U d^1@sddlmZddlZddlZddlmZddlmZddlmZm Z m Z ddl m Z m Z ddlmZdd lmZmZmZmZmZmZmZdd lmZe rdd lmZmZGd d d ZeZejZejZej Z dS)) annotationsN)timegm)Iterable)datetime timedeltatimezone) TYPE_CHECKINGAny)api_jws) DecodeErrorExpiredSignatureErrorImmatureSignatureErrorInvalidAudienceErrorInvalidIssuedAtErrorInvalidIssuerErrorMissingRequiredClaimError)RemovedInPyjwt3Warning)AllowedPrivateKeysAllowedPublicKeysc @sJeZdZdBdddddZeddd d ZdCd dddddddddZdDd ddddddZdEdddddd d!dd"d#d d$ d%d&Zd d#d'd(d)Z dFdddddd d!dd"d#d#d$ d*d+Z dGd d d"dd,d-d.Z d d dd/d0d1Z d d2d2dd3d4d5Z d d2d2dd3d6d7Zd d2d2dd3d8d9Zd:d;d d!ddd<d=d>Zd d#dd?d@dAZdS)HPyJWTNzdict[str, Any] | NoneNone)optionsreturncCs|dkr i}|||_dSN)_get_default_optionsr)selfrr//tmp/pip-unpacked-wheel-z041_nl0/jwt/api_jwt.py__init__szPyJWT.__init__zdict[str, bool | list[str]])rcCsddddddgdS)NT)verify_signature verify_exp verify_nbf verify_iat verify_aud verify_issrequirerrrrrr szPyJWT._get_default_optionsHS256Tzdict[str, Any]z AllowedPrivateKeys | str | bytesz str | Noneztype[json.JSONEncoder] | Noneboolstr)payloadkey algorithmheaders json_encoder sort_headersrc Csnt|tstd|}dD](}t||trt||||<q|j|||d}t j ||||||dS)NzGExpecting a dict object, as JWT only supports JSON objects as payloads.)expiatnbf)r-r.)r/) isinstancedict TypeErrorcopygetrr utctimetuple_encode_payloadr encode) rr*r+r,r-r.r/Z time_claimZ json_payloadrrrr:,s* z PyJWT.encodebytes)r*r-r.rcCstj|d|ddS)z Encode a given payload to the bytes to be signed. This method is intended to be overridden by subclasses that need to encode the payload in a different way, e.g. compress the payload. ),:) separatorsclszutf-8)jsondumpsr:)rr*r-r.rrrr9Rs zPyJWT._encode_payloadrz str | byteszAllowedPublicKeys | str | byteszlist[str] | Nonez bool | Nonez bytes | Nonezstr | Iterable[str] | Nonezfloat | timedeltar ) jwtr+ algorithmsrverifydetached_payloadaudienceissuerleewaykwargsrc Ks| rtdt| tt|p&i}|dd|dk rX||dkrXtjdtd|ds|dd|dd|d d|d d|d d|dr|std t j |||||d } | | } |j |} |j | | ||| d| | d<| S)Nzypassing additional kwargs to decode_complete() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: r TzThe `verify` argument to `decode` does nothing in PyJWT 2.0 and newer. The equivalent is setting `verify_signature` to False in the `options` dictionary. This invocation has a mismatch between the kwarg and the option entry.)categoryr!Fr"r#r$r%z\It is required that you pass in a value for the "algorithms" argument when calling decode().)r+rDrrF)rGrHrIr*)warningswarntuplekeysrr4 setdefaultDeprecationWarningr r decode_complete_decode_payloadr_validate_claims)rrCr+rDrrErFrGrHrIrJdecodedr*Zmerged_optionsrrrrRdsP          zPyJWT.decode_complete)rUrc CsZzt|d}Wn0tk rB}ztd|W5d}~XYnXt|tsVtd|S)a Decode the payload from a JWS dictionary (payload, signature, header). This method is intended to be overridden by subclasses that need to decode the payload in a different way, e.g. decompress compressed payloads. r*zInvalid payload string: Nz-Invalid payload string: must be a json object)r@loads ValueErrorr r3r4)rrUr*errrrSs  zPyJWT._decode_payloadc KsB| rtdt| t|j||||||||| d } | dS)Nzppassing additional kwargs to decode() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: )rErFrGrHrIr*)rLrMrNrOrrR) rrCr+rDrrErFrGrHrIrJrUrrrdecodes" z PyJWT.decode)r*rrIrcCst|tr|}|dk r0t|ttfs0td|||tjt j d }d|krl|drl| |||d|kr|dr| |||d|kr|dr|||||d r||||d r|j|||d d d dS)Nz+audience must be a string, iterable or None)tzr1r#r2r"r0r!r%r$Z strict_audFstrict)r3r total_secondsr)rr5_validate_required_claimsrnowrutc timestamp _validate_iat _validate_nbf _validate_exp _validate_iss _validate_audr7)rr*rrGrHrIr_rrrrTs(    zPyJWT._validate_claims)r*rrcCs(|dD]}||dkrt|qdS)Nr&)r7r)rr*rZclaimrrrr^s zPyJWT._validate_required_claimsfloat)r*r_rIrcCsFzt|d}Wntk r,tdYnX|||krBtddS)Nr1z)Issued At claim (iat) must be an integer.z The token is not yet valid (iat))intrWrr)rr*r_rIr1rrrrb s  zPyJWT._validate_iatcCsFzt|d}Wntk r,tdYnX|||krBtddS)Nr2z*Not Before claim (nbf) must be an integer.z The token is not yet valid (nbf))rhrWr r)rr*r_rIr2rrrrcs  zPyJWT._validate_nbfcCsFzt|d}Wntk r,tdYnX|||krBtddS)Nr0z/Expiration Time claim (exp) must be an integer.zSignature has expired)rhrWr r )rr*r_rIr0rrrrd&s  zPyJWT._validate_expFr[)r*rGr\rcs|dkr$d|ks|dsdStdd|ks4|ds]sz&PyJWT._validate_aud..c3s|]}|kVqdSrr)rjriZaudience_claimsrrrlcszAudience doesn't match)rrr3r)listanyall)rr*rGr\rrmrrf4s2     zPyJWT._validate_aud)r*rHrcCs4|dkr dSd|krtd|d|kr0tddS)NZisszInvalid issuer)rr)rr*rHrrrrefs  zPyJWT._validate_iss)N)r'NNT)NN)rBNNNNNNr)rBNNNNNNr)NNr)__name__ __module__ __qualname__r staticmethodrr:r9rRrSrYrTr^rbrcrdrfrerrrrrsR)$E$*#  2r)! __future__rr@rLcalendarrcollections.abcrrrrtypingrr rBr exceptionsr r rrrrrrrDrrrZ_jwt_global_objr:rRrYrrrrs$    $ Y