U
    M8Úcêb  ã                   @   s   d dl Z d dlmZ d dlmZmZmZmZmZm	Z	 d dl
mZmZmZmZmZ d dlmZ d dlmZ G dd„ deƒZG d	d
„ d
eƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZeeeeeeedœZdS )é    N)ÚBytesIO)ÚSIGNED_HEADERS_BLACKLISTÚ"STREAMING_UNSIGNED_PAYLOAD_TRAILERÚUNSIGNED_PAYLOADÚ
BaseSignerÚ_get_body_as_dictÚ_host_from_url)ÚHTTPHeadersÚawscrtÚparse_qsÚurlsplitÚ
urlunsplit)ÚNoCredentialsError)Úpercent_encode_sequencec                   @   s~   e Zd ZdZddddgZejjjZ	dZ
dZdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚCrtSigV4AuthTÚAuthorizationú
X-Amz-DateúX-Amz-Content-SHA256úX-Amz-Security-Tokenc                 C   s   || _ || _|| _d | _d S ©N©ÚcredentialsÚ_service_nameÚ_region_nameÚ_expiration_in_seconds©Úselfr   Úservice_nameÚregion_name© r   ú5/tmp/pip-unpacked-wheel-ozje0y8b/botocore/crt/auth.pyÚ__init__*   s    zCrtSigV4Auth.__init__c                 C   s0   |j  di ¡}| d¡}t|tƒo.| d¡dkS ©NÚchecksumÚrequest_algorithmÚinÚtrailer©ÚcontextÚgetÚ
isinstanceÚdict©r   ÚrequestÚchecksum_contextÚ	algorithmr   r   r    Ú_is_streaming_checksum_payload0   s    
z+CrtSigV4Auth._is_streaming_checksum_payloadc           
      C   s  | j d krtƒ ‚tj ¡ jtjjd}|  |¡}|  |¡ t	j
jj| j j| j j| j jd}|  |¡rjt}n|  |¡r„|r~|}qˆd }nt}|  |¡ržt	j
jj}n
t	j
jj}t	j
jt	j
jj| j|| j| j|| j| j| j ||| j!d}|  "|¡}t	j
 #||¡}	|	 $¡  |  %||¡ d S ©N)Útzinfo)Zaccess_key_idZsecret_access_keyZsession_token)r/   Zsignature_typeÚcredentials_providerZregionZserviceÚdateZshould_sign_headerZuse_double_uri_encodeZshould_normalize_uri_pathZsigned_body_valueZsigned_body_header_typeZexpiration_in_seconds)&r   r   ÚdatetimeÚutcnowÚreplaceÚtimezoneÚutcÚ_get_existing_sha256Ú_modify_request_before_signingr
   ÚauthÚAwsCredentialsProviderÚ
new_staticÚ
access_keyÚ
secret_keyÚtokenr0   r   Ú_should_sha256_sign_payloadr   Ú!_should_add_content_sha256_headerÚAwsSignedBodyHeaderTypeÚX_AMZ_CONTENT_SHA_256ÚNONEÚAwsSigningConfigÚAwsSigningAlgorithmZV4Ú_SIGNATURE_TYPEr   r   Ú_should_sign_headerÚ_USE_DOUBLE_URI_ENCODEÚ_SHOULD_NORMALIZE_URI_PATHr   Ú_crt_request_from_aws_requestÚaws_sign_requestÚresultÚ_apply_signing_changes©
r   r-   Zdatetime_nowZexisting_sha256r3   Úexplicit_payloadZbody_headerZsigning_configÚcrt_requestÚfuturer   r   r    Úadd_auth5   sR    

ÿ

ý


ÿ
ô
zCrtSigV4Auth.add_authc           
      C   sÒ   t |jƒ}|jr|jnd}|jrhg }|j ¡ D ]$\}}t|ƒ}| |› d|› ¡ q.|d d |¡ }n|jr~|› d|j› }t	j
 |j ¡ ¡}d }|jr¸t|jdƒr®|j}n
t|jƒ}t	j
j|j|||d}	|	S ©Nú/ú=ú?ú&Úseek)ÚmethodÚpathÚheadersZbody_stream©r   Úurlr]   ÚparamsÚitemsÚstrÚappendÚjoinÚqueryr
   ÚhttpZHttpHeadersr^   ÚbodyÚhasattrr   ZHttpRequestr\   ©
r   Úaws_requestÚ	url_partsZcrt_pathÚarrayÚparamÚvalueZcrt_headersZcrt_body_streamrS   r   r   r    rM   n   s.    

üz*CrtSigV4Auth._crt_request_from_aws_requestc                 C   s   t  t|jƒ¡|_d S r   ©r	   Z
from_pairsÚlistr^   ©r   rk   Úsigned_crt_requestr   r   r    rP   Œ   s    ÿz#CrtSigV4Auth._apply_signing_changesc                 K   s   |  ¡ tkS r   ©Úlowerr   ©r   ÚnameÚkwargsr   r   r    rJ   ’   s    z CrtSigV4Auth._should_sign_headerc                 C   s<   | j D ]}||jkr|j|= qd|jkr8t|jƒ|jd< d S ©NÚhost©Ú_PRESIGNED_HEADERS_BLOCKLISTr^   r   r`   ©r   r-   Úhr   r   r    r;   •   s
    



z+CrtSigV4Auth._modify_request_before_signingc                 C   s   |j  d¡S ©Nr   ©r^   r)   ©r   r-   r   r   r    r:   Ÿ   s    z!CrtSigV4Auth._get_existing_sha256c                 C   s   |j  d¡sdS |j dd¡S ©NÚhttpsTÚpayload_signing_enabled©r`   Ú
startswithr(   r)   r   r   r   r    rB   ¢   s    z(CrtSigV4Auth._should_sha256_sign_payloadc                 C   s   |d k	S r   r   ©r   rR   r   r   r    rC   ¬   s    z.CrtSigV4Auth._should_add_content_sha256_headerN)Ú__name__Ú
__module__Ú__qualname__ÚREQUIRES_REGIONr|   r
   r<   ÚAwsSignatureTypeÚHTTP_REQUEST_HEADERSrI   rK   rL   r!   r0   rU   rM   rP   rJ   r;   r:   rB   rC   r   r   r   r    r      s&   ü
9

r   c                       s4   e Zd ZdZdZdd„ Z‡ fdd„Zdd„ Z‡  ZS )ÚCrtS3SigV4AuthFc                 C   s   d S r   r   r   r   r   r    r:   ¶   s    z#CrtS3SigV4Auth._get_existing_sha256c                    s°   |j  d¡}t|dd ƒ}|d kr$i }| dd ¡}|d k	r<|S d}|j  di ¡}| d¡}t|tƒrx| d¡dkrx|d	 }|j d
¡rŽ||jkr’dS |j  dd¡r¤dS tƒ  	|¡S )NÚclient_configÚs3r„   úContent-MD5r#   r$   r%   Úheaderrw   rƒ   TÚhas_streaming_inputF)
r(   r)   Úgetattrr*   r+   r`   r†   r^   ÚsuperrB   )r   r-   r   Ú	s3_configÚsign_payloadZchecksum_headerr.   r/   ©Ú	__class__r   r    rB   º   s(    

ÿþz*CrtS3SigV4Auth._should_sha256_sign_payloadc                 C   s   dS ©NTr   r‡   r   r   r    rC   ã   s    z0CrtS3SigV4Auth._should_add_content_sha256_header©	rˆ   r‰   rŠ   rK   rL   r:   rB   rC   Ú__classcell__r   r   r˜   r    rŽ   ±   s
   )rŽ   c                   @   s~   e Zd ZdZddddgZejjjZ	dZ
dZdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚCrtSigV4AsymAuthTr   r   r   r   c                 C   s   || _ || _|| _d | _d S r   r   r   r   r   r    r!   ô   s    zCrtSigV4AsymAuth.__init__c           
      C   s  | j d krtƒ ‚tj ¡ jtjjd}|  |¡}|  |¡ t	j
jj| j j| j j| j jd}|  |¡rjt}n|  |¡r„|r~|}qˆd }nt}|  |¡ržt	j
jj}n
t	j
jj}t	j
jt	j
jj| j|| j| j|| j| j| j ||| j!d}|  "|¡}t	j
 #||¡}	|	 $¡  |  %||¡ d S r1   )&r   r   r5   r6   r7   r8   r9   r:   r;   r
   r<   r=   r>   r?   r@   rA   r0   r   rB   r   rC   rD   rE   rF   rG   rH   ZV4_ASYMMETRICrI   r   r   rJ   rK   rL   r   rM   rN   rO   rP   rQ   r   r   r    rU   ú   sR    

ÿ

ý


ÿ
ô
zCrtSigV4AsymAuth.add_authc           
      C   sÒ   t |jƒ}|jr|jnd}|jrhg }|j ¡ D ]$\}}t|ƒ}| |› d|› ¡ q.|d d |¡ }n|jr~|› d|j› }t	j
 |j ¡ ¡}d }|jr¸t|jdƒr®|j}n
t|jƒ}t	j
j|j|||d}	|	S rV   r_   rj   r   r   r    rM   3  s.    

üz.CrtSigV4AsymAuth._crt_request_from_aws_requestc                 C   s   t  t|jƒ¡|_d S r   rp   rr   r   r   r    rP   Q  s    ÿz'CrtSigV4AsymAuth._apply_signing_changesc                 K   s   |  ¡ tkS r   rt   rv   r   r   r    rJ   W  s    z$CrtSigV4AsymAuth._should_sign_headerc                 C   s<   | j D ]}||jkr|j|= qd|jkr8t|jƒ|jd< d S ry   r{   r}   r   r   r    r;   Z  s
    



z/CrtSigV4AsymAuth._modify_request_before_signingc                 C   s   |j  d¡S r   r€   r   r   r   r    r:   d  s    z%CrtSigV4AsymAuth._get_existing_sha256c                 C   s0   |j  di ¡}| d¡}t|tƒo.| d¡dkS r"   r'   r,   r   r   r    r0   g  s    
z/CrtSigV4AsymAuth._is_streaming_checksum_payloadc                 C   s   |j  d¡sdS |j dd¡S r‚   r…   r   r   r   r    rB   l  s    z,CrtSigV4AsymAuth._should_sha256_sign_payloadc                 C   s   |d k	S r   r   r‡   r   r   r    rC   v  s    z2CrtSigV4AsymAuth._should_add_content_sha256_headerN)rˆ   r‰   rŠ   r‹   r|   r
   r<   rŒ   r   rI   rK   rL   r!   rU   rM   rP   rJ   r;   r:   r0   rB   rC   r   r   r   r    r   è   s&   ü
9

r   c                       s4   e Zd ZdZdZdd„ Z‡ fdd„Zdd„ Z‡  ZS )ÚCrtS3SigV4AsymAuthFc                 C   s   d S r   r   r   r   r   r    r:   €  s    z'CrtS3SigV4AsymAuth._get_existing_sha256c                    st   |j  d¡}t|dd ƒ}|d kr$i }| dd ¡}|d k	r<|S |j d¡rRd|jkrVdS |j  dd¡rhdS tƒ  |¡S )	Nr   r   r„   rƒ   r‘   Tr“   F)r(   r)   r”   r`   r†   r^   r•   rB   )r   r-   r   r–   r—   r˜   r   r    rB   „  s    
ÿþz.CrtS3SigV4AsymAuth._should_sha256_sign_payloadc                 C   s   dS rš   r   r‡   r   r   r    rC   ¨  s    z4CrtS3SigV4AsymAuth._should_add_content_sha256_headerr›   r   r   r˜   r    rž   {  s
   $rž   c                       sF   e Zd ZdZejjjZef‡ fdd„	Z	‡ fdd„Z
‡ fdd„Z‡  ZS )ÚCrtSigV4AsymQueryAuthé  c                    s   t ƒ  |||¡ || _d S r   ©r•   r!   r   ©r   r   r   r   Úexpiresr˜   r   r    r!   ±  s    zCrtSigV4AsymQueryAuth.__init__c           	         s¤   t ƒ  |¡ |j d¡}|dkr(|jd= t|jƒ}t|jdd}dd„ | ¡ D ƒ}|j	rl| 
t|ƒ¡ d|_	t|ƒ}|}|d |d	 |d
 ||d f}t|ƒ|_d S )Núcontent-typeú0application/x-www-form-urlencoded; charset=utf-8T©Úkeep_blank_valuesc                 S   s   i | ]\}}||d  “qS ©r   r   ©Ú.0ÚkÚvr   r   r    Ú
<dictcomp>Ç  s      zHCrtSigV4AsymQueryAuth._modify_request_before_signing.<locals>.<dictcomp>Ú r   é   é   é   )r•   r;   r^   r)   r   r`   r   rf   rb   ÚdataÚupdater   r   r   )	r   r-   Úcontent_typerl   Zquery_string_partsÚ
query_dictÚnew_query_stringÚpÚnew_url_partsr˜   r   r    r;   ·  s    
	z4CrtSigV4AsymQueryAuth._modify_request_before_signingc                    sL   t ƒ  ||¡ t|jƒj}t|jƒ}t|d |d |d ||d fƒ|_d S ©Nr   r¯   r°   r±   ©r•   rP   r   r]   rf   r`   r   ©r   rk   rs   Zsigned_queryr·   r˜   r   r    rP   á  s    
	z,CrtSigV4AsymQueryAuth._apply_signing_changes©rˆ   r‰   rŠ   ZDEFAULT_EXPIRESr
   r<   rŒ   ZHTTP_REQUEST_QUERY_PARAMSrI   r!   r;   rP   rœ   r   r   r˜   r    rŸ   ­  s   
ÿ*rŸ   c                   @   s(   e Zd ZdZdZdZdd„ Zdd„ ZdS )ÚCrtS3SigV4AsymQueryAuthz¢S3 SigV4A auth using query parameters.
    This signer will sign a request using query parameters and signature
    version 4A, i.e a "presigned url" signer.
    Fc                 C   s   dS ©NFr   r   r   r   r    rB   ü  s    z3CrtS3SigV4AsymQueryAuth._should_sha256_sign_payloadc                 C   s   dS r¾   r   r‡   r   r   r    rC     s    z9CrtS3SigV4AsymQueryAuth._should_add_content_sha256_headerN©rˆ   r‰   rŠ   Ú__doc__rK   rL   rB   rC   r   r   r   r    r½   ò  s
   r½   c                       sF   e Zd ZdZejjjZef‡ fdd„	Z	‡ fdd„Z
‡ fdd„Z‡  ZS )ÚCrtSigV4QueryAuthr    c                    s   t ƒ  |||¡ || _d S r   r¡   r¢   r˜   r   r    r!     s    zCrtSigV4QueryAuth.__init__c                    s¸   t ƒ  |¡ |j d¡}|dkr(|jd= t|jƒ}dd„ t|jdd ¡ D ƒ}|j	rf| 
|j	¡ i |_	|jr€| 
t|ƒ¡ d|_t|ƒ}|}|d |d	 |d
 ||d f}t|ƒ|_d S )Nr¤   r¥   c                 S   s   i | ]\}}||d  “qS r¨   r   r©   r   r   r    r­   !  s   ÿ zDCrtSigV4QueryAuth._modify_request_before_signing.<locals>.<dictcomp>Tr¦   r®   r   r¯   r°   r±   )r•   r;   r^   r)   r   r`   r   rf   rb   ra   r³   r²   r   r   r   )r   r-   r´   rl   rµ   r¶   r·   r¸   r˜   r   r    r;     s*    
 ÿþ	z0CrtSigV4QueryAuth._modify_request_before_signingc                    sL   t ƒ  ||¡ t|jƒj}t|jƒ}t|d |d |d ||d fƒ|_d S r¹   rº   r»   r˜   r   r    rP   B  s    
	z(CrtSigV4QueryAuth._apply_signing_changesr¼   r   r   r˜   r    rÁ     s   
ÿ0rÁ   c                   @   s(   e Zd ZdZdZdZdd„ Zdd„ ZdS )ÚCrtS3SigV4QueryAutha  S3 SigV4 auth using query parameters.
    This signer will sign a request using query parameters and signature
    version 4, i.e a "presigned url" signer.
    Based off of:
    http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
    Fc                 C   s   dS r¾   r   r   r   r   r    rB   _  s    z/CrtS3SigV4QueryAuth._should_sha256_sign_payloadc                 C   s   dS r¾   r   r‡   r   r   r    rC   f  s    z5CrtS3SigV4QueryAuth._should_add_content_sha256_headerNr¿   r   r   r   r    rÂ   S  s
   rÂ   )Zv4zv4-queryZv4aZs3v4z
s3v4-queryZs3v4azs3v4a-query)r5   Úior   Zbotocore.authr   r   r   r   r   r   Zbotocore.compatr	   r
   r   r   r   Zbotocore.exceptionsr   Zbotocore.utilsr   r   rŽ   r   rž   rŸ   r½   rÁ   rÂ   ZCRT_AUTH_TYPE_MAPSr   r   r   r    Ú<module>   s.     7 2EKù