U
    /2iv                     @   s  d Z ddlZddlmZ ddlZddlZddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ddlmZ ddlmZ ejejejejhZd	gZeed
re Znedd dkZerde
j Znde
j Zde dZed Zed Zed Zed Z G dd dej!Z!dS )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)mtlsz#https://www.googleapis.com/auth/iamshould_use_client_certZ!GOOGLE_API_USE_CLIENT_CERTIFICATEfalsetrueziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                   @   s@   e Zd ZdZdd Zdd Zedd Ze	e
jdd	 Zd
S )Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 C   s   || _ || _|| _dS )a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   Zservice_account_email r   3/tmp/pip-unpacked-wheel-t7lbbs2b/google/auth/iam.py__init__S   s    zSigner.__init__c           	      C   s   t |}d}ttj| jj| j	}ddi}t
dt|did}t }|D ]h}| j| j||| | j||||d}|jtkrq\|jtjkrtd|jt
|jd  S tdd	S )
z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retriesN)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   Zuniverse_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ZExponentialBackoffZbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   ZTransportErrordataloads)	r   messager   r   r   r   retries_responser   r   r   _make_signing_requestg   s4    
 

zSigner._make_signing_requestc                 C   s   dS )zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        Nr   )r   r   r   r   key_id   s    zSigner.key_idc                 C   s   |  |}t|d S )NZ
signedBlob)r/   r!   	b64decode)r   r+   r.   r   r   r   sign   s    
zSigner.signN)__name__
__module____qualname____doc__r   r/   propertyr0   r   Zcopy_docstringr   r   r2   r   r   r   r   r   H   s   

	
r   )"r6   r!   http.clientclientr'   r   osZgoogle.authr   r   r   r   r   Zgoogle.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr&   Z
_IAM_SCOPEhasattrr   Zuse_client_certgetenvlowerr   Z_IAM_DOMAINZ_IAM_BASE_URLZ_IAM_ENDPOINTr   Z_IAM_SIGNJWT_ENDPOINTZ_IAM_IDTOKEN_ENDPOINTr   r   r   r   r   <module>   s:   

