
    )                         S r SSKJrJr  SSKrSSKrSSKrSSKJr  SSK	J
r
Jr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  \R,                  " \5      r " S S\
5      rg)zoauthlib.oauth2.rfc6749.endpoint.metadata ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

An implementation of the `OAuth 2.0 Authorization Server Metadata`.

.. _`OAuth 2.0 Authorization Server Metadata`:
https://tools.ietf.org/html/rfc8414
    )absolute_importunicode_literalsN   )unicode_type   )BaseEndpointcatch_errors_and_unavailability)AuthorizationEndpoint)IntrospectEndpoint)TokenEndpoint)RevocationEndpoint   )grant_typesc                   p    \ rS rSrSr0 S4S jr\   SS j5       r    SS jrS r	S	 r
S
 rS rS rSrg)MetadataEndpoint   a  OAuth2.0 Authorization Server Metadata endpoint.

This specification generalizes the metadata format defined by
`OpenID Connect Discovery 1.0` in a way that is compatible
with OpenID Connect Discovery while being applicable to a wider set
of OAuth 2.0 use cases.  This is intentionally parallel to the way
that OAuth 2.0 Dynamic Client Registration Protocol [`RFC7591`_]
generalized the dynamic client registration mechanisms defined by
OpenID Connect Dynamic Client Registration 1.0
in a way that is compatible with it.

.. _`OpenID Connect Discovery 1.0`:
https://openid.net/specs/openid-connect-discovery-1_0.html
.. _`RFC7591`: https://tools.ietf.org/html/rfc7591
Tc                     [        U[        5      (       d   eU H  n[        U[        5      (       a  M   e   [        R                  " U 5        X0l        Xl        X l        U R                  5       U l        g )N)	
isinstancedictr   __init__raise_errors	endpointsinitial_claimsvalidate_metadata_serverclaims)selfr   r   r   endpoints        =lib/third_party/oauthlib/oauth2/rfc6749/endpoints/metadata.pyr   MetadataEndpoint.__init__+   sc    fd####,////  $$N //1DK    Nc                 P    SS0nU[         R                  " U R                  5      S4$ )zCreate metadata responsezContent-Typezapplication/json   )jsondumpsr   )r   urihttp_methodbodyheaderss        r   create_metadata_response)MetadataEndpoint.create_metadata_response6   s)     12GDJJt{{+S00r    c                    U R                   (       d  g X!;  a"  U(       a  [        SR                  U5      5      eg U(       ak  X   R                  S5      (       d  [        SR                  X!U   5      5      eSX   ;   d  SX   ;   d  SX   ;   a  [        SR                  X!U   5      5      eg U(       a6  X   R                  S5      (       d  [        S	R                  X!U   5      5      eg U(       as  [	        X   [
        5      (       d  [        S
R                  X!U   5      5      eX    H6  n[	        U[        5      (       a  M  [        SR                  X!U   U5      5      e   g g )Nzkey {} is a mandatory metadata.httpszkey {}: {} must be an HTTPS URL?&#z8key {}: {} must not contain query or fragment componentshttpzkey {}: {} must be an URLzkey {}: {} must be an Arrayz/array {}: {} must contains only string (not {}))r   
ValueErrorformat
startswithr   listr   )r   arraykeyis_requiredis_listis_url	is_issuerelems           r   validate_metadata"MetadataEndpoint.validate_metadata@   s\    
	:AA#FGG 
 
Z""7++:AAs  		
	cUZ/3%*3DFMM3Z!" 	" 4E
 
Z""6**4;;CsLMM + 

D))6==c:NOO*$$--?FFSz4)* *  
r    c                     U R                   R                  UR                   R                  5       5        UR                  SSS/5        U R	                  USSS9  U R	                  USSS9  U R	                  USSSS9  g	)
z
If the token endpoint is used in the grant type, the value of this
parameter MUST be the same as the value of the "grant_type"
parameter passed to the token endpoint defined in the grant type
definition.
%token_endpoint_auth_methods_supportedclient_secret_postclient_secret_basicTr8   0token_endpoint_auth_signing_alg_values_supportedtoken_endpointr7   r9   N)_grant_typesextendkeys
setdefaultr<   r   r   r   s      r   validate_metadata_token(MetadataEndpoint.validate_metadata_tokend   s     	X22779:
=+-BCE 	7  G:   	 d4  Ar    c           
         UR                  S[        [        S UR                  R	                  5       5      5      5        UR                  SSS/5        SUS   ;   a  U R
                  R                  S5        U R                  USSSS	9  U R                  USSS
9  SUS   ;   a  UR                  S   n[        U[        R                  5      (       d  [        US5      (       a  UR                  nUR                  S[        UR                  R	                  5       5      5        U R                  USSS
9  U R                  USSSS9  g )Nresponse_types_supportedc                     U S:g  $ )Nnone )xs    r   <lambda>BMetadataEndpoint.validate_metadata_authorization.<locals>.<lambda>{   s    a6kr    response_modes_supportedqueryfragmenttokenimplicitT)r7   r8   rB   codedefault_grant code_challenge_methods_supportedauthorization_endpointrE   )rI   r4   filter_response_typesrH   rF   appendr<   r   r   AuthorizationCodeGranthasattrr[   _code_challenge_methods)r   r   r   
code_grants       r   validate_metadata_authorization0MetadataEndpoint.validate_metadata_authorizationx   s[   
"V)8+C+C+H+H+JKLN 07J2GH
 &344
z**d  L6#=tL233++F3j
#::< <@G&A9 A9--
:Z??DDFGI

4d  D(d4  Ir    c                     UR                  SSS/5        U R                  USSS9  U R                  USSS9  U R                  USSSS9  g )	N*revocation_endpoint_auth_methods_supportedr@   rA   TrB   5revocation_endpoint_auth_signing_alg_values_supportedrevocation_endpointrE   rI   r<   rJ   s      r   validate_metadata_revocation-MetadataEndpoint.validate_metadata_revocation   sw    
B+-BCE 	<d  L?   	%4  Fr    c                     UR                  SSS/5        U R                  USSS9  U R                  USSS9  U R                  USSSS9  g )	N-introspection_endpoint_auth_methods_supportedr@   rA   TrB   8introspection_endpoint_auth_signing_alg_values_supportedintrospection_endpointrE   rk   rJ   s      r   validate_metadata_introspection0MetadataEndpoint.validate_metadata_introspection   sw    
E+-BCE 	?  OB   	(d4  Ir    c                    [         R                  " U R                  5      nU R                  USSSS9  U R                  USSS9  U R                  USSS9  U R                  USSS9  U R                  US	SS9  U R                  US
SS9  U R                  USSS9  / U l        U R
                   H  n[        U[        5      (       a  U R                  X5        [        U[        5      (       a  U R                  X5        [        U[        5      (       a  U R                  X5        [        U[        5      (       d  M  U R                  X5        M     UR                  SU R                  5        U R                  USSS9  U$ )aL  
 Authorization servers can have metadata describing their
 configuration.  The following authorization server metadata values
 are used by this specification. More details can be found in
 `RFC8414 section 2`_ :

issuer
   REQUIRED

authorization_endpoint
   URL of the authorization server's authorization endpoint
   [`RFC6749#Authorization`_].  This is REQUIRED unless no grant types
   are supported
   that use the authorization endpoint.

token_endpoint
   URL of the authorization server's token endpoint [`RFC6749#Token`_].
   This
   is REQUIRED unless only the implicit grant type is supported.

scopes_supported
   RECOMMENDED.

response_types_supported
   REQUIRED.

* Other OPTIONAL fields:
jwks_uri
registration_endpoint
response_modes_supported

grant_types_supported
   OPTIONAL.  JSON array containing a list of the OAuth 2.0 grant
   type values that this authorization server supports.  The array
   values used are the same as those used with the "grant_types"
   parameter defined by "OAuth 2.0 Dynamic Client Registration
   Protocol" [`RFC7591`_].  If omitted, the default value is
   "["authorization_code", "implicit"]".

token_endpoint_auth_methods_supported

token_endpoint_auth_signing_alg_values_supported

service_documentation

ui_locales_supported

op_policy_uri

op_tos_uri

revocation_endpoint

revocation_endpoint_auth_methods_supported

revocation_endpoint_auth_signing_alg_values_supported

introspection_endpoint

introspection_endpoint_auth_methods_supported

introspection_endpoint_auth_signing_alg_values_supported

code_challenge_methods_supported

Additional authorization server metadata parameters MAY also be used.
Some are defined by other specifications, such as OpenID Connect
Discovery 1.0 [`OpenID.Discovery`_].

 .. _`RFC8414 section 2`: https://tools.ietf.org/html/rfc8414#section-2
 .. _`RFC6749#Authorization`:
 https://tools.ietf.org/html/rfc6749#section-3.1
 .. _`RFC6749#Token`: https://tools.ietf.org/html/rfc6749#section-3.2
 .. _`RFC7591`: https://tools.ietf.org/html/rfc7591
 .. _`OpenID.Discovery`:
 https://openid.net/specs/openid-connect-discovery-1_0.html
 issuerT)r7   r:   jwks_uri)r9   scopes_supportedrB   service_documentationui_locales_supportedop_policy_uri
op_tos_urigrant_types_supported)copydeepcopyr   r<   rF   r   r   r   rK   r
   re   r   rl   r   rr   rI   rJ   s      r   r   )MetadataEndpoint.validate_metadata_server   sj   \ ]]4../F68N6:d;6#5tD6#:4H6#94H6?4@6<=DNN	Hm	,	,$$V6	H3	4	4,,V>	H0	1	1))&;	H0	1	1,,V> # -t/@/@A6#:DIMr    )rF   r   r   r   r   )GETNN)FFFF)__name__
__module____qualname____firstlineno____doc__r   r	   r)   r<   rK   re   rl   rr   r   __static_attributes__rQ   r    r   r   r      sd      (* 	2 # ,1$('+	1 #1 %* %$"'"*HA(I:FIfr    r   )r   
__future__r   r   r}   r#   loggingcommonr   baser   r	   authorizationr
   
introspectr   rX   r   
revocationr    r   	getLoggerr   logr   rQ   r    r   <module>r      sK    9    # ? 0 *   * !{| {r    