
    qhl+                         S r SSKrSSKrSSKrSSKJr  SSKJr  SSKJ	r	  SSK
JrJr  SSKJr   " S	 S
\5      r       SS jrS rSS jrSS jrSS jrS rS r " S S5      r " S S\5      rg)z
oauthlib.oauth2.rfc6749.tokens
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module contains methods for adding two types of access tokens to requests.

- Bearer https://tools.ietf.org/html/rfc6750
- MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
    N)
b2a_base64)urlparse)common)add_params_to_qsadd_params_to_uri   )utilsc                      ^  \ rS rSrSU 4S jjr\S 5       r\S 5       r\S 5       r\S 5       r	\S 5       r
\S 5       r\S	 5       rS
rU =r$ )OAuth2Token   c                 P  > [         TU ]  U5        S U l        SU;   a1  US   (       a'  [        [        R
                  " US   5      5      U l        UbD  [        [        R
                  " U5      5      U l        U R                  c  U R                  U l        g g U R                  U l        g )Nscope)super__init__
_new_scopesetr	   scope_to_list
_old_scope)selfparams	old_scope	__class__s      P/var/www/html/env/lib/python3.13/site-packages/oauthlib/oauth2/rfc6749/tokens.pyr   OAuth2Token.__init__   s     f!%"5"5fWo"FGDO !%"5"5i"@ADO& #'// '
 #ooDO    c                 4    U R                   U R                  :g  $ Nr   r   r   s    r   scope_changedOAuth2Token.scope_changed&   s    $//11r   c                 B    [         R                  " U R                  5      $ r   )r	   list_to_scoper   r   s    r   r   OAuth2Token.old_scope*       ""4??33r   c                 ,    [        U R                  5      $ r   )listr   r   s    r   
old_scopesOAuth2Token.old_scopes.       DOO$$r   c                 B    [         R                  " U R                  5      $ r   )r	   r#   r   r   s    r   r   OAuth2Token.scope2   r%   r   c                 ,    [        U R                  5      $ r   )r'   r   r   s    r   scopesOAuth2Token.scopes6   r*   r   c                 F    [        U R                  U R                  -
  5      $ r   )r'   r   r   r   s    r   missing_scopesOAuth2Token.missing_scopes:       DOOdoo566r   c                 F    [        U R                  U R                  -
  5      $ r   )r'   r   r   r   s    r   additional_scopesOAuth2Token.additional_scopes>   r3   r   r   r   )__name__
__module____qualname____firstlineno__r   propertyr    r   r(   r   r.   r1   r5   __static_attributes____classcell__)r   s   @r   r   r      s    . 2 2 4 4 % % 4 4 % % 7 7 7 7r   r   c                    UR                  5       n[        R                  " U5      u  pUR                  5       S:X  a  [        R
                  nO0UR                  5       S:X  a  [        R                  nO[        S5      eU
S:X  aC  U=(       d9    SR                  [        R                  " U	5      [        R                  " 5       5      nO*[        R                  " 5       n[        R                  " 5       n[        U5      u  nnnnnnU(       a	  US-   U-   nOUnUbI  U
S:X  aC  UR                  S5      n[        U" U5      R!                  5       5      SS	 R#                  S5      nOS
n/ nU
S:X  a  UR%                  U5        O"UR%                  W5        UR%                  U5        UR%                  UR                  5       5        UR%                  U5        UR%                  U5        UR%                  U5        U
S:X  a  UR%                  U5        UR%                  U=(       d    S
5        SR'                  U5      S-   n[)        U[*        5      (       a  UR                  S5      n[,        R.                  " UUR                  S5      U5      n[        UR!                  5       5      SS	 R#                  S5      n/ nUR%                  SU -  5        U
S:w  a  UR%                  SW-  5        UR%                  SU-  5        U(       a  UR%                  SU-  5        U(       a  UR%                  SU-  5        UR%                  SU-  5        U=(       d    0 nSR'                  U5      US'   U$ )a  Add an `MAC Access Authentication`_ signature to headers.

Unlike OAuth 1, this HMAC signature does not require inclusion of the
request payload/body, neither does it use a combination of client_secret
and token_secret but rather a mac_key provided together with the access
token.

Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
`extension algorithms`_ are not supported.

Example MAC Authorization header, linebreaks added for clarity

Authorization: MAC id="h480djs93hd8",
                   nonce="1336363200:dj83hs9s",
                   mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="

.. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
.. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1

:param token:
:param uri: Request URI.
:param key: MAC given provided by token endpoint.
:param http_method: HTTP Request method.
:param nonce:
:param headers: Request headers as a dictionary.
:param body:
:param ext:
:param hash_algorithm: HMAC algorithm provided by token endpoint.
:param issue_time: Time when the MAC credentials were issued (datetime).
:param draft: MAC authentication specification version.
:return: headers dictionary with the authorization field added.

hmac-sha-1zhmac-sha-256zunknown hash algorithmr   z{}:{}?Nzutf-8 
zMAC id="%s"zts="%s"z
nonce="%s"zbodyhash="%s"zext="%s"zmac="%s"z, Authorization)upperr	   host_from_urilowerhashlibsha1sha256
ValueErrorformatgenerate_ager   generate_noncegenerate_timestampr   encoder   digestdecodeappendjoin
isinstancestrhmacnew)tokenurikeyhttp_methodnonceheadersbodyexthash_algorithm
issue_timedrafthostporthtsschnetpathparqueryfrarequest_uribodyhashbasebase_stringsignheaders                              r   prepare_mac_headerrt   C   s   P ##%K$$S)JD-LL				>	1NN122z C(:(::(F*0*?*?*AC &&(%%'&.sm#CdCSj5( EQJ{{7#agnn./4;;GD DzEBEKK!!#$KKKKKKzHKK	r))D/D(K #sjj!88C++G4a8Ddkkm$Sb)009DF
MM-%'(zi"n%
MM,&'o01
j3&'
MM*t#$mG#yy0GONr   c                      [        USU 4/5      $ )a  Add a `Bearer Token`_ to the request URI.
Not recommended, use only if client can't use authorization header or body.

http://www.example.com/path?access_token=h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param uri:
access_token)r   )rY   rZ   s     r   prepare_bearer_urirw      s     S^U$;"=>>r   c                 ,    U=(       d    0 nSU -  US'   U$ )zAdd a `Bearer Token`_ to the request URI.
Recommended method of passing bearer tokens.

Authorization: Bearer h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param headers:
z	Bearer %srD    )rY   r^   s     r   prepare_bearer_headersrz      s!     mG*U2GONr   c                      [        USU 4/5      $ )zAdd a `Bearer Token`_ to the request body.

access_token=h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param body:
rv   )r   )rY   r_   s     r   prepare_bearer_bodyr|      s     D^U$;"=>>r   c                 ,    [         R                  " 5       $ )z`
:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:
)r   generate_token)requestrefresh_tokens     r   random_token_generatorr      s       ""r   c                    ^ ^ UU 4S jnU$ )z
:param private_pem:
c                 @   > TU l         [        R                  " TU 5      $ r   )claimsr   generate_signed_token)r   kwargsprivate_pems    r   signed_token_generator6signed_token_generator.<locals>.signed_token_generator   s    ++KAAr   ry   )r   r   r   s   `` r   r   r      s    B "!r   c                     SnSU R                   ;   aV  U R                   R                  S5      R                  5       n[        U5      S:X  a  US   R	                  5       S:X  a  US   nU$ U R
                  nU$ )z
Helper function to extract a token from the request header.

:param request: OAuthlib request.
:type request: oauthlib.common.Request
:return: Return the token or None if the Authorization header is malformed.
NrD      r   bearerr   )r^   getsplitlenrG   rv   )r   rY   split_headers      r   get_token_from_headerr      su     E'//)**?;AAC|!l1o&;&;&=&I OE L $$Lr   c                   .    \ rS rSrSrSS jrS rS rSrg)	TokenBasei  ry   c                     [        S5      e)N&Subclasses must implement this method.NotImplementedError)r   r   r   s      r   __call__TokenBase.__call__  s    !"JKKr   c                     [        S5      eJ
:param request: OAuthlib request.
:type request: oauthlib.common.Request
r   r   r   r   s     r   validate_requestTokenBase.validate_request	      
 ""JKKr   c                     [        S5      er   r   r   s     r   estimate_typeTokenBase.estimate_type  r   r   NF)	r7   r8   r9   r:   	__slots__r   r   r   r<   ry   r   r   r   r     s    ILLLr   r   c                   <    \ rS rSrSr  S	S jrS
S jrS rS rSr	g)BearerTokeni  )request_validatortoken_generatorrefresh_token_generator
expires_inNc                     Xl         U=(       d    [        U l        U=(       d    U R                  U l        U=(       d    SU l        g )Ni  )r   r   r   r   r   )r   r   r   r   r   s        r   r   BearerToken.__init__  s:    !2.H2H#;t';'; 	$ %,r   c                 V   SU;   a  [         R                  " S[        5        [        U R                  5      (       a  U R	                  U5      nOU R                  nXAl        U R                  U5      USS.nUR                  b  SR                  UR                  5      US'   U(       aU  UR                  (       a0  U R                  R                  U5      (       d  UR                  US'   OU R                  U5      US'   UR                  UR                  =(       d    0 5        [        U5      $ )z
Create a BearerToken, by default without refresh token.

:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:

save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.Bearer)rv   r   
token_type r   r   )warningswarnDeprecationWarningcallabler   r   r.   rT   r   r   rotate_refresh_tokenr   updateextra_credentialsr   )r   r   r   r   r   rY   s         r   create_tokenBearerToken.create_token'  s     6!MM V,. DOO$$1JJ' !009$"
 >>% XXgnn5E'N%%..CCGLL)0)>)>o&)-)E)Eg)No&W..4"55!!r   c                 d    [        U5      nU R                  R                  X!R                  U5      $ )r   )r   r   validate_bearer_tokenr.   )r   r   rY   s      r   r   BearerToken.validate_requestQ  s0    
 &g.%%;;>>7, 	,r   c                     UR                   R                  SS5      R                  S5      S   R                  5       S:X  a  gUR                  b  gg)r   rD   rB   r   r   r   	      )r^   r   r   rG   rv   r   s     r   r   BearerToken.estimate_typeZ  sK    
 ??399#>qAGGIXU!!-r   )r   r   r   r   )NNNNr   )
r7   r8   r9   r:   r   r   r   r   r   r<   ry   r   r   r   r     s(    I
 @D:>-("T,
r   r   )NNNrB   r?   Nr   r   )rB   r   )__doc__rH   rW   r   binasciir   urllib.parser   oauthlibr   oauthlib.commonr   r   rB   r	   dictr   rt   rw   rz   r|   r   r   r   r   r   ry   r   r   <module>r      s        !  ? *7$ *7\ "# &2"&jZ? 
?#"(L L*L) Lr   