
    qh%                         S r / SQrSSKJr  SSKrSrSrSrSr\R                  " S	5      r
 " S
 S\5      r\\l         " S S\5      r\\l        g)zAn implementation of the OpenID Provider Authentication Policy
Extension 1.0

@see: http://openid.net/developers/specs/

@since: 2.1.0
)RequestResponsens_uriAUTH_PHISHING_RESISTANTAUTH_MULTI_FACTORAUTH_MULTI_FACTOR_PHYSICAL    )	ExtensionNz+http://specs.openid.net/extensions/pape/1.0zEhttp://schemas.openid.net/pape/policies/2007/06/multi-factor-physicalz<http://schemas.openid.net/pape/policies/2007/06/multi-factorzBhttp://schemas.openid.net/pape/policies/2007/06/phishing-resistantz$^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$c                   h   ^  \ rS rSrSrSrSU 4S jjrS rS rS r	S r
\" \
5      r
S	 rS
 rSrU =r$ )r   !   a  A Provider Authentication Policy request, sent from a relying
party to a provider

@ivar preferred_auth_policies: The authentication policies that
    the relying party prefers
@type preferred_auth_policies: [str]

@ivar max_auth_age: The maximum time, in seconds, that the relying
    party wants to allow to have elapsed before the user must
    re-authenticate
@type max_auth_age: int or NoneType
papec                 T   > [         [        U ]  5         U(       d  / nXl        X l        g N)superr   __init__preferred_auth_policiesmax_auth_age)selfr   r   	__class__s      O/var/www/html/env/lib/python3.13/site-packages/openid/extensions/draft/pape2.pyr   Request.__init__1   s%    gt%'&&(#'>$(    c                 V    [        U R                  =(       d    U R                  S L5      $ r   )boolr   r   )r   s    r   __bool__Request.__bool__9   s*    D00 2%%T13 	3r   c                 Z    XR                   ;  a  U R                   R                  U5        gg)ae  Add an acceptable authentication policy URI to this request

This method is intended to be used by the relying party to add
acceptable authentication types to the request.

@param policy_uri: The identifier for the preferred type of
    authentication.
@see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html#auth_policies
N)r   appendr   
policy_uris     r   addPolicyURIRequest.addPolicyURI=   s)     999((//
; :r   c                     SSR                  U R                  5      0nU R                  b  [        U R                  5      US'   U$ )/@see: C{L{Extension.getExtensionArgs}}
        r    r   )joinr   r   strr   ns_argss     r   getExtensionArgsRequest.getExtensionArgsJ   sG     &sxx0L0L'M
 (&)$*;*;&<GN#r   c                     U " 5       nUR                   R                  UR                  5      nU0 :X  a  gUR                  U5        U$ )zQInstantiate a Request object from the arguments in a
C{checkid_*} OpenID message
N)messagegetArgsr   parseExtensionArgs)clsrequestr   argss       r   fromOpenIDRequestRequest.fromOpenIDRequestV   s@     u&&t{{32:%r   c                    / U l         UR                  S5      nU(       ac  [        U[        5      (       a
  [	        USS9nUR                  S5       H/  nX0R                   ;  d  M  U R                   R                  U5        M1     UR                  S5      nSU l        U(       a   [        U5      U l        gg! [         a     gf = f)zSet the state of this request to be that expressed in these
PAPE arguments

@param args: The PAPE arguments without a namespace

@rtype: None

@raises ValueError: When the max_auth_age is not parseable as
    an integer
r   zutf-8)encodingr$   r   N)
r   get
isinstancebytesr&   splitr   r   int
ValueError)r   r1   policies_strurimax_auth_age_strs        r   r.   Request.parseExtensionArgse   s     (*$xx 9:,.."<'B#))#.:::0077< /
  88N3 $'(8$9!   s   #B5 5
CCc                 T    [        [        U R                  R                  U5      5      $ )aG  Given a list of authentication policy URIs that a provider
supports, this method returns the subsequence of those types
that are preferred by the relying party.

@param supported_types: A sequence of authentication policy
    type URIs that are supported by a provider

@returns: The sub-sequence of the supported types that are
    preferred by the relying party. This list will be ordered
    in the order that the types appear in the supported_types
    sequence, and may be empty if the provider does not prefer
    any of the supported authentication types.

@returntype: [str]
)listfilterr   __contains__)r   supported_typess     r   preferredTypesRequest.preferredTypes   s)      4//<<oNP 	Pr   )r   r   )NN)__name__
__module____qualname____firstlineno____doc__ns_aliasr   r   r    r)   r2   classmethodr.   rE   __static_attributes____classcell__r   s   @r   r   r   !   sH     H)3<
 $$56BP Pr   r   c                   f   ^  \ rS rSrSrSr   S
U 4S jjrS rS rSS jr	\
" \5      rS rS	rU =r$ )r      zSA Provider Authentication Policy response, sent from a provider
to a relying party
r   c                 l   > [         [        U ]  5         U(       a  Xl        O/ U l        X l        X0l        g r   )r   r   r   auth_policies	auth_timenist_auth_level)r   rT   rU   rV   r   s       r   r   Response.__init__   s.     	h&(!.!#D".r   c                 Z    XR                   ;  a  U R                   R                  U5        gg)ag  Add a authentication policy to this response

This method is intended to be used by the provider to add a
policy that the provider conformed to when authenticating the user.

@param policy_uri: The identifier for the preferred type of
    authentication.
@see: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0-01.html#auth_policies
N)rT   r   r   s     r   r    Response.addPolicyURI   s)     ///%%j1 0r   c                 t    U " 5       nUR                  UR                  5      nUb  UR                  U5        U$ g)a  Create a C{L{Response}} object from a successful OpenID
library response
(C{L{openid.consumer.consumer.SuccessResponse}}) response
message

@param success_response: A SuccessResponse from consumer.complete()
@type success_response: C{L{openid.consumer.consumer.SuccessResponse}}

@rtype: Response or None
@returns: A provider authentication policy response from the
    data that was supplied with the C{id_res} response or None
    if the provider sent no signed PAPE response arguments.
N)getSignedNSr   r.   )r/   success_responser   r1   s       r   fromSuccessResponseResponse.fromSuccessResponse   s?     u  ++DKK8 ##D)Kr   c                    UR                  S5      nU(       a  US:w  a  UR                  S5      U l        UR                  S5      nU(       a"   [        U5      nSUs=::  a  S:  a	  O  OXPl        UR                  S	5      nU(       a4  [        R                  U5      (       a  X`l        gU(       a  [        S
5      egg! [
         a    U(       a  [        S5      eSU l         Nrf = f)aA  Parse the provider authentication policy arguments into the
internal state of this object

@param args: unqualified provider authentication policy
    arguments

@param strict: Whether to raise an exception when bad data is
    encountered

@returns: None. The data is parsed into the internal fields of
    this object.
rT   noner$   rV   r      Cnist_auth_level must be an integer between zero and four, inclusiveNrU   #auth_time must be in RFC3339 format)	r6   r9   rT   r:   rV   r;   TIME_VALIDATORmatchrU   )r   r1   strictr<   nist_level_str
nist_levelrU   s          r   r.   Response.parseExtensionArgs   s     xx0LF2!-!3!3C!8D"346 0
 
&Q&+5(HH[)	##I..!* !FGG    0$34 4 ,0D(0s   B< <#C"!C"c                    [        U R                  5      S:X  a  SS0nOSSR                  U R                  5      0nU R                  bF  U R                  [	        [        SS5      5      ;  a  [        S5      e[        U R                  5      US'   U R                  b>  [        R                  U R                  5      (       d  [        S5      eU R                  US	'   U$ )
r#   r   rT   r`   r$   ra   rb   rV   rc   rU   )lenrT   r%   rV   rA   ranger;   r&   rU   rd   re   r'   s     r   r)   Response.getExtensionArgs  s     t!!"a'G
  $*<*<!=G +##4a+<<  "< = =),T-A-A)BG%&>>%!''77 !FGG#'>>GK r   )rT   rU   rV   )NNN)F)rG   rH   rI   rJ   rK   rL   r   r    r]   r.   rM   r)   rN   rO   rP   s   @r   r   r      sH     H  $!%/26%HN &&9: r   r   )rK   __all__openid.extensionr	   rer   r   r   r   compilerd   r   r    r   r   <module>rs      s    ' 		6 L  C  I  BCvPi vPr }y }@ r   