o

��h�X�@s,
dd
lZdd
l
Z
dd
lZddlmZ
ddlmZ
ddlmZ
ddl	m
Z

ddlmZm
Z
mZ
ddlmZmZ
dd	lmZmZmZ
ejejd
d
d
fd
d�
Zdd
�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Z dd�Z!dd�Z"d d!�Z#d"d#�Z$d$d%�Z%d&d'�Z&d(d)�Z'd*d+�Z(d,d-�Z)d.d/�Z*d
S)0�N)
�Mapping�
�pack�
)
�jwk)
�get_random_bytes)�
ALGORITHMS�JWE_SIZE_LIMIT�ZIPS)�JWEError�
JWEParseError)�base64url_decode�base64url_encode�
ensure_binaryc
Cs�t|�
}|t
jv
rtd
|�
�
|t
jv
rtd
|�
�
t�|
|�}
t|||||�}t||�}t|
|||||�\}}	}
}t	|||	|
|�}|S)a�Encrypts plaintext and returns a JWE cmpact serialization string.

    Args:
        plaintext (bytes): A bytes object to encrypt
        key (str or dict): The key(s) to use for encrypting the content. Can be
            individual JWK or JWK set.
        encryption (str, optional): The content encryption algorithm used to
            perform authenticated encryption on the plaintext to produce the
            ciphertext and the Authentication Tag.  Defaults to A256GCM.
        algorithm (str, optional): The cryptographic algorithm used
            to encrypt or determine the value of the CEK.  Defaults to dir.
        zip (str, optional): The compression algorithm) applied to the
            plaintext before encryption. Defaults to None.
        cty (str, optional): The media type for the secured content.
            See http://www.iana.org/assignments/media-types/media-types.xhtml
        kid (str, optional): Key ID for the provided key

    Returns:
        bytes: The string representation of the header, encrypted key,
            initialization vector, ciphertext, and authentication tag.

    Raises:
        JWEError: If there is an error signing the token.

    Examples:
        >>> from jose import jwe
        >>> jwe.encrypt('Hello, World!', 'asecret128bitkey', algorithm='dir', encryption='A128GCM')
        'eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..McILMB3dYsNJSuhcDzQshA.OfX9H_mcUpHDeRM4IA.CcnTWqaqxNsjT4eCaUABSg'

    �Algorithm %s not supported.)
rr�	SUPPORTEDrr�	construct�_encoded_header�	_compress�_encrypt_and_auth�_jwe_compact_serialize)
�	plaintext�key�
encryption�	algorithm�zip�cty�kid�encoded_header�enc_cek�iv�cipher_text�auth_tag�
jwe_string�r$�>/usr/local/CyberPanel/lib/python3.10/site-packages/jose/jwe.py�encrypts










r&c
Cs�
t|�
t
krtd
t|�
�dt
�d��
�
t|�
\}}}}}}z |d}|d}	|tjv
r1td|�
�
|	tjv
r<td|	�
�
WntyH


td�
�
wt�	|
|�}
|tj
kr]|dk}
t|
�
}n'z	|
�|�
}d	}
Wnt
yu


td
|�d��
�
ty�


d}
t|	�
}Yn
w|}|}
zt||	|||
|�}Wnt
y�


td
|	�d��
�
ty�
}
zt|�
�
d}~w
w|du
r�t|�d�
|�}|
r�|SdS)aDecrypts a JWE compact serialized string and returns the plaintext.

    Args:
        jwe_str (str): A JWE to be decrypt.
        key (str or dict): A key to attempt to decrypt the payload with. Can be
            individual JWK or JWK set.

    Returns:
        bytes: The plaintext bytes, assuming the authentication tag is valid.

    Raises:
        JWEError: If there is an exception verifying the token.

    Examples:
        >>> from jose import jwe
        >>> jwe.decrypt(jwe_string, 'asecret128bitkey')
        'Hello, World!'
    zJWE string z bytes exceeds � bytes�alg�encrz!alg and enc headers are required!�T�alg � is not implementedF�enc Nr)�lenr	r�_jwe_compact_deserializerr�KeyErrorrrr�DIR�_get_key_bytes_from_key�
unwrap_key�NotImplementedError�	Exception�_get_random_cek_bytes_for_enc�_decrypt_and_auth�_decompress�get)�jwe_strr�headerr�
encrypted_keyr r!r"r(r)�	cek_valid�	cek_bytes�protected_header�aad�
plain_text�
er$r$r%�decrypt<sP







�
�






�





��
rCc
Cst|�
d
}
|
S)a+
Returns the decoded headers without verification of any kind.

    Args:
        jwe_str (str): A compact serialized JWE to decode the headers from.

    Returns:
        dict: The dict representation of the JWE headers.

    Raises:
        JWEError: If there is an exception decoding the JWE.
    r
)
r/)r:r;r$r$r%�get_unverified_header�s
rDcCs||
tj
vrt||
�\}}}t|||||�}	n|
tjvr$t�||
�}|}	ntd
|
�d��
�
|�||||�}
||	kr<t	d�
�
|
S)a�

    Decrypt and verify the data

    Args:
        cek_bytes (bytes): cek to derive encryption and possible auth key to
            verify the auth tag
        cipher_text (bytes): Encrypted data
        iv (bytes): Initialization vector (iv) used to encrypt data
        aad (bytes): Additional Authenticated Data used to verify the data
        auth_tag (bytes): Authentication ntag to verify the data

    Returns:
        (bytes): Decrypted data
    r-� is not implemented!zInvalid JWE Auth Tag)
r�
HMAC_AUTH_TAG�3_get_encryption_key_mac_key_and_key_length_from_cek�	_auth_tag�GCMrrr4rCr)r>r)r!r r@r"�encryption_key�mac_key�key_len�auth_tag_checkrr$r$r%r7�s








r7c	CsTt|�
d
}|d|�}t
|
|�}||d�}|
�d�
\}}t�||�}|||fS)N�r
�
-)r.�
_get_hmac_key�splitrr)	r>r)�derived_key_len�
mac_key_bytesrK�encryption_key_bytes�encryption_alg�
_rJr$r$r%rG�s








rGc


Cs\
t|�
}z|�
d
d�\}
}}}}t|
�
}Wnty 


td�
�
ttjfy-


td�
�
wzt�	|�
}WntyH
}
ztd|���
�
d}~w
wt
|t�sRtd�
�
zt|�
}	Wnttjfyf


td�
�
wzt|�
}
Wnttjfy{


td	�
�
wzt|�
}Wnttjfy�


td
�
�
wzt|�
}Wnttjfy�


td�
�
w||
|	|
||fS)z�
    Deserialize and verify the header and segments are appropriate.

    Args:
        jwe_bytes (bytes): The compact serialized JWE
    Returns:
        (dict, bytes, bytes, bytes, bytes, bytes)
    �
.�zNot enough segmentszInvalid headerzInvalid header string: Nz,Invalid header string: must be a json objectzInvalid encrypted keyz
Invalid IVzInvalid cyphertextzInvalid auth tag)rrQr
�
ValueErrorr�	TypeError�binascii�Error�json�loads�
isinstancer)
�	jwe_bytes�header_segment�encrypted_key_segment�
iv_segment�cipher_text_segment�auth_tag_segment�header_datar;rBr<r �
ciphertextr"r$r$r%r/
sP


�



�


��




�


�


�


�r/cCsL||
d
�}|r||d<|r||d<|r||d<tj
|ddd��d�
}t|�
S)	a�

    Generate an appropriate JOSE header based on the values provided
    Args:
        alg (str): Key wrap/negotiation algorithm
        enc (str): Encryption algorithm
        zip (str): Compression method
        cty (str): Content type of the encrypted data
        kid (str): ID for the key used for the operation

    Returns:
        bytes: JSON object of header based on input
    )r(r)rrr)�
,�
:T)�
separators�	sort_keyszutf-8)r]�dumps�encoder)r(r)rrrr;�json_headerr$r$r%rQ
s











��rc

Cs
td
|�S)Nz!Qr)
�int_valr$r$r%�_big_endianm
s

rpcCs�z
t||
|�\}}Wnt
y


td
|
�d��
�
w|tjvr9t||�\}}	}
|�||�\}}}
t||||	|
�}n|tjvrNt	�
||�}|�||�\}}}nt
d|�d��
�
||||fS)a/
    Generate a content encryption key (cek) and initialization
    vector (iv) based on enc and alg, compress the plaintext based on zip,
    encrypt the compressed plaintext using the cek and iv based on enc

    Args:
        key (Key): The key provided for encryption
        alg (str): The algorithm use for key wrap/negotiation
        enc (str): The encryption algorithm with which to encrypt the plaintext
        zip (str): The compression algorithm with which to compress the plaintext
        plaintext (bytes): The data to encrypt
        aad (str): Additional authentication data utilized for generating an
                    auth tag

    Returns:
          (bytes, bytes, bytes, bytes): A tuple of the following data
                                 (key wrapped cek, iv, cipher text, auth tag)
    r+r,r-rE)�_get_cekr4rrrFrGr&rHrIrr)rr(r)rrr@r>�kw_cekrJrKrLr rg�tagr"r$r$r%rq
s


�







rcCs|�d
�
\}}t
�|
|�}|S)z�
    Get an HMACKey for the provided encryption algorithm and key bytes

    Args:
        enc (str): Encryption algorithm
        mac_key_bytes (bytes): vytes for the HMAC key

    Returns:
         (HMACKey): The key to perform HMAC actions
    rO)rQrr)r)rSrV�hash_algrKr$r$r%rP�
s

rPcCsR|tj
v
r
td
|�d��
�
|dur|
}|S|tjkr!t�|
�
}|Std
|�d��
�
)z�
    Compress the plaintext based on the algorithm supplied

    Args:
        zip (str): Compression Algorithm
        plaintext (bytes): plaintext to compress

    Returns:
        (bytes): Compressed plaintext
    �ZIP � is not supported!NrE)r
rr4�DEF�zlib�compress)rr�
compressedr$r$r%r�
s




�

�rcCst|tj
v
r
td
|�d��
�
|dur|
}|S|tjkr2t��}|j|
td�}|jr0t	dt�d��
�
|Std
|�d��
�
)z�
    Decompress the plaintext based on the algorithm supplied

    Args:
        zip (str): Compression Algorithm
        plaintext (bytes): plaintext to decompress

    Returns:
        (bytes): Compressed plaintext
    rurvN)
�
max_lengthz Decompressed JWE string exceeds r'rE)
r
rr4rwrx�
decompressobj�
decompressr	�unconsumed_tailr)rrz�decompressed�decompressorr$r$r%r8�
s





�


�r8cCs4|
tj
krt|�
\}}||fSt||�\}}||fS)
a

    Get the content encryption key

    Args:
        enc (str): Encryption algorithm
        alg (str): kwy wrap/negotiation algorithm
        key (Key): Key provided to encryption method

    Return:
        (bytes, bytes): Tuple of (cek bytes and wrapped cek)
    )rr1�_get_direct_key_wrap_cek�_get_key_wrap_cek)r)r(r�cek�wrapped_cekr$r$r%rq�
s


�rqc
Cs:|��}
|
d
dkrt
|�
}d}||fStd�|
d
�
�
�
)z�
    Get the cek and wrapped cek from the encryption key direct

    Args:
        key (Key): Key provided to encryption method

    Return:
        (Key, bytes): Tuple of (cek Key object and wrapped cek)
    �kty�octr*zJWK type {} not supported!)�to_dictr2r4�format)r�jwk_datar>r�r$r$r%r��
s

�r�c
Cs|��}
|
d
}t
|�
}|S)z�
    Get the raw key bytes from a Key object

    Args:
        key (Key): Key from which to extract the raw key bytes
    Returns:
        (bytes) key data
    �
k)r�r
)rr��encoded_keyr>r$r$r%r2s	


r2cCst|�
}|
�
|�
}||fS)
a
_get_rsa_key_wrap_cek
    Get the content encryption key for RSA key wrap

    Args:
        enc (str): Encryption algorithm
        key (Key): Key provided to encryption method

    Returns:
        (Key, bytes): Tuple of (cek Key object and wrapped cek)
    )r6�wrap_key)r)rr>r�r$r$r%r�s


r�c
Cst|tj
krd
}
n*|tjkrd}
n"|tjtjfvrd}
n|tjkr#d}
n|tjkr+d}
nt|�d��
�
t|
d�
}|S)z�
    Get the random cek bytes based on the encryptionn algorithm

    Args:
        enc (str): Encryption algorithm

    Returns:
        (bytes) random bytes for cek key
    ���
i�
iz not supported�)	r�A128GCM�A192GCM�
A128CBC_HS256�A256GCM�
A192CBC_HS384�
A256CBC_HS512r4r)r)�num_bitsr>r$r$r%r6s















r6c	Cs:tt
|�
d
�
}||
||}|�|�
}|d|�}|S)aZ

    Get ann auth tag from the provided data

    Args:
        ciphertext (bytes): Encrypted value
        iv (bytes): Initialization vector
        aad (bytes): Additional Authenticated Data
        mac_key (bytes): Key to use in generating the MAC
        tag_length (int): How log the tag should be

    Returns:
        (bytes) Auth tag
    r�r
)rpr.�sign)	rgr r@rK�
tag_length�al�auth_tag_input�	signaturer"r$r$r%rH9s





rHc	CsLt|�
}t
|
�
}t
|�
}t
|�
}t
|�
}|d
|d
|d
|d
|S)ay

    Generate a compact serialized JWE

    Args:
        encoded_header (bytes): Base64 URL Encoded JWE header JSON
        encrypted_cek (bytes): Encrypted content encryption key (cek)
        iv (bytes): Initialization vector (IV)
        cipher_text (bytes): Cipher text
        auth_tag (bytes): JWE Auth Tag

    Returns:
        (str): JWE compact serialized string
    rW)rr)	r�
encrypted_cekr r!r"�encoded_encrypted_cek�
encoded_iv�encoded_cipher_text�encoded_auth_tagr$r$r%rNs.




���������r)+r[r]rx�collections.abcr�structr�r�backendsr�	constantsrr	r
�
exceptionsrr�utilsr
rrr�r1r&rCrDr7rGr/rrprrPrr8rqr�r2r�r6rHrr$r$r$r%�<module>
s<







.&
J%