o
    bi                     @   s   d Z ddlZddlmZ ddlZddlmZ ddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ddlmZ ejejejejhZd	gZeed
rQe rQde	j Znde	j Zde dZed Zed Zed Zed ZG dd de
jZdS )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)_mtls_helperz#https://www.googleapis.com/auth/iamcheck_use_client_certziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                   @   s@   e Zd ZdZdd Zdd Zedd Ze	e
jdd	 Zd
S )Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 C   s   || _ || _|| _dS )a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   Zservice_account_email r   I/home/kim/smarthome/.venv/lib/python3.10/site-packages/google/auth/iam.py__init__J   s   
zSigner.__init__c           	      C   s   t |}d}ttj| jj| j	}ddi}t
dt|did}t }|D ]4}| j| j||| | j||||d}|jtv rIq.|jtjkrXtd|jt
|jd  S td)	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   Zuniverse_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ZExponentialBackoffZbefore_requestr
   statusIAM_RETRY_CODEShttp_clientOKr   ZTransportErrordataloads)	r   messager   r   r   r   retries_responser   r   r   _make_signing_request^   s2   




zSigner._make_signing_requestc                 C   s   dS )zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        Nr   )r   r   r   r   key_id|   s   zSigner.key_idc                 C   s   |  |}t|d S )NZ
signedBlob)r-   r   	b64decode)r   r)   r,   r   r   r   sign   s   
zSigner.signN)__name__
__module____qualname____doc__r   r-   propertyr.   r   Zcopy_docstringr   r	   r0   r   r   r   r   r	   ?   s    


	r	   )r4   r   http.clientclientr%   r   Zgoogle.authr   r   r   r   r   Zgoogle.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr$   Z
_IAM_SCOPEhasattrr   r   Z_IAM_DOMAINZ_IAM_BASE_URLZ_IAM_ENDPOINTr   Z_IAM_SIGNJWT_ENDPOINTZ_IAM_IDTOKEN_ENDPOINTr	   r   r   r   r   <module>   s8   