
    (pha                     ^   S r SSKrSSKrSSKJr  SSKJr  SSKrSSKJ	r	  SSKJ
r
  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SrSrSrSrSrSr\R0                  S4S jr " S S\R4                  \R6                  \R8                  5      r " S S\R6                  5      r/ 4S jrg)a  Google Cloud Impersonated credentials.

This module provides authentication for applications where local credentials
impersonates a remote service account using `IAM Credentials API`_.

This class can be used to impersonate a service account as long as the original
Credential object has the "Service Account Token Creator" role on the target
service account.

    .. _IAM Credentials API:
        https://cloud.google.com/iam/credentials/reference/rest/
    N)datetime)_exponential_backoff)_helperscredentials)
exceptions)iam)jwt)metrics)_clientz*Unable to acquire impersonated credentialsi  z#https://oauth2.googleapis.com/tokenauthorized_userservice_account external_account_authorized_userc                    U=(       d=    [         R                  R                  [        R                  U5      R                  U5      n[        R                  " U5      R                  S5      nU " USX#S9n[        UR                  S5      (       a  UR                  R                  S5      OUR                  nUR                  [        R                  :w  a  [        R                   " ["        U5      e [        R$                  " U5      n	U	S   n
[&        R(                  " U	S   S5      nX4$ ! [*        [,        4 a1  n[        R                   " SR                  ["        5      U5      nXeS	nAff = f)
a  Makes a request to the Google Cloud IAM service for an access token.
Args:
    request (Request): The Request object to use.
    principal (str): The principal to request an access token for.
    headers (Mapping[str, str]): Map of headers to transmit.
    body (Mapping[str, str]): JSON Payload body for the iamcredentials
        API call.
    iam_endpoint_override (Optiona[str]): The full IAM endpoint override
        with the target_principal embedded. This is useful when supporting
        impersonation with regional endpoints.

Raises:
    google.auth.exceptions.TransportError: Raised if there is an underlying
        HTTP connection error
    google.auth.exceptions.RefreshError: Raised if the impersonated
        credentials are not available.  Common reasons are
        `iamcredentials.googleapis.com` is not enabled or the
        `Service Account Token Creator` is not assigned
utf-8POSTurlmethodheadersbodydecodeaccessToken
expireTimez%Y-%m-%dT%H:%M:%SZz6{}: No access token or invalid expiration in response.N)r	   _IAM_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINformatjsondumpsencodehasattrdatar   statushttp_clientOKr   RefreshError_REFRESH_ERRORloadsr   strptimeKeyError
ValueError)request	principalr   r   universe_domainiam_endpoint_overrideiam_endpointresponseresponse_bodytoken_responsetokenexpiry
caught_excnew_excs                 W/var/www/html/venv/lib/python3.13/site-packages/google/auth/impersonated_credentials.py_make_iam_token_requestr:   9   s:   6 ) C,=,=,E,E++_-fY  ::d""7+D<SH
 8==(++ 	W%]]  +..(%%nmDD&M2}-"">,#?AUV}j! &))DKK 	
 %&s   07D( (E)8,E$$E)c                     ^  \ rS rSrSrSS\SS4U 4S jjrS r\R                  " \
R                  5      S 5       rS rS r\S	 5       r\S
 5       r\S 5       r\S 5       r\R                  " \
R                  5      S 5       rS r\R                  " \
R,                  5      S 5       r\R                  " \
R0                  5      SS j5       r\SS j5       rSrU =r$ )Credentialsw   a&  This module defines impersonated credentials which are essentially
impersonated identities.

Impersonated Credentials allows credentials issued to a user or
service account to impersonate another. The target service account must
grant the originating credential principal the
`Service Account Token Creator`_ IAM role:

For more information about Token Creator IAM role and
IAMCredentials API, see
`Creating Short-Lived Service Account Credentials`_.

.. _Service Account Token Creator:
    https://cloud.google.com/iam/docs/service-accounts#the_service_account_token_creator_role

.. _Creating Short-Lived Service Account Credentials:
    https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials

Usage:

First grant source_credentials the `Service Account Token Creator`
role on the target account to impersonate.   In this example, the
service account represented by svc_account.json has the
token creator role on
`impersonated-account@_project_.iam.gserviceaccount.com`.

Enable the IAMCredentials API on the source project:
`gcloud services enable iamcredentials.googleapis.com`.

Initialize a source credential which does not have access to
list bucket::

    from google.oauth2 import service_account

    target_scopes = [
        'https://www.googleapis.com/auth/devstorage.read_only']

    source_credentials = (
        service_account.Credentials.from_service_account_file(
            '/path/to/svc_account.json',
            scopes=target_scopes))

Now use the source credentials to acquire credentials to impersonate
another service account::

    from google.auth import impersonated_credentials

    target_credentials = impersonated_credentials.Credentials(
      source_credentials=source_credentials,
      target_principal='impersonated-account@_project_.iam.gserviceaccount.com',
      target_scopes = target_scopes,
      lifetime=500)

Resource access is granted::

    client = storage.Client(credentials=target_credentials)
    buckets = client.list_buckets(project='your_project')
    for bucket in buckets:
      print(bucket.name)
Nc	                   > [         [        U ]  5         [        R                  " U5      U l        [        U R                  [        R                  5      (       a  U R                  R                  [        R                  5      U l        [        U R                  S5      (       a6  U R                  R                  (       a  U R                  R                  S5        UR                  U l        X l        X0l        X@l        XPl        U=(       d    [(        U l        SU l        [.        R0                  " 5       U l        Xpl        Xl        SU l        g)a<  
Args:
    source_credentials (google.auth.Credentials): The source credential
        used as to acquire the impersonated credentials.
    target_principal (str): The service account to impersonate.
    target_scopes (Sequence[str]): Scopes to request during the
        authorization grant.
    delegates (Sequence[str]): The chained list of delegates required
        to grant the final access_token.  If set, the sequence of
        identities must have "Service Account Token Creator" capability
        granted to the prceeding identity.  For example, if set to
        [serviceAccountB, serviceAccountC], the source_credential
        must have the Token Creator role on serviceAccountB.
        serviceAccountB must have the Token Creator on
        serviceAccountC.
        Finally, C must have Token Creator on target_principal.
        If left unset, source_credential must have that role on
        target_principal.
    lifetime (int): Number of seconds the delegated credential should
        be valid for (upto 3600).
    quota_project_id (Optional[str]): The project ID used for quota and billing.
        This project may be different from the project used to
        create the credentials.
    iam_endpoint_override (Optional[str]): The full IAM endpoint override
        with the target_principal embedded. This is useful when supporting
        impersonation with regional endpoints.
    subject (Optional[str]): sub field of a JWT. This field should only be set
        if you wish to impersonate as a user. This feature is useful when
        using domain wide delegation.
_create_self_signed_jwtN)superr<   __init__copy_source_credentials
isinstancer   Scopedwith_scopesr	   
_IAM_SCOPEr"   _always_use_jwt_accessr?   r/   _universe_domain_target_principal_target_scopes
_delegates_subject_DEFAULT_TOKEN_LIFETIME_SECS	_lifetimer5   r   utcnowr6   _quota_project_id_iam_endpoint_override_cred_file_path)
selfsource_credentialstarget_principaltarget_scopes	delegatessubjectlifetimequota_project_idr0   	__class__s
            r9   rA   Credentials.__init__   s    T 	k4)+#'99-?#@  d..0B0BCC'+'?'?'K'K(D$ 002KLL,,CC((@@F 2 B B!1+#!A%A
oo'!1&;##    c                 "    [         R                  $ N)r   CRED_TYPE_SA_IMPERSONATErT   s    r9   _metric_header_for_usage$Credentials._metric_header_for_usage   s    ///r^   c                 &    U R                  U5        g r`   )_update_token)rT   r-   s     r9   refreshCredentials.refresh  s    7#r^   c           	         U R                   R                  [        R                  R                  :X  d2  U R                   R                  [        R                  R
                  :X  a  U R                   R                  U5        U R                  U R                  [        U R                  5      S-   S.nSS[        R                  [        R                  " 5       0nU R                   R                  U5        U R                  (       Ga  U R                   [        R"                  :w  a  [$        R&                  " S5      e[(        R*                  " 5       nU R,                  [(        R.                  " U R                  =(       d    S5      U R                  [0        [(        R2                  " U5      [(        R2                  " U5      [4        -   S.n[7        UU R,                  UUU R                  S9n[8        R:                  " U[0        U5      u  U l        U l        ng	[A        UU R,                  UUU R                   U RB                  S
9u  U l        U l        g	)zUpdates credentials with a new access_token representing
the impersonated account.

Args:
    request (google.auth.transport.requests.Request): Request object
        to use for refreshing credentials.
s)rX   scoperZ   Content-Typeapplication/jsonzNDomain-wide delegation is not supported in universes other than googleapis.com )issrk   subaudiatexp)r-   r.   r   payloadrX   N)r-   r.   r   r   r/   r0   )"rC   token_stater   
TokenStateSTALEINVALIDrg   rL   rK   strrO   r   API_CLIENT_HEADER&token_request_access_token_impersonateapplyrM   r/   r   r   GoogleAuthErrorr   rP   rJ   scopes_to_string_GOOGLE_OAUTH2_TOKEN_ENDPOINTdatetime_to_secsrN   _sign_jwt_requestr   	jwt_grantr5   r6   r:   rR   )rT   r-   r   r   nowrt   	assertion_s           r9   rf   Credentials._update_token  s    $$00K4J4J4P4PP''33{7M7M7U7UU$$,,W5 ((DNN+c1
 .%%w'U'U'W
 	  &&w/ ===##{'J'JJ 00, 
 //#C--!2243F3F3L"M}}40050058TTG *00//I *1):):6	*&DJQ "9,, 00"&"="=#

DKr^   c                 d   SSK Jn  [        R                  R	                  [
        R                  U R                  5      R                  U R                  5      n[        R                  " U5      R                  S5      U R                  S.nSS0nU" U R                  5      n [        R                   " 5       nU H  nUR#                  X5US9n	U	R$                  [        R&                  ;   a  M3  U	R$                  [(        R*                  :w  a3  [,        R.                  " SR                  U	R1                  5       5      5      e[        R2                  " U	R1                  5       S	   5      s  UR5                  5         $    UR5                  5         [,        R.                  " S
5      e! UR5                  5         f = f)Nr   AuthorizedSessionr   )rt   rX   rl   rm   )r   r   r   zError calling sign_bytes: {}
signedBlobz#exhausted signBlob endpoint retries)google.auth.transport.requestsr   r	   _IAM_SIGN_ENDPOINTr   r   r   r/   r   rJ   base64	b64encoder   rL   rC   r   ExponentialBackoffpoststatus_codeIAM_RETRY_CODESr%   r&   r   TransportErrorr   	b64decodeclose)
rT   messager   iam_sign_endpointr   r   authed_sessionretriesr   r2   s
             r9   
sign_bytesCredentials.sign_bytesN  sh   D22:://1E1E

&''
( 	
 ''077@

 "#56*4+C+CD	#*==?G)..) /  ''3+>+>>'';>>9$336==hmmoN  ''(EFF  "    "''(MNN   "s   !CF 5F F/c                     U R                   $ r`   rJ   rb   s    r9   signer_emailCredentials.signer_emailp      %%%r^   c                     U R                   $ r`   r   rb   s    r9   service_account_email!Credentials.service_account_emailt  r   r^   c                     U $ r`   rn   rb   s    r9   signerCredentials.signerx  s    r^   c                 $    U R                   (       + $ r`   )rK   rb   s    r9   requires_scopesCredentials.requires_scopes|  s    &&&&r^   c                 Z    U R                   (       a  U R                   SU R                  S.$ g )Nzimpersonated credentials)credential_sourcecredential_typer.   )rS   rJ   rb   s    r9   get_cred_infoCredentials.get_cred_info  s/    %)%9%9#=!33 
 r^   c           
          U R                  U R                  U R                  U R                  U R                  U R
                  U R                  U R                  S9nU R                  Ul        U$ )N)rV   rW   rX   rZ   r[   r0   )	r\   rC   rJ   rK   rL   rO   rQ   rR   rS   )rT   creds     r9   
_make_copyCredentials._make_copy  se    ~~$$!33--oo^^!33"&"="=  
  $33r^   c                 2    U R                  5       nXl        U$ r`   )r   rQ   )rT   r[   r   s      r9   with_quota_projectCredentials.with_quota_project  s     !1r^   c                 F    U R                  5       nU=(       d    UUl        U$ r`   )r   rK   )rT   scopesdefault_scopesr   s       r9   rF   Credentials.with_scopes  s      $6r^   c                    UR                  S5      nUR                  S5      nU[        :X  a"  SSKJn  UR                  R                  U5      nO}U[        :X  a"  SSKJn  UR                  R                  U5      nOQU[        :X  a"  SSK
Jn  UR                  R                  U5      nO%[        R                  " SR                  U5      5      eUR                  S5      n	U	R!                  S	5      n
U	R#                  S
5      nU
S:X  d  US:X  d  X:  a%  [        R$                  " SR                  U	5      5      eXS-   U nUR                  S5      nUR                  S5      nU " UUUUUS9$ )a  Creates a Credentials instance from parsed impersonated service account credentials info.

Args:
    info (Mapping[str, str]): The impersonated service account credentials info in Google
        format.
    scopes (Sequence[str]): Optional list of scopes to include in the
        credentials.

Returns:
    google.oauth2.credentials.Credentials: The constructed
        credentials.

Raises:
    InvalidType: If the info["source_credentials"] are not a supported impersonation type
    InvalidValue: If the info["service_account_impersonation_url"] is not in the expected format.
    ValueError: If the info is not in the expected format.
rU   typer   r   )r   )r   z.source credential of type {} is not supported.!service_account_impersonation_url/z:generateAccessTokenz'Cannot extract target principal from {}   rX   r[   )r[   )get'_SOURCE_CREDENTIAL_AUTHORIZED_USER_TYPEgoogle.oauth2r   r<   from_authorized_user_info'_SOURCE_CREDENTIAL_SERVICE_ACCOUNT_TYPEr   from_service_account_info8_SOURCE_CREDENTIAL_EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPEgoogle.authr   	from_infor   InvalidTyper   rfindfindInvalidValue)clsinfor   source_credentials_infosource_credentials_typer   rU   r   r   impersonation_urlstart_index	end_indexrV   rX   r[   s                  r9   &from_impersonated_service_account_info2Credentials.from_impersonated_service_account_info  sz   ( #'((+?"@"9"="=f"E"&MM1!,!8!8!R!R'" %(OO5!0!<!<!V!V'" $GH E!A!M!M!W!W'" ((@GG+  !HH%HI'--c2%**+AB	"	R;3J))9@@ARS  -1_yIHH[)	88$67-
 	
r^   )rS   rL   rR   rO   rQ   rC   rM   rJ   rK   rI   r6   r5   r`   )__name__
__module____qualname____firstlineno____doc__rN   rA   rc   r   copy_docstringr   r<   rg   rf   r   propertyr   r   r   r   r   r   CredentialsWithQuotaProjectr   rE   rF   classmethodr   __static_attributes____classcell__r\   s   @r9   r<   r<   w   s4   ;D -"F$P0 [445$ 6$F
P OD & & & &   ' ' [445 6 [DDE F
 [//0 1
 B
 B
r^   r<   c                      ^  \ rS rSrSr   S
U 4S jjrSS jrS rS r\	R                  " \R                  5      S 5       r\	R                  " \R                  5      S 5       rS	rU =r$ )IDTokenCredentialsi  zAOpen ID Connect ID Token-based service account credentials.

    c                    > [         [        U ]  5         [        U[        5      (       d  [
        R                  " S5      eXl        X l        X0l	        X@l
        g)aI  
Args:
    target_credentials (google.auth.Credentials): The target
        credential used as to acquire the id tokens for.
    target_audience (string): Audience to issue the token for.
    include_email (bool): Include email in IdToken
    quota_project_id (Optional[str]):  The project ID used for
        quota and billing.
z4Provided Credential must be impersonated_credentialsN)r@   r   rA   rD   r<   r   r}   _target_credentials_target_audience_include_emailrQ   )rT   target_credentialstarget_audienceinclude_emailr[   r\   s        r9   rA   IDTokenCredentials.__init__  sQ      	 $02,k::,,I  $6  /+!1r^   c                 N    U R                  UUU R                  U R                  S9$ N)r   r   r   r[   )r\   r   rQ   )rT   r   r   s      r9   from_credentials#IDTokenCredentials.from_credentials	  s0    ~~1+--!33	  
 	
r^   c                 b    U R                  U R                  UU R                  U R                  S9$ r   )r\   r   r   rQ   )rT   r   s     r9   with_target_audience'IDTokenCredentials.with_target_audience  s6    ~~#77+--!33	  
 	
r^   c                 b    U R                  U R                  U R                  UU R                  S9$ r   )r\   r   r   rQ   )rT   r   s     r9   with_include_email%IDTokenCredentials.with_include_email  s6    ~~#77 11'!33	  
 	
r^   c                 b    U R                  U R                  U R                  U R                  US9$ r   )r\   r   r   r   )rT   r[   s     r9   r   %IDTokenCredentials.with_quota_project!  s6    ~~#77 11---	  
 	
r^   c                    SSK Jn  [        R                  R	                  [
        R                  U R                  R                  5      R                  U R                  R                  5      nU R                  U R                  R                  U R                  S.nSS[        R                  [        R                   " 5       0nU" U R                  R"                  US9n UR%                  UU[&        R(                  " U5      R+                  S5      S9nUR-                  5         UR.                  [0        R2                  :w  a3  [4        R6                  " S	R                  UR'                  5       5      5      eUR'                  5       S
   nXl        [:        R<                  " [>        R@                  " USS9S   5      U l!        g ! UR-                  5         f = f)Nr   r   )audiencerX   includeEmailrl   rm   )auth_requestr   )r   r   r#   zError getting ID token: {}r5   F)verifyrs   )"r   r   r	   _IAM_IDTOKEN_ENDPOINTr   r   r   r   r/   r   r   r   rL   r   r   rz   "token_request_id_token_impersonaterC   r   r   r    r!   r   r   r%   r&   r   r'   r5   r   utcfromtimestampr
   r   r6   )	rT   r-   r   r   r   r   r   r2   id_tokens	            r9   rg   IDTokenCredentials.refresh*  s   D55==//$$44
 &))66
7 	 --11<< //
 .%%w'Q'Q'S

 +$$88w
	#%**%ZZ%,,W5 + H   ";>>1)),33HMMOD  ==?7+
//JJx.u5
   "s   4F= =G)r   rQ   r   r   r6   r5   )NFNr`   )r   r   r   r   r   rA   r   r   r   r   r   r   r   r   r<   rg   r   r   r   s   @r9   r   r     sr     26


 [DDE
 F
 [445)
 6)
r^   r   c                    [         R                  R                  U5      nU[        R                  " U5      S.n[        R                  " U5      R                  S5      nU " USX&S9n[        UR                  S5      (       a  UR                  R                  S5      OUR                  nUR                  [        R                  :w  a  [        R                  " [        U5      e [        R                  " U5      n	U	S   n
U
$ ! [         ["        4 a1  n[        R                  " SR                  [        5      U5      nXeSnAff = f)	a  Makes a request to the Google Cloud IAM service to sign a JWT using a
service account's system-managed private key.
Args:
    request (Request): The Request object to use.
    principal (str): The principal to request an access token for.
    headers (Mapping[str, str]): Map of headers to transmit.
    payload (Mapping[str, str]): The JWT payload to sign. Must be a
        serialized JSON object that contains a JWT Claims Set.
    delegates (Sequence[str]): The chained list of delegates required
        to grant the final access_token.  If set, the sequence of
        identities must have "Service Account Token Creator" capability
        granted to the prceeding identity.  For example, if set to
        [serviceAccountB, serviceAccountC], the source_credential
        must have the Token Creator role on serviceAccountB.
        serviceAccountB must have the Token Creator on
        serviceAccountC.
        Finally, C must have Token Creator on target_principal.
        If left unset, source_credential must have that role on
        target_principal.

Raises:
    google.auth.exceptions.TransportError: Raised if there is an underlying
        HTTP connection error
    google.auth.exceptions.RefreshError: Raised if the impersonated
        credentials are not available.  Common reasons are
        `iamcredentials.googleapis.com` is not enabled or the
        `Service Account Token Creator` is not assigned
)rX   rt   r   r   r   r   	signedJwtz{}: No signed JWT in response.N)r	   _IAM_SIGNJWT_ENDPOINTr   r   r    r!   r"   r#   r   r$   r%   r&   r   r'   r(   r)   r+   r,   )r-   r.   r   rt   rX   r1   r   r2   r3   jwt_response
signed_jwtr7   r8   s                r9   r   r   W  s   : ,,33I>L"tzz'/BCD::d""7+D<SH
 8==(++ 	W%]]  +..(%%nmDD	&zz-0!+.
j! &)),33NC]
 %	&s   "C? ?E ,D;;E ) r   r   rB   r   http.clientclientr%   r   r   r   r   r   r   r	   r
   r   r   r   r(   rN   r   r   r   r   r   r:   rE   r   Signingr<   r   r   rn   r^   r9   <module>r
     s       !  ,   # "    ! >#  E *; '*; '& 9  77;&|o
??ATATo
dk
@@ k
\ GI 7&r^   