G)f6dZddlmZddlZddlmZmZmZmZddl m Z m Z m Z ddl m Z ddlmZmZdd lmZmZmZmZmZmZmZmZdd lmZerdd lmZGd d Zy)z5Implementing support for MySQL Authentication Plugins) annotationsN) TYPE_CHECKINGAnyDictOptional)InterfaceErrorNotSupportedError get_exception)logger)MySQLAuthPluginget_auth_plugin)AUTH_SWITCH_STATUSDEFAULT_CHARSET_IDDEFAULT_MAX_ALLOWED_PACKET ERR_STATUSEXCHANGE_FURTHER_STATUS MFA_STATUS OK_STATUS MySQLProtocol) HandShakeType) MySQLSocketc eZdZdZddZeddZeddZede f ddZ d ddZ dd Z dd Z d d d d dede dddd f dd Zy)MySQLAuthenticatorz$Implements the authentication phase.cXd|_i|_i|_d|_d|_d|_y)z Constructor.FN) _username _passwords_plugin_config _ssl_enabled_auth_strategy_auth_plugin_classselfs [/var/www/html/flask-app/venv/lib/python3.12/site-packages/mysql/connector/authentication.py__init__zMySQLAuthenticator.__init__:s0 *,.0"'9=15c|jS)z&Signals whether or not SSL is enabled.)r r#s r% ssl_enabledzMySQLAuthenticator.ssl_enabledCs   r'c|jS)aCustom arguments that are being provided to the authentication plugin when called. The parameters defined here will override the ones defined in the auth plugin itself. The plugin config is a read-only property - the plugin configuration provided when invoking `authenticate()` is recorded and can be queried by accessing this property. Returns: dict: The latest plugin configuration provided when invoking `authenticate()`. )rr#s r% plugin_configz MySQLAuthenticator.plugin_configHs"""r'rc |i}tj|||}|j|tjd|j |j d|j d|j d|j dd|j dd|j d |j d  }tjd |j||tjd d|_|S)aSets up an SSL communication channel. Args: sock: Pointer to the socket connection. host: Server host name. ssl_options: SSL and TLS connection options (see `network.MySQLSocket.build_ssl_context`). charset: Client charset (see [1]), only the lower 8-bits. client_flags: Integer representing client capabilities flags. max_allowed_packet: Maximum packet size. Returns: ssl_request_payload: Payload used to carry out SSL authentication. References: [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/ page_protocol_basic_character_set.html#a_protocol_character_set )charset client_flagsmax_allowed_packetzBuilding SSL contextcacertkey verify_certFverify_identity tls_versionstls_ciphersuites)ssl_cassl_certssl_keyssl_verify_certssl_verify_identityr5tls_cipher_suiteszSwitching to SSLzSSL has been enabledT) r make_auth_sslsendr debugbuild_ssl_contextget switch_to_sslr ) r$sockhost ssl_optionsr-r.r/ssl_request_payload ssl_contexts r% setup_sslzMySQLAuthenticator.setup_sslYs6  K,99%1  %& +,,,??4( __V,OOE*'OOM5A +0A5 I$8)oo.@A-   '( ;- +, ""r'Nc| |j}| |j}tjd|t ||||j j |d|j|_y)aSwitches the authorization plugin. Args: new_strategy_name: New authorization plugin name to switch to. strategy_class: New authorization plugin class to switch to (has higher precedence than the authorization plugin name). username: Username to be used - if not defined, the username provided when `authentication()` was invoked is used. password_factor: Up to three levels of authentication (MFA) are allowed, hence you can choose the password corresponding to the 1st, 2nd, or 3rd factor - 1st is the default. NzSwitching to strategy %s) plugin_nameauth_plugin_classr)r)) rr"r r?rrrAr)r!)r$new_strategy_namestrategy_classusernamepassword_factors r%_switch_auth_strategyz(MySQLAuthenticator._switch_auth_strategysq&  ~~H  !!44N /1BC o)^   OO   4((  r'cd}|dtk(r-||jvr tdtj|\}}|j ||t jd||jj|jj||fi|j}|dtk(r=tj|}|jj||fi|j}|dtk(rt jd|S|dt k(r t#||dz }|dtk(r-t j$dy ) a Handles MFA (Multi-Factor Authentication) response. Up to three levels of authentication (MFA) are allowed. Args: sock: Pointer to the socket connection. pkt: MFA response. Returns: ok_packet: If last server's response is an OK packet. None: If last server's response isn't an OK packet and no ERROR was raised. Raises: InterfaceError: If got an invalid N factor. errors.ErrorTypes: If got an ERROR response. z5Failed Multi Factor Authentication (invalid N factor))rOzMFA %i factor %szMFA completed succesfullyrz"MFA terminated with a no ok packetN)rrr rparse_auth_next_factorrPr r?r!nameauth_switch_responserrparse_auth_more_dataauth_more_responserrr warning)r$rCpktn_factorrL auth_datas r% _mfa_n_factorz MySQLAuthenticator._mfa_n_factorsP*!f "t.$K,9+O+OPS+T ( y  & &'8( & S LL+Xt7J7J7O7O P:$%%::i#'#6#6C1v00)>>sC   q6' ' LLF G+8+R+RSV+W ( y  & &'8 9:$%%::i#'#6#6C q6, , LL5 6%::3?I8$%%88i#'#6#6C q6Y  LL3T5H5H5M5M NJ q6Z  LL? @ LL*D,?,?,D,D E%%dC0 0 q6Z $ $r'rFc ||_|||d|_tj||_| |_t j|||||| | | | | ||j|j \}|_ |rdnd}|j|g|t|j}|j||}| tdd|S)aPerforms the authentication phase. During re-authentication you must set `is_change_user_request` to True. Args: sock: Pointer to the socket connection. handshake: Initial handshake. username: Account's username. password1: Account's password factor 1. password2: Account's password factor 2. password3: Account's password factor 3. database: Initial database name for the connection. charset: Client charset (see [1]), only the lower 8-bits. client_flags: Integer representing client capabilities flags. max_allowed_packet: Maximum packet size. auth_plugin: Authorization plugin name. auth_plugin_class: Authorization plugin class (has higher precedence than the authorization plugin name). conn_attrs: Connection attributes. is_change_user_request: Whether is a `change user request` operation or not. plugin_config: Custom configuration to be passed to the auth plugin when invoked. The parameters defined here will override the ones defined in the auth plugin itself. Returns: ok_packet: OK packet. Raises: InterfaceError: If OK packet is NULL. References: [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/ page_protocol_basic_character_set.html#a_protocol_character_set )rrR) handshakerNpassworddatabaser-r.r/ auth_pluginrK conn_attrsis_change_user_requestr)r+)rr)NNNzGot a NULL ok_pkt)rrcopydeepcopyrr"r make_authr)r+r!r>bytesrecvrbr )r$rCrerN password1 password2 password3rgr-r.r/rhrKrirjr+response_payload send_argsrZok_pkts r% authenticatezMySQLAuthenticator.authenticate!sj"'I)D"mmM:"31>0G0G%1#/!#9((,,1 -$-"5F,  "/Y/DIIK --dC8 > !454 ? r')returnNone)rwbool)rwzDict[str, Any])rCrrDstrrEzOptional[Dict[str, Any]]r-intr.r{r/r{rwrn)NNr) rLrzrM Optional[str]rNr|rOr{rwrx)rCrrZrnrwzOptional[bytes]) rCrrerrNrzrprzrqrzrrrzrgr|r-r{r.r{r/r{rhr|rKr|rizOptional[Dict[str, str]]rjryr+rrwrn)__name__ __module__ __qualname____doc__r&propertyr)r+rrrHrPr]rbrvr'r%rr7s.6!!##**"<7#7#7#. 7#  7#  7# 7# 7#x)-"&    &        D444  4l555  5v"&)"<%)+//3',VV!V V  V  VV VVV V#V)V-V!%V !V" #Vr'r)r __future__rrktypingrrrrerrorsr r r r pluginsr rprotocolrrrrrrrrtypesrnetworkrrrr'r%rsH:<" 55DD5   !$@@r'