U
    ڲgt                     @  s  d dl mZ d dlZd dlZd dlZd dlmZmZ d dlm	Z	m
Z
mZmZmZmZmZ ddlmZ ddlmZmZ ddlmZmZmZmZmZmZmZmZmZ zd d	lm Z m!Z! d d
l"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dl3m4Z4m5Z5 d dl6m7Z7m8Z8 d dl9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZA d dlBmCZCmDZDmEZEmFZFmGZGmHZHmIZI dZJW n eKk
r   dZJY nX e	re:e<B ZLe/e1B ZMe7e8B e4B e5B ZNeLeMB eNB ZOe:e/B e7B e4B ZPe<e1B e8B e5B ZQddddddddddddhZRd d!d"d#ZSG d$d% d%eZTG d&d' d'eTZUG d(d) d)eTZVeJrG d*d+ d+eTZWG d,d- d-eTZXG d.d/ d/eWZYG d0d1 d1eTZZdS )2    )annotationsN)ABCabstractmethod)TYPE_CHECKINGAnyClassVarLiteralNoReturncastoverload   InvalidKeyError)HashlibHashJWKDict)	base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintis_pem_format
is_ssh_keyraw_to_der_signatureto_base64url_uint)InvalidSignatureUnsupportedAlgorithm)default_backend)hashes)padding)
ECDSA	SECP256K1	SECP256R1	SECP384R1	SECP521R1EllipticCurveEllipticCurvePrivateKeyEllipticCurvePrivateNumbersEllipticCurvePublicKeyEllipticCurvePublicNumbers)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTFRS256RS384RS512ES256ES256KES384ES521ES512PS256PS384PS512EdDSAzdict[str, Algorithm])returnc                  C  s   t  ttjttjttjd} tr| ttjttjttjttjttjttjttjttjt	t	jt	t	jt	t	jt
 d | S )zE
    Returns the algorithms that are implemented by the library.
    )noneZHS256ZHS384ZHS512)r<   r=   r>   r?   r@   rA   rB   rC   rD   rE   rF   rG   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)Zdefault_algorithms rU   2/tmp/pip-unpacked-wheel-ecrjo5d0/jwt/algorithms.pyget_default_algorithmsi   s0    rW   c                   @  s   e Zd ZdZdddddZeddddd	Zedddd
ddZedddddddZe	e
edddddZe	e
ed!dddddZe
ed"dddddZe
edddddZd S )#	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    bytes)bytestrrH   c                 C  sn   t | dd}|dkrttrZt|trZt|tjrZtj| t	 d}|
| t| S t|| S dS )z
        Compute a hash digest using the specified algorithm's hash algorithm.

        If there is no hash algorithm, raises a NotImplementedError.
        hash_algN)backend)getattrNotImplementedErrorrO   
isinstancetype
issubclassr   ZHashAlgorithmZHashr   rP   rY   finalizedigest)selfrZ   r[   rc   rU   rU   rV   compute_hash_digest   s    

zAlgorithm.compute_hash_digestr   keyrH   c                 C  s   dS )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NrU   rd   rg   rU   rU   rV   prepare_key   s    zAlgorithm.prepare_keymsgrg   rH   c                 C  s   dS )zn
        Returns a digital signature for the specified message
        using the specified key value.
        NrU   rd   rk   rg   rU   rU   rV   sign   s    zAlgorithm.signboolrk   rg   sigrH   c                 C  s   dS )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        NrU   rd   rk   rg   rp   rU   rU   rV   verify   s    zAlgorithm.verifyLiteral[True]r   )as_dictrH   c                 C  s   d S NrU   key_objrt   rU   rU   rV   to_jwk   s    zAlgorithm.to_jwkFLiteral[False]strc                 C  s   d S ru   rU   rv   rU   rU   rV   rx      s    JWKDict | strc                 C  s   dS )z3
        Serializes a given key into a JWK
        NrU   rv   rU   rU   rV   rx      s    str | JWKDictjwkrH   c                 C  s   dS )zJ
        Deserializes a given key from JWK back into a key object
        NrU   r~   rU   rU   rV   from_jwk   s    zAlgorithm.from_jwkN)F)F)__name__
__module____qualname____doc__re   r   ri   rm   rr   r   staticmethodrx   r   rU   rU   rU   rV   rX      s,   rX   c                   @  sr   e Zd ZdZdddddZddddd	d
ZdddddddZedddddddZedddddZ	dS )rJ   zZ
    Placeholder for use when no signing or verification
    operations are required.
    z
str | NoneNonerf   c                 C  s    |dkrd }|d k	rt d|S )N z*When alg = "none", key value must be None.r   rh   rU   rU   rV   ri      s
    zNoneAlgorithm.prepare_keyrY   rj   c                 C  s   dS )N    rU   rl   rU   rU   rV   rm      s    zNoneAlgorithm.signrn   ro   c                 C  s   dS )NFrU   rq   rU   rU   rV   rr      s    zNoneAlgorithm.verifyFr   r	   rw   rt   rH   c                 C  s
   t  d S ru   r^   rv   rU   rU   rV   rx      s    zNoneAlgorithm.to_jwkr|   r}   c                 C  s
   t  d S ru   r   r   rU   rU   rV   r      s    zNoneAlgorithm.from_jwkN)F)
r   r   r   r   ri   rm   rr   r   rx   r   rU   rU   rU   rV   rJ      s   	rJ   c                   @  s   e Zd ZU dZejZded< ejZ	ded< ej
Zded< dddd	d
ZdddddZeeddddddZeed'ddddddZed(ddddddZedddddZdddd d!d"Zddddd#d$d%Zd&S ))rK   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    zClassVar[HashlibHash]rL   rM   rN   r   r   r[   rH   c                 C  s
   || _ d S ru   r[   rd   r[   rU   rU   rV   __init__   s    zHMACAlgorithm.__init__str | bytesrY   rf   c                 C  s$   t |}t|st|r td|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r   r   r   rd   rg   	key_bytesrU   rU   rV   ri      s    zHMACAlgorithm.prepare_keyrs   r   r   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx   
  s    zHMACAlgorithm.to_jwkFry   rz   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx     s    rn   r{   c                 C  s,   t t|  dd}|r|S t|S d S )Noct)kkty)r   r   decodejsondumps)rw   rt   r~   rU   rU   rV   rx     s    r|   r}   c                 C  sn   z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtdt|d S )NKey is not valid JSONr   r   zNot an HMAC keyr   )	r_   rz   r   loadsdict
ValueErrorr   getr   )r~   objrU   rU   rV   r   "  s    

zHMACAlgorithm.from_jwkrj   c                 C  s   t ||| j S ru   )hmacnewr[   rc   rl   rU   rU   rV   rm   3  s    zHMACAlgorithm.signro   c                 C  s   t || ||S ru   )r   compare_digestrm   rq   rU   rU   rV   rr   6  s    zHMACAlgorithm.verifyN)F)F)r   r   r   r   hashlibsha256rL   __annotations__sha384rM   sha512rN   r   ri   r   r   rx   r   rm   rr   rU   rU   rU   rV   rK      s&   
 rK   c                   @  s   e Zd ZU dZejZded< ejZded< ejZded< dddd	d
Z	dddddZ
eeddddddZeed*ddddddZed+ddddddZedddddZd d!d d"d#d$Zd d%d dd&d'd(Zd)S ),rQ   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        $ClassVar[type[hashes.HashAlgorithm]]rL   rM   rN   type[hashes.HashAlgorithm]r   r   c                 C  s
   || _ d S ru   r   r   rU   rU   rV   r   F  s    zRSAAlgorithm.__init__zAllowedRSAKeys | str | bytesAllowedRSAKeysrf   c                 C  s   t |ttfr|S t |ttfs(tdt|}z2|drLttt	|W S ttt
|d dW S W nJ tk
r   zttt|W  Y S  ttfk
r   tdY nX Y nX d S )NExpecting a PEM-formatted key.s   ssh-rsapasswordz(Could not parse the provided public key.)r_   r-   r/   rY   rz   	TypeErrorr   
startswithr
   r;   r9   r   r:   r   r   r   rU   rU   rV   ri   I  s"    
 

zRSAAlgorithm.prepare_keyrs   r   r   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx   _  s    zRSAAlgorithm.to_jwkFry   rz   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx   e  s    rn   r{   c                 C  s   d }t | dr|  }ddgt|jj t|jj t|j t|j t|j	 t|j
 t|j t|j d
}n@t | dr|  }ddgt|j t|j d}ntd|r|S t|S d S )Nprivate_numbersRSArm   )
r   key_opsnedpqdpdqqirr   )r   r   r   r   Not a public or private key)hasattrr   r   public_numbersr   r   r   r   r   r   dmp1dmq1iqmpr   r   r   )rw   rt   r   numbersrU   rU   rV   rx   k  s2    

r|   r}   c           	   	     s  z.t | trt|  nt | tr(|  ntW n tk
rJ   tdY nX  ddkrbtdd krd krd krd krtd	d
ddddg} fdd|D }t|}|rt	|stdt
t d t d }|r4tt d t d
 t d t d t d t d |d}nHt d }t|j||j\}}t|||t||t||t|||d}| S d krd krt
t d t d  S tdd S )Nr   r   r   zNot an RSA keyr   r   r   Zothz5Unsupported RSA private key: > 2 primes not supportedr   r   r   r   r   c                   s   g | ]}| kqS rU   rU   ).0propr   rU   rV   
<listcomp>  s     z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides d)r   r   r   r   r   r   r   r   )r_   rz   r   r   r   r   r   r   anyallr0   r   r.   r4   r   r   r1   r2   r3   private_key
public_key)	r~   Zother_propsZprops_foundZany_props_foundr   r   r   r   r   rU   r   rV   r     st    










  


zRSAAlgorithm.from_jwkrY   r-   rj   c                 C  s   | |t |  S ru   )rm   r   PKCS1v15r[   rl   rU   rU   rV   rm     s    zRSAAlgorithm.signr/   ro   c                 C  s:   z| ||t |   W dS  tk
r4   Y dS X d S )NTF)rr   r   r   r[   r   rq   rU   rU   rV   rr     s
    zRSAAlgorithm.verifyN)F)F)r   r   r   r   r   rL   r   rM   rN   r   ri   r   r   rx   r   rm   rr   rU   rU   rU   rV   rQ   <  s&   
 &GrQ   c                   @  s   e Zd ZU dZejZded< ejZded< ejZded< dddd	d
Z	dddddZ
ddddddZdddddddZeeddddddZeed)ddd dd!dZed*ddd"dd#dZed$dd%d&d'Zd(S )+rR   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        r   rL   rM   rN   r   r   r   c                 C  s
   || _ d S ru   r   r   rU   rU   rV   r     s    zECAlgorithm.__init__zAllowedECKeys | str | bytesAllowedECKeysrf   c                 C  s   t |ttfr|S t |ttfs(tdt|}z |drFt|}nt	|}W n  t
k
rp   t|d d}Y nX t |ttfstd|S )Nr   s   ecdsa-sha2-r   zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for ECDSA algorithms)r_   r%   r'   rY   rz   r   r   r   r;   r:   r   r9   r   )rd   rg   r   Z
crypto_keyrU   rU   rV   ri     s&    

 zECAlgorithm.prepare_keyrY   r%   rj   c                 C  s    | |t|  }t||jS ru   )rm   r   r[   r   curve)rd   rk   rg   der_sigrU   rU   rV   rm     s    zECAlgorithm.signrn   ro   c                 C  sv   zt ||j}W n tk
r&   Y dS X z2t|tr<| n|}|||t|   W dS  t	k
rp   Y dS X d S )NFT)
r   r   r   r_   r%   r   rr   r   r[   r   )rd   rk   rg   rp   r   r   rU   rU   rV   rr     s    
zECAlgorithm.verifyrs   r   r   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx   %  s    zECAlgorithm.to_jwkFry   rz   c                 C  s   d S ru   rU   rv   rU   rU   rV   rx   +  s    r{   c                 C  s   t | tr|   }nt | tr,|  }ntdt | jtrFd}nFt | jtrXd}n4t | jt	rjd}n"t | jt
r|d}ntd| j d|t|j t|j d}t | trt|  j |d	< |r|S t|S d S )
Nr   P-256P-384P-521	secp256k1Invalid curve: EC)r   crvxyr   )r_   r%   r   r   r'   r   r   r!   r"   r#   r    r   r   r   r   r   Zprivate_valuer   r   )rw   rt   r   r   r   rU   rU   rV   rx   1  s4    



r|   r}   c                 C  s$  z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtdd|ksrd|krztdt|d}t|d}|d}|dkrt	|t	|  krd	krn nt
 }ntd
n|dkrt	|t	|  krdkrn nt }ntdn|dkrZt	|t	|  krDdkrPn nt }ntdnN|dkrt	|t	|  krd	krn nt }ntdntd| ttj|ddtj|dd|d}d|kr| S t|d}t	|t	|krtdt	||ttj|dd| S )Nr   r   r   zNot an Elliptic curve keyr   r   r   r       z)Coords should be 32 bytes for curve P-256r   0   z)Coords should be 48 bytes for curve P-384r   B   z)Coords should be 66 bytes for curve P-521r   z-Coords should be 32 bytes for curve secp256k1r   big)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})r_   rz   r   r   r   r   r   r   r   lenr!   r"   r#   r    r(   int
from_bytesr   r&   r   )r~   r   r   r   r   Z	curve_objr   r   rU   rU   rV   r   V  sh    


 

$

$

$
   zECAlgorithm.from_jwkN)F)F)r   r   r   r   r   rL   r   rM   rN   r   ri   rm   rr   r   r   rx   r   rU   rU   rU   rV   rR     s&   
 $rR   c                   @  s6   e Zd ZdZddddddZddddd	d
dZdS )rS   zA
        Performs a signature using RSASSA-PSS with MGF1
        rY   r-   rj   c                 C  s,   | |tjt|  |  jd|  S )NZmgfZsalt_length)rm   r   PSSMGF1r[   digest_sizerl   rU   rU   rV   rm     s    zRSAPSSAlgorithm.signr/   rn   ro   c              	   C  sP   z4| ||tjt|  |  jd|   W dS  tk
rJ   Y dS X d S )Nr   TF)rr   r   r   r   r[   r   r   rq   rU   rU   rV   rr     s    	zRSAPSSAlgorithm.verifyN)r   r   r   r   rm   rr   rU   rU   rU   rV   rS     s   
rS   c                   @  s   e Zd ZdZdddddZddd	d
dZddddddZdddddddZee	ddddddZ
ee	d&ddddddZ
e	d'ddddd dZ
e	d!dd"d#d$Zd%S )(rT   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        r   r   )kwargsrH   c                 K  s   d S ru   rU   )rd   r   rU   rU   rV   r     s    zOKPAlgorithm.__init__zAllowedOKPKeys | str | bytesAllowedOKPKeysrf   c                 C  s   t |ttfr~t |tr"|dn|}t |tr:|dn|}d|krPt|}n.d|krft|d d}n|dd dkr~t|}t |tt	t
tfstd|S )	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr   r      zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)r_   rY   rz   r   encoder:   r9   r;   r+   r,   r)   r*   r   )rd   rg   Zkey_strr   rU   rU   rV   ri     s"    

zOKPAlgorithm.prepare_keyr   z#Ed25519PrivateKey | Ed448PrivateKeyrY   rj   c                 C  s"   t |tr|dn|}||S )aS  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` isinstance
            :return bytes signature: The signature, as bytes
            r   )r_   rz   r   rm   )rd   rk   rg   	msg_bytesrU   rU   rV   rm     s    
zOKPAlgorithm.signrn   ro   c                 C  sx   z\t |tr|dn|}t |tr.|dn|}t |ttfrH| n|}||| W dS  tk
rr   Y dS X dS )a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TFN)r_   rz   r   r+   r)   r   rr   r   )rd   rk   rg   rp   r   Z	sig_bytesr   rU   rU   rV   rr     s    
zOKPAlgorithm.verifyrs   r   )rg   rt   rH   c                 C  s   d S ru   rU   rg   rt   rU   rU   rV   rx      s    zOKPAlgorithm.to_jwkFry   rz   c                 C  s   d S ru   rU   r   rU   rU   rV   rx     s    r{   c                 C  s   t | ttfr\| jtjtjd}t | tr.dnd}tt|	 d|d}|rR|S t
|S t | ttfr| jtjtjt d}|  jtjtjd}t | trdnd}tt|	 tt|	 d|d}|r|S t
|S tdd S )	N)encodingformatEd25519Ed448OKP)r   r   r   )r   r   Zencryption_algorithm)r   r   r   r   r   )r_   r,   r*   Zpublic_bytesr5   ZRawr8   r   r   r   r   r   r+   r)   Zprivate_bytesr7   r6   r   r   )rg   rt   r   r   r   r   rU   rU   rV   rx     sB    

r|   r}   c              
   C  s2  z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtd|d}|dkr|dkrtd| d	|krtd
t|d	}zVd|kr|dkrt	
|W S t
|W S t|d}|dkrt|W S t|W S  tk
r, } ztd|W 5 d }~X Y nX d S )Nr   r   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)r_   rz   r   r   r   r   r   r   r   r,   Zfrom_public_bytesr*   r+   Zfrom_private_bytesr)   )r~   r   r   r   r   errrU   rU   rV   r   ;  s6    


zOKPAlgorithm.from_jwkN)F)F)r   r   r   r   r   ri   rm   rr   r   r   rx   r   rU   rU   rU   rV   rT     s     .rT   )[
__future__r   r   r   r   abcr   r   typingr   r   r   r   r	   r
   r   
exceptionsr   typesr   r   utilsr   r   r   r   r   r   r   r   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   Z,cryptography.hazmat.primitives.asymmetric.ecr   r    r!   r"   r#   r$   r%   r&   r'   r(   Z/cryptography.hazmat.primitives.asymmetric.ed448r)   r*   Z1cryptography.hazmat.primitives.asymmetric.ed25519r+   r,   Z-cryptography.hazmat.primitives.asymmetric.rsar-   r.   r/   r0   r1   r2   r3   r4   Z,cryptography.hazmat.primitives.serializationr5   r6   r7   r8   r9   r:   r;   rO   ModuleNotFoundErrorr   r   r   ZAllowedKeysZAllowedPrivateKeysZAllowedPublicKeysZrequires_cryptographyrW   rX   rJ   rK   rQ   rR   rS   rT   rU   rU   rU   rV   <module>   sn   $,0(
$

"IH ) 7