
    *                     $   S r SSKJrJr  SSKrSSKrSSKJr  SSKrSSK	J
r
  SSKJrJrJr  SSKJr   SS	KJr   " S
 S\5      r       SS jrS rSS jrSS jrSS jrS rS r " S S\5      r " S S\5      rg! \ a	    SS	KJr   NTf = f)zoauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module contains methods for adding two types of access tokens to requests.

- Bearer https://tools.ietf.org/html/rfc6750
- MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
    )absolute_importunicode_literalsN)
b2a_base64)common)add_params_to_qsadd_params_to_uriunicode_type   )utils)urlparsec                      ^  \ rS rSrSU 4S jjr\S 5       r\S 5       r\S 5       r\S 5       r	\S 5       r
\S 5       r\S	 5       rS
rU =r$ )OAuth2Token   c                 X  > [         [        U ]  U5        S U l        SU;   a1  US   (       a'  [	        [
        R                  " US   5      5      U l        UbD  [	        [
        R                  " U5      5      U l        U R                  c  U R                  U l        g g U R                  U l        g )Nscope)superr   __init__
_new_scopesetr   scope_to_list
_old_scope)selfparams	old_scope	__class__s      1lib/third_party/oauthlib/oauth2/rfc6749/tokens.pyr   OAuth2Token.__init__   s    	+t%f-DO&VG_E//w@AdoE//	:;do		  // 
!
 do    c                 4    U R                   U R                  :g  $ Nr   r   r   s    r   scope_changedOAuth2Token.scope_changed*   s    ??doo--r   c                 B    [         R                  " U R                  5      $ r    )r   list_to_scoper   r"   s    r   r   OAuth2Token.old_scope.       t//r   c                 ,    [        U R                  5      $ r    )listr   r"   s    r   
old_scopesOAuth2Token.old_scopes2         r   c                 B    [         R                  " U R                  5      $ r    )r   r&   r   r"   s    r   r   OAuth2Token.scope6   r(   r   c                 ,    [        U R                  5      $ r    )r*   r   r"   s    r   scopesOAuth2Token.scopes:   r-   r   c                 F    [        U R                  U R                  -
  5      $ r    )r*   r   r   r"   s    r   missing_scopesOAuth2Token.missing_scopes>       $//122r   c                 F    [        U R                  U R                  -
  5      $ r    )r*   r   r   r"   s    r   additional_scopesOAuth2Token.additional_scopesB   r6   r   r!   r    )__name__
__module____qualname____firstlineno__r   propertyr#   r   r+   r   r1   r4   r8   __static_attributes____classcell__)r   s   @r   r   r      s    ( . . 0 0 ! ! 0 0 ! ! 3 3 3 3r   r   c                    UR                  5       n[        R                  " U5      u  pUR                  5       S:X  a  [        R
                  nO0UR                  5       S:X  a  [        R                  nO[        S5      eU
S:X  aC  U=(       d9    SR                  [        R                  " U	5      [        R                  " 5       5      nO*[        R                  " 5       n[        R                  " 5       n[        U5      u  nnnnnnU(       a	  US-   U-   nOUnUbI  U
S:X  aC  UR                  S5      n[        U" U5      R!                  5       5      SS	 R#                  S5      nOS
n/ nU
S:X  a  UR%                  U5        O"UR%                  W5        UR%                  U5        UR%                  UR                  5       5        UR%                  U5        UR%                  U5        UR%                  U5        U
S:X  a  UR%                  U5        UR%                  U=(       d    S
5        SR'                  U5      S-   n[)        U[*        5      (       a  UR                  S5      n[,        R.                  " UUR                  S5      U5      n[        UR!                  5       5      SS	 R#                  S5      n/ nUR%                  SU -  5        U
S:w  a  UR%                  SW-  5        UR%                  SU-  5        U(       a  UR%                  SU-  5        U(       a  UR%                  SU-  5        UR%                  SU-  5        U=(       d    0 nSR'                  U5      US'   U$ )a  Add an `MAC Access Authentication`_ signature to headers.

Unlike OAuth 1, this HMAC signature does not require inclusion of the
request payload/body, neither does it use a combination of client_secret
and token_secret but rather a mac_key provided together with the access
token.

Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
`extension algorithms`_ are not supported.

Example MAC Authorization header, linebreaks added for clarity

Authorization: MAC id="h480djs93hd8",
                   nonce="1336363200:dj83hs9s",
                   mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="

.. _`MAC Access Authentication`:
https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
.. _`extension algorithms`:
https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1

:param token:
:param uri: Request URI.
:param key: MAC given provided by token endpoint.
:param http_method: HTTP Request method.
:param nonce:
:param headers: Request headers as a dictionary.
:param body:
:param ext:
:param hash_algorithm: HMAC algorithm provided by token endpoint.
:param issue_time: Time when the MAC credentials were issued (datetime).
:param draft: MAC authentication specification version.
:return: headers dictionary with the authorization field added.

hmac-sha-1zhmac-sha-256zunknown hash algorithmr   z{0}:{1}?Nzutf-8 
zMAC id="%s"zts="%s"z
nonce="%s"zbodyhash="%s"zext="%s"zmac="%s"z, Authorization)upperr   host_from_urilowerhashlibsha1sha256
ValueErrorformatgenerate_ager   generate_noncegenerate_timestampr   encoder   digestdecodeappendjoin
isinstancer	   hmacnew)tokenurikeyhttp_methodnonceheadersbodyexthash_algorithm
issue_timedrafthostporthtsschnetpathparqueryfrarequest_uribodyhashbasebase_stringsignheaders                              r   prepare_mac_headerrv   G   s   Z !!#+""3'*$|+A/A
-
..
aZ AY%%:&(=(=(?AE 
	"	"	$B!!#E$,SM!#sD#uc
*u$KK 
%1*;;wD!D'..*+CR077@HH 
$
aZKKKKOKK++k!"++k++d++d
aZKK++ciR		$$&+ \""
**W
C	#{))'2A	6$	DKKM	"3B	'	.	.w	7$&--%&
aZ
MM)b.!--u$%
MM/H,-
MM*s"#--
T!"Mr'!YYv.'/	.r   c                      [        USU 4/5      $ )a  Add a `Bearer Token`_ to the request URI.

Not recommended, use only if client can't use authorization header or body.

http://www.example.com/path?access_token=h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param uri:
access_token)r   )r[   r\   s     r   prepare_bearer_uriry      s     
3>5"9 ;	<<r   c                 ,    U=(       d    0 nSU -  US'   U$ )zAdd a `Bearer Token`_ to the request URI.

Recommended method of passing bearer tokens.

Authorization: Bearer h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param headers:
z	Bearer %srG    )r[   r`   s     r   prepare_bearer_headersr|      s!     Mr'(50'/	.r   c                      [        USU 4/5      $ )zAdd a `Bearer Token`_ to the request body.

access_token=h480djs93hd8

.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

:param token:
:param body:
rx   )r   )r[   ra   s     r   prepare_bearer_bodyr~      s     
$>5"9 ;	<<r   c                 ,    [         R                  " 5       $ )z`
:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:
)r   generate_token)requestrefresh_tokens     r   random_token_generatorr      s     
			  r   c                    ^ ^ UU 4S jnU$ )z
:param private_pem:
c                 @   > TU l         [        R                  " TU 5      $ r    )claimsr   generate_signed_token)r   kwargsprivate_pems    r   signed_token_generator6signed_token_generator.<locals>.signed_token_generator   s    GN''W==r   r{   )r   r   r   s   `` r   r   r      s    
> 
 r   c                     SnSU R                   ;   aH  U R                   R                  S5      R                  5       n[        U5      S:X  a  US   S:X  a  US   nU$ U R                  nU$ )z
Helper function to extract a token from the request header.

:param request: OAuthlib request.
:type request: oauthlib.common.Request
:return: Return the token or None if the Authorization header is malformed.
NrG      r   Bearerr
   )r`   getsplitlenrx   )r   r[   split_headers      r   get_token_from_headerr      sl     %'??&&7==?L
<A,q/X"=1oe 
,   E	,r   c                   *    \ rS rSrSS jrS rS rSrg)	TokenBasei  c                     [        S5      e)N&Subclasses must implement this method.NotImplementedError)r   r   r   s      r   __call__TokenBase.__call__  s    
F
GGr   c                     [        S5      eJ
:param request: OAuthlib request.
:type request: oauthlib.common.Request
r   r   r   r   s     r   validate_requestTokenBase.validate_request      
 F
GGr   c                     [        S5      er   r   r   s     r   estimate_typeTokenBase.estimate_type  r   r   r{   NF)r:   r;   r<   r=   r   r   r   r?   r{   r   r   r   r     s    HHHr   r   c                   @    \ rS rSrSr    S	S jrS
S jrS rS rSr	g)BearerTokeni#  )request_validatortoken_generatorrefresh_token_generator
expires_inNc                     Xl         U=(       d    [        U l        U=(       d    U R                  U l        U=(       d    SU l        g )Ni  )r   r   r   r   r   )r   r   r   r   r   s        r   r   BearerToken.__init__'  s:    
 /*D.DD74#7#7 	  (DDOr   c                 V   SU;   a  [         R                  " S[        5        [        U R                  5      (       a  U R	                  U5      nOU R                  nXAl        U R                  U5      USS.nUR                  b  SR                  UR                  5      US'   U(       aU  UR                  (       a0  U R                  R                  U5      (       d  UR                  US'   OU R                  U5      US'   UR                  UR                  =(       d    0 5        [        U5      $ )z
Create a BearerToken, by default without refresh token.

:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:

save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.r   )rx   r   
token_type r   r   )warningswarnDeprecationWarningcallabler   r   r1   rW   r   r   rotate_refresh_tokenr   updateextra_credentialsr   )r   r   r   r   r   r[   s         r   create_tokenBearerToken.create_token2  s     vmmF

   ??7+j??j# ,,W5 E ~~!xx/eGn


$$99'BB!(!6!6o!%!=!=g!Fo	LL**0b1ur   c                 d    [        U5      nU R                  R                  X!R                  U5      $ )r   )r   r   validate_bearer_tokenr1   )r   r   r[   s      r   r   BearerToken.validate_request]  s2    
 "'*E!!77~~8?A Ar   c                     UR                   R                  SS5      R                  S5      S   S:X  a  gUR                  b  gg)r   rG   rE   r   r   r   	      )r`   r   r   rx   r   s     r   r   BearerToken.estimate_typef  sB    
 ?B/55c:1=I				)r   )r   r   r   r   )NNNNr   )
r:   r;   r<   r=   	__slots__r   r   r   r   r?   r{   r   r   r   r   #  s-    8) "&#'+		))VA
r   r   )NNNrE   rB   Nr   r    )rE   r   ) __doc__
__future__r   r   rK   rY   binasciir   r   oauthlibr   oauthlib.commonr   r   r	   rE   r   r   ImportErrorurllib.parsedictr   rv   ry   r|   r~   r   r   r   objectr   r   r{   r   r   <module>r      s    9      M M $
*3$ *3b "# &2"&od="
=!	 (H H(M) M[  $#$s   B   BB