o

��ha�@sldZd
dl
Z
d
dlmZ
d
dlZd
dlmZ
d
dlmZ
d
dlm	Z	
dg
Z
dZdZd	Z
Gd
d�dej�ZdS)z�Tools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
�N)
�_helpers)
�crypt)
�
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc@s@eZ
dZd
Zdd�Zdd�Zedd��
Ze�	e
j�
dd	��
Zd
S)�Signera
Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    cCs|
|_||_
||_d
S)a�
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)�_request�_credentials�_service_account_email)�self�request�credentials�service_account_email�r
�E/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/iam.py�__init__<s


zSigner.__init__cCs�t�
|
�
}
d
}t�|j�
}ddi
}t�dt�|
�
�	d�
i
�
�
d�
}|j�|j
|||�
|j
||||d�}|jtjkrCt�d�|j�
�
�
t�|j�	d�
�
S)z(Makes a request to the API signBlob API.�POSTzContent-Typezapplication/json�payloadzutf-8)�url�method�body�headersz&Error calling the IAM signBlob API: {})r�to_bytes�_IAM_SIGN_ENDPOINT�formatr�json�dumps�base64�	b64encode�decode�encoder�before_requestr�status�http_client�OKr�TransportError�data�loads)r	�messagerrrr�responser
r
r�_make_signing_requestPs 




��



�zSigner._make_signing_requestc


Csd
S)z�Optional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        Nr
)
r	r
r
r�key_idesz
Signer.key_idcCs|�|
�
}t
�|d
�
S)N�
signedBlob)r(r�	b64decode)r	r&r'r
r
r�signos

zSigner.signN)
�__name__�
__module__�__qualname__�__doc__rr(�propertyr)r�copy_docstringrrr,r
r
r
rr1s




	
r)r0r�http.client�clientr!r�google.authrrr�
_IAM_SCOPE�
_IAM_ENDPOINTr�_IAM_IDTOKEN_ENDPOINTrr
r
r
r�<module>
s



���