
                            S SK r S SKrS SKrS SKrS SKrS SKrS SKrS SKrS SKJ	r	  S SK
Jr  S SKJrJr  S SKJr  S SKJrJrJrJrJrJrJrJrJr  S SKJrJr  S SKJrJ r J!r!  S S	KJ"r"  \RF                  " \$5      r%S
r&Sr'Sr(Sr)/ SQr*Sr+Sr,S r-S r. " S S5      r/ " S S\/5      r0 " S S\/5      r1 " S S\/5      r2 " S S\/5      r3 " S S\35      r4 " S S \45      r5 " S! S"\55      r6 " S# S$\55      r7 " S% S&\35      r8 " S' S(\85      r9 " S) S*\35      r: " S+ S,\/5      r; " S- S.\;5      r< " S/ S0\;5      r= " S1 S2\05      r>\1\2\2\;\<\=\:\5\7\6\>S3.r?\(       a  S S4K@JArA  \?R                  \A5        g\?R                  \3\8\4\9S5.5        g)6    N)Mapping
formatdate)sha1sha256)
itemgetter)	HAS_CRTHTTPHeadersencodebytesensure_unicodeparse_qsquoteunquoteurlsplit
urlunsplit)NoAuthTokenErrorNoCredentialsError)is_valid_ipv6_endpoint_urlnormalize_url_pathpercent_encode_sequence)MD5_AVAILABLE@e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855i   z%Y-%m-%dT%H:%M:%SZz%Y%m%dT%H%M%SZ)expectz
user-agentzx-amzn-trace-idzUNSIGNED-PAYLOADz"STREAMING-UNSIGNED-PAYLOAD-TRAILERc                     [        U 5      nUR                  n[        U 5      (       a  SU S3nSSS.nUR                  b9  UR                  UR	                  UR
                  5      :w  a  SX!R                  4-  nU$ )N[]P   i  )httphttpsz%s:%d)r   hostnamer   portgetscheme)url	url_partshostdefault_portss        lib/third_party/botocore/auth.py_host_from_urlr)   F   s|    
 ID!#&&4&{M ~~!>>]..y/?/?@@dNN33DK    c                     U R                   n[        U[        5      (       a'  [        R                  " UR                  S5      5      nU$ [        U[        5      (       a  [        R                  " U5      nU$ Nutf-8)data
isinstancebytesjsonloadsdecodestr)requestr.   s     r(   _get_body_as_dictr6   Y   sZ    
 <<D$zz$++g./ K 
D#		zz$Kr*   c                   "    \ rS rSrSrSrS rSrg)
BaseSignerf   Fc                     [        S5      e)Nadd_auth)NotImplementedErrorselfr5   s     r(   r;   BaseSigner.add_authj   s    !*--r*    N)__name__
__module____qualname____firstlineno__REQUIRES_REGIONREQUIRES_TOKENr;   __static_attributes__r@   r*   r(   r8   r8   f   s    ON.r*   r8   c                        \ rS rSrSr S rSrg)TokenSignern   Tc                     Xl         g N
auth_token)r>   rN   s     r(   __init__TokenSigner.__init__t   s    $r*   rM   N)rA   rB   rC   rD   rF   rO   rG   r@   r*   r(   rI   rI   n   s    N%r*   rI   c                   *    \ rS rSrSrS rS rS rSrg)	SigV2Authx   z#
Sign a request with Signature V2.
c                     Xl         g rL   credentialsr>   rV   s     r(   rO   SigV2Auth.__init__}       &r*   c                 F   [         R                  S5        [        UR                  5      nUR                  n[        U5      S:X  a  SnUR                   SUR                   SU S3n[        R                  " U R                  R                  R                  S5      [        S9n/ n[        U5       H`  nUS:X  a  M  [        X(   5      n	[!        UR                  S5      SS	9n
[!        U	R                  S5      S
S	9nUR#                  U
 SU 35        Mb     SR%                  U5      nX\-  n[         R                  SU5        UR'                  UR                  S5      5        [(        R*                  " UR-                  5       5      R/                  5       R1                  S5      nX4$ )Nz$Calculating signature using v2 auth.r   /
r-   	digestmod	Signature safez-_~=&zString to sign: %s)loggerdebugr   r$   pathlenmethodnetlochmacnewrV   
secret_keyencoder   sortedr4   r   appendjoinupdatebase64	b64encodedigeststripr3   )r>   r5   paramssplitrg   string_to_signlhmacpairskeyvalue
quoted_keyquoted_valueqsb64s                 r(   calc_signatureSigV2Auth.calc_signature   s_   ;<%zzt9>D#NN+2ell^2dV2F''..w76
 &>C k!$Eszz'2<J g!6UCLLLJ<q78 " XXe_)>:^**734u||~.446==gFyr*   c                    U R                   c
  [        5       eUR                  (       a  UR                  nOUR                  nU R                   R                  US'   SUS'   SUS'   [
        R                  " [        [
        R                  " 5       5      US'   U R                   R                  (       a  U R                   R                  US'   U R                  X5      u  p4XBS'   U$ )	NAWSAccessKeyId2SignatureVersion
HmacSHA256SignatureMethod	TimestampSecurityTokenr_   )rV   r   r.   rw   
access_keytimestrftimeISO8601gmtimetokenr   )r>   r5   rw   r   	signatures        r(   r;   SigV2Auth.add_auth   s     #$&&<<\\F ^^F#'#3#3#>#> %(!"$0 !"mmGT[[]C{!!&*&6&6&<&<F?#++G<'{r*   rU   N)	rA   rB   rC   rD   __doc__rO   r   r;   rG   r@   r*   r(   rR   rR   x   s    '8r*   rR   c                        \ rS rSrS rS rSrg)	SigV3Auth   c                     Xl         g rL   rU   rW   s     r(   rO   SigV3Auth.__init__   rY   r*   c                    U R                   c
  [        5       eSUR                  ;   a  UR                  S	 [        SS9UR                  S'   U R                   R                  (       a@  SUR                  ;   a  UR                  S	 U R                   R                  UR                  S'   [
        R                  " U R                   R                  R                  S5      [        S9nUR                  UR                  S   R                  S5      5        [        UR                  5       5      R                  5       nSU R                   R                   SUR                  S5       3nS	UR                  ;   a  UR                  S		 XAR                  S	'   g )
NDateTusegmtX-Amz-Security-Tokenr-   r]   zAWS3-HTTPS AWSAccessKeyId=z ,Algorithm=HmacSHA256,Signature=zX-Amzn-Authorization)rV   r   headersr   r   rk   rl   rm   rn   r   rr   r   ru   rv   r   r3   )r>   r5   new_hmacencoded_signaturer   s        r(   r;   SigV3Auth.add_auth   sJ   #$&&W__$'",D"9!!%8OO$:;6:6F6F6L6LGOO2388''..w76
 	/66w?@'(9:@@B()9)9)D)D(E F..?.F.Fw.O-PR 	 "W__4 672;./r*   rU   N)rA   rB   rC   rD   rO   r;   rG   r@   r*   r(   r   r      s    '<r*   r   c                       \ rS rSrSrSrS rSS jrS rS r	S r
S	 rS
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rSrg)	SigV4Auth   z#
Sign a request with Signature V4.
Tc                 (    Xl         X0l        X l        g rL   )rV   _region_name_service_namer>   rV   service_nameregion_names       r(   rO   SigV4Auth.__init__   s    & ()r*   c                     U(       a:  [         R                  " XR                  S5      [        5      R	                  5       nU$ [         R                  " XR                  S5      [        5      R                  5       nU$ r,   )rk   rl   rn   r   	hexdigestru   )r>   r|   msghexsigs        r(   _signSigV4Auth._sign   sW    ((3

7 3V<FFHC 
 ((3

7 3V<CCEC
r*   c                     [        5       nUR                  R                  5        H%  u  p4UR                  5       nU[        ;  d  M!  XBU'   M'     SU;  a  [        UR                  5      US'   U$ )zS
Select the headers from the request that need to be included
in the StringToSign.
r&   )r
   r   itemslowerSIGNED_HEADERS_BLACKLISTr)   r$   )r>   r5   
header_mapnamer}   lnames         r(   headers_to_signSigV4Auth.headers_to_sign   se    
 !]
"??002KDJJLE44$)5! 3 # "0!<Jvr*   c                     UR                   (       a  U R                  UR                   5      $ U R                  [        UR                  5      5      $ rL   )rw   _canonical_query_string_params_canonical_query_string_urlr   r$   r=   s     r(   canonical_query_string SigV4Auth.canonical_query_string   s:    
 >>66w~~FF33HW[[4IJJr*   c           	      <   / n[        U[        5      (       a  UR                  5       nU H1  u  p4UR                  [	        USS9[	        [        U5      SS945        M3     / n[        U5       H  u  p4UR                  U SU 35        M     SR                  U5      nU$ )Nz-_.~ra   rc   rd   )r/   r   r   rp   r   r4   ro   rq   )r>   rw   key_val_pairsr|   r}   sorted_key_valsr   s          r(   r   (SigV4Auth._canonical_query_string_params  s    fg&&\\^F JC  s(%E
*HI !  !/JC""cU!E7#34 0!$/!:%%r*   c                 :   SnUR                   (       a  / nUR                   R                  S5       H)  nUR                  S5      u  pVnUR                  XW45        M+     / n[	        U5       H  u  pWUR                  U SU 35        M     SR                  U5      nU$ )Nr`   rd   rc   )queryrx   	partitionrp   ro   rq   )	r>   partsr   r   pairr|   _r}   r   s	            r(   r   %SigV4Auth._canonical_query_string_url  s    !#;;M))#. $s 3$$c\2 / !O %]3
&&#aw'78 4%(XXo%>"%%r*   c                    ^  / n[        [        U5      5      nU HL  nSR                  U 4S jUR                  U5       5       5      nUR	                  U S[        U5       35        MN     SR                  U5      $ )z
Return the headers that need to be included in the StringToSign
in their canonical form by converting all header keys to lower
case, sorting them in alphabetical order and then joining
them into a string, separated by newlines.
,c              3   F   >#    U  H  nTR                  U5      v   M     g 7frL   )_header_value).0vr>   s     r(   	<genexpr>.SigV4Auth.canonical_headers.<locals>.<genexpr>,  s#      /K!""1%%/Ks   !:r\   )ro   setrq   get_allrp   r   )r>   r   r   sorted_header_namesr|   r}   s   `     r(   canonical_headersSigV4Auth.canonical_headers"  sz     $S%9:&CHH />/F/Fs/K E NNcU!N5$9#:;<	 '
 yy!!r*   c                 @    SR                  UR                  5       5      $ )N )rq   rx   )r>   r}   s     r(   r   SigV4Auth._header_value2  s     xx&&r*   c                 Z    [        S [        U5       5       5      nSR                  U5      $ )Nc              3   \   #    U  H"  oR                  5       R                  5       v   M$     g 7frL   )r   rv   )r   ns     r(   r   +SigV4Auth.signed_headers.<locals>.<genexpr>;  s      I4Hq**4Hs   *,;)ro   r   rq   )r>   r   r   s      r(   signed_headersSigV4Auth.signed_headers:  s&    IC4HIIxx  r*   c                     UR                   R                  S0 5      nUR                  S5      n[        U[        5      =(       a    UR                  S5      S:H  $ )Nchecksumrequest_algorithmintrailer)contextr"   r/   dict)r>   r5   checksum_context	algorithms       r(   _is_streaming_checksum_payload(SigV4Auth._is_streaming_checksum_payload>  sJ    "??..z2>$(()<=	)T*Oy}}T/Bi/OOr*   c                    U R                  U5      (       a  [        $ U R                  U5      (       d  [        $ UR                  nU(       a  [        US5      (       a  UR                  5       n[        R                  " UR                  [        5      n[        5       n[        US5       H  nUR                  U5        M     UR                  5       nUR                  U5        U$ U(       a  [        U5      R                  5       $ [         $ )Nseekr*   )r   "STREAMING_UNSIGNED_PAYLOAD_TRAILER_should_sha256_sign_payloadUNSIGNED_PAYLOADbodyhasattrtell	functoolspartialreadPAYLOAD_BUFFERr   iterrr   r   r   EMPTY_SHA256_HASH)r>   r5   request_bodypositionread_chunksizer   chunkhex_checksums           r(   payloadSigV4Auth.payloadC  s    ..w775511':: $#||GL&99#((*H&..!!>N xHnc2& 3#--/Lh' ,'1133$$r*   c                 |    UR                   R                  S5      (       d  gUR                  R                  SS5      $ )Nr   Tpayload_signing_enabled)r$   
startswithr   r"   r=   s     r(   r   %SigV4Auth._should_sha256_sign_payload]  s4    {{%%g..
 ""#<dCCr*   c                 D   UR                   R                  5       /nU R                  [        UR                  5      R
                  5      nUR                  U5        UR                  U R                  U5      5        U R                  U5      nUR                  U R                  U5      S-   5        UR                  U R                  U5      5        SUR                  ;   a  UR                  S   nOU R                  U5      nUR                  U5        SR                  U5      $ )Nr\   X-Amz-Content-SHA256)ri   upper_normalize_url_pathr   r$   rg   rp   r   r   r   r   r   r  rq   )r>   r5   crrg   r   body_checksums         r(   canonical_requestSigV4Auth.canonical_requestg  s    nn""$%''(=(B(BC
		$
		$--g67..w7
		$((9D@A
		$%%o67!W__4#OO,BCM LL1M
		- yy}r*   c                 ,    [        [        U5      SS9nU$ )Nz/~ra   )r   r   )r>   rg   normalized_paths      r(   r  SigV4Auth._normalize_url_pathv  s     24 8tDr*   c                 "   U R                   R                  /nUR                  UR                  S   SS 5        UR                  U R                  5        UR                  U R
                  5        UR                  S5        SR                  U5      $ N	timestampr      aws4_requestr[   )rV   r   rp   r   r   r   rq   r>   r5   scopes      r(   r  SigV4Auth.scopez  sp    !!,,-W__[1!A67T&&'T''(^$xxr*   c                     / nUR                  UR                  S   SS 5        UR                  U R                  5        UR                  U R                  5        UR                  S5        SR	                  U5      $ r  )rp   r   r   r   rq   r  s      r(   credential_scopeSigV4Auth.credential_scope  sa    W__[1!A67T&&'T''(^$xxr*   c                    S/nUR                  UR                  S   5        UR                  U R                  U5      5        UR                  [        UR	                  S5      5      R                  5       5        SR                  U5      $ )z
Return the canonical StringToSign as well as a dict
containing the original version of all headers that
were included in the StringToSign.
AWS4-HMAC-SHA256r  r-   r\   )rp   r   r  r   rn   r   rq   )r>   r5   r  stss       r(   ry   SigV4Auth.string_to_sign  sl     ""

7??;/0

4((12

6+227;<FFHIyy~r*   c                 D   U R                   R                  nU R                  SU 3R                  5       UR                  S   SS 5      nU R                  X@R
                  5      nU R                  XPR                  5      nU R                  US5      nU R                  XqSS9$ )NAWS4r  r   r  r  T)r   )rV   rm   r   rn   r   r   r   )r>   ry   r5   r|   k_datek_region	k_service	k_signings           r(   r   SigV4Auth.signature  s    ))C5\!!#W__[%A!A%F
 ::f&7&78JJx););<	JJy.9	zz)z>>r*   c                 
   U R                   c
  [        5       e[        R                  R                  5       nUR	                  [
        5      UR                  S'   U R                  U5        U R                  U5      n[        R                  S5        [        R                  SU5        U R                  X5      n[        R                  SU5        U R                  XA5      n[        R                  SU5        U R                  X5        g )Nr  z$Calculating signature using v4 auth.zCanonicalRequest:
%sStringToSign:
%szSignature:
%s)rV   r   datetimeutcnowr   SIGV4_TIMESTAMPr   _modify_request_before_signingr  re   rf   ry   r   _inject_signature_to_request)r>   r5   datetime_nowr  ry   r   s         r(   r;   SigV4Auth.add_auth  s    #$&&((//1'3'<'<_'M$ 	++G4 227;;<,.?@,,WH(.9NN>;	%y1))'=r*   c                     SU R                  U5      -  /nU R                  U5      nUR                  SU R                  U5       35        UR                  SU-  5        SR	                  U5      UR
                  S'   U$ )NzAWS4-HMAC-SHA256 Credential=%szSignedHeaders=zSignature=%sz, Authorization)r  r   rp   r   rq   r   )r>   r5   r   auth_strr   s        r(   r0  &SigV4Auth._inject_signature_to_request  sy    4tzz'7JJK..w7T00ABC	
 	23+/99X+>(r*   c                    SUR                   ;   a  UR                   S	 U R                  U5        U R                  R                  (       a@  SUR                   ;   a  UR                   S	 U R                  R                  UR                   S'   UR                  R                  SS5      (       d1  SUR                   ;   a  UR                   S	 [        UR                   S'   g g )Nr4  r   r  Tr
  )r   _set_necessary_date_headersrV   r   r   r"   r   r=   s     r(   r/  (SigV4Auth._modify_request_before_signing  s    goo-0((1!!%8OO$:;6:6F6F6L6LGOO23""#<dCC%8OO$:;6FGOO23 Dr*   c                    SUR                   ;   a  UR                   S	 [        R                  R                  UR                  S   [        5      n[        [        [        R                  " UR                  5       5      5      5      UR                   S'   SUR                   ;   a  UR                   S	 g g SUR                   ;   a  UR                   S	 UR                  S   UR                   S'   g )Nr   r  
X-Amz-Date)
r   r,  strptimer   r.  r   intcalendartimegm	timetuple)r>   r5   datetime_timestamps      r(   r8  %SigV4Auth._set_necessary_date_headers  s     W__$'!)!2!2!;!;,o" '1HOO$6$@$@$BCD'GOOF# w.OOL1 / w.OOL1,3OOK,HGOOL)r*   )r   r   rV   N)F)rA   rB   rC   rD   r   rE   rO   r   r   r   r   r   r   r   r   r   r  r   r  r  r  r  ry   r   r;   r0  r/  r8  rG   r@   r*   r(   r   r      s     O* K&"& " '!P
%4D
?>$GIr*   r   c                   :   ^  \ rS rSrU 4S jrU 4S jrS rSrU =r$ )S3SigV4Authi  c                    > [         TU ]  U5        SUR                  ;   a  UR                  S	 U R                  U5      UR                  S'   g )Nr
  )superr/  r   r  r>   r5   	__class__s     r(   r/  *S3SigV4Auth._modify_request_before_signing  sA    .w7!W__4 6726,,w2G./r*   c                 
  > UR                   R                  S5      n[        USS 5      nUc  0 nUR                  SS 5      nUb  U$ SnUR                   R                  S0 5      nUR                  S5      n[        U[        5      (       a  UR                  S5      S:X  a  US	   nUR
                  R                  S
5      (       a  XQR                  ;  a  gUR                   R                  SS5      (       a  g[        TU ]%  U5      $ )Nclient_configs3r  zContent-MD5r   r   r   headerr   r   Thas_streaming_inputF)
r   r"   getattrr/   r   r$   r  r   rF  r   )	r>   r5   rK  	s3_configsign_payloadchecksum_headerr   r   rH  s	           r(   r   'S3SigV4Auth._should_sha256_sign_payload  s      ++O<M46	 I !}}%>E# ("??..z2>$(()<=	i&&9==+>(+J'/O&&w//oo5 ??4e<< w27;;r*   c                     U$ rL   r@   r>   rg   s     r(   r  S3SigV4Auth._normalize_url_path      r*   r@   )	rA   rB   rC   rD   r/  r   r  rG   __classcell__rH  s   @r(   rD  rD    s    H'<R r*   rD  c                   D   ^  \ rS rSrSrU 4S jrU 4S jrU 4S jrSrU =r	$ )S3ExpressAuthi  Tc                2   > [         TU ]  XU5        X@l        g rL   )rF  rO   _identity_cache)r>   rV   r   r   identity_cacherH  s        r(   rO   S3ExpressAuth.__init__  s     	K@-r*   c                 $   > [         TU ]  U5        g rL   )rF  r;   rG  s     r(   r;   S3ExpressAuth.add_auth  s    !r*   c                    > [         TU ]  U5        SUR                  ;  a#  U R                  R                  UR                  S'   SUR                  ;   a  UR                  S	 g g )Nzx-amz-s3session-tokenr   )rF  r/  r   rV   r   rG  s     r(   r/  ,S3ExpressAuth._modify_request_before_signing   sU    .w7"'//97;7G7G7M7MGOO34!W__4 67 5r*   )r]  )
rA   rB   rC   rD   REQUIRES_IDENTITY_CACHErO   r;   r/  rG   rX  rY  s   @r(   r[  r[    s    "."8 8r*   r[  c                       \ rS rSrSrS rSrg)S3ExpressPostAuthi)  Tc                 $   [         R                   R                  5       nUR                  [        5      UR                  S'   0 nUR                  R                  SS 5      b  UR                  S   n0 n/ nUR                  R                  SS 5      b'  UR                  S   nUR                  SS 5      b  US   nXTS'   SUS'   U R                  U5      US'   UR                  S   US'   UR                  SS05        UR                  SU R                  U5      05        UR                  SUR                  S   05        U R                  R                  b@  U R                  R                  US	'   UR                  S	U R                  R                  05        [        R                  " [        R                  " U5      R                  S
5      5      R                  S
5      US'   U R!                  US   U5      US'   X1R                  S'   XAR                  S'   g )Nr  s3-presign-post-fieldss3-presign-post-policy
conditionsr   x-amz-algorithmx-amz-credential
x-amz-dateX-Amz-S3session-Tokenr-   policyx-amz-signaturer,  r-  r   r.  r   r"   r  rp   rV   r   rs   rt   r1   dumpsrn   r3   r   r>   r5   r1  fieldsro  rj  s         r(   r;   S3ExpressPostAuth.add_auth,  s   ((//1'3'<'<_'M$??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|$6 !%)ZZ%8!"&{;|,.@AB-tzz'/BCD<)EFG!!-.2.>.>.D.DF*+($*:*:*@*@A
 "++JJv%%g.

&/ 	x %)NN6(3CW$M !4:014:01r*   r@   N)rA   rB   rC   rD   rd  r;   rG   r@   r*   r(   rf  rf  )  s    "';r*   rf  c                   P   ^  \ rS rSrSrSr\S.U 4S jjrS rS rS r	S	 r
S
rU =r$ )S3ExpressQueryAuthiV  i,  T)expiresc                2   > [         TU ]  UUUUS9  XPl        g )N)r^  rF  rO   _expires)r>   rV   r   r   r^  rx  rH  s         r(   rO   S3ExpressQueryAuth.__init__Z  s*     	)	 	 	
  r*   c                 h   UR                   R                  S5      nSnX#:X  a  UR                   S	 U R                  U R                  U5      5      nSU R	                  U5      UR
                  S   U R                  US.nU R                  R                  b  U R                  R                  US'   [        UR                  5      n[        UR                  SS9nUR                  5        VV	s0 s H
  u  pXS	   _M     n
nn	UR                  (       a"  U
R                  UR                  5        0 Ul        S
nUR                   (       a!  U
R                  [#        U5      5        S
Ul        U
(       a  [%        U
5      S-   nU [%        U5       3nUnUS	   US   US   XS   4n['        U5      Ul
        g s  sn	nf )Ncontent-type0application/x-www-form-urlencoded; charset=utf-8r   r  zX-Amz-AlgorithmzX-Amz-Credentialr;  zX-Amz-ExpireszX-Amz-SignedHeadersrn  Tkeep_blank_valuesr   r`   rd            r   r"   r   r   r  r   r{  rV   r   r   r$   r   r   r   rw   rr   r.   r6   r   r   )r>   r5   content_typeblocklisted_content_typer   auth_paramsr%   query_string_partskr   
query_dictoperation_paramsnew_query_stringpnew_url_partss                  r(   r/  1S3ExpressQueryAuth._modify_request_before_signingk  s    **>:> 	! 3/
 ,,T-A-A'-JK  2 $

7 3!//+6!]]#1
 !!-373C3C3I3IK/0 W[[)	 &iooN*<*B*B*DE*D$!a1g*D
E>>gnn-GN << /89GL6zBSH !8!E FG 	 1qtQqT+;qTB /A F   *F.c                 4    U=R                   SU-  -  sl         g Nz&X-Amz-Signature=%sr$   r>   r5   r   s      r(   r0  /S3ExpressQueryAuth._inject_signature_to_request       	,y88r*   c                     U$ rL   r@   rU  s     r(   r  &S3ExpressQueryAuth._normalize_url_path  rW  r*   c                     [         $ rL   r   r=   s     r(   r  S3ExpressQueryAuth.payload  
    
  r*   r{  )rA   rB   rC   rD   DEFAULT_EXPIRESrd  rO   r/  r0  r  r  rG   rX  rY  s   @r(   rw  rw  V  s7    O"     "?0B9   r*   rw  c                   >   ^  \ rS rSrSr\4U 4S jjrS rS rSrU =r	$ )SigV4QueryAuthi    c                 2   > [         TU ]  XU5        X@l        g rL   rz  )r>   rV   r   r   rx  rH  s        r(   rO   SigV4QueryAuth.__init__  s     	K@r*   c                 h   UR                   R                  S5      nSnX#:X  a  UR                   S	 U R                  U R                  U5      5      nSU R	                  U5      UR
                  S   U R                  US.nU R                  R                  b  U R                  R                  US'   [        UR                  5      n[        UR                  SS9nUR                  5        VV	s0 s H
  u  pXS	   _M     n
nn	UR                  (       a"  U
R                  UR                  5        0 Ul        S
nUR                   (       a!  U
R                  [#        U5      5        S
Ul        U
(       a  [%        U
5      S-   nU [%        U5       3nUnUS	   US   US   XS   4n['        U5      Ul
        g s  sn	nf )Nr~  r  r   r  r  r   Tr  r   r`   rd   r  r  r  r  )r>   r5   r  blacklisted_content_typer   r  r%   r  r  r   r  r  r  r  r  s                  r(   r/  -SigV4QueryAuth._modify_request_before_signing  s    **>:> 	! 3/
 ,,T-A-A'-JK  2 $

7 3!//+6!]]#1
 !!-262B2B2H2HK./ W[[)	 &iooN*<*B*B*DE*D$!a1g*D
E>>gnn-GN << /89GL6zBSH !8!E FG 	 1qtQqT+;qTB /A Fr  c                 4    U=R                   SU-  -  sl         g r  r  r  s      r(   r0  +SigV4QueryAuth._inject_signature_to_request  r  r*   r  )
rA   rB   rC   rD   r  rO   r/  r0  rG   rX  rY  s   @r(   r  r    s#    O ?N ?0B9 9r*   r  c                   $    \ rS rSrSrS rS rSrg)S3SigV4QueryAuthi  zS3 SigV4 auth using query parameters.

This signer will sign a request using query parameters and signature
version 4, i.e a "presigned url" signer.

Based off of:

http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

c                     U$ rL   r@   rU  s     r(   r  $S3SigV4QueryAuth._normalize_url_path  rW  r*   c                     [         $ rL   r  r=   s     r(   r  S3SigV4QueryAuth.payload  r  r*   r@   N)rA   rB   rC   rD   r   r  r  rG   r@   r*   r(   r  r    s    	 r*   r  c                       \ rS rSrSrS rSrg)S3SigV4PostAuthi'  zv
Presigns a s3 post

Implementation doc here:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html
c                 $   [         R                   R                  5       nUR                  [        5      UR                  S'   0 nUR                  R                  SS 5      b  UR                  S   n0 n/ nUR                  R                  SS 5      b'  UR                  S   nUR                  SS 5      b  US   nXTS'   SUS'   U R                  U5      US'   UR                  S   US'   UR                  SS05        UR                  SU R                  U5      05        UR                  SUR                  S   05        U R                  R                  b@  U R                  R                  US	'   UR                  S	U R                  R                  05        [        R                  " [        R                  " U5      R                  S
5      5      R                  S
5      US'   U R!                  US   U5      US'   X1R                  S'   XAR                  S'   g )Nr  rh  ri  rj  r   rk  rl  rm  x-amz-security-tokenr-   ro  rp  rq  rs  s         r(   r;   S3SigV4PostAuth.add_auth/  s   ((//1'3'<'<_'M$??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|$6 !%)ZZ%8!"&{;|,.@AB-tzz'/BCD<)EFG!!--1-=-=-C-CF)*5t7G7G7M7MNO "++JJv%%g.

&/ 	x %)NN6(3CW$M !4:014:01r*   r@   NrA   rB   rC   rD   r   r;   rG   r@   r*   r(   r  r  '  s    %;r*   r  c                   r    \ rS rSr/ SQrSS jrS rS rS rS r	SS	 jr
 SS
 jr SS jrS rS rS rSrg)
HmacV1AuthiW  )$
accelerateaclcorsdefaultObjectAcllocationlogging
partNumberro  requestPaymenttorrent
versioning	versionIdversionswebsiteuploadsuploadIdzresponse-content-typezresponse-content-languagezresponse-expireszresponse-cache-controlzresponse-content-dispositionzresponse-content-encodingdelete	lifecycletaggingrestorestorageClassnotificationreplicationr  	analyticsmetrics	inventoryselectzselect-typezobject-lockNc                     Xl         g rL   rU   r   s       r(   rO   HmacV1Auth.__init__  rY   r*   c                 &   [         R                  " U R                  R                  R	                  S5      [
        S9nUR                  UR	                  S5      5        [        UR                  5       5      R                  5       R                  S5      $ )Nr-   r]   )rk   rl   rV   rm   rn   r   rr   r   ru   rv   r3   )r>   ry   r   s      r(   sign_stringHmacV1Auth.sign_string  sk    88''..w74
 	--g678??,-335<<WEEr*   c                 F   / SQn/ nSU;   a  US	 U R                  5       US'   U Hi  nSnU HD  nUR                  5       nX   c  M  Xt:X  d  M!  UR                  X   R                  5       5        SnMF     U(       a  MX  UR                  S5        Mk     SR	                  U5      $ )N)content-md5r~  dater   FTr`   r\   )	_get_dater   rp   rv   rq   )r>   r   interesting_headershoiihfoundr|   lks           r(   canonical_standard_headers%HmacV1Auth.canonical_standard_headers  s    EW..*%BEYY[<+JJw|1134 E	 
 5

2 & yy~r*   c                 b   / n0 nU H[  nUR                  5       nX   c  M  UR                  S5      (       d  M2  SR                  S UR                  U5       5       5      X5'   M]     [	        UR                  5       5      nU H  nUR                  U SX4    35        M     SR                  U5      $ )Nx-amz-r   c              3   @   #    U  H  oR                  5       v   M     g 7frL   )rv   )r   r   s     r(   r   6HmacV1Auth.canonical_custom_headers.<locals>.<genexpr>  s      2+?a		+?s   r   r\   )r   r  rq   r   ro   keysrp   )r>   r   r  custom_headersr|   r  sorted_header_keyss          r(   canonical_custom_headers#HmacV1Auth.canonical_custom_headers  s    CB|'==**), 2+2??3+?2 *N&	  $N$7$7$9:%CJJ#a 3456 &yy~r*   c                 J    [        U5      S:X  a  U$ US   [        US   5      4$ )z
TODO: Do we need this?
r  r   )rh   r   )r>   nvs     r(   	unquote_vHmacV1Auth.unquote_v  s+     r7a<IqE72a5>**r*   c                    Ub  UnOUR                   nUR                  (       a  UR                  R                  S5      nU Vs/ s H  oUR                  SS5      PM     nnU Vs/ s H(  oUS   U R                  ;   d  M  U R	                  U5      PM*     nn[        U5      S:  aR  UR                  [        S5      S9  U Vs/ s H  nSR                  U5      PM     nnUS-  nUSR                  U5      -  nU$ s  snf s  snf s  snf )Nrd   rc   r  r   )r|   ?)	rg   r   rx   QSAOfInterestr  rh   sortr   rq   )r>   rx   	auth_pathbufqsaas         r(   canonical_resourceHmacV1Auth.canonical_resource  s      C**C;;++##C(C,/0Cq773?CC0+.+.aA$$:L:L2L!q!3   3x!|Z]+,/0Cqsxx{C0s
sxx}$
 1
 1s   C8$C=>C= Dc                     UR                  5       S-   nX`R                  U5      S-   -  nU R                  U5      nU(       a  XgS-   -  nX`R                  X%S9-  nU$ )Nr\   r  )r  r  r  r  )r>   ri   rx   r   rx  r  csr  s           r(   canonical_stringHmacV1Auth.canonical_string  sg     \\^d"
--g6==66w?4''B
%%e%AA	r*   c                     U R                   R                  (       a  US	 U R                   R                  US'   U R                  XX5S9n[        R	                  SU5        U R                  U5      $ )Nr  r  r+  )rV   r   r  re   rf   r  )r>   ri   rx   r   rx  r  ry   s          r(   get_signatureHmacV1Auth.get_signature  so     !!./.2.>.>.D.DG*+..7 / 
 	(.9//r*   c                 >   U R                   c  [        e[        R                  S5        [	        UR
                  5      n[        R                  SUR                  5        U R                  UR                  X!R                  UR                  S9nU R                  X5        g )Nz(Calculating signature using hmacv1 auth.zHTTP request method: %sr  )rV   r   re   rf   r   r$   ri   r   r   r  _inject_signature)r>   r5   rx   r   s       r(   r;   HmacV1Auth.add_auth  s|    #$$?@%.?&&NNE??g>O>O ' 
	 	w2r*   c                     [        SS9$ )NTr   r   r>   s    r(   r  HmacV1Auth._get_date  s    &&r*   c                     SUR                   ;   a  UR                   S	 SU R                  R                   SU 3nX1R                   S'   g )Nr4  zAWS r   )r   rV   r   )r>   r5   r   auth_headers       r(   r  HmacV1Auth._inject_signature  sG    goo- 0T--8899+F+6(r*   rU   )NNrL   )rA   rB   rC   rD   r  rO   r  r  r  r  r  r  r   r;   r  r  rG   r@   r*   r(   r  r  W  sN    %MN'F"+6 ?C	 ?C
0	3'7r*   r  c                   4    \ rS rSrSrSr\4S jrS rS rSr	g)	HmacV1QueryAuthi   z
Generates a presigned request for s3.

Spec from this document:

http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
#RESTAuthenticationQueryStringAuth

r  c                     Xl         X l        g rL   )rV   r{  )r>   rV   rx  s      r(   rO   HmacV1QueryAuth.__init__  s    &r*   c                 |    [        [        [        R                  " 5       [        U R                  5      -   5      5      $ rL   )r4   r=  r   r{  r  s    r(   r  HmacV1QueryAuth._get_date  s&    3tyy{S%77899r*   c                    0 nU R                   R                  US'   X#S'   UR                   H\  nUR                  5       nUS:X  a  UR                  S   US'   M-  UR	                  S5      (       d  US;   d  MK  UR                  U   X5'   M^     [        U5      n[        UR                  5      nUS   (       a
  US    SU 3nUS	   US
   US   XgS   4n[        U5      Ul        g )Nr   r_   r   Expiresr  )r  r~     rd   r   r  r  r  )	rV   r   r   r   r  r   r   r$   r   )	r>   r5   r   r  
header_keyr  r  r  r  s	            r(   r  !HmacV1QueryAuth._inject_signature  s    
'+'7'7'B'B
#$"+;!//J!!#B V#(/(?
9% x((B 3 - ")!4
 *  3:> W[[!Q4 #$A$q)9(:;1qtQqT+;qTB /r*   )r{  rV   N)
rA   rB   rC   rD   r   r  rO   r  r  rG   r@   r*   r(   r  r     s      O,;  :0r*   r  c                       \ rS rSrSrS rSrg)HmacV1PostAuthi5  z
Generates a presigned post for s3.

Spec from this document:

http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingHTTPPOST.html
c                    0 nUR                   R                  SS 5      b  UR                   S   n0 n/ nUR                   R                  SS 5      b'  UR                   S   nUR                  SS 5      b  US   nXCS'   U R                  R                  US'   U R                  R                  b@  U R                  R                  US'   UR                  SU R                  R                  05        [        R                  " [        R                  " U5      R                  S5      5      R                  S5      US'   U R                  US   5      US'   X!R                   S'   X1R                   S'   g )	Nrh  ri  rj  r   r  r-   ro  r   )r   r"   rV   r   r   rp   rs   rt   r1   rr  rn   r3   r  )r>   r5   rt  ro  rj  s        r(   r;   HmacV1PostAuth.add_auth>  sR   ??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|#'#3#3#>#> !!--1-=-=-C-CF)*5t7G7G7M7MNO "++JJv%%g.

&/ 	x #..vh/?@{4:014:01r*   r@   Nr  r@   r*   r(   r  r  5  s    ;r*   r  c                       \ rS rSrSrS rSrg)
BearerAuthi]  z
Performs bearer token authorization by placing the bearer token in the
Authorization header as specified by Section 2.1 of RFC 6750.

https://datatracker.ietf.org/doc/html/rfc6750#section-2.1
c                     U R                   c
  [        5       eSU R                   R                   3nSUR                  ;   a  UR                  S	 X!R                  S'   g )NzBearer r4  )rN   r   r   r   )r>   r5   r	  s      r(   r;   BearerAuth.add_authe  sP    ??""$$ 5 567goo-0+6(r*   r@   Nr  r@   r*   r(   r  r  ]  s    7r*   r  )v2v3v3httpsrL  zs3-queryzs3-presign-postzs3v4-presign-postzv4-s3expresszv4-s3express-queryzv4-s3express-presign-postbearer)CRT_AUTH_TYPE_MAPS)v4zv4-querys3v4z
s3v4-query)Crs   r>  r,  r   rk   r1   r  r   collections.abcr   email.utilsr   hashlibr   r   operatorr   botocore.compatr	   r
   r   r   r   r   r   r   r   botocore.exceptionsr   r   botocore.utilsr   r   r   r   	getLoggerrA   re   r   r   r   r.  r   r   r   r)   r6   r8   rI   rR   r   r   rD  r[  rf  rw  r  r  r  r  r  r  r  AUTH_TYPE_MAPSbotocore.crt.authr"  rr   r@   r*   r(   <module>r/     s           # "   
 
 
 E  * 
		8	$ G  
" 
 & %I "&
. .%* %:
 :z<
 <8JI
 JIZ3) 3l8K 8**; *;Ze  e PN9Y N9b ~  0-;i -;`f7 f7R20j 20j%;Z %;P7 7& 

%(!,!2 4,-&*		
r*   