qh~G&SrSSKrSSKrSSKJr SSKJr SSKJr SSKJr /SQr SS /r \ "\S 5(a\ "\ 5r /S QrS S /rO S/r S S/rS /rSrSr"SS\5r\"\5r\"\5rSr\R."SS\55rg)a This module contains code for dealing with associations between consumers and servers. Associations contain a shared secret that is used to sign C{openid.mode=id_res} messages. Users of the library should not usually need to interact directly with associations. The L{store}, L{server} and L{consumer} objects will create and manage the associations. The consumer and server code will make use of a C{L{SessionNegotiator}} when managing associations, which enables users to express a preference for what kind of associations should be allowed, and what kind of exchange should be done to establish the association. @var default_negotiator: A C{L{SessionNegotiator}} that allows all association types that are specified by the OpenID specification. It prefers to use HMAC-SHA1/DH-SHA1, if it's available. If HMAC-SHA256 is not supported by your Python runtime, HMAC-SHA256 and DH-SHA256 will not be available. @var encrypted_negotiator: A C{L{SessionNegotiator}} that does not support C{'no-encryption'} associations. It prefers HMAC-SHA1/DH-SHA1 association types if available. N) cryptutil)kvform)oidutil) OPENID_NS)default_negotiatorencrypted_negotiatorSessionNegotiator Association HMAC-SHA1 HMAC-SHA256 hmacSha256)r DH-SHA1r no-encryptionr DH-SHA256)r rrrrc8SS/SS/S.nURU/5$)z=Return the allowed session types for a given association typerrrr r )get) assoc_typeassoc_to_sessions D/var/www/html/env/lib/python3.13/site-packages/openid/association.pygetSessionTypesrJs1 1#_5    B //cHU[U5;a[SU<SU<35eg)zLCheck to make sure that this pair of assoc type and session type are allowedz Session type z not valid for assocation type N)r ValueError)r session_types rcheckSessionTyperSs-?:66& 45 57rc@\rSrSrSrSrSrSrS SjrSr S r S r g) r [aA session negotiator controls the allowed and preferred association types and association session types. Both the C{L{Consumer}} and C{L{Server}} use negotiators when creating associations. You can create and use negotiators if you: - Do not want to do Diffie-Hellman key exchange because you use transport-layer encryption (e.g. SSL) - Want to use only SHA-256 associations - Do not want to support plain-text associations over a non-secure channel It is up to you to set a policy for what kinds of associations to accept. By default, the library will make any kind of association that is allowed in the OpenID 2.0 specification. Use of negotiators in the library ================================= When a consumer makes an association request, it calls C{L{getAllowedType}} to get the preferred association type and association session type. The server gets a request for a particular association/session type and calls C{L{isAllowed}} to determine if it should create an association. If it is supported, negotiation is complete. If it is not, the server calls C{L{getAllowedType}} to get an allowed association type to return to the consumer. If the consumer gets an error response indicating that the requested association/session type is not supported by the server that contains an assocation/session type to try, it calls C{L{isAllowed}} to determine if it should try again with the given combination of association/session type. @ivar allowed_types: A list of association/session types that are allowed by the server. The order of the pairs in this list determines preference. If an association/session type comes earlier in the list, the library is more likely to use that type. @type allowed_types: [(str, str)] c&URU5 gN)setAllowedTypes)self allowed_typess r__init__SessionNegotiator.__init__s ]+rcJUR[UR55$r#) __class__listr&r%s rcopySessionNegotiator.copys~~d4#5#5677rc<UHup#[X#5 M Xlg)zSSet the allowed association types, checking to make sure each combination is valid.N)rr&)r%r&rrs rr$!SessionNegotiator.setAllowedTypess!+8 &Z Z 6+8+rNc URc/UlUcE[U5nU(d[SU<35e[U5HnURX5 M g[ X5 URR X45 g)zAdd an association type and session type to the allowed types list. The assocation/session pairs are tried in the order that they are added.Nz*No session available for association type )r&rraddAllowedTyperappend)r%rr availables rr2 SessionNegotiator.addAllowedTypes    %!#D   ' 3I $."233!0 ; ##J=!< Z 6    % %z&@ ArcTX4UR;nU[U5;nU=(a U$)zAIs this combination of association type and session type allowed?)r&r)r%rr assoc_goodmatchess r isAllowedSessionNegotiator.isAlloweds/ /43E3EE /*"==%g%rcBURS$![a gf=f)zAGet a pair of assocation type and session type that are supportedr)NN)r& IndexErrorr,s rgetAllowedType SessionNegotiator.getAllowedTypes* %%a( (  s  )r&r#) __name__ __module__ __qualname____firstlineno____doc__r'r-r$r2r9r=__static_attributes__rrr r [s'-^,8+B(&  rr c<US:XagUS:Xag[SU<35e)Nr r zUnsupported association type: )r)rs r getSecretSizerIs&[  } $zLMMrc\rSrSrSr/SQr\R\RS.r \ S5r Sr \ SSj5rS rS rS rS r\ S 5rSrSrSrSrSrSrSrg)r a This class represents an association between a server and a consumer. In general, users of this library will never see instances of this object. The only exception is if you implement a custom C{L{OpenIDStore}}. If you do implement such a store, it will need to store the values of the C{L{handle}}, C{L{secret}}, C{L{issued}}, C{L{lifetime}}, and C{L{assoc_type}} instance variables. @ivar handle: This is the handle the server gave this association. @type handle: C{str} @ivar secret: This is the shared secret the server generated for this association. @type secret: C{str} @ivar issued: This is the time this association was issued, in seconds since 00:00 GMT, January 1, 1970. (ie, a unix timestamp) @type issued: C{int} @ivar lifetime: This is the amount of time this association is good for, measured in seconds since the association was issued. @type lifetime: C{int} @ivar assoc_type: This is the type of association this instance represents. The only valid value of this field at this time is C{'HMAC-SHA1'}, but new types may be defined in the future. @type assoc_type: C{str} @sort: __init__, fromExpiresIn, expiresIn, __eq__, __ne__, handle, secret, issued, lifetime, assoc_type versionhandlesecretissuedlifetimerrcV[[R"55nUnU"X#XVU5$)a! This is an alternate constructor used by the OpenID consumer library to create associations. C{L{OpenIDStore }} implementations shouldn't use this constructor. @param expires_in: This is the amount of time this association is good for, measured in seconds since the association was issued. @type expires_in: C{int} @param handle: This is the handle the server gave this association. @type handle: C{str} @param secret: This is the shared secret the server generated for this association. @type secret: C{str} @param assoc_type: This is the type of association this instance represents. The only valid value of this field at this time is C{'HMAC-SHA1'}, but new types may be defined in the future. @type assoc_type: C{str} )inttime)cls expires_inrNrOrrPrQs r fromExpiresInAssociation.fromExpiresIns)FTYY[!66Z@@rcU[;aSn[Xe4-5eXl[U[5(aUR S5nX lX0lX@lXPl g)a8 This is the standard constructor for creating an association. @param handle: This is the handle the server gave this association. @type handle: C{str} @param secret: This is the shared secret the server generated for this association. @type secret: C{str} @param issued: This is the time this association was issued, in seconds since 00:00 GMT, January 1, 1970. (ie, a unix timestamp) @type issued: C{int} @param lifetime: This is the amount of time this association is good for, measured in seconds since the association was issued. @type lifetime: C{int} @param assoc_type: This is the type of association this instance represents. The only valid value of this field at this time is C{'HMAC-SHA1'}, but new types may be defined in the future. @type assoc_type: C{str} z&%r is not a supported association typeutf-8N) all_association_typesrrN isinstancestrencoderOrPrQr)r%rNrOrPrQrfmts rr'Association.__init__/sYL 2 2:CS>12 2 fc " "]]7+F   $rNcUc[[R"55n[SURUR-U- 5$)a This returns the number of seconds this association is still valid for, or C{0} if the association is no longer valid. @return: The number of seconds this association is still valid for, or C{0} if the association is no longer valid. @rtype: C{int} r)rSrTmaxrPrQ)r%nows r expiresInAssociation.expiresInhs8 ;diik"C1dkkDMM1C788rc4URUR:$)z Compare two C{L{Association}} instances to determine relative ordering. Currently compares object lifetimes -- C{L{Association}} A < B if A.lifetime < B.lifetime. )rQr%others r__lt__Association.__lt__ys}}u~~--rcn[U5[U5L=(a URUR:H$)z This checks to see if two C{L{Association}} instances represent the same association. @return: C{True} if the two instances represent the same association, C{False} otherwise. @rtype: C{bool} )type__dict__rgs r__eq__Association.__eq__s)DzT%[(LT]]enn-LLrc X:X+$)z This checks to see if two C{L{Association}} instances represent different associations. @return: C{True} if the two instances represent different associations, C{False} otherwise. @rtype: C{bool} rErgs r__ne__Association.__ne__s ""rc SUR[R"UR5[ [ UR 55[ [ UR55URS.n[U5[UR5:Xde/nURHnURX1U45 M [R"USS9$)z~ Convert an association to KV form. @return: String in KV form suitable for deserialization by deserialize. @rtype: str 2rLTstrict)rNrtoBase64rOr]rSrPrQrlen assoc_keysr3rseqToKV)r%datapairs field_names r serializeAssociation.serializeskk&&t{{3#dkk*+C .///  4yC0000//J LL*:&67 8*~~eD11rcd[R"USS9n/n/nUH'upVURU5 URU5 M) X0R:wa [ SU5eUupxppUS:wa[ SU-5e[ U 5n [ U 5n [ R"U 5n U"XXU 5$)z Parse an association as stored by serialize(). inverse of serialize @param assoc_s: Association as serialized by serialize() @type assoc_s: bytes @return: instance of this class TruzUnexpected key values: %rrtzUnknown version: %r)rkvToSeqr3ryrrSr fromBase64) rUassoc_sr|keysvalueskvrMrNrOrPrQrs r deserializeAssociation.deserializeswt4DA KKN MM!  >> !8$? ?@F= c>2W<= =Vx=##F+66Z@@rc[R"U5nURURnU"UR U5$![a [ SUR<35ef=f)z Generate a signature for a sequence of (key, value) pairs @param pairs: The pairs to sign, in order @type pairs: sequence of (str, str) @return: The binary signature of this sequence of pairs @rtype: bytes zUnknown association type: )rrz_macsrKeyErrorrrO)r%r|kvmacs rsignAssociation.signsf^^E " 2**T__-C 4;;##  2"oo12 2 2s A$A(cnURU5n[R"URU55$)aReturn the signature of a message. If I am not a sign-all association, the message must have a signed list. @return: the signature, base64 encoded @rtype: bytes @raises ValueError: If there is no signed list and I am not a sign-all type of association. ) _makePairsrrwr)r%messager|s rgetMessageSignatureAssociation.getMessageSignatures,( % 011rcUR[S5(dUR[S5(a [S5eUR[S5nU(aX R:wa [S5eUR 5nUR [SUR5 [UR5R55nUVs/sHoURS5(dMUSSPM! nnURS5 UR5 UR [SS RU55 URU5nUR [SU5 U$s snf) zAdd a signature (and a signed list) to a message. @return: a new Message object with a signature @rtype: L{openid.message.Message} sigsignedz,Message already has signed list or signature assoc_handlez*Message has a different association handleopenid.N,)hasKeyrrgetArgrNr-setArgr+ toPostArgsr startswithr3sortjoinr)r%r extant_handlesigned_message message_keysr signed_listrs r signMessageAssociation.signMessages NN9e , ,y(33KL Ly.A ]kk9IJ J iEN557<<>? &2Nlll96Muqul N8$i388K3HI&&~6i4 Os E.2 E.cUR[S5nU(d[U<S35eURU5nUR S5n[ R "X25$)zGiven a message with a signature, calculate a new signature and return whether it matches the signature in the message. @raises ValueError: if the message has no signature or no signature can be calculated for it. rz has no sig.rZ)rrrrdecoderconst_eq)r%r message_sigcalculated_sigs rcheckMessageSignature!Association.checkMessageSignaturesVnnY6 ;< <11':'..w7!!.>>rcUR[S5nU(d[SU<35eURS5n/nUR 5nUH(nUR XeR SU-S545 M* U$)NrzMessage has no signed list: rr)rrrsplitrr3r)r%rrrr|r{fields rrAssociation._makePairs#sr 84KL Lll3' !!# E LL%)e*;R!@A B! rc SURR<SURR<SUR<SUR<S3 $)N<. >)r*r@r?rrNr,s r__repr__Association.__repr__/s3"&..";";"&.."9"94??"&++/ /r)rrNrPrQrOr#)r?r@rArBrCryrhmacSha1r r classmethodrWr'propertyrdrirnrqr~rrrrrrrrDrErrr r s,^J'' ++ E $A$AL7%r99 . M #24AA:$,2 2 ? /rr )rCrT functoolsopenidrrropenid.messager__all__r[hasattrr+supported_association_typesdefault_association_order only_encrypted_association_orderrrobjectr rrrItotal_orderingr rErrrs0 $   9l##"&'<"=! !$($ $/- !&! !($ 05^ ^ B''@A()IJN h/&h/h/r