
    Pqh3                        d Z ddlZddlZddlZddlZddlZddlZddlZddlZdZ	 ej                         Z ej                  d        dZdZd Zd Zd&d	Zd
dedfdZd Zd Zd Zd'dZd Zd ZdZddedZdgZd Zd ZdZ ej@                  edd      Z!de ejD                  e!jG                  d            jI                  d      jK                  d       dZ&d! Z'd" Z(d# Z)d$ Z*e+d%k(  r e*        yy)(a  MSAL Python Tester

Usage 1: Run it on the fly.
    python -m msal
    Note: We choose to not define a console script to avoid name conflict.

Usage 2: Build an all-in-one executable file for bug bash.
    shiv -e msal.__main__._main -o msaltest-on-os-name.pyz .
    Nzmsal_cache.binc                      t         j                  r1t        t        d      j	                  t         j                               S d S )Nw)global_cachehas_state_changedopen_token_cache_filenamewrite	serialize     N/srv/www/ollama/chat-ollama/venv/lib/python3.12/site-packages/msal/__main__.py<lambda>r      s=     %% 		$**<+A+A+CD  ,0 r   z$04b07795-8ddb-461a-bbee-02f9e1bf7b46z$04f0c124-f2bc-4f59-8241-bf6df9866bbdc                 F    t        t        j                  | dd             y )N   T)indent	sort_keys)printjsondumps)blobs    r   
print_jsonr      s    	$**T!t
45r   c                 :    t        dj                  |             dvS )Nz9{} (N/n/F/f or empty means False, otherwise it is True): )NnFf )inputformat)messages    r   _input_booleanr!      s%    CJJ7S
)* *r   c                 \    t        | j                  |            j                         xs |S )N)default)r   r   strip)r    r#   s     r   _inputr%   "   s&    01779DWDr   zYour options:z    Your choice? Fc           	      R   | sJ d       |rt        |       t        | d      D ]&  \  }}t        dj                  | ||                   ( |rt        d       	 t        |      }	 t	        |      }d|cxk  rt        |       k  rn n| |dz
     S 7# t        $ r |r|r|cY S Y w xY w)Nzoptions must not be empty   )startz
    {}: {}z'    Or you can just type in your input.)r   	enumerater   r   intlen
ValueError)	optionsheaderfooteroption_rendereraccept_nonempty_stringioraw_datachoices	            r   _select_optionsr6   %   s     ///7f'+ :1l!!!_Q%789:78
=	 ]FF*c'l*vz**   	 2	 s   ')B B&%B&c                  `    t        g ddd      j                         } d| v rt        d      | S )N)z$https://graph.microsoft.com/.defaultz%https://management.azure.com/.defaultz	User.ReadzUser.ReadBasic.Allz_Select a scope (multiple scopes can only be input by manually typing them, delimited by space):Tr.   r1   4https://pas.windows.net/CheckMyAccess/Linux/.defaultz9SSH Cert scope shall be tested by its dedicated functions)r6   splitr,   scopess    r   _input_scopesr=   :   sA     
 q#
 %'  >GTUUMr   c                 \    | j                         }|rt        |d d      S t        d       y )Nc                 2    dj                  | d   | d         S )Nz{}, came from {}usernameaccount_source)r   as    r   r   z!_select_account.<locals>.<lambda>M   s    &8&?&?*qQaOb&c r   z0Account(s) already signed in inside MSAL Python:r0   r.   zRNo account available inside MSAL Python. Use other methods to acquire token first.)get_accountsr6   r   )appaccountss     r   _select_accountrH   H   s4    !HcE 	 	bcr   c           	      |    t        |       }|r/t        | j                  t               |t	        d                   yy)zIacquire_token_silent() - with an account already signed into MSAL Python.!Bypass MSAL Python's token cache?)accountforce_refreshN)rH   r   acquire_token_silent_with_errorr=   r!   rF   rK   s     r   _acquire_token_silentrO   S   s?    c"G366O()LM 7  	 r   c           
         |xs
 t               }t        dddddddddgd d	
      d   }|dk(  rd}nHt        dg| j                         D cg c]  }|d   	 c}z   dd      }t        |t              r|d   n|}| j                  || j                  | j                  t        t        fv d|||xs i       }|r@d|v r<|j                  di       j                  d      }||k7  rt        j                  d|       t        |       |S c c}w )zUacquire_token_interactive() - User will be prompted if app opts to do select_account.NzRUnspecified. Proceed silently with a default account (if any), fallback to prompt.)valuedescriptionnonezEnone. Proceed silently with a default account (if any), or error out.select_accountz.select_account. Prompt with an account picker.c                     | d   S )NrR   r   r3   s    r   r   z,_acquire_token_interactive.<locals>.<lambda>e   s    !M"2 r   zPrompt behavior?rD   rQ   r@   zlogin_hint? (If you have multiple signed-in sessions in browser/broker, and you specify a login_hint to match one of them, you will bypass the account picker.)Tr8   i  )parent_window_handleenable_msa_passthroughportprompt
login_hintdataid_token_claimspreferred_usernamez-Signed-in user "%s" does not match login_hint)r=   r6   rE   
isinstancedictacquire_token_interactiveCONSOLE_WINDOW_HANDLE	client_id
_AZURE_CLI_VISUAL_STUDIOgetloggingwarningr   )	rF   r<   r\   rZ   r[   rC   raw_login_hintresultsigned_in_users	            r   _acquire_token_interactiverl   ]   sB   &}F'{|)pq"3cd

 3!# $+,F !!
(FS-=-=-?@a
m@@ u#'
 4>nd3S^J/Yg
** 66"}}1   *4:2 + 
F '61$5r:>>?STZ'OOK^\vM' As   D
c                     t        | j                  t        d      t        j                  d      t	                            y)zacquire_token_by_username_password() - See constraints here: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows#constraints-for-ropcz
username: z
password: r;   N)r   "acquire_token_by_username_passwordr%   getpassr=   )rF   s    r   #_acquire_token_by_username_passwordrp      s5    s55|gool;MO 6 U Vr   c                     | j                  t                     }t        |d          t        j                  j                          t        d       | j                  |      }t        |       y)zNacquire_token_by_device_flow() - Note that this one does not go through brokerr;   r    zNAfter you completed the step above, press ENTER in this console to continue...N)	initiate_device_flowr=   r   sysstdoutflushr   acquire_token_by_device_flowr   )rF   flowrj   s      r   _acquire_token_by_device_flowrx      sT    ##=?#;D	$y/JJ	
Z[--d3Fvr   aw  {"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}ssh-certkey1)
token_typekey_idreq_cnfr9   c                     t        |       }|r_| j                  t        |t        t	        d            }t        |       |r+|j                  d      dk7  rt        j                  d       yyyy)zFAcquire an SSH Cert silently- This typically only works with Azure CLIrJ   )r\   rL   r{   ry   zUnable to acquire an ssh-cert.N)	rH   acquire_token_silent_SSH_CERT_SCOPE_SSH_CERT_DATAr!   r   rf   rg   error)rF   rK   rj   s      r   _acquire_ssh_cert_silentlyr      sl    c"G))()LM	 *  	6fjj.*<MM:; =6 r   c                     t        | t        t              }|j                  d      dk7  rt	        j
                  d       yy)zLAcquire an SSH Cert interactively - This typically only works with Azure CLIr<   r\   r{   ry   zUnable to acquire an ssh-certN)rl   r   r   rf   rg   r   )rF   rj   s     r   _acquire_ssh_cert_interactiver      s3    'O.YFzz,:-56 .r   z+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-AAAAAAAAsw)kidxms_kslpopzutf-8=c                     dg}t        | |t              }t        |       |j                  d      dk7  rt	        j
                  d       yy)zLAcquire a POP token interactively - This typically only works with Azure CLIz-6256c85f-0aad-4d50-b960-e6e9b21efe35/.defaultr   r{   r   zUnable to acquire a pop tokenN)rl   	_POP_DATAr   rf   rg   r   )rF   	POP_SCOPErj   s      r   _acquire_pop_token_interactiver      sC    @AI'IINFvzz,5(56 )r   c                 |    t        |       }|r/| j                  |       t        dj                  |d                yy)zoremove_account() - Invalidate account and/or token(s) from cache, so that acquire_token_silent() would be resetz@Account "{}" and/or its token(s) are signed out from MSAL Pythonr@   N)rH   remove_accountr   r   rN   s     r   _remove_accountr      s=    c"G7#PWWX_`jXklm r   c                     | j                   rdnd}t        dj                  |             t        j                          y)Exitzjhttps://identitydivision.visualstudio.com/Engineering/_queries/query/79b3a352-a775-406f-87cd-a487c382a8ed/zXhttps://github.com/AzureAD/microsoft-authentication-library-for-python/issues/new/choosez2Bye. If you found a bug, please report it here: {}N)_enable_brokerr   r   rs   exit)rF   bug_links     r   _exitr      s:      	ub 
 

>
E
Eh
OPHHJr   c                     t        dj                  t        j                               t	        dddddj                  t
              dgd dd	
      } | d   dk(  rUt        j                  j                  t
              r2	 t        j                  t        t
        d      j                                t	        t        ddt        dddddgd dd
      }t!        d      }t!        d      }|r|rt!        d      nd	}t        j"                  t%        |t&              r|d   n|t	        g ddd      ||t              }|r$t)        j*                  t(        j,                         	 t	        t.        t0        t2        t4        t6        t8        t:        t<        t>        g	d d       }	  ||       F# t        $ r Y w xY w# t@        $ r }t)        jB                  d!|       Y d }~5d }~wtD        $ r t        d"       Y Nw xY w)#Nz4Welcome to the Msal Python {} Tester (Experimental)
emptyz<Start with an empty token cache. Suitable for one-off tests.)r5   descreusezReuse the previous token cache {} (if any) which was created during last test app exit. Useful for testing acquire_token_silent() repeatedlyc                     | d   S )Nr   r   rV   s    r   r   z_main.<locals>.<lambda>   
    !F) r   z1What token cache state do you want to begin with?F)r0   r.   r1   r5   rz+Azure CLI (Correctly configured for MSA-PT))rc   namez/Visual Studio (Correctly configured for MSA-PT)z$95de633a-083e-42f5-b444-a4295d8e9314zAWhiteboard Services (Non MSA-PT app. Accepts AAD & MSA accounts.)c                     | d   S )Nr   r   rB   s    r   r   z_main.<locals>.<lambda>   r   r   zGImpersonate this app (or you can type in the client_id of your own app)TzWEnable broker? It will error out later if your app has not registered some redirect URIzEnable MSAL Python's DEBUG log?zEnable PII in broker's log?rc   )z(https://login.microsoftonline.com/commonz/https://login.microsoftonline.com/organizationsz;https://login.microsoftonline.com/microsoft.onmicrosoft.comz:https://login.microsoftonline.com/msidlab4.onmicrosoft.comz+https://login.microsoftonline.com/consumerszKInput authority (Note that MSA-PT apps would NOT use the /common authority)r8   )	authorityenable_broker_on_windowsenable_pii_logtoken_cache)levelc                     | j                   S N)__doc__)r   s    r   r   z_main.<locals>.<lambda>  s
     r   zMSAL Python APIs:rD   zInvalid input: %sAborted)#r   r   msal__version__r6   r   ospathexistsr   deserializer   readIOErrorrd   re   r!   PublicClientApplicationr_   r`   rg   basicConfigDEBUGrO   rl   rp   rx   r   r   r   r   r   r,   r   KeyboardInterrupt)cache_choice
chosen_appenable_brokerenable_debug_logr   rF   funces           r   _mainr      s   	
A
H
HIYIY
Z["!V
 "KKQ6-L/	$
 ,B$&L  H(RWW^^<Q-R	$$T*?%E%J%J%LM ! *WX$._`<  GJ  	K"

 ,X#%J ##|}M%&GHFSXh^$ABnsN

&
&#-j$#?
;Z! # a#'	 "/% 
C  '--0
!&/)&)*
   3;N
P	I ?  		Z  	2MM-q11  	)	s0    1F* !F: *	F76F7:	G8GG87G8__main__r   )NN),r   base64ro   r   rg   rs   r   atexitr   r   SerializableTokenCacher   registerrd   re   r   r!   r%   strr6   r=   rH   rO   rl   rp   rx   _JWK1r   r   r   r   _POP_KEY_IDr   _RAW_REQ_CNFurlsafe_b64encodeencodedecoderstripr   r   r   r   r   __name__r   r   r   <module>r      s=   = < < <( *t**,  0  4
76*
E (0CUX$ *	d!FV
 	F *fOIJ<7 <tzz+$?@'v''(;(;G(DELLWU\\]`a	7nEN z	G r   