�
J�gB � �� � d Z ddlZddlmZ ddlZddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z ej ej
ej ej hZdgZd Zd
Zd Zd Z G d
� de
j � � ZdS )z�Tools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.
.. _Cloud Identity and Access Management (IAM) API:
https://cloud.google.com/iam/docs/
� N)�_exponential_backoff)�_helpers)� credentials)�crypt)�
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzNhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signJwtzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc �p � e Zd ZdZd� Zd� Zed� � � Z ej e
j � � d� � � Z dS )�Signera Signs messages using the IAM `signBlob API`_.
This is useful when you need to sign bytes but do not have access to the
credential's private key file.
.. _signBlob API:
https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
/signBlob
c �0 � || _ || _ || _ dS )a�
Args:
request (google.auth.transport.Request): The object used to make
HTTP requests.
credentials (google.auth.credentials.Credentials): The credentials
that will be used to authenticate the request to the IAM API.
The credentials must have of one the following scopes:
- https://www.googleapis.com/auth/iam
- https://www.googleapis.com/auth/cloud-platform
service_account_email (str): The service account email identifying
which service account to use to sign bytes. Often, this can
be the same as the service account email in the given
credentials.
N)�_request� _credentials�_service_account_email)�self�requestr �service_account_emails �_/home/asafur/pinokio/api/open-webui.git/app/env/lib/python3.11/site-packages/google/auth/iam.py�__init__zSigner.__init__I s! � � ��
� '���&;��#�#�#� c �( � t j |� � }d}t � t j | j j � � � | j � � }ddi}t j dt j
|� � � d� � i� � � d� � }t! j � � }|D ]�}| j � | j |||� � | � ||||�� � }|j t* v r�L|j t, j k r,t1 j d� |j � � � � �t j |j � d� � � � c S t1 j d� � �) z(Makes a request to the API signBlob API.�POSTz Content-Typezapplication/json�payloadzutf-8)�url�method�body�headersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries) r �to_bytes�_IAM_SIGN_ENDPOINT�replacer �DEFAULT_UNIVERSE_DOMAINr �universe_domain�formatr
�json�dumps�base64� b64encode�decode�encoder �ExponentialBackoff�before_requestr �status�IAM_RETRY_CODES� http_client�OKr �TransportError�data�loads) r �messager r r r �retries�_�responses r �_make_signing_requestz Signer._make_signing_request] ss � ��#�G�,�,���� �(�(� � /��1B�1R�
�
�
�&��,�
-�
-� � "�#5�6���z�
��(��1�1�8�8��A�A� B�
�
�
�&��/�/�
� '�9�;�;���
=�
=�A� � � ,� ,�T�]�F�C�� Q� Q� Q��}�}��V�$�PW�}�X�X�H���/�1�1����+�.�0�0� �/�<�C�C�H�M�R�R�� � � �:�h�m� 2� 2�7� ;� ;�<�<� <� <� <��'�(M�N�N�Nr c � � dS )z�Optional[str]: The key ID used to identify this private key.
.. warning::
This is always ``None``. The key ID used by IAM can not
be reliably determined ahead of time.
N� )r s r �key_idz
Signer.key_id{ s � � �tr c �` � | � |� � }t j |d � � S )N�
signedBlob)r4 r# � b64decode)r r0 r3 s r �signz Signer.sign� s+ � ��-�-�g�6�6��� �� � 6�7�7�7r N)
�__name__�
__module__� __qualname__�__doc__r r4 �propertyr7 r �copy_docstringr r r; r6 r r r r > s� � � � � � �� �<� <� <�( O� O� O�< �� � �X�� �X� �U�\�*�*�8� 8� +�*�8� 8� 8r r )r? r# � http.client�clientr+ r! � google.authr r r r r �INTERNAL_SERVER_ERROR� BAD_GATEWAY�SERVICE_UNAVAILABLE�GATEWAY_TIMEOUTr* �
_IAM_SCOPE�
_IAM_ENDPOINTr �_IAM_SIGNJWT_ENDPOINT�_IAM_IDTOKEN_ENDPOINTr r6 r r �<module>rM s" �� � � �
�
�
� !� !� !� !� !� !� � � � � ,� ,� ,� ,� ,� ,� � � � � � � #� #� #� #� #� #� � � � � � � "� "� "� "� "� "� �%����#�� � �� 4�
4�
�0� � %� � $� � 6� � J8� J8� J8� J8� J8�U�\� J8� J8� J8� J8� J8r