U
    
ڲg                  H   @   sF  d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dd	lm	Z	 d
Z
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRgHZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZej Z ej!Z!ej"Z"ej#Z#ej$Z$ej%Z%ej&Z&ej'Z'ej(Z(ej)Z)ej*Z*ej+Z+ej,Z,ej-Z-ej.Z.ej/Z/ej0Z0ej1Z1ej2Z2ej3Z3ej4Z4ej5Z5ej6Z6ej7Z7dSdT Z8dudVd7Z9dvdXdQZ:dwdYd:Z;dxdZdRZ<dyd[dLZ=dzd\dEZ>d{d]dFZ?d|d^dGZ@d}d_dHZAdUejBdUfd`dKZCdad; ZDdbdP ZEd~dcdMZFdddd>ZGdded?ZHddfdIZIddgdAZJddhd@ZKddidBZLddjdCZMddkd8ZNddldNZOddmd<ZPdUejQdUfdndoZRddpdDZSddqd9ZTddrdOZUddsd=ZVdUejQdUfdtdJZWdUS )zFirebase Authentication module.

This module contains functions for minting and verifying JWTs used for
authenticating against Firebase services. It also provides functions for
creating and managing user accounts in Firebase projects.
    )_auth_client)_auth_providers)_auth_utils)_user_identifier)
_token_gen)_user_import)	_user_mgt)_utilsZ_authActionCodeSettingsCertificateFetchErrorClientConfigurationNotFoundErrorDELETE_ATTRIBUTEEmailAlreadyExistsErrorEmailNotFoundError	ErrorInfoExpiredIdTokenErrorExpiredSessionCookieErrorExportedUserRecordDeleteUsersResultGetUsersResultImportUserRecordInsufficientPermissionErrorInvalidDynamicLinkDomainErrorInvalidIdTokenErrorInvalidSessionCookieErrorListProviderConfigsPageListUsersPageOIDCProviderConfigPhoneNumberAlreadyExistsErrorProviderConfigResetPasswordExceedLimitErrorRevokedIdTokenErrorRevokedSessionCookieErrorSAMLProviderConfigTokenSignErrorTooManyAttemptsTryLaterErrorUidAlreadyExistsErrorUnexpectedResponseErrorUserDisabledErrorUserImportHashUserImportResultUserInfoUserMetadataUserNotFoundErrorUserProvider
UserRecordUserIdentifierUidIdentifierEmailIdentifierPhoneIdentifierProviderIdentifiercreate_custom_tokencreate_oidc_provider_configcreate_saml_provider_configcreate_session_cookiecreate_userdelete_oidc_provider_configdelete_saml_provider_configdelete_userdelete_users generate_email_verification_linkgenerate_password_reset_link generate_sign_in_with_email_linkget_oidc_provider_configget_saml_provider_configget_userget_user_by_emailget_user_by_phone_number	get_usersimport_userslist_saml_provider_configs
list_usersrevoke_refresh_tokensset_custom_user_claimsupdate_oidc_provider_configupdate_saml_provider_configupdate_userverify_id_tokenverify_session_cookiec                 C   s   t | ttS )a  Returns a client instance for an App.

    If the App already has a client associated with it, simply returns
    it. Otherwise creates a new client, and adds it to the App before
    returning it.

    Args:
        app: A Firebase App instance (or ``None`` to use the default App).

    Returns:
        Client: A client for the specified App instance.

    Raises:
        ValueError: If the app argument is invalid.
    )r	   Zget_app_service_AUTH_ATTRIBUTEr   )app rT   7/tmp/pip-unpacked-wheel-p0r7i5ii/firebase_admin/auth.py_get_client   s    rV   Nc                 C   s   t |}|| |S )a  Builds and signs a Firebase custom auth token.

    Args:
        uid: ID of the user for whom the token is created.
        developer_claims: A dictionary of claims to be included in the token
            (optional).
        app: An App instance (optional).

    Returns:
        bytes: A token minted from the input parameters.

    Raises:
        ValueError: If input parameters are invalid.
        TokenSignError: If an error occurs while signing the token using the remote IAM service.
    )rV   r6   )uidZdeveloper_claimsrS   clientrT   rT   rU   r6      s    Fc                 C   s   t |}|j| ||dS )a  Verifies the signature and data for the provided JWT.

    Accepts a signed token string, verifies that it is current, and issued
    to this project, and that it was correctly signed by Google.

    Args:
        id_token: A string of the encoded JWT.
        app: An App instance (optional).
        check_revoked: Boolean, If true, checks whether the token has been revoked or
            the user disabled (optional).
        clock_skew_seconds: The number of seconds to tolerate when checking the token.
            Must be between 0-60. Defaults to 0.
    Returns:
        dict: A dictionary of key-value pairs parsed from the decoded JWT.

    Raises:
        ValueError: If ``id_token`` is a not a string or is empty.
        InvalidIdTokenError: If ``id_token`` is not a valid Firebase ID token.
        ExpiredIdTokenError: If the specified ID token has expired.
        RevokedIdTokenError: If ``check_revoked`` is ``True`` and the ID token has been revoked.
        CertificateFetchError: If an error occurs while fetching the public key certificates
            required to verify the ID token.
        UserDisabledError: If ``check_revoked`` is ``True`` and the corresponding user
            record is disabled.
    )check_revokedclock_skew_seconds)rV   rP   )id_tokenrS   rY   rZ   rX   rT   rT   rU   rP      s      c                 C   s   t |}|j| |S )a  Creates a new Firebase session cookie from the given ID token and options.

    The returned JWT can be set as a server-side session cookie with a custom cookie policy.

    Args:
        id_token: The Firebase ID token to exchange for a session cookie.
        expires_in: Duration until the cookie is expired. This can be specified
            as a numeric seconds value or a ``datetime.timedelta`` instance.
        app: An App instance (optional).

    Returns:
        bytes: A session cookie generated from the input parameters.

    Raises:
        ValueError: If input parameters are invalid.
        FirebaseError: If an error occurs while creating the cookie.
    )rV   Z_token_generatorr9   )r[   Z
expires_inrS   rX   rT   rT   rU   r9      s    c                 C   s,   t |}|j| |}|r(||td |S )a  Verifies a Firebase session cookie.

    Accepts a session cookie string, verifies that it is current, and issued
    to this project, and that it was correctly signed by Google.

    Args:
        session_cookie: A session cookie string to verify.
        check_revoked: Boolean, if true, checks whether the cookie has been revoked or the
            user disabled (optional).
        app: An App instance (optional).
        clock_skew_seconds: The number of seconds to tolerate when checking the cookie.

    Returns:
        dict: A dictionary of key-value pairs parsed from the decoded JWT.

    Raises:
        ValueError: If ``session_cookie`` is a not a string or is empty.
        InvalidSessionCookieError: If ``session_cookie`` is not a valid Firebase session cookie.
        ExpiredSessionCookieError: If the specified session cookie has expired.
        RevokedSessionCookieError: If ``check_revoked`` is ``True`` and the cookie has been revoked.
        CertificateFetchError: If an error occurs while fetching the public key certificates
            required to verify the session cookie.
        UserDisabledError: If ``check_revoked`` is ``True`` and the corresponding user
            record is disabled.
    zsession cookie)rV   Z_token_verifierrQ   Z_check_jwt_revoked_or_disabledr#   )Zsession_cookierY   rS   rZ   rX   Zverified_claimsrT   rT   rU   rQ      s       c                 C   s   t |}||  dS )aA  Revokes all refresh tokens for an existing user.

    This function updates the user's ``tokens_valid_after_timestamp`` to the current UTC
    in seconds since the epoch. It is important that the server on which this is called has its
    clock set correctly and synchronized.

    While this revokes all sessions for a specified user and disables any new ID tokens for
    existing sessions from getting minted, existing ID tokens may remain active until their
    natural expiration (one hour). To verify that ID tokens are revoked, use
    ``verify_id_token(idToken, check_revoked=True)``.

    Args:
        uid: A user ID string.
        app: An App instance (optional).

    Raises:
        ValueError: If the user ID is None, empty or malformed.
        FirebaseError: If an error occurs while revoking the refresh token.
    N)rV   rK   rW   rS   rX   rT   rT   rU   rK      s    c                 C   s   t |}|j| dS )a  Gets the user data corresponding to the specified user ID.

    Args:
        uid: A user ID string.
        app: An App instance (optional).

    Returns:
        UserRecord: A user record instance.

    Raises:
        ValueError: If the user ID is None, empty or malformed.
        UserNotFoundError: If the specified user ID does not exist.
        FirebaseError: If an error occurs while retrieving the user.
    )rW   )rV   rD   r\   rT   rT   rU   rD   8  s    c                 C   s   t |}|j| dS )a  Gets the user data corresponding to the specified user email.

    Args:
        email: A user email address string.
        app: An App instance (optional).

    Returns:
        UserRecord: A user record instance.

    Raises:
        ValueError: If the email is None, empty or malformed.
        UserNotFoundError: If no user exists by the specified email address.
        FirebaseError: If an error occurs while retrieving the user.
    )email)rV   rE   )r]   rS   rX   rT   rT   rU   rE   K  s    c                 C   s   t |}|j| dS )a  Gets the user data corresponding to the specified phone number.

    Args:
        phone_number: A phone number string.
        app: An App instance (optional).

    Returns:
        UserRecord: A user record instance.

    Raises:
        ValueError: If the phone number is None, empty or malformed.
        UserNotFoundError: If no user exists by the specified phone number.
        FirebaseError: If an error occurs while retrieving the user.
    )phone_number)rV   rF   )r^   rS   rX   rT   rT   rU   rF   ^  s    c                 C   s   t |}|| S )aa  Gets the user data corresponding to the specified identifiers.

    There are no ordering guarantees; in particular, the nth entry in the
    result list is not guaranteed to correspond to the nth entry in the input
    parameters list.

    A maximum of 100 identifiers may be supplied. If more than 100
    identifiers are supplied, this method raises a `ValueError`.

    Args:
        identifiers (list[UserIdentifier]): A list of ``UserIdentifier``
            instances used to indicate which user records should be returned.
            Must have <= 100 entries.
        app: An App instance (optional).

    Returns:
        GetUsersResult: A ``GetUsersResult`` instance corresponding to the
        specified identifiers.

    Raises:
        ValueError: If any of the identifiers are invalid or if more than 100
            identifiers are specified.
    )rV   rG   )ZidentifiersrS   rX   rT   rT   rU   rG   q  s    c                 C   s   t |}|j| |dS )a  Retrieves a page of user accounts from a Firebase project.

    The ``page_token`` argument governs the starting point of the page. The ``max_results``
    argument governs the maximum number of user accounts that may be included in the returned page.
    This function never returns None. If there are no user accounts in the Firebase project, this
    returns an empty page.

    Args:
        page_token: A non-empty page token string, which indicates the starting point of the page
            (optional). Defaults to ``None``, which will retrieve the first page of users.
        max_results: A positive integer indicating the maximum number of users to include in the
            returned page (optional). Defaults to 1000, which is also the maximum number allowed.
        app: An App instance (optional).

    Returns:
        ListUsersPage: A page of user accounts.

    Raises:
        ValueError: If ``max_results`` or ``page_token`` are invalid.
        FirebaseError: If an error occurs while retrieving the user accounts.
    )
page_tokenmax_results)rV   rJ   r_   r`   rS   rX   rT   rT   rU   rJ     s    c                  K   s    |  dd}t|}|jf | S )a  Creates a new user account with the specified properties.

    Args:
        **kwargs: A series of keyword arguments (optional).

    Keyword Args:
        uid: User ID to assign to the newly created user (optional).
        display_name: The user's display name (optional).
        email: The user's primary email (optional).
        email_verified: A boolean indicating whether or not the user's primary email is
            verified (optional).
        phone_number: The user's primary phone number (optional).
        photo_url: The user's photo URL (optional).
        password: The user's raw, unhashed password. (optional).
        disabled: A boolean indicating whether or not the user account is disabled (optional).
        app: An App instance (optional).

    Returns:
        UserRecord: A user record instance for the newly created user.

    Raises:
        ValueError: If the specified user properties are invalid.
        FirebaseError: If an error occurs while creating the user account.
    rS   N)poprV   r:   )kwargsrS   rX   rT   rT   rU   r:     s    c                 K   s"   | dd}t|}|j| f|S )a<  Updates an existing user account with the specified properties.

    Args:
        uid: A user ID string.
        **kwargs: A series of keyword arguments (optional).

    Keyword Args:
        display_name: The user's display name (optional). Can be removed by explicitly passing
            ``auth.DELETE_ATTRIBUTE``.
        email: The user's primary email (optional).
        email_verified: A boolean indicating whether or not the user's primary email is
            verified (optional).
        phone_number: The user's primary phone number (optional). Can be removed by explicitly
            passing ``auth.DELETE_ATTRIBUTE``.
        photo_url: The user's photo URL (optional). Can be removed by explicitly passing
            ``auth.DELETE_ATTRIBUTE``.
        password: The user's raw, unhashed password. (optional).
        disabled: A boolean indicating whether or not the user account is disabled (optional).
        custom_claims: A dictionary or a JSON string containing the custom claims to be set on the
            user account (optional). To remove all custom claims, pass ``auth.DELETE_ATTRIBUTE``.
        valid_since: An integer signifying the seconds since the epoch (optional). This field is
            set by ``revoke_refresh_tokens`` and it is discouraged to set this field directly.
        app: An App instance (optional).

    Returns:
        UserRecord: An updated user record instance for the user.

    Raises:
        ValueError: If the specified user ID or properties are invalid.
        FirebaseError: If an error occurs while updating the user account.
    rS   N)rb   rV   rO   )rW   rc   rS   rX   rT   rT   rU   rO     s     c                 C   s   t |}|j| |d dS )a  Sets additional claims on an existing user account.

    Custom claims set via this function can be used to define user roles and privilege levels.
    These claims propagate to all the devices where the user is already signed in (after token
    expiration or when token refresh is forced), and next time the user signs in. The claims
    can be accessed via the user's ID token JWT. If a reserved OIDC claim is specified (sub, iat,
    iss, etc), an error is thrown. Claims payload must also not be larger then 1000 characters
    when serialized into a JSON string.

    Args:
        uid: A user ID string.
        custom_claims: A dictionary or a JSON string of custom claims. Pass None to unset any
            claims set previously.
        app: An App instance (optional).

    Raises:
        ValueError: If the specified user ID or the custom claims are invalid.
        FirebaseError: If an error occurs while updating the user account.
    )custom_claimsN)rV   rL   )rW   rd   rS   rX   rT   rT   rU   rL     s    c                 C   s   t |}||  dS )a%  Deletes the user identified by the specified user ID.

    Args:
        uid: A user ID string.
        app: An App instance (optional).

    Raises:
        ValueError: If the user ID is None, empty or malformed.
        FirebaseError: If an error occurs while deleting the user account.
    N)rV   r=   r\   rT   rT   rU   r=     s    c                 C   s   t |}|| S )a  Deletes the users specified by the given identifiers.

    Deleting a non-existing user does not generate an error (the method is
    idempotent.) Non-existing users are considered to be successfully deleted
    and are therefore included in the `DeleteUserResult.success_count` value.

    A maximum of 1000 identifiers may be supplied. If more than 1000
    identifiers are supplied, this method raises a `ValueError`.

    Args:
        uids: A list of strings indicating the uids of the users to be deleted.
            Must have <= 1000 entries.
        app: An App instance (optional).

    Returns:
        DeleteUsersResult: The total number of successful/failed deletions, as
        well as the array of errors that correspond to the failed deletions.

    Raises:
        ValueError: If any of the identifiers are invalid or if more than 1000
            identifiers are specified.
    )rV   r>   )ZuidsrS   rX   rT   rT   rU   r>     s    c                 C   s   t |}|| |S )a  Imports the specified list of users into Firebase Auth.

    At most 1000 users can be imported at a time. This operation is optimized for bulk imports and
    will ignore checks on identifier uniqueness which could result in duplications. The
    ``hash_alg`` parameter must be specified when importing users with passwords. Refer to the
    ``UserImportHash`` class for supported hash algorithms.

    Args:
        users: A list of ``ImportUserRecord`` instances to import. Length of the list must not
            exceed 1000.
        hash_alg: A ``UserImportHash`` object (optional). Required when importing users with
            passwords.
        app: An App instance (optional).

    Returns:
        UserImportResult: An object summarizing the result of the import operation.

    Raises:
        ValueError: If the provided arguments are invalid.
        FirebaseError: If an error occurs while importing users.
    )rV   rH   )ZusersZhash_algrS   rX   rT   rT   rU   rH   ,  s    c                 C   s   t |}|j| |dS )a  Generates the out-of-band email action link for password reset flows for the specified email
    address.

    Args:
        email: The email of the user whose password is to be reset.
        action_code_settings: ``ActionCodeSettings`` instance (optional). Defines whether
            the link is to be handled by a mobile app and the additional state information to be
            passed in the deep link.
        app: An App instance (optional).
    Returns:
        link: The password reset link created by the API

    Raises:
        ValueError: If the provided arguments are invalid
        FirebaseError: If an error occurs while generating the link
    action_code_settings)rV   r@   r]   rf   rS   rX   rT   rT   rU   r@   F  s    c                 C   s   t |}|j| |dS )a  Generates the out-of-band email action link for email verification flows for the specified
    email address.

    Args:
        email: The email of the user to be verified.
        action_code_settings: ``ActionCodeSettings`` instance (optional). Defines whether
            the link is to be handled by a mobile app and the additional state information to be
            passed in the deep link.
        app: An App instance (optional).
    Returns:
        link: The email verification link created by the API

    Raises:
        ValueError: If the provided arguments are invalid
        FirebaseError: If an error occurs while generating the link
    re   )rV   r?   rg   rT   rT   rU   r?   [  s
     c                 C   s   t |}|j| |dS )a  Generates the out-of-band email action link for email link sign-in flows, using the action
    code settings provided.

    Args:
        email: The email of the user signing in.
        action_code_settings: ``ActionCodeSettings`` instance. Defines whether
            the link is to be handled by a mobile app and the additional state information to be
            passed in the deep link.
        app: An App instance (optional).

    Returns:
        link: The email sign-in link created by the API

    Raises:
        ValueError: If the provided arguments are invalid
        FirebaseError: If an error occurs while generating the link
    re   )rV   rA   rg   rT   rT   rU   rA   q  s
     c                 C   s   t |}|| S )a  Returns the ``OIDCProviderConfig`` with the given ID.

    Args:
        provider_id: Provider ID string.
        app: An App instance (optional).

    Returns:
        OIDCProviderConfig: An OIDC provider config instance.

    Raises:
        ValueError: If the provider ID is invalid, empty or does not have ``oidc.`` prefix.
        ConfigurationNotFoundError: If no OIDC provider is available with the given identifier.
        FirebaseError: If an error occurs while retrieving the OIDC provider.
    )rV   rB   provider_idrS   rX   rT   rT   rU   rB     s    c	           
   
   C   s"   t |}	|	j| |||||||dS )a=  Creates a new OIDC provider config from the given parameters.

    OIDC provider support requires Google Cloud's Identity Platform (GCIP). To learn more about
    GCIP, including pricing and features, see https://cloud.google.com/identity-platform.

    Args:
        provider_id: Provider ID string. Must have the prefix ``oidc.``.
        client_id: Client ID of the new config.
        issuer: Issuer of the new config. Must be a valid URL.
        display_name: The user-friendly display name to the current configuration (optional).
            This name is also used as the provider label in the Cloud Console.
        enabled: A boolean indicating whether the provider configuration is enabled or disabled
            (optional). A user cannot sign in using a disabled provider.
        app: An App instance (optional).
        client_secret: A string which sets the client secret for the new provider.
            This is required for the code flow.
        code_response_type: A boolean which sets whether to enable the code response flow for the
            new provider. By default, this is not enabled if no response type is specified.
            A client secret must be set for this response type.
            Having both the code and ID token response flows is currently not supported.
        id_token_response_type: A boolean which sets whether to enable the ID token response flow
            for the new provider. By default, this is enabled if no response type is specified.
            Having both the code and ID token response flows is currently not supported.

    Returns:
        OIDCProviderConfig: The newly created OIDC provider config instance.

    Raises:
        ValueError: If any of the specified input parameters are invalid.
        FirebaseError: If an error occurs while creating the new OIDC provider config.
    	client_idissuerdisplay_nameenabledclient_secretid_token_response_typecode_response_type)rV   r7   
ri   rk   rl   rm   rn   ro   rp   rq   rS   rX   rT   rT   rU   r7     s    "     c	           
   
   C   s"   t |}	|	j| |||||||dS )ac  Updates an existing OIDC provider config with the given parameters.

    Args:
        provider_id: Provider ID string. Must have the prefix ``oidc.``.
        client_id: Client ID of the new config (optional).
        issuer: Issuer of the new config (optional). Must be a valid URL.
        display_name: The user-friendly display name of the current configuration (optional).
            Pass ``auth.DELETE_ATTRIBUTE`` to delete the current display name.
        enabled: A boolean indicating whether the provider configuration is enabled or disabled
            (optional).
        app: An App instance (optional).
        client_secret: A string which sets the client secret for the new provider.
            This is required for the code flow.
        code_response_type: A boolean which sets whether to enable the code response flow for the
            new provider. By default, this is not enabled if no response type is specified.
            A client secret must be set for this response type.
            Having both the code and ID token response flows is currently not supported.
        id_token_response_type: A boolean which sets whether to enable the ID token response flow
            for the new provider. By default, this is enabled if no response type is specified.
            Having both the code and ID token response flows is currently not supported.

    Returns:
        OIDCProviderConfig: The updated OIDC provider config instance.

    Raises:
        ValueError: If any of the specified input parameters are invalid.
        FirebaseError: If an error occurs while updating the OIDC provider config.
    rj   )rV   rM   rr   rT   rT   rU   rM     s         c                 C   s   t |}||  dS )a  Deletes the ``OIDCProviderConfig`` with the given ID.

    Args:
        provider_id: Provider ID string.
        app: An App instance (optional).

    Raises:
        ValueError: If the provider ID is invalid, empty or does not have ``oidc.`` prefix.
        ConfigurationNotFoundError: If no OIDC provider is available with the given identifier.
        FirebaseError: If an error occurs while deleting the OIDC provider.
    N)rV   r;   rh   rT   rT   rU   r;     s    c                 C   s   t |}|| |S )aC  Retrieves a page of OIDC provider configs from a Firebase project.

    The ``page_token`` argument governs the starting point of the page. The ``max_results``
    argument governs the maximum number of configs that may be included in the returned
    page. This function never returns ``None``. If there are no OIDC configs in the Firebase
    project, this returns an empty page.

    Args:
        page_token: A non-empty page token string, which indicates the starting point of the
            page (optional). Defaults to ``None``, which will retrieve the first page of users.
        max_results: A positive integer indicating the maximum number of users to include in
            the returned page (optional). Defaults to 100, which is also the maximum number
            allowed.
        app: An App instance (optional).

    Returns:
        ListProviderConfigsPage: A page of OIDC provider config instances.

    Raises:
        ValueError: If ``max_results`` or ``page_token`` are invalid.
        FirebaseError: If an error occurs while retrieving the OIDC provider configs.
    )rV   list_oidc_provider_configsra   rT   rT   rU   rs     s    rs   c                 C   s   t |}|| S )a  Returns the ``SAMLProviderConfig`` with the given ID.

    Args:
        provider_id: Provider ID string.
        app: An App instance (optional).

    Returns:
        SAMLProviderConfig: A SAML provider config instance.

    Raises:
        ValueError: If the provider ID is invalid, empty or does not have ``saml.`` prefix.
        ConfigurationNotFoundError: If no SAML provider is available with the given identifier.
        FirebaseError: If an error occurs while retrieving the SAML provider.
    )rV   rC   rh   rT   rT   rU   rC     s    c	           
   
   C   s"   t |}	|	j| |||||||dS )a  Creates a new SAML provider config from the given parameters.

    SAML provider support requires Google Cloud's Identity Platform (GCIP). To learn more about
    GCIP, including pricing and features, see https://cloud.google.com/identity-platform.

    Args:
        provider_id: Provider ID string. Must have the prefix ``saml.``.
        idp_entity_id: The SAML IdP entity identifier.
        sso_url: The SAML IdP SSO URL. Must be a valid URL.
        x509_certificates: The list of SAML IdP X.509 certificates issued by CA for this provider.
            Multiple certificates are accepted to prevent outages during IdP key rotation (for
            example ADFS rotates every 10 days). When the Auth server receives a SAML response, it
            will match the SAML response with the certificate on record. Otherwise the response is
            rejected. Developers are expected to manage the certificate updates as keys are
            rotated.
        rp_entity_id: The SAML relying party (service provider) entity ID. This is defined by the
            developer but needs to be provided to the SAML IdP.
        callback_url: Callback URL string. This is fixed and must always be the same as the OAuth
            redirect URL provisioned by Firebase Auth, unless a custom authDomain is used.
        display_name: The user-friendly display name to the current configuration (optional). This
            name is also used as the provider label in the Cloud Console.
        enabled: A boolean indicating whether the provider configuration is enabled or disabled
            (optional). A user cannot sign in using a disabled provider.
        app: An App instance (optional).

    Returns:
        SAMLProviderConfig: The newly created SAML provider config instance.

    Raises:
        ValueError: If any of the specified input parameters are invalid.
        FirebaseError: If an error occurs while creating the new SAML provider config.
    idp_entity_idsso_urlx509_certificatesrp_entity_idcallback_urlrm   rn   )rV   r8   
ri   ru   rv   rw   rx   ry   rm   rn   rS   rX   rT   rT   rU   r8   (  s    #     c	           
   
   C   s"   t |}	|	j| |||||||dS )ag  Updates an existing SAML provider config with the given parameters.

    Args:
        provider_id: Provider ID string. Must have the prefix ``saml.``.
        idp_entity_id: The SAML IdP entity identifier (optional).
        sso_url: The SAML IdP SSO URL. Must be a valid URL (optional).
        x509_certificates: The list of SAML IdP X.509 certificates issued by CA for this
            provider  (optional).
        rp_entity_id: The SAML relying party entity ID (optional).
        callback_url: Callback URL string  (optional).
        display_name: The user-friendly display name of the current configuration (optional).
            Pass ``auth.DELETE_ATTRIBUTE`` to delete the current display name.
        enabled: A boolean indicating whether the provider configuration is enabled or disabled
            (optional).
        app: An App instance (optional).

    Returns:
        SAMLProviderConfig: The updated SAML provider config instance.

    Raises:
        ValueError: If any of the specified input parameters are invalid.
        FirebaseError: If an error occurs while updating the SAML provider config.
    rt   )rV   rN   rz   rT   rT   rU   rN   R  s         c                 C   s   t |}||  dS )a  Deletes the ``SAMLProviderConfig`` with the given ID.

    Args:
        provider_id: Provider ID string.
        app: An App instance (optional).

    Raises:
        ValueError: If the provider ID is invalid, empty or does not have ``saml.`` prefix.
        ConfigurationNotFoundError: If no SAML provider is available with the given identifier.
        FirebaseError: If an error occurs while deleting the SAML provider.
    N)rV   r<   rh   rT   rT   rU   r<   s  s    c                 C   s   t |}|| |S )aC  Retrieves a page of SAML provider configs from a Firebase project.

    The ``page_token`` argument governs the starting point of the page. The ``max_results``
    argument governs the maximum number of configs that may be included in the returned
    page. This function never returns ``None``. If there are no SAML configs in the Firebase
    project, this returns an empty page.

    Args:
        page_token: A non-empty page token string, which indicates the starting point of the
            page (optional). Defaults to ``None``, which will retrieve the first page of users.
        max_results: A positive integer indicating the maximum number of users to include in
            the returned page (optional). Defaults to 100, which is also the maximum number
            allowed.
        app: An App instance (optional).

    Returns:
        ListProviderConfigsPage: A page of SAML provider config instances.

    Raises:
        ValueError: If ``max_results`` or ``page_token`` are invalid.
        FirebaseError: If an error occurs while retrieving the SAML provider configs.
    )rV   rI   ra   rT   rT   rU   rI     s    )NN)NFr   )N)FNr   )N)N)N)N)N)N)N)N)NN)NN)NN)N)N)NNNNNN)NNNNNNNN)N)N)NNN)NNNNNNNN)N)X__doc__Zfirebase_adminr   r   r   r   r   r   r   r	   rR   __all__r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   rV   r6   rP   r9   rQ   rK   rD   rE   rF   rG   ZMAX_LIST_USERS_RESULTSrJ   r:   rO   rL   r=   r>   rH   r@   r?   rA   rB   r7   rM   r;   ZMAX_LIST_CONFIGS_RESULTSrs   rC   r8   rN   r<   rI   rT   rT   rT   rU   <module>   sv  M



$




%







          
*              
&
  

     
+              
!
  