
    iv                        d Z ddlZddlmZ ddlZddlZddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ddlmZ ddlmZ ej        ej        ej        ej        hZd	gZ eed
          r ej                    Zn' ej        dd                                          dk    Zerde
j         Zn
de
j         Zde dZedz   Zedz   Zedz   Zedz   Z  G d dej!                  Z!dS )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)mtlsz#https://www.googleapis.com/auth/iamshould_use_client_cert!GOOGLE_API_USE_CLIENT_CERTIFICATEfalsetrueziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                   p    e Zd ZdZd Zd Zed             Z ej	        e
j                  d             ZdS )Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 0    || _         || _        || _        dS )a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   service_account_emails       J/root/projects/butler/venv/lib/python3.11/site-packages/google/auth/iam.py__init__zSigner.__init__S   s!       '&;###    c                 (   t          j        |          }d}t                              t          j        | j        j                                      | j	                  }ddi}t          j        dt          j        |                              d          i                              d          }t!          j                    }|D ]}| j                            | j        |||           |                     ||||          }|j        t*          v rL|j        t,          j        k    r,t1          j        d                    |j                            t          j        |j                            d                    c S t1          j        d          )	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestzSigner._make_signing_requestg   ss   #G,, ((/1B1R
 

&,
-
- 	 "#56z(1188AAB
 

&// 	 '9;; 	= 	=A,,T]FCQQQ}}V$PW}XXH/11+.00 /<CCHMRR   :hm227;;<<<<<'(MNNNr   c                     dS )zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        N )r   s    r   key_idzSigner.key_id   s	     tr   c                 `    |                      |          }t          j        |d                   S )N
signedBlob)r9   r(   	b64decode)r   r5   r8   s      r   signzSigner.sign   s+    --g66 6777r   N)__name__
__module____qualname____doc__r   r9   propertyr<   r   copy_docstringr   r   r@   r;   r   r   r   r   H   s         < < <(O O O<   X XU\**8 8 +*8 8 8r   r   )"rD   r(   http.clientclientr0   r&   osgoogle.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr/   
_IAM_SCOPEhasattrr	   use_client_certgetenvlowerr#   _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr!   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr   r;   r   r   <module>rZ      s     ! ! ! ! ! !  				 , , , , , ,             # # # # # #       " " " " " " & & & & & & %#	 44
 74)** 1d133OO 		5w??EEGG6Q   JN)LNNKKIK$GIIK L;KKK  66"[0 %
2 %(:: J8 J8 J8 J8 J8U\ J8 J8 J8 J8 J8r   