
    &gB                         d Z ddlZddlmZ ddlZddlmZ ddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ej        ej        ej        ej        hZdgZd	Zd
ZdZdZ G d de
j                  ZdS )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzNhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signJwtzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc                   p    e Zd ZdZd Zd Zed             Z ej	        e
j                  d             ZdS )Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 0    || _         || _        || _        dS )a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   service_account_emails       A/var/www/api/venv/lib/python3.11/site-packages/google/auth/iam.py__init__zSigner.__init__I   s!       '&;###    c                 (   t          j        |          }d}t                              t          j        | j        j                                      | j	                  }ddi}t          j        dt          j        |                              d          i                              d          }t!          j                    }|D ]}| j                            | j        |||           |                     ||||          }|j        t*          v rL|j        t,          j        k    r,t1          j        d                    |j                            t          j        |j                            d                    c S t1          j        d          )	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestzSigner._make_signing_request]   ss   #G,, ((/1B1R
 

&,
-
- 	 "#56z(1188AAB
 

&// 	 '9;; 	= 	=A,,T]FCQQQ}}V$PW}XXH/11+.00 /<CCHMRR   :hm227;;<<<<<'(MNNNr   c                     dS )zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        N )r   s    r   key_idzSigner.key_id{   s	     tr   c                 `    |                      |          }t          j        |d                   S )N
signedBlob)r4   r#   	b64decode)r   r0   r3   s      r   signzSigner.sign   s+    --g66 6777r   N)__name__
__module____qualname____doc__r   r4   propertyr7   r   copy_docstringr   r	   r;   r6   r   r   r	   r	   >   s         < < <(O O O<   X XU\**8 8 +*8 8 8r   r	   )r?   r#   http.clientclientr+   r!   google.authr   r   r   r   r   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr*   
_IAM_SCOPE_IAM_ENDPOINTr   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr	   r6   r   r   <module>rM      s"     ! ! ! ! ! !  , , , , , ,             # # # # # #       " " " " " " %#	 44
0 % $ 6 J8 J8 J8 J8 J8U\ J8 J8 J8 J8 J8r   