HEX

File: //usr/local/CyberCP/lib/python3.10/site-packages/google/auth/__pycache__/pluggable.cpython-310.pyc
o

�h�C�@s�dZzddlmZWneyddlmZYnwddlZddlZddlZddlZddl	Z	ddl
mZddl
mZddl
m
Z
dZdZd	Zd
ZdZdZGdd
�d
e
j�ZdS)a�Pluggable Credentials.
Pluggable Credentials are initialized using external_account arguments which
are typically loaded from third-party executables. Unlike other
credentials that can be initialized with a list of explicit arguments, secrets
or credentials, external account clients use the environment and hints/guidelines
provided by the external_account JSON file to retrieve credentials and exchange
them for Google access tokens.

Example credential_source for pluggable credential:
{
    "executable": {
        "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
        "timeout_millis": 5000,
        "output_file": "/path/to/generated/cached/credentials"
    }
}
�)�MappingN)�_helpers)�
exceptions)�external_account�i0ui�i��i@wcs�eZdZdZ�fdd�Ze�ej�dd��Z	dd�Z
edd	��Ze
�fd
d��Ze
�fdd
��Zdd�Zdd�Zdd�Zdd�Zdd�Z�fdd�Z�ZS)�Credentialsz6External account credentials sourced from executables.cs
|�dd�|_tt|�j|||||d�|��t|t�s$d|_t�	d��|�
d�|_|js2t�	d��|j�
d�|_|j�
d	�|_|j�
d
�|_
|j�
d�|_d|_|jsYt�	d
��|js`t|_n|jtksj|jtkrot�d��|j
r�|j
tks||j
tkr�t�d��dSdS)adInstantiates an external account credentials object from a executables.

        Args:
            audience (str): The STS audience field.
            subject_token_type (str): The subject token type.
            token_url (str): The STS endpoint URL.
            credential_source (Mapping): The credential source dictionary used to
                provide instructions on how to retrieve external credential to be
                exchanged for Google access tokens.

                Example credential_source for pluggable credential:

                    {
                        "executable": {
                            "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
                            "timeout_millis": 5000,
                            "output_file": "/path/to/generated/cached/credentials"
                        }
                    }
            args (List): Optional positional arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.
            kwargs (Mapping): Optional keyword arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.

        Raises:
            google.auth.exceptions.RefreshError: If an error is encountered during
                access token retrieval logic.
            google.auth.exceptions.InvalidValue: For invalid parameters.
            google.auth.exceptions.MalformedError: For invalid parameters.

        .. note:: Typically one of the helper constructors
            :meth:`from_file` or
            :meth:`from_info` are used instead of calling the constructor directly.
        �interactiveF)�audience�subject_token_type�	token_url�credential_sourceNz?Missing credential_source. The credential_source is not a dict.�
executablez<Missing credential_source. An 'executable' must be provided.�command�timeout_millis�interactive_timeout_millis�output_file�z;Missing command field. Executable command must be provided.z*Timeout must be between 5 and 120 seconds.z>Interactive timeout must be between 30 seconds and 30 minutes.)�popr�superr�__init__�
isinstancer�_credential_source_executabler�MalformedError�get�%_credential_source_executable_command�,_credential_source_executable_timeout_millis�8_credential_source_executable_interactive_timeout_millis�)_credential_source_executable_output_file�_tokeninfo_username�!EXECUTABLE_TIMEOUT_MILLIS_DEFAULT�%EXECUTABLE_TIMEOUT_MILLIS_LOWER_BOUND�%EXECUTABLE_TIMEOUT_MILLIS_UPPER_BOUND�InvalidValue�1EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS_LOWER_BOUND�1EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS_UPPER_BOUND)�selfr	r
rr�args�kwargs��	__class__��H/usr/local/CyberCP/lib/python3.10/site-packages/google/auth/pluggable.pyr>sv*
���
����������
����zCredentials.__init__c	Cs�|��|jdurVzt|jdd��
}t�|�}Wd�n1s!wYWn	ty0Yn&wz|�|�}d|vr>tj�W|Stj	tj
fyL�tjyUYnwt��s_t�d��t
j��}|�|�d|d<|jru|jdn|jd}|jr�tjnd}|jr�tjntj}|jr�tjntj}	tj|j��||||	|d�}
|
jd	kr�t�d
�|
j|
j���|
jr�t�|
j� d��nd}|s�|jdur�t�t|jdd��}|�|�}|S)N�utf-8)�encoding�expiration_time�0Pluggable auth is only supported for python 3.7+�0�GOOGLE_EXTERNAL_ACCOUNT_REVOKE��)�timeout�stdin�stdout�stderr�envrz9Executable exited with non-zero return code {}. Error: {})!�_validate_running_moder�open�json�load�	Exception�_parse_subject_tokenr�RefreshErrorrr"r�is_python_3�os�environ�copy�_inject_env_variablesrrr�sysr4r5�
subprocess�PIPE�STDOUT�runr�split�
returncode�format�loads�decode)r%�requestr�response�
subject_tokenr7�exe_timeout�	exe_stdin�
exe_stdout�
exe_stderr�resultr*r*r+�retrieve_subject_token�sv
����
����

���
���
z"Credentials.retrieve_subject_tokencCs�|jst�d��|��t��st�d��tj�	�}|�
|�d|d<tj|j
��|jdtjtj|d�}|jdkrEt�d�|j|j���t�|j�d	��}|�|�d
S)aGRevokes the subject token using the credential_source object.

        Args:
            request (google.auth.transport.Request): A callable used to make
                HTTP requests.
        Raises:
            google.auth.exceptions.RefreshError: If the executable revocation
                not properly executed.

        z.Revoke is only enabled under interactive mode.r/�1r1r2)r3r5r6r7rzNAuth revoke failed on executable. Exit with non-zero return code {}. Error: {}r,N)rrr"r8rr?r>r@rArBrCrErHrrIrrFrGrJrKr5r:rLrM�_validate_revoke_response)r%rNr7rUrOr*r*r+�revoke�s:��

��
	��zCredentials.revokecCs|jp|jS)a1Returns the external account identifier.

        When service account impersonation is used the identifier is the service
        account email.

        Without service account impersonation, this returns None, unless it is
        being used by the Google Cloud CLI which populates this field.
        )�service_account_emailr)r%r*r*r+�external_account_idszCredentials.external_account_idc�tt|�j|fi|��S)a'Creates a Pluggable Credentials instance from parsed external account info.

        Args:
            info (Mapping[str, str]): The Pluggable external account info in Google
                format.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.pluggable.Credentials: The constructed
                credentials.

        Raises:
            google.auth.exceptions.InvalidValue: For invalid parameters.
            google.auth.exceptions.MalformedError: For invalid parameters.
        )rr�	from_info)�cls�infor'r(r*r+r]+szCredentials.from_infocr\)ajCreates an Pluggable Credentials instance from an external account json file.

        Args:
            filename (str): The path to the Pluggable external account json file.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.pluggable.Credentials: The constructed
                credentials.
        )rr�	from_file)r^�filenamer'r(r*r+r`>szCredentials.from_filecCs`|j|d<|j|d<|j|d<|jrdnd|d<|jdur"|j|d<|jdur.|j|d<dSdS)	N� GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE�"GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE�GOOGLE_EXTERNAL_ACCOUNT_IDrWr0�#GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE�*GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL�#GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE)�	_audience�_subject_token_typer[r�"_service_account_impersonation_urlrZr)r%r7r*r*r+rCLs



��
���z!Credentials._inject_env_variablescCs�|�|�|ds#d|vsd|vrt�d��t�d�|d|d���d|vr4|dt��kr4t�d��d|vr=t�d	��|dd
ksI|ddkrM|dS|dd
krW|dSt�d��)N�success�code�messagez;Error code and message fields are required in the response.zAExecutable returned unsuccessful response: code: {}, message: {}.r.z0The token returned by the executable is expired.�
token_typez8The executable response is missing the token_type field.z$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token�id_tokenz&urn:ietf:params:oauth:token-type:saml2�
saml_responsez+Executable returned unsupported token type.)�_validate_response_schemarrr>rK�time�r%rOr*r*r+r=[s2
�����
z Credentials._parse_subject_tokencCs |�|�|dst�d��dS)Nrkz)Revoke failed with unsuccessful response.)rqrr>rsr*r*r+rXys

�z%Credentials._validate_revoke_responsecCsHd|vr	t�d��|dtkrt�d�|d���d|vr"t�d��dS)N�versionz5The executable response is missing the version field.z+Executable returned unsupported version {}.rkz5The executable response is missing the success field.)rr� EXECUTABLE_SUPPORTED_MAX_VERSIONr>rKrsr*r*r+rq~s�����z%Credentials._validate_response_schemacCshtj�d�}|dkrt�d��|jr|jst�d��|jr%|js%t�d��|jr0|j	s2t�
d��dSdS)N�)GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLESrWzhExecutables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run.zVAn output_file must be specified in the credential configuration for interactive mode.z;Interactive mode cannot run without an interactive timeout.z4Interactive mode is only enabled for workforce pool.)r@rArrrrrr�InvalidOperation�is_workforce_poolr")r%�env_allow_executablesr*r*r+r8�s.��������z"Credentials._validate_running_modecstt|���}d|d<|S)Nr
�source)rr�_create_default_metrics_options)r%�metrics_optionsr(r*r+r{�sz+Credentials._create_default_metrics_options)�__name__�
__module__�__qualname__�__doc__rr�copy_docstringrrrVrY�propertyr[�classmethodr]r`rCr=rXrqr8r{�
__classcell__r*r*r(r+r;s$
h
H/

r)r��collections.abcr�ImportError�collectionsr:r@rErDrr�google.authrrrrurr r!r#r$rr*r*r*r+�<module>s*�