
    i                        d Z ddlZddlmZ ddlZddlmZ ddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ddlmZ ej        ej        ej        ej        hZd	gZ eed
          r ej                    rde	j         Zn
de	j         Zde dZedz   Zedz   Zedz   Zedz   Zde dZde dZde dZ G d de
j                   Z dS )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)_mtls_helperz#https://www.googleapis.com/auth/iamcheck_use_client_certziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenzG/v1/projects/-/serviceAccounts/{service_account_email}/allowedLocationsz>/v1/locations/global/workforcePools/{pool_id}/allowedLocationsz_/v1/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/allowedLocationsc                   p    e Zd ZdZd Zd Zed             Z ej	        e
j                  d             ZdS )Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 0    || _         || _        || _        dS )a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   service_account_emails       P/usr/local/lib/hermes-agent/venv/lib/python3.11/site-packages/google/auth/iam.py__init__zSigner.__init__P   s!       '&;###    c                 (   t          j        |          }d}t                              t          j        | j        j                                      | j	                  }ddi}t          j        dt          j        |                              d          i                              d          }t!          j                    }|D ]}| j                            | j        |||           |                     ||||          }|j        t*          v rL|j        t,          j        k    r,t1          j        d                    |j                            t          j        |j                            d                    c S t1          j        d          )	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestzSigner._make_signing_requestd   ss   #G,, ((/1B1R
 

&,
-
- 	 "#56z(1188AAB
 

&// 	 '9;; 	= 	=A,,T]FCQQQ}}V$PW}XXH/11+.00 /<CCHMRR   :hm227;;<<<<<'(MNNNr   c                     dS )zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        N )r   s    r   key_idzSigner.key_id   s	     tr   c                 `    |                      |          }t          j        |d                   S )N
signedBlob)r6   r%   	b64decode)r   r2   r5   s      r   signzSigner.sign   s+    --g66 6777r   N)__name__
__module____qualname____doc__r   r6   propertyr9   r   copy_docstringr   r   r=   r8   r   r   r   r   E   s         < < <(O O O<   X XU\**8 8 +*8 8 8r   r   )!rA   r%   http.clientclientr-   r#   google.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr,   
_IAM_SCOPEhasattrr	   r    _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINT9_SERVICE_ACCOUNT_REGIONAL_ACCESS_BOUNDARY_LOOKUP_ENDPOINT8_WORKFORCE_POOL_REGIONAL_ACCESS_BOUNDARY_LOOKUP_ENDPOINT@_WORKLOAD_IDENTITY_POOL_REGIONAL_ACCESS_BOUNDARY_LOOKUP_ENDPOINTr   r8   r   r   <module>rV      s     ! ! ! ! ! !  , , , , , ,             # # # # # #       " " " " " " . . . . . . %#	 44
 GL122J**,,J
 O)LNNKKIK$GIIK L;KKK  66"[0 %
2 %(::  =^{  =^  =^  =^ 9 <Tk  <T  <T  <T 8 Dk  D  D  D @J8 J8 J8 J8 J8U\ J8 J8 J8 J8 J8r   