(phQJ$SrSSKrSSKJr SSKJr SSKJr SSKJr SSKJr SSKJr SS K J r SS K J r "S S \R\R\R5rS rSr"SS\R\R&\R(5rg)zGoogle Compute Engine credentials. This module provides authentication for an application running on Google Compute Engine using the Compute Engine metadata server. N)_helpers) credentials) exceptions)iam)jwt)metrics) _metadata)_clientc^\rSrSrSrSU4SjjrSrSrSr\ S5r \ S5r \ S 5r \ R"\R 5S 5r\ R"\R$5S 5r\ R"\R(5SS j5r\ R"\R,5S 5rSrU=r$) Credentials"aCompute Engine Credentials. These credentials use the Google Compute Engine metadata server to obtain OAuth 2.0 access tokens associated with the instance's service account, and are also used for Cloud Run, Flex and App Engine (except for the Python 2.7 runtime, which is supported only on older versions of this library). For more information about Compute Engine authentication, including how to configure scopes, see the `Compute Engine authentication documentation`_. .. note:: On Compute Engine the metadata server ignores requested scopes. On Cloud Run, Flex and App Engine the server honours requested scopes. .. _Compute Engine authentication documentation: https://cloud.google.com/compute/docs/authentication#using c>[[U] 5 XlX lX0lX@lSUlU(aXPlSUlgg)a Args: service_account_email (str): The service account email to use, or 'default'. A Compute Engine instance may have multiple service accounts. quota_project_id (Optional[str]): The project ID used for quota and billing. scopes (Optional[Sequence[str]]): The list of scopes for the credentials. default_scopes (Optional[Sequence[str]]): Default scopes passed by a Google client library. Use 'scopes' for user-defined scopes. universe_domain (Optional[str]): The universe domain. If not provided or None, credential will attempt to fetch the value from metadata server. If metadata server doesn't have universe domain endpoint, then the default googleapis.com will be used. FTN) superr __init___service_account_email_quota_project_id_scopes_default_scopes_universe_domain_cached_universe_domain)selfservice_account_emailquota_project_idscopesdefault_scopesuniverse_domain __class__s Y/var/www/html/venv/lib/python3.13/site-packages/google/auth/compute_engine/credentials.pyrCredentials.__init__9sG. k4)+&;#!1 -',$ $3 !+/D ( c[R"XRS9nUSUlURc USUlgg)zRetrieve information about the service account. Updates the scopes and retrieves the full service account email. Args: request (google.auth.transport.Request): The object used to make HTTP requests. )service_accountemailNr)r get_service_account_inforr)rrequestinfos r_retrieve_infoCredentials._retrieve_infoZsG11 %@%@ '+7m# << >DL r c"[R$N)rCRED_TYPE_SA_MDSrs r_metric_header_for_usage$Credentials._metric_header_for_usagems'''r c2URb URO URnURU5 [R"XR US9uUlUlg![Ran[R"U5nXCeSnAff=f)a*Refresh the access token and scopes. Args: request (google.auth.transport.Request): The object used to make HTTP requests. Raises: google.auth.exceptions.RefreshError: If the Compute Engine metadata service can't be reached if if the instance has not credentials. N)r"r) rrr'r get_service_account_tokenrtokenexpiryrTransportError RefreshError)rr%r caught_excnew_excs rrefreshCredentials.refreshps"&!9t?S?S *    (&/&I&I)D)DV' #DJ (( * --j9G ) *s=A%%B9BBcUR$)zrThe service account email. .. note:: This is not guaranteed to be set until :meth:`refresh` has been called. rr,s rr!Credentials.service_account_emails***r c$UR(+$r*)rr,s rrequires_scopesCredentials.requires_scopess<<r cUR(a UR$SSKJn [R "UR 55UlSUlUR$)Nr)requestsT)rrgoogle.auth.transportr@r get_universe_domainRequest)rgoogle_auth_requestss rrCredentials.universe_domainsO  ' '(( (J ) = = ( ( *! (,$$$$r c"SSURS.$)Nzmetadata serverzVM credentials)credential_sourcecredential_type principal)rr,s r get_cred_infoCredentials.get_cred_infos"3/33  r cURURUURURS9nURUlUR UlU$)N)rrrr)rrrrrr)rrcredss rwith_quota_projectCredentials.with_quota_projectsT"&"="=-<<//   "&!6!6(,(D(D% r cURUUURURS9nURUlURUlU$)N)rrrr)rrrrr)rrrrMs r with_scopesCredentials.with_scopessR )"&"="=!33   "&!6!6(,(D(D% r cxURURURURURUS9$)N)rrrrr)rrrrr)rrs rwith_universe_domain Credentials.with_universe_domains=~~<<//"&"="=!33+   r )rrrrrrr2r1)defaultNNNNr*)__name__ __module__ __qualname____firstlineno____doc__rr'r-r7propertyrr=rrcopy_docstringrr rJCredentialsWithQuotaProjectrNScopedrQCredentialsWithUniverseDomainrT__static_attributes__ __classcell__rs@rr r "s (( 0B*&(*,++   % %[445 6 [DDE F [//0 1 [FFG H r r iz*https://www.googleapis.com/oauth2/v4/tokencP^\rSrSrSrSU4SjjrSr\R"\ R5S5r \R"\ R5S5r SrSrS r\\R"\ R$5S 55rS r\S 5r\S 5rSrU=r$)IDTokenCredentialsaOpen ID Connect ID Token-based service account credentials. These credentials relies on the default service account of a GCE instance. ID token can be requested from `GCE metadata server identity endpoint`_, IAM token endpoint or other token endpoints you specify. If metadata server identity endpoint is not used, the GCE instance must have been started with a service account that has access to the IAM Cloud API. .. _GCE metadata server identity endpoint: https://cloud.google.com/compute/docs/instances/verifying-instance-identity c >[[U] 5 XlXplX lU(aGU(dU(dU(dU(a[ R"S5eSUlSUl SUl Uc![R"U5n U SUl OXPl U(dWUc([R"U[!5URS9nX`l U=(d ["UlUbX@l g0Ul gg)a| Args: request (google.auth.transport.Request): The object used to make HTTP requests. target_audience (str): The intended audience for these credentials, used when requesting the ID Token. The ID Token's ``aud`` claim will be set to this string. token_uri (str): The OAuth 2.0 Token URI. additional_claims (Mapping[str, str]): Any additional claims for the JWT assertion used in the authorization grant. service_account_email (str): Optional explicit service account to use to sign JWT tokens. By default, this is the default GCE service account. signer (google.auth.crypt.Signer): The signer used to sign JWTs. In case the signer is specified, the request argument will be ignored. use_metadata_identity_endpoint (bool): Whether to use GCE metadata identity endpoint. For backward compatibility the default value is False. If set to True, ``token_uri``, ``additional_claims``, ``service_account_email``, ``signer`` argument should not be set; otherwise ValueError will be raised. quota_project_id (Optional[str]): The project ID used for quota and billing. Raises: ValueError: If ``use_metadata_identity_endpoint`` is set to True, and one of ``token_uri``, ``additional_claims``, ``service_account_email``, ``signer`` arguments is set. zIf use_metadata_identity_endpoint is set, token_uri, additional_claims, service_account_email, signer arguments must not be setNr#)r%rr)rrerr_use_metadata_identity_endpoint_target_audiencerMalformedError _token_uri_additional_claims_signerr r$rrSignerr _DEFAULT_TOKEN_URI) rr%target_audience token_uriadditional_claimsrsigneruse_metadata_identity_endpointrsa_infors rrIDTokenCredentials.__init__sR  $02!1/M, / )-1F& //' #DO&*D #DL (88AG*1'*:D '*? '-~# + *.*E*E "L'=+=DO ,*;'*,'.r c UR(aURSUSURS9$URSURURUUR R 5URSURS9$)aCreate a copy of these credentials with the specified target audience. Args: target_audience (str): The intended audience for these credentials, used when requesting the ID Token. Returns: google.auth.service_account.IDTokenCredentials: A new credentials instance. NTrprtrFrrqrprrrsrtr)rhrrrrkrlcopyrs)rrps rwith_target_audience'IDTokenCredentials.with_target_audience3s  / />> //3!%!7!7 " >>&*&A&A// /"&"9"9">">"@{{/4!%!7!7"  r c UR(aURSURSUS9$URSURURURUR R 5URSUS9$)NTrxFry)rhrrirrkrlrzrs)rrs rrN%IDTokenCredentials.with_quota_projectRs  / />> $ 5 5/3!1 " >>&*&A&A// $ 5 5"&"9"9">">"@{{/4!1"  r c UR(a[R"S5eURSURUUR UR R5URSURS9$)NzCIf use_metadata_identity_endpoint is set, token_uri must not be setFry) rhrrjrrrirlrzrsr)rrqs rwith_token_uri!IDTokenCredentials.with_token_urijsx  / /++X >>&*&A&A# $ 5 5"&"9"9">">"@{{/4!%!6!6"  r c|[R"5n[R"[S9nX-n[R "U5[R "U5UR URURS.nURUR5 [R"URU5nU$)zCreate the OAuth 2.0 assertion. This assertion is used during the OAuth 2.0 grant to acquire an ID token. Returns: bytes: The authorization grant assertion. )seconds)iatexpissaudrp)rutcnowdatetime timedelta_DEFAULT_TOKEN_LIFETIME_SECSdatetime_to_secsrrkriupdaterlrencoderm)rnowlifetimer2payloadr1s r#_make_authorization_grant_assertion6IDTokenCredentials._make_authorization_grant_assertionsoo%%.JK,,S1,,V4--?? $44   t../ 4<<1 r c~SnURSS.n[R[R"50n[R "XX4S9n[R"U5up nU[RRU S54$![ Ran[ R"U5nXveSnAff=f)aRequest ID token from metadata identity endpoint. Args: request (google.auth.transport.Request): The object used to make HTTP requests. Returns: Tuple[str, datetime.datetime]: The ID token and the expiry of the ID token. Raises: google.auth.exceptions.RefreshError: If the Compute Engine metadata service can't be reached or if the instance has no credentials. ValueError: If extracting expiry from the obtained ID token fails. z*instance/service-accounts/default/identityfull)audienceformat)paramsheadersNr) rirAPI_CLIENT_HEADERtoken_request_id_token_mdsr getrr3r4r_unverified_decoderutcfromtimestamp) rr%pathrmetrics_headerid_tokenr5r6_rs r _call_metadata_identity_endpoint3IDTokenCredentials._call_metadata_identity_endpoints *?D"&"7"76JF))7+M+M+ON!}}fH11(;Aq**;;GENKKK (( * --j9G ) *sA B B<B77B<cUR(aURU5uUlUlgUR 5n[ R "XRU5up4nX0lX@lg)a'Refreshes the ID token. Args: request (google.auth.transport.Request): The object used to make HTTP requests. Raises: google.auth.exceptions.RefreshError: If the credentials could not be refreshed. ValueError: If extracting expiry from the obtained ID token fails. N)rhrr1r2rr id_token_jwt_grantrk)rr% assertion access_tokenr2rs rr7IDTokenCredentials.refreshs^  / /&*&K&KG&T #DJ @@BI&-&@&@)' #L!&J Kr cUR$r*)rmr,s rrsIDTokenCredentials.signers||r cUR(a[R"S5eURR U5$)zSigns the given message. Args: message (bytes): The message to sign. Returns: bytes: The message's cryptographic signature. Raises: ValueError: Signer is not available if metadata identity endpoint is used. z=Signer is not available if metadata identity endpoint is used)rhrInvalidOperationrmsign)rmessages r sign_bytesIDTokenCredentials.sign_bytess:  / /--O ||  ))r cUR$)zThe service account email.r:r,s rr(IDTokenCredentials.service_account_emails***r cUR$r*r:r,s r signer_emailIDTokenCredentials.signer_emails***r ) rlrrrmrirkrhr2r1)NNNNFN)rWrXrYrZr[rr{rr]rr^rNCredentialsWithTokenUrirrrr7r\Signingrsrrrrarbrcs@rreres ""',M-^>[DDEF.[@@AB(:L>!, [0012*&++++r re)r[r google.authrrrrrrgoogle.auth.compute_enginer google.oauth2r r_r^r`r rrorrrer rrs #"0!i ++--i X $A^+++''^+r