
    qh                        S r SSKJr  SSKrSSKrSSKJr  SSKrSSKJ	r	  SSK
Jr  SSKJr  SSKJr  \(       a  SS	KJr   " S
 S\5      rg)a  
Sign In With Apple authentication backend.

Docs:
    * https://developer.apple.com/documentation/signinwithapplerestapi
    * https://developer.apple.com/documentation/signinwithapplerestapi/tokenresponse

Settings:
    * `TEAM` - your team id;
    * `KEY` - your key id;
    * `CLIENT` - your client id;
    * `AUDIENCE` - a list of authorized client IDs, defaults to [CLIENT].
                   Use this if you need to accept both service and bundle id to
                   be able to login both via iOS and ie a web form.
    * `SECRET` - your secret key;
    * `SCOPE` (optional) - e.g. `['name', 'email']`;
    * `EMAIL_AS_USERNAME` - use apple email is username is set, use apple id
                            otherwise.
    * `AppleIdAuth.TOKEN_TTL_SEC` - time before JWT token expiration, seconds.
    * `SOCIAL_AUTH_APPLE_ID_INACTIVE_USER_LOGIN` - allow inactive users email to
                                                   login
    )annotationsN)TYPE_CHECKING)RSAAlgorithm)
PyJWTError)
BaseOAuth2)
AuthFailed)JWKDictc                     ^  \ rS rSrSrSrSrSrSrSr	Sr
S	rS
rSrSrSrS rU 4S jrS rS rS rSSS jjrS rS rU 4S jrSrU =r$ )AppleIdAuth)   zapple-idz#https://appleid.apple.com/auth/keysz(https://appleid.apple.com/auth/authorizez$https://appleid.apple.com/auth/tokenNsubid_tokenTFz%20zhttps://appleid.apple.comi N c                F    U R                  S5      nU R                  SU/S9$ )NCLIENTAUDIENCE)defaultsetting)self	client_ids     L/var/www/html/env/lib/python3.13/site-packages/social_core/backends/apple.pyget_audienceAppleIdAuth.get_audience:   s%    LL*	||J|<<    c                   > [         TU ]  " U0 UD6nU R                  (       a  U R                  US'   U$ U R                  5       (       a  SUS'   U$ )zV
Apple requires to set `response_mode` to `form_post` if `scope`
parameter is passed.
response_mode	form_post)superauth_paramsRESPONSE_MODE	get_scope)r   argskwargsparams	__class__s       r   r   AppleIdAuth.auth_params>   sW    
 $d5f5&*&8&8F?#  ^^&1F?#r   c                $    U R                  S5      $ )zt
Return contents of the private key file. Override this method to provide
secret key from another source if needed.
SECRETr   )r   s    r   get_private_keyAppleIdAuth.get_private_keyJ   s    
 ||H%%r   c                h   [        [        R                  " 5       5      nU R                  R                  SU R	                  S5      5      nU R	                  S5      nU R	                  S5      nU R                  5       nSU0nUUXR                  -   U R                  US.n[        R                  " XuSUS9$ )	Nr   r   TEAMKEYkid)issiatexpaudr   ES256)key	algorithmheaders)
inttimedatagetr   r)   TOKEN_TTL_SECTOKEN_AUDIENCEjwtencode)r   nowr   team_idkey_idprivate_keyr6   payloads           r   generate_client_secret"AppleIdAuth.generate_client_secretQ   s    $))+IIMM+t||H/EF	,,v&e$**,&/+++&&
 zz'gwWWr   c                ~    U R                   R                  SU R                  S5      5      nU R                  5       nX4$ )Nr   r   )r9   r:   r   rD   )r   r   client_secrets      r   get_key_and_secretAppleIdAuth.get_key_and_secretc   s6    IIMM+t||H/EF	335''r   c                  ^ U R                  U R                  S9R                  S5      n[        U[        5      (       a  U(       d  [        U S5      eT(       a)  [        R                  " [        U4S jU 5       5      5      $ S U 5       $ )z5
Return requested Apple public key or all available.
)urlkeyszInvalid jwk responsec              3  <   >#    U  H  oS    T:X  d  M  Uv   M     g7f)r.   N ).0r4   r.   s     r   	<genexpr>,AppleIdAuth.get_apple_jwk.<locals>.<genexpr>r   s     "L$3e*:K33$s   	c              3  N   #    U  H  n[         R                  " U5      v   M     g 7fN)jsondumps)rO   r4   s     r   rP   rQ   u   s     04C

34s   #%)	get_jsonJWK_URLr:   
isinstancelistr   rT   rU   next)r   r.   rL   s    ` r   get_apple_jwkAppleIdAuth.get_apple_jwkh   sk     }}}.226:$%%TT#9::::d"L$"LLMM 1400r   c                P   U(       d  [        U S5      e [        R                  " U5      R                  S5      n[        R
                  " U R                  U5      5      n[        R                  " UUU R                  5       S/S9nU$ ! [         a  n[        U SU 35      eSnAff = f)zR
Decode and validate JWT token from apple and return payload including
user data.
Missing id_token parameterr.   RS256)r4   audience
algorithmszToken validation failed by N)
r   r=   get_unverified_headerr:   r   from_jwkr[   decoder   r   )r   r   r.   
public_keydecodederrors         r   decode_id_tokenAppleIdAuth.decode_id_tokenw   s    
 T#?@@	J++H599%@C%..t/A/A#/FGJjj**,#9	G   	JT%@#HII	Js   A0B 
B%B  B%c                   [         R                  " U R                  R                  SS5      5      R                  S0 5      nU R	                  SUR                  SS5      UR                  SS5      S9u  p4nUR                  SS5      nUR                  U R
                  S5      nU=(       d    S U=(       d    S U=(       d    S US	.nU(       a  U R                  S
5      (       a  XhS'   U(       a  U R                  S
5      (       d  XxS'   U$ )Nuserz{}name 	firstNamelastName)fullname
first_name	last_nameemail)rp   rq   rr   rs   EMAIL_AS_USERNAMEusername)rT   loadsr9   r:   get_user_namesID_KEYr   )	r   responserl   rp   rq   rr   rs   apple_iduser_detailss	            r   get_user_detailsAppleIdAuth.get_user_details   s    zz$))--56::62F*.*=*=xxR0hhz2. +> +
'i Wb)<<R0 !(D$,"*d	
 T\\"566',$DLL)<=='/$r   c                   > UR                  SS 5      =(       d    0 nUR                  U R                  5      =(       d    UnU(       d  [        U S5      eU R	                  U5      n[
        TU ]  " U/UQ7SU0UD6$ )Nry   r^   )popr:   	TOKEN_KEYr   rh   r   do_auth)r   access_tokenr"   r#   ry   
jwt_stringdecoded_datar%   s          r   r   AppleIdAuth.do_auth   sn    ::j$/52\\$..1A\
T#?@@++J7w|TTTlTVTTr   rN   rS   )returnzstr | JWKDict)__name__
__module____qualname____firstlineno__rl   rW   AUTHORIZATION_URLACCESS_TOKEN_URLr    rx   r   STATE_PARAMETERREDIRECT_STATESCOPE_SEPARATORr<   r;   r   r   r)   rD   rH   r[   rh   r|   r   __static_attributes____classcell__)r%   s   @r   r   r   )   sv    D3GB=MFIONO0N)M=
&X$(
1.0U Ur   r   )__doc__
__future__r   rT   r8   typingr   r=   jwt.algorithmsr   jwt.exceptionsr   social_core.backends.oauthr   social_core.exceptionsr   	jwt.typesr	   r   rN   r   r   <module>r      s=   . #     
 ' % 1 -!EU* EUr   