
    Y                         S r SSKrSSKJr  SSKrSSKJr  SSKJr  SSKJ	r	  Sr
\
S-   r " S S	\R                  5      rg)
zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_helpers)crypt)
exceptionsz(https://iamcredentials.googleapis.com/v1z0/projects/-/serviceAccounts/{}:signBlob?alt=jsonc                   x    \ rS rSrSrS rS r\S 5       r\	R                  " \R                  5      S 5       rSrg)	Signer#   a  Signs messages using the IAM `signBlob API`_.

This is useful when you need to sign bytes but do not have access to the
credential's private key file.

.. _signBlob API:
    https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
    /signBlob
c                 (    Xl         X l        X0l        g)au  
Args:
    request (google.auth.transport.Request): The object used to make
        HTTP requests.
    credentials (google.auth.credentials.Credentials): The credentials
        that will be used to authenticate the request to the IAM API.
        The credentials must have of one the following scopes:

        - https://www.googleapis.com/auth/iam
        - https://www.googleapis.com/auth/cloud-platform
    service_account_email (str): The service account email identifying
        which service account to use to sign bytes. Often, this can
        be the same as the service account email in the given
        credentials.
N)_request_credentials_service_account_email)selfrequestcredentialsservice_account_emails       *platform/bq/third_party/google/auth/iam.py__init__Signer.__init__.   s       '&;#    c                 r   [         R                  " U5      nSn[        R                  U R                  5      nSS0n[
        R                  " S[        R                  " U5      R                  S5      05      R                  S5      nU R                  R                  U R                  X#U5        U R                  X2XTS9nUR                  [        R                   :w  a/  ["        R$                  " SR                  UR&                  5      5      e[
        R(                  " UR&                  R                  S5      5      $ )z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {})r   to_bytes_SIGN_BLOB_URIformatr   jsondumpsbase64	b64encodedecodeencoder   before_requestr
   statushttp_clientOKr   TransportErrordataloads)r   messager   r   r   r   responses          r   _make_signing_requestSigner._make_signing_requestB   s    ##G,##D$?$?@!#56zz((188AB

&/ 	 	((WM==Sd=T??knn,++8??N  zz(--..w788r   c                     g)zOptional[str]: The key ID used to identify this private key.

.. warning::
   This is always ``None``. The key ID used by IAM can not
   be reliably determined ahead of time.
N )r   s    r   key_idSigner.key_idW   s     r   c                 V    U R                  U5      n[        R                  " US   5      $ )N
signedBlob)r.   r!   	b64decode)r   r,   r-   s      r   signSigner.signa   s(    --g6 677r   )r   r
   r   N)__name__
__module____qualname____firstlineno____doc__r   r.   propertyr2   r   copy_docstringr   r   r7   __static_attributes__r1   r   r   r   r   #   sH    <(9*   U\\*8 +8r   r   )r=   r!   http.clientclientr'   r   google.authr   r   r   _IAM_API_ROOT_URIr   r   r1   r   r   <module>rE      sA      !     "> "%WWA8U\\ A8r   