U
    dht                     @  s  d dl mZ d dlZd dlZd dlZd dlZd dlmZmZ d dl	m
Z
mZmZmZmZmZmZ ddlmZ ddlmZmZ ddlmZmZmZmZmZmZmZmZmZ ej d	krd d
l	m!Z! nd d
l"m!Z! zd dl#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z* d dl+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8 d dl9m:Z:m;Z; d dl<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZD d dlEmFZFmGZGmHZHmIZImJZJmKZKmLZL dZMW n eNk
r   dZMY nX e
re=e?B ZOe2e4B ZPe:e;B e7B e8B ZQeOePB eQB ZRe=e2B e:B e7B ZSe?e4B e;B e8B ZTddddddddddd d!hZUd"d#d$d%ZVG d&d' d'eZWG d(d) d)eWZXG d*d+ d+eWZYeMrG d,d- d-eWZZG d.d/ d/eWZ[G d0d1 d1eZZ\G d2d3 d3eWZ]dS )4    )annotationsN)ABCabstractmethod)TYPE_CHECKINGAnyClassVarNoReturnUnioncastoverload   InvalidKeyError)HashlibHashJWKDict)	base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintis_pem_format
is_ssh_keyraw_to_der_signatureto_base64url_uint)      )Literal)InvalidSignature)default_backend)hashes)padding)
ECDSA	SECP256K1	SECP256R1	SECP384R1	SECP521R1EllipticCurveEllipticCurvePrivateKeyEllipticCurvePrivateNumbersEllipticCurvePublicKeyEllipticCurvePublicNumbers)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTFRS256RS384RS512ES256ES256KES384ES521ES512PS256PS384PS512EdDSAzdict[str, Algorithm])returnc                  C  s   t  ttjttjttjd} tr| ttjttjttjttjttjttjttjttjt	t	jt	t	jt	t	jt
 d | S )zE
    Returns the algorithms that are implemented by the library.
    )noneZHS256ZHS384ZHS512)r>   r?   r@   rA   rB   rC   rD   rE   rF   rG   rH   rI   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)Zdefault_algorithms rW   2/tmp/pip-unpacked-wheel-z041_nl0/jwt/algorithms.pyget_default_algorithmsp   s0    rY   c                   @  s   e Zd ZdZdddddZeddddd	Zedddd
ddZedddddddZe	e
edddddZe	e
ed!dddddZe
ed"dddddZe
edddddZd S )#	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    bytes)bytestrrJ   c                 C  sn   t | dd}|dkrttrZt|trZt|tjrZtj| t	 d}|
| t| S t|| S dS )z
        Compute a hash digest using the specified algorithm's hash algorithm.

        If there is no hash algorithm, raises a NotImplementedError.
        hash_algN)backend)getattrNotImplementedErrorrQ   
isinstancetype
issubclassr   ZHashAlgorithmZHashr   rR   r[   finalizedigest)selfr\   r]   re   rW   rW   rX   compute_hash_digest   s    

zAlgorithm.compute_hash_digestr   keyrJ   c                 C  s   dS )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NrW   rf   ri   rW   rW   rX   prepare_key   s    zAlgorithm.prepare_keymsgri   rJ   c                 C  s   dS )zn
        Returns a digital signature for the specified message
        using the specified key value.
        NrW   rf   rm   ri   rW   rW   rX   sign   s    zAlgorithm.signboolrm   ri   sigrJ   c                 C  s   dS )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        NrW   rf   rm   ri   rr   rW   rW   rX   verify   s    zAlgorithm.verifyLiteral[True]r   )as_dictrJ   c                 C  s   d S NrW   key_objrv   rW   rW   rX   to_jwk   s    zAlgorithm.to_jwkFLiteral[False]strc                 C  s   d S rw   rW   rx   rW   rW   rX   rz      s    Union[JWKDict, str]c                 C  s   dS )z3
        Serializes a given key into a JWK
        NrW   rx   rW   rW   rX   rz      s    str | JWKDictjwkrJ   c                 C  s   dS )zJ
        Deserializes a given key from JWK back into a key object
        NrW   r   rW   rW   rX   from_jwk   s    zAlgorithm.from_jwkN)F)F)__name__
__module____qualname____doc__rg   r   rk   ro   rt   r   staticmethodrz   r   rW   rW   rW   rX   rZ      s,   rZ   c                   @  sr   e Zd ZdZdddddZddddd	d
ZdddddddZedddddddZedddddZ	dS )rL   zZ
    Placeholder for use when no signing or verification
    operations are required.
    z
str | NoneNonerh   c                 C  s    |dkrd }|d k	rt d|S )N z*When alg = "none", key value must be None.r   rj   rW   rW   rX   rk      s
    zNoneAlgorithm.prepare_keyr[   rl   c                 C  s   dS )N    rW   rn   rW   rW   rX   ro      s    zNoneAlgorithm.signrp   rq   c                 C  s   dS )NFrW   rs   rW   rW   rX   rt      s    zNoneAlgorithm.verifyFr   r   ry   rv   rJ   c                 C  s
   t  d S rw   r`   rx   rW   rW   rX   rz      s    zNoneAlgorithm.to_jwkr~   r   c                 C  s
   t  d S rw   r   r   rW   rW   rX   r      s    zNoneAlgorithm.from_jwkN)F)
r   r   r   r   rk   ro   rt   r   rz   r   rW   rW   rW   rX   rL      s   	rL   c                   @  s   e Zd ZU dZejZded< ejZ	ded< ej
Zded< dddd	d
ZdddddZeeddddddZeed'ddddddZed(ddddddZedddddZdddd d!d"Zddddd#d$d%Zd&S ))rM   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    zClassVar[HashlibHash]rN   rO   rP   r   r   r]   rJ   c                 C  s
   || _ d S rw   r]   rf   r]   rW   rW   rX   __init__  s    zHMACAlgorithm.__init__str | bytesr[   rh   c                 C  s$   t |}t|st|r td|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r   r   r   rf   ri   	key_bytesrW   rW   rX   rk     s    zHMACAlgorithm.prepare_keyru   r   r   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz     s    zHMACAlgorithm.to_jwkFr{   r|   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz     s    rp   r}   c                 C  s,   t t|  dd}|r|S t|S d S )Noct)kkty)r   r   decodejsondumps)ry   rv   r   rW   rW   rX   rz     s    r~   r   c                 C  sn   z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtdt|d S )NKey is not valid JSONr   r   zNot an HMAC keyr   )	ra   r|   r   loadsdict
ValueErrorr   getr   )r   objrW   rW   rX   r   )  s    

zHMACAlgorithm.from_jwkrl   c                 C  s   t ||| j S rw   )hmacnewr]   re   rn   rW   rW   rX   ro   :  s    zHMACAlgorithm.signrq   c                 C  s   t || ||S rw   )r   compare_digestro   rs   rW   rW   rX   rt   =  s    zHMACAlgorithm.verifyN)F)F)r   r   r   r   hashlibsha256rN   __annotations__sha384rO   sha512rP   r   rk   r   r   rz   r   ro   rt   rW   rW   rW   rX   rM      s$   
rM   c                   @  s   e Zd ZU dZejZded< ejZded< ejZded< dddd	d
Z	dddddZ
eeddddddZeed*ddddddZed+ddddddZedddddZd d!d d"d#d$Zd d%d dd&d'd(Zd)S ),rS   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        $ClassVar[type[hashes.HashAlgorithm]]rN   rO   rP   type[hashes.HashAlgorithm]r   r   c                 C  s
   || _ d S rw   r   r   rW   rW   rX   r   M  s    zRSAAlgorithm.__init__zAllowedRSAKeys | str | bytesAllowedRSAKeysrh   c                 C  s   t |ttfr|S t |ttfs(tdt|}z2|drLttt	|W S ttt
|d dW S W n" tk
r   ttt| Y S X d S )NExpecting a PEM-formatted key.s   ssh-rsapassword)ra   r/   r1   r[   r|   	TypeErrorr   
startswithr
   r=   r;   r   r<   r   rW   rW   rX   rk   P  s    
 

zRSAAlgorithm.prepare_keyru   r   r   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz   c  s    zRSAAlgorithm.to_jwkFr{   r|   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz   h  s    rp   r}   c                 C  s   d }t | dr|  }ddgt|jj t|jj t|j t|j t|j	 t|j
 t|j t|j d
}n@t | dr|  }ddgt|j t|j d}ntd|r|S t|S d S )Nprivate_numbersRSAro   )
r   key_opsnedpqdpdqqirt   )r   r   r   r   Not a public or private key)hasattrr   r   public_numbersr   r   r   r   r   r   dmp1dmq1iqmpr   r   r   )ry   rv   r   numbersrW   rW   rX   rz   m  s2    

r~   r   c           	   	     s  z.t | trt|  nt | tr(|  ntW n tk
rJ   tdY nX  ddkrbtdd krd krd krd krtd	d
ddddg} fdd|D }t|}|rt	|stdt
t d t d }|r4tt d t d
 t d t d t d t d |d}nHt d }t|j||j\}}t|||t||t||t|||d}| S d krd krt
t d t d  S tdd S )Nr   r   r   zNot an RSA keyr   r   r   Zothz5Unsupported RSA private key: > 2 primes not supportedr   r   r   r   r   c                   s   g | ]}| kqS rW   rW   ).0propr   rW   rX   
<listcomp>  s     z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides d)r   r   r   r   r   r   r   r   )ra   r|   r   r   r   r   r   r   anyallr2   r   r0   r6   r   r   r3   r4   r5   private_key
public_key)	r   Zother_propsZprops_foundZany_props_foundr   r   r   r   r   rW   r   rX   r     st    










  


zRSAAlgorithm.from_jwkr[   r/   rl   c                 C  s   | |t |  S rw   )ro   r    PKCS1v15r]   rn   rW   rW   rX   ro     s    zRSAAlgorithm.signr1   rq   c                 C  s:   z| ||t |   W dS  tk
r4   Y dS X d S )NTF)rt   r    r   r]   r   rs   rW   rW   rX   rt     s
    zRSAAlgorithm.verifyN)F)F)r   r   r   r   r   rN   r   rO   rP   r   rk   r   r   rz   r   ro   rt   rW   rW   rW   rX   rS   C  s&   
 (GrS   c                   @  s   e Zd ZU dZejZded< ejZded< ejZded< dddd	d
Z	dddddZ
ddddddZdddddddZeeddddddZeed*dd d!dd"dZed+ddd#dd$dZed%dd&d'd(Zd)S ),rT   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        r   rN   rO   rP   r   r   r   c                 C  s
   || _ d S rw   r   r   rW   rW   rX   r     s    zECAlgorithm.__init__zAllowedECKeys | str | bytesAllowedECKeysrh   c                 C  s   t |ttfr|S t |ttfs(tdt|}z |drFt|}nt	|}W n  t
k
rp   t|d d}Y nX t |ttfstd|S )Nr   s   ecdsa-sha2-r   zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for ECDSA algorithms)ra   r'   r)   r[   r|   r   r   r   r=   r<   r   r;   r   )rf   ri   r   Z
crypto_keyrW   rW   rX   rk     s&    

 zECAlgorithm.prepare_keyr[   r'   rl   c                 C  s    | |t|  }t||jS rw   )ro   r!   r]   r   curve)rf   rm   ri   der_sigrW   rW   rX   ro     s    zECAlgorithm.signz'AllowedECKeys'rp   rq   c                 C  sv   zt ||j}W n tk
r&   Y dS X z2t|tr<| n|}|||t|   W dS  t	k
rp   Y dS X d S )NFT)
r   r   r   ra   r'   r   rt   r!   r]   r   )rf   rm   ri   rr   r   r   rW   rW   rX   rt     s    
zECAlgorithm.verifyru   r   r   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz   )  s    zECAlgorithm.to_jwkFr{   r|   c                 C  s   d S rw   rW   rx   rW   rW   rX   rz   .  s    r}   c                 C  s   t | tr|   }nt | tr,|  }ntdt | jtrFd}nFt | jtrXd}n4t | jt	rjd}n"t | jt
r|d}ntd| j d|t|j t|j d}t | trt|  j |d	< |r|S t|S d S )
Nr   P-256P-384P-521	secp256k1Invalid curve: EC)r   crvxyr   )ra   r'   r   r   r)   r   r   r#   r$   r%   r"   r   r   r   r   r   Zprivate_valuer   r   )ry   rv   r   r   r   rW   rW   rX   rz   3  s4    



r~   r   c                 C  s$  z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtdd|ksrd|krztdt|d}t|d}|d}|dkrt	|t	|  krd	krn nt
 }ntd
n|dkrt	|t	|  krdkrn nt }ntdn|dkrZt	|t	|  krDdkrPn nt }ntdnN|dkrt	|t	|  krd	krn nt }ntdntd| ttj|ddtj|dd|d}d|kr| S t|d}t	|t	|krtdt	||ttj|dd| S )Nr   r   r   zNot an Elliptic curve keyr   r   r   r       z)Coords should be 32 bytes for curve P-256r   0   z)Coords should be 48 bytes for curve P-384r   B   z)Coords should be 66 bytes for curve P-521r   z-Coords should be 32 bytes for curve secp256k1r   big)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})ra   r|   r   r   r   r   r   r   r   lenr#   r$   r%   r"   r*   int
from_bytesr   r(   r   )r   r   r   r   r   Z	curve_objr   r   rW   rW   rX   r   Z  sh    


 

$

$

$
   zECAlgorithm.from_jwkN)F)F)r   r   r   r   r   rN   r   rO   rP   r   rk   ro   rt   r   r   rz   r   rW   rW   rW   rX   rT     s&   
 &rT   c                   @  s6   e Zd ZdZddddddZddddd	d
dZdS )rU   zA
        Performs a signature using RSASSA-PSS with MGF1
        r[   r/   rl   c                 C  s,   | |tjt|  |  jd|  S )NZmgfZsalt_length)ro   r    PSSMGF1r]   digest_sizern   rW   rW   rX   ro     s    zRSAPSSAlgorithm.signr1   rp   rq   c              	   C  sP   z4| ||tjt|  |  jd|   W dS  tk
rJ   Y dS X d S )Nr   TF)rt   r    r   r   r]   r   r   rs   rW   rW   rX   rt     s    	zRSAPSSAlgorithm.verifyN)r   r   r   r   ro   rt   rW   rW   rW   rX   rU     s   
rU   c                   @  s   e Zd ZdZdddddZddd	d
dZddddddZdddddddZee	ddddddZ
ee	d&ddddddZ
e	d'ddddd dZ
e	d!dd"d#d$Zd%S )(rV   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        r   r   )kwargsrJ   c                 K  s   d S rw   rW   )rf   r   rW   rW   rX   r     s    zOKPAlgorithm.__init__zAllowedOKPKeys | str | bytesAllowedOKPKeysrh   c                 C  s   t |ttfr~t |tr"|dn|}t |tr:|dn|}d|krPt|}n.d|krft|d d}n|dd dkr~t|}t |tt	t
tfstd|S )	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr   r      zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)ra   r[   r|   r   encoder<   r;   r=   r-   r.   r+   r,   r   )rf   ri   Zkey_strr   rW   rW   rX   rk     s"    

zOKPAlgorithm.prepare_keyr   z#Ed25519PrivateKey | Ed448PrivateKeyr[   rl   c                 C  s"   t |tr|dn|}||S )aS  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` isinstance
            :return bytes signature: The signature, as bytes
            r   )ra   r|   r   ro   )rf   rm   ri   	msg_bytesrW   rW   rX   ro     s    
zOKPAlgorithm.signrp   rq   c                 C  sx   z\t |tr|dn|}t |tr.|dn|}t |ttfrH| n|}||| W dS  tk
rr   Y dS X dS )a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TFN)ra   r|   r   r-   r+   r   rt   r   )rf   rm   ri   rr   r   Z	sig_bytesr   rW   rW   rX   rt     s    
zOKPAlgorithm.verifyru   r   )ri   rv   rJ   c                 C  s   d S rw   rW   ri   rv   rW   rW   rX   rz     s    zOKPAlgorithm.to_jwkFr{   r|   c                 C  s   d S rw   rW   r   rW   rW   rX   rz   	  s    r}   c                 C  s   t | ttfr\| jtjtjd}t | tr.dnd}tt|	 d|d}|rR|S t
|S t | ttfr| jtjtjt d}|  jtjtjd}t | trdnd}tt|	 tt|	 d|d}|r|S t
|S tdd S )	N)encodingformatEd25519Ed448OKP)r   r   r   )r   r   Zencryption_algorithm)r   r   r   r   r   )ra   r.   r,   Zpublic_bytesr7   ZRawr:   r   r   r   r   r   r-   r+   Zprivate_bytesr9   r8   r   r   )ri   rv   r   r   r   r   rW   rW   rX   rz     sB    

r~   r   c              
   C  s2  z.t | trt| }nt | tr(| }ntW n tk
rJ   tdY nX |ddkrbtd|d}|dkr|dkrtd| d	|krtd
t|d	}zVd|kr|dkrt	
|W S t
|W S t|d}|dkrt|W S t|W S  tk
r, } ztd|W 5 d }~X Y nX d S )Nr   r   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)ra   r|   r   r   r   r   r   r   r   r.   Zfrom_public_bytesr,   r-   Zfrom_private_bytesr+   )r   r   r   r   r   errrW   rW   rX   r   =  s6    


zOKPAlgorithm.from_jwkN)F)F)r   r   r   r   r   rk   ro   rt   r   r   rz   r   rW   rW   rW   rX   rV     s   .rV   )^
__future__r   r   r   r   sysabcr   r   typingr   r   r   r   r	   r
   r   
exceptionsr   typesr   r   utilsr   r   r   r   r   r   r   r   r   version_infor   Ztyping_extensionsZcryptography.exceptionsr   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr    Z,cryptography.hazmat.primitives.asymmetric.ecr!   r"   r#   r$   r%   r&   r'   r(   r)   r*   Z/cryptography.hazmat.primitives.asymmetric.ed448r+   r,   Z1cryptography.hazmat.primitives.asymmetric.ed25519r-   r.   Z-cryptography.hazmat.primitives.asymmetric.rsar/   r0   r1   r2   r3   r4   r5   r6   Z,cryptography.hazmat.primitives.serializationr7   r8   r9   r:   r;   r<   r=   rQ   ModuleNotFoundErrorr   r   r   ZAllowedKeysZAllowedPrivateKeysZAllowedPublicKeysZrequires_cryptographyrY   rZ   rL   rM   rS   rT   rU   rV   rW   rW   rW   rX   <module>   sv   $,
0(
$

"KF & 7