py2docfx 0.1.9.dev1886355__py3-none-any.whl → 0.1.9.dev1897554__py3-none-any.whl

py2docfx/venv/venv1/Lib/site-packages/azure/identity/_credentials/imds.py

@@ -0,0 +1,129 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import os
+import json
+from typing import Any, Optional, Dict
+
+from azure.core.exceptions import ClientAuthenticationError, HttpResponseError
+from azure.core.pipeline.transport import HttpRequest
+from azure.core.credentials import AccessTokenInfo
+
+from .. import CredentialUnavailableError
+from .._constants import EnvironmentVariables
+from .._internal import within_credential_chain
+from .._internal.managed_identity_client import ManagedIdentityClient
+from .._internal.msal_managed_identity_client import MsalManagedIdentityClient
+
+
+IMDS_AUTHORITY = "http://169.254.169.254"
+IMDS_TOKEN_PATH = "/metadata/identity/oauth2/token"
+
+PIPELINE_SETTINGS = {
+    "connection_timeout": 2,
+    # Five retries, with each retry sleeping for [0.0s, 1.6s, 3.2s, 6.4s, 12.8s] between attempts.
+    "retry_backoff_factor": 0.8,
+    "retry_backoff_max": 60,
+    "retry_on_status_codes": [404, 410, 429] + list(range(500, 600)),
+    "retry_status": 5,
+    "retry_total": 5,
+}
+
+
+def _get_request(scope: str, identity_config: Dict) -> HttpRequest:
+    url = (
+        os.environ.get(EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST, IMDS_AUTHORITY).strip("/")
+        + IMDS_TOKEN_PATH
+    )
+    request = HttpRequest("GET", url)
+    request.format_parameters(dict({"api-version": "2018-02-01", "resource": scope}, **identity_config))
+    return request
+
+
+def _check_forbidden_response(ex: HttpResponseError) -> None:
+    """Special case handling for Docker Desktop.
+
+    Docker Desktop proxies all HTTP traffic, and if the IMDS endpoint is unreachable, it
+    responds with a 403 with a message that contains "unreachable".
+
+    :param ~azure.core.exceptions.HttpResponseError ex: The exception raised by the request
+    :raises ~azure.core.exceptions.CredentialUnavailableError: When the IMDS endpoint is unreachable
+    """
+    if ex.status_code == 403:
+        if ex.message and "unreachable" in ex.message:
+            error_message = f"ManagedIdentityCredential authentication unavailable. Error: {ex.message}"
+            raise CredentialUnavailableError(message=error_message) from ex
+
+
+class ImdsCredential(MsalManagedIdentityClient):
+    def __init__(self, **kwargs: Any) -> None:
+        super(ImdsCredential, self).__init__(**kwargs)
+        self._config = kwargs
+
+        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:
+            self._endpoint_available: Optional[bool] = True
+        else:
+            self._endpoint_available = None
+
+    def __enter__(self) -> "ImdsCredential":
+        self._client.__enter__()
+        return self
+
+    def __exit__(self, *args):
+        self._client.__exit__(*args)
+
+    def close(self) -> None:
+        self.__exit__()
+
+    def _request_token(self, *scopes: str, **kwargs: Any) -> AccessTokenInfo:
+
+        if within_credential_chain.get() and not self._endpoint_available:
+            # If within a chain (e.g. DefaultAzureCredential), we do a quick check to see if the IMDS endpoint
+            # is available to avoid hanging for a long time if the endpoint isn't available.
+            try:
+                client = ManagedIdentityClient(_get_request, **dict(PIPELINE_SETTINGS, **self._config))
+                client.request_token(*scopes, connection_timeout=1, retry_total=0)
+                self._endpoint_available = True
+            except HttpResponseError as ex:
+                # IMDS responded
+                _check_forbidden_response(ex)
+                self._endpoint_available = True
+            except Exception as ex:  # pylint:disable=broad-except
+                error_message = (
+                    "ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint."
+                )
+                raise CredentialUnavailableError(error_message) from ex
+
+        try:
+            token_info = super()._request_token(*scopes)
+        except CredentialUnavailableError:
+            # Response is not json, skip the IMDS credential
+            raise
+        except HttpResponseError as ex:
+            # 400 in response to a token request indicates managed identity is disabled,
+            # or the identity with the specified client_id is not available
+            if ex.status_code == 400:
+                error_message = (
+                    "ManagedIdentityCredential authentication unavailable. "
+                    "No identity has been assigned to this resource."
+                )
+
+                if ex.message:
+                    error_message += f" Error: {ex.message}"
+
+                raise CredentialUnavailableError(message=error_message) from ex
+
+            _check_forbidden_response(ex)
+            # any other error is unexpected
+            raise ClientAuthenticationError(message=ex.message, response=ex.response) from ex
+        except json.decoder.JSONDecodeError as ex:
+            raise CredentialUnavailableError(message="ManagedIdentityCredential authentication unavailable.") from ex
+        except Exception as ex:  # pylint:disable=broad-except
+            # if anything else was raised, assume the endpoint is unavailable
+            error_message = "ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint."
+            raise CredentialUnavailableError(error_message) from ex
+        return token_info
+
+    def get_unavailable_message(self, desc: str = "") -> str:
+        return f"ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint. {desc}"

py2docfx/venv/venv1/Lib/site-packages/azure/identity/_credentials/managed_identity.py

@@ -0,0 +1,185 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import logging
+import os
+from typing import Optional, Any, Mapping, cast
+
+from azure.core.credentials import AccessToken, AccessTokenInfo, TokenRequestOptions, TokenCredential, SupportsTokenInfo
+from .. import CredentialUnavailableError
+from .._constants import EnvironmentVariables
+from .._internal.decorators import log_get_token
+
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def validate_identity_config(client_id: Optional[str], identity_config: Optional[Mapping[str, str]]) -> None:
+    if identity_config:
+        if client_id:
+            if any(key in identity_config for key in ("object_id", "resource_id", "client_id")):
+                raise ValueError(
+                    "identity_config must not contain 'object_id', 'resource_id', or 'client_id' when 'client_id' is "
+                    "provided as a keyword argument."
+                )
+        # Only one of these keys should be present if one is present.
+        valid_keys = {"object_id", "resource_id", "client_id"}
+        if len(identity_config.keys() & valid_keys) > 1:
+            raise ValueError(
+                f"identity_config must not contain more than one of the following keys: {', '.join(valid_keys)}"
+            )
+
+
+class ManagedIdentityCredential:
+    """Authenticates with an Azure managed identity in any hosting environment which supports managed identities.
+
+    This credential defaults to using a system-assigned identity. To configure a user-assigned identity, use one of
+    the keyword arguments. See `Microsoft Entra ID documentation
+    <https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview>`__ for more
+    information about configuring managed identity for applications.
+
+    :keyword str client_id: a user-assigned identity's client ID or, when using Pod Identity, the client ID of a
+       Microsoft Entra app registration. This argument is supported in all hosting environments.
+    :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object
+        or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to
+        learn what values it expects.
+    :paramtype identity_config: Mapping[str, str]
+
+    .. admonition:: Example:
+
+        .. literalinclude:: ../samples/credential_creation_code_snippets.py
+            :start-after: [START create_managed_identity_credential]
+            :end-before: [END create_managed_identity_credential]
+            :language: python
+            :dedent: 4
+            :caption: Create a ManagedIdentityCredential.
+    """
+
+    def __init__(
+        self, *, client_id: Optional[str] = None, identity_config: Optional[Mapping[str, str]] = None, **kwargs: Any
+    ) -> None:
+        validate_identity_config(client_id, identity_config)
+        self._credential: Optional[SupportsTokenInfo] = None
+        exclude_workload_identity = kwargs.pop("_exclude_workload_identity_credential", False)
+        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):
+            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):
+                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):
+                    _LOGGER.info("%s will use Service Fabric managed identity", self.__class__.__name__)
+                    from .service_fabric import ServiceFabricCredential
+
+                    self._credential = ServiceFabricCredential(
+                        client_id=client_id, identity_config=identity_config, **kwargs
+                    )
+                else:
+                    _LOGGER.info("%s will use App Service managed identity", self.__class__.__name__)
+                    from .app_service import AppServiceCredential
+
+                    self._credential = AppServiceCredential(
+                        client_id=client_id, identity_config=identity_config, **kwargs
+                    )
+            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):
+                _LOGGER.info("%s will use Azure Arc managed identity", self.__class__.__name__)
+                from .azure_arc import AzureArcCredential
+
+                self._credential = AzureArcCredential(client_id=client_id, identity_config=identity_config, **kwargs)
+        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):
+            if os.environ.get(EnvironmentVariables.MSI_SECRET):
+                _LOGGER.info("%s will use Azure ML managed identity", self.__class__.__name__)
+                from .azure_ml import AzureMLCredential
+
+                self._credential = AzureMLCredential(client_id=client_id, identity_config=identity_config, **kwargs)
+            else:
+                _LOGGER.info("%s will use Cloud Shell managed identity", self.__class__.__name__)
+                from .cloud_shell import CloudShellCredential
+
+                self._credential = CloudShellCredential(client_id=client_id, identity_config=identity_config, **kwargs)
+        elif (
+            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)
+            and not exclude_workload_identity
+        ):
+            _LOGGER.info("%s will use workload identity", self.__class__.__name__)
+            from .workload_identity import WorkloadIdentityCredential
+
+            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)
+            if not workload_client_id:
+                raise ValueError('Configure the environment with a client ID or pass a value for "client_id" argument')
+
+            self._credential = WorkloadIdentityCredential(
+                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],
+                client_id=workload_client_id,
+                file=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],
+                **kwargs,
+            )
+        else:
+            from .imds import ImdsCredential
+
+            _LOGGER.info("%s will use IMDS", self.__class__.__name__)
+            self._credential = ImdsCredential(client_id=client_id, identity_config=identity_config, **kwargs)
+
+    def __enter__(self) -> "ManagedIdentityCredential":
+        if self._credential:
+            self._credential.__enter__()  # type: ignore
+        return self
+
+    def __exit__(self, *args: Any) -> None:
+        if self._credential:
+            self._credential.__exit__(*args)  # type: ignore
+
+    def close(self) -> None:
+        """Close the credential's transport session."""
+        self.__exit__()
+
+    @log_get_token
+    def get_token(
+        self, *scopes: str, claims: Optional[str] = None, tenant_id: Optional[str] = None, **kwargs: Any
+    ) -> AccessToken:
+        """Request an access token for `scopes`.
+
+        This method is called automatically by Azure SDK clients.
+
+        :param str scopes: desired scope for the access token. This credential allows only one scope per request.
+            For more information about scopes, see
+            https://learn.microsoft.com/entra/identity-platform/scopes-oidc.
+
+        :keyword str claims: not used by this credential; any value provided will be ignored.
+        :keyword str tenant_id: not used by this credential; any value provided will be ignored.
+
+        :return: An access token with the desired scopes.
+        :rtype: ~azure.core.credentials.AccessToken
+        :raises ~azure.identity.CredentialUnavailableError: managed identity isn't available in the hosting environment
+        """
+
+        if not self._credential:
+            raise CredentialUnavailableError(
+                message="No managed identity endpoint found. \n"
+                "The Target Azure platform could not be determined from environment variables. \n"
+                "Visit https://aka.ms/azsdk/python/identity/managedidentitycredential/troubleshoot to "
+                "troubleshoot this issue."
+            )
+        return cast(TokenCredential, self._credential).get_token(*scopes, claims=claims, tenant_id=tenant_id, **kwargs)
+
+    @log_get_token
+    def get_token_info(self, *scopes: str, options: Optional[TokenRequestOptions] = None) -> AccessTokenInfo:
+        """Request an access token for `scopes`.
+
+        This is an alternative to `get_token` to enable certain scenarios that require additional properties
+        on the token. This method is called automatically by Azure SDK clients.
+
+        :param str scopes: desired scope for the access token. This credential allows only one scope per request.
+            For more information about scopes, see https://learn.microsoft.com/entra/identity-platform/scopes-oidc.
+        :keyword options: A dictionary of options for the token request. Unknown options will be ignored. Optional.
+        :paramtype options: ~azure.core.credentials.TokenRequestOptions
+
+        :rtype: AccessTokenInfo
+        :return: An AccessTokenInfo instance containing information about the token.
+        :raises ~azure.identity.CredentialUnavailableError: managed identity isn't available in the hosting environment.
+        """
+        if not self._credential:
+            raise CredentialUnavailableError(
+                message="No managed identity endpoint found. \n"
+                "The Target Azure platform could not be determined from environment variables. \n"
+                "Visit https://aka.ms/azsdk/python/identity/managedidentitycredential/troubleshoot to "
+                "troubleshoot this issue."
+            )
+        return cast(SupportsTokenInfo, self._credential).get_token_info(*scopes, options=options)

py2docfx/venv/venv1/Lib/site-packages/azure/identity/_credentials/on_behalf_of.py

@@ -0,0 +1,168 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import time
+from typing import Any, Optional, Callable, Union, Dict
+
+import msal
+
+from azure.core.credentials import AccessTokenInfo
+from azure.core.exceptions import ClientAuthenticationError
+
+from .certificate import get_client_credential
+from .._internal.decorators import wrap_exceptions
+from .._internal.get_token_mixin import GetTokenMixin
+from .._internal.interactive import _build_auth_record
+from .._internal.msal_credentials import MsalCredential
+from .. import AuthenticationRecord
+
+
+class OnBehalfOfCredential(MsalCredential, GetTokenMixin):
+    """Authenticates a service principal via the on-behalf-of flow.
+
+    This flow is typically used by middle-tier services that authorize requests to other services with a delegated
+    user identity. Because this is not an interactive authentication flow, an application using it must have admin
+    consent for any delegated permissions before requesting tokens for them. See `Microsoft Entra ID documentation
+    <https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow>`__ for a more detailed
+    description of the on-behalf-of flow.
+
+    :param str tenant_id: ID of the service principal's tenant. Also called its "directory" ID.
+    :param str client_id: The service principal's client ID.
+    :keyword str client_secret: Optional. A client secret to authenticate the service principal.
+        One of **client_secret**, **client_certificate**, or **client_assertion_func** must be provided.
+    :keyword bytes client_certificate: Optional. The bytes of a certificate in PEM or PKCS12 format including
+        the private key to authenticate the service principal. One of **client_secret**, **client_certificate**,
+        or **client_assertion_func** must be provided.
+    :keyword client_assertion_func: Optional. Function that returns client assertions that authenticate the
+        application to Microsoft Entra ID. This function is called each time the credential requests a token. It must
+        return a valid assertion for the target resource.
+    :paramtype client_assertion_func: Callable[[], str]
+    :keyword str user_assertion: Required. The access token the credential will use as the user assertion when
+        requesting on-behalf-of tokens.
+
+    :keyword str authority: Authority of a Microsoft Entra endpoint, for example "login.microsoftonline.com",
+        the authority for Azure Public Cloud (which is the default). :class:`~azure.identity.AzureAuthorityHosts`
+        defines authorities for other clouds.
+    :keyword password: A certificate password. Used only when **client_certificate** is provided. If this value
+        is a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass
+        appropriately encoded bytes instead.
+    :paramtype password: str or bytes
+    :keyword bool send_certificate_chain: If True when **client_certificate** is provided, the credential will send
+        the public certificate chain in the x5c header of each token request's JWT. This is required for Subject
+        Name/Issuer (SNI) authentication. Defaults to False.
+    :keyword bool disable_instance_discovery: Determines whether or not instance discovery is performed when attempting
+        to authenticate. Setting this to true will completely disable both instance discovery and authority validation.
+        This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in
+        private clouds or Azure Stack. The process of instance discovery entails retrieving authority metadata from
+        https://login.microsoft.com/ to validate the authority. By setting this to **True**, the validation of the
+        authority is disabled. As a result, it is crucial to ensure that the configured authority host is valid and
+        trustworthy.
+    :keyword List[str] additionally_allowed_tenants: Specifies tenants in addition to the specified "tenant_id"
+        for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to
+        acquire tokens for any tenant the application can access.
+
+    .. admonition:: Example:
+
+        .. literalinclude:: ../samples/credential_creation_code_snippets.py
+            :start-after: [START create_on_behalf_of_credential]
+            :end-before: [END create_on_behalf_of_credential]
+            :language: python
+            :dedent: 4
+            :caption: Create an OnBehalfOfCredential.
+    """
+
+    def __init__(
+        self,
+        tenant_id: str,
+        client_id: str,
+        *,
+        client_certificate: Optional[bytes] = None,
+        client_secret: Optional[str] = None,
+        client_assertion_func: Optional[Callable[[], str]] = None,
+        user_assertion: str,
+        password: Optional[Union[bytes, str]] = None,
+        send_certificate_chain: bool = False,
+        **kwargs: Any
+    ) -> None:
+        self._assertion = user_assertion
+        if not self._assertion:
+            raise TypeError('"user_assertion" must not be empty.')
+
+        if client_assertion_func:
+            if client_certificate or client_secret:
+                raise ValueError(
+                    "It is invalid to specify more than one of the following: "
+                    '"client_assertion_func", "client_certificate" or "client_secret".'
+                )
+            credential: Union[str, Dict[str, Any]] = {
+                "client_assertion": client_assertion_func,
+            }
+        elif client_certificate:
+            if client_secret:
+                raise ValueError('Specifying both "client_certificate" and "client_secret" is not valid.')
+            try:
+                credential = get_client_credential(
+                    certificate_path=None,
+                    password=password,
+                    certificate_data=client_certificate,
+                    send_certificate_chain=send_certificate_chain,
+                )
+            except ValueError as ex:
+                # client_certificate isn't a valid cert.
+                message = '"client_certificate" is not a valid certificate in PEM or PKCS12 format'
+                raise ValueError(message) from ex
+        elif client_secret:
+            credential = client_secret
+        else:
+            raise TypeError('Either "client_certificate", "client_secret", or "client_assertion_func" must be provided')
+
+        super(OnBehalfOfCredential, self).__init__(
+            client_id=client_id, client_credential=credential, tenant_id=tenant_id, **kwargs
+        )
+        self._auth_record: Optional[AuthenticationRecord] = None
+
+    @wrap_exceptions
+    def _acquire_token_silently(self, *scopes: str, **kwargs: Any) -> Optional[AccessTokenInfo]:
+        if self._auth_record:
+            claims = kwargs.get("claims")
+            app = self._get_app(**kwargs)
+            for account in app.get_accounts(username=self._auth_record.username):
+                if account.get("home_account_id") != self._auth_record.home_account_id:
+                    continue
+
+                now = int(time.time())
+                result = app.acquire_token_silent_with_error(list(scopes), account=account, claims_challenge=claims)
+                if result and "access_token" in result and "expires_in" in result:
+                    refresh_on = int(result["refresh_on"]) if "refresh_on" in result else None
+                    return AccessTokenInfo(
+                        result["access_token"],
+                        now + int(result["expires_in"]),
+                        token_type=result.get("token_type", "Bearer"),
+                        refresh_on=refresh_on,
+                    )
+
+        return None
+
+    @wrap_exceptions
+    def _request_token(self, *scopes: str, **kwargs: Any) -> AccessTokenInfo:
+        app: msal.ConfidentialClientApplication = self._get_app(**kwargs)
+        request_time = int(time.time())
+        result = app.acquire_token_on_behalf_of(self._assertion, list(scopes), claims_challenge=kwargs.get("claims"))
+        if "access_token" not in result or "expires_in" not in result:
+            message = "Authentication failed: {}".format(result.get("error_description") or result.get("error"))
+            response = self._client.get_error_response(result)
+            raise ClientAuthenticationError(message=message, response=response)
+
+        try:
+            self._auth_record = _build_auth_record(result)
+        except ClientAuthenticationError:
+            pass  # non-fatal; we'll use the assertion again next time instead of a refresh token
+
+        refresh_on = int(result["refresh_on"]) if "refresh_on" in result else None
+        return AccessTokenInfo(
+            result["access_token"],
+            request_time + int(result["expires_in"]),
+            token_type=result.get("token_type", "Bearer"),
+            refresh_on=refresh_on,
+        )

py2docfx/venv/venv1/Lib/site-packages/azure/identity/_credentials/service_fabric.py

@@ -0,0 +1,39 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import functools
+import os
+from typing import Dict, Optional, Any
+
+from azure.core.pipeline.transport import HttpRequest
+
+from .._constants import EnvironmentVariables
+from .._internal.msal_managed_identity_client import MsalManagedIdentityClient
+
+
+class ServiceFabricCredential(MsalManagedIdentityClient):
+    def get_unavailable_message(self, desc: str = "") -> str:
+        return f"Service Fabric managed identity configuration not found in environment. {desc}"
+
+
+def _get_client_args(**kwargs: Any) -> Optional[Dict]:
+    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)
+    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)
+    thumbprint = os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT)
+    if not (url and secret and thumbprint):
+        # Service Fabric managed identity isn't available in this environment
+        return None
+
+    return dict(
+        kwargs,
+        base_headers={"Secret": secret},
+        connection_verify=False,
+        request_factory=functools.partial(_get_request, url),
+    )
+
+
+def _get_request(url: str, scope: str, identity_config: Dict) -> HttpRequest:
+    request = HttpRequest("GET", url)
+    request.format_parameters(dict({"api-version": "2019-07-01-preview", "resource": scope}, **identity_config))
+    return request