Ë
    "ïàjð  ã                   ó®   — d Z ddlZddlZddlmZ ddlmZ dZ ej                  e	«      Z
	 ddlZ G d„ de«      Zy# e$ r e
j                  d«       ‚ w xY w)	a  
Implementation of a domain controller that allows users to authenticate against
a Pluggable Authentication Module ('PAM').

Used by HTTPAuthenticator. Only available on linux and macOS.

See https://wsgidav.readthedocs.io/en/latest/user_guide_configure.html
é    N)Úutil)ÚBaseDomainControllerÚreStructuredTextzHpam_dc requires the `python-pam` module. Try `pip install wsgidav[pam]`.c                   óB   ‡ — e Zd Zˆ fd„Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ Z	ˆ xZ
S )ÚPAMDomainControllerc                 óˆ  •— t         ‰| �  ||«       t        j                  «       | _        t        j
                  «       | _        t        j                  |dd¬«      }|j                  dd«      | _	        |j                  dd«      | _
        |j                  dd«      | _        |j                  d	d
«      | _        | j                  dv s3t        | j                  t        «      st        d| j                  ›d�«      ‚|j                  dg «      | _        t        | j                   t        «      st        d| j                   ›d�«      ‚y )NÚpam_dcT)Úas_dictÚserviceÚloginÚencodingzutf-8Ú
resetcredsÚallow_usersÚall)r   ÚcurrentzInvalid 'allow_users' value: z5, expected 'all', 'current' or list of allowed users.Ú
deny_userszInvalid 'deny_users' value: z , expected list of denied users.)ÚsuperÚ__init__Ú	threadingÚRLockÚlockÚpamr   Úget_dict_valueÚgetÚpam_serviceÚpam_encodingÚpam_resetcredsr   Ú
isinstanceÚlistÚ
ValueErrorr   )ÚselfÚwsgidav_appÚconfigÚdc_confÚ	__class__s       €ú@/srv/dav/.venv/lib/python3.12/site-packages/wsgidav/dc/pam_dc.pyr   zPAMDomainController.__init__   s  ø€ Ü‰Ñ˜ fÔ-ä—O‘OÓ%ˆŒ	Ü—7‘7“9ˆŒä×%Ñ% f¨hÀÔEˆà"Ÿ;™; y°'Ó:ˆÔØ#ŸK™K¨
°GÓ<ˆÔØ%Ÿk™k¨,¸Ó=ˆÔØ"Ÿ;™; }°eÓ<ˆÔà×ÑÐ 2Ñ2´jÀ×AQÑAQÔSWÔ6XäØ/°×0@Ñ0@Ð/CÐCxÐyóð ð "Ÿ+™+ l°BÓ7ˆŒÜ˜$Ÿ/™/¬4Ô0ÜØ.¨t¯©Ð.AÐAaÐbóð ð 1ó    c                 óN   — | j                   j                  › d| j                  ›d�S )Nú(ú))r%   Ú__name__r   ©r!   s    r&   Ú__str__zPAMDomainController.__str__7   s'   € Ø—.‘.×)Ñ)Ð*¨!¨D×,<Ñ,<Ð+?¸qÐAÐAr'   c                 ó"   — d| j                   › d�S )NzPAM(r*   )r   )r!   Ú	path_infoÚenvirons      r&   Úget_domain_realmz$PAMDomainController.get_domain_realm:   s   € Ø�d×&Ñ&Ð' qÐ)Ð)r'   c                  ó   — y)NT© )r!   Úrealmr0   s      r&   Úrequire_authenticationz*PAMDomainController.require_authentication=   s   € Ør'   c                 ó®   — || j                   v ry| j                  dk(  ry| j                  dk(  r|t        j                  «       k(  ry|| j                  v ryy)NFr   Tr   )r   r   ÚosÚgetlogin)r!   Ú	user_names     r&   Ú_validate_userz"PAMDomainController._validate_user@   sU   € Ø˜Ÿ™Ñ'ØØ×Ñ˜uÒ$ØØ×Ñ˜yÒ(ØœBŸK™K›MÒ)ØØ˜×(Ñ(Ñ(ØØr'   c                 ó
  — | j                  |«      st        j                  d|›d�«       y| j                  5  | j                  j                  ||| j                  | j                  | j                  ¬«      }|s]t        j                  d|›d| j                  ›d| j                  j                  › d| j                  j                  › �«       	 d d d «       y	 d d d «       t        j                  d|›d	�«       y
# 1 sw Y   Œ#xY w)NzUser z is not allowed.F)r   r   r   zpam.authenticate(z, '<redacted>', z) failed with code z: z logged on.T)r:   Ú_loggerÚwarningr   r   Úauthenticater   r   r   ÚcodeÚreasonÚdebug)r!   r4   r9   Úpasswordr0   Úis_oks         r&   Úbasic_auth_userz#PAMDomainController.basic_auth_userL   s  € à×"Ñ" 9Ô-Ü�O‰O˜e I =Ð0@ÐAÔBØØ�Y‰Yñ 	Ø—H‘H×)Ñ)ØØØ×(Ñ(Ø×.Ñ.Ø×*Ñ*ð *ó ˆEñ Ü—‘Ø'¨	 }Ð4DÀT×EUÑEUÐDXÐXkÐlp×ltÑlt×lyÑlyÐkzÐz|ð  ~B÷  ~Fñ  ~F÷  ~Mñ  ~Mð  }Nð  Oôð ÷	ð 	ð ÷	ô 	�‰˜˜i˜]¨+Ð6Ô7Ø÷	ð 	ús   ¸BC9Ã9Dc                  ó   — y)NFr3   r,   s    r&   Úsupports_http_digest_authz-PAMDomainController.supports_http_digest_authb   s   € àr'   )r+   Ú
__module__Ú__qualname__r   r-   r1   r5   r:   rD   rF   Ú__classcell__)r%   s   @r&   r   r      s'   ø„ ôò0Bò*òò
òö,r'   r   )Ú__doc__r7   r   Úwsgidavr   Úwsgidav.dc.base_dcr   Ú__docformat__Úget_module_loggerr+   r<   r   ÚImportErrorÚerrorr   r3   r'   r&   ú<module>rQ      sk   ðñó 
Û å Ý 3à"€Ø
 ˆ$×
 Ñ
  Ó
*€ð
ÛôFÐ.õ Føð ò 
Ø‡M�MØRôð 
ð	
ús	   ¬< ¼A