
    #	h*@                     4   S r SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSr	\R                  " 5       r\R                  " S 5        SrSr\R                  " \R                  R                   SSS	9rS
 rS rS0S jrSS\S4S jr\" S5      r\R0                  " \(       a  \R2                  O\R4                  S9   SSKJr  \" 5         \R:                  " S5        S r S r!S r"S1S jr#S r$S r%Sr&SS\&S.r'S /r(S! r)S" r*S#r+\RX                  " \+S$S%.5      r-S&\+\R\                  " \-R_                  S'5      5      Ra                  S'5      Rc                  S(5      S.r2S) r3S* r4S+ r5S, r6S- r7S. r8\9S/:X  a  \8" 5         gg! \ a    \R>                  " S5         Nf = f)2a  MSAL Python Tester

Usage 1: Run it on the fly.
    python -m msal
    Note: We choose to not define a console script to avoid name conflict.

Usage 2: Build an all-in-one executable file for bug bash.
    shiv -e msal.__main__._main -o msaltest-on-os-name.pyz .
    Nzmsal_cache.binc                      [         R                  (       a1  [        [        S5      R	                  [         R                  5       5      $ S $ )Nw)global_cachehas_state_changedopen_token_cache_filenamewrite	serialize     ?/var/www/html/env/lib/python3.13/site-packages/msal/__main__.py<lambda>r      s;     %% 		$**<+A+A+CD 0+/0r   z$04b07795-8ddb-461a-bbee-02f9e1bf7b46z$04f0c124-f2bc-4f59-8241-bf6df9866bbdzhttps://example.com/endpointplaceholder)http_methodurlnoncec                 B    [        [        R                  " U SSS95        g )N   T)indent	sort_keys)printjsondumps)blobs    r   
print_jsonr      s    	$**T!t
45r   c                 <    [        SR                  U 5      5      S;  $ )Nz9{} (N/n/F/f or empty means False, otherwise it is True): )NnFf )inputformat)messages    r   _input_booleanr%   "   s%    CJJ7S
)* *r   c                 `    [        U R                  US95      R                  5       =(       d    U$ )N)default)r"   r#   strip)r$   r'   s     r   _inputr)   '   s&    01779DWDr   zYour options:z    Your choice? Fc           	         U (       d   S5       eU(       a  [        U5        [        U SS9 H%  u  pV[        SR                  XS" U5      5      5        M'     U(       a  [        S5         [        U5      n [	        U5      nSUs=::  a  [        U 5      ::  a
  O  OXS-
     $  M:  ! [         a    U(       a  U(       a  Us $  N f = f)Nzoptions must not be empty   )startz
    {}: {}z'    Or you can just type in your input.)r   	enumerater#   r"   intlen
ValueError)	optionsheaderfooteroption_rendereraccept_nonempty_stringioraw_datachoices	            r   _select_optionsr:   *   s     ///7f'+l!!!_Q%789 ,78
=	 ]FF*c'l*z** +	   	 2	 s   3#B! B! !C ?C zEnable MSAL Python's DEBUG log?)level)load_dotenvz+Loaded environment variables from .env filezSpython-dotenv is not installed. You may need to set environment variables manually.c                  ^    [        / SQSSS9R                  5       n SU ;   a  [        S5      eU $ )N)z$https://graph.microsoft.com/.defaultz%https://management.azure.com/.defaultz	User.ReadzUser.ReadBasic.Allz_Select a scope (multiple scopes can only be input by manually typing them, delimited by space):Tr2   r5   4https://pas.windows.net/CheckMyAccess/Linux/.defaultz9SSH Cert scope shall be tested by its dedicated functions)r:   splitr0   scopess    r   _input_scopesrC   J   sA     
 q#
 %'  >GTUUMr   c                 `    U R                  5       nU(       a  [        US SS9$ [        S5        g )Nc                 2    SR                  U S   U S   5      $ )Nz{}, came from {}usernameaccount_source)r#   as    r   r   !_select_account.<locals>.<lambda>]   s    &8&?&?*qQaOb&cr   z0Account(s) already signed in inside MSAL Python:r4   r2   zRNo account available inside MSAL Python. Use other methods to acquire token first.)get_accountsr:   r   )appaccountss     r   _select_accountrO   X   s4    !HcE 	 	bcr   c           
          [        U 5      nU(       aX  [        U R                  [        5       U[	        S5      U R                  5       (       a  [	        S5      (       a  [        OSS95        gg)zIacquire_token_silent() - with an account already signed into MSAL Python.!Bypass MSAL Python's token cache?Acquire AT POP via Broker?N)accountforce_refreshauth_scheme)rO   r   acquire_token_silent_with_errorrC   r%   is_pop_supportedplaceholder_auth_schemerM   rS   s     r   _acquire_token_silentrZ   c   sa    c"G366O()LM''))n=Y.Z.Z 0 7  	 r   c                    [        U [        R                  5      (       d   eU=(       d
    [        5       n[	        SSS.SSS.SSS./S S	S
9S   nUS:X  a  SnOL[	        S/U R                  5        Vs/ s H  oUS   PM	     sn-   SSS9n[        U[        5      (       a  US   OUnU R                  UU R                  U R                  [        [        4;   SX4U=(       d    0 U R                  5       (       a  [        S5      (       a  [        OSS9nU(       aC  SU;   a=  UR                  S0 5      R                  S5      nX:w  a  [         R"                  " SU5        [%        U5        U$ s  snf )zUacquire_token_interactive() - User will be prompted if app opts to do select_account.NzRUnspecified. Proceed silently with a default account (if any), fallback to prompt.)valuedescriptionnonezEnone. Proceed silently with a default account (if any), or error out.select_accountz.select_account. Prompt with an account picker.c                     U S   $ )Nr]   r   r7   s    r   r   ,_acquire_token_interactive.<locals>.<lambda>y   s	    !M"2r   zPrompt behavior?rK   r\   rF   zlogin_hint? (If you have multiple signed-in sessions in browser/broker, and you specify a login_hint to match one of them, you will bypass the account picker.)Tr>   i  rR   )parent_window_handleenable_msa_passthroughportprompt
login_hintdatarU   id_token_claimspreferred_usernamez-Signed-in user "%s" does not match login_hint)
isinstancemsalPublicClientApplicationrC   r:   rL   dictacquire_token_interactiveCONSOLE_WINDOW_HANDLE	client_id
_AZURE_CLI_VISUAL_STUDIOrW   r%   rX   getloggingwarningr   )	rM   rB   rh   rf   rg   rI   raw_login_hintresultsigned_in_users	            r   _acquire_token_interactiverz   p   s   c4778888&}F'{|)pq"3cd

 3!# $+,F !!
(FS-=-=-?@-?
m-?@@ u#'
 4>nd3S3S^J/Yg
** 66"}}1   4:2##%%.9U*V*V , + 
F '61$5r:>>?ST'OOK^\vM- As   2E&
c                     [        U R                  [        S5      [        R                  " S5      [	        5       S95        g)zacquire_token_by_username_password() - See constraints here: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows#constraints-for-ropcz
username: z
password: rA   N)r   "acquire_token_by_username_passwordr)   getpassrC   rM   s    r   #_acquire_token_by_username_passwordr      s5    s55|gool;MO 6 U Vr   c                    [        U [        R                  5      (       d   eU R                  [	        5       S9n[        US   5        [        R                  R                  5         [        S5        U R                  U5      n[        U5        g)zNacquire_token_by_device_flow() - Note that this one does not go through brokerrA   r$   zNAfter you completed the step above, press ENTER in this console to continue...N)rk   rl   rm   initiate_device_flowrC   r   sysstdoutflushr"   acquire_token_by_device_flowr   )rM   flowrx   s      r   _acquire_token_by_device_flowr      sm    c4778888##=?#;D	$y/JJ	
Z[--d3Fvr   aw  {"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}ssh-certkey1)
token_typekey_idreq_cnfr?   c                 0   [        U [        R                  5      (       d   e[        U 5      nU(       ac  U R	                  [
        U[        [        S5      S9n[        U5        U(       a-  UR                  S5      S:w  a  [        R                  " S5        gggg)zFAcquire an SSH Cert silently- This typically only works with Azure CLIrQ   )rh   rT   r   r   zUnable to acquire an ssh-cert.N)rk   rl   rm   rO   acquire_token_silent_SSH_CERT_SCOPE_SSH_CERT_DATAr%   r   rt   ru   error)rM   rS   rx   s      r   _acquire_ssh_cert_silentlyr      s    c4778888c"G))()LM	 *  	6fjj.*<MM:; =6 r   c                     [        U [        R                  5      (       d   e[        U [        [
        S9nUR                  S5      S:w  a  [        R                  " S5        gg)zLAcquire an SSH Cert interactively - This typically only works with Azure CLIrB   rh   r   r   zUnable to acquire an ssh-certN)	rk   rl   rm   rz   r   r   rt   ru   r   )rM   rx   s     r   _acquire_ssh_cert_interactiver      sL    c4778888'O.YFzz,:-56 .r   z+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-AAAAAAAAsw)kidxms_kslpopzutf-8=c                     [        U [        R                  5      (       d   eS/n[        X[        S9n[        U5        UR                  S5      S:w  a  [        R                  " S5        gg)zLAcquire a POP token interactively - This typically only works with Azure CLIz-6256c85f-0aad-4d50-b960-e6e9b21efe35/.defaultr   r   r   zUnable to acquire a pop tokenN)	rk   rl   rm   rz   	_POP_DATAr   rt   ru   r   )rM   	POP_SCOPErx   s      r   _acquire_pop_token_interactiver      sZ    c4778888@AI'INFvzz,5(56 )r   c                     [        U 5      nU(       a/  U R                  U5        [        SR                  US   5      5        gg)zoremove_account() - Invalidate account and/or token(s) from cache, so that acquire_token_silent() would be resetz@Account "{}" and/or its token(s) are signed out from MSAL PythonrF   N)rO   remove_accountr   r#   rY   s     r   _remove_accountr      s=    c"G7#PWWX_`jXklm r   c                     [        U [        R                  5      (       d   e[        U R	                  [        5       S95        g)zKCCA.acquire_token_for_client() - Rerun this will get same token from cache.rA   N)rk   rl   ConfidentialClientApplicationr   acquire_token_for_clientrC   r~   s    r   _acquire_token_for_clientr      s3    c4==>>>>s++=?+CDr   c                 f    [        U [        R                  5      (       d   eU R                  5         g)zECCA.remove_tokens_for_client() - Run this to evict tokens from cache.N)rk   rl   r   remove_tokens_for_clientr~   s    r   _remove_tokens_for_clientr      s'    c4==>>>>  "r   c                     U R                   (       a  SOSn[        SR                  U5      5        [        R                  " 5         g)Exitzjhttps://identitydivision.visualstudio.com/Engineering/_queries/query/79b3a352-a775-406f-87cd-a487c382a8ed/zXhttps://github.com/AzureAD/microsoft-authentication-library-for-python/issues/new/choosez2Bye. If you found a bug, please report it here: {}N)_enable_brokerr   r#   r   exit)rM   bug_links     r   _exitr      s:      	ub 
 

>
E
Eh
OPHHJr   c            
         [        SR                  [        R                  5      5        [	        SSS.SSR                  [
        5      S./S SS	S
9n U S   S:X  aZ  [        R                  R                  [
        5      (       a2   [        R                  [        [
        S5      R                  5       5        [	        [        SS.[        SS.SSS.[        R                   " S5      [        R                   " S5      SS./S SSS
9n[#        U[$        5      =(       a    SU;   nU(       a  US   (       a
  US   (       d  ['        S5      eU(       + =(       a    [)        S5      nU(       a  [*        (       a  [)        S5      OS	n[	        / SQSSS 9nU(       a!  UR-                  S!5      (       d  [)        S"5      OS nU(       d8  [        R.                  " [#        U[$        5      (       a  US   OUUUUUU[        S#9O"[        R0                  " US   US   UUU[        S$9n[2        /[#        U[        R.                  5      (       a  [4        [6        [8        [:        [<        /O/ -   [>        [@        /-   [#        U[        R0                  5      (       a  [B        [D        /O/ -   n [	        U[F        /-   S% S&S'9n	 U	" U5        M  ! [         a     GNf = f! [&         a!  n
[H        RJ                  " S(U
5         S n
A
N9S n
A
f[L         a    [        S)5         NSf = f)*Nz4Welcome to the Msal Python {} Tester (Experimental)
emptyz<Start with an empty token cache. Suitable for one-off tests.)r9   descreusezReuse the previous token cache {} (if any) which was created during last test app exit. Useful for testing acquire_token_silent() repeatedlyc                     U S   $ )Nr   r   ra   s    r   r   _main.<locals>.<lambda>       !F)r   z1What token cache state do you want to begin with?F)r4   r2   r5   r9   rz+Azure CLI (Correctly configured for MSA-PT))rq   namez/Visual Studio (Correctly configured for MSA-PT)z$95de633a-083e-42f5-b444-a4295d8e9314zAWhiteboard Services (Non MSA-PT app. Accepts AAD & MSA accounts.)	CLIENT_IDCLIENT_SECRETzoA confidential client app (CCA) whose settings are defined in environment variables CLIENT_ID and CLIENT_SECRET)rq   client_secretr   c                     U S   $ )Nr   r   rH   s    r   r   r     r   r   zUImpersonate this app (or you can type in the client_id of your own public client app)Tr   rq   zAYou need to set environment variables CLIENT_ID and CLIENT_SECRETzYEnable broker? (It will error out later if your app has not registered some redirect URI)zEnable PII in broker's log?)z(https://login.microsoftonline.com/commonz/https://login.microsoftonline.com/organizationsz;https://login.microsoftonline.com/microsoft.onmicrosoft.comz:https://login.microsoftonline.com/msidlab4.onmicrosoft.comz+https://login.microsoftonline.com/consumerszKInput authority (Note that MSA-PT apps would NOT use the /common authority)r>   z!https://login.microsoftonline.comzYou input an unusual authority which might fail the Instance Discovery. Now, do you want to perform Instance Discovery on your input authority?)	authorityinstance_discoveryenable_broker_on_windowsenable_broker_on_macenable_pii_logtoken_cache)client_credentialr   r   r   r   c                     U R                   $ N)__doc__)r    s    r   r   r   M  s    aiir   zMSAL Python APIs:rK   zInvalid input: %sAborted)'r   r#   rl   __version__r:   r   ospathexistsr   deserializer   readIOErrorrr   rs   getenvrk   rn   r0   r%   enable_debug_log
startswithrm   r   rZ   rz   r   r   r   r   r   r   r   r   r   ru   r   KeyboardInterrupt)cache_choice
chosen_appis_ccaenable_brokerr   r   r   rM   methods_to_be_testedfunces              r   _mainr      s)   	
A
H
HIYIY
Z["!V
 "KKQ6-L/	$
 ,B$&L  H(RWW^^<Q-R-R	$$T*?%E%J%J%LM ! *WX$._`<  GJ  	K;/YY7G	
	
"
 ,O#%J 
D)Ko.KFz+.:o3N\]]Z 
^ 5U &
M GTXhXh^$ABnsN !
 ]#	
I y33/ 1  1 (	R
 7;	   
&
&#-j$#?#?
;Z-!.*% 
 "??;$_5-% 
 " "
 C!=!=>> ')&)* EG	
 0

 C!C!CDD &% KM
"  E7*/8KM	I Q  		\  	2MM-q11  	)	s0   1J4 *K 4
KK
LK++LL__main__r   )NN):r   base64r}   r   ru   r   r   atexitrl   r   SerializableTokenCacher   registerrr   rs   PopAuthSchemeHTTP_GETrX   r   r%   r)   strr:   r   basicConfigDEBUGINFOdotenvr<   infoImportErrorrv   rC   rO   rZ   rz   r   r   _JWK1r   r   r   r   _POP_KEY_IDr   _RAW_REQ_CNFurlsafe_b64encodeencodedecoderstripr   r   r   r   r   r   r   __name__r   r   r   <module>r      s   = < < <( **,  0  4
7,,""++&
 6*
E (0CUX$ * ""CD    +;'-- N?"MLL>?	d%NV
 	F *fOIJ<7 <zz+$?@''(;(;G(DELLWU\\]`a	7nE
#
fP z	G a  ?OO	>??s   =E< <FF