
    T                        S r SSKrSSKrSSKrSSKrSSKJr  SSKJr  SSKJr  SSKJ	r	  SSKJ
r
  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKr\R$                  R&                  \R$                  R(                  \R$                  R*                  \R$                  R,                  \R$                  R.                  /r " S S\R2                  R4                  5      rS rS rS rS rS r g)a   
Classes and functions to allow google.auth credentials to be used within oauth2client.

In particular, the External Account credentials don't have an equivalent in
oauth2client, so we create helper methods to allow variants of this particular
class to be used in oauth2client workflows.
    N)aws)credentials)
exceptions)external_account) external_account_authorized_user)identity_pool)	pluggable)requests)	constantsc                   6  ^  \ rS rSrSr\" \" \R                  R                  R                  5      S/-   5      r
U 4S jrS r\S 5       r\R                  S 5       r\S 5       r\R                  S	 5       rU 4S
 jr\S 5       r\S 5       r\S 5       rSrU =r$ )WrappedCredentials0   zWA utility class to use Google Auth credentials in place of oauth2client credentials.
  _basec           
        > Xl         [        U[        R                  5      (       a  U R                   R                  nSnSnOm[        U[
        R                  5      (       aC  U R                   R                  nU R                   R                  nU R                   R                  nO[        S5      e[        [        U ]3  U R                   R                  UUUU R                   R                  SSS9  g)zInitializes oauth2client credentials based on underlying Google Auth credentials.

Args:
  external_account_creds: subclass of google.auth.external_account.Credentials
NzInvalid Credentials)access_token	client_idclient_secretrefresh_tokentoken_expiry	token_uri
user_agent)r   
isinstancer   Credentials	_audiencer   r   r   r   	TypeErrorsuperr   __init__tokenexpiry)self
base_credsr   r   r   	__class__s        2platform/gsutil/gslib/utils/wrapped_credentials.pyr   WrappedCredentials.__init__7   s     J*.::;;**&&imm	J @ L L	M	M**&&ijj..mjj..m+,,	
d,$**:J:J7@;H;H:>**:K:K7;8< - >    c                     U R                   R                  [        R                  " 5       5        U R                  b  U R                  R                  U 5        g g N)r   refreshr
   Requeststore
locked_put)r    https     r#   _do_refresh_request&WrappedCredentials._do_refresh_requestQ   s>    JJx'')*zz
jjD! r%   c                 .    U R                   R                  $ r'   r   r   r    s    r#   r   WrappedCredentials.access_tokenV   s    ::r%   c                 $    XR                   l        g r'   r0   r    values     r#   r   r2   Z   s    JJr%   c                 .    U R                   R                  $ r'   r   r   r1   s    r#   r   WrappedCredentials.token_expiry^   s    ::r%   c                 $    XR                   l        g r'   r7   r4   s     r#   r   r8   b   s    JJr%   c                 4  > [         TU ]  5       n[        R                  " U5      n[        R                  " U R
                  R                  5      US'   U R
                  R                  US'   [        U R                  5      US'   [        R                  " U5      $ )zUtility function that creates JSON repr. of a Credentials object.

Returns:
    string, a JSON representation of this instance, suitable to pass to
    from_json().
r   r   r   )r   to_jsonjsonloadscopyr   infor   _parse_expiryr   dumps)r    serialized_datadeserialized_datar"   s      r#   r;   WrappedCredentials.to_jsonf   sw     go'O

?3!%4::??!;g(,

(8(8n%(5d6G6G(Hn%::'((r%   c                 (    [        U5      nU " U5      $ r'   )+_get_external_account_credentials_from_fileclsfilenamecredss      r#   for_external_account'WrappedCredentials.for_external_accountu   s    7AEu:r%   c                 (    [        U5      nU " U5      $ r'   );_get_external_account_authorized_user_credentials_from_filerG   s      r#   $for_external_account_authorized_user7WrappedCredentials.for_external_account_authorized_userz   s    GEu:r%   c                 Z   [         R                  " U5      nUR                  S5      nSnUR                  S5      S:X  a  [        U5      nO UR                  S5      S:X  a  [	        U5      nU " U5      nUR                  S5      Ul        UR                  S5      (       aa  [        US   [        R                  5      (       d?   [        R                  R                  US   [        R                  R                  5      US'   UR                  S5      Ul        U$ ! [         a    SUS'    N)f = f)zInstantiate a Credentials object from a JSON description of it.

The JSON should have been produced by calling .to_json() on the object.

Args:
    data: dict, A deserialized JSON object.

Returns:
    An instance of a Credentials subclass.
r   Ntyper   r   r   r   )r<   r=   get+_get_external_account_credentials_from_info;_get_external_account_authorized_user_credentials_from_infor   r   datetimestrptimeoauth2clientclientEXPIRY_FORMAT
ValueErrorr   )rH   	json_datadatabaser!   rJ   s         r#   	from_jsonWrappedCredentials.from_json   s    ::i D88GDJxx-->tDj	&	?	?N
j
OE.1E  tN+X->->??$'0099 ,"5"5"C"C E^ .1EL  $#^$s   >D D*)D*)r   )__name__
__module____qualname____firstlineno____doc__	frozensetlistrX   rY   OAuth2CredentialsNON_SERIALIZED_MEMBERSr   r-   propertyr   setterr   r;   classmethodrK   rO   r_   __static_attributes____classcell__)r"   s   @r#   r   r   0   s    $
<00GGHi>4"
        )    
    r%   r   c                 ^   U R                  S5      S:X  a"  [        R                  R                  U [        S9$ U R                  S5      bC  U R                  S5      R                  S5      b"  [
        R                  R                  U [        S9$ [        R                  R                  U [        S9$ )Nsubject_token_typez+urn:ietf:params:aws:token-type:aws4_request)scopescredential_source
executable)rS   r   r   	from_infoDEFAULT_SCOPESr	   r   r?   s    r#   rT   rT      s    	XXLM ??$$T.$AA$%1$%)),7C  **4*GG $$..tN.KKr%   c                     [         R                  " U SSS9 n[        R                  " U5      n[	        U5      sS S S 5        $ ! , (       d  f       g = fNrzutf-8)encoding)ioopenr<   loadrT   rI   	json_filer]   s      r#   rF   rF      s6    	wwxw/999YD6t< 0//   !A
Ac                 @    [         R                  R                  U 5      $ r'   )r   r   rt   rv   s    r#   rU   rU      s    	)	5	5	?	?	EEr%   c                     [         R                  " U SSS9 n[        R                  " U5      n[	        U5      sS S S 5        $ ! , (       d  f       g = frx   )r{   r|   r<   r}   rU   r~   s      r#   rN   rN      s6    	wwxw/999YDFtL 0//r   c                     U (       aH  [        U [        R                  5      (       a)  U R                  [        R                  R
                  5      $ g r'   )r   rV   strftimerX   rY   rZ   )r   s    r#   r@   r@      s5    
68#4#455??<..<<==r%   )!re   r>   rV   r{   r<   google.authr   r   r   r   r   r   r	   google.auth.transportr
   gslib.utilsr   rX   ScopesCLOUD_PLATFORMCLOUD_PLATFORM_READ_ONLYFULL_CONTROL	READ_ONLY
READ_WRITEru   rY   rh   r   rT   rF   rU   rN   r@    r%   r#   <module>r      s      	   # " ( 8 % ! * !  ##--!!q,,>> qhL=FMr%   