
    yPjA                       d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm	Z	 ddl
mZmZmZmZ ddlmZ ddlmZmZmZmZmZ dd	lmZmZ dd
lmZmZ erddl
mZmZ ddlmZ  e        Z! G d d      Z" e"       Z#e#jH                  Z$e#jJ                  Z%e#jL                  Z&e#jN                  Z'e#jP                  Z(e#jR                  Z)e#jT                  Z*y)    )annotationsN)Sequence)TYPE_CHECKINGAny   )	Algorithmget_default_algorithms
has_cryptorequires_cryptography)PyJWK)DecodeErrorInvalidAlgorithmErrorInvalidKeyErrorInvalidSignatureErrorInvalidTokenError)base64url_decodebase64url_encode)InsecureKeyLengthWarningRemovedInPyjwt3Warning)AllowedPrivateKeysAllowedPublicKeys)
SigOptionsc                  X   e Zd ZU dZ	 	 d	 	 	 	 	 ddZedd       ZddZddZddZ	ddZ
eddd	d
f	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 ddZ	 	 	 	 d 	 	 	 	 	 	 	 	 	 	 	 	 	 d!dZ	 	 	 	 d 	 	 	 	 	 	 	 	 	 	 	 	 	 d"dZd#dZd$dZ	 	 	 d%	 	 	 	 	 	 	 	 	 	 	 	 	 d&dZdhZded<   d	d	 	 	 	 	 d'dZd(dZd)dZy)*PyJWSJWTNc                R   t               | _        |t        |      nt        | j                        | _        t	        | j                  j                               D ]  }|| j                  vs| j                  |=   | j                         | _        |i | j                  || _        y y )N)r	   _algorithmsset_valid_algslistkeys_get_default_optionsoptions)self
algorithmsr#   keys       C/root/$HERMES_HOME/venv/lib/python3.12/site-packages/jwt/api_jws.py__init__zPyJWS.__init__$   s    
 23)5C
O3t?O?O;P 	
 ((--/0 	*C$***$$S)	* $(#<#<#>6dll6g6DL     c                     dddS )NTF)verify_signatureenforce_minimum_key_length r-   r)   r'   r"   zPyJWS._get_default_options7   s    $(NNr)   c                    || j                   v rt        d      t        |t              st	        d      || j                   |<   | j
                  j                  |       y)z
        Registers a new Algorithm for use when creating and verifying tokens.

        :param str alg_id: the ID of the Algorithm
        :param alg_obj: the Algorithm object
        :type alg_obj: Algorithm
        z Algorithm already has a handler.z!Object is not of type `Algorithm`N)r   
ValueError
isinstancer   	TypeErrorr   add)r$   alg_idalg_objs      r'   register_algorithmzPyJWS.register_algorithm;   sX     T%%%?@@'9-?@@#* V$r)   c                    || j                   vrt        d      | j                   |= | j                  j                  |       y)z
        Unregisters an Algorithm for use when creating and verifying tokens
        :param str alg_id: the ID of the Algorithm
        :raises KeyError: if algorithm is not registered.
        zJThe specified algorithm could not be removed because it is not registered.N)r   KeyErrorr   remove)r$   r3   s     r'   unregister_algorithmzPyJWS.unregister_algorithmL   sH     )))1 
 V$'r)   c                ,    t        | j                        S )zh
        Returns a list of supported values for the `alg` parameter.

        :rtype: list[str]
        )r    r   )r$   s    r'   get_algorithmszPyJWS.get_algorithms[   s     D$$%%r)   c                    	 | j                   |   S # t        $ r/}t        s|t        v rt	        d| d      |t	        d      |d}~ww xY w)a/  
        For a given string name, return the matching Algorithm object.

        Example usage:
        >>> jws_obj = PyJWS()
        >>> jws_obj.get_algorithm_by_name("RS256")

        :param alg_name: The name of the algorithm to retrieve
        :type alg_name: str
        :rtype: Algorithm
        zAlgorithm 'z9' could not be found. Do you have cryptography installed?Algorithm not supportedN)r   r7   r
   r   NotImplementedError)r$   alg_namees      r'   get_algorithm_by_namezPyJWS.get_algorithm_by_namec   sc    	H##H-- 	H(.C"C)!(+de &&?@aG	Hs    	A	*AA	FTc                   g }|t         u r t        |t              r|j                  }	n'd}	n$| t        |t              r|j                  }	nd}	n|}	|r/|j	                  d      }
|
r|d   }	|j	                  d      }|du rd}| j
                  |	d}|r$| j                  |d       |j                  |       |d	   s|d	= |r@d|d<   |j	                  d
g       }t        |t              st        d      d|vrg |d|d
<   nd|v r|d= t        j                  |d||      j                         }|j                  t        |             |r|}nt        |      }|j                  |       dj                  |      }| j!                  |	      }t        |t              r|j"                  }|j%                  |      }|j'                  |      }|rC| j(                  j	                  dd      rt+        |      t-        j.                  |t0        d       |j3                  ||      }|j                  t        |             |rd|d<   dj                  |      }|j5                  d      S )NHS256nonealgb64FT)typrE   encodingrG   critz%Invalid 'crit' header: must be a list),:)
separatorscls	sort_keys   .r,      
stacklevelr)   r   utf-8)_ALGORITHM_UNSETr0   r   algorithm_nameget
header_typ_validate_headersupdater    r   jsondumpsencodeappendr   joinrA   r&   prepare_keycheck_key_lengthr#   r   warningswarnr   signdecode)r$   payloadr&   	algorithmheadersjson_encoderis_payload_detachedsort_headerssegments
algorithm_headers_algheaders_b64headerexisting_critjson_headermsg_payloadsigning_inputr4   key_length_msg	signatureencoded_strings                        r'   r]   zPyJWS.encodex   sU    !# ((#u% //
$
#u% //
#
"J !++e,K$U^
!++e,Ke#&*# *.!L""7T":MM'"e}u!F5M
 #JJvr2MmT2'(OPPM)!8=!8%!8vf_ujjz||

&( 	 	(56!K*73K$ 		(+,,Z8c5!''C!!#& 11#6|| <eD%n55n.FSTULL4	(34 HQK8,$$W--r)   c                ~   |r6t        j                  dt        |j                                t        d       || j
                  }ni | j
                  |}|d   }|r|st        |t              st        d      | j                  |      \  }	}
}}| j                  |       |j                  dd      du ri|j                  d	      xs g }t        |t              rd|vrt        d
      |t        d      |}	dj                  |
j                  dd      d   |	g      }
|r| j!                  |
|||||       |	||dS )Nzypassing additional kwargs to decode_complete() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: rQ   rR   r+   z\It is required that you pass in a value for the "algorithms" argument when calling decode().rF   TFrJ   zAThe 'b64' header parameter requires 'b64' to be listed in 'crit'.zIt is required that you pass in a value for the "detached_payload" argument to decode a message having the b64 header set to false.rP   r   r   )r#   )rf   rp   rv   )rb   rc   tupler!   r   r#   r0   r   r   _loadrY   rW   r    r   r_   rsplit_verify_signature)r$   jwtr&   r%   r#   detached_payloadkwargsmerged_optionsr+   rf   rt   rp   rv   rJ   s                 r'   decode_completezPyJWS.decode_complete   sv    MM'',V[[]';&<> ' ?!\\N888N)*<=Jz#u7Mn  59JJsO1	v&::eT"e+ ::f%+DdD)U$->'W   '! Z  'G II}';';D!'DQ'G&QRM""& #  "
 	
r)   c                    |r6t        j                  dt        |j                                t        d       | j                  |||||      }|d   S )Nzppassing additional kwargs to decode() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: rQ   rR   )r~   rf   )rb   rc   ry   r!   r   r   )r$   r}   r&   r%   r#   r~   r   decodeds           r'   re   zPyJWS.decode  sf     MM'',V[[]';&<> ' &&j'<L ' 
 y!!r)   c                P    | j                  |      d   }| j                  |       |S )zReturns back the JWT header parameters as a `dict`

        Note: The signature is not verified so the header parameters
        should not be fully trusted until signature verification is complete
        rQ   )rz   rY   )r$   r}   rh   s      r'   get_unverified_headerzPyJWS.get_unverified_header3  s)     **S/!$w'r)   c                d   t        |t              r|j                  d      }t        |t              st	        dt               	 |j                  dd      \  }}|j                  dd      \  }}	 t        |      }	 t        j                  |      }t        |t              st	        d      |j                  d	d
      du r|rt	        d      d}
n	 t        |      }
	 t        |      }|
|||fS # t        $ r}t	        d      |d }~ww xY w# t        t        j                  f$ r}t	        d      |d }~ww xY w# t        $ r}	t	        d|	       |	d }	~	ww xY w# t        t        j                  f$ r}t	        d      |d }~ww xY w# t        t        j                  f$ r}t	        d      |d }~ww xY w)NrT   z$Invalid token type. Token must be a rP   r   zNot enough segmentszInvalid header paddingzInvalid header string: z,Invalid header string: must be a json objectrF   TFz2Payload segment must be empty when 'b64' is false.r)   zInvalid payload paddingzInvalid crypto padding)r0   strr]   bytesr   r{   splitr/   r   r1   binasciiErrorr[   loadsdictrW   )r$   r}   rt   crypto_segmentheader_segmentpayload_segmenterrheader_datarp   r@   rf   rv   s               r'   rz   zPyJWS._load>  s   c3**W%C#u% DUGLMM	>,/JJtQ,?)M>.;.A.A$.J+NO	A*>:K	D%)ZZ%<F &$'LMM::eT"e+ !"VWWGF*?;	A(8I 	::M  	>34#=	>
 8>>* 	A67S@	A
  	D 7s;<!C	D( x~~. F!";<#EF
 8>>* 	A67S@	Asx   *C. 0D <D8 E F .	D7DDD5$D00D58	EEEF1E==FF/F**F/c                   ||n| j                   }|t        |t              r|j                  g}	 |d   }|r|||vrt        d      t        |t              rC||j                  k7  rt        d|d|j                        |j                  }	|j                  }
n#	 | j                  |      }	|	j                  |      }
|	j                  |
      }|r9|j                  dd      rt        |      t        j                  |t         d	
       |	j#                  ||
|      st%        d      y # t        $ r t        d      d w xY w# t        $ r}t        d      |d }~ww xY w)NrE   zAlgorithm not specifiedz&The specified alg value is not allowedzToken algorithm z$ does not match the key's algorithm r=   r,   F   rR   zSignature verification failed)r#   r0   r   rV   r7   r   r   r&   rA   r>   r`   ra   rW   r   rb   rc   r   verifyr   )r$   rt   rp   rv   r&   r%   r#   effective_optionsrE   r4   prepared_keyr@   ru   s                r'   r|   zPyJWS._verify_signaturep  s    (/':G*S%"8,,-J	M-C z-#Z2G'(PQQc5! c(((+&sg .!!$!3!3 68  mmG77LN44S9 #..s3L 11,? $$%A5I%n55n.FSTU~~m\9E'(GHH FC  	M'(ABL	M, ' N+,EFAMNs#   D* E *E 	EEErF   zset[str]_supported_critrH   c               f    d|v r| j                  |d          |sd|v r| j                  |       y y y )NkidrJ   )_validate_kid_validate_crit)r$   rh   rI   s      r'   rY   zPyJWS._validate_headers  s=     Gwu~.Fg-( .xr)   c                :    t        |t              st        d      y )Nz(Key ID header parameter must be a string)r0   r   r   )r$   r   s     r'   r   zPyJWS._validate_kid  s    #s##$NOO $r)   c                   |d   }t        |t              rt        |      dk(  rt        d      |D ]L  }t        |t              st        d      || j
                  vrt        d|       ||vs?t        d| d       y )NrJ   r   z/Invalid 'crit' header: must be a non-empty listz-Invalid 'crit' header: values must be stringsz Unsupported critical extension: zCritical extension 'z' is missing from headers)r0   r    lenr   r   r   )r$   rh   rJ   exts       r'   r   zPyJWS._validate_crit  s    v$%Ta#$UVV 	Cc3''(WXX$...'*J3%(PQQ'!'*3%/HI 	r)   )NN)r%   Sequence[str] | Noner#   SigOptions | NonereturnNone)r   r   )r3   r   r4   r   r   r   )r3   r   r   r   )r   z	list[str])r?   r   r   r   )rf   r   r&   z(AllowedPrivateKeys | PyJWK | str | bytesrg   z
str | Nonerh   zdict[str, Any] | Noneri   ztype[json.JSONEncoder] | Nonerj   boolrk   r   r   r   ) NNN)r}   str | bytesr&   'AllowedPublicKeys | PyJWK | str | bytesr%   r   r#   r   r~   bytes | Noner   dict[str, Any]r   r   )r}   r   r&   r   r%   r   r#   r   r~   r   r   r   r   r   )r}   r   r   r   )r}   r   r   z*tuple[bytes, bytes, dict[str, Any], bytes])r   NN)rt   r   rp   r   rv   r   r&   r   r%   r   r#   r   r   r   )rh   r   rI   r   r   r   )r   r   r   r   )rh   r   r   r   )__name__
__module____qualname__rX   r(   staticmethodr"   r5   r9   r;   rA   rU   r]   r   re   r   rz   r|   r   __annotations__rY   r   r   r-   r)   r'   r   r   !   s$   J ,0%)7(7 #7 
	7& O O%"(&H2 !1)-6:$)!a.a. 6a. 	a.
 'a. 4a. "a. a. 
a.L 8:+/%))-@
@
 5@
 )	@

 #@
 '@
 !@
 
@
J 8:+/%))-"" 5" )	"
 #" '" !" 
",	0;n 8:+/%)1I1I 1I 	1I
 51I )1I #1I 
1Ih "'OX' <A)%)48)	)Pr)   r   )+
__future__r   r   r[   rb   collections.abcr   typingr   r   r%   r   r	   r
   r   api_jwkr   
exceptionsr   r   r   r   r   utilsr   r   r   r   r   r   typesr   objectrU   r   _jws_global_objr]   r   re   r5   r9   rA   r   r-   r)   r'   <module>r      s    "    $ %    6 FA!8 ] ]@ '			!11			$77 &;; '== '== r)   