o l>jzi@sdZddlmZddlZddlmZddlmZddlmZm Z ddl m Z ddl m Z mZdd lmZmZddlZdd lmZdd lmZdd lmZmZdd lmZddlmZmZmZm Z m!Z!m"Z"m#Z#ddl$m%Z%ddl&m'Z'm(Z(m)Z)m*Z*ddl+m,Z,m-Z-dZ.Gddde/Z0Gddde1e Z2eddGdddZ3GdddZ4dEd!d"Z5dd#dFd(d)Z6dGd,d-Z7d.d/dHd5d6Z8d.d7dId:d;Z9dJd?d@Z:dKdCdDZ;dS)Lzr@rArBrCrDrErFr(rGrr-Nonec Cs|pd|_||_||_||_||_||_||_||_| |_ | |_ | |_ | |_ t |_t dd|_t|_d|_d|_|jp@d|_d|_dS)zDCapture the CLI options and shared runtime state for one invocation.T)stderrNF)stripr:r;r=r?r@rArBrCrDrErFrGr console err_consoler_stack_api _probe_api_resolved_username_logging_configured) r5r:r;r=r?r@rArBrCrDrErFrGr&r&r'__init__Vs&   zCLIState.__init__optionsr8 'CLIState'cCs8||j|j|j|j|j|j|j|j|j|j |j |j d S)z0Build CLI state from one leaf command's options. r:r;r=r?r@rArBrCrDrErFrGrY)clsrWr&r&r' from_options{szCLIState.from_optionscCs t|jS)z5Return whether the user explicitly passed --username.)r>r:r4r&r&r'has_explicit_usernames zCLIState.has_explicit_usernamecCs |jtjuS)z0Return whether the current command expects JSON.)rGrJSONr4r&r&r' json_outputs zCLIState.json_outputcCs*|jt|j |jp d|jpdddS)zOpen CLI-scoped resources.rL) verify_sslrCrDN)rQ enter_contextrrErCrDr4r&r&r'opensz CLIState.opencCs|jdS)zClose CLI-scoped resources.N)rQcloser4r&r&r'rbzCLIState.closepayloadr cCst|j|dS)zWrite a JSON payload to stdout.N)rrO)r5rdr&r&r'rzCLIState.write_jsonstrcCs,t|rt||dS|dS)z0Delete a stored keyring password for a username.TF)rpassword_exists_in_keyringdelete_password_in_keyringprune_local_accountsr5r:r&r&r'delete_keyring_passwords  z CLIState.delete_keyring_passwordNcCs&|p|jp|j}|sdSt|S)z8Return whether a keyring password exists for a username.F)rTr:rNrrg)r5r: candidater&r&r'has_keyring_passwords zCLIState.has_keyring_passwordrcCstt|jS)z9Return the resolved session root for this CLI invocation.)rrrBr4r&r&r' session_rootszCLIState.session_rootlist[AccountIndexEntry]cCst|j|jS)z?Return discoverable local accounts after opportunistic pruning.)rrnrmr4r&r&r'local_accountsrczCLIState.local_accountscCs|S)z=Prune stale indexed accounts and return the discoverable set.)rpr4r&r&r'riszCLIState.prune_local_accountsOptional[AccountIndexEntry]cCst|j|S)zsz-CLIState._resolve_username..zCMultiple local accounts were found; pass --username to choose one. rr:)rTrpr!lenjoin)r5accountsrWr&r&r'_resolve_usernames  zCLIState._resolve_usernamecCs dS)zGReturn the default message for commands that require an active session.zdYou are not logged into any iCloud accounts. To log in, run: icloud auth login --username r&r4r&r&r'not_logged_in_messageszCLIState.not_logged_in_messagecCsd|d|S)zKReturn the message for account-targeted commands without an active session.z#You are not logged into iCloud for $. Run: icloud auth login --username r&rjr&r&r'!not_logged_in_for_account_message sz*CLIState.not_logged_in_for_account_message usernames list[str]cCsddd|D}d|S)zBReturn the message for ambiguous active-session account selection.rcss|]}d|VqdS)rNr&)rr:r&r&r'rsz?CLIState.multiple_logged_in_accounts_message..zNMultiple logged-in iCloud accounts were found; pass --username to choose one. )r)rrWr&r&r'#multiple_logged_in_accounts_messages z,CLIState.multiple_logged_in_accounts_message#tuple[Optional[str], Optional[str]]cCsB|jr|jdfSt|}|r|dfS|jsdStj|dddfS)zAReturn the password and its source for an interactive login flow.explicitkeyring)NNT)r?prompt)r;rget_password_from_keyringr? get_password)r5r:keyring_passwordr&r&r'_password_for_logins  zCLIState._password_for_logincCs&|jrdStj|jdd|_dS)z?Apply the requested log level once for the current CLI process.N)levelT)rUr0 basicConfigrFr6r4r&r&r'_configure_logging*s zCLIState._configure_loggingcCs|jr|jSt|S)zEReturn a non-interactive password for service-level reauthentication.)r;rrrjr&r&r'_stored_password_for_session1s z%CLIState._stored_password_for_sessionrcountr.c Csl|dks|js dStj|dd}zt|}Wnty'}ztd|d}~ww|dks0||kr4td|S)zDPrompt for a zero-based selection index when multiple choices exist.rr0)defaultzInvalid device selection.N)r?typerrr. ValueErrorr!)r5rrrawidxexcr&r&r' _prompt_index8s  zCLIState._prompt_indexc Cstt|dgpg}|rP|jdt|D]\}}|jd|d|q|dt|}|jdz |||WntyO}zt d|d}~ww|j sWt d z3| s`t d t|d d}|rn|j|t|d d }|dkr|jdn |dkr|jdWn1t y}zt d|d}~wt y}zt d|d}~wty}zt d|d}~wwd} t| D]<} td} z|| } Wnty}zt d|d}~ww| rn| | d} | dkrt d|jd| dq|js |dSdS)zHComplete Apple's HSA2 flow using a security key or code-based challenge. fido2_devicesz#Security key verification required. z: Security key zSelect security key indexz,Touch the selected security key to continue.z!Security key verification failed.NzLTwo-factor authentication is required, but interactive prompts are disabled.zBThis 2FA challenge requires a security key. Connect one and retry.two_factor_delivery_noticetwo_factor_delivery_methodunknowntrusted_devicez5Requested a 2FA prompt on your trusted Apple devices.smszRequested a 2FA code by SMS.zQTwo-factor authentication requires a trusted phone number, but none was returned.z0Failed to request the 2FA trusted-device prompt.z#Failed to request the 2FA SMS code.zEnter 2FA codez-Failed to verify the 2FA trusted-device code.rrzFailed to verify the 2FA code.zInvalid 2FA code. z attempt(s) remaining.)listgetattrrOprint enumeraterrconfirm_security_key Exceptionr!r?request_2fa_coderrrrangerrvalidate_2fa_coderis_trusted_session trust_session)r5rxrindex_deviceselected_indexrnoticedelivery_method max_attemptsattemptcodeis_validremaining_attemptsr&r&r' _handle_2faEs             zCLIState._handle_2facCst|jpg}|s td|jdt|D]\}}|dr"dnd}|jd|d|q|dt|}||}|j sDtd | |sMtd t d }| ||s\td d S)z5Complete Apple's legacy two-step authentication flow.zITwo-step authentication is required but no trusted devices are available.zTrusted devices: phoneNumberzSMS trusted devicezTrusted devicerz: zSelect trusted device indexzJTwo-step authentication is required, but interactive prompts are disabled.z)Failed to send the 2SA verification code.zEnter 2SA verification codezFailed to verify the 2SA code.N)rtrusted_devicesr!rOrrrrrrr?send_verification_coderrvalidate_verification_code)r5rxdevicesrdevicelabelrrr&r&r' _handle_2sas,    zCLIState._handle_2sac Cs|jdur|jS|}||\}}|std|zt|||||j|j|j d}Wn&t yU}z|dkrIt |rIt ||td||d}~wwt |sh|jrhtdrht |||jrq||n|jry||||_|||S)z8Return a PyiCloudService, bootstrapping login if needed.Nz6No password supplied and no stored password was found.)apple_idr;r=cookie_directoryr@rArzBad username or password for zSave password in keyring?)rRrrr!rrrurBr@rArrrgrhrir?r store_password_in_keyring requires_2far requires_2sarr)r5r:r;password_sourcerxerrr&r&r' get_login_apisN         zCLIState.get_login_apicCs"|jdur|jS|jrG|}||}|}|ds#t||||}|||s=|}|ds=t||||_| ||S| }|sSt| t |dkret| dd|D|d\}}||j}|||s|}|dst||j||_| ||S)zDReturn an authenticated PyiCloudService backed by an active session.N authenticatedrcSsg|]\}}|jqSr&r|)rrx_statusr&r&r' sz$CLIState.get_api..r)rRr\rbuild_probe_apiget_auth_statusr!rbuild_session_api_hydrate_api_from_proberactive_session_probesrrrr|)r5r: probe_apistatusrx active_probesrr&r&r'get_apisH             zCLIState.get_apic Cs,|t||j|||j|j|jddS)z>Build a non-authenticating PyiCloudService for session probes.Frr;r=rr@rA authenticate)rrr;rurBr@rArjr&r&r'rszCLIState.build_probe_apic Cs0|t||||||j|j|jddS)zEBuild a session-backed API that can satisfy service reauthentication.Fr)rrrrurBr@rArjr&r&r'r szCLIState.build_session_apirOptional[PyiCloudService]cCs|durdSt|dd}t|tr|sdSt||_t|dd}|d}t|trr@r>rAr>rBr9rCr9rDr9rEr>rFr(rGrr-rK)rWr8r-rX)r-r>)r-rK)rdr r-rK)r:rfr-r>N)r:r9r-r>)r-r)r-ro)r:rfr-rq)r:rfr-r<)rxrrwr>r-rK)r-rf)r:rfr-rf)rrr-rf)r:rfr-r)r:rfr-r9)rrfrr.r-r.)rxrr-rK)r-r)r:rfr-r)rxrrrr-r>)rxrr-r)r-r)(r"r#r$r%rV classmethodr[propertyr\r^rarbrrkrmrnrprirsrurrrr staticmethodrrrrrrrrrrrrrrrr&r&r&r'rJSsT %                    D  . +    rJctx typer.Contextr-cCsb|}|j}t|tr|Stdi|jti}t|}| | |j ||_||_|S)z1Return the resolved CLI state for a leaf command.Nr&) find_rootobjrrJr8metarrCOMMAND_OPTIONS_META_KEYr[ra call_on_closerb)rroot_ctxstaterWresolvedr&r&r' get_stateYs   rrrrfr|r9c Cs~z|WSty}z t|d||d}~wttfy>}z|r2t|d|d||t|d|d}~ww)zBWrap a service call with user-facing service-unavailable handling.z service unavailable: Nz requires re-authentication for rz4 requires re-authentication. Run: icloud auth login.)rr!rr)rfnr|rr&r&r' service_calljs* rvalueOptional[datetime]c Cs~|durdS|}|dr|ddd}zt|}Wnty0}ztd|d}~ww|jdur=|jt j d}|S)z"Parse an ISO-8601 datetime string.NZz+00:00z$Expected an ISO-8601 datetime value.)tzinfo) rNendswithr fromisoformatrr BadParameterr replacerutc)r normalizeddtrr&r&r'parse_datetime|s   rF)require_uniquerxrqueryrr>c s8|ttdfddjd}|D]}tt|dd}|r.|kr.|Sqg}t}|D];}tt|dd}t|ddt|ddg}tfd d |DsZq6|patt |} | |vrgq6| | | |q6|s|t d |d |rt |d krddd |D} t d|d| |dS)z6Return a device matched by id or common display names.zFind MycsjSr)rr&)rxr&r'sz resolve_device..ridrLnamedeviceDisplayNamec3s$|] }t|kVqdSr)rfrNlower)rrl)loweredr&r'rs z!resolve_device..zNo device matched 'z'.rrc ss@|]}dt|dddt|dddt|dddVqdS) rrrLz (rz / r)N)r)rrr&r&r'rs    zMultiple devices matched 'z'. Use a device id instead. r)rNrrrr|rfrsetanyraddrr!rr) rxrrrr identifiermatchesseen_ids candidates dedupe_keyrWr&)rxrr'resolve_devicesF        r$)trashpathr%cCsN|r|jn|j}t|p d}t|dvr|S|jD] }|dvr q||}q|S)zResolve an iCloud Drive node./>.r'>rLr')r%rootr rfparts)driver&r%noderpartr&r&r'resolve_drive_nodes    r.responser rKcCsnt|dr|jddD] }|r||q dSt|dr3t|jdr5 |jd}|s-dS||q#dSdS)z;Write a download response to a file, streaming if possible. iter_contenti ) chunk_sizeNrread)hasattrr0writerr2)r/file_outchunkr&r&r'_write_to_files    r7outputrcCsvt|dpt|dot|jd}|std|jjddd|d}t||WddS1s4wYdS) z#Stream a download response to disk.r0rr2z,The download response could not be streamed.T)parentsexist_okwbN)r3rr!parentmkdirrar7)r/r8 can_streamr5r&r&r'write_response_to_paths   "r?)rrr-rJ)rrfr|r9)rr9r-r)rxrrrfrr>)r&rfr%r>)r/r r-rK)r/r r8rr-rK)sF       $   .