ó
    Ú°›jŽ ã                   ó  • S SK r S SKrS SKrS SKrS SKrS SKrS SKrS SKrS SKrS SK	r	S SK
Jr  S SKJr  S SKJrJr  S SKrS SKJr  S SKJrJr  S SKrS SKrS SKJr  S SKJrJrJr  S S	KJr  S S
K J!r!J"r"J#r#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.  S SK/J0r0  S SK1J2r2J3r3  S SK4J5r5J6r6J7r7J8r8J9r9J:r:J;r;J<r<J=r=J>r>J?r?  \R€                  " \A5      rB\" S/ SQSS9rCSrDSrESQS jrF " S S5      rGS rHS rIS rJSRS jrKS rLS rMS rN " S S5      rO " S  S!\O5      rP " S" S#\P5      rQ " S$ S%5      rR " S& S'\R5      rS " S( S)\S5      rT " S* S+\S5      rU " S, S-5      rV " S. S/\V5      rW " S0 S1\V5      rX " S2 S3\V5      rY " S4 S5\V5      rZ " S6 S7\V5      r[ " S8 S9\V5      r\ " S: S;\V5      r] " S< S=\V5      r^ " S> S?\V5      r_ " S@ SA5      r` " SB SC\V5      ra " SD SE5      rb " SF SG\R5      rc " SH SI\V5      rdSJ reSQSK jrfSL rg " SM SN5      rh " SO SP\V5      rig)Sé    N)Ú
namedtuple)Údeepcopy)Úsha1Úsha256©Úparse)ÚtzlocalÚtzutc)ÚUNSIGNED)ÚECÚcompat_shell_splitÚtotal_seconds)ÚConfig)ÚConfigNotFoundÚCredentialRetrievalErrorÚInfiniteLoopConfigErrorÚInvalidConfigErrorÚ
LoginErrorÚLoginInsufficientPermissionsÚLoginRefreshRequiredÚLoginTokenLoadErrorÚMetadataRetrievalErrorÚMissingDependencyExceptionÚPartialCredentialsErrorÚRefreshWithMFAUnsupportedErrorÚUnauthorizedSSOTokenErrorÚUnknownCredentialError)ÚSSOTokenProvider)Úregister_feature_idÚregister_feature_ids)Ú	ArnParserÚContainerMetadataFetcherÚFileWebIdentityTokenLoaderÚInstanceMetadataFetcherÚJSONFileCacheÚLoginTokenLoaderÚSSOTokenLoaderÚcreate_nested_clientÚget_login_token_cache_directoryÚparse_key_val_fileÚresolve_imds_endpoint_modeÚReadOnlyCredentials)Ú
access_keyÚ
secret_keyÚtokenÚ
account_id©N)ÚdefaultsiX  é„  c                 óÊ  ^ • T R                  S5      =(       d    SnT R                  S5      nT R                  S5      nT R                  5       R                  S5      SLnT R                  S5      [        T 5      [        T R                  S5      S.nUc  0 n[        5       n[        5       n	[        [        UUT R                  5       US	9S
9n
[        T XS9n[        U 4S j[        T U5      UU[        X‰U
/5      US9nUU/nUR                  UUS9n[        5       [!        5       U	U
/nXÞ-   U-   nU(       a&  UR#                  U5        [$        R'                  S5        [)        US9nU$ )z’Create a default credential resolver.

This creates a pre-configured credential resolver
that includes the default lookup chain for
credentials.

ÚprofileÚdefaultÚmetadata_service_timeoutÚmetadata_service_num_attemptsNÚec2_metadata_service_endpointÚec2_metadata_v1_disabled)r9   Ú"ec2_metadata_service_endpoint_modeÚec2_credential_refresh_windowr:   )ÚtimeoutÚnum_attemptsÚ
user_agentÚconfig)Úiam_role_fetcher)ÚcacheÚregion_namec                  ó   >• T R                   $ r1   )Úfull_config©Úsessions   €ÚQ/home/mande/repo/quber/.venv/lib/python3.13/site-packages/botocore/credentials.pyÚ<lambda>Ú,create_credential_resolver.<locals>.<lambda>€   s   ø€ ˜G×/Ò/ó    )Úload_configÚclient_creatorrB   Úprofile_nameÚcredential_sourcerÚprofile_provider_builder©rN   Údisable_env_varszWSkipping environment variable credential check because profile name was explicitly set.©Ú	providers)Úget_config_variableÚinstance_variablesÚgetr+   Ú!_DEFAULT_ADVISORY_REFRESH_TIMEOUTÚEnvProviderÚContainerProviderÚInstanceMetadataProviderr$   r?   ÚProfileProviderBuilderÚAssumeRoleProviderÚ_get_client_creatorÚCanonicalNameCredentialSourcerrT   ÚOriginalEC2ProviderÚBotoProviderÚremoveÚloggerÚdebugÚCredentialResolver)rG   rB   rC   rN   Úmetadata_timeoutr>   rR   Úimds_configÚenv_providerÚcontainer_providerÚinstance_metadata_providerrP   Úassume_role_providerÚpre_profileÚprofile_providersÚpost_profilerT   Úresolvers   `                 rH   Úcreate_credential_resolverrp   T   s²  ø€ ð ×.Ñ.¨yÓ9×F¸Y€LØ×2Ñ2Ð3MÓNÐØ×.Ñ.Ð/NÓO€LØ×1Ñ1Ó3×7Ñ7¸	ÓBÈ$ÐNÐð *1×)DÑ)DØ+ó*
ô /IØó/
ô *KØ$+×$?Ñ$?Ø&ó%
ñ€Kð �}Øˆä“=€LÜ*Ó,ÐÜ!9Ü0Ø$Ø%Ø×)Ñ)Ó+Øñ	
ñ"Ðô  6Ø�uñ Ðô .Ü/Ü*¨7°KÓ@ØØ!Ü9ØÐ/IÐJó
ð ":ñ	Ðð 	Øð€Kð 1×:Ñ:Ø!Ø)ð ;ð Ðô
 	ÓÜ‹ØØ"ð	€Lð Ñ/°,Ñ>€Iæð  	×Ñ˜Ô&Ü�‰ð8ô	
ô
 "¨IÑ6€HØ€OrK   c                   óX   • \ rS rSrSr    SS jrSS jrS rS rS r	S	 r
S
 rS rSrg)r\   é´   aŒ  This class handles the creation of profile based providers.

NOTE: This class is only intended for internal use.

This class handles the creation and ordering of the various credential
providers that primarly source their configuration from the shared config.
This is needed to enable sharing between the default credential chain and
the source profile chain created by the assume role provider.
Nc                 ó@   • Xl         X l        X0l        X@l        XPl        g r1   )Ú_sessionÚ_cacheÚ_region_nameÚ_sso_token_cacheÚ_login_token_cache)ÚselfrG   rB   rC   Ússo_token_cacheÚlogin_token_caches         rH   Ú__init__ÚProfileProviderBuilder.__init__¿   s    € ð  ŒØŒØ'ÔØ /ÔØ"3ÕrK   c                 óÈ   • U R                  UU5      U R                  U5      U R                  U5      U R                  U5      U R	                  U5      U R                  U5      /$ r1   )Ú_create_web_identity_providerÚ_create_sso_providerÚ"_create_shared_credential_providerÚ_create_login_providerÚ_create_process_providerÚ_create_config_provider©ry   rN   rR   s      rH   rT   Ú ProfileProviderBuilder.providersÍ   sh   € à×.Ñ.ØØ óð ×%Ñ% lÓ3Ø×3Ñ3°LÓAØ×'Ñ'¨Ó5Ø×)Ñ)¨,Ó7Ø×(Ñ(¨Ó6ð

ð 
	
rK   c                 ó    ^ • [        UU 4S jS9$ )Nc                  ó0   >• T R                   R                  $ r1   ©rt   rE   ©ry   s   €rH   rI   ÚAProfileProviderBuilder._create_process_provider.<locals>.<lambda>Ý   ó   ø€  §¡× 9Ò 9rK   )rN   rL   )ÚProcessProvider©ry   rN   s   ` rH   rƒ   Ú/ProfileProviderBuilder._create_process_providerÚ   s   ø€ ÜØ%Ü9ñ
ð 	
rK   c                 óL   • U R                   R                  S5      n[        UUS9$ )NÚcredentials_file)rN   Úcreds_filename)rt   rU   ÚSharedCredentialProvider)ry   rN   Úcredential_files      rH   r�   Ú9ProfileProviderBuilder._create_shared_credential_providerà   s*   € ØŸ-™-×;Ñ;Ð<NÓOˆÜ'Ø%Ø*ñ
ð 	
rK   c                 óL   • U R                   R                  S5      n[        UUS9$ )NÚconfig_file)rN   Úconfig_filename)rt   rU   ÚConfigProvider)ry   rN   r—   s      rH   r„   Ú.ProfileProviderBuilder._create_config_providerç   s)   € Ø—m‘m×7Ñ7¸ÓFˆÜØ%Ø'ñ
ð 	
rK   c                 óv   ^ • [        U 4S j[        T R                  T R                  5      T R                  UUS9$ )Nc                  ó0   >• T R                   R                  $ r1   r‰   rŠ   s   €rH   rI   ÚFProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>ð   rŒ   rK   )rL   rM   rB   rN   rR   )Ú!AssumeRoleWithWebIdentityProviderr^   rt   rv   ru   r…   s   `  rH   r   Ú4ProfileProviderBuilder._create_web_identity_providerî   s9   ø€ Ü0Ü9Ü.Ø—‘˜t×0Ñ0óð —+‘+Ø%Ø-ñ
ð 	
rK   c                 ó²   ^ • [        U 4S jT R                  R                  UT R                  T R                  [        T R                  T R                  US9S9$ )Nc                  ó0   >• T R                   R                  $ r1   r‰   rŠ   s   €rH   rI   Ú=ProfileProviderBuilder._create_sso_provider.<locals>.<lambda>û   rŒ   rK   )rB   rN   )rL   rM   rN   rB   Útoken_cacheÚtoken_provider)ÚSSOProviderrt   Úcreate_clientru   rw   r   rŽ   s   ` rH   r€   Ú+ProfileProviderBuilder._create_sso_providerù   sN   ø€ ÜÜ9ØŸ=™=×6Ñ6Ø%Ø—+‘+Ø×-Ñ-Ü+Ø—‘Ø×+Ñ+Ø)ññ
ð 	
rK   c                 ó`   ^ • [        U 4S jT R                  R                  UT R                  S9$ )Nc                  ó0   >• T R                   R                  $ r1   r‰   rŠ   s   €rH   rI   Ú?ProfileProviderBuilder._create_login_provider.<locals>.<lambda>	  rŒ   rK   )rL   rM   rN   r£   )ÚLoginProviderrt   r¦   rx   rŽ   s   ` rH   r‚   Ú-ProfileProviderBuilder._create_login_provider  s,   ø€ ÜÜ9ØŸ=™=×6Ñ6Ø%Ø×/Ñ/ñ	
ð 	
rK   )ru   rx   rv   rt   rw   ©NNNN©F)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r|   rT   rƒ   r�   r„   r   r€   r‚   Ú__static_attributes__© rK   rH   r\   r\   ´   s=   † ñð ØØØô4ô
ò
ò
ò
ò	
ò
õ
rK   r\   c                 ó8   • [        U 5      nUR                  5       $ r1   )rp   Úload_credentials)rG   ro   s     rH   Úget_credentialsr¸     s   € Ü)¨'Ó2€HØ×$Ñ$Ó&Ð&rK   c                  óP   • [         R                   R                  [        5       5      $ r1   )ÚdatetimeÚnowr	   rµ   rK   rH   Ú
_local_nowr¼     s   € Ü×Ñ× Ñ ¤£Ó+Ð+rK   c                 óZ   • [        U [        R                  5      (       a  U $ [        U 5      $ r1   )Ú
isinstancerº   r   )Úvalues    rH   Ú_parse_if_neededrÀ     s$   € Ü�%œ×*Ñ*×+Ñ+ØˆÜ�‹<ÐrK   c                 ó”   • [        U [        R                  5      (       a(  U(       a  U R                  5       $ U R                  S5      $ U $ )Nz%Y-%m-%dT%H:%M:%S%Z)r¾   rº   Ú	isoformatÚstrftime)r¿   Úisos     rH   Ú_serialize_if_neededrÅ     s:   € Ü�%œ×*Ñ*×+Ñ+ÞØ—?‘?Ó$Ð$Ø�~‰~Ð3Ó4Ð4Ø€LrK   c                 ó   ^ ^• UU 4S jnU$ )Nc                 óJ   >• ST0nUR                   " S0 UD6  [        TU 40 UD6$ )NrC   rµ   )Úupdater(   )Úservice_nameÚkwargsÚcreate_client_kwargsrC   rG   s      €€rH   rM   Ú+_get_client_creator.<locals>.client_creator(  s9   ø€ Ø -¨{Ð;ÐØ×#Ò#Ñ- fÒ-Ü#Ø�\ñ
Ø%9ñ
ð 	
rK   rµ   )rG   rC   rM   s   `` rH   r^   r^   '  s   ù€ ö
ð ÐrK   c                 ó   ^ ^• U U4S jnU$ )Nc                  ój   >• TR                   " S0 TD6n U S   nUS   US   US   [        US   5      S.$ )NÚCredentialsÚAccessKeyIdÚSecretAccessKeyÚSessionTokenÚ
Expiration©r-   r.   r/   Úexpiry_timerµ   )Úassume_rolerÅ   )ÚresponseÚcredentialsÚclientÚparamss     €€rH   ÚrefreshÚ-create_assume_role_refresher.<locals>.refresh3  sR   ø€ Ø×%Ò%Ñ/¨Ñ/ˆØ˜}Ñ-ˆð & mÑ4Ø%Ð&7Ñ8Ø  Ñ0Ü/°¸LÑ0IÓJñ	
ð 	
rK   rµ   )rÙ   rÚ   rÛ   s   `` rH   Úcreate_assume_role_refresherrÝ   2  s   ù€ ö

ð €NrK   c                 ó&   •  " S S5      nU" U 5      $ )Nc                   ó    • \ rS rSrS rS rSrg)Ú/create_mfa_serial_refresher.<locals>._RefresheriC  c                 ó   • Xl         SU l        g )NF)Ú_refreshÚ_has_been_called)ry   rÛ   s     rH   r|   Ú8create_mfa_serial_refresher.<locals>._Refresher.__init__D  s   € Ø#ŒMØ$)ˆDÕ!rK   c                 óf   • U R                   (       a
  [        5       eSU l         U R                  5       $ ©NT)rã   r   râ   rŠ   s    rH   Ú__call__Ú8create_mfa_serial_refresher.<locals>._Refresher.__call__H  s*   € Ø×$×$ô 5Ó6Ð6Ø$(ˆDÔ!Ø—=‘=“?Ð"rK   )rã   râ   N)r¯   r°   r±   r²   r|   rç   r´   rµ   rK   rH   Ú
_Refresherrà   C  s   † ò	*õ	#rK   ré   rµ   )Úactual_refreshré   s     rH   Úcreate_mfa_serial_refresherrë   B  s   € ÷#ñ #ñ �nÓ%Ð%rK   c                   ó6   • \ rS rSrSr S	S jrS rS rS rSr	g)
rÏ   iT  a¥  
Holds the credentials needed to authenticate requests.

:param str access_key: The access key part of the credentials.
:param str secret_key: The secret key part of the credentials.
:param str token: The security token, valid only for session credentials.
:param str method: A string which identifies where the credentials
    were found.
:param str account_id: (optional) An account ID associated with the credentials.
Nc                 ój   • Xl         X l        X0l        Uc  SnX@l        XPl        U R                  5         g )NÚexplicit)r-   r.   r/   Úmethodr0   Ú
_normalize)ry   r-   r.   r/   rï   r0   s         rH   r|   ÚCredentials.__init__`  s1   € ð %ŒØ$ŒØŒ
à‰>ØˆFØŒØ$Œà�‰ÕrK   c                 ó¼   • [         R                  R                  U R                  5      U l        [         R                  R                  U R                  5      U l        g r1   )ÚbotocoreÚcompatÚensure_unicoder-   r.   rŠ   s    rH   rð   ÚCredentials._normalizen  s8   € ô #Ÿ/™/×8Ñ8¸¿¹ÓIˆŒÜ"Ÿ/™/×8Ñ8¸¿¹ÓIˆ�rK   c                 ón   • [        U R                  U R                  U R                  U R                  5      $ r1   )r,   r-   r.   r/   r0   rŠ   s    rH   Úget_frozen_credentialsÚ"Credentials.get_frozen_credentialsx  s(   € Ü"Ø�O‰O˜TŸ_™_¨d¯j©j¸$¿/¹/ó
ð 	
rK   c                 ó   ^ ^• UU 4S jnU$ )Nc                  ó   >• [        TT S 5      $ r1   )Úgetattr)Úproperty_namery   s   €€rH   Úget_propertyÚ7Credentials.get_deferred_property.<locals>.get_property~  s   ø€ Ü˜4 °Ó5Ð5rK   rµ   )ry   rý   rþ   s   `` rH   Úget_deferred_propertyÚ!Credentials.get_deferred_property}  s   ù€ ö	6ð ÐrK   )r-   r0   rï   r.   r/   ©NNN)
r¯   r°   r±   r²   r³   r|   rð   rø   r   r´   rµ   rK   rH   rÏ   rÏ   T  s#   † ñ	ð KOôòJò
õ
rK   rÏ   c                   ó^  • \ rS rSrSr\r\r\	SSS4S jr
S r\  SS j5       r\S 5       r\R                   S 5       r\S	 5       r\R                   S
 5       r\S 5       r\R                   S 5       r\S 5       r\R                   S 5       rS rSS jrS rS rS r\S 5       rS rS rSrg)ÚRefreshableCredentialsi„  a]  
Holds the credentials needed to authenticate requests. In addition, it
knows how to refresh itself.

:param str access_key: The access key part of the credentials.
:param str secret_key: The secret key part of the credentials.
:param str token: The security token, valid only for session credentials.
:param datetime expiry_time: The expiration time of the credentials.
:param function refresh_using: Callback function to refresh the credentials.
:param str method: A string which identifies where the credentials
    were found.
:param function time_fetcher: Callback function to retrieve current time.
Nc                 ó   • XPl         Xl        X l        X0l        X l        X@l        Xpl        [        R                  " 5       U l	        X`l
        [        XX:5      U l        U R                  5         Ub  X€l        U	b  X�l        g g r1   )Ú_refresh_usingÚ_access_keyÚ_secret_keyÚ_tokenÚ_account_idÚ_expiry_timeÚ_time_fetcherÚ	threadingÚLockÚ_refresh_lockrï   r,   Ú_frozen_credentialsrð   Ú_advisory_refresh_timeoutÚ_mandatory_refresh_timeout)ry   r-   r.   r/   rÕ   Úrefresh_usingrï   Útime_fetcherÚadvisory_timeoutÚmandatory_timeoutr0   s              rH   r|   ÚRefreshableCredentials.__init__š  s|   € ð ,ÔØ%ÔØ%ÔØŒØ%ÔØ'ÔØ)ÔÜ&Ÿ^š^Ó-ˆÔØŒÜ#6Ø Eó$
ˆÔ ð 	�‰ÔØÑ'Ø-=Ô*ØÑ(Ø.?Õ+ð )rK   c                 ó¼   • [         R                  R                  U R                  5      U l        [         R                  R                  U R                  5      U l        g r1   )ró   rô   rõ   r  r  rŠ   s    rH   rð   Ú!RefreshableCredentials._normalize¹  s<   € Ü#Ÿ?™?×9Ñ9¸$×:JÑ:JÓKˆÔÜ#Ÿ?™?×9Ñ9¸$×:JÑ:JÓKˆÕrK   c                 óš   • 0 nUb  XFS'   Ub  XVS'   U " S	US   US   US   U R                  US   5      UUUR                  S5      S.UD6nU$ )
Nr  r  r-   r.   r/   rÕ   r0   )r-   r.   r/   rÕ   rï   r  r0   rµ   )Ú_expiry_datetimerW   )ÚclsÚmetadatar  rï   r  r  rÊ   Úinstances           rH   Úcreate_from_metadataÚ+RefreshableCredentials.create_from_metadata½  s„   € ð ˆØÑ'Ø)9Ð%Ñ&ØÑ(Ø*;Ð&Ñ'áð 	
Ø Ñ-Ø Ñ-Ø˜7Ñ#Ø×,Ñ,¨X°mÑ-DÓEØØ'Ø—|‘| LÓ1ñ	
ð ñ	
ˆð ˆrK   c                 ó:   • U R                  5         U R                  $ ©z¬Warning: Using this property can lead to race conditions if you
access another property subsequently along the refresh boundary.
Please use get_frozen_credentials instead.
)râ   r  rŠ   s    rH   r-   Ú!RefreshableCredentials.access_keyØ  ó   € ð 	�‰ŒØ×ÑÐrK   c                 ó   • Xl         g r1   )r  ©ry   r¿   s     rH   r-   r#  á  ó   € à ÕrK   c                 ó:   • U R                  5         U R                  $ r"  )râ   r  rŠ   s    rH   r.   Ú!RefreshableCredentials.secret_keyå  r$  rK   c                 ó   • Xl         g r1   )r  r&  s     rH   r.   r)  î  r'  rK   c                 ó:   • U R                  5         U R                  $ r"  )râ   r	  rŠ   s    rH   r/   ÚRefreshableCredentials.tokenò  s   € ð 	�‰ŒØ�{‰{ÐrK   c                 ó   • Xl         g r1   )r	  r&  s     rH   r/   r,  û  s   € à�rK   c                 ó:   • U R                  5         U R                  $ r"  )râ   r
  rŠ   s    rH   r0   Ú!RefreshableCredentials.account_idÿ  r$  rK   c                 ó   • Xl         g r1   )r
  r&  s     rH   r0   r/    r'  rK   c                 óR   • U R                   U R                  5       -
  n[        U5      $ r1   )r  r  r   )ry   Údeltas     rH   Ú_seconds_remainingÚ)RefreshableCredentials._seconds_remaining  s&   € Ø×!Ñ! D×$6Ñ$6Ó$8Ñ8ˆÜ˜UÓ#Ð#rK   c                 ó’   • U R                   c  gUc  U R                  nU R                  5       U:¼  a  g[        R	                  S5        g)aK  Check if a refresh is needed.

A refresh is needed if the expiry time associated
with the temporary credentials is less than the
provided ``refresh_in``.  If ``time_delta`` is not
provided, ``self.advisory_refresh_needed`` will be used.

For example, if your temporary credentials expire
in 10 minutes and the provided ``refresh_in`` is
``15 * 60``, then this function will return ``True``.

:type refresh_in: int
:param refresh_in: The number of seconds before the
    credentials expire in which refresh attempts should
    be made.

:return: True if refresh needed, False otherwise.

Fz!Credentials need to be refreshed.T)r  r  r3  rc   rd   )ry   Ú
refresh_ins     rH   Úrefresh_neededÚ%RefreshableCredentials.refresh_needed  sJ   € ð( ×ÑÑ$ààÑØ×7Ñ7ˆJð ×"Ñ"Ó$¨
Ó2àÜ�‰Ð8Ô9ØrK   c                 ó    • U R                  SS9$ )Nr   )r6  )r7  rŠ   s    rH   Ú_is_expiredÚ"RefreshableCredentials._is_expired2  s   € à×"Ñ"¨aÐ"Ð0Ð0rK   c                 óÊ  • U R                  U R                  5      (       d  g U R                  R                  S5      (       aƒ   U R                  U R                  5      (       d   U R                  R	                  5         g U R                  U R
                  5      nU R                  US9   U R                  R	                  5         g U R                  U R
                  5      (       aO  U R                     U R                  U R
                  5      (       d
   S S S 5        g U R                  SS9  S S S 5        g g ! U R                  R	                  5         f = f! , (       d  f       g = f)NF)Úis_mandatoryT)r7  r  r  ÚacquireÚreleaser  Ú_protected_refresh)ry   Úis_mandatory_refreshs     rH   râ   ÚRefreshableCredentials._refresh6  s3  € ð ×"Ñ" 4×#AÑ#A×BÑBØð ×Ñ×%Ñ% e×,Ñ,ð	-Ø×*Ñ*¨4×+IÑ+I×JÑJØð ×"Ñ"×*Ñ*Õ,ð (,×':Ñ':Ø×3Ñ3ó(Ð$ð ×'Ñ'Ð5IÐ'ÑJØà×"Ñ"×*Ñ*Õ,Ø× Ñ  ×!@Ñ!@×AÑAð ×#Ó#Ø×*Ñ*¨4×+JÑ+J×KÑKØ÷ $Ð#ð ×'Ñ'°TÐ'Ñ:÷ $Ð#ð Bøð ×"Ñ"×*Ñ*Õ,ú÷ $Õ#ús$   Á D5 Á?*D5 Ã1"EÄEÄ5EÅ
E"c                 óœ  •  U R                  5       nU R	                  U5        [        U R                  U R                  U R                  U R                  5      U l
        U R                  5       (       a"  Sn[        R                  U5        [        U5      eg ! [         a+    U(       a  SOSn[        R                  SUSS9  U(       a  e  g f = f)NÚ	mandatoryÚadvisoryzARefreshing temporary credentials failed during %s refresh period.T©Úexc_infozLCredentials were refreshed, but the refreshed credentials are still expired.)r  Ú	Exceptionrc   ÚwarningÚ_set_from_datar,   r  r  r	  r
  r  r:  ÚRuntimeError)ry   r=  r  Úperiod_nameÚmsgs        rH   r@  Ú)RefreshableCredentials._protected_refreshT  sÏ   € ð	Ø×*Ñ*Ó,ˆHð$ 	×Ñ˜HÔ%Ü#6Ø×Ñ˜d×.Ñ.°·±¸T×=MÑ=Mó$
ˆÔ ð ×Ñ×Ñð;ð ô �N‰N˜3ÔÜ˜sÓ#Ð#ð øô+ ó 	Þ)5™+¸:ˆKÜ�N‰Nð,àØð	 ñ ö ð ñ ð!	ús   ‚B Â2CÃ
Cc                 ó   • [        U 5      $ r1   r   )Útime_strs    rH   r  Ú'RefreshableCredentials._expiry_datetime{  s   € ä�X‹ÐrK   c                 ó¨  • / SQnU(       d  UnOU Vs/ s H  oDU;  d  M
  UPM     nnU(       a(  Sn[        U R                  USR                  U5      -  S9eUS   U l        US   U l        US   U l        [        US   5      U l        UR                  S	5      U l	        [        R                  S
U R                  5        U R                  5         g s  snf )NrÔ   z7Credential refresh failed, response did not contain: %sú, ©ÚproviderÚ	error_msgr-   r.   r/   rÕ   r0   z(Retrieved credentials will expire at: %s)r   rï   Újoinr-   r.   r/   r   r  rW   r0   rc   rd   rð   )ry   ÚdataÚexpected_keysÚmissing_keysÚkÚmessages         rH   rJ  Ú%RefreshableCredentials._set_from_data  sÄ   € ÚLˆÞØ(‰Lá'4ÓF¢} !À¹ŸA¡}ˆLÐFæØOˆGÜ*ØŸ™Ø! D§I¡I¨lÓ$;Ñ;ñð ð
 ˜|Ñ,ˆŒØ˜|Ñ,ˆŒØ˜'‘]ˆŒ
Ü! $ }Ñ"5Ó6ˆÔØŸ(™( <Ó0ˆŒÜ�‰Ø6¸×8IÑ8Iô	
ð 	�‰Õùò# Gs
   “	C Cc                 ó:   • U R                  5         U R                  $ )a¼  Return immutable credentials.

The ``access_key``, ``secret_key``, and ``token`` properties
on this class will always check and refresh credentials if
needed before returning the particular credentials.

This has an edge case where you can get inconsistent
credentials.  Imagine this:

    # Current creds are "t1"
    tmp.access_key  ---> expired? no, so return t1.access_key
    # ---- time is now expired, creds need refreshing to "t2" ----
    tmp.secret_key  ---> expired? yes, refresh and return t2.secret_key

This means we're using the access key from t1 with the secret key
from t2.  To fix this issue, you can request a frozen credential object
which is guaranteed not to change.

The frozen credentials returned from this method should be used
immediately and then discarded.  The typical usage pattern would
be::

    creds = RefreshableCredentials(...)
    some_code = SomeSignerObject()
    # I'm about to sign the request.
    # The frozen credentials are only used for the
    # duration of generate_presigned_url and will be
    # immediately thrown away.
    request = some_code.sign_some_request(
        with_credentials=creds.get_frozen_credentials())
    print("Signed request:", request)

)râ   r  rŠ   s    rH   rø   Ú-RefreshableCredentials.get_frozen_credentials—  s   € ðD 	�‰ŒØ×'Ñ'Ð'rK   )r  r
  r  r  r  r  r  r  r  r  r	  r-   r0   rï   r.   r/   ©NNr1   )r¯   r°   r±   r²   r³   rX   r  Ú"_DEFAULT_MANDATORY_REFRESH_TIMEOUTr  r¼   r|   rð   Úclassmethodr  Úpropertyr-   Úsetterr.   r/   r0   r3  r7  r:  râ   r@  Ústaticmethodr  rJ  rø   r´   rµ   rK   rH   r  r  „  s>  † ñð  !BÐð "DÐð  ØØØô@ò>Lð ð Øóó ðð4 ñ ó ð ð ×Ññ!ó ð!ð ñ ó ð ð ×Ññ!ó ð!ð ñó ðð ‡\�\ñó ðð ñ ó ð ð ×Ññ!ó ð!ò$ô òD1ò;ò<%$ðN ñó ðòõ0#(rK   r  c                   ó<   ^ • \ rS rSrSr\4S jrSU 4S jjrSrU =r	$ )ÚDeferredRefreshableCredentialsi½  zqRefreshable credentials that don't require initial credentials.

refresh_using will be called upon first access.
c                 ó°   • Xl         S U l        S U l        S U l        S U l        S U l        X0l        [        R                  " 5       U l	        X l
        S U l        g r1   )r  r  r  r	  r
  r  r  r  r  r  rï   r  )ry   r  rï   r  s       rH   r|   Ú'DeferredRefreshableCredentials.__init__Ã  sQ   € Ø+ÔØˆÔØˆÔØˆŒØˆÔØ ˆÔØ)ÔÜ&Ÿ^š^Ó-ˆÔØŒØ#'ˆÕ rK   c                 ó>   >• U R                   c  g[        TU ]	  U5      $ ræ   )r  Úsuperr7  )ry   r6  Ú	__class__s     €rH   r7  Ú-DeferredRefreshableCredentials.refresh_neededÏ  s"   ø€ Ø×#Ñ#Ñ+ØÜ‰wÑ% jÓ1Ð1rK   )
r  r
  r  r  r  r  r  r  r	  rï   r1   )
r¯   r°   r±   r²   r³   r¼   r|   r7  r´   Ú__classcell__©rl  s   @rH   rg  rg  ½  s   ø† ñð
 <Fô 
(÷2õ 2rK   rg  c                   óR   • \ rS rSrSrSS jrS rS rS rS r	S	 r
S
 rS rS rSrg)ÚCachedCredentialFetcheriÕ  r3   Nc                 óŒ   • Uc  0 nXl         U R                  5       U l        Uc  U R                  nX l        [        5       U l        g r1   )ru   Ú_create_cache_keyÚ
_cache_keyÚDEFAULT_EXPIRY_WINDOW_SECONDSÚ_expiry_window_secondsÚsetÚfeature_ids)ry   rB   Úexpiry_window_secondss      rH   r|   Ú CachedCredentialFetcher.__init__Ø  sC   € Ø‰=ØˆEØŒØ×0Ñ0Ó2ˆŒØ Ñ(Ø$(×$FÑ$FÐ!Ø&;Ô#Ü›5ˆÕrK   c                 ó   • [        S5      e)Nz_create_cache_key()©ÚNotImplementedErrorrŠ   s    rH   rs  Ú)CachedCredentialFetcher._create_cache_keyâ  s   € Ü!Ð"7Ó8Ð8rK   c                 ó†   • UR                  SS5      R                  [        R                  S5      nUR                  SS5      $ )NÚ:Ú_Ú/)ÚreplaceÚosÚsep)ry   Úfilenames     rH   Ú_make_file_safeÚ'CachedCredentialFetcher._make_file_safeå  s8   € à×#Ñ# C¨Ó-×5Ñ5´b·f±f¸cÓBˆØ×Ñ  SÓ)Ð)rK   c                 ó   • [        S5      e)Nz_get_credentials()r|  rŠ   s    rH   Ú_get_credentialsÚ(CachedCredentialFetcher._get_credentialsê  s   € Ü!Ð"6Ó7Ð7rK   c                 ó"   • U R                  5       $ r1   )Ú_get_cached_credentialsrŠ   s    rH   Úfetch_credentialsÚ)CachedCredentialFetcher.fetch_credentialsí  s   € Ø×+Ñ+Ó-Ð-rK   c                 óþ   • U R                  5       nUc"  U R                  5       nU R                  U5        O[        R	                  S5        US   n[        US   SS9nUS   US   US   UUR                  S	5      S
.nU$ )z~Get up-to-date credentials.

This will check the cache for up-to-date credentials, calling assume
role if none are available.
z*Credentials for role retrieved from cache.rÏ   rÓ   T)rÄ   rÐ   rÑ   rÒ   Ú	AccountId©r-   r.   r/   rÕ   r0   )Ú_load_from_cacherŠ  Ú_write_to_cacherc   rd   rÅ   rW   )ry   r×   ÚcredsÚ
expirationrØ   s        rH   r�  Ú/CachedCredentialFetcher._get_cached_credentialsð  s“   € ð ×(Ñ(Ó*ˆØÑØ×,Ñ,Ó.ˆHØ× Ñ  Õ*ä�L‰LÐEÔFà˜Ñ'ˆÜ)¨%°Ñ*=À4ÑHˆ
à Ñ.ØÐ 1Ñ2Ø˜>Ñ*Ø%ØŸ)™) KÓ0ñ
ˆð ÐrK   c                 óÖ   • U R                   U R                  ;   aO  [        U R                  U R                      5      nU R                  U5      (       d  U$ [        R                  S5        g )Nz6Credentials were found in cache, but they are expired.)rt  ru   r   r:  rc   rd   )ry   r•  s     rH   r“  Ú(CachedCredentialFetcher._load_from_cache	  sS   € Ø�?‰?˜dŸk™kÓ)Ü˜TŸ[™[¨¯©Ñ9Ó:ˆEØ×#Ñ# E×*Ñ*Ø�ä—‘ØLôð rK   c                 óH   • [        U5      U R                  U R                  '   g r1   )r   ru   rt  )ry   r×   s     rH   r”  Ú'CachedCredentialFetcher._write_to_cache  s   € Ü'/°Ó'9ˆ�‰�D—O‘OÒ$rK   c                 ól   • [        US   S   5      n[        U[        5       -
  5      nX0R                  :  $ )z!Check if credentials are expired.rÏ   rÓ   )rÀ   r   r¼   rv  )ry   rØ   Úend_timeÚsecondss       rH   r:  Ú#CachedCredentialFetcher._is_expired  s6   € ä# K°Ñ$>¸|Ñ$LÓMˆÜ ¬:«<Ñ 7Ó8ˆØ×4Ñ4Ñ4Ð4rK   )ru   rt  rv  rx  r`  )r¯   r°   r±   r²   ru  r|   rs  r‡  rŠ  rŽ  r�  r“  r”  r:  r´   rµ   rK   rH   rq  rq  Õ  s5   † Ø$+Ð!ô!ò9ò*ò
8ò.òò2	ò:õ5rK   rq  c                   óD   ^ • \ rS rSr   SU 4S jjrS rS rS rSrU =r	$ )ÚBaseAssumeRoleCredentialFetcheri  c                 ó4  >• Xl         X l        Uc  0 U l        O[        U5      U l        U R                  U R                  S'   U R                  R	                  S5      U l        SU l        U R
                  (       d  U R                  5         [        TU ]%  XE5        g )NÚRoleArnÚRoleSessionNameF)
Ú_client_creatorÚ	_role_arnÚ_assume_kwargsr   rW   Ú_role_session_nameÚ_using_default_session_nameÚ_generate_assume_role_namerk  r|   )ry   rM   Úrole_arnÚ
extra_argsrB   ry  rl  s         €rH   r|   Ú(BaseAssumeRoleCredentialFetcher.__init__  sƒ   ø€ ð  .ÔØ!ŒàÑØ"$ˆDÕä"*¨:Ó"6ˆDÔØ)-¯©ˆ×Ñ˜IÑ&à"&×"5Ñ"5×"9Ñ"9Ð:KÓ"LˆÔØ+0ˆÔ(Ø×&×&Ø×+Ñ+Ô-ä‰Ñ˜Õ6rK   c                 ó�   • S[        [        R                  " 5       5       3U l        U R                  U R                  S'   SU l        g )Nzbotocore-session-r¤  T)ÚintÚtimer¨  r§  r©  rŠ   s    rH   rª  Ú:BaseAssumeRoleCredentialFetcher._generate_assume_role_name7  s<   € Ø$5´c¼$¿)º)»+Ó6FÐ5GÐ"HˆÔØ15×1HÑ1Hˆ×ÑÐ-Ñ.Ø+/ˆÕ(rK   c                 ó4  • [        U R                  5      nU R                  (       a  US	 SU;   a  [        R                  " US   5      US'   [        R
                  " USS9n[        UR                  S5      5      R                  5       nU R                  U5      $ )ú{Create a predictable cache key for the current configuration.

The cache key is intended to be compatible with file names.
r¤  ÚPolicyT)Ú	sort_keysúutf-8)
r   r§  r©  ÚjsonÚloadsÚdumpsr   ÚencodeÚ	hexdigestr‡  ©ry   ÚargsÚargument_hashs      rH   rs  Ú1BaseAssumeRoleCredentialFetcher._create_cache_key<  s…   € ô
 ˜×+Ñ+Ó,ˆð ×+×+ØÐ&Ð'à�tÓô "ŸZšZ¨¨X©Ó7ˆD�‰Nä�zŠz˜$¨$Ñ/ˆÜ˜TŸ[™[¨Ó1Ó2×<Ñ<Ó>ˆØ×#Ñ# MÓ2Ð2rK   c                 óô   • UR                  S0 5      R                  S5      n[        R                  " U5      (       a&  [        5       nUR                  U5      S   nXAS   S'   g [        R                  SU5        g )NÚAssumedRoleUserÚArnÚaccountrÏ   r‘  z)Unable to extract account ID from Arn: %s)rW   r!   Úis_arnÚ	parse_arnrc   rd   )ry   r×   r«  Ú
arn_parserr0   s        rH   Ú_add_account_id_to_responseÚ;BaseAssumeRoleCredentialFetcher._add_account_id_to_responseR  sg   € Ø—<‘<Ð 1°2Ó6×:Ñ:¸5ÓAˆÜ×Ò˜H×%Ñ%Ü"›ˆJØ#×-Ñ-¨hÓ7¸	ÑBˆJØ3=�]Ñ# KÒ0ä�L‰LÐDÀhÕOrK   )r§  r¥  r¦  r¨  r©  r  )
r¯   r°   r±   r²   r|   rª  rs  rÇ  r´   rn  ro  s   @rH   r¡  r¡    s)   ø† ð
 ØØ"÷7ò00ò
3÷,Pð PrK   r¡  c                   óF   ^ • \ rS rSr    SU 4S jjrS rS rS rSrU =r	$ )ÚAssumeRoleCredentialFetcheri\  c                 ó„   >• X l         XPl        U R                  c  [        R                  U l        [        TU ]  UUUUUS9  g)a)  
:type client_creator: callable
:param client_creator: A callable that creates a client taking
    arguments like ``Session.create_client``.

:type source_credentials: Credentials
:param source_credentials: The credentials to use to create the
    client for the call to AssumeRole.

:type role_arn: str
:param role_arn: The ARN of the role to be assumed.

:type extra_args: dict
:param extra_args: Any additional arguments to add to the assume
    role request using the format of the botocore operation.
    Possible keys include, but may not be limited to,
    DurationSeconds, Policy, SerialNumber, ExternalId and
    RoleSessionName.

:type mfa_prompter: callable
:param mfa_prompter: A callable that returns input provided by the
    user (i.e raw_input, getpass.getpass, etc.).

:type cache: dict
:param cache: An object that supports ``__getitem__``,
    ``__setitem__``, and ``__contains__``.  An example of this is
    the ``JSONFileCache`` class in aws-cli.

:type expiry_window_seconds: int
:param expiry_window_seconds: The amount of time, in seconds,
N©r¬  rB   ry  )Ú_source_credentialsÚ_mfa_prompterÚgetpassrk  r|   )	ry   rM   Úsource_credentialsr«  r¬  Úmfa_prompterrB   ry  rl  s	           €rH   r|   Ú$AssumeRoleCredentialFetcher.__init__]  sK   ø€ ðR $6Ô Ø)ÔØ×ÑÑ%Ü!(§¡ˆDÔä‰ÑØØØ!ØØ"7ð 	ò 	
rK   c                 ó¶   • [        U R                  5        U R                  5       nU R                  5       nUR                  " S0 UD6nU R                  U5        U$ )ú'Get credentials by calling assume role.rµ   )r    rx  Ú_assume_role_kwargsÚ_create_clientrÖ   rÇ  )ry   rÊ   rÙ   r×   s       rH   rŠ  Ú,AssumeRoleCredentialFetcher._get_credentials“  sR   € ä˜T×-Ñ-Ô.Ø×)Ñ)Ó+ˆØ×$Ñ$Ó&ˆØ×%Ò%Ñ/¨Ñ/ˆØ×(Ñ(¨Ô2ØˆrK   c                 ó¾   • [        U R                  5      nUR                  S5      nUb  SU S3nU R                  U5      nXAS'   UR                  S5      nUb  XQS'   U$ )úAGet the arguments for assume role based on current configuration.ÚSerialNumberzEnter MFA code for z: Ú	TokenCodeÚDurationSeconds)r   r§  rW   rÎ  )ry   Úassume_role_kwargsÚ
mfa_serialÚpromptÚ
token_codeÚduration_secondss         rH   rÕ  Ú/AssumeRoleCredentialFetcher._assume_role_kwargsœ  sv   € ä% d×&9Ñ&9Ó:Ðà'×+Ñ+¨NÓ;ˆ
àÑ!Ø*¨:¨,°bÐ9ˆFØ×+Ñ+¨FÓ3ˆJØ.8˜{Ñ+à-×1Ñ1Ð2CÓDÐàÑ'Ø4DÐ0Ñ1à!Ð!rK   c                 ó–   • U R                   R                  5       nU R                  SUR                  UR                  UR
                  S9$ )z2Create an STS client using the source credentials.Ústs)Úaws_access_key_idÚaws_secret_access_keyÚaws_session_token)rÍ  rø   r¥  r-   r.   r/   )ry   Úfrozen_credentialss     rH   rÖ  Ú*AssumeRoleCredentialFetcher._create_client®  sM   € à!×5Ñ5×LÑLÓNÐØ×#Ñ#ØØ0×;Ñ;Ø"4×"?Ñ"?Ø0×6Ñ6ð	 $ð 
ð 	
rK   )rÎ  rÍ  r­   )
r¯   r°   r±   r²   r|   rŠ  rÕ  rÖ  r´   rn  ro  s   @rH   rÊ  rÊ  \  s+   ø† ð ØØØ"÷4
òlò"÷$
ð 
rK   rÊ  c                   ó>   ^ • \ rS rSr   SU 4S jjrS rS rSrU =r$ )Ú*AssumeRoleWithWebIdentityCredentialFetcheri¹  c                 ó4   >• X l         [        TU ]	  UUUUUS9  g)aŸ  
:type client_creator: callable
:param client_creator: A callable that creates a client taking
    arguments like ``Session.create_client``.

:type web_identity_token_loader: callable
:param web_identity_token_loader: A callable that takes no arguments
and returns a web identity token str.

:type role_arn: str
:param role_arn: The ARN of the role to be assumed.

:type extra_args: dict
:param extra_args: Any additional arguments to add to the assume
    role request using the format of the botocore operation.
    Possible keys include, but may not be limited to,
    DurationSeconds, Policy, SerialNumber, ExternalId and
    RoleSessionName.

:type cache: dict
:param cache: An object that supports ``__getitem__``,
    ``__setitem__``, and ``__contains__``.  An example of this is
    the ``JSONFileCache`` class in aws-cli.

:type expiry_window_seconds: int
:param expiry_window_seconds: The amount of time, in seconds,
rÌ  N)Ú_web_identity_token_loaderrk  r|   )ry   rM   Úweb_identity_token_loaderr«  r¬  rB   ry  rl  s          €rH   r|   Ú3AssumeRoleWithWebIdentityCredentialFetcher.__init__¼  s.   ø€ ðH +DÔ'ä‰ÑØØØ!ØØ"7ð 	ò 	
rK   c                 óÐ   • [        U R                  5        U R                  5       n[        [        S9nU R                  SUS9nUR                  " S0 UD6nU R                  U5        U$ )rÔ  ©Úsignature_versionrä  ©r@   rµ   )r    rx  rÕ  r   r   r¥  Úassume_role_with_web_identityrÇ  )ry   rÊ   r@   rÙ   r×   s        rH   rŠ  Ú;AssumeRoleWithWebIdentityCredentialFetcher._get_credentialsê  se   € ä˜T×-Ñ-Ô.Ø×)Ñ)Ó+ˆô ¬(Ñ3ˆØ×%Ñ% e°FÐ%Ð;ˆØ×7Ò7ÑA¸&ÑAˆØ×(Ñ(¨Ô2ØˆrK   c                 óX   • [        U R                  5      nU R                  5       nX!S'   U$ )rÙ  ÚWebIdentityToken)r   r§  rí  )ry   rÝ  Úidentity_tokens      rH   rÕ  Ú>AssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargsö  s0   € ä% d×&9Ñ&9Ó:ÐØ×8Ñ8Ó:ˆØ1?Ð-Ñ.à!Ð!rK   )rí  r  )	r¯   r°   r±   r²   r|   rŠ  rÕ  r´   rn  ro  s   @rH   rë  rë  ¹  s#   ø† ð ØØ"÷,
ò\
÷"ð "rK   rë  c                   ó2   • \ rS rSrSrSrSS jrS rS rSr	g)ÚCredentialProvideriÿ  Nc                 ó   • Xl         g r1   rF   )ry   rG   s     rH   r|   ÚCredentialProvider.__init__  s   € Ø�rK   c                 ó   • g)a%  
Loads the credentials from their source & sets them on the object.

Subclasses should implement this method (by reading from disk, the
environment, the network or wherever), returning ``True`` if they were
found & loaded.

If not found, this method should return ``False``, indicating that the
``CredentialResolver`` should fall back to the next available method.

The default implementation does nothing, assuming the user has set the
``access_key/secret_key/token`` themselves.

:returns: Whether credentials were found & set
:rtype: Credentials
Trµ   rŠ   s    rH   ÚloadÚCredentialProvider.load  s   € ð" rK   c                 óˆ   • / nU H  n UR                  X   5        M     U$ ! [         a    [        U R                  US9ef = f)N©rU  Úcred_var)ÚappendÚKeyErrorr   ÚMETHOD)ry   ÚmappingÚ	key_namesÚfoundÚkey_names        rH   Ú_extract_creds_from_mappingÚ.CredentialProvider._extract_creds_from_mapping!  sS   € ØˆÛ!ˆHðØ—‘˜WÑ.Ö/ñ "ð ˆøô	 ó Ü-Ø!Ÿ[™[°8ñð ðús	   ‰"¢ArF   r1   )
r¯   r°   r±   r²   r  ÚCANONICAL_NAMEr|   rÿ  r  r´   rµ   rK   rH   rû  rû  ÿ  s   † à€Fð €Nôòõ&	rK   rû  c                   ój   • \ rS rSrSr\R                  4S jrS rS r	\
S 5       r\
S 5       rS rS	rg
)r�   i-  zcustom-processc                 ó6   • Xl         X l        S U l        X0l        g r1   )Ú_profile_nameÚ_load_configÚ_loaded_configÚ_popen)ry   rN   rL   Úpopens       rH   r|   ÚProcessProvider.__init__0  s   € Ø)ÔØ'ÔØ"ˆÔØ�rK   c           	      óZ  ^ ^• T R                   mTc  g [        S5        T R                  T5      n[        S5        UR                  S5      b&  [        R                  UUU 4S jT R                  5      $ [        US   US   UR                  S5      T R                  UR                  S5      S	9$ )
NÚCREDENTIALS_PROFILE_PROCESSÚCREDENTIALS_PROCESSrÕ   c                  ó&   >• TR                  T 5      $ r1   )Ú_retrieve_credentials_using)Úcredential_processry   s   €€rH   rI   Ú&ProcessProvider.load.<locals>.<lambda>A  s   ø€ ˜×8Ñ8Ð9KÔLrK   r-   r.   r/   r0   )r-   r.   r/   rï   r0   )Ú_credential_processr   r  rW   r  r  r  rÏ   )ry   Ú
creds_dictr  s   ` @rH   rÿ  ÚProcessProvider.load6  s¨   ù€ Ø!×5Ñ5ÐØÑ%ØäÐ9Ô:Ø×5Ñ5Ð6HÓIˆ
ÜÐ1Ô2Ø�>‰>˜-Ó(Ñ4Ü)×>Ñ>ØÝLØ—‘óð ô Ø! ,Ñ/Ø! ,Ñ/Ø—.‘. Ó)Ø—;‘;Ø!—~‘~ lÓ3ñ
ð 	
rK   c                 ó–  • [        U5      nU R                  U[        R                  [        R                  S9nUR	                  5       u  pEUR
                  S:w  a#  [        U R                  UR                  S5      S9e[        R                  R                  R                  UR                  S5      5      nUR                  SS5      nUS:w  a  [        U R                  SU S	3S9e US
   US   UR                  S5      UR                  S5      U R                  U5      S.$ ! [         a  n[        U R                  SU 3S9eS nAff = f)N)ÚstdoutÚstderrr   r¶  rT  ÚVersionz<Version key not provided>é   zUnsupported version 'z8' for credential process provider, supported versions: 1rÐ   rÑ   rÒ   rÓ   r’  z"Missing required key in response: )r   r  Ú
subprocessÚPIPEÚcommunicateÚ
returncoder   r  Údecoderó   rô   r·  r¸  rW   Ú_get_account_idr  )	ry   r  Úprocess_listÚpr!  r"  ÚparsedÚversionÚes	            rH   r  Ú+ProcessProvider._retrieve_credentials_usingM  sC  € ô *Ð*<Ó=ˆØ�K‰KØ¤§¡¼¿¹ð ð 
ˆð Ÿ™›‰ˆØ�<‰<˜1ÓÜ*ØŸ™°·±¸gÓ0Fñð ô —‘×%Ñ%×+Ñ+¨F¯M©M¸'Ó,BÓCˆØ—*‘*˜YÐ(DÓEˆØ�a‹<Ü*ØŸ™à+¨G¨9ð 56ð 7ñð ð	à$ ]Ñ3Ø$Ð%6Ñ7ØŸ™ NÓ3Ø%Ÿz™z¨,Ó7Ø"×2Ñ2°6Ó:ñð øô ó 	Ü*ØŸ™Ø>¸q¸cÐBñð ûð	ús   Ã':D" Ä"
EÄ,EÅEc                 ó8   • U R                   R                  S5      $ )Nr  )Úprofile_configrW   rŠ   s    rH   r  Ú#ProcessProvider._credential_processq  s   € à×"Ñ"×&Ñ&Ð';Ó<Ð<rK   c                 ó¶   • U R                   c  U R                  5       U l         U R                   R                  S0 5      R                  U R                  0 5      nU$ ©NÚprofiles)r  r  rW   r  )ry   r2  s     rH   r2  ÚProcessProvider.profile_configu  sU   € à×ÑÑ&Ø"&×"3Ñ"3Ó"5ˆDÔØ×,Ñ,×0Ñ0°¸RÓ@×DÑDØ×Ñ ó
ˆð ÐrK   c                 ól   • UR                  S5      nU=(       d    U R                  R                  S5      $ )Nr‘  Úaws_account_id)rW   r2  )ry   r-  r0   s      rH   r*  ÚProcessProvider._get_account_id~  s-   € Ø—Z‘Z Ó,ˆ
Ø×F˜T×0Ñ0×4Ñ4Ð5EÓFÐFrK   )r  r  r  r  N)r¯   r°   r±   r²   r  r%  ÚPopenr|   rÿ  r  rc  r  r2  r*  r´   rµ   rK   rH   r�   r�   -  sN   † Ø€Fà8B×8HÑ8Hô ò
ò."ðH ñ=ó ð=ð ñó ðõGrK   r�   c                   ó(   • \ rS rSrSrSrS rS rSrg)r[   iƒ  ziam-roleÚEc2InstanceMetadatac                 ó   • Xl         g r1   ©Ú_role_fetcher)ry   rA   s     rH   r|   Ú!InstanceMetadataProvider.__init__‡  s   € Ø-ÕrK   c                 óè   • U R                   nUR                  5       nU(       d  g [        S5        [        R	                  SUS   5        [
        R                  UU R                  UR                  S9nU$ )NÚCREDENTIALS_IMDSz#Found credentials from IAM Role: %sÚ	role_name©rï   r  )r@  Úretrieve_iam_role_credentialsr   rc   Úinfor  r  r  )ry   Úfetcherr  r•  s       rH   rÿ  ÚInstanceMetadataProvider.loadŠ  ss   € Ø×$Ñ$ˆð ×8Ñ8Ó:ˆÞØÜÐ.Ô/Ü�‰Ø1°8¸KÑ3Hô	
ô '×;Ñ;ØØ—;‘;Ø!×?Ñ?ð <ð 
ˆð
 ˆrK   r?  N)	r¯   r°   r±   r²   r  r  r|   rÿ  r´   rµ   rK   rH   r[   r[   ƒ  s   † Ø€FØ*€Nò.õrK   r[   c                   óP   • \ rS rSrSrSrSrSrSS/rSr	S	r
SS jrS rS rS rSrg
)rY   i¡  ÚenvÚEnvironmentÚAWS_ACCESS_KEY_IDÚAWS_SECRET_ACCESS_KEYÚAWS_SECURITY_TOKENÚAWS_SESSION_TOKENÚAWS_CREDENTIAL_EXPIRATIONÚAWS_ACCOUNT_IDNc                 ób   • Uc  [         R                  nXl        U R                  U5      U l        g)aŸ  

:param environ: The environment variables (defaults to
    ``os.environ`` if no value is provided).
:param mapping: An optional mapping of variable names to
    environment variable names.  Use this if you want to
    change the mapping of access_key->AWS_ACCESS_KEY_ID, etc.
    The dict can have up to 5 keys:
    * ``access_key``
    * ``secret_key``
    * ``token``
    * ``expiry_time``
    * ``account_id``
N)r„  ÚenvironÚ_build_mappingÚ_mapping)ry   rT  r  s      rH   r|   ÚEnvProvider.__init__¬  s)   € ð ‰?Ü—j‘jˆGØŒØ×+Ñ+¨GÓ4ˆ�rK   c                 ó"  • 0 nUcM  U R                   US'   U R                  US'   U R                  US'   U R                  US'   U R                  US'   U$ UR                  SU R                   5      US'   UR                  SU R                  5      US'   UR                  SU R                  5      US'   [        US   [        5      (       d	  US   /US'   UR                  SU R                  5      US'   UR                  SU R                  5      US'   U$ )Nr-   r.   r/   rÕ   r0   )Ú
ACCESS_KEYÚ
SECRET_KEYÚTOKENSÚEXPIRY_TIMEÚ
ACCOUNT_IDrW   r¾   Úlist)ry   r  Úvar_mappings      rH   rU  ÚEnvProvider._build_mappingÀ  s  € àˆØ‰?à(,¯©ˆK˜Ñ%Ø(,¯©ˆK˜Ñ%Ø#'§;¡;ˆK˜Ñ Ø)-×)9Ñ)9ˆK˜Ñ&Ø(,¯©ˆK˜Ñ%ð" Ðð )0¯©Ø˜dŸo™oó)ˆK˜Ñ%ð )0¯©Ø˜dŸo™oó)ˆK˜Ñ%ð $+§;¡;¨w¸¿¹Ó#DˆK˜Ñ Ü˜k¨'Ñ2´D×9Ñ9Ø(3°GÑ(<Ð'=�˜GÑ$Ø)0¯©Ø˜t×/Ñ/ó*ˆK˜Ñ&ð )0¯©Ø˜dŸo™oó)ˆK˜Ñ%ð ÐrK   c           
      ó†  • U R                   R                  U R                  S   S5      nU(       a‘  [        R	                  S5        U R                  5       nU" SS9n[        S5        US   nUb0  [        U5      n[        US   US	   US
   UUU R                  US   S9$ [        US   US	   US
   U R                  US   S9$ g)z;
Search for credentials in explicit environment variables.
r-   Ú z+Found credentials in environment variables.F)Úrequire_expiryÚCREDENTIALS_ENV_VARSrÕ   Nr.   r/   r0   )r  rï   r0   ©rï   r0   )rT  rW   rV  rc   rG  Ú_create_credentials_fetcherr   r   r  r  rÏ   )ry   r-   rH  rØ   rÕ   s        rH   rÿ  ÚEnvProvider.loadÜ  sã   € ð
 —\‘\×%Ñ% d§m¡m°LÑ&AÀ2ÓFˆ
æÜ�K‰KÐEÔFØ×6Ñ6Ó8ˆGÙ!°Ñ7ˆKÜÐ 6Ô7à% mÑ4ˆKØÑ&Ü# KÓ0�Ü-Ø Ñ-Ø Ñ-Ø Ñ(ØØ")ØŸ;™;Ø*¨<Ñ8ñð ô Ø˜LÑ)Ø˜LÑ)Ø˜GÑ$Ø—{‘{Ø& |Ñ4ñð ð rK   c                 óh   ^^^• U R                   mU R                  mU R                  mSUUU4S jjnU$ )Nc                 óê  >• 0 nTR                  T	S   S5      nU(       d  [        T
T	S   S9eX!S'   TR                  T	S   S5      nU(       d  [        T
T	S   S9eX1S'   S US'   T	S    H"  nTR                  US5      nU(       d  M  XQS'     O   S US'   TR                  T	S   S5      nU(       a  XaS'   U (       a  U(       d  [        T
T	S   S9eS US'   TR                  T	S   S5      nU(       a  XqS'   U$ )Nr-   rb  r  r.   r/   rÕ   r0   )rW   r   )rc  rØ   r-   r.   Útoken_env_varr/   rÕ   r0   rT  r  rï   s           €€€rH   rŽ  ÚBEnvProvider._create_credentials_fetcher.<locals>.fetch_credentials  s-  ø€ ØˆKà Ÿ™ W¨\Ñ%:¸BÓ?ˆJÞÜ-Ø#¨g°lÑ.Cñð ð )3˜Ñ%à Ÿ™ W¨\Ñ%:¸BÓ?ˆJÞÜ-Ø#¨g°lÑ.Cñð ð )3˜Ñ%à#'ˆK˜Ñ Ø!(¨Ô!1�ØŸ™ M°2Ó6�ß�5Ø+0 Ñ(Ùñ	 "2ð *.ˆK˜Ñ&Ø!Ÿ+™+ g¨mÑ&<¸bÓAˆKÞØ-8˜MÑ*Þ¦kÜ-Ø#¨g°mÑ.Dñð ð )-ˆK˜Ñ%Ø Ÿ™ W¨\Ñ%:¸BÓ?ˆJÞØ,6˜LÑ)àÐrK   )T)rV  r  rT  )ry   rŽ  rT  r  rï   s     @@@rH   rf  Ú'EnvProvider._create_credentials_fetcher   s1   ú€ Ø—-‘-ˆØ—‘ˆØ—,‘,ˆ÷&	ñ &	ðP !Ð rK   )rV  rT  r`  )r¯   r°   r±   r²   r  r  rY  rZ  r[  r\  r]  r|   rU  rÿ  rf  r´   rµ   rK   rH   rY   rY   ¡  sB   † Ø€FØ"€NØ$€JØ(€Jð #Ð$7Ð8€FØ-€KØ!€Jô5ò(ò8"õH-!rK   rY   c                   ó8   • \ rS rSrSrSrSrSrSrSS jr	S	 r
S
rg)r`   i0  zec2-credentials-fileÚ	Ec2ConfigÚAWS_CREDENTIAL_FILEÚAWSAccessKeyIdÚAWSSecretKeyNc                 óT   • Uc  [         R                  nUc  [        nXl        X l        g r1   )r„  rT  r*   Ú_environÚ_parser)ry   rT  Úparsers      rH   r|   ÚOriginalEC2Provider.__init__8  s$   € Ø‰?Ü—j‘jˆGØ‰>Ü'ˆFØŒØ�rK   c                 óJ  • SU R                   ;   a“  [        R                  R                  U R                   S   5      nU R	                  U5      nU R
                  U;   aE  [        R                  S5        X R
                     nX R                     n[        X4U R                  S9$ gg)z>
Search for a credential file used by original EC2 CLI tools.
ro  z)Found credentials in AWS_CREDENTIAL_FILE.©rï   N)rs  r„  ÚpathÚ
expanduserrt  rY  rc   rG  rZ  rÏ   r  )ry   Ú	full_pathr•  r-   r.   s        rH   rÿ  ÚOriginalEC2Provider.load@  s�   € ð ! D§M¡MÓ1ÜŸ™×*Ñ*Ø—‘Ð3Ñ4óˆIð —L‘L Ó+ˆEØ�‰ %Ó'Ü—‘ÐGÔHØ"§?¡?Ñ3�
Ø"§?¡?Ñ3�
ä" :À$Ç+Á+ÑNÐNð (ð rK   )rs  rt  r`  )r¯   r°   r±   r²   r  r  ÚCRED_FILE_ENVrY  rZ  r|   rÿ  r´   rµ   rK   rH   r`   r`   0  s%   † Ø#€FØ €Nà)€MØ!€JØ€JôõrK   r`   c                   óL   • \ rS rSrSrSrSrSrSS/rSr	SS
 jr
S rS rS rSrg	)r“   iS  zshared-credentials-fileÚSharedCredentialsrå  ræ  Úaws_security_tokenrç  r9  Nc                 ól   • Xl         Uc  SnX l        Uc  [        R                  R                  nX0l        g )Nr6   )Ú_creds_filenamer  ró   ÚconfigloaderÚraw_config_parseÚ_ini_parser)ry   r’   rN   Ú
ini_parsers       rH   r|   Ú!SharedCredentialProvider.__init___  s6   € Ø-ÔØÑØ$ˆLØ)ÔØÑÜ!×.Ñ.×?Ñ?ˆJØ%ÕrK   c                 óÒ  •  U R                  U R                  5      nU R                  U;   a«  XR                     nU R                  U;   aŒ  [
        R                  SU R                  5        U R                  X R                  U R                  5      u  p4U R                  U5      nU R                  U5      n[        S5        [        UUUU R                  US9$ g g ! [         a     g f = f)Nz0Found credentials in shared credentials file: %sÚCREDENTIALS_PROFILEre  )r…  r‚  r   r  rY  rc   rG  r  rZ  Ú_get_session_tokenr*  r   rÏ   r  )ry   Úavailable_credsr@   r-   r.   r/   r0   s          rH   rÿ  ÚSharedCredentialProvider.loadh  sê   € ð	Ø"×.Ñ.¨t×/CÑ/CÓDˆOð ×Ñ Ó0Ø$×%7Ñ%7Ñ8ˆFØ�‰ &Ó(Ü—‘ØFØ×(Ñ(ôð *.×)IÑ)IØŸO™O¨T¯_©_ó*Ñ&�
ð ×/Ñ/°Ó7�Ø!×1Ñ1°&Ó9�
Ü#Ð$9Ô:Ü"ØØØØŸ;™;Ø)ñð ð )ð 1øô ó 	Ùð	ús   ‚C Ã
C&Ã%C&c                 ó@   • U R                    H  nX!;   d  M
  X   s  $    g r1   ©r[  )ry   r@   Útoken_envvars      rH   rŠ  Ú+SharedCredentialProvider._get_session_token‚  s   € Ø ŸKœKˆLØÕ%ØÑ+Ò+ò (rK   c                 ó8   • UR                  U R                  5      $ r1   ©rW   r]  ©ry   r@   s     rH   r*  Ú(SharedCredentialProvider._get_account_id‡  ó   € Ø�z‰z˜$Ÿ/™/Ó*Ð*rK   )r‚  r…  r  r`  )r¯   r°   r±   r²   r  r  rY  rZ  r[  r]  r|   rÿ  rŠ  r*  r´   rµ   rK   rH   r“   r“   S  s<   † Ø&€FØ(€Nà$€JØ(€Jð #Ð$7Ð8€FØ!€Jô&òò4,õ
+rK   r“   c                   óP   • \ rS rSrSrSrSrSrSrSS/r	S	r
SS jrS rS rS rSrg
)r™   i‹  z0INI based config provider with profile sections.zconfig-fileÚSharedConfigrå  ræ  r€  rç  r9  Nc                 ób   • Xl         X l        Uc  [        R                  R                  nX0l        g)zé

:param config_filename: The session configuration scoped to the current
    profile.  This is available via ``session.config``.
:param profile_name: The name of the current profile.
:param config_parser: A config parser callable.

N)Ú_config_filenamer  ró   rƒ  rL   Ú_config_parser)ry   r˜   rN   Úconfig_parsers       rH   r|   ÚConfigProvider.__init__™  s-   € ð !0ÔØ)ÔØÑ Ü$×1Ñ1×=Ñ=ˆMØ+ÕrK   c                 óà  •  U R                  U R                  5      nU R                  US   ;   a¯  US   U R                     nU R                  U;   aŒ  [
        R                  SU R                  5        U R                  X R                  U R                  5      u  p4U R                  U5      nU R                  U5      n[        S5        [        UUUU R                  US9$ gg! [         a     gf = f)zZ
If there is are credentials in the configuration associated with
the session, use those.
Nr6  z$Credentials found in config file: %sr‰  re  )rš  r™  r   r  rY  rc   rG  r  rZ  rŠ  r*  r   rÏ   r  )ry   rE   r2  r-   r.   r/   r0   s          rH   rÿ  ÚConfigProvider.load¨  sö   € ð
	Ø×-Ñ-¨d×.CÑ.CÓDˆKð ×Ñ ¨ZÑ!8Ó8Ø(¨Ñ4°T×5GÑ5GÑHˆNØ�‰ .Ó0Ü—‘Ø:Ø×)Ñ)ôð *.×)IÑ)IØ"§O¡O°T·_±_ó*Ñ&�
ð ×/Ñ/°Ó?�Ø!×1Ñ1°.ÓA�
Ü#Ð$9Ô:Ü"ØØØØŸ;™;Ø)ñð ð 1ð& øô/ ó 	Ùð	ús   ‚C  Ã 
C-Ã,C-c                 ó@   • U R                    H  nX!;   d  M
  X   s  $    g r1   rŽ  )ry   r2  Ú
token_names      rH   rŠ  Ú!ConfigProvider._get_session_tokenÈ  s   € ØŸ+œ+ˆJØÕ+Ø%Ñ1Ò1ò &rK   c                 ó8   • UR                  U R                  5      $ r1   r’  r“  s     rH   r*  ÚConfigProvider._get_account_idÍ  r•  rK   )r™  rš  r  r1   )r¯   r°   r±   r²   r³   r  r  rY  rZ  r[  r]  r|   rÿ  rŠ  r*  r´   rµ   rK   rH   r™   r™   ‹  s@   † Ù:à€FØ#€Nà$€JØ(€Jð #Ð$7Ð8€FØ!€Jô,òò@2õ
+rK   r™   c                   ó@   • \ rS rSrSrSrSrSS/rSrSr	SS
 jr
S rSrg	)ra   iÑ  zboto-configÚBoto2ConfigÚBOTO_CONFIGz/etc/boto.cfgz~/.botorå  ræ  Nc                 ó|   • Uc  [         R                  nUc  [        R                  R                  nXl        X l        g r1   )r„  rT  ró   rƒ  r„  rs  r…  )ry   rT  r†  s      rH   r|   ÚBotoProvider.__init__Ú  s2   € Ø‰?Ü—j‘jˆGØÑÜ!×.Ñ.×?Ñ?ˆJØŒØ%ÕrK   c                 óÖ  • U R                   U R                  ;   a  U R                  U R                      /nOU R                  nU H‘  n U R                  U5      nSU;   d  M  US   nU R
                  U;   d  M4  [        R                  SU5        U R                  X@R
                  U R                  5      u  pV[        S5        [        XVU R                  S9s  $    g! [         a     M£  f = f)z+
Look for credentials in boto config file.
rÏ   z)Found credentials in boto config file: %sÚCREDENTIALS_BOTO2_CONFIG_FILErx  N)ÚBOTO_CONFIG_ENVrs  ÚDEFAULT_CONFIG_FILENAMESr…  r   rY  rc   rG  r  rZ  r   rÏ   r  )ry   Úpotential_locationsr†  r@   rØ   r-   r.   s          rH   rÿ  ÚBotoProvider.loadâ  sá   € ð ×Ñ 4§=¡=Ó0Ø#'§=¡=°×1EÑ1EÑ#FÐ"GÑà"&×"?Ñ"?ÐÛ+ˆHðØ×)Ñ)¨(Ó3�ð  Õ&Ø$ ]Ñ3�Ø—?‘? kÕ1Ü—K‘KØCÀXôð .2×-MÑ-MØ#§_¡_°d·o±oó.Ñ*�Jô (Ð(GÔHÜ&Ø"°t·{±{ñò ò! ,øô "ó âðús   ÁCÃ
C(Ã'C()rs  r…  r`  )r¯   r°   r±   r²   r  r  r«  r¬  rY  rZ  r|   rÿ  r´   rµ   rK   rH   ra   ra   Ñ  s0   † Ø€FØ"€Nà#€OØ /°Ð;ÐØ$€JØ(€Jô&õrK   ra   c                   ó    • \ rS rSrSrSrSrSrSrSSS	S
.r	\
R                  SS4S jrS rS rS rS rS rS rS rS rS rS rS rS rSrg)r]   iÿ  úassume-roleNr«  Úweb_identity_token_filer3   rC  rd  ÚCREDENTIALS_HTTP)r=  rL  ÚEcsContainerc                 ó¨   • X0l         Xl        X l        X@l        XPl        0 U l        X`l        Xpl        U R                  /U l        [        5       U l
        g)aã  
:type load_config: callable
:param load_config: A function that accepts no arguments, and
    when called, will return the full configuration dictionary
    for the session (``session.full_config``).

:type client_creator: callable
:param client_creator: A factory function that will create
    a client when called.  Has the same interface as
    ``botocore.session.Session.create_client``.

:type cache: dict
:param cache: An object that supports ``__getitem__``,
    ``__setitem__``, and ``__contains__``.  An example
    of this is the ``JSONFileCache`` class in the CLI.

:type profile_name: str
:param profile_name: The name of the profile.

:type prompter: callable
:param prompter: A callable that returns input provided
    by the user (i.e raw_input, getpass.getpass, etc.).

:type credential_sourcer: CanonicalNameCredentialSourcer
:param credential_sourcer: A credential provider that takes a
    configuration, which is used to provide the source credentials
    for the STS call.
N)rB   r  r¥  r  Ú	_prompterr  Ú_credential_sourcerÚ_profile_provider_builderÚ_visited_profilesrw  Ú_feature_ids)ry   rL   rM   rB   rN   ÚprompterrO   rP   s           rH   r|   ÚAssumeRoleProvider.__init__  sT   € ðV Œ
Ø'Ôð  .ÔØ)ÔØ!Œð !ˆÔØ#5Ô Ø)AÔ&Ø"&×"4Ñ"4Ð!5ˆÔÜ›EˆÕrK   c                 ó   • U R                  5       U l        U R                  R                  S0 5      nUR                  U R                  0 5      nU R	                  U5      (       a  U R                  U R                  5      $ g r5  )r  r  rW   r  Ú_has_assume_role_config_varsÚ_load_creds_via_assume_role)ry   r6  r5   s      rH   rÿ  ÚAssumeRoleProvider.loadR  sn   € Ø"×/Ñ/Ó1ˆÔØ×&Ñ&×*Ñ*¨:°rÓ:ˆØ—,‘,˜t×1Ñ1°2Ó6ˆØ×,Ñ,¨W×5Ñ5Ø×3Ñ3°D×4FÑ4FÓGÐGð 6rK   c                 óL   • U R                   U;   =(       a    U R                  U;  $ r1   )ÚROLE_CONFIG_VARÚWEB_IDENTITY_TOKE_FILE_VAR©ry   r5   s     rH   r½  Ú/AssumeRoleProvider._has_assume_role_config_varsY  s*   € à× Ñ  GÑ+÷ ;ð ×+Ñ+°7Ñ:ð	
rK   c           	      ól  • U R                  U5      nU R                  X!5      n0 nUR                  S5      nUb  XTS'   UR                  S5      nUb  XdS'   UR                  S5      nUb  XtS'   UR                  S5      nUb  X„S'   [        U R                  UUS	   UU R
                  U R                  S
9n	U R                  R                  5       U	l	        U	R                  n
Ub  [        U
5      n
U R                  R                  S5        [        U R                  5        [        U R                  U
[         S9$ )NÚrole_session_namer¤  Úexternal_idÚ
ExternalIdrÞ  rÚ  rá  rÜ  r«  )rM   rÐ  r«  r¬  rÑ  rB   ÚCREDENTIALS_STS_ASSUME_ROLE)rï   r  r  )Ú_get_role_configÚ_resolve_source_credentialsrW   rÊ  r¥  rµ  rB   r¹  Úcopyrx  rŽ  rë   Úaddr    rg  r  r¼   )ry   rN   Úrole_configrÐ  r¬  rÆ  rÇ  rÞ  rá  rH  Ú	refreshers              rH   r¾  Ú.AssumeRoleProvider._load_creds_via_assume_roled  sE  € Ø×+Ñ+¨LÓ9ˆØ!×=Ñ=Øó
Ðð ˆ
Ø'ŸO™OÐ,?Ó@ÐØÑ(Ø,=Ð(Ñ)à!—o‘o mÓ4ˆØÑ"Ø'2�|Ñ$à —_‘_ \Ó2ˆ
ØÑ!Ø)3�~Ñ&à&Ÿ?™?Ð+=Ó>ÐØÑ'Ø,<Ð(Ñ)ä-Ø×/Ñ/Ø1Ø  Ñ,Ø!ØŸ™Ø—*‘*ñ
ˆð #×/Ñ/×4Ñ4Ó6ˆÔØ×-Ñ-ˆ	ØÑ!Ü3°IÓ>ˆIà×Ñ×ÑÐ;Ô<Ü˜T×.Ñ.Ô/ô .Ø—;‘;Ø#Ü#ñ
ð 	
rK   c                 ó  • U R                   R                  S0 5      nX!   nUR                  S5      nUS   nUR                  S5      nUR                  S5      nUR                  S5      nUR                  S5      n	UR                  S5      n
UUUU	UUS	.nU
b   [        U
5      US'   Ub  Ub  [	        S
U S3S9eUc  Uc  [        U R                  SS9eUb  U R                  X5        U$ U R                  X5        U$ ! [         a     Nbf = f)z?Retrieves and validates the role configuration for the profile.r6  Úsource_profiler«  Úcredential_sourcerÞ  rÇ  rÆ  rá  )r«  rÇ  rÞ  rÆ  rÒ  rÓ  úThe profile "z5" contains both source_profile and credential_source.©rV  z#source_profile or credential_sourcer  )	r  rW   r¯  Ú
ValueErrorr   r   r  Ú_validate_credential_sourceÚ_validate_source_profile)ry   rN   r6  r5   rÒ  r«  rÓ  rÞ  rÇ  rÆ  rá  rÎ  s               rH   rÊ  Ú#AssumeRoleProvider._get_role_config“  sW  € à×&Ñ&×*Ñ*¨:°rÓ:ˆàÑ(ˆØ Ÿ™Ð%5Ó6ˆØ˜:Ñ&ˆØ#ŸK™KÐ(;Ó<ÐØ—[‘[ Ó.ˆ
Ø—k‘k -Ó0ˆØ#ŸK™KÐ(;Ó<ÐØ"Ÿ;™;Ð'9Ó:Ðð !Ø&Ø$Ø!2Ø,Ø!2ñ
ˆð Ñ'ðÜ25Ð6FÓ2G�Ð.Ñ/ð Ñ(¨^Ñ-GÜ$à# L >ð 2<ð <ñð ð Ñ&¨>Ñ+AÜ)ØŸ™Ø>ñð ð Ñ*Ø×,Ñ,¨\ÔMð Ðð ×)Ñ)¨,ÔGàÐøô- ó Ùðús   ÂC= Ã=
D
Ä	D
c                 óž   • U R                   c  [        SU SU S3S9eU R                   R                  U5      (       d  [        SU SU S3S9eg )NzThe credential_source "z" is specified in profile "z)", but no source provider was configured.rÕ  zThe credential source "z" referenced in profile "z" is not valid.)r¶  r   Úis_supported)ry   Úparent_profilerÓ  s      rH   r×  Ú.AssumeRoleProvider._validate_credential_sourceÄ  s…   € Ø×#Ñ#Ñ+Ü$à.Ð/@Ð.Að B$Ø$2Ð#3ð 4=ð>ñð ð ×'Ñ'×4Ñ4Ð5F×GÑGÜ$à.Ð/@Ð.Að B$Ø$2Ð#3Ð3CðEñð ð HrK   c                 óX   • [        U R                  U5      U R                  U5      /5      $ r1   )ÚanyÚ_has_static_credentialsr½  rÃ  s     rH   Ú_source_profile_has_credentialsÚ2AssumeRoleProvider._source_profile_has_credentialsÕ  s0   € Üà×,Ñ,¨WÓ5Ø×1Ñ1°'Ó:ðó
ð 	
rK   c                 ó  • U R                   R                  S0 5      nX#;  a  [        SU SU S3S9eX2   nX R                  ;  a  g X!:w  a  [	        UU R                  S9eU R                  U5      (       d  [	        UU R                  S9eg )Nr6  zThe source_profile "z" referenced in the profile "z" does not exist.rÕ  )rÒ  Úvisited_profiles)r  rW   r   r¸  r   rà  )ry   Úparent_profile_nameÚsource_profile_namer6  rÒ  s        rH   rØ  Ú+AssumeRoleProvider._validate_source_profileÝ  sº   € ð ×&Ñ&×*Ñ*¨:°rÓ:ˆØÓ.Ü$à+Ð,?Ð+@ð A%Ø%8Ð$9Ð9KðMñð ð "Ñ6ˆð ×&<Ñ&<Ó<Øð Ó5Ü)Ø2Ø!%×!7Ñ!7ñð ð ×+Ñ+¨N×;Ñ;Ü)Ø2Ø!%×!7Ñ!7ñð ð <rK   c                 ó6   ^• SS/n[        U4S jU 5       5      $ )Nræ  rå  c              3   ó,   >#   • U  H	  oT;   v •  M     g 7fr1   rµ   )Ú.0Ú
static_keyr5   s     €rH   Ú	<genexpr>Ú=AssumeRoleProvider._has_static_credentials.<locals>.<genexpr>  s   øé € ÐGº;¨Z Ö(º;ùó   ƒ)rß  )ry   r5   Ústatic_keyss    ` rH   rà  Ú*AssumeRoleProvider._has_static_credentials  s   ø€ Ø.Ð0CÐDˆÜÔG¹;ÓGÓGÐGrK   c                 ó  • UR                  S5      nUb,  U R                  R                  S5        U R                  X25      $ US   nU R                  R                  U5        U R                  R                  S5        U R                  U5      $ )NrÓ  Ú"CREDENTIALS_PROFILE_NAMED_PROVIDERrÒ  Ú"CREDENTIALS_PROFILE_SOURCE_PROFILE)rW   r¹  rÍ  Ú _resolve_credentials_from_sourcer¸  r  Ú!_resolve_credentials_from_profile)ry   rÎ  rN   rÓ  rÒ  s        rH   rË  Ú.AssumeRoleProvider._resolve_source_credentials  sŠ   € Ø'ŸO™OÐ,?Ó@ÐØÑ(Ø×Ñ×!Ñ!Ð"FÔGØ×8Ñ8Ø!óð ð %Ð%5Ñ6ˆØ×Ñ×%Ñ% nÔ5Ø×Ñ×ÑÐBÔCØ×5Ñ5°nÓEÐErK   c                 óð  • U R                   R                  S0 5      nX!   nU R                  R                  S5        U R	                  U5      (       a"  U R
                  (       d  U R                  U5      $ U R	                  U5      (       d  U R                  U5      (       dG  U R
                  R                  USS9n[        U5      nUR                  5       nUc  Sn[        Xq-  S9eU$ U R                  U5      $ )Nr6  r‰  TrQ   z.The source profile "%s" must have credentials.rÕ  )r  rW   r¹  rÍ  rà  r·  Ú(_resolve_static_credentials_from_profiler½  rT   re   r·   r   r¾  )ry   rN   r6  r5   rm   Úprofile_chainrØ   Úerror_messages           rH   rõ  Ú4AssumeRoleProvider._resolve_credentials_from_profile  s  € Ø×&Ñ&×*Ñ*¨:°rÓ:ˆØÑ(ˆØ×Ñ×ÑÐ3Ô4à×(Ñ(¨×1Ñ1Ø×2×2ð ×@Ñ@ÀÓIÐIØ×)Ñ)Ø÷
ñ 
à×2Ñ2°7×;Ñ;Ø $× >Ñ >× HÑ HØ)Ø!%ð !Ið !Ðô /Ð/@ÓAˆMØ'×8Ñ8Ó:ˆKØÑ"àDð ô )Ø+Ñ:ñð ð Ðà×/Ñ/°Ó=Ð=rK   c                 ó¢   •  [        US   US   UR                  S5      S9$ ! [         a"  n[        U R                  [        U5      S9eS nAff = f)Nrå  ræ  rç  )r-   r.   r/   r  )rÏ   rW   r  r   r  Ústr)ry   r5   r/  s      rH   rø  Ú;AssumeRoleProvider._resolve_static_credentials_from_profile5  s_   € ð		ÜØ"Ð#6Ñ7Ø"Ð#:Ñ;Ø—k‘kÐ"5Ó6ñð øô
 ó 	Ü)ØŸ™¬s°1«vñð ûð	ús   ‚" ¢
A¬A	Á	Ac                 óÖ   • U R                   R                  U5      nUc  [        USU 3S9eU R                  R	                  U5      nU(       a  U R
                  R                  U5        U$ )Nz@No credentials found in credential_source referenced in profile rT  )r¶  rÐ  r   ÚNAMED_PROVIDER_FEATURE_MAPrW   r¹  rÍ  )ry   rÓ  rN   rØ   Únamed_provider_feature_ids        rH   rô  Ú3AssumeRoleProvider._resolve_credentials_from_sourceA  s€   € ð ×.Ñ.×AÑAØó
ˆð ÑÜ*Ø*ð"Ø". ð1ñð ð %)×$CÑ$C×$GÑ$GØó%
Ð!ö %Ø×Ñ×!Ñ!Ð";Ô<ØÐrK   )
r¥  r¶  r¹  r  r  r  r·  rµ  r¸  rB   )r¯   r°   r±   r²   r  r  rÁ  rÂ  ÚEXPIRY_WINDOW_SECONDSr   rÏ  r|   rÿ  r½  r¾  rÊ  r×  rá  rØ  rà  rË  rõ  rø  rô  r´   rµ   rK   rH   r]   r]   ÿ  sŠ   † Ø€Fð €NØ €OØ!:Ðð $Ðà1Ø-Ø*ñ"Ðð —‘ØØ!%ô="ò~Hò	
ò-
ò^/òbò"
ò$òLHòFò>òB
õrK   r]   c                   óV   • \ rS rSrSrSrSSSS.r   SS jrS	 rS
 r	S r
S rS rSrg)rž   iW  zassume-role-with-web-identityNÚAWS_WEB_IDENTITY_TOKEN_FILEÚAWS_ROLE_SESSION_NAMEÚAWS_ROLE_ARN)r±  rÆ  r«  c                 óŠ   • X@l         Xl        X l        X0l        S U l        XPl        Uc  [        nX`l        [        5       U l	        g r1   )
rB   r  r¥  r  Ú_profile_configÚ_disable_env_varsr#   Ú_token_loader_clsrw  r¹  )ry   rL   rM   rN   rB   rR   Útoken_loader_clss          rH   r|   Ú*AssumeRoleWithWebIdentityProvider.__init__`  sE   € ð Œ
Ø'ÔØ-ÔØ)ÔØ#ˆÔØ!1ÔØÑ#Ü9ÐØ!1ÔÜ›EˆÕrK   c                 ó"   • U R                  5       $ r1   )Ú_assume_role_with_web_identityrŠ   s    rH   rÿ  Ú&AssumeRoleWithWebIdentityProvider.loadt  s   € Ø×2Ñ2Ó4Ð4rK   c                 óØ   • U R                   cC  U R                  5       nUR                  S0 5      nUR                  U R                  0 5      U l         U R                   R                  U5      $ r5  )r	  r  rW   r  )ry   ÚkeyÚloaded_configr6  s       rH   Ú_get_profile_configÚ5AssumeRoleWithWebIdentityProvider._get_profile_configw  s^   € Ø×ÑÑ'Ø ×-Ñ-Ó/ˆMØ$×(Ñ(¨°RÓ8ˆHØ#+§<¡<°×0BÑ0BÀBÓ#GˆDÔ Ø×#Ñ#×'Ñ'¨Ó,Ð,rK   c                 óº   • U R                   (       a  g U R                  R                  U5      nU(       a'  U[        R                  ;   a  [        R                  U   $ g r1   )r
  Ú_CONFIG_TO_ENV_VARrW   r„  rT  )ry   r  Úenv_keys      rH   Ú_get_env_configÚ1AssumeRoleWithWebIdentityProvider._get_env_config~  sD   € Ø×!×!ØØ×)Ñ)×-Ñ-¨cÓ2ˆÞ�w¤"§*¡*Ó,Ü—:‘:˜gÑ&Ð&ØrK   c                 óÈ   • U R                  U5      nUb  U R                  R                  S5        U$ U R                  U5      nUb  U R                  R                  S5        U$ g )NÚ%CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKENÚ$CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN)r  r¹  rÍ  r  )ry   r  Ú	env_valueÚconfig_values       rH   Ú_get_configÚ-AssumeRoleWithWebIdentityProvider._get_config†  sg   € Ø×(Ñ(¨Ó-ˆ	ØÑ Ø×Ñ×!Ñ!Ð"IÔJØÐà×/Ñ/°Ó4ˆØÑ#Ø×Ñ×!Ñ!Ð"HÔIØÐàrK   c                 óì  • U R                  S5      nU(       d  g U R                  U5      nU R                  S5      nU(       d  Sn[        US9e0 nU R                  S5      nUb  XeS'   [        U R                  UUUU R
                  S9nU R                  R                  5       Ul        U R                  R                  S5        [        U R                  5        [        U R                  UR                  S	9$ )
Nr±  r«  zÜThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.rÕ  rÆ  r¤  )rM   rî  r«  r¬  rB   Ú"CREDENTIALS_STS_ASSUME_ROLE_WEB_IDrE  )r   r  r   rë  r¥  rB   r¹  rÌ  rx  rÍ  r    rg  r  rŽ  )ry   Ú
token_pathÚtoken_loaderr«  rV  r¬  rÆ  rH  s           rH   r  Ú@AssumeRoleWithWebIdentityProvider._assume_role_with_web_identity“  sø   € Ø×%Ñ%Ð&?Ó@ˆ
ÞØØ×-Ñ-¨jÓ9ˆà×#Ñ# JÓ/ˆÞðHð ô %¨yÑ9Ð9àˆ
Ø ×,Ñ,Ð-@ÓAÐØÑ(Ø,=Ð(Ñ)ä<Ø×/Ñ/Ø&2ØØ!Ø—*‘*ñ
ˆð #×/Ñ/×4Ñ4Ó6ˆÔà×Ñ×ÑÐBÔCÜ˜T×.Ñ.Ô/ô .Ø—;‘;Ø!×3Ñ3ñ
ð 	
rK   )r¥  r
  r¹  r  r	  r  r  rB   )NFN)r¯   r°   r±   r²   r  r  r  r|   rÿ  r  r  r   r  r´   rµ   rK   rH   rž   rž   W  sF   † Ø,€FØ€Nà#@Ø4Ø"ñÐð ØØô"ò(5ò-òòõ&
rK   rž   c                   ó8   • \ rS rSrS rS rS rS rS rS r	Sr
g	)
r_   i¼  c                 ó   • Xl         g r1   ©Ú
_providers©ry   rT   s     rH   r|   Ú'CanonicalNameCredentialSourcer.__init__½  s   € Ø#�rK   c                 ó\   • XR                    Vs/ s H  o"R                  PM     sn;   $ s  snf )a  Validates a given source name.

:type source_name: str
:param source_name: The value of credential_source in the config
    file. This is the canonical name of the credential provider.

:rtype: bool
:returns: True if the credential provider is supported,
    False otherwise.
)r*  r  )ry   Úsource_namer,  s      rH   rÛ  Ú+CanonicalNameCredentialSourcer.is_supportedÀ  s'   € ð ¿ºÓIº°A×/Ô/¹ÑIÑIÐIùÒIs   �)c                 óŽ   • U R                  U5      n[        U[        5      (       a  UR                  5       $ UR	                  5       $ )zíLoads source credentials based on the provided configuration.

:type source_name: str
:param source_name: The value of credential_source in the config
    file. This is the canonical name of the credential provider.

:rtype: Credentials
)Ú_get_providerr¾   re   r·   rÿ  )ry   r.  Úsources      rH   rÐ  Ú1CanonicalNameCredentialSourcer.source_credentialsÍ  s=   € ð ×#Ñ# KÓ0ˆÜ�fÔ0×1Ñ1Ø×*Ñ*Ó,Ð,Ø�{‰{‹}ÐrK   c                 ó²   • U R                  U5      nUR                  5       S;   a%  U R                  S5      nUb  Uc  U$ [        X2/5      $ Uc	  [	        US9eU$ )zóReturn a credential provider by its canonical name.

:type canonical_name: str
:param canonical_name: The canonical name of the provider.

:raises UnknownCredentialError: Raised if no
    credential provider by the provided name
    is found.
)ÚsharedconfigÚsharedcredentialsr°  ©Úname)Ú_get_provider_by_canonical_nameÚlowerÚ_get_provider_by_methodre   r   )ry   Úcanonical_namerU  rk   s       rH   r1  Ú,CanonicalNameCredentialSourcer._get_providerÛ  st   € ð ×7Ñ7¸ÓGˆð ×ÑÓ!Ð%JÓJØ#'×#?Ñ#?ÀÓ#NÐ Ø#Ñ/ð
 Ñ#Ø/Ð/ô
 *Ð+?Ð*JÓKÐKàÑÜ(¨nÑ=Ð=àˆrK   c                 ó    • U R                    H>  nUR                  nU(       d  M  UR                  5       UR                  5       :X  d  M<  Us  $    g)zƒReturn a credential provider by its canonical name.

This function is strict, it does not attempt to address
compatibility issues.
N)r*  r  r:  )ry   r<  rU  r8  s       rH   r9  Ú>CanonicalNameCredentialSourcer._get_provider_by_canonical_name  s=   € ð ŸœˆHØ×*Ñ*ˆDçˆt˜Ÿ
™
›¨×(<Ñ(<Ó(>Õ>Ø’ò	 (rK   c                 óR   • U R                    H  nUR                  U:X  d  M  Us  $    g)z0Return a credential provider by its METHOD name.N)r*  r  )ry   rï   rU  s      rH   r;  Ú6CanonicalNameCredentialSourcer._get_provider_by_method  s!   € àŸœˆHØ�‰ &Õ(Ø’ò (rK   r)  N)r¯   r°   r±   r²   r|   rÛ  rÐ  r1  r9  r;  r´   rµ   rK   rH   r_   r_   ¼  s"   † ò$òJòò$òL
 õ rK   r_   c                   óZ   • \ rS rSrSrSrSrSrSrSr	SS	 jr
S
 rS rS rS rS rS rSrg)rZ   i  zcontainer-roler³  Ú&AWS_CONTAINER_CREDENTIALS_RELATIVE_URIÚ"AWS_CONTAINER_CREDENTIALS_FULL_URIÚ!AWS_CONTAINER_AUTHORIZATION_TOKENÚ&AWS_CONTAINER_AUTHORIZATION_TOKEN_FILENc                 ó\   • Uc  [         R                  nUc
  [        5       nXl        X l        g r1   )r„  rT  r"   rs  Ú_fetcher)ry   rT  rH  s      rH   r|   ÚContainerProvider.__init__  s'   € Ø‰?Ü—j‘jˆGØ‰?Ü.Ó0ˆGØŒØ�rK   c                 óŒ   • U R                   U R                  ;   d  U R                  U R                  ;   a  U R                  5       $ g r1   )ÚENV_VARrs  ÚENV_VAR_FULLÚ_retrieve_or_failrŠ   s    rH   rÿ  ÚContainerProvider.load$  s:   € ð �<‰<˜4Ÿ=™=Ó(¨D×,=Ñ,=ÀÇÁÓ,NØ×)Ñ)Ó+Ð+ð -OrK   c                 ón  • U R                  5       (       a3  U R                  R                  U R                  U R                     5      nOU R                  U R
                     nU R                  U5      nU" 5       n[        US   US   US   U R                  [        US   5      UUR                  S5      S9$ )Nr-   r.   r/   rÕ   r0   )r-   r.   r/   rï   rÕ   r  r0   )Ú_provided_relative_urirH  Úfull_urlrs  rK  rL  Ú_create_fetcherr  r  rÀ   rW   )ry   Úfull_urirH  r•  s       rH   rM  Ú#ContainerProvider._retrieve_or_fail*  s¤   € Ø×&Ñ&×(Ñ(Ø—}‘}×-Ñ-¨d¯m©m¸D¿L¹LÑ.IÓJ‰Hà—}‘} T×%6Ñ%6Ñ7ˆHØ×&Ñ& xÓ0ˆÙ“	ˆÜ%Ø˜\Ñ*Ø˜\Ñ*Ø˜‘.Ø—;‘;Ü(¨¨}Ñ)=Ó>Ø!Ø—y‘y Ó.ñ
ð 	
rK   c                 óp  • S nU R                   U R                  ;   a>  U R                  U R                      n[        U5       nUR                  5       nS S S 5        O3U R                  U R                  ;   a  U R                  U R                     nUb  U R                  U5        SU0$ g ! , (       d  f       N'= f)NÚAuthorization)ÚENV_VAR_AUTH_TOKEN_FILErs  ÚopenÚreadÚENV_VAR_AUTH_TOKENÚ_validate_auth_token)ry   Ú
auth_tokenÚauth_token_file_pathÚ
token_files       rH   Ú_build_headersÚ ContainerProvider._build_headers;  s    € Øˆ
Ø×'Ñ'¨4¯=©=Ó8Ø#'§=¡=°×1MÑ1MÑ#NÐ ÜÐ*Ô+¨zØ'Ÿ_™_Ó.�
÷ ,Ð+à×$Ñ$¨¯©Ó5ØŸ™ t×'>Ñ'>Ñ?ˆJØÑ!Ø×%Ñ% jÔ1Ø# ZÐ0Ð0ð "÷	 ,Õ+ús   ÁB'Â'
B5c                 ó2   • SU;   d  SU;   a  [        S5      eg )NÚÚ
z,Auth token value is not a legal header value)rÖ  )ry   r\  s     rH   r[  Ú&ContainerProvider._validate_auth_tokenG  s"   € Ø�:Ó ¨Ó!3ÜÐKÓLÐLð "4rK   c                 ó   ^ ^• UU 4S jnU$ )Nc                  ó>  >•  TR                  5       n TR                  R                  TU S9n[        S5        US   US   US	   US
   UR                  S5      S.$ ! [         a7  n[
        R                  SUSS9  [        TR                  [        U5      S9eS nAff = f)N)Úheadersr²  z'Error retrieving container metadata: %sTrF  rT  rÐ   rÑ   ÚTokenrÓ   r‘  r’  )r_  rH  Úretrieve_full_urir   r   rc   rd   r   r  rý  rW   )rg  r×   r/  rS  ry   s      €€rH   Úfetch_credsÚ6ContainerProvider._create_fetcher.<locals>.fetch_credsL  s¾   ø€ ðØ×-Ñ-Ó/�ØŸ=™=×:Ñ:Ø gð ;ð �ô $Ð$6Ô7ð ' }Ñ5Ø&Ð'8Ñ9Ø! 'Ñ*Ø'¨Ñ5Ø&Ÿl™l¨;Ó7ñð øô *ó Ü—‘Ø=¸qÈ4ð ñ ô /Ø!Ÿ[™[´C¸³Fñð ûð	ús   ƒ5A Á
BÁ%2BÂBrµ   )ry   rS  r½  rÊ   rj  s   ``   rH   rR  Ú!ContainerProvider._create_fetcherK  s   ù€ ö	ð, ÐrK   c                 ó4   • U R                   U R                  ;   $ r1   )rK  rs  rŠ   s    rH   rP  Ú(ContainerProvider._provided_relative_urid  s   € Ø�|‰|˜tŸ}™}Ñ,Ð,rK   )rs  rH  r`  )r¯   r°   r±   r²   r  r  rK  rL  rZ  rW  r|   rÿ  rM  r_  r[  rR  rP  r´   rµ   rK   rH   rZ   rZ     sF   † Ø€FØ#€NØ6€GØ7€LØ<ÐØFÐô ò,ò
ò"
1òMòõ2-rK   rZ   c                   ó>   • \ rS rSrS rS rS rS rS rS r	S r
S	rg
)re   ih  c                 ó   • Xl         g)zA

:param providers: A list of ``CredentialProvider`` instances.

NrS   r+  s     rH   r|   ÚCredentialResolver.__init__i  s	   € ð #�rK   c                 óÞ   •  U R                    Vs/ s H  o3R                  PM     snR                  U5      nU R                   R                  XB5        gs  snf ! [         a
    [	        US9ef = f)aí  
Inserts a new instance of ``CredentialProvider`` into the chain that
will be tried before an existing one.

:param name: The short name of the credentials you'd like to insert the
    new credentials before. (ex. ``env`` or ``config``). Existing names
    & ordering can be discovered via ``self.available_methods``.
:type name: string

:param cred_instance: An instance of the new ``Credentials`` object
    you'd like to add to the chain.
:type cred_instance: A subclass of ``Credentials``
r7  N)rT   r  ÚindexrÖ  r   Úinsert)ry   r8  Úcredential_providerr,  Úoffsets        rH   Úinsert_beforeÚ CredentialResolver.insert_beforeq  s_   € ð	4Ø(,¯ªÓ7ª 1—h”h©Ñ7×=Ñ=¸dÓCˆFð 	�‰×Ñ˜fÕ:ùò 8øÜó 	4Ü(¨dÑ3Ð3ð	4ús   ‚A �A¥A ÁA ÁA,c                 ód   • U R                  U5      nU R                  R                  US-   U5        g)aé  
Inserts a new type of ``Credentials`` instance into the chain that will
be tried after an existing one.

:param name: The short name of the credentials you'd like to insert the
    new credentials after. (ex. ``env`` or ``config``). Existing names
    & ordering can be discovered via ``self.available_methods``.
:type name: string

:param cred_instance: An instance of the new ``Credentials`` object
    you'd like to add to the chain.
:type cred_instance: A subclass of ``Credentials``
r$  N)Ú_get_provider_offsetrT   rt  )ry   r8  ru  rv  s       rH   Úinsert_afterÚCredentialResolver.insert_after…  s-   € ð ×*Ñ*¨4Ó0ˆØ�‰×Ñ˜f q™jÐ*=Õ>rK   c                 ó¼   • U R                    Vs/ s H  o"R                  PM     nnX;  a  gUR                  U5      nU R                   R                  U5        gs  snf )z‘
Removes a given ``Credentials`` instance from the chain.

:param name: The short name of the credentials instance to remove.
:type name: string
N)rT   r  rs  Úpop)ry   r8  r,  Úavailable_methodsrv  s        rH   rb   ÚCredentialResolver.remove–  sO   € ð 04¯~ª~Ó>ª~¨!ŸXœX©~ÐÐ>ØÓ(àà"×(Ñ(¨Ó.ˆØ�‰×Ñ˜6Õ"ùò ?s   �Ac                 ó>   • U R                   U R                  U5         $ )zÇReturn a credential provider by name.

:type name: str
:param name: The name of the provider.

:raises UnknownCredentialError: Raised if no
    credential provider by the provided name
    is found.
)rT   rz  )ry   r8  s     rH   Úget_providerÚCredentialResolver.get_provider¥  s   € ð �~‰~˜d×7Ñ7¸Ó=Ñ>Ð>rK   c                 ó¦   •  U R                    Vs/ s H  o"R                  PM     snR                  U5      $ s  snf ! [         a
    [	        US9ef = f)Nr7  )rT   r  rs  rÖ  r   )ry   r8  r,  s      rH   rz  Ú'CredentialResolver._get_provider_offset±  sJ   € ð	4Ø&*§n¢nÓ5¢n —H”H¡nÑ5×;Ñ;¸DÓAÐAùÒ5øÜó 	4Ü(¨dÑ3Ð3ð	4ús   ‚< �7¥< ·< ¼Ac                 ó˜   • U R                    H:  n[        R                  SUR                  5        UR	                  5       nUc  M8  Us  $    g)z_
Goes through the credentials chain, returning the first ``Credentials``
that could be loaded.
zLooking for credentials via: %sN)rT   rc   rd   r  rÿ  )ry   rU  r•  s      rH   r·   Ú#CredentialResolver.load_credentials·  s@   € ð ŸœˆHÜ�L‰LÐ:¸H¿O¹OÔLØ—M‘M“OˆEØÓ Ø’ñ	 'ð rK   rS   N)r¯   r°   r±   r²   r|   rw  r{  rb   r‚  rz  r·   r´   rµ   rK   rH   re   re   h  s%   † ò#ò;ò(?ò"#ò
?ò4õrK   re   c                   óN   ^ • \ rS rSrSrSSSSS\4U 4S jjrS rS rS r	Sr
U =r$ )	ÚSSOCredentialFetcheriÌ  ú%Y-%m-%dT%H:%M:%SZNc                 ó�   >• XPl         X l        X0l        X@l        Xl        X`l        X�l        X l        X°l        [        TU ])  Xx5        g r1   )r¥  Ú_sso_regionÚ
_role_namer
  Ú
_start_urlÚ_token_loaderÚ_token_providerÚ_sso_session_namer  rk  r|   )ry   Ú	start_urlÚ
sso_regionrD  r0   rM   r%  rB   ry  r¤   Ússo_session_namer  rl  s               €rH   r|   ÚSSOCredentialFetcher.__init__Ï  sF   ø€ ð  .ÔØ%ÔØ#ŒØ%ÔØ#ŒØ)ÔØ-ÔØ!1ÔØ)ÔÜ‰Ñ˜Õ6rK   c                 ó2  • U R                   U R                  S.nU R                  (       a  U R                  US'   OU R                  US'   [        R
                  " USSS9n[        UR                  S5      5      R                  5       nU R                  U5      $ )r³  )ÚroleNameÚ	accountIdÚsessionNameÚstartUrlT©Ú,r€  )rµ  Ú
separatorsr¶  )
r�  r
  r‘  rŽ  r·  r¹  r   rº  r»  r‡  r¼  s      rH   rs  Ú&SSOCredentialFetcher._create_cache_keyè  s…   € ð Ÿ™Ø×)Ñ)ñ
ˆð ×!×!Ø"&×"8Ñ"8ˆD�Òà#Ÿ™ˆD�Ñô �zŠz˜$¨$¸:ÑFˆÜ˜TŸ[™[¨Ó1Ó2×<Ñ<Ó>ˆØ×#Ñ# MÓ2Ð2rK   c                 ó’   • US-  n[         R                   R                  U[        5       5      nUR                  U R                  5      $ )Ng     @�@)rº   Úfromtimestampr
   rÃ   Ú_UTC_DATE_FORMAT)ry   Útimestamp_msÚtimestamp_secondsÚ	timestamps       rH   Ú_parse_timestampÚ%SSOCredentialFetcher._parse_timestampþ  s?   € à(¨6Ñ1ÐÜ×%Ñ%×3Ñ3Ð4EÄuÃwÓOˆ	Ø×!Ñ! $×"7Ñ"7Ó8Ð8rK   c                 óú  • [        [        U R                  S9nU R                  SUS9nU R                  (       a5  U R                  R                  5       nUR                  5       R                  nOmU R                  U R                  5      nUS   n[        R                  R                  US   5      n[        X`R                  5       -
  5      nUS::  a
  [        5       eU R                   U R"                  US.n [%        U R&                  5        UR(                  " S0 UD6n	U	S   n
SU
S	   U
S
   U
S   U R/                  U
S   5      U R"                  S.S.n
U
$ ! UR*                  R,                   a    [        5       ef = f)z4Get credentials by calling SSO get role credentials.)rò  rC   Ússoró  ÚaccessTokenÚ	expiresAtr   )r—  r˜  r©  ÚroleCredentialsÚaccessKeyIdÚsecretAccessKeyÚsessionTokenr–  )rÐ   rÑ   rÒ   rÓ   r‘  )ÚProviderTyperÏ   rµ   )r   r   rŒ  r¥  r�  Ú
load_tokenÚget_frozen_tokenr/   r�  rŽ  Údateutilru  r   r   r  r   r�  r
  r    rx  Úget_role_credentialsÚ
exceptionsÚUnauthorizedExceptionr¥  )ry   r@   rÙ   Úinitial_token_datar/   Ú
token_dictr–  Ú	remainingrÊ   r×   rØ   s              rH   rŠ  Ú%SSOCredentialFetcher._get_credentials	  sƒ  € äÜ&Ø×(Ñ(ñ
ˆð ×%Ñ% e°FÐ%Ð;ˆØ××Ø!%×!5Ñ!5×!@Ñ!@Ó!BÐØ&×7Ñ7Ó9×?Ñ?‰Eà×+Ñ+¨D¯O©OÓ<ˆJØ˜}Ñ-ˆEô
 "Ÿ™×.Ñ.¨z¸+Ñ/FÓGˆJÜ% j×3EÑ3EÓ3GÑ&GÓHˆIØ˜A‹~Ü/Ó1Ð1ð Ÿ™Ø×)Ñ)Ø ñ
ˆð
	.Ü  ×!1Ñ!1Ô2Ø×2Ò2Ñ<°VÑ<ˆHð Ð0Ñ1ˆð "à*¨=Ñ9Ø#.Ð/@Ñ#AØ +¨NÑ ;Ø"×3Ñ3°KÀÑ4MÓNØ!×-Ñ-ññ	
ˆð Ðøð × Ñ ×6Ñ6ó 	.Ü+Ó-Ð-ð	.ús   Ã7'E Å%E:)	r
  r¥  r�  rŒ  r‘  rŽ  r  r�  r�  )r¯   r°   r±   r²   r¡  r¼   r|   rs  r¥  rŠ  r´   rn  ro  s   @rH   r‰  r‰  Ì  s6   ø† Ø+Ðð ØØ"ØØØ÷7ò23ò,9÷,ð ,rK   r‰  c                   óº   • \ rS rSrSr\R                  R                  \R                  R                  SSSS5      5      r	Sr
Sr\
\-   r   SS	 jrS
 rS rS rSrg)r¥   i3	  r¨  Ú~z.awsrB   )Ússo_role_nameÚsso_account_id)Ússo_start_urlr“  Nc                 ó¤   • Uc  [        U R                  5      nXPl        X`l        Uc  0 nX@l        Xl        X l        X0l        [        5       U l	        g r1   )
r%   Ú_SSO_TOKEN_CACHE_DIRÚ_token_cacher�  rB   r  r¥  r  rw  r¹  )ry   rL   rM   rN   rB   r£   r¤   s          rH   r|   ÚSSOProvider.__init__E	  sQ   € ð ÑÜ'¨×(AÑ(AÓBˆKØ'ÔØ-ÔØ‰=ØˆEØŒ
Ø'ÔØ-ÔØ)ÔÜ›EˆÕrK   c                 óô  ^• U R                  5       nUR                  S0 5      nU R                  nUR                  U R                  0 5      mUR                  S0 5      n[        U4S jU R                   5       5      (       a  g U R                  TU5      u  pV0 n/ nU R                  U-   n	U	 H!  n
X¥;   a  XZ   Xz'   M  UR                  U
5        M#     U(       a   SR                  U5      n[        SU SU 3S9eU$ )Nr6  Ússo_sessionsc              3   ó,   >#   • U  H	  oT;  v •  M     g 7fr1   rµ   )rê  Úcr2  s     €rH   rì  Ú/SSOProvider._load_sso_config.<locals>.<genexpr>b	  s   øé € ð 
Ú-O¨�^Ö#Ò-Oùrî  rS  rÔ  zB" is configured to use SSO but is missing required configuration: rÕ  )
r  rW   r  ÚallÚ_PROFILE_REQUIRED_CONFIG_VARSÚ_resolve_sso_session_referenceÚ_ALL_REQUIRED_CONFIG_VARSr  rW  r   )ry   r  r6  rN   rÄ  Úresolved_configÚ
extra_reqsr@   Úmissing_config_varsÚall_required_configsÚ
config_varÚmissingr2  s               @rH   Ú_load_sso_configÚSSOProvider._load_sso_configZ	  s  ø€ Ø×)Ñ)Ó+ˆØ ×$Ñ$ Z°Ó4ˆØ×)Ñ)ˆØ!Ÿ™ d×&8Ñ&8¸"Ó=ˆØ$×(Ñ(¨¸Ó<ˆô ô 
Ø-1×-OÒ-Oó
÷ 
ñ 
ð à&*×&IÑ&IØ˜Ló'
Ñ#ˆð ˆØ ÐØ#×=Ñ=À
ÑJÐÛ.ˆJØÓ,Ø%4Ñ%@�Ó"à#×*Ñ*¨:Ö6ñ	 /ö Ø—i‘iÐ 3Ó4ˆGÜ$à# L >ð 2>Ø>E¸YðHñð ð ˆrK   c                 ó  • UR                  S5      nUc  US4$ X2;  a  SU S3n[        US9eUR                  5       nX#   nUR                  5        H5  u  pxUR                  Xx5      U:w  a  SU SXW    SU S	3n[        US9eX…U'   M7     US
4$ )NÚsso_sessionrµ   z+The specified sso-session does not exist: "Ú"rÕ  zThe value for z" is inconsistent between profile (z) and sso-session (z).)rÕ  )rW   r   rÌ  Úitems)	ry   r2  rÄ  r”  rV  r@   rG   rÐ  Úvals	            rH   rÊ  Ú*SSOProvider._resolve_sso_session_reference~	  sË   € Ø)×-Ñ-¨mÓ<ÐØÑ#à! 2Ð%Ð%àÓ/ØEÐFVÐEWÐWXÐYˆIÜ$¨yÑ9Ð9à×$Ñ$Ó&ˆØÑ0ˆØ&Ÿ}™}ž‰OˆJà�z‰z˜*Ó*¨cÓ1à$ Z Lð 1 Ø &Ñ 2Ð3Ð3FÀsÀeÈ2ðOð ô )°9Ñ=Ð=Ø!$�:Óñ  /ð Ð'Ð'Ð'rK   c           	      ó’  • U R                  5       nU(       d  g US   US   US   US   U R                  [        U R                  S9U R                  S.nSU;   nU(       a3  US   US'   U R
                  US	'   U R                  R                  S
5        OU R                  R                  S5        [        S0 UD6nU R                  R                  5       Ul
        U(       a  U R                  R                  S5        OU R                  R                  S5        [        U R                  5        [        U R                  UR                  S9$ )Nr¾  r“  r¼  r½  )rB   )r’  r“  rD  r0   rM   r%  rB   rÕ  r”  r¤   ÚCREDENTIALS_PROFILE_SSOÚCREDENTIALS_PROFILE_SSO_LEGACYÚCREDENTIALS_SSOÚCREDENTIALS_SSO_LEGACYrE  rµ   )rÒ  r¥  r'   rÁ  rB   r�  r¹  rÍ  r‰  rÌ  rx  r    rg  r  rŽ  )ry   Ú
sso_configÚfetcher_kwargsÚsso_session_in_configÚsso_fetchers        rH   rÿ  ÚSSOProvider.load•	  s5  € Ø×*Ñ*Ó,ˆ
ÞØð $ OÑ4Ø$ \Ñ2Ø# OÑ4Ø$Ð%5Ñ6Ø"×2Ñ2Ü*°×1BÑ1BÑCØ—Z‘Zñ
ˆð !.°Ñ ;ÐÞ Ø1;¸MÑ1JˆNÐ-Ñ.Ø/3×/CÑ/CˆNÐ+Ñ,Ø×Ñ×!Ñ!Ð";Õ<à×Ñ×!Ñ!Ð"BÔCä*Ñ<¨^Ñ<ˆØ"&×"3Ñ"3×"8Ñ"8Ó":ˆÔæ Ø×Ñ×!Ñ!Ð"3Õ4à×Ñ×!Ñ!Ð":Ô;ä˜T×.Ñ.Ô/Ü-Ø—;‘;Ø%×7Ñ7ñ
ð 	
rK   )r¥  r¹  r  r  rÁ  r�  rB   r  )r¯   r°   r±   r²   r  r„  ry  rz  rW  rÀ  rÉ  Ú_SSO_REQUIRED_CONFIG_VARSrË  r|   rÒ  rÊ  rÿ  r´   rµ   rK   rH   r¥   r¥   3	  sr   † Ø€FàŸ7™7×-Ñ-Ø
�‰�‰�S˜& %¨Ó1óÐð%Ð!ð!Ðð
 	&Ð(AÑAð ð ØØô"ò*"òH(õ."
rK   r¥   c                 ój   • [         R                  " U 5      R                  S5      R                  S5      $ )Nó   =Úascii)Úbase64Úurlsafe_b64encodeÚrstripr)  )rX  s    rH   Ú_base64_url_encode_no_paddingrë  º	  s)   € Ü×#Ò# DÓ)×0Ñ0°Ó6×=Ñ=¸gÓFÐFrK   c                 ó¤  • [         c	  [        SS9eU R                  5       u  pES[        U5      [        U5      SS.nSSUS.nS	UU=(       d    [	        [
        R
                  " 5       5      U=(       d    [        [        R                  " 5       5      S
.n[        [        R                  " USS9R                  5       5      n	[        [        R                  " USS9R                  5       5      n
U	 SU
 3R                  5       nU R                  [        U5      R                  5       5      n[         R                  " USS9n[        U5      nU	 SU
 SU 3$ )NzqThis operation requires an additional dependency. You will need to pip install "botocore[crt]" before proceeding.©rM  r   zP-256)ÚktyÚxÚyÚcrvzdpop+jwtÚES256)ÚtypÚalgÚjwkÚPOST)ÚhtmÚhtuÚiatÚjtir›  )r�  Ú.é    )Úpad_to)r   r   Úget_public_coordsrë  r¯  r°  rý  ÚuuidÚuuid4r·  r¹  rº  Úsignr   ÚdigestÚ#decode_der_signature_to_padded_pair)Úprivate_keyÚuriÚuidÚtsrï  rð  rõ  ÚheaderÚpayloadÚ
header_b64Úpayload_b64Úsigning_inputÚ	signatureÚsignature_bytesÚsignature_b64s                  rH   Ú_build_dpop_headerr  ¾	  sG  € Ü	�zÜ(ðQñ
ð 	
ð ×(Ñ(Ó*�D€AàÜ*¨1Ó-Ü*¨1Ó-Øñ	€Cð ØØñ€Fð ØØ×%”SœŸš›Ó%Ø×'”cœ$Ÿ*š*›,Ó'ñ	€Gô /Ü�
Š
�6 jÑ1×8Ñ8Ó:ó€Jô 0Ü�
Š
�7 zÑ2×9Ñ9Ó;ó€Kð "�l ! K =Ð1×8Ñ8Ó:€MØ× Ñ ¤¨Ó!6×!=Ñ!=Ó!?Ó@€IÜ×<Ò<Ø˜"ñ€Oô 2°/ÓB€Màˆ\˜˜;˜- q¨¨Ð8Ð8rK   c                 ó   ^ • U 4S jnU$ )zHBuilds a before-call handler for calculating and setting the DPoP headerc                  ó<   >• [        TU S   S   5      U S   S   S'   g )NrÚ   Úurlrg  ÚDPoP)r  )rÊ   r  s    €rH   Ú_add_dpop_header_handlerÚ@_build_add_dpop_header_handler.<locals>._add_dpop_header_handlerí	  s+   ø€ Ü.@Ø˜ Ñ)¨%Ñ0ó/
ˆˆxÑ˜Ñ# FÒ+rK   rµ   )r  r  s   ` rH   Ú_build_add_dpop_header_handlerr  ê	  s   ø€ õ
ð
 $Ð#rK   c                   óZ   • \ rS rSrSrSrSr\S4S jrS r	S r
\S	 5       r\S
 5       rSrg)ÚLoginCredentialFetcheriõ	  zb
Converts login access tokens from the cached token to
credentials, and supports refreshing them.
i,  )r©  ÚrefreshTokenÚdpopKeyÚclientIdNc                 óZ   • Xl         X l        X0l        X@l        Uc
  [	        5       nXPl        g r1   )Ú_session_namer�  r¥  r  rw  rx  )ry   Úsession_namer%  rM   r  rx  s         rH   r|   ÚLoginCredentialFetcher.__init__
  s/   € ð *ÔØ)ÔØ-ÔØ)ÔØÑÜ›%ˆKØ&ÕrK   c                 ó8  • U R                   R                  U R                  5      nUc  [        SU R                   S3S9eU R                   Vs/ s H  o"U;  d  M
  UPM     nnU(       a  [        SSR                  U5       S3S9eU R                  U5      $ s  snf )z7Loads cached credentials without checking their expiry.z4Unable to load a existing login session for session z). Please reauthenticate with 'aws login'.rÕ  zGFailed to load access token from token cache, missing required fields: rS  rû  )r�  r°  r  r   Ú_REQUIRED_TOKEN_FIELDSrW  Ú_token_to_credentials)ry   r/   r  Úmissing_fieldss       rH   Úload_cached_credentialsÚ.LoginCredentialFetcher.load_cached_credentials
  s»   € à×"Ñ"×-Ñ-¨d×.@Ñ.@ÓAˆà‰=Ü%ØPØ×%Ñ%Ð&ð 'ðñð ð  ×6Ò6ó
Ú6�CÀUÑ:J�CÑ6ð 	ð 
ö Ü%ØcÐdh×dmÑdmÐn|Ód}Ðc~Ð~ð  Añð ð ×)Ñ)¨%Ó0Ð0ùò
s   Á	BÁBc           	      ó  • U R                   (       a  [        U R                   5        U R                  R                  U R                  5      nU R                  U5      nU(       a[  SU;   aU  SUS   ;   aL  [        US   S   5      n[        X0R                  5       -
  5      nX@R                  :”  a  U R                  U5      $ [        R                  R                  [        R                  S9nU R                  SUS9nUR                   R"                  R%                  S['        U5      5         UR)                  US   US   S	S
.S9nUb  SU;  a	  [9        SS9eUR1                  S5      n
U R                  5       R;                  [=        5       5      [>        R@                  " U
S   S9-   nURC                  U
S   S   U
S   S   U
S   S   US   S   URE                  S5      S.U
S   S.5        U R                  RG                  U R                  U5        U R                  U5      $ ! UR*                  R,                   aN  nUR.                  R1                  SS5      n	U	S;   a  [3        5       UeU	S:X  a  [5        5       Ue[7        5       UeSnAff = f)z@Refreshes login credentials, including saving them to the cache.r©  rª  rñ  Úsigninró  z$before-call.signin.CreateOAuth2Tokenr  r  Úrefresh_token)r  r  Ú	grantType)Ú
tokenInputÚerrorrb  )ÚTOKEN_EXPIREDÚUSER_CREDENTIALS_CHANGEDÚINSUFFICIENT_PERMISSIONSNÚtokenOutputz°Unable to refresh access token due to an invalid service response. Please try running 'aws login' again. If the issue persists, there may be a temporary signin service problem.rÕ  Ú	expiresIn)rž  r¬  r­  r®  r˜  rŠ  )r¬  r­  r®  r˜  rª  )r©  r  )$rx  r    r�  r°  r  Ú_load_private_keyrÀ   r   r  Ú_REFRESH_THRESHOLDr#  ró   r@   r   r   r¥  ÚmetaÚeventsÚregisterr  Úcreate_o_auth2_tokenr´  ÚAccessDeniedExceptionr×   rW   r   r   r   r   Ú
astimezoner
   rº   Ú	timedeltarÈ   rÃ   Ú
save_token)ry   r/   r  rÕ   Úremaining_timer@   rÙ   r×   r/  Ú
error_typeÚoutputÚexpires_timestamps               rH   Úrefresh_credentialsÚ*LoginCredentialFetcher.refresh_credentials(
  s§  € à××Ü  ×!1Ñ!1Ô2à×"Ñ"×-Ñ-¨d×.@Ñ.@ÓAˆØ×,Ñ,¨UÓ3ˆö Ø Ó&Ø˜u ]Ñ3Ó3ä*¨5°Ñ+?ÀÑ+LÓMˆKÜ*¨;×9KÑ9KÓ9MÑ+MÓNˆNØ× 7Ñ 7Ó7Ø×1Ñ1°%Ó8Ð8ä—‘×'Ñ'Ü&×/Ñ/ð (ð 
ˆð ×%Ñ%ØØð &ð 
ˆð
 	�‰×Ñ×#Ñ#Ø2Ü*¨;Ó7ô	
ð
	&Ø×2Ñ2à % jÑ 1Ø$)¨.Ñ$9Ø!0ñð 3ð ˆHð Ñ˜}°HÓ<Ü%ðAñð ð —‘˜mÓ,ˆà ×.Ñ.Ó0×;Ñ;Ü‹Gó
ä×Ò v¨kÑ':Ñ;ñ<Ðð
 	�‰ð $*¨-Ñ#8¸Ñ#GØ'-¨mÑ'<Ø)ñ(ð %+¨=Ñ$9¸.Ñ$IØ!& }Ñ!5°kÑ!BØ!2×!;Ñ!;Ø,ó"ñ
 ð !' ~Ñ 6ñô	
ð  	×Ñ×%Ñ% d×&8Ñ&8¸%Ô@à×)Ñ)¨%Ó0Ð0øðU × Ñ ×6Ñ6ó 	&ØŸ™Ÿ™¨°Ó4ˆJØÐJÓJÜ*Ó,°!Ð3ØÐ9Ó9Ü2Ó4¸!Ð;Ü“, AÐ%ûð	&ús   Ä*H  È JÈ:A	JÊJc                 óN   • U S   S   U S   S   U S   S   U S   S   U S   S   S.$ )Nr©  r¬  r­  r®  rª  r˜  r’  rµ   )r/   s    rH   r#  Ú,LoginCredentialFetcher._token_to_credentials|
  sP   € ð   Ñ.¨}Ñ=Ø Ñ.Ð/@ÑAØ˜=Ñ)¨.Ñ9Ø  Ñ/°Ñ<Ø Ñ.¨{Ñ;ñ
ð 	
rK   c                 ó   • SU ;  a	  [        SS9eU S   R                  5       nU Vs/ s H5  nUR                  S5      (       a  M  UR                  S5      (       a  M3  UPM7     nnSR                  U5      R	                  5       n [
        R                  " [        R                  " U5      5      $ s  snf ! [         a  n[        SS9UeS nAff = f)Nr  z&Private key not found in cached token.rÕ  z
-----BEGINz-----ENDrb  z-Unable to load private key from cached token.)
r   Ú
splitlinesÚ
startswithrW  Ústripr   Únew_key_from_der_datarè  Ú	b64decoderÖ  )r/   ÚlinesÚlineÚcontent_linesÚcontentsr/  s         rH   r2  Ú(LoginCredentialFetcher._load_private_key†
  sÔ   € à˜EÓ!Ü%ØBñð ð
 �iÑ ×+Ñ+Ó-ˆñ ó
â�Ø—?‘? <×0ó ð —O‘O J×/÷ Ùð 	ð 
ð —7‘7˜=Ó)×/Ñ/Ó1ˆð	Ü×+Ò+¬F×,<Ò,<¸XÓ,FÓGÐGùò
øô ó 	Ü%ØIñàðûð	ús)   §B/ÁB/ÁB/Â)B4 Â4
CÂ>
CÃC)r¥  r  r  r�  rx  )r¯   r°   r±   r²   r³   r3  r"  r¼   r|   r%  r@  re  r#  r2  r´   rµ   rK   rH   r  r  õ	  sX   † ñð
  ÐðÐð  Øô'ò 1ò*R1ðh ñ
ó ð
ð ñó órK   r  c                   ó8   ^ • \ rS rSrSr SU 4S jjrS rSrU =r$ )r«   i¡
  Úloginc                 ó�   >• [         TU ]  5         Uc  [        [        5       5      nX@l        Xl        X l        X0l        SS1U l        g )NÚCREDENTIALS_PROFILE_LOGINÚCREDENTIALS_LOGIN)	rk  r|   r%   r)   rÁ  r  r¥  r  r¹  )ry   rL   rM   rN   r£   rl  s        €rH   r|   ÚLoginProvider.__init__¤
  sJ   ø€ ô 	‰ÑÔØÑÜ'Ô(GÓ(IÓJˆKØ'Ôà'ÔØ-ÔØ)ÔØ8Ð:MÐNˆÕrK   c                 óì  • U R                  5       nUR                  S0 5      nUR                  U R                  0 5      nSU;  a  g [        c	  [	        SS9e[        US   [        U R                  5      U R                  [        U R                  S9n[        U R                  5        UR                  5       n[        US   US   US   [        US	   5      US
   U R                  UR                   [        S9$ )Nr6  Úlogin_sessionz†Using the login credential provider requires an additional dependency. You will need to pip install "botocore[crt]" before proceeding.rí  )r  r%  rM   r  rx  r-   r.   r/   rÕ   r0   )r-   r.   r/   rÕ   r0   rï   r  r  )r  rW   r  r   r   r  r&   rÁ  r¥  r¼   r¹  r    r%  r  rÀ   r  r@  )ry   r  r6  r2  rH  Úcached_credentialss         rH   rÿ  ÚLoginProvider.loadµ
  s   € Ø×)Ñ)Ó+ˆØ ×$Ñ$ Z°Ó4ˆØ!Ÿ™ d×&8Ñ&8¸"Ó=ˆà .Ó0Øä‰:Ü,ð;ñð ô )Ø'¨Ñ8Ü)¨$×*;Ñ*;Ó<Ø×/Ñ/Ü#Ø×)Ñ)ñ
ˆô 	˜T×.Ñ.Ô/ð %×<Ñ<Ó>Ðä%Ø)¨,Ñ7Ø)¨,Ñ7Ø$ WÑ-Ü(Ð);¸MÑ)JÓKØ)¨,Ñ7Ø—;‘;Ø!×5Ñ5Ü#ñ	
ð 		
rK   )r¥  r¹  r  r  rÁ  r1   )	r¯   r°   r±   r²   r  r|   rÿ  r´   rn  ro  s   @rH   r«   r«   ¡
  s   ø† Ø€Fð ÷O÷"(
ð (
rK   r«   r`  r®   )jrè  rº   rÏ  r·  Úloggingr„  r%  r  r°  rÿ  Úcollectionsr   rÌ  r   Úhashlibr   r   Údateutil.parserr²  r   Údateutil.tzr	   r
   Úbotocore.compatró   Úbotocore.configloaderr   r   r   r   Úbotocore.configr   Úbotocore.exceptionsr   r   r   r   r   r   r   r   r   r   r   r   r   r   Úbotocore.tokensr   Úbotocore.useragentr   r    Úbotocore.utilsr!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   Ú	getLoggerr¯   rc   r,   ra  rX   rp   r\   r¸   r¼   rÀ   rÅ   r^   rÝ   rë   rÏ   r  rg  rq  r¡  rÊ  rë  rû  r�   r[   rY   r`   r“   r™   ra   r]   rž   r_   rZ   re   r‰  r¥   rë  r  r  r  r«   rµ   rK   rH   Ú<module>rf     sW  ðó Û Û Û Û Û 	Û Û Û Û Ý "Ý ß  ã Ý !ß &ã Û Ý ÷ñ õ
 #÷÷ ÷ ÷ õ  -ß H÷÷ ÷ ñ ð 
×	Ò	˜8Ó	$€Ù ØÚ7ØñÐ ð &-Ð "Ø$+Ð !ô]÷@Y
ñ Y
òx'ò
,òôòòò &÷$-ñ -ô`v(˜[ô v(ôr	2Ð%;ô 2÷0F5ñ F5ôR;PÐ&=ô ;Pô|Z
Ð"Aô Z
ôzC"Ø#ôC"÷L+ñ +ô\SGÐ(ô SGôlÐ1ô ô<L!Ð$ô L!ô^ Ð,ô  ôF5+Ð1ô 5+ôpC+Ð'ô C+ôL+Ð%ô +ô\UÐ+ô Uôp
b
Ð(:ô b
÷JU ñ U ôpQ-Ð*ô Q-÷hañ aôHdÐ2ô dôND
Ð$ô D
òNGô)9òX$÷iñ iôX<
Ð&õ <
rK   