o
                         @   s   d Z ddlmZ ddlmZ ddlmZ ddlZddlZddlZddlm	Z
 ddlmZ ddlmZ dd	lmZ ddlm	Z	 dd
lmZ ddlmZ ddlmZ dZddiZdZG dd de	jZG dd deZG dd deZG dd dejZdd ZdS )z+Provides utilities for token introspection.    )absolute_import)division)unicode_literalsN)
exceptions)external_account)utils)config)
properties)http_client)urllibz-urn:ietf:params:oauth:token-type:access_tokenzContent-Typez!application/x-www-form-urlencodedz(https://sts.googleapis.com/v1/introspectc                   @      e Zd ZdZdS )Errorz!A base exception for this module.N__name__
__module____qualname____doc__ r   r   G/tmp/google-cloud-sdk/lib/googlecloudsdk/core/credentials/introspect.pyr   *       r   c                   @   r   )InactiveCredentialsErrorz<Raised when the provided credentials are invalid or expired.Nr   r   r   r   r   r   .   r   r   c                   @   r   )TokenIntrospectionErrorzFRaised when an error is encountered while calling token introspection.Nr   r   r   r   r   r   2   r   r   c                       s.   e Zd ZdZd fdd	ZefddZ  ZS )IntrospectionClienta  Implements the OAuth 2.0 token introspection spec.

  This is based on https://tools.ietf.org/html/rfc7662.
  The implementation supports 3 types of client authentication when calling
  the endpoints: no authentication, basic header authentication and POST body
  authentication.
  Nc                    s   t t| | || _dS )a"  Initializes an OAuth introspection client instance.

    Args:
      token_introspect_endpoint (str): The token introspection endpoint.
      client_authentication (Optional[oauth2_utils.ClientAuthentication]): The
        optional OAuth client authentication credentials if available.
    N)superr   __init___token_introspect_endpoint)selftoken_introspect_endpointclient_authentication	__class__r   r   r   ?   s   
zIntrospectionClient.__init__c           	      C   s   t  }||d}| || || jd|tj|dd}t|j	dr+|j	
dn|j	}|jtjkr8t|t|}|drD|S t|)a  Returns the meta-information associated with an OAuth token.

    Args:
      request (google.auth.transport.Request): A callable that makes HTTP
        requests.
      token (str): The OAuth token whose meta-information are to be returned.
      token_type_hint (Optional[str]): The optional token type. The default is
        access_token.

    Returns:
      Mapping: The active token meta-information returned by the introspection
        endpoint.

    Raises:
      InactiveCredentialsError: If the credentials are invalid or expired.
      TokenIntrospectionError: If an error is encountered while calling the
        token introspection endpoint.
    )tokentoken_type_hintPOSTzutf-8)urlmethodheadersbodydecodeactive)_URLENCODED_HEADERScopy#apply_client_authentication_optionsr   r   parse	urlencodeencodehasattrdatar(   statusr
   OKr   jsonloadsgetr   )	r   requestr!   r"   r&   request_bodyresponseresponse_bodyresponse_datar   r   r   
introspectJ   s*   
	

zIntrospectionClient.introspect)N)r   r   r   r   r   _ACCESS_TOKEN_TYPEr<   __classcell__r   r   r   r   r   6   s    r   c                 C   s  ddl m} ttjjtjtj}t	}t
jjj }| j}|s!|r%|p$|}t||d}| }t| tjrut| drutt| dru|  ruz|  \}}	tj|||	fd}W n tttjt t!fyt }
 zt"#d|
 W Y d}
~
nd}
~
ww | j$s}| %| |&|| j'}|(dS )	a  Returns the external account credentials' identifier.

  This requires basic client authentication and only works with external
  account credentials that have not been impersonated. The returned username
  field is used for the account ID.

  Args:
    creds (google.auth.external_account.Credentials): The external account
      credentials whose account ID is to be determined.

  Returns:
    Optional(str): The account ID string if determinable.

  Raises:
    InactiveCredentialsError: If the credentials are invalid or expired.
    TokenIntrospectionError: If an error is encountered while calling the
      token introspection endpoint.
  r   )requests)r   r   _mtls_required)certz0Could not get mTLS certificate and key paths: %sNusername))googlecloudsdk.corer?   oauth2_utilsClientAuthenticationClientAuthTypebasicr   CLOUDSDK_CLIENT_IDCLOUDSDK_CLIENT_NOTSOSECRET(_EXTERNAL_ACCT_TOKEN_INTROSPECT_ENDPOINTr	   VALUESauthtoken_introspection_endpointGettoken_info_urlr   GoogleAuthRequest
isinstancer   Credentialsr0   callablegetattrr@   _get_mtls_cert_and_key_paths	functoolspartialAttributeError
ValueErrorgoogle_auth_exceptionsGoogleAuthErrorIOErrorOSErrorloggingdebugvalidrefreshr<   r!   r6   )credscore_requestsr   rM   endpoint_overrideproperty_overrideoauth_introspectionr7   	cert_pathkey_pathe
token_infor   r   r   GetExternalAccountId   sT   	
	

rk   )r   
__future__r   r   r   rV   r4   r^   google.authr   rZ   r   google.oauth2r   rD   rC   r   r	   	six.movesr
   r   r=   r*   rJ   r   r   r   OAuthClientAuthHandlerr   rk   r   r   r   r   <module>   s0   I