o
    i                     @   s  d dl Z d dlZd dlmZmZmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ d dlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ dZdZdddg deedd dddZG dd deZ de!dedefddZ"de
ddfdd Z#G d!d" d"eZ$dS )#    N)AnyOptionalDict)PipelineResponse)ClientAuthenticationErrorHttpResponseError)HttpRequest)AccessTokenInfo)RetryPolicy   )CredentialUnavailableError)EnvironmentVariables)within_credential_chain)ManagedIdentityClient)MsalManagedIdentityClientzhttp://169.254.169.254z/metadata/identity/oauth2/tokeng?<   )i    i  i  iX     )connection_timeoutZretry_backoff_factorZretry_backoff_maxZretry_on_status_codesZretry_statusretry_totalc                       sT   e Zd ZdZdeddf fddZdeeef deeef de	f fd	d
Z
  ZS )ImdsRetryPolicyaR  Custom retry policy for IMDS credential with extended retry duration for 410 responses.

    This policy ensures that specifically for 410 status codes, the total exponential backoff duration
    is at least 70 seconds to handle temporary IMDS endpoint unavailability.
    For other status codes, it uses the standard retry behavior.
    kwargsreturnNc                    s   d| _ t jdi | d S )Ng      @ )backoff_factor_for_410super__init__selfr   	__class__r   W/home/app/Keep/.python/lib/python3.10/site-packages/azure/identity/_credentials/imds.pyr   ,   s   zImdsRetryPolicy.__init__settingsresponsec                    s0   |j jdkr| j|d< n| j|d< t ||S )Nr   backoff)http_responsestatus_coder   backoff_factorr   is_retry)r   r"   r#   r   r   r!   r(   2   s   
zImdsRetryPolicy.is_retry)__name__
__module____qualname____doc__r   r   r   strr   boolr(   __classcell__r   r   r   r!   r   $   s    2r   scopeidentity_configr   c                 C   s:   t jtjtdt }td|t	d| dfi |dS )N/GETz
2018-02-01)zapi-versionresource)params)
osenvirongetr   !AZURE_POD_IDENTITY_AUTHORITY_HOSTIMDS_AUTHORITYstripIMDS_TOKEN_PATHr   dict)r0   r1   urlr   r   r!   _get_request:   s
    r?   exc                 C   s>   | j dkr| jrd| jv rd| j }t|d| dS dS dS )a  Special case handling for Docker Desktop.

    Docker Desktop proxies all HTTP traffic, and if the IMDS endpoint is unreachable, it
    responds with a 403 with a message that contains "unreachable".

    :param ~azure.core.exceptions.HttpResponseError ex: The exception raised by the request
    :raises ~azure.core.exceptions.CredentialUnavailableError: When the IMDS endpoint is unreachable
    i  Zunreachablez=ManagedIdentityCredential authentication unavailable. Error: messageN)r&   rB   r   )r@   error_messager   r   r!   _check_forbidden_responseB   s   
	rD   c                       sp   e Zd Zdeddf fddZdddZdd	 Zdd
dZdedede	f fddZ
ddedefddZ  ZS )ImdsCredentialr   r   Nc                    sV   | dd | _t jddtittfi | || _tj	t
jv r&d| _d S d | _d S )N_enable_imds_probeZretry_policy_classTr   )poprF   r   r   r   r=   PIPELINE_SETTINGS_configr   r9   r6   r7   _endpoint_availabler   r   r   r!   r   R   s   "

zImdsCredential.__init__c                 C   s   | j   | S N)_client	__enter__r   r   r   r!   rM   _   s   
zImdsCredential.__enter__c                 G   s   | j j|  d S rK   )rL   __exit__)r   argsr   r   r!   rO   c   s   zImdsCredential.__exit__c                 C   s   |    d S rK   )rO   rN   r   r   r!   closef   s   zImdsCredential.closescopesc              
      s  | j d ur| j nt }|rZ| jsZzttfi ttfi | j}|j	|ddd d| _W n+ t
yG } zt| d| _W Y d }~nd }~w tyY } zd}t||d }~ww zt j|i |}W |S  tyn     t
y } z%|jdkrd}|jr|d|j 7 }t|d	|t| t|j|jd
|d }~w tjjy } ztdd	|d }~w ty } zd}t||d }~ww )N   r   )r   r   TzYManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.i  zeManagedIdentityCredential authentication unavailable. No identity has been assigned to this resource.z Error: rA   )rB   r#   z5ManagedIdentityCredential authentication unavailable.)rF   r   r8   rJ   r   r?   r=   rH   rI   Zrequest_tokenr   rD   	Exceptionr   r   _request_tokenr&   rB   r   r#   jsondecoderJSONDecodeError)r   rR   r   Zdo_probeclientr@   rC   Z
token_infor   r   r!   rU   i   sN   




zImdsCredential._request_token descc                 C   s
   d| S )NzZManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint. r   )r   r[   r   r   r!   get_unavailable_message   s   
z&ImdsCredential.get_unavailable_message)r   rE   )r   N)rZ   )r)   r*   r+   r   r   rM   rO   rQ   r-   r	   rU   r\   r/   r   r   r   r!   rE   Q   s    

1rE   )%r6   rV   typingr   r   r   Zazure.core.pipeliner   Zazure.core.exceptionsr   r   Zazure.core.restr   Zazure.core.credentialsr	   Zazure.core.pipeline.policiesr
   rZ   r   
_constantsr   	_internalr   Z!_internal.managed_identity_clientr   Z&_internal.msal_managed_identity_clientr   r:   r<   listrangerH   r   r-   r?   rD   rE   r   r   r   r!   <module>   s4   