+
    jT@                       ^ RI Ht ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHtH	t	 ^ RI
HtH
t
 ^ RIHt ^ RIHt ^ RIHt ^ RIHtHtHtHtHt ^ R	IHtHt ^ R
IHtHt  ! R R]4      t ! R R]4      t ]! RR7       ! R R4      4       t! ! R R]4      t"]! RR7       ! R R4      4       t#]! RR7       ! R R4      4       t$ ! R R4      t%R# )    )annotationsN)	dataclassreplace)UTCdatetime)Path)Callable)Protocol)AccountAccountRegistry
AccountRefAuthorityBindingAuthorityMode)AccountSnapshotHealthStatus)AccountHealthProviderAccountLifecyclec                      ] tR t^tRtR# )MigrationError N__name__
__module____qualname____firstlineno____static_attributes__r       M/home/user/overdeck-private-tests/subrouter-s5-systray/authority_migration.pyr   r          r   r   c                      ] tR t^tRtR# )MigrationCleanupErrorr   Nr   r   r   r   r!   r!      r   r   r!   T)frozenc                  @    ] tR t^t$ R]R&   R]R&   R]R&   R]R&   RtR	# )
AuthorityProvisionstrauthority_nameroute_idr   proxy_grant_refint
generationr   N)r   r   r   r   __annotations__r   r   r   r   r$   r$      s    MOr   r$   c                  ^    ] tR t^#tR R ltR R ltR R ltR R ltR	 R
 ltR R lt	Rt
R# )AuthorityMigrationAdminc               $    V ^8  d   QhRRRRRR/# )   accountr   r&   r%   returnr$   r   )formats   "r   __annotate__$AuthorityMigrationAdmin.__annotate__$   s    cc7cCcL^cr   c                	    R # Nr   )selfr0   r&   s   &&&r   login_and_provision+AuthorityMigrationAdmin.login_and_provision$   s    `cr   c               $    V ^8  d   QhRRRRRR/# )r/   providerr%   
account_idr1   r)   r   )r2   s   "r   r3   r4   &   s    KK#K3K3Kr   c                	    R # r6   r   r7   r;   r<   s   &&&r   status_generation)AuthorityMigrationAdmin.status_generation&   s    r   c                    V ^8  d   QhRRRR/# r/   r'   r%   r1   Noner   )r2   s   "r   r3   r4   (   s    77c7d7r   c                	    R # r6   r   r7   r'   s   &&r   disable_route%AuthorityMigrationAdmin.disable_route(   s    Cr   c                    V ^8  d   QhRRRR/# rB   r   )r2   s   "r   r3   r4   *   s    ==C=D=r   c                	    R # r6   r   rE   s   &&r   remove_route_grants+AuthorityMigrationAdmin.remove_route_grants*   s    #r   c                    V ^8  d   QhRRRR/# rB   r   )r2   s   "r   r3   r4   ,   s    66S6T6r   c                	    R # r6   r   rE   s   &&r   remove_route$AuthorityMigrationAdmin.remove_route,   s    3r   c               $    V ^8  d   QhRRRRRR/# )r/   r;   r%   r<   r1   rC   r   )r2   s   "r   r3   r4   .   s    IIsIIIr   c                	    R # r6   r   r>   s   &&&r   remove_account&AuthorityMigrationAdmin.remove_account.   s    cr   r   N)r   r   r   r   r8   r?   rF   rJ   rN   rR   r   r   r   r   r-   r-   #   s    cK7=6IIr   r-   c                      ] tR t^1t$ RtR]R&   RtR]R&   RtR]R&   RtR]R&   Rt	R]R&   Rt
R]R&   RtR]R	&   RtR]R
&   RtR]R&   RtR]R&   RtR]R&   RtR]R&   R R ltR R ltR R ltRtR# )MigrationAcceptanceFboolcliresume	streamingquota_healthrepairrestartexact_routeno_provider_credentials	responsesrealtime
app_serverhttp_ssec                    V ^8  d   QhRRRR/# r/   r;   r%   r1   ztuple[str, ...]r   )r2   s   "r   r3    MigrationAcceptance.__annotate__@   s     I I I Ir   c                	\    RpVR8X  d   . VORNRNRN5# VR8X  d   . VORN5# \        R4      h)	rW   codexr_   r`   ra   clauderb   (unsupported authority migration provider)rW   rX   rY   rZ   r[   r\   r]   r^   )r   )r7   r;   commons   && r   requiredMigrationAcceptance.required@   sQ    	
 wCVC[C*ClCCx(V(Z((GHHr   c                    V ^8  d   QhRRRR/# rd   r   )r2   s   "r   r3   re   Q   s     Z Z Z Zr   c                	   a  \         ;QJ d&    . V 3R  lS P                  V4       4       F  NK  	  5# ! V 3R  lS P                  V4       4       4      # )c              3  P   <"   T F  p\        SV4      '       d   K  Vx  K  	  R # 5ir6   )getattr).0namer7   s   & r   	<genexpr>.MigrationAcceptance.missing.<locals>.<genexpr>R   s     Y&=dWTSWEXTT&=s   &
&)tuplerk   )r7   r;   s   f&r   missingMigrationAcceptance.missingQ   s7    uYdmmH&=YuYuYdmmH&=YYYr   c                   V ^8  d   QhRR/# )r/   r1   zdict[str, bool]r   )r2   s   "r   r3   re   T   s     
 
 
r   c           
     	V    R Uu/ uF  pV\        \        W4      4      bK  	  up# u upi )rW   )rW   rX   rY   rZ   r[   r\   r]   r^   r_   r`   ra   rb   )rV   rp   )r7   rr   s   & r   as_dictMigrationAcceptance.as_dictT   s<    
 $wt*++
 	
 
s   &r   N)r   r   r   r   rW   r+   rX   rY   rZ   r[   r\   r]   r^   r_   r`   ra   rb   rk   rv   rz   r   r   r   r   rU   rU   1   s    CFDItL$FDGTK$)T)ItHdJHdI"Z
 
r   rU   c                      ] tR t^ht$ R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R	&   R]R
&   RtR]R&   RtR]R&   RtR]R&   RtR]R&   Rt	R]R&   Rt
R]R&   RtR]R&   R R ltRtR# )AccountMigrationReceiptr%   r;   r&   account_fingerprintroute_fingerprintstater)   r*   
started_at
updated_atNz
str | Nonepromoted_atrollback_started_atrollback_completed_atzdict[str, bool] | Noneflow_checksFrV   provider_credential_copiednative_fallback_usedcleanup_completec                   V ^8  d   QhRR/# )r/   r1   zdict[str, object]r   )r2   s   "r   r3   $AccountMigrationReceipt.__annotate__z   s     
 
* 
r   c                	   / R RbRV P                   bRV P                  bRV P                  bRV P                  bRV P                  bRV P
                  bRV P                  bR	V P                  bR
V P                  bRV P                  bRV P                  bR\        V P                  ;'       g    / 4      bRV P                  bRV P                  bRV P                  b# )schemaAccountMigrationReceipt/v1r;   r&   r~   r   r   r*   r   r   r   r   r   r   r   r   r   )r;   r&   r~   r   r   r*   r   r   r   r   r   dictr   r   r   r   )r7   s   &r   rz   AccountMigrationReceipt.as_dictz   s&   
2

 d11
 "4#;#;	

  !7!7
 TZZ
 $//
 $//
 $//
 4++
 "4#;#;
 $T%?%?
 4 0 0 6 6B7
 )$*I*I
 #D$=$=
   5 5!
 	
r   r   )r   r   r   r   r+   r   r   r   r   r   r   r   rz   r   r   r   r   r}   r}   h   s    MJOOO"K"&**(,:,*.K'.',,!&$&"d"
 
r   r}   c                      ] tR t^tRR/R R llt]R R l4       tR R ltR	 R
 lt]R R l4       t	R R lt
R R ltR R ltR R ltR R ltR R ltR R lt]R R l4       tRtR# )AuthorityMigrationCoordinatorclockNc               (    V ^8  d   QhRRRRRRRR/# )	r/   registryr   adminr-   r   zCallable[[], datetime] | Noner1   rC   r   )r2   s   "r   r3   *AuthorityMigrationCoordinator.__annotate__   s8     
P 
P!
P '
P
 -
P 

Pr   c               	r    Wn         W n        T;'       g    R  V n        VP                  R,          V n        R# )c                 6    \         P                  ! \        4      # r6   )r   nowr   r   r   r   <lambda>8AuthorityMigrationCoordinator.__init__.<locals>.<lambda>   s    S(9r   zauthority-migration-receiptsN)	_registry_admin_clockbase_dir_receipt_root)r7   r   r   r   s   &&&$r   __init__&AuthorityMigrationCoordinator.__init__   s2     ":: 9%..1OOr   c                    V ^8  d   QhRRRR/# )r/   valuer%   r1   r   )r2   s   "r   r3   r      s     F FC FC Fr   c                	v    \         P                  ! V P                  R 4      4      P                  4       R,          # )utf-8:N   N)hashlibsha256encode	hexdigest)r   s   &r   _fingerprint*AuthorityMigrationCoordinator._fingerprint   s(    ~~ell734>>@EEr   c                   V ^8  d   QhRR/# )r/   r1   r%   r   )r2   s   "r   r3   r      s     H HC Hr   c                	   V P                  4       p\        V\        4      '       g   \        R 4      hVP                  f   VP                  \        R7      pVP                  \        4      P                  4       P                  RR4      # )z)migration clock returned an invalid value)tzinfoz+00:00Z)	r   
isinstancer   r   r   r   r   
astimezone	isoformat)r7   r   s   & r   
_timestamp(AuthorityMigrationCoordinator._timestamp   sg    %** !LMM<<MMM-E$..0883GGr   c                    V ^8  d   QhRRRR/# )r/   r0   r   r1   r   r   )r2   s   "r   r3   r      s     a aW a ar   c                	    V P                   VP                  ,          V P                  VP                  4       R 2,          # )z.json)r   toolr   tray_key)r7   r0   s   &&r   _receipt_path+AuthorityMigrationCoordinator._receipt_path   s6    !!GLL0d6G6GHXHX6Y5ZZ_3```r   c                    V ^8  d   QhRRRR/# )r/   r0   r   r1   r   )r2   s   "r   r3   r      s     	
 	
g 	
' 	
r   c           
     	    \        \        V P                  V P                  4      V P                  V P
                  V P                  V P                  V P                  R R7      # )N)refaliasaccount_homeemailplanr<   authority_binding)	r   r   r   slugr   r   r   r   r<   )r0   s   &r   _native_view*AuthorityMigrationCoordinator._native_view   sK    7<<6-- ----))"
 	
r   c               $    V ^8  d   QhRRRRRR/# )r/   r0   r   receiptr}   r1   r   r   )r2   s   "r   r3   r      s#      g 8O TX r   c                	   V P                  V4      pVP                  P                  R R RR7       \        P                  ! VP                  4       ^R R7      R,           p\        P                  ! RVP                   R2VP                  R7      w  rV\        V4      p \        P                  ! VR4       \        P                  ! VRR	R
7      ;_uu_ 4       pVP                  V4       VP                  4        \        P                  ! VP!                  4       4       RRR4       \        P"                  ! Ws4       VP%                  R R7       V#   + '       g   i     L:; i  TP%                  R R7       i ; i)Ti  )parentsexist_okmode)indent	sort_keys
.)prefixdiri  wr   encodingN)
missing_ok)r   parentmkdirjsondumpsrz   tempfilemkstemprr   r   osfchmodfdopenwriteflushfsyncfilenor   unlink)	r7   r0   r   pathpayloadfdrr   	temporaryhandles	   &&&      r   _write_receipt,AuthorityMigrationCoordinator._write_receipt   s   !!'*$EB**W__.qDIDP##Qtyyk+;MJ		.IIb% 2sW55W%) 6 JJy'- 65 -s%   8E AEE E	E E3c                    V ^8  d   QhRRRR/# )r/   r0   r   r1   r}   r   )r2   s   "r   r3   r      s     6
 6
W 6
1H 6
r   c                	(   V P                  V4      p \        P                  ! VP                  R R7      4      p0 Rmp\        T\        4      '       d   \        T4      T8w  d   \        R4      hTP                  R4      R8w  d   \        R4      hTP                  R4      TP                  8w  d   \        R4      hTP                  R4      T P                  TP                  4      8w  d   \        R4      hTP                  R4      RJg   TP                  R4      RJd   \        R4      hTP                  R
4      p\        T\        4      '       g   \        T\        4      '       d   T^ 8:  d   \        R4      hTP                  R4      p\        T\        4      '       dW   \         ;QJ d*    R TP#                  4        4       F  '       g   K   RM	  RM! R TP#                  4        4       4      '       d   \        R4      h\%        TR,          TR,          TR,          TR,          TR	,          TTR,          TR,          TR,          TR,          TR,          TTR,          R7      #   \        \        P
                  3 d   p\        R4      ThRp?ii ; i) r   r   z migration receipt is unavailableNr   r;   r&   r~   r   r   r*   r   r   r   r   r   r   r   r   r   zmigration receipt is invalidr   z#migration receipt provider mismatchz"migration receipt account mismatchFz.migration receipt violates credential boundaryz'migration receipt generation is invalidc              3     "   T F9  w  r\        V\        4      '       * ;'       g    \        V\        4      '       * x  K;  	  R # 5ir6   )r   r%   rV   )rq   kvs   &  r   rs   >AuthorityMigrationCoordinator._read_receipt.<locals>.<genexpr>   sC       4G  sFjnjk
1c8J4J4e4eR\]^`dReNe4e  sFs
   "AATz)migration receipt flow checks are invalid)r;   r&   r~   r   r   r*   r   r   r   r   r   r   r   >   r   r   r;   r*   r   r   r   r   r&   r   r   r~   r   r   r   r   )r   r   loads	read_textOSErrorJSONDecodeErrorr   r   r   setgetr   r   r   rV   r)   anyitemsr}   )r7   r0   r   r   excexpectedr*   r   s   &&      r   _read_receipt+AuthorityMigrationCoordinator._read_receipt   sZ   !!'*	Njj!ABG
$ '4((CLH,D !?@@;;x $@@ !?@@;;z"gll2 !FGG;;,-1B1B7CSCS1TT !EFF;;34EAW[[QgEhpuEu !QRR[[.
j$''z*c/J/Jj\]o !JKKkk-0+t,,  4Gr}  sD  sD  sF  4G  4Gr}  sD  sD  sF  4G  1G  1G !LMM&Z("#34 '(= >%&9:'"!|,|,. '(= >")*A"B#$%78
 	
I --. 	N !CD#M	Ns   &I% %J JJc               $    V ^8  d   QhRRRRRR/# )r/   r0   r   r&   r%   r1   r}   r   )r2   s   "r   r3   r      s"     # #' #c #F] #r   c               	   VP                   R
9  d   \        R4      hVP                  e   \        R4      hV P                  P	                  W4      pVP
                  V8w  g   VP                  ^ 8:  d   \        R4      hVP                  P                  4       '       g   \        R4      h\        \        P                  VP
                  VP                  VP                   VP                  R7      p V P                  P                  VP                  V4       T P%                  4       p\'        TP                   TP
                  T P)                  TP*                  4      T P)                  TP                  4      RTP                  TT\-        4       P/                  4       R	7	      pT P1                  Y4       T#   \          d,    T P#                  TP                   TP                  TRR7       h i ; i)rg   ri   z(account already has an authority bindingz(authority provisioning result is invalidz*authority grant reference must be absolute)r   r&   r'   r;   r(   Tremove_grant_refdark)	r;   r&   r~   r   r   r*   r   r   r   >   rg   rh   )r   r   r   r   r8   r&   r*   r(   is_absoluter   r   SUBROUTER_DARKr'   r   set_authority_bindingr   	Exception_cleanup_authorityr   r}   r   r   rU   rz   r   )r7   r0   r&   	provisionbindingr   r   s   &&$    r   
stage_dark(AuthorityMigrationCoordinator.stage_dark   s   <<22 !KLL$$0 !KLLKK33GL	##~59M9MQR9R !KLL((4466 !MNN"--$33''\\%55
	NN00wG oo)\\"11 $ 1 1'2B2B C"//0@0@A +++-557

 	G-!  	##GLL',,Z^#_	s   0&F3 36G)c               $    V ^8  d   QhRRRRRR/# )r/   r0   r   
acceptancerU   r1   r}   r   )r2   s   "r   r3   r   %  s#      w 4G Lc r   c           	     	n   V P                  VP                  4      pVP                  pVe2   VP                  \        P
                  8w  g   VP                  '       d   \        R4      hVP                  VP                  4      pV'       d"   \        RRP                  V4      ,           4      hV P                  P                  VP                  VP                  4      pV^ 8:  d   \        R4      hV P                  V4      pVP                  V P                  VP                   4      8w  d   \        R4      h\#        V\        P$                  R7      pV P&                  P)                  VP                  V4       V P+                  4       p	\#        VRVV	V	VP-                  4       R7      p
V P/                  W:4       V
# )	Nz)account is not in a promotable dark statez!migration acceptance incomplete: z, z#authority generation is unavailablez)migration route changed during acceptance)r   	authority)r   r*   r   r   r   )_currentr   r   r   r   r  quiescedr   rv   r   joinr   r?   r   r   r   r'   r   	SUBROUTERr   r  r   rz   r   )r7   r0   r  currentr  rv   r*   priorpromoted_bindingr   r   s   &&&        r   promote%AuthorityMigrationCoordinator.promote%  s\   ---++?gllm.J.JJgN^N^N^ !LMM$$W\\2 !DtyyQXGY!YZZ[[227<<N
? !FGG""7+""d&7&78H8H&II !LMM"71H1HI,,W\\;KLoo!"**,
 	G-r   c               (    V ^8  d   QhRRRRRRRR/# )	r/   r0   r   native_lifecycler   native_healthr   r1   r}   r   )r2   s   "r   r3   r   A  s2     8 88 +	8
 -8 
!8r   c          	     	6   V P                  VP                  4      pVP                  pVf   \        R4      hV P	                  V4      pV P                  4       p\        VRR7      pV P                  P                  VP                  V4       \        VRWwR7      p	V P                  WI4        V P                  P                  VP                  4       T P                  T4      p\        TP!                  T4      4      p\"        ;QJ d    R T 4       F  '       g   K   RM	  RM! R T 4       4      '       d;   \"        ;QJ d    R	 T 4       F  '       g   K   RM	  RM! R	 T 4       4      '       d   \        R
4      hTP%                  T4      pTP&                  \(        P*                  8w  d   \        R4      hT P                  P                  TP                  R 4       T P                  4       pRp T P-                  TP.                  TP                  TRR7       Rp\        T	RTTTR7      p	T P                  Y4       T	#   \         d   p
\        R4      T
hR p
?
ii ; i  \         d3   p
\        T	RTTRR7      p	T P                  Y4       \1        R4      T
hR p
?
ii ; i)Nzaccount is not authority-boundT)r  zrollback-quiesced)r   r   r   z!failed to disable authority routec              3  >   "   T F  qP                   R 8H  x  K  	  R# 5i)successNkindrq   events   & r   rs   9AuthorityMigrationCoordinator.rollback.<locals>.<genexpr>Y  s     ?u::*   Fc              3  >   "   T F  qP                   R 8H  x  K  	  R# 5i)failureNr!  r#  s   & r   rs   r%  Y  s     FslrchzzU^G^lrr&  z.fresh native reauthentication did not completez*fresh native readiness verification failedr  znative-cleanup-required)r   r   r   r   z4native routing restored but authority cleanup failednative)r  r   r   r   r   r   r   r   r  r   r   rF   r'   r  r   listreauthenticater   fetchstatusr   OKr	  r   r!   )r7   r0   r  r  r  r  r  r   r  r   r   r)  eventssnapshot	completedr   s   &&$$            r   rollback&AuthorityMigrationCoordinator.rollbackA  sF    ---++? !ABB""7+oo7T2,,W\\8D%':sdG-	OKK%%g&6&67 ""7+&55f=>s??sss????33FslrFs333FslrFsCsCs !QRR$1$7$7$???loo- !MNN 	,,W\\4@OO%	 	i##GLL',,Z^#_#  "+-
 	F,K  	O !DE3N	O&  		i/$&/!&G 0'(^_ehh		is0   +%H< .+I <IIIJ&-JJc                    V ^8  d   QhRRRR/# )r/   r   r%   r1   r   r   )r2   s   "r   r3   r   {  s     E ES EW Er   c                	    V P                   P                  4        F  pVP                  V8X  g   K  Vu # 	  \        R 4      h)z$account disappeared during migration)r   r*  r   r   )r7   r   r0   s   && r   r  &AuthorityMigrationCoordinator._current{  s8    ~~**,G||t# - CDDr   c          
     ,    V ^8  d   QhRRRRRRRRRR	/# )
r/   r;   r%   r<   r  r   r  rV   r1   rC   r   )r2   s   "r   r3   r     sC     [ [[ [ "	[ [ 
[r   c               	~  a aaa . pVV 3R  lVV 3R lVVV 3R l3 F  p V! 4        K  	  V'       d    S P                  SP                  4       V'       d   \	        R4      V^ ,          hR#   \          d   pTP                  T4        Rp?Kr  Rp?ii ; i  \          d   pTP                  T4        Rp?LhRp?ii ; i)c                 N   < SP                   P                  S P                  4      # r6   )r   rJ   r'   r  r7   s   r   r   BAuthorityMigrationCoordinator._cleanup_authority.<locals>.<lambda>  s    DKK33G4D4DEr   c                 N   < SP                   P                  S P                  4      # r6   )r   rN   r'   r:  s   r   r   r;    s    DKK,,W-=-=>r   c                 <   < SP                   P                  SS 4      # r6   )r   rR   )r<   r;   r7   s   r   r   r;    s    DKK..xDr   Nz authority cleanup was incomplete)r  append_remove_grant_refr(   r!   )r7   r;   r<   r  r  errors	operationr   s   ffff$   r   r	  0AuthorityMigrationCoordinator._cleanup_authority  s     #%E>D
I
#
 #&&w'>'>? '(JKQWXYQZZ   #c""#
  #c""#s.   A,B ,B7BBB<!B77B<c                    V ^8  d   QhRRRR/# )r/   r   r   r1   rC   r   )r2   s   "r   r3   r     s        r   c                	    V P                  4       p\        P                  ! TP                  4      '       dc   TP
                  ^8w  gR   TP                  \        P                  ! 4       8w  g.   \        P                  ! TP                  4      ^?,          '       d   \        R4      hT P                  4        R #   \         d     R # i ; i)Nz'refusing unsafe authority grant cleanup)lstatFileNotFoundErrorstatS_ISREGst_modest_nlinkst_uidr   geteuidS_IMODEr!   r   )r   infos   & r   r?  /AuthorityMigrationCoordinator._remove_grant_ref  s    	::<D T\\**}}!{{bjjl*||DLL)E11'(QRR ! 		s   B7 7CC)r   r   r   r   )r   r   r   r   r   staticmethodr   r   r   r   r   r   r  r  r2  r  r	  r?  r   r   r   r   r   r      s    
P
 04
P F FHa 	
 	
"6
p#J88tE[4  r   r   )&
__future__r   r   r   r   rG  r   dataclassesr   r   r   r   pathlibr   collections.abcr	   typingr
   account_registryr   r   r   r   r   health_clientr   r   provider_servicesr   r   RuntimeErrorr   r!   r$   r-   rU   r}   r   r   r   r   <module>rZ     s    "   	   * "  $  b b 7 E	\ 		N 	 $  Jh J $3
 3
 3
l $#
 #
 #
LY Yr   