o i,@sddlmZddlZddlZddlZddlmZmZddlm Z m Z m Z m Z ddl mZddlmZmZmZmZddlmZmZdd lmZerPdd lmZmZGd d d ZeZejZejZejZejZej Z ej!Z!ej"Z"dS) ) annotationsN) TYPE_CHECKINGAny) Algorithmget_default_algorithms has_cryptorequires_cryptography)PyJWK) DecodeErrorInvalidAlgorithmErrorInvalidSignatureErrorInvalidTokenError)base64url_decodebase64url_encode)RemovedInPyjwt3Warning)AllowedPrivateKeysAllowedPublicKeysc@seZdZdZ  dHdId d ZedJd d ZdKddZdLddZdMddZ dNddZ     dOdPd+d,Z -   dQdRd4d5Z -   dQdSd7d8Z dTd9d:ZdUd||jvr tdt|tstd||j|<|j|dS)zW Registers a new Algorithm for use when creating and verifying tokens. z Algorithm already has a handler.z!Object is not of type `Algorithm`N)r ValueError isinstancer TypeErrorradd)r!r(r*r#r#r$register_algorithm6s   zPyJWS.register_algorithmcCs*||jvr td|j|=|j|dS)z Unregisters an Algorithm for use when creating and verifying tokens Throws KeyError if algorithm is not registered. zJThe specified algorithm could not be removed because it is not registered.N)rKeyErrorrremove)r!r(r#r#r$unregister_algorithmCs zPyJWS.unregister_algorithm list[str]cCs t|jS)zM Returns a list of supported values for the 'alg' parameter. )rr)r!r#r#r$get_algorithmsQs zPyJWS.get_algorithmsalg_namec CsNz|j|WSty&}zts|tvrtd|d|td|d}~ww)z For a given string name, return the matching Algorithm object. Example usage: >>> jws_obj.get_algorithm_by_name("RS256") z Algorithm 'z9' could not be found. Do you have cryptography installed?Algorithm not supportedN)rr0rr NotImplementedError)r!r5er#r#r$get_algorithm_by_nameWs    zPyJWS.get_algorithm_by_nameHS256FTpayloadbytesr" AllowedPrivateKeys | str | bytes algorithm str | Noneheaders json_encodertype[json.JSONEncoder] | Noneis_payload_detachedbool sort_headerscCs*g}|dur|nd} |r"|d} | r|d} |d} | dur"d}|j| d} |r4||| || ds;| d=|rBd| d<nd| vrI| d=tj| d||d } |t| |r`|}nt|}||d |}| | }| |}| ||}|t||rd |d <d |}| d S)Nnonealgb64FT)typrGrI),:) separatorscls sort_keys.rutf-8)get header_typ_validate_headersupdatejsondumpsencodeappendrjoinr9 prepare_keysigndecode)r!r;r"r>r@rArCrEsegmentsZ algorithm_Z headers_algZ headers_b64headerZ json_headerZ msg_payload signing_inputr* signatureencoded_stringr#r#r$rXhsL              z PyJWS.encodejwt str | bytes'AllowedPublicKeys | PyJWK | str | bytesdetached_payload bytes | Nonedict[str, Any]c Ks|rtdt|t|duri}i|j|}|d}|r-|s-t|ts-td| |\} } } } | dddurU|durFtd|} d | dd d | g} |r`| | | | ||| | | d S) Nzypassing additional kwargs to decode_complete() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: r'z\It is required that you pass in a value for the "algorithms" argument when calling decode().rHTFzIt is required that you pass in a value for the "detached_payload" argument to decode a message having the b64 header set to false.rOrr)r;r_ra)warningswarntuplerrrr,r r _loadrRrZrsplit_verify_signature) r!rdr"rrrgkwargsZmerged_optionsr'r;r`r_rar#r#r$decode_completes:  zPyJWS.decode_completercKs:|rtdt|t|j|||||d}|dS)Nzppassing additional kwargs to decode() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: )rgr;)rjrkrlrrrq)r!rdr"rrrgrpdecodedr#r#r$r]s   z PyJWS.decodecCs||d}|||S)zReturns back the JWT header parameters as a dict() Note: The signature is not verified so the header parameters should not be fully trusted until signature verification is complete )rmrT)r!rdr@r#r#r$get_unverified_headers zPyJWS.get_unverified_header*tuple[bytes, bytes, dict[str, Any], bytes]c Cslt|tr |d}t|tstdtz|dd\}}|dd\}}Wnty9}ztd|d}~wwzt|}Wnt t j fyT}ztd|d}~wwzt |}Wntyp} ztd| | d} ~ wwt|tsztdzt|} Wnt t j fy}ztd |d}~wwzt|} Wnt t j fy}ztd |d}~ww| ||| fS) NrQz$Invalid token type. Token must be a rOrzNot enough segmentszInvalid header paddingzInvalid header string: z,Invalid header string: must be a json objectzInvalid payload paddingzInvalid crypto padding)r,r)rXr<r rnsplitr+rr-binasciiErrorrVloadsdict) r!rdr`Zcrypto_segmentZheader_segmentZpayload_segmenterrZ header_datar_r8r;rar#r#r$rmsL            z PyJWS._loadr`r_rac Cs|dur t|tr |jg}z|d}Wn tytdw|r)|dur-||vr-tdt|tr9|j}|j}nz||}WntyQ} ztd| d} ~ ww| |}| |||sbt ddS)NrGzAlgorithm not specifiedz&The specified alg value is not allowedr6zSignature verification failed) r,r Zalgorithm_namer0r rr"r9r7r[verifyr ) r!r`r_rar"rrGr*Z prepared_keyr8r#r#r$ro s,     zPyJWS._verify_signaturecCsd|vr ||ddSdS)Nkid) _validate_kid)r!r@r#r#r$rT?szPyJWS._validate_headersr}cCst|ts tddS)Nz(Key ID header parameter must be a string)r,r)r)r!r}r#r#r$r~Cs zPyJWS._validate_kid)NN)rrrrrr)rr&)r(r)r*rrr)r(r)rr)rr3)r5r)rr)r:NNFT)r;r<r"r=r>r?r@rrArBrCrDrErDrr))rcNNN) rdrer"rfrrrrrgrhrri) rdrer"rfrrrrrgrhrr)rdrerri)rdrerru)rcN) r`r<r_rirar<r"rfrrrr)r@rirr)r}rrr)__name__ __module__ __qualname__rSr% staticmethodr r/r2r4r9rXrqr]rtrmrorTr~r#r#r#r$rsD      H 0  + r)# __future__rrwrVrjtypingrrrrrrr Zapi_jwkr exceptionsr r r rutilsrrrrrrZ_jws_global_objrXrqr]r/r2r9rtr#r#r#r$s.   .