
    jx)              	           d dl Z d dlZd dlmZmZmZmZmZ d dlm	Z	m
Z
mZmZmZ ddlmZ ddlmZ ddlmZ  e j(                  e      Zdee   d	eeeef      d
eeeef      fdZ G d d      Zy)    N)OptionalAnyMappingcastTuple)AccessTokenAccessTokenInfoTokenRequestOptionsTokenCredentialSupportsTokenInfo   )CredentialUnavailableError)EnvironmentVariables)log_get_token	client_ididentity_configreturnc                     rqh d}| r5t        fd|D              rt        ddj                  |             d| fS d }|D ]-  }|v s|rt        ddj                  |             ||   f}/ |S | rd| fS y )N>   r   	object_idresource_idc              3   &   K   | ]  }|v  
 y wN ).0keyr   s     m/root/aria/tools/markitdown-venv/lib/python3.12/site-packages/azure/identity/_credentials/managed_identity.py	<genexpr>z+validate_identity_config.<locals>.<genexpr>   s     @c3/)@s   zrWhen 'client_id' is provided as a keyword argument, 'identity_config' must not contain any of the following keys: z, r   zFidentity_config must not contain more than one of the following keys: )any
ValueErrorjoin)r   r   
valid_keysresultr   s    `   r   validate_identity_configr#      s     >
@Z@@ ''+yy'<&=?  	))  	3Co%$`99Z013  oc22	3 I%%    c                       e Zd ZdZddddee   deeeef      deddfdZdd	Z	d
eddfdZ
ddZeddddedee   dee   dedef
d       Zedddedee   defd       Zy)ManagedIdentityCredentialaK  Authenticates with an Azure managed identity in any hosting environment which supports managed identities.

    This credential defaults to using a system-assigned identity. To configure a user-assigned identity, use one of
    the keyword arguments. See `Microsoft Entra ID documentation
    <https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview>`__ for more
    information about configuring managed identity for applications.

    :keyword str client_id: a user-assigned identity's client ID or, when using Pod Identity, the client ID of a
       Microsoft Entra app registration. This argument is supported in all hosting environments.
    :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object
        or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to
        learn what values it expects.
    :paramtype identity_config: Mapping[str, str]

    .. admonition:: Example:

        .. literalinclude:: ../samples/credential_creation_code_snippets.py
            :start-after: [START create_managed_identity_credential]
            :end-before: [END create_managed_identity_credential]
            :language: python
            :dedent: 4
            :caption: Create a ManagedIdentityCredential.
    Nr   r   r   r   kwargsr   c                   t        ||      }d | _        |j                  dd      }|j                  dd       | _        d }t        j
                  j                  t        j                        rt        j
                  j                  t        j                        rat        j
                  j                  t        j                        rd}ddlm}  |d||d|| _        nd}dd	lm}  |d||d|| _        nt        j
                  j                  t        j                        rd
}ddlm}	  |	d||d|| _        nkt        j
                  j                  t        j$                        r_t        j
                  j                  t        j&                        rd}ddlm}
  |
d||d|| _        nd}ddlm}  |d||d|| _        nt1        d t        j2                  D              r|sddlm} |xs- t        j
                  j                  t        j8                        }|st;        d      d}d|f} |dt        j
                  t        j<                     |t        j
                  t        j>                     d|| _        n#d}ddl m!}  |d||| j                  d|| _        |rD| jD                  jF                   d| }|r|d|d    d|d    z  }tH        jK                  |       y y )N%_exclude_workload_identity_credentialF_enable_imds_probezService Fabric managed identity   )ServiceFabricCredentialr'   zApp Service managed identity)AppServiceCredentialzAzure Arc managed identity)AzureArcCredentialzAzure ML managed identity)AzureMLCredentialzCloud Shell managed identity)CloudShellCredentialc              3   Z   K   | ]#  }t         j                  j                  |       % y wr   )osenvironget)r   vars     r   r   z5ManagedIdentityCredential.__init__.<locals>.<genexpr>s   s     [

s#[s   )+)WorkloadIdentityCredentialzWorkload identity was selected but no client ID was provided. Configure the environment with a client ID or pass a value for "client_id" argumentzworkload identityr   )	tenant_idr   token_file_pathIMDS)ImdsCredential)r   r   r+   z
 will use z with r   z: r   )&r#   _credentialpopr+   r3   r4   r5   r   IDENTITY_ENDPOINTIDENTITY_HEADERIDENTITY_SERVER_THUMBPRINTservice_fabricr-   app_servicer.   IMDS_ENDPOINT	azure_arcr/   MSI_ENDPOINT
MSI_SECRETazure_mlr0   cloud_shellr1   allWORKLOAD_IDENTITY_VARSworkload_identityr7   AZURE_CLIENT_IDr   AZURE_TENANT_IDAZURE_FEDERATED_TOKEN_FILEimdsr;   	__class____name___LOGGERinfo)selfr   r   r(   user_identity_infoexclude_workload_identitymanaged_identity_typer-   r.   r/   r0   r1   r7   workload_client_idr;   log_msgs                   r   __init__z"ManagedIdentityCredential.__init__I   s    6iQ8<$*JJ/VX]$^!"(**-A4"H $::>>.@@Azz~~2BBC::>>"6"Q"QR,M)G'> ("+_(PV(D$ -K)A'; ("+_(PV(D$  4 B BC(D%9#5#u	[j#unt#u ZZ^^0==>zz~~2==>(C%7#4#tyZi#tms#t (F%=#7#w)]l#wpv#w [/C/Z/Z[[-E!*!bbjjnn=Q=a=a.b% j 
 %8!"-/A!B9  **%9%I%IJ, "

+?+Z+Z [  	 D %+!,-  # /#'#:#:  	 D !001<Q;RSG!V$6q$9#:"=OPQ=R<STTLL!	 !r$   c                 R    | j                   r| j                   j                          | S r   )r<   	__enter__rT   s    r   r\   z#ManagedIdentityCredential.__enter__   s"    &&(r$   argsc                 P    | j                   r | j                   j                  |  y y r   )r<   __exit__)rT   r^   s     r   r`   z"ManagedIdentityCredential.__exit__   s&    %D%%t, r$   c                 $    | j                          y)z)Close the credential's transport session.N)r`   r]   s    r   closezManagedIdentityCredential.close   s    r$   claimsr8   scopesrd   r8   c                    | j                   st        d       t        t        | j                         j                  |||d|S )ac  Request an access token for `scopes`.

        This method is called automatically by Azure SDK clients.

        :param str scopes: desired scope for the access token. This credential allows only one scope per request.
            For more information about scopes, see
            https://learn.microsoft.com/entra/identity-platform/scopes-oidc.
        :keyword str claims: additional claims required in the token, such as those returned in a resource provider's
            claims challenge following an authorization failure.
        :keyword str tenant_id: not used by this credential; any value provided will be ignored.

        :return: An access token with the desired scopes.
        :rtype: ~azure.core.credentials.AccessToken
        :raises ~azure.identity.CredentialUnavailableError: managed identity isn't available in the hosting environment
        No managed identity endpoint found. 
The Target Azure platform could not be determined from environment variables. 
Visit https://aka.ms/azsdk/python/identity/managedidentitycredential/troubleshoot to troubleshoot this issue.messagerc   )r<   r   r   r   	get_token)rT   rd   r8   re   r(   s        r   rj   z#ManagedIdentityCredential.get_token   sN    ( ,+  AtOT%5%56@@&QWclwpvwwr$   )optionsrk   c                    | j                   st        d       t        t        | j                         j                  |d|iS )a  Request an access token for `scopes`.

        This is an alternative to `get_token` to enable certain scenarios that require additional properties
        on the token. This method is called automatically by Azure SDK clients.

        :param str scopes: desired scope for the access token. This credential allows only one scope per request.
            For more information about scopes, see https://learn.microsoft.com/entra/identity-platform/scopes-oidc.
        :keyword options: A dictionary of options for the token request. Unknown options will be ignored. Optional.
        :paramtype options: ~azure.core.credentials.TokenRequestOptions

        :rtype: ~azure.core.credentials.AccessTokenInfo
        :return: An AccessTokenInfo instance containing information about the token.
        :raises ~azure.identity.CredentialUnavailableError: managed identity isn't available in the hosting environment.
        rg   rh   rk   )r<   r   r   r   get_token_info)rT   rk   re   s      r   rm   z(ManagedIdentityCredential.get_token_info   sI      ,+  Ht%t'7'78GGaY`aar$   )r   r&   )r   N)rQ   
__module____qualname____doc__r   strr   r   rZ   r\   r`   rb   r   r   rj   r
   r	   rm   r   r$   r   r&   r&   0   s    2 -1aeN"$SMN"CKGTWY\T\L]C^N"qtN"	N"`
-c -d - 48UYxx$,SMxEMc]xehx	x x8 TX bc bH=P4Q b]l b br$   r&   )loggingr3   typingr   r   r   r   r   azure.core.credentialsr   r	   r
   r   r    r   
_constantsr   _internal.decoratorsr   	getLoggerrQ   rR   rq   r#   r&   r   r$   r   <module>ry      s   
  	 6 6 x x ) - 0 '

H
%}/7S8I/JeCHo<jb jbr$   