr5|jr)tj|jt z kry|j r"tj|j kryy)zChecks if the Regional Access Boundary data needs a refresh and is not in cooldown. Returns: bool: True if a refresh is required, False otherwise. FT)r"rrrr@*REGIONAL_ACCESS_BOUNDARY_REFRESH_THRESHOLDr)r*rDs r_should_refreshz._RegionalAccessBoundaryManager._should_refreshsf ::  & &!!KKM  # #(9HrErHrOrRrJrQr]rrrrrEsP C -  B $@&.K K "RHR<6&rrc6eZdZdZ dfd ZdZxZS)$_RegionalAccessBoundaryRefreshThreadzAThread for background refreshing of the Regional Access Boundary.cZt|d|_||_||_||_y)NT)superr+daemon _credentials_request _rab_manager)r*rMrN rab_manager __class__s rr+z-_RegionalAccessBoundaryRefreshThread.__init__Os.  ' 'rc |jj|j}|j j|y#t$r$}tj d|dd}Yd}~Dd}~wwxYw)a Performs the Regional Access Boundary lookup and updates the state. This method is run in a separate thread. It delegates the actual lookup to the credentials object's `_lookup_regional_access_boundary` method. Based on the lookup's outcome (success or complete failure after retries), it updates the cached Regional Access Boundary information, its expiry, its cooldown expiry, and its exponential cooldown duration. DAsynchronous Regional Access Boundary lookup raised an exception: %sTrVN)rurZrvr^r[r\rwr])r*r`ras rrunz(_RegionalAccessBoundaryRefreshThread.run[sq 1!!BB4==Q * ?? )  1 MMV   -1 )  1s%A A0 A++A0)rMz=google.auth.credentials.CredentialsWithRegionalAccessBoundaryrNzgoogle.auth.transport.Requestrxr)rrrrr+r| __classcell__)rys@rrqrqLs,K (T (1 (6 ( rrqc(eZdZdZdZdZdZdZy)r#zKManages a thread for background refreshing of the Regional Access Boundary.cDtj|_d|_yN)r%r&_lock_workerr)s rr+z._RegionalAccessBoundaryRefreshManager.__init__|s^^%  rcN|jj}d|d<d|d<|S)z?Pickle helper that serializes the _lock and _worker attributes.Nrrr-r0s rr2z2_RegionalAccessBoundaryRefreshManager.__getstate__s, ""$gi rcz|jj|tj|_d|_y)zAPickle helper that deserializes the _lock and _worker attributes.N)r.r4r%r&rrr0s rr5z2_RegionalAccessBoundaryRefreshManager.__setstate__s) U#^^%  rc|j5|jr$|jjr dddy tj|}t||||_|jjdddy#t $r(}t jd|Yd}~dddyd}~wwxYw#1swYyxYw)a Starts a background thread to refresh the Regional Access Boundary if one is not already running. Args: credentials (CredentialsWithRegionalAccessBoundary): The credentials to refresh. request (google.auth.transport.Request): The object used to make HTTP requests. rab_manager (_RegionalAccessBoundaryManager): The manager container to update. NzCould not deepcopy transport for background RAB refresh. Skipping background refresh to avoid thread safety issues. Exception: %s) rris_aliver/deepcopyr^r[r\rqstart)r*rMrNrxcopied_requestras rrKz3_RegionalAccessBoundaryRefreshManager.start_refreshsZZ !|| 5 5 7 ! ! !%w!7@^[DL LL   ' ! !  $   ! !  ! !s4(B=B ,B= B:B5(B=5B::B==CNrrrrr+r2r5rKrrrr#r#ysU !rr#ct|tj}|r |jn|}t |ds||dfS|j }||u}|r.tj|g|j i|j}n|}|||fS)akUnwraps a request callable, clones the transport, and returns the new callable. Args: request: The original request callable (e.g. functools.partial or raw Request). Returns: Tuple[Callable, Any, bool]: A tuple containing the new lookup callable, the underlying request object, and a boolean indicating if it was cloned. _cloneF)r7 functoolspartialfunchasattrrargskeywords)rN is_partial base_callablecloned_callable is_cloned new_requests r_prepare_async_lookup_callablersGY%6%67J$.GLLGM =( + u,,#**,O}4I''  %ll .5.>.> &  22rcK|r t|dsyd} |j}tj|x}r |d{yy7#t$r)}|rdnd}t j d||dYd}~yd}~wwxYww) zSafely closes the underlying cloned request transport, if applicable. Args: lookup_request (Any): The request object/transport to close. is_cloned (bool): Whether the request was actually cloned. closeNFz asynchronous  z5Failed to cleanly close cloned%srequest transport: %sTrV)rrrX isawaitabler^r[r\)lookup_requestris_async maybe_corora adapter_types r_close_cloned_requestrs GNG<H  #))+ **:6 68 6   7   +3'  C      s@A?,A AA A?A A<A72A?7A<<A?c(eZdZdZdZdZdZdZy)*_AsyncRegionalAccessBoundaryRefreshManagerzXManages a task for background refreshing of the Regional Access Boundary in async flows.cDtj|_d|_yr)r%r&r _worker_taskr)s rr+z3_AsyncRegionalAccessBoundaryRefreshManager.__init__s^^%  rcN|jj}d|d<d|d<|S)zbPickle helper that excludes the un-picklable _lock and _worker_task attributes from serialization.Nrrr-r0s rr2z7_AsyncRegionalAccessBoundaryRefreshManager.__getstate__s, ""$g $n rcz|jj|tj|_d|_y)z[Pickle helper that restores state and re-initializes the _lock and _worker_task attributes.N)r.r4r%r&rrr0s rr5z7_AsyncRegionalAccessBoundaryRefreshManager.__setstate__s* U#^^%  rc |j5|jr$|jjs dddy t|\  fd}|} tj||_ dddy#t$r;}t j d|djdYd}~dddyd}~wwxYw#t$ra|j tjjt n#t$rYnwxYwjdwxYw#1swYyxYw)a Starts a background task to refresh the Regional Access Boundary if one is not already running. Args: credentials (CredentialsWithRegionalAccessBoundary): The credentials to refresh. request (google.auth.aio.transport.Request): The object used to make HTTP requests. rab_manager (_RegionalAccessBoundaryManager): The manager container to update. NzMSynchronous cloning of request for Regional Access Boundary lookup failed: %sTrVc(K jd{}t d{j |y7*#t$r$}tjd|dd}Yd}~Pd}~wwxYw7H#t d{7wxYww)Nr{TrV)rZr^r[r\rr])r`rarMrlookup_callablerrxs rrzI_AsyncRegionalAccessBoundaryRefreshManager.start_refresh.._workersK)JJ+20 JJJAA1!9MM^!%" 591 9K/ JJJseBAAABA6BA A3A.)A8.A33A86B8BB  BB)rrdonerr^r[r\r]asyncio create_taskrget_running_loopr RuntimeError) r*rMrNrxrarcororrrs ` ` @@@rrKz8_AsyncRegionalAccessBoundaryRefreshManager.start_refreshsEZZ6   ):):)?)?)A6 6   37; #"  *9D $+$7$7$=!W6 6   c! AA$G%6 6  B  ,,.::-niH$AA$G Y6 6 sk(D<BD<$C C )C:D<C  D<D9)-DD9 D# D9"D##D99D<<ENrrrrrrsb!! Arrreturncddlm}t|dr#|jrdtj Sdtj S)zDynamically determines the domain for IAM credentials based on active mTLS configuration. Returns: str: The dynamic domain string. r _mtls_helpercheck_use_client_certziamcredentials.mtls.ziamcredentials.)google.auth.transportrrrrDEFAULT_UNIVERSE_DOMAINrs r _get_domainr<sH 3  56  . . 0%h&F&F%GHH !A!A BCCrservice_account_emailc$dtd|dS)zBuilds the Regional Access Boundary lookup URL for service accounts. Args: service_account_email: The service account email. Returns: str: The complete lookup URL. https://z/v1/projects/-/serviceAccounts//allowedLocationsr)rs r get_service_account_rab_endpointrMskm_$CDYCZZk llrpool_idc$dtd|dS)zBuilds the Regional Access Boundary lookup URL for workforce pools. Args: pool_id: The workforce pool ID. Returns: str: The complete lookup URL. rz$/v1/locations/global/workforcePools/rr)rs rget_workforce_pool_rab_endpointrYskm_$H Qb ccrproject_numberc*dtd|d|dS)zBuilds the Regional Access Boundary lookup URL for workload identity pools. Args: project_number: The Google Cloud project number. pool_id: The workload identity pool ID. Returns: str: The complete lookup URL. rz /v1/projects/z(/locations/global/workloadIdentityPools/rr)rrs r'get_workload_identity_pool_rab_endpointres0km_M.1AAijqirsD EEr)(rrr/rrrXloggingr%typingrrr google.authrgoogle.auth.credentialsgoogler getLoggerrr[rrgrGr!rirAr objectrThreadrqr#rrrrrrrrrrrrsM9 66 " '  H %(:x'9'9'B$.@X-?-?a-H*-?H,>,>r,J));(:(:(C%$9  ** * D&VD&N* 9+;+;* Z2!F2!j3: 2UUpDSD" mC mC m dS dS d EC E# ERU Er