U
    ù¹c4  ã                   @   sŒ  d dl Z d dlZd dlZddlmZmZ ddlmZ ddlm	Z	m
Z
mZmZmZmZmZmZ zˆd dlmZ d dlmZmZmZ d dlmZmZmZmZmZmZmZmZ d d	l m!Z!m"Z" d d
l#m$Z$m%Z% d dl&m'Z' d dl(m)Z) dZ*W n e+k
rü   dZ*Y nX e,ddddddddddg
ƒZ-dd„ Z.G dd„ de/ƒZ0G dd„ de0ƒZ1G dd „ d e0ƒZ2e*�rˆG d!d"„ d"e0ƒZ3G d#d$„ d$e0ƒZ4G d%d&„ d&e3ƒZ5dS )'é    Né   )Úconstant_time_compareÚstring_types©ÚInvalidKeyError)Úbase64url_decodeÚbase64url_encodeÚder_to_raw_signatureÚforce_bytesÚforce_unicodeÚfrom_base64url_uintÚraw_to_der_signatureÚto_base64url_uint)Úhashes)Úload_pem_private_keyÚload_pem_public_keyÚload_ssh_public_key)ÚRSAPrivateKeyÚRSAPublicKeyÚRSAPrivateNumbersÚRSAPublicNumbersÚrsa_recover_prime_factorsÚrsa_crt_dmp1Úrsa_crt_dmq1Úrsa_crt_iqmp)ÚEllipticCurvePrivateKeyÚEllipticCurvePublicKey)ÚecÚpadding)Údefault_backend)ÚInvalidSignatureTFÚRS256ÚRS384ÚRS512ÚES256ÚES384ÚES521ÚES512ÚPS256ÚPS384ÚPS512c                  C   s†   t ƒ ttjƒttjƒttjƒdœ} tr‚|  ttjƒttjƒttjƒttjƒttjƒttjƒttjƒt	t	jƒt	t	jƒt	t	jƒdœ
¡ | S )zE
    Returns the algorithms that are implemented by the library.
    )ÚnoneZHS256ZHS384ZHS512)
r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   )
ÚNoneAlgorithmÚHMACAlgorithmÚSHA256ÚSHA384ÚSHA512Ú
has_cryptoÚupdateÚRSAAlgorithmÚECAlgorithmÚRSAPSSAlgorithm)Zdefault_algorithms© r6   ú2/tmp/pip-unpacked-wheel-eh6jf6x0/jwt/algorithms.pyÚget_default_algorithms&   s&    üör8   c                   @   s@   e Zd ZdZdd„ Zdd„ Zdd„ Zedd	„ ƒZed
d„ ƒZ	dS )Ú	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                 C   s   t ‚dS )zš
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        N©ÚNotImplementedError©ÚselfÚkeyr6   r6   r7   Úprepare_keyF   s    zAlgorithm.prepare_keyc                 C   s   t ‚dS )zn
        Returns a digital signature for the specified message
        using the specified key value.
        Nr:   ©r=   Úmsgr>   r6   r6   r7   ÚsignM   s    zAlgorithm.signc                 C   s   t ‚dS )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        Nr:   ©r=   rA   r>   Úsigr6   r6   r7   ÚverifyT   s    zAlgorithm.verifyc                 C   s   t ‚dS )z7
        Serializes a given RSA key into a JWK
        Nr:   ©Úkey_objr6   r6   r7   Úto_jwk[   s    zAlgorithm.to_jwkc                 C   s   t ‚dS )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        Nr:   )Újwkr6   r6   r7   Úfrom_jwkb   s    zAlgorithm.from_jwkN)
Ú__name__Ú
__module__Ú__qualname__Ú__doc__r?   rB   rE   ÚstaticmethodrH   rJ   r6   r6   r6   r7   r9   B   s   
r9   c                   @   s(   e Zd ZdZdd„ Zdd„ Zdd„ ZdS )	r,   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 C   s    |dkrd }|d k	rt dƒ‚|S )NÚ z*When alg = "none", key value must be None.r   r<   r6   r6   r7   r?   o   s
    zNoneAlgorithm.prepare_keyc                 C   s   dS )Nó    r6   r@   r6   r6   r7   rB   x   s    zNoneAlgorithm.signc                 C   s   dS )NFr6   rC   r6   r6   r7   rE   {   s    zNoneAlgorithm.verifyN)rK   rL   rM   rN   r?   rB   rE   r6   r6   r6   r7   r,   j   s   	r,   c                   @   sZ   e Zd ZdZejZejZej	Z
dd„ Zdd„ Zedd„ ƒZedd	„ ƒZd
d„ Zdd„ ZdS )r-   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   s
   || _ d S ©N©Úhash_alg©r=   rT   r6   r6   r7   Ú__init__ˆ   s    zHMACAlgorithm.__init__c                    s6   t ˆ ƒ‰ ddddg}t‡ fdd„|D ƒƒr2tdƒ‚ˆ S )Ns   -----BEGIN PUBLIC KEY-----s   -----BEGIN CERTIFICATE-----s   -----BEGIN RSA PUBLIC KEY-----ó   ssh-rsac                    s   g | ]}|ˆ k‘qS r6   r6   )Ú.0Zstring_value©r>   r6   r7   Ú
<listcomp>•   s     z-HMACAlgorithm.prepare_key.<locals>.<listcomp>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r
   Úanyr   )r=   r>   Zinvalid_stringsr6   rY   r7   r?   ‹   s    üÿzHMACAlgorithm.prepare_keyc                 C   s   t  ttt| ƒƒƒddœ¡S )NÚoct)ÚkÚkty)ÚjsonÚdumpsr   r   r
   rF   r6   r6   r7   rH   œ   s    þzHMACAlgorithm.to_jwkc                 C   s,   t  | ¡}| d¡dkr tdƒ‚t|d ƒS )Nr^   r\   zNot an HMAC keyr]   )r_   ÚloadsÚgetr   r   )rI   Úobjr6   r6   r7   rJ   £   s    
zHMACAlgorithm.from_jwkc                 C   s   t  ||| j¡ ¡ S rR   )ÚhmacÚnewrT   Údigestr@   r6   r6   r7   rB   ¬   s    zHMACAlgorithm.signc                 C   s   t ||  ||¡ƒS rR   )r   rB   rC   r6   r6   r7   rE   ¯   s    zHMACAlgorithm.verifyN)rK   rL   rM   rN   ÚhashlibÚsha256r.   Úsha384r/   Úsha512r0   rV   r?   rO   rH   rJ   rB   rE   r6   r6   r6   r7   r-      s   

r-   c                   @   sZ   e Zd ZdZejZejZejZdd„ Zdd„ Z	e
dd„ ƒZe
dd	„ ƒZd
d„ Zdd„ ZdS )r3   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                 C   s
   || _ d S rR   rS   rU   r6   r6   r7   rV   ¾   s    zRSAAlgorithm.__init__c                 C   sŠ   t |tƒst |tƒr|S t |tƒr~t|ƒ}z.| d¡rFt|tƒ d�}nt|d tƒ d�}W q† t	k
rz   t
|tƒ d�}Y q†X ntdƒ‚|S )NrW   ©Úbackend©Úpasswordrl   úExpecting a PEM-formatted key.)Ú
isinstancer   r   r   r
   Ú
startswithr   r   r   Ú
ValueErrorr   Ú	TypeErrorr<   r6   r6   r7   r?   Á   s    
ÿ

zRSAAlgorithm.prepare_keyc                 C   sÖ   d }t | dd ƒrŠ|  ¡ }ddgtt|jjƒƒtt|jjƒƒtt|jƒƒtt|jƒƒtt|j	ƒƒtt|j
ƒƒtt|jƒƒtt|jƒƒdœ
}nBt | dd ƒrÄ|  ¡ }ddgtt|jƒƒtt|jƒƒdœ}ntdƒ‚t |¡S )NÚprivate_numbersÚRSArB   )
r^   Úkey_opsÚnÚeÚdÚpÚqÚdpÚdqÚqirE   )r^   rv   rw   rx   úNot a public or private key)Úgetattrrt   r   r   Úpublic_numbersrw   rx   ry   rz   r{   Údmp1Údmq1Úiqmpr   r_   r`   )rG   rc   Únumbersr6   r6   r7   rH   Õ   s.    öüzRSAAlgorithm.to_jwkc           	   	      s®  zt  | ¡‰ W n tk
r*   tdƒ‚Y nX ˆ  d¡dkrBtdƒ‚dˆ k�rhdˆ k�rhdˆ k�rhdˆ krptd	ƒ‚d
ddddg}‡ fdd„|D ƒ}t|ƒ}|r¬t|ƒs¬tdƒ‚ttˆ d ƒtˆ d ƒƒ}|�rt	tˆ d ƒtˆ d
 ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒ|d�}nHtˆ d ƒ}t
|j||jƒ\}}t	|||t||ƒt||ƒt||ƒ|d�}| tƒ ¡S dˆ k�r¢dˆ k�r¢ttˆ d ƒtˆ d ƒƒ}| tƒ ¡S tdƒ‚d S )NzKey is not valid JSONr^   ru   zNot an RSA keyry   rx   rw   Zothz5Unsupported RSA private key: > 2 primes not supportedrz   r{   r|   r}   r~   c                    s   g | ]}|ˆ k‘qS r6   r6   )rX   Úprop©rc   r6   r7   rZ   	  s     z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides d)ry   rz   r{   r‚   rƒ   r„   r�   r   )r_   ra   rr   r   rb   r[   Úallr   r   r   r   rw   rx   r   r   r   Zprivate_keyr   Z
public_key)	rI   Zother_propsZprops_foundZany_props_foundr�   r…   ry   rz   r{   r6   r‡   r7   rJ   ù   sf    
 
ÿ





ù
  ÿù

 
ÿzRSAAlgorithm.from_jwkc                 C   s   |  |t ¡ |  ¡ ¡S rR   )rB   r   ÚPKCS1v15rT   r@   r6   r6   r7   rB   8  s    zRSAAlgorithm.signc                 C   s:   z|  ||t ¡ |  ¡ ¡ W dS  tk
r4   Y dS X d S )NTF)rE   r   r‰   rT   r    rC   r6   r6   r7   rE   ;  s
    zRSAAlgorithm.verifyN)rK   rL   rM   rN   r   r.   r/   r0   rV   r?   rO   rH   rJ   rB   rE   r6   r6   r6   r7   r3   µ   s   
#
>r3   c                   @   sB   e Zd ZdZejZejZejZdd„ Zdd„ Z	dd„ Z
dd	„ Zd
S )r4   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                 C   s
   || _ d S rR   rS   rU   r6   r6   r7   rV   K  s    zECAlgorithm.__init__c                 C   sŠ   t |tƒst |tƒr|S t |tƒr~t|ƒ}z,| d¡rFt|tƒ d�}nt|tƒ d�}W q† t	k
rz   t
|d tƒ d�}Y q†X ntdƒ‚|S )Ns   ecdsa-sha2-rk   rm   ro   )rp   r   r   r   r
   rq   r   r   r   rr   r   rs   r<   r6   r6   r7   r?   N  s    
ÿ

zECAlgorithm.prepare_keyc                 C   s"   |  |t |  ¡ ¡¡}t||jƒS rR   )rB   r   ÚECDSArT   r	   Úcurve)r=   rA   r>   Úder_sigr6   r6   r7   rB   f  s    zECAlgorithm.signc                 C   sb   zt ||jƒ}W n tk
r&   Y dS X z| ||t |  ¡ ¡¡ W dS  tk
r\   Y dS X d S )NFT)r   r‹   rr   rE   r   rŠ   rT   r    )r=   rA   r>   rD   rŒ   r6   r6   r7   rE   k  s    zECAlgorithm.verifyN)rK   rL   rM   rN   r   r.   r/   r0   rV   r?   rB   rE   r6   r6   r6   r7   r4   B  s   r4   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )r5   zA
        Performs a signature using RSASSA-PSS with MGF1
        c                 C   s*   |  |tjt |  ¡ ¡| jjd�|  ¡ ¡S )N©ZmgfZsalt_length)rB   r   ÚPSSÚMGF1rT   Údigest_sizer@   r6   r6   r7   rB   |  s    þúzRSAPSSAlgorithm.signc              	   C   sN   z2|  ||tjt |  ¡ ¡| jjd�|  ¡ ¡ W dS  tk
rH   Y dS X d S )Nr�   TF)rE   r   rŽ   r�   rT   r�   r    rC   r6   r6   r7   rE   †  s    þù	zRSAPSSAlgorithm.verifyN)rK   rL   rM   rN   rB   rE   r6   r6   r6   r7   r5   w  s   
r5   )6rg   rd   r_   Úcompatr   r   Ú
exceptionsr   Úutilsr   r   r	   r
   r   r   r   r   Zcryptography.hazmat.primitivesr   Z,cryptography.hazmat.primitives.serializationr   r   r   Z-cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   Z,cryptography.hazmat.primitives.asymmetric.ecr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   Zcryptography.hazmat.backendsr   Zcryptography.exceptionsr    r1   ÚImportErrorÚsetZrequires_cryptographyr8   Úobjectr9   r,   r-   r3   r4   r5   r6   r6   r6   r7   Ú<module>   s@   ((
    ÿ(4 5