credentials.py 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561
  1. import calendar
  2. import json
  3. import time
  4. from urllib.parse import urlparse, parse_qs
  5. from Tea.core import TeaCore
  6. from alibabacloud_credentials.utils import auth_constant as ac
  7. from alibabacloud_credentials.utils import parameter_helper as ph
  8. from alibabacloud_credentials.exceptions import CredentialException
  9. from alibabacloud_credentials.models import CredentialModel
  10. class Credential:
  11. def get_access_key_id(self):
  12. return
  13. def get_access_key_secret(self):
  14. return
  15. def get_security_token(self):
  16. return
  17. async def get_access_key_id_async(self):
  18. return
  19. async def get_access_key_secret_async(self):
  20. return
  21. async def get_security_token_async(self):
  22. return
  23. def get_credential(self):
  24. return
  25. async def get_credential_async(self):
  26. return
  27. class _AutomaticallyRefreshCredentials:
  28. def __init__(self, expiration, provider):
  29. self.expiration = expiration
  30. self.provider = provider
  31. def _with_should_refresh(self):
  32. if self.expiration is None:
  33. return True
  34. return int(time.mktime(time.localtime())) >= (self.expiration - 180)
  35. def _get_new_credential(self):
  36. return self.provider.get_credentials()
  37. def _refresh_credential(self):
  38. if self._with_should_refresh():
  39. return self._get_new_credential()
  40. async def _get_new_credential_async(self):
  41. return await self.provider.get_credentials_async()
  42. async def _refresh_credential_async(self):
  43. if self._with_should_refresh():
  44. return await self._get_new_credential_async()
  45. class AccessKeyCredential(Credential):
  46. """AccessKeyCredential"""
  47. def __init__(self, access_key_id, access_key_secret):
  48. self.access_key_id = access_key_id
  49. self.access_key_secret = access_key_secret
  50. self.credential_type = ac.ACCESS_KEY
  51. def get_access_key_id(self):
  52. return self.access_key_id
  53. def get_access_key_secret(self):
  54. return self.access_key_secret
  55. async def get_access_key_id_async(self):
  56. return self.access_key_id
  57. async def get_access_key_secret_async(self):
  58. return self.access_key_secret
  59. def get_credential(self):
  60. return CredentialModel(
  61. access_key_id=self.access_key_id,
  62. access_key_secret=self.access_key_secret,
  63. type=ac.ACCESS_KEY
  64. )
  65. async def get_credential_async(self):
  66. return CredentialModel(
  67. access_key_id=self.access_key_id,
  68. access_key_secret=self.access_key_secret,
  69. type=ac.ACCESS_KEY
  70. )
  71. class BearerTokenCredential(Credential):
  72. """BearerTokenCredential"""
  73. def __init__(self, bearer_token):
  74. self.bearer_token = bearer_token
  75. self.credential_type = ac.BEARER
  76. def get_credential(self):
  77. return CredentialModel(
  78. bearer_token=self.bearer_token,
  79. type=ac.BEARER
  80. )
  81. async def get_credential_async(self):
  82. return CredentialModel(
  83. bearer_token=self.bearer_token,
  84. type=ac.BEARER
  85. )
  86. def get_type(self) -> str:
  87. return self.credential_type
  88. class EcsRamRoleCredential(Credential, _AutomaticallyRefreshCredentials):
  89. """EcsRamRoleCredential"""
  90. def __init__(self, access_key_id, access_key_secret, security_token, expiration, provider):
  91. super().__init__(expiration, provider)
  92. self.access_key_id = access_key_id
  93. self.access_key_secret = access_key_secret
  94. self.security_token = security_token
  95. self.credential_type = ac.ECS_RAM_ROLE
  96. def _refresh_credential(self):
  97. credential = super()._refresh_credential()
  98. if credential:
  99. self.access_key_id = credential.access_key_id
  100. self.access_key_secret = credential.access_key_secret
  101. self.expiration = credential.expiration
  102. self.security_token = credential.security_token
  103. async def _refresh_credential_async(self):
  104. credential = await super()._refresh_credential_async()
  105. if credential:
  106. self.access_key_id = credential.access_key_id
  107. self.access_key_secret = credential.access_key_secret
  108. self.expiration = credential.expiration
  109. self.security_token = credential.security_token
  110. def get_access_key_id(self):
  111. self._refresh_credential()
  112. return self.access_key_id
  113. def get_access_key_secret(self):
  114. self._refresh_credential()
  115. return self.access_key_secret
  116. def get_security_token(self):
  117. self._refresh_credential()
  118. return self.security_token
  119. async def get_access_key_id_async(self):
  120. await self._refresh_credential_async()
  121. return self.access_key_id
  122. async def get_access_key_secret_async(self):
  123. await self._refresh_credential_async()
  124. return self.access_key_secret
  125. async def get_security_token_async(self):
  126. await self._refresh_credential_async()
  127. return self.security_token
  128. def get_credential(self):
  129. self._refresh_credential()
  130. return CredentialModel(
  131. access_key_id=self.access_key_id,
  132. access_key_secret=self.access_key_secret,
  133. security_token=self.security_token,
  134. type=ac.ECS_RAM_ROLE
  135. )
  136. async def get_credential_async(self):
  137. await self._refresh_credential_async()
  138. return CredentialModel(
  139. access_key_id=self.access_key_id,
  140. access_key_secret=self.access_key_secret,
  141. security_token=self.security_token,
  142. type=ac.ECS_RAM_ROLE
  143. )
  144. class RamRoleArnCredential(Credential, _AutomaticallyRefreshCredentials):
  145. """RamRoleArnCredential"""
  146. def __init__(self, access_key_id, access_key_secret, security_token, expiration, provider):
  147. super().__init__(expiration, provider)
  148. self.access_key_id = access_key_id
  149. self.access_key_secret = access_key_secret
  150. self.security_token = security_token
  151. self.credential_type = ac.RAM_ROLE_ARN
  152. def _refresh_credential(self):
  153. credential = super()._refresh_credential()
  154. if credential:
  155. self.access_key_id = credential.access_key_id
  156. self.access_key_secret = credential.access_key_secret
  157. self.expiration = credential.expiration
  158. self.security_token = credential.security_token
  159. async def _refresh_credential_async(self):
  160. credential = await super()._refresh_credential_async()
  161. if credential:
  162. self.access_key_id = credential.access_key_id
  163. self.access_key_secret = credential.access_key_secret
  164. self.expiration = credential.expiration
  165. self.security_token = credential.security_token
  166. def get_access_key_id(self):
  167. self._refresh_credential()
  168. return self.access_key_id
  169. def get_access_key_secret(self):
  170. self._refresh_credential()
  171. return self.access_key_secret
  172. def get_security_token(self):
  173. self._refresh_credential()
  174. return self.security_token
  175. async def get_access_key_id_async(self):
  176. await self._refresh_credential_async()
  177. return self.access_key_id
  178. async def get_access_key_secret_async(self):
  179. await self._refresh_credential_async()
  180. return self.access_key_secret
  181. async def get_security_token_async(self):
  182. await self._refresh_credential_async()
  183. return self.security_token
  184. def get_credential(self):
  185. self._refresh_credential()
  186. return CredentialModel(
  187. access_key_id=self.access_key_id,
  188. access_key_secret=self.access_key_secret,
  189. security_token=self.security_token,
  190. type=ac.RAM_ROLE_ARN
  191. )
  192. async def get_credential_async(self):
  193. await self._refresh_credential_async()
  194. return CredentialModel(
  195. access_key_id=self.access_key_id,
  196. access_key_secret=self.access_key_secret,
  197. security_token=self.security_token,
  198. type=ac.RAM_ROLE_ARN
  199. )
  200. class OIDCRoleArnCredential(Credential, _AutomaticallyRefreshCredentials):
  201. """OIDCRoleArnCredential"""
  202. def __init__(self, access_key_id, access_key_secret, security_token, expiration, provider):
  203. super().__init__(expiration, provider)
  204. self.access_key_id = access_key_id
  205. self.access_key_secret = access_key_secret
  206. self.security_token = security_token
  207. self.credential_type = ac.OIDC_ROLE_ARN
  208. def _refresh_credential(self):
  209. credential = super()._refresh_credential()
  210. if credential:
  211. self.access_key_id = credential.access_key_id
  212. self.access_key_secret = credential.access_key_secret
  213. self.expiration = credential.expiration
  214. self.security_token = credential.security_token
  215. async def _refresh_credential_async(self):
  216. credential = await super()._refresh_credential_async()
  217. if credential:
  218. self.access_key_id = credential.access_key_id
  219. self.access_key_secret = credential.access_key_secret
  220. self.expiration = credential.expiration
  221. self.security_token = credential.security_token
  222. def get_access_key_id(self):
  223. self._refresh_credential()
  224. return self.access_key_id
  225. def get_access_key_secret(self):
  226. self._refresh_credential()
  227. return self.access_key_secret
  228. def get_security_token(self):
  229. self._refresh_credential()
  230. return self.security_token
  231. async def get_access_key_id_async(self):
  232. await self._refresh_credential_async()
  233. return self.access_key_id
  234. async def get_access_key_secret_async(self):
  235. await self._refresh_credential_async()
  236. return self.access_key_secret
  237. async def get_security_token_async(self):
  238. await self._refresh_credential_async()
  239. return self.security_token
  240. def get_credential(self):
  241. self._refresh_credential()
  242. return CredentialModel(
  243. access_key_id=self.access_key_id,
  244. access_key_secret=self.access_key_secret,
  245. security_token=self.security_token,
  246. type=ac.OIDC_ROLE_ARN
  247. )
  248. async def get_credential_async(self):
  249. await self._refresh_credential_async()
  250. return CredentialModel(
  251. access_key_id=self.access_key_id,
  252. access_key_secret=self.access_key_secret,
  253. security_token=self.security_token,
  254. type=ac.OIDC_ROLE_ARN
  255. )
  256. class CredentialsURICredential(Credential):
  257. """CredentialsURICredential"""
  258. def __init__(self, credentials_uri):
  259. self.access_key_id = None
  260. self.access_key_secret = None
  261. self.security_token = None
  262. self.expiration = None
  263. self.credentials_uri = credentials_uri
  264. self.credential_type = ac.CREDENTIALS_URI
  265. def _need_refresh(self):
  266. if self.expiration is None:
  267. return True
  268. return int(time.mktime(time.localtime())) >= (self.expiration - 180)
  269. def _ensure_credential(self):
  270. if self._need_refresh():
  271. self._get_new_credential()
  272. async def _ensure_credential_async(self):
  273. if self._need_refresh():
  274. await self._get_new_credential_async()
  275. def _get_new_credential(self):
  276. r = urlparse(self.credentials_uri)
  277. tea_request = ph.get_new_request()
  278. tea_request.headers['host'] = r.hostname
  279. tea_request.port = r.port
  280. tea_request.method = 'GET'
  281. tea_request.pathname = r.path
  282. for key, values in parse_qs(r.query).items():
  283. for value in values:
  284. tea_request.query[key] = value
  285. response = TeaCore.do_action(tea_request)
  286. if response.status_code != 200:
  287. raise CredentialException(
  288. "Get credentials from " + self.credentials_uri + " failed, HttpCode=" + str(response.status_code))
  289. body = response.body.decode('utf-8')
  290. dic = json.loads(body)
  291. content_code = dic.get('Code')
  292. content_access_key_id = dic.get('AccessKeyId')
  293. content_access_key_secret = dic.get('AccessKeySecret')
  294. content_security_token = dic.get('SecurityToken')
  295. content_expiration = dic.get('Expiration')
  296. if content_code != "Success":
  297. raise CredentialException(
  298. "Get credentials from " + self.credentials_uri + " failed, Code is " + content_code)
  299. # 先转换为时间数组
  300. time_array = time.strptime(content_expiration, "%Y-%m-%dT%H:%M:%SZ")
  301. # 转换为时间戳
  302. time_stamp = calendar.timegm(time_array)
  303. self.access_key_id = content_access_key_id
  304. self.access_key_secret = content_access_key_secret
  305. self.security_token = content_security_token
  306. self.expiration = time_stamp
  307. async def _get_new_credential_async(self):
  308. r = urlparse(self.credentials_uri)
  309. tea_request = ph.get_new_request()
  310. tea_request.headers['host'] = r.netloc
  311. tea_request.method = 'GET'
  312. tea_request.pathname = r.path
  313. tea_request.query = parse_qs(r.query)
  314. response = await TeaCore.async_do_action(tea_request)
  315. if response.status_code != 200:
  316. raise CredentialException(
  317. "Get credentials from " + self.credentials_uri + " failed, HttpCode=" + str(response.status_code))
  318. body = response.body.decode('utf-8')
  319. dic = json.loads(body)
  320. content_code = dic.get('Code')
  321. content_access_key_id = dic.get('AccessKeyId')
  322. content_access_key_secret = dic.get('AccessKeySecret')
  323. content_security_token = dic.get('SecurityToken')
  324. content_expiration = dic.get('Expiration')
  325. if content_code != "Success":
  326. raise CredentialException(
  327. "Get credentials from " + self.credentials_uri + " failed, Code is " + content_code)
  328. # 先转换为时间数组
  329. time_array = time.strptime(content_expiration, "%Y-%m-%dT%H:%M:%SZ")
  330. # 转换为时间戳
  331. time_stamp = calendar.timegm(time_array)
  332. self.access_key_id = content_access_key_id
  333. self.access_key_secret = content_access_key_secret
  334. self.security_token = content_security_token
  335. self.expiration = time_stamp
  336. def get_access_key_id(self):
  337. self._ensure_credential()
  338. return self.access_key_id
  339. def get_access_key_secret(self):
  340. self._ensure_credential()
  341. return self.access_key_secret
  342. def get_security_token(self):
  343. self._ensure_credential()
  344. return self.security_token
  345. async def get_access_key_id_async(self):
  346. await self._ensure_credential_async()
  347. return self.access_key_id
  348. async def get_access_key_secret_async(self):
  349. await self._ensure_credential_async()
  350. return self.access_key_secret
  351. async def get_security_token_async(self):
  352. await self._ensure_credential_async()
  353. return self.security_token
  354. def get_credential(self):
  355. self._ensure_credential()
  356. return CredentialModel(
  357. access_key_id=self.access_key_id,
  358. access_key_secret=self.access_key_secret,
  359. security_token=self.security_token,
  360. type=ac.CREDENTIALS_URI
  361. )
  362. async def get_credential_async(self):
  363. await self._ensure_credential_async()
  364. return CredentialModel(
  365. access_key_id=self.access_key_id,
  366. access_key_secret=self.access_key_secret,
  367. security_token=self.security_token,
  368. type=ac.CREDENTIALS_URI
  369. )
  370. class RsaKeyPairCredential(Credential, _AutomaticallyRefreshCredentials):
  371. def __init__(self, access_key_id, access_key_secret, expiration, provider):
  372. super().__init__(expiration, provider)
  373. self.access_key_id = access_key_id
  374. self.access_key_secret = access_key_secret
  375. self.credential_type = ac.RSA_KEY_PAIR
  376. def _refresh_credential(self):
  377. credential = super()._refresh_credential()
  378. if credential:
  379. self.access_key_id = credential.access_key_id
  380. self.access_key_secret = credential.access_key_secret
  381. self.expiration = credential.expiration
  382. async def _refresh_credential_async(self):
  383. credential = await super()._refresh_credential_async()
  384. if credential:
  385. self.access_key_id = credential.access_key_id
  386. self.access_key_secret = credential.access_key_secret
  387. self.expiration = credential.expiration
  388. self.security_token = credential.security_token
  389. def get_access_key_id(self):
  390. self._refresh_credential()
  391. return self.access_key_id
  392. def get_access_key_secret(self):
  393. self._refresh_credential()
  394. return self.access_key_secret
  395. async def get_access_key_id_async(self):
  396. await self._refresh_credential_async()
  397. return self.access_key_id
  398. async def get_access_key_secret_async(self):
  399. await self._refresh_credential_async()
  400. return self.access_key_secret
  401. def get_credential(self):
  402. self._refresh_credential()
  403. return CredentialModel(
  404. access_key_id=self.access_key_id,
  405. access_key_secret=self.access_key_secret,
  406. type=ac.RSA_KEY_PAIR
  407. )
  408. async def get_credential_async(self):
  409. await self._refresh_credential_async()
  410. return CredentialModel(
  411. access_key_id=self.access_key_id,
  412. access_key_secret=self.access_key_secret,
  413. type=ac.RSA_KEY_PAIR
  414. )
  415. class StsCredential(Credential):
  416. def __init__(self, access_key_id, access_key_secret, security_token):
  417. self.access_key_id = access_key_id
  418. self.access_key_secret = access_key_secret
  419. self.security_token = security_token
  420. self.credential_type = ac.STS
  421. def get_access_key_id(self):
  422. return self.access_key_id
  423. def get_access_key_secret(self):
  424. return self.access_key_secret
  425. def get_security_token(self):
  426. return self.security_token
  427. async def get_access_key_id_async(self):
  428. return self.access_key_id
  429. async def get_access_key_secret_async(self):
  430. return self.access_key_secret
  431. async def get_security_token_async(self):
  432. return self.security_token
  433. def get_credential(self):
  434. return CredentialModel(
  435. access_key_id=self.access_key_id,
  436. access_key_secret=self.access_key_secret,
  437. security_token=self.security_token,
  438. type=ac.STS
  439. )
  440. async def get_credential_async(self):
  441. return CredentialModel(
  442. access_key_id=self.access_key_id,
  443. access_key_secret=self.access_key_secret,
  444. security_token=self.security_token,
  445. type=ac.STS
  446. )