
    (phB                         S r SSKrSSKJr  SSKrSSKJr  SSKJr  SSKJ	r	  SSKJ
r
  SSKJr  \R                  \R                  \R                  \R                  1rS/rS	rS
rSrSr " S S\
R,                  5      rg)zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzNhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signJwtzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc                   x    \ rS rSrSrS rS r\S 5       r\	R                  " \R                  5      S 5       rSrg)	Signer>   a  Signs messages using the IAM `signBlob API`_.

This is useful when you need to sign bytes but do not have access to the
credential's private key file.

.. _signBlob API:
    https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
    /signBlob
c                 (    Xl         X l        X0l        g)au  
Args:
    request (google.auth.transport.Request): The object used to make
        HTTP requests.
    credentials (google.auth.credentials.Credentials): The credentials
        that will be used to authenticate the request to the IAM API.
        The credentials must have of one the following scopes:

        - https://www.googleapis.com/auth/iam
        - https://www.googleapis.com/auth/cloud-platform
    service_account_email (str): The service account email identifying
        which service account to use to sign bytes. Often, this can
        be the same as the service account email in the given
        credentials.
N)_request_credentials_service_account_email)selfrequestr   service_account_emails       B/var/www/html/venv/lib/python3.13/site-packages/google/auth/iam.py__init__Signer.__init__I   s       '&;#    c                 j   [         R                  " U5      nSn[        R                  [        R
                  U R                  R                  5      R                  U R                  5      nSS0n[        R                  " S[        R                  " U5      R                  S5      05      R                  S5      n[         R"                  " 5       nU H  nU R                  R%                  U R&                  X#U5        U R'                  X2XTS9nUR(                  [*        ;   a  MP  UR(                  [,        R.                  :w  a/  [0        R2                  " SR                  UR4                  5      5      e[        R6                  " UR4                  R                  S5      5      s  $    [0        R2                  " S5      e)	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestSigner._make_signing_request]   sV   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99;A,,T]]FQ}}$}XH/1+..0 //<CCHMMR  ::hmm227;<<  ''(MNNr   c                     g)zOptional[str]: The key ID used to identify this private key.

.. warning::
   This is always ``None``. The key ID used by IAM can not
   be reliably determined ahead of time.
N )r   s    r   key_idSigner.key_id{   s     r   c                 V    U R                  U5      n[        R                  " US   5      $ )N
signedBlob)r6   r%   	b64decode)r   r2   r5   s      r   signSigner.sign   s(    --g6 677r   )r   r   r   N)__name__
__module____qualname____firstlineno____doc__r   r6   propertyr:   r   copy_docstringr   r	   r?   __static_attributes__r9   r   r   r	   r	   >   sI    <(O<   U\\*8 +8r   r	   )rE   r%   http.clientclientr-   r#   google.authr   r   r   r   r   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr,   
_IAM_SCOPE_IAM_ENDPOINTr   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr	   r9   r   r   <module>rT      s     !  ,   #  " %%##	 44
0 % $ 6 J8U\\ J8r   