
    (phk6                         S r SSKJr  SSKrSSKrSSKJr  SSKJr  SSKJ	r	  SSK
Jr   SSKr\R                  " \5      r " S	 S
\R$                  5      r  SS jr " S S5      rg! \ a  r\" S5      \eSrCff = f)zAuthorization support for gRPC.    )absolute_importN)environment_vars)
exceptions)_mtls_helper)service_accountzWgRPC is not installed from please install the grpcio package to use the gRPC transport.c                   <   ^  \ rS rSrSrSU 4S jjrS rS rSrU =r	$ )AuthMetadataPlugin%   a>  A `gRPC AuthMetadataPlugin`_ that inserts the credentials into each
request.

.. _gRPC AuthMetadataPlugin:
    http://www.grpc.io/grpc/python/grpc.html#grpc.AuthMetadataPlugin

Args:
    credentials (google.auth.credentials.Credentials): The credentials to
        add to requests.
    request (google.auth.transport.Request): A HTTP transport request
        object used to refresh credentials as needed.
    default_host (Optional[str]): A host like "pubsub.googleapis.com".
        This is used when a self-signed JWT is created from service
        account credentials.
c                 N   > [         [        U ]  5         Xl        X l        X0l        g N)superr	   __init___credentials_request_default_host)selfcredentialsrequestdefault_host	__class__s       M/var/www/html/venv/lib/python3.13/site-packages/google/auth/transport/grpc.pyr   AuthMetadataPlugin.__init__6   s$     	 $02')    c                    0 n[        U R                  [        R                  5      (       aG  U R                  R	                  U R
                  (       a  SR                  U R
                  5      OS5        U R                  R                  U R                  UR                  UR                  U5        [        UR                  5       5      $ )zGets the authorization headers for a request.

Returns:
    Sequence[Tuple[str, str]]: A list of request headers (key, value)
        to add to the request.
zhttps://{}/N)
isinstancer   r   Credentials_create_self_signed_jwtr   formatbefore_requestr   method_nameservice_urllistitems)r   contextheaderss      r   _get_authorization_headers-AuthMetadataPlugin._get_authorization_headers?   s      d'')D)DEE55<@<N<N$$T%7%78TX 	((MM7..0C0CW	
 GMMO$$r   c                 4    U" U R                  U5      S5        g)zPasses authorization metadata into the given callback.

Args:
    context (grpc.AuthMetadataContext): The RPC context.
    callback (grpc.AuthMetadataPluginCallback): The callback that will
        be invoked to pass in the authorization metadata.
N)r&   )r   r$   callbacks      r   __call__AuthMetadataPlugin.__call__W   s     	0094@r   )r   r   r   r   )
__name__
__module____qualname____firstlineno____doc__r   r&   r*   __static_attributes____classcell__)r   s   @r   r	   r	   %   s     *%0A Ar   r	   c                    [        X5      n[        R                  " U5      nU(       a  U(       a  [        R                  " S5      eU(       d  [
        R                  " [        R                  S5      nUS:X  a%  U(       a  U" 5       u  p[        R                  " XS9nO2US:X  a  [        5       nUR                  nO[        R                  " 5       n[        R                  " X75      n[        R                  " X,40 UD6$ )a  Creates a secure authorized gRPC channel.

This creates a channel with SSL and :class:`AuthMetadataPlugin`. This
channel can be used to create a stub that can make authorized requests.
Users can configure client certificate or rely on device certificates to
establish a mutual TLS channel, if the `GOOGLE_API_USE_CLIENT_CERTIFICATE`
variable is explicitly set to `true`.

Example::

    import google.auth
    import google.auth.transport.grpc
    import google.auth.transport.requests
    from google.cloud.speech.v1 import cloud_speech_pb2

    # Get credentials.
    credentials, _ = google.auth.default()

    # Get an HTTP request function to refresh credentials.
    request = google.auth.transport.requests.Request()

    # Create a channel.
    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, regular_endpoint, request,
        ssl_credentials=grpc.ssl_channel_credentials())

    # Use the channel to create a stub.
    cloud_speech.create_Speech_stub(channel)

Usage:

There are actually a couple of options to create a channel, depending on if
you want to create a regular or mutual TLS channel.

First let's list the endpoints (regular vs mutual TLS) to choose from::

    regular_endpoint = 'speech.googleapis.com:443'
    mtls_endpoint = 'speech.mtls.googleapis.com:443'

Option 1: create a regular (non-mutual) TLS channel by explicitly setting
the ssl_credentials::

    regular_ssl_credentials = grpc.ssl_channel_credentials()

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, regular_endpoint, request,
        ssl_credentials=regular_ssl_credentials)

Option 2: create a mutual TLS channel by calling a callback which returns
the client side certificate and the key (Note that
`GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly
set to `true`)::

    def my_client_cert_callback():
        code_to_load_client_cert_and_key()
        if loaded:
            return (pem_cert_bytes, pem_key_bytes)
        raise MyClientCertFailureException()

    try:
        channel = google.auth.transport.grpc.secure_authorized_channel(
            credentials, mtls_endpoint, request,
            client_cert_callback=my_client_cert_callback)
    except MyClientCertFailureException:
        # handle the exception

Option 3: use application default SSL credentials. It searches and uses
the command in a context aware metadata file, which is available on devices
with endpoint verification support (Note that
`GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly
set to `true`).
See https://cloud.google.com/endpoint-verification/docs/overview::

    try:
        default_ssl_credentials = SslCredentials()
    except:
        # Exception can be raised if the context aware metadata is malformed.
        # See :class:`SslCredentials` for the possible exceptions.

    # Choose the endpoint based on the SSL credentials type.
    if default_ssl_credentials.is_mtls:
        endpoint_to_use = mtls_endpoint
    else:
        endpoint_to_use = regular_endpoint
    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, endpoint_to_use, request,
        ssl_credentials=default_ssl_credentials)

Option 4: not setting ssl_credentials and client_cert_callback. For devices
without endpoint verification support or `GOOGLE_API_USE_CLIENT_CERTIFICATE`
environment variable is not `true`, a regular TLS channel is created;
otherwise, a mutual TLS channel is created, however, the call should be
wrapped in a try/except block in case of malformed context aware metadata.

The following code uses regular_endpoint, it works the same no matter the
created channle is regular or mutual TLS. Regular endpoint ignores client
certificate and key::

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, regular_endpoint, request)

The following code uses mtls_endpoint, if the created channle is regular,
and API mtls_endpoint is confgured to require client SSL credentials, API
calls using this channel will be rejected::

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, mtls_endpoint, request)

Args:
    credentials (google.auth.credentials.Credentials): The credentials to
        add to requests.
    request (google.auth.transport.Request): A HTTP transport request
        object used to refresh credentials as needed. Even though gRPC
        is a separate transport, there's no way to refresh the credentials
        without using a standard http transport.
    target (str): The host and port of the service.
    ssl_credentials (grpc.ChannelCredentials): Optional SSL channel
        credentials. This can be used to specify different certificates.
        This argument is mutually exclusive with client_cert_callback;
        providing both will raise an exception.
        If ssl_credentials and client_cert_callback are None, application
        default SSL credentials are used if `GOOGLE_API_USE_CLIENT_CERTIFICATE`
        environment variable is explicitly set to `true`, otherwise one way TLS
        SSL credentials are used.
    client_cert_callback (Callable[[], (bytes, bytes)]): Optional
        callback function to obtain client certicate and key for mutual TLS
        connection. This argument is mutually exclusive with
        ssl_credentials; providing both will raise an exception.
        This argument does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE`
        environment variable is explicitly set to `true`.
    kwargs: Additional arguments to pass to :func:`grpc.secure_channel`.

Returns:
    grpc.Channel: The created gRPC channel.

Raises:
    google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
        creation failed for any reason.
zUReceived both ssl_credentials and client_cert_callback; these are mutually exclusive.falsetruecertificate_chainprivate_key)r	   grpcmetadata_call_credentialsr   MalformedErrorosgetenvr   !GOOGLE_API_USE_CLIENT_CERTIFICATEssl_channel_credentialsSslCredentialsssl_credentialscomposite_channel_credentialssecure_channel)r   r   targetrA   client_cert_callbackkwargsmetadata_plugingoogle_auth_credentialsuse_client_certcertkeyadc_ssl_credentilscomposite_credentialss                r   secure_authorized_channelrN   b   s    h )>O #<<_M/'',
 	
 ))>>
 f$)=,.ID"::"&O &!/!10@@O"::<O !>> vGGGr   c                   >    \ rS rSrSrS r\S 5       r\S 5       rSr	g)r@   i  a"  Class for application default SSL credentials.

The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment
variable whose default value is `false`. Client certificate will not be used
unless the environment variable is explicitly set to `true`. See
https://google.aip.dev/auth/4114

If the environment variable is `true`, then for devices with endpoint verification
support, a device certificate will be automatically loaded and mutual TLS will
be established.
See https://cloud.google.com/endpoint-verification/docs/overview.
c                     [         R                  " [        R                  S5      nUS:w  a  SU l        g [
        R                  " [
        R                  5      nUS LU l        g )Nr4   r5   F)r<   r=   r   r>   _is_mtlsr   _check_config_pathCONTEXT_AWARE_METADATA_PATH)r   rI   metadata_paths      r   r   SslCredentials.__init__)  sU    ))>>
 f$!DM );;88M *5DMr   c                 T   U R                   (       a>   [        R                  " 5       u  pp1[        R                  " X#S9U l        U R
                  $ [        R                  " 5       U l        U R
                  $ ! [        R                   a  n[        R                  " U5      nXTeSnAff = f)a  Get the created SSL channel credentials.

For devices with endpoint verification support, if the device certificate
loading has any problems, corresponding exceptions will be raised. For
a device without endpoint verification support, no exceptions will be
raised.

Returns:
    grpc.ChannelCredentials: The created grpc channel credentials.

Raises:
    google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
        creation failed for any reason.
r6   N)	rQ   r   get_client_ssl_credentialsr9   r?   _ssl_credentialsr   ClientCertErrorMutualTLSChannelError)r   _rJ   rK   
caught_excnew_excs         r   rA   SslCredentials.ssl_credentials6  s      ==."."I"I"K(,(D(D&*)% $$$ %)$@$@$BD!$$$ -- .$:::F-.s   1A6 6B'
B""B'c                     U R                   $ )z?Indicates if the created SSL channel credentials is mutual TLS.)rQ   )r   s    r   is_mtlsSslCredentials.is_mtlsT  s     }}r   )rQ   rX   N)
r,   r-   r.   r/   r0   r   propertyrA   r`   r1    r   r   r@   r@     s4    6 % %:  r   r@   )NN)r0   
__future__r   loggingr<   google.authr   r   google.auth.transportr   google.oauth2r   r9   ImportErrorr\   	getLoggerr,   _LOGGERr	   rN   r@   rc   r   r   <module>rl      s    & &  	 ( " . ) 

H
%:A00 :AB vHr< <}  
as   A' 'A;-	A66A;