
    a                     2   S r SSKJrJr  SSKrSSKrSSKrSSKrSSKJ	r	J
r
JrJr  SSKJr   SSKr\R&                  " \5      rS rSS jrS	/ SS
S4S jrS rS rS rS rS rSqS rS r S r!S r"S r#SS jr$S r%S r&SS jr'g! \ a	    SSKJr   Ncf = f)a  oauthlib.oauth1.rfc5849.signature ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module represents a direct implementation of `section 3.4`_ of the spec.

Terminology:
 * Client: software interfacing with an OAuth API
 * Server: the API provider
 * Resource Owner: the user who is granting authorization to the client

Steps for signing a request:

1. Collect parameters from the uri query, auth header, & body
2. Normalize those parameters
3. Normalize the uri
4. Pass the normalized uri, normalized parameters, and http method to
   construct the base string
5. Pass the base string and any keys needed to a signing function

.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
    )absolute_importunicode_literalsN)extract_paramssafe_string_equalsunicode_type	urldecode   )utilsc                     [         R                  " U R                  5       5      nUS-  nU[         R                  " U5      -  nUS-  nU[         R                  " U5      -  nU$ )a  **String Construction**

Per `section 3.4.1.1`_ of the spec.

For example, the HTTP request::

    POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
    Host: example.com
    Content-Type: application/x-www-form-urlencoded
    Authorization: OAuth realm="Example",
        oauth_consumer_key="9djdj82h48djs9d2",
        oauth_token="kkk9d7dh3k39sjv7",
        oauth_signature_method="HMAC-SHA1",
        oauth_timestamp="137131201",
        oauth_nonce="7d8f3e4a",
        oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D"

    c2&a3=2+q

is represented by the following signature base string (line breaks
are for display purposes only)::

    POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q
    %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_
    key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m
    ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk
    9d7dh3k39sjv7

.. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1
&)r
   escapeupper)http_methodbase_string_uri%normalized_encoded_request_parametersbase_strings       4lib/third_party/oauthlib/oauth1/rfc5849/signature.pyconstruct_base_stringr   *   se    R [..01+ + o..+ + CDD+	    c                    [        U [        5      (       d  [        S5      e[        R                  " U 5      u  p#pEpgU(       a  U(       d  [        S5      eU(       d  SnUR	                  5       nUR	                  5       nUb  UR	                  5       nSnSU;   a  UR                  SS5      u  pX)4U;   a  Un[        R                  " X#XESS45      $ )a  **Base String URI**

Per `section 3.4.1.2`_ of the spec.

For example, the HTTP request::

    GET /r%20v/X?id=123 HTTP/1.1
    Host: EXAMPLE.COM:80

is represented by the base string URI: "http://example.com/r%20v/X".

In another example, the HTTPS request::

    GET /?q=1 HTTP/1.1
    Host: www.example.net:8080

is represented by the base string URI: "https://www.example.net:8080/".

.. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2

The host argument overrides the netloc part of the uri argument.
zuri must be a unicode object.z$uri must include a scheme and netloc/))http80)https443:r	    )
isinstancer   
ValueErrorurlparselowersplit
urlunparse)
urihostschemenetlocpathparamsqueryfragmentdefault_portsports
             r   normalize_base_string_urir.   l   s    . 
C	&	&
4
55 3;2C2CC2H/&$ 
v
;
<< 
D <<>&<<>& 
ZZ\F- 	F]c1%JD~&f			fdBC	DDr   r   TFc                    U=(       d    0 n/ nU (       a  UR                  [        U 5      5        U(       a|  [        S UR                  5        5       5      nUR	                  S5      nUbH  UR                  [
        R                  " U5       Vs/ s H  nU(       d  US   S:w  d  M  UPM     sn5        [        U5      =(       d    / n	UR                  U	5        / n
U HC  u  pUR                  S5      (       a  [
        R                  " U5      nU
R                  X45        ME     U(       a  [        [        S U
5      5      n
U
$ s  snf )a  **Parameter Sources**

Parameters starting with `oauth_` will be unescaped.

Body parameters must be supplied as a dict, a list of 2-tuples, or a
formencoded query string.

Headers must be supplied as a dict.

Per `section 3.4.1.3.1`_ of the spec.

For example, the HTTP request::

    POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
    Host: example.com
    Content-Type: application/x-www-form-urlencoded
    Authorization: OAuth realm="Example",
        oauth_consumer_key="9djdj82h48djs9d2",
        oauth_token="kkk9d7dh3k39sjv7",
        oauth_signature_method="HMAC-SHA1",
        oauth_timestamp="137131201",
        oauth_nonce="7d8f3e4a",
        oauth_signature="djosJKDKJSD8743243%2Fjdk33klY%3D"

    c2&a3=2+q

contains the following (fully decoded) parameters used in the
signature base sting::

    +------------------------+------------------+
    |          Name          |       Value      |
    +------------------------+------------------+
    |           b5           |       =%3D       |
    |           a3           |         a        |
    |           c@           |                  |
    |           a2           |        r b       |
    |   oauth_consumer_key   | 9djdj82h48djs9d2 |
    |       oauth_token      | kkk9d7dh3k39sjv7 |
    | oauth_signature_method |     HMAC-SHA1    |
    |     oauth_timestamp    |     137131201    |
    |       oauth_nonce      |     7d8f3e4a     |
    |           c2           |                  |
    |           a3           |        2 q       |
    +------------------------+------------------+

Note that the value of "b5" is "=%3D" and not "==".  Both "c@" and
"c2" have empty values.  While the encoding rules specified in this
specification for the purpose of constructing the signature base
string exclude the use of a "+" character (ASCII code 43) to
represent an encoded space character (ASCII code 32), this practice
is widely used in "application/x-www-form-urlencoded" encoded values,
and MUST be properly decoded, as demonstrated by one of the "a3"
parameter instances (the "a3" parameter is used twice in this
request).

.. _`section 3.4.1.3.1`:
https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1
c              3   J   #    U  H  u  pUR                  5       U4v   M     g 7fN)r!   ).0kvs      r   	<genexpr>%collect_parameters.<locals>.<genexpr>  s     DODA!'')QOs   !#authorizationr   realmoauth_c                     U S   S:g  $ )Nr   oauth_signature )is    r   <lambda>$collect_parameters.<locals>.<lambda>A  s    1!22r   )extendr   dictitemsgetr
   parse_authorization_headerr   
startswithunescapeappendlistfilter)	uri_querybodyheadersexclude_oauth_signature
with_realmr)   headers_lowerauthorization_headerr=   
bodyparamsunescaped_paramsr3   r4   s                r   collect_parametersrS      s$   ~ Mr'& 
MM)I&' DGMMODDM(,,_='mm556JKK1Q47? K 	& d#)r*--
 da||H
..
aQF#  24DEG 
Gs   E%Ec                 &   U  VVs/ s H1  u  p[         R                  " U5      [         R                  " U5      4PM3     nnnUR                  5         U VVs/ s H  u  pSR                  X5      PM     nnnSR	                  U5      $ s  snnf s  snnf )a
  **Parameters Normalization**

Per `section 3.4.1.3.2`_ of the spec.

For example, the list of parameters from the previous section would
be normalized as follows:

Encoded::

+------------------------+------------------+
|          Name          |       Value      |
+------------------------+------------------+
|           b5           |     %3D%253D     |
|           a3           |         a        |
|          c%40          |                  |
|           a2           |       r%20b      |
|   oauth_consumer_key   | 9djdj82h48djs9d2 |
|       oauth_token      | kkk9d7dh3k39sjv7 |
| oauth_signature_method |     HMAC-SHA1    |
|     oauth_timestamp    |     137131201    |
|       oauth_nonce      |     7d8f3e4a     |
|           c2           |                  |
|           a3           |       2%20q      |
+------------------------+------------------+

Sorted::

+------------------------+------------------+
|          Name          |       Value      |
+------------------------+------------------+
|           a2           |       r%20b      |
|           a3           |       2%20q      |
|           a3           |         a        |
|           b5           |     %3D%253D     |
|          c%40          |                  |
|           c2           |                  |
|   oauth_consumer_key   | 9djdj82h48djs9d2 |
|       oauth_nonce      |     7d8f3e4a     |
| oauth_signature_method |     HMAC-SHA1    |
|     oauth_timestamp    |     137131201    |
|       oauth_token      | kkk9d7dh3k39sjv7 |
+------------------------+------------------+

Concatenated Pairs::

+-------------------------------------+
|              Name=Value             |
+-------------------------------------+
|               a2=r%20b              |
|               a3=2%20q              |
|                 a3=a                |
|             b5=%3D%253D             |
|                c%40=                |
|                 c2=                 |
| oauth_consumer_key=9djdj82h48djs9d2 |
|         oauth_nonce=7d8f3e4a        |
|   oauth_signature_method=HMAC-SHA1  |
|      oauth_timestamp=137131201      |
|     oauth_token=kkk9d7dh3k39sjv7    |
+-------------------------------------+

and concatenated together into a single string (line breaks are for
display purposes only)::

    a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj
    dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1
    &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7

.. _`section 3.4.1.3.2`:
https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
z{0}={1}r   )r
   r   sortformatjoin)r)   r3   r4   
key_valuesparameter_partss        r   normalize_parametersrZ   F  s    d @FFvtqa%,,q/2v*F
 //
 9CC
Y%%a+
/C
 
/	"" G Ds   8BBc                 B    [        XR                  UR                  5      $ r1   )sign_hmac_sha1client_secretresource_owner_secretr   clients     r   sign_hmac_sha1_with_clientra     s     	%9%944
6 6r   c                    U n[         R                  " U=(       d    S5      nUS-  nU[         R                  " U=(       d    S5      -  nUR                  S5      nUR                  S5      n[        R                  " XV[
        R                  5      n[        R                  " UR                  5       5      SS R                  S5      $ )a4  **HMAC-SHA1**

The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature
algorithm as defined in `RFC2104`_::

    digest = HMAC-SHA1 (key, text)

Per `section 3.4.2`_ of the spec.

.. _`RFC2104`: https://tools.ietf.org/html/rfc2104
.. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
r   r   utf-8N)r
   r   encodehmacnewhashlibsha1binascii
b2a_base64digestdecoder   r]   r^   textkeykey_utf8	text_utf8	signatures           r   r\   r\     s    ( 
$ 	](b)# *#
 +1r	22# ZZ (kk'")hhxGLL9) 
		Y--/	0"	5	<	<W	EEr   c                 B    [        XR                  UR                  5      $ r1   )sign_hmac_sha256r]   r^   r_   s     r   sign_hmac_sha256_with_clientrv     s     	+';'; 66
8 8r   c                    U n[         R                  " U=(       d    S5      nUS-  nU[         R                  " U=(       d    S5      -  nUR                  S5      nUR                  S5      n[        R                  " XV[
        R                  5      n[        R                  " UR                  5       5      SS R                  S5      $ )a<  **HMAC-SHA256**

The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature
algorithm as defined in `RFC4634`_::

    digest = HMAC-SHA256 (key, text)

Per `section 3.4.2`_ of the spec.

.. _`RFC4634`: https://tools.ietf.org/html/rfc4634
.. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
r   r   rc   Nrd   )r
   r   re   rf   rg   rh   sha256rj   rk   rl   rm   rn   s           r   ru   ru     s    ( 
$ 	](b)# *#
 +1r	22# ZZ (kk'")hhxGNN;) 
		Y--/	0"	5	<	<W	EEr   c                  r    [         c+  SS KJn   U R                  U R                  R
                  5      q [         $ )Nr   )_jwtrs1jwt.algorithms
algorithmsRSAAlgorithmhashesSHA1)jwtalgos    r   _jwt_rs1_signing_algorithmr     s)    _$""7>>#6#67G	.r   c                     [        U [        5      (       a  U R                  S5      n [        5       n[	        X!5      nUR                  X5      n[        R                  " U5      SS R                  S5      $ )aA  **RSA-SHA1**

Per `section 3.4.3`_ of the spec.

The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature
algorithm as defined in `RFC3447, Section 8.2`_ (also known as
PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5.  To
use this method, the client MUST have established client credentials
with the server that included its RSA public key (in a manner that is
beyond the scope of this specification).

.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
.. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2

rc   Nrd   )	r   r   re   r   _prepare_key_plussignrj   rk   rm   )r   rsa_private_keyalgrp   ss        r   sign_rsa_sha1r   $  sd      \**$$W-K"$##/#	hh{ !			Q		$	+	+G	44r   c                 d    UR                   (       d  [        S5      e[        XR                   5      $ )Nz4rsa_key is required when using RSA signature method.)rsa_keyr   r   r_   s     r   sign_rsa_sha1_with_clientr   =  s$    	
K
LL	{NN	33r   c                     [         R                  " U =(       d    S5      nUS-  nU[         R                  " U=(       d    S5      -  nU$ )a  Sign a request using plaintext.

Per `section 3.4.4`_ of the spec.

The "PLAINTEXT" method does not employ a signature algorithm.  It
MUST be used with a transport-layer mechanism such as TLS or SSL (or
sent over a secure channel with equivalent protections).  It does not
utilize the signature base string or the "oauth_timestamp" and
"oauth_nonce" parameters.

.. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4

r   r   )r
   r   )r]   r^   rs   s      r   sign_plaintextr   C  sD    * ll=.B/) s)
 u||17R88)	r   c                 B    [        UR                  UR                  5      $ r1   )r   r]   r^   r_   s     r   sign_plaintext_with_clientr   f  s    	,,f.J.J	KKr   c                    [        U R                  5      n[        U R                  5      n[	        U R
                  XC5      n[        XQU5      n[        X`R                  5      nU(       d  [        R                  SU5        U$ )a  Verify a HMAC-SHA1 signature.

Per `section 3.4`_ of the spec.

.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4

To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.

.. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2

z,Verify HMAC-SHA1 failed: sig base string: %s)rZ   r)   r.   r$   r   r   r\   r   rs   logdebug)requestr]   r^   norm_paramsr$   r   rs   matchs           r   verify_hmac_sha1r   j  sf      %W^^4+!'++.#%g&9&93L+[9NO)
Y(9(9
:%	II<kJ	,r   c                 p    [        U[        5      (       a  UR                  S5      nU R                  U5      $ )Nrc   )r   bytesrm   prepare_key)r   keystrs     r   r   r     s,    ]]7#F		  r   c                    [        U R                  5      n[        U R                  5      n[	        U R
                  UU5      R                  S5      n[        R                  " U R                  R                  S5      5      n[        5       n[        Xa5      nUR                  XGU5      nU(       d  [        R                  SU5        U$ )a>  Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature.

Per `section 3.4.3`_ of the spec.

Note this method requires the jwt and cryptography libraries.

.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3

To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.

.. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
rc   z+Verify RSA-SHA1 failed: sig base string: %s)rZ   r)   r.   r$   r   r   re   rj   
a2b_base64rs   r   r   verifyr   r   )	r   rsa_public_keyr   r$   messagesigr   rp   	verify_oks	            r   verify_rsa_sha1r     s    " %W^^4+!'++.#!'"5"5s"-//5vg 
G--44W=>#"$##.#jjs+)	II;WE	r   c                 ~    [        X5      n[        X0R                  5      nU(       d  [        R	                  S5        U$ )zVerify a PLAINTEXT signature.

Per `section 3.4`_ of the spec.

.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
zVerify PLAINTEXT failed)r   r   rs   r   r   )r   r]   r^   rs   r   s        r   verify_plaintextr     s3     ]B)
Y(9(9
:%	II'(	,r   r1   )NN)(__doc__
__future__r   r   rj   rh   rf   loggingoauthlib.commonr   r   r   r   r   r
   r    ImportErrorurllib.parseparse	getLogger__name__r   r   r.   rS   rZ   ra   r\   rv   ru   rz   r   r   r   r   r   r   r   r   r   r<   r   r   <module>r      s   ( 9    ( ( " !?DIEr "$#/3"'	~Ba#H6
/Fd8
/Fd 524 FL4!@M  "!"s   B BB