U
    
ڲg                     @   s   d Z ddlmZmZ ddlZddlmZmZmZmZ ddlm	Z	m
Z
mZ ddlmZ dZedd	d
Zdeeeef dddZG dd dZG dd dZdS )zFirebase App Check module.    )AnyDictN)PyJWKClientExpiredSignatureErrorInvalidTokenErrorDecodeError)InvalidAudienceErrorInvalidIssuerErrorInvalidSignatureError)_utilsZ
_app_check)returnc                 C   s   t | ttS )N)r   Zget_app_service_APP_CHECK_ATTRIBUTE_AppCheckService)app r   </tmp/pip-unpacked-wheel-p0r7i5ii/firebase_admin/app_check.py_get_app_check_service   s    r   tokenr   c                 C   s   t || S )a  Verifies a Firebase App Check token.

    Args:
        token: A token from App Check.
        app: An App instance (optional).

    Returns:
        Dict[str, Any]: The token's decoded claims.

    Raises:
        ValueError: If the app's ``project_id`` is invalid or unspecified,
        or if the token's headers or payload are invalid.
        PyJWKClientError: If PyJWKClient fails to fetch a valid signing key.
    )r   verify_token)r   r   r   r   r   r      s    r   c                   @   sd   e Zd ZdZdZdZdZdZdZdd Z	e
ee
ef ddd	Zedd
ddZe
e
dddZdS )r   z?Service class that implements Firebase App Check functionality.z(https://firebaseappcheck.googleapis.com/z/https://firebaseappcheck.googleapis.com/v1/jwksNc                 C   s6   |j | _| jstdd|j  | _t| jdd| _d S )NzA project ID must be specified to access the App Check service. Either set the projectId option, use service account credentials, or set the GOOGLE_CLOUD_PROJECT environment variable.z	projects/i`T  )Zlifespan)Z
project_id_project_id
ValueError_scoped_project_idr   	_JWKS_URL_jwks_client)selfr   r   r   r   __init__6   s    z_AppCheckService.__init__r   c              
   C   s   t d| z.| j|}| t| | ||j}W n4 t	t
fk
rn } ztd| W 5 d}~X Y nX |d|d< |S )z$Verifies a Firebase App Check token.zapp check tokenz)Verifying App Check token failed. Error: NsubZapp_id)_Validatorscheck_stringr   Zget_signing_key_from_jwt_has_valid_token_headersjwtZget_unverified_header_decode_and_verifykeyr   r   r   get)r   r   signing_keyZverified_claims	exceptionr   r   r   r   D   s    z_AppCheckService.verify_token)headersr   c                 C   s<   | ddkrtd| d}|dkr8td| ddS )	z9Checks whether the token has valid headers for App Check.typZJWTz9The provided App Check token has an incorrect type headerZalgRS256zQThe provided App Check token has an incorrect alg header. Expected RS256 but got .N)r$   r   )r   r'   	algorithmr   r   r   r    W   s    

z)_AppCheckService._has_valid_token_headers)r   r%   c              
   C   s"  i }zt j||dg| jd}W n tk
r:   tdY n tk
r^   td| j dY nl tk
r   td| j Y nJ tk
r   tdY n0 t	k
r } ztd| W 5 d	}~X Y nX |
d
}t|tr| j|krtd|
d| jstdtd|
d |S )z.Decodes and verifies the token from App Check.r)   )Z
algorithmsaudiencez6The provided App Check token has an invalid signature.zbThe provided App Check token has an incorrect "aud" (audience) claim. Expected payload to include r*   z^The provided App Check token has an incorrect "iss" (issuer) claim. Expected claim to include z)The provided App Check token has expired.z(Decoding App Check token failed. Error: NZaudz>Firebase App Check token has incorrect "aud" (audience) claim.Zissz2Token does not contain the correct "iss" (issuer).z2The provided App Check token "sub" (subject) claimr   )r!   decoder   r
   r   r   r	   _APP_CHECK_ISSUERr   r   r$   
isinstancelist
startswithr   r   )r   r   r%   payloadr&   r,   r   r   r   r"   d   sL    


z#_AppCheckService._decode_and_verify)__name__
__module____qualname____doc__r.   r   r   r   r   r   strr   r   r   r    r"   r   r   r   r   r   -   s   r   c                   @   s$   e Zd ZdZeeedddZdS )r   zA collection of data validation utilities.

    Methods provided in this class raise ``ValueErrors`` if any validations fail.
    )labelvaluec                 C   s6   |dkrt d||t|ts2t d||dS )z&Checks if the given value is a string.Nz%{0} "{1}" must be a non-empty string.z{0} "{1}" must be a string.)r   formatr/   r7   )clsr8   r9   r   r   r   r      s    
z_Validators.check_stringN)r3   r4   r5   r6   classmethodr7   r   r   r   r   r   r   r      s   r   )N)r6   typingr   r   r!   r   r   r   r   r   r	   r
   Zfirebase_adminr   r   r   r7   r   r   r   r   r   r   r   <module>   s   c