
    (ph                         S r SSKJrJr  SSKrSSKJrJrJrJr  SSKJ	r	J
r
Jr  SSKJr  SrS\4S	 jrSS
\S\\\4   4S jjr " S S5      r " S S5      rg)zFirebase App Check module.    )AnyDictN)PyJWKClientExpiredSignatureErrorInvalidTokenErrorDecodeError)InvalidAudienceErrorInvalidIssuerErrorInvalidSignatureError)_utils
_app_checkreturnc                 B    [         R                  " U [        [        5      $ N)r   get_app_service_APP_CHECK_ATTRIBUTE_AppCheckService)apps    K/var/www/html/venv/lib/python3.13/site-packages/firebase_admin/app_check.py_get_app_check_servicer      s    !!#';=MNN    tokenc                 6    [        U5      R                  U 5      $ )a}  Verifies a Firebase App Check token.

Args:
    token: A token from App Check.
    app: An App instance (optional).

Returns:
    Dict[str, Any]: The token's decoded claims.

Raises:
    ValueError: If the app's ``project_id`` is invalid or unspecified,
    or if the token's headers or payload are invalid.
    PyJWKClientError: If PyJWKClient fails to fetch a valid signing key.
)r   verify_token)r   r   s     r   r   r      s     "#&33E::r   c                   r    \ rS rSrSrSrSrSrSrSr	S r
S\S\\\4   4S	 jrS
\SS4S jrS\S\4S jrSrg)r   -   z?Service class that implements Firebase App Check functionality.z(https://firebaseappcheck.googleapis.com/z/https://firebaseappcheck.googleapis.com/v1/jwksNc                     UR                   U l        U R                  (       d  [        S5      eSUR                   -   U l        [	        U R
                  SS9U l        g )NzA project ID must be specified to access the App Check service. Either set the projectId option, use service account credentials, or set the GOOGLE_CLOUD_PROJECT environment variable.z	projects/i`T  )lifespan)
project_id_project_id
ValueError_scoped_project_idr   	_JWKS_URL_jwks_client)selfr   s     r   __init___AppCheckService.__init__6   sO    >>=> >
 #.">'Gr   r   r   c                 ^   [         R                  SU5         U R                  R                  U5      nU R	                  [
        R                  " U5      5        U R                  XR                  5      nUR                  S5      US'   U$ ! [        [        4 a  n[        SU 35      eSnAff = f)z$Verifies a Firebase App Check token.zapp check tokenz)Verifying App Check token failed. Error: Nsubapp_id)_Validatorscheck_stringr$   get_signing_key_from_jwt_has_valid_token_headersjwtget_unverified_header_decode_and_verifykeyr   r   r!   get)r%   r   signing_keyverified_claims	exceptions        r   r   _AppCheckService.verify_tokenD   s      !2E:
	++DDUKK))#*C*CE*JK"55e__MO %4$7$7$>! ";/ 	;I;G 	s   AB	 	B,B''B,headersc                     UR                  S5      S:w  a  [        S5      eUR                  S5      nUS:w  a  [        SU S35      eg)	z9Checks whether the token has valid headers for App Check.typJWTz9The provided App Check token has an incorrect type headeralgRS256zQThe provided App Check token has an incorrect alg header. Expected RS256 but got .N)r3   r!   )r%   r8   	algorithms      r   r.   )_AppCheckService._has_valid_token_headersW   sZ     ;;u&XYYKK&	**3A7   r   r4   c                    0 n [         R                  " UUS/U R                  S9nUR                  S
5      n[        U[        5      (       a  U R                  U;  a  [	        S5      eUR                  S5      R                  U R                  5      (       d  [	        S5      e[        R                  SUR                  S5      5        U$ ! [         a    [	        S5      e[
         a    [	        SU R                   S35      e[         a    [	        SU R                   35      e[         a    [	        S5      e[         a  n[	        SU 35      eS	nAff = f)z.Decodes and verifies the token from App Check.r=   )
algorithmsaudiencez6The provided App Check token has an invalid signature.zbThe provided App Check token has an incorrect "aud" (audience) claim. Expected payload to include r>   z^The provided App Check token has an incorrect "iss" (issuer) claim. Expected claim to include z)The provided App Check token has expired.z(Decoding App Check token failed. Error: Naudz>Firebase App Check token has incorrect "aud" (audience) claim.issz2Token does not contain the correct "iss" (issuer).z2The provided App Check token "sub" (subject) claimr)   )r/   decoder"   r   r!   r	   r
   _APP_CHECK_ISSUERr   r   r3   
isinstancelist
startswithr+   r,   )r%   r   r4   payloadr6   rC   s         r   r1   #_AppCheckService._decode_and_verifyd   sp   	jj#900	G: ;;u%(D))T-D-DH-T]^^{{5!,,T-C-CDDQRR  @KK	  A % 	H  $ 	//3/F/F.GqJ  " 	--1-C-C,DF  % 	;  ! 	:9+F 	s   "C A5E=EE)r$   r    r"   )__name__
__module____qualname____firstlineno____doc__rG   r#   r    r"   r$   r&   strr   r   r   r.   r1   __static_attributes__ r   r   r   r   -   sg    IBAIKLH# $sCx. &  * *# *r   r   c                   4    \ rS rSrSr\S\S\4S j5       rSr	g)r+      zzA collection of data validation utilities.

Methods provided in this class raise ``ValueErrors`` if any validations fail.
labelvaluec                     Uc  [        SR                  X5      5      e[        U[        5      (       d  [        SR                  X5      5      eg)z&Checks if the given value is a string.Nz%{0} "{1}" must be a non-empty string.z{0} "{1}" must be a string.)r!   formatrH   rR   )clsrW   rX   s      r   r,   _Validators.check_string   sI     =DKKEYZZ%%%:AA%OPP &r   rT   N)
rM   rN   rO   rP   rQ   classmethodrR   r   r,   rS   rT   r   r   r+   r+      s-    
 Q QS Q Qr   r+   r   )rQ   typingr   r   r/   r   r   r   r   r	   r
   r   firebase_adminr   r   r   rR   r   r   r+   rT   r   r   <module>r`      sg    !  
 R R O O !# O3 O; ;$sCx. ;"a aFQ Qr   