
    hK                        d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
ZddlZddlZddlmZ ddlmZ dd	lmZ d
ZdZdZdZ e ej        d                                                    Z e ej        d                                                    Z e ej        d                                                    ZdZ eg d          ZdZdZ dZ!dZ" G d dej#        j$        j%                  Z& G d d          Z' G d d          Z( G d  d!e	j)                  Z* G d" d#          Z+ G d$ d%          Z, G d& d'ej-                  Z. G d( d)ej-                  Z/ G d* d+ej0                  Z1 G d, d-ej0                  Z2 G d. d/ej3                  Z4 G d0 d1e4          Z5 G d2 d3e4          Z6dS )4z1Firebase token minting and validation sub module.    N)credentials)iam)jwt)	transport)
exceptions)_auth_utils)_http_clientzhttps://securetoken.google.com/zXhttps://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.comz$https://session.firebase.google.com/zEhttps://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys   )minutes   )days   )hourszYhttps://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit)acramrat_hashaud	auth_timeazpcnfc_hashexpfirebaseiatissjtinbfnoncesubzZhttp://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/emailRS256nonez"firebase-auth-emulator@example.comc                       e Zd ZdZd Zd ZdS )_EmulatedSignerNc                     d S N selfs    ]/var/www/html/e360mart/e360mart_env/lib/python3.11/site-packages/firebase_admin/_token_gen.py__init__z_EmulatedSigner.__init__B   s        c                     dS )Nr+   r&   r(   messages     r)   signz_EmulatedSigner.signE   s    sr+   )__name__
__module____qualname__key_idr*   r/   r&   r+   r)   r#   r#   ?   s7        F      r+   r#   c                       e Zd ZdZefdZed             Zed             Zed             Z	e
d             Ze
d             Ze
d             Zd	S )
_SigningProviderz2Stores a reference to a google.auth.crypto.Signer.c                 0    || _         || _        || _        d S r%   )_signer_signer_email_alg)r(   signersigner_emailalgs       r)   r*   z_SigningProvider.__init__L   s    )			r+   c                     | j         S r%   )r7   r'   s    r)   r:   z_SigningProvider.signerQ   s
    |r+   c                     | j         S r%   )r8   r'   s    r)   r;   z_SigningProvider.signer_emailU   s    !!r+   c                     | j         S r%   )r9   r'   s    r)   r<   z_SigningProvider.algY   s
    yr+   c                 6    t          |j        |j                  S r%   )r5   r:   r;   )clsgoogle_creds     r)   from_credentialz _SigningProvider.from_credential]   s     2K4LMMMr+   c                 N    t          j        |||          }t          ||          S r%   )r   Signerr5   )rA   requestrB   service_accountr:   s        r)   from_iamz_SigningProvider.from_iama   s%    G[/BB888r+   c                 P    t          t                      t          t                    S r%   )r5   r#   AUTH_EMULATOR_EMAILALGORITHM_NONE)rA   s    r)   for_emulatorz_SigningProvider.for_emulatorf   s     1 13FWWWr+   N)r0   r1   r2   __doc__ALGORITHM_RS256r*   propertyr:   r;   r<   classmethodrC   rH   rL   r&   r+   r)   r5   r5   I   s        <<1@    
   X " " X"   X N N [N 9 9 [9 X X [X X Xr+   r5   c                   H    e Zd ZdZdZd	dZd Zed             Zd
dZ	d Z
dS )TokenGeneratorz,Generates custom tokens and session cookies.z)https://identitytoolkit.googleapis.com/v1Nc                     || _         || _        t          j                                        | _        |p| j        }| d|j         | _        d | _	        d S )Nz
/projects/)
apphttp_clientr   requestsRequestrF   ID_TOOLKIT_URL
project_idbase_url_signing_provider)r(   rT   rU   url_override
url_prefixs        r)   r*   zTokenGenerator.__init__p   sY    & )1133!8T%8
%AAAA!%r+   c                    t          j                    rt                                          S | j        j                                        }t          |t          j	        j
        j                  rt                              |          S | j        j                            d          }|r!t                              | j        ||          S t          |t"          j                  rt                              |          S |                     t&          ddi          }|j        dk    r*t+          d|j                                         d          |j                                        }t                              | j        ||          S )zPInitializes a signing provider by following the go/firebase-admin-sign protocol.serviceAccountIdzMetadata-FlavorGoogle)urlheaders   z.Failed to contact the local metadata service: .)r   is_emulatedr5   rL   rT   
credentialget_credential
isinstancegoogleoauth2rG   CredentialsrC   optionsgetrH   rF   r   SigningMETADATA_SERVICE_URLstatus
ValueErrordatadecode)r(   rB   rG   resps       r)   _init_signing_providerz%TokenGenerator._init_signing_providerx   s^   "$$ 	3#00222h)88::k6=#@#LMM 	A#33K@@@ (*../ABB 	Y#,,T\;XXX k;#677 	A#33K@@@ || 4?PRZ>[|\\;#VAQAQASASVVVX X X)**,,(({OTTTr+   c                     | j         sF	 |                                 | _         n+# t          $ r}d}t          d| d| d          |d}~ww xY w| j         S )z@Initializes and returns the SigningProvider instance to be used.z@https://firebase.google.com/docs/auth/admin/create-custom-tokensz%Failed to determine service account: z. Make sure to initialize the SDK with service account credentials or specify a service account ID with iam.serviceAccounts.signBlob permission. Please refer to z, for more details on creating custom tokens.N)r[   ru   	Exceptionrq   )r(   errorra   s      r)   signing_providerzTokenGenerator.signing_provider   s     % 		EE)-)D)D)F)F&& E E EX 9E 9 9PS9 9 9: : @E	EE %%s   # 
AAAc                 $   |t          |t                    st          d          t          |                                          t
          z  }|rUt          |          dk    rdd                    |           d}ndd                    |           d}t          |          |r(t          |t                    rt          |          d	k    rt          d
          | j	        }t          t          j                              }|j        |j        t          |||t          z   d}|r||d<   |||d<   d|j        i}		 t!          j        |j        ||	          S # t&          j        j        j        $ r}
d|
 }t/          ||
          |
d}
~
ww xY w)z.Builds and signs a Firebase custom auth token.Nz%developer_claims must be a dictionaryr   zDeveloper claims z, z& are reserved and cannot be specified.zDeveloper claim z% is reserved and cannot be specified.   z2uid must be a string between 1 and 128 characters.)r   r   r   uidr   r   	tenant_idclaimsr<   )headerzFailed to sign custom token. )rh   dictrq   setkeysRESERVED_CLAIMSlenjoinstrry   inttimer;   FIREBASE_AUDIENCEMAX_TOKEN_LIFETIME_SECONDSr<   r   encoder:   ri   authr   TransportErrorTokenSignError)r(   r|   developer_claimsr}   disallowed_keyserror_messagery   nowpayloadr   rx   msgs               r)   create_custom_tokenz"TokenGenerator.create_custom_token   s   '.55 J !HIII!"2"7"7"9"9::_LO 	0''!++%DIIo,F,F % % % "M
%499_+E+E % % % " !/// 	S*S#.. 	S#c((S..QRRR0$)++#0#0$33
 
  	-#,GK ' 0GH)-.	8:.5wvNNNN{%4 	8 	8 	89%99C e,,%7	8s   ?E F4F

Fc                 |   t          |t                    r|                    d          n|}t          |t                    r|st	          d| d          t          |t
          j                  r!t          |                                          }t          |t                    st          |t                    st	          d| d          |t          k     rt	          d| dt           d          |t          k    rt	          d| dt           d          | j         d	}||d
}	 | j                            d||          \  }}n0# t          j        j        $ r}t%          j        |          d}~ww xY w|r|                    d          st%          j        d|          |                    d          S )z4Creates a session cookie from the provided ID token.utf-8zIllegal ID token provided: z&. ID token must be a non-empty string.zIllegal expiry duration: rd   z. Duration must be at least z	 seconds.z. Duration must be at most z:createSessionCookie)idTokenvalidDurationpost)jsonNsessionCookiez Failed to create session cookie.)http_response)rh   bytesrs   r   rq   datetime	timedeltar   total_secondsbool#MIN_SESSION_COOKIE_DURATION_SECONDS#MAX_SESSION_COOKIE_DURATION_SECONDSrZ   rU   body_and_responserV   r   RequestExceptionr   handle_auth_backend_errorrm   UnexpectedResponseError)r(   id_token
expires_inra   r   body	http_resprx   s           r)   create_session_cookiez$TokenGenerator.create_session_cookie   s@   /9(E/J/JX8??7+++PX(C(( 	` 	`^h^^^` ` ` j("455 	9Z557788Jj$'' 	Hz*c/J/J 	HFFFFGGG;;;BJ B B6B B BC C C ;;;BJ B B6B B BC C C 444'
 
	?".@@SZ@[[OD))"3 	? 	? 	?7>>>	? 	M488O44 	M52)M M M Mxx(((s   + E E9 E44E9r%   )NN)r0   r1   r2   rM   rX   r*   ru   rO   ry   r   r   r&   r+   r)   rR   rR   k   s        66@N& & & &U U U: & & X&*8 *8 *8 *8Z )  )  )  )  )r+   rR   c                   N    e Zd ZdZddZed             Zed             Zd	dZdS )
CertificateFetchRequestzyA google-auth transport that supports HTTP cache-control.

    Also injects a timeout to each outgoing HTTP request.
    Nc                     t          j        t          j                              | _        t
          j                            | j                  | _        || _	        d S r%   )
cachecontrolCacheControlrV   Session_sessionr   rW   session	_delegate_timeout_seconds)r(   timeout_secondss     r)   r*   z CertificateFetchRequest.__init__   sE    $1(2B2D2DEE"+33DLAA /r+   c                     | j         S r%   )r   r'   s    r)   r   zCertificateFetchRequest.session   s
    }r+   c                     | j         S r%   )r   r'   s    r)   r   z'CertificateFetchRequest.timeout_seconds  s    $$r+   GETc                 :    |p| j         } | j        |f||||d|S )N)methodr   rb   timeout)r   r   )r(   ra   r   r   rb   r   kwargss          r)   __call__z CertificateFetchRequest.__call__  sI    1T1t~WT7GW WOUW W 	Wr+   r%   )r   NNN)	r0   r1   r2   rM   r*   rO   r   r   r   r&   r+   r)   r   r      s         
0 0 0 0
   X % % X%W W W W W Wr+   r   c                   (    e Zd ZdZd ZddZddZdS )TokenVerifierz'Verifies ID tokens and session cookies.c           
      V   |j                             dt          j                  }t	          |          | _        t          |j        dddt          t          t          j        t                    | _        t          |j        dddt          t          t           t"                    | _        d S )NhttpTimeoutzID tokenzverify_id_token()z<https://firebase.google.com/docs/auth/admin/verify-id-tokens)rY   
short_name	operationdoc_urlcert_urlissuerinvalid_token_errorexpired_token_errorzsession cookiezverify_session_cookie())rl   rm   r	   DEFAULT_TIMEOUT_SECONDSr   rF   _JWTVerifierrY   ID_TOKEN_CERT_URIID_TOKEN_ISSUER_PREFIXr   InvalidIdTokenErrorExpiredIdTokenErrorid_token_verifierCOOKIE_CERT_URICOOKIE_ISSUER_PREFIXInvalidSessionCookieErrorExpiredSessionCookieErrorcookie_verifier)r(   rT   r   s      r)   r*   zTokenVerifier.__init__  s    +//-1UVV.w77!-~*)R&) + ? 3"5 "5 "5  ,~2B/R$' 9 9 ;  ;  ;r+   r   c                 D    | j                             || j        |          S r%   )r   verifyrF   )r(   r   clock_skew_secondss      r)   verify_id_tokenzTokenVerifier.verify_id_token$  s     %,,Xt|EWXXXr+   c                 D    | j                             || j        |          S r%   )r   r   rF   )r(   cookier   s      r)   verify_session_cookiez#TokenVerifier.verify_session_cookie'  s     #**64<ASTTTr+   Nr   )r0   r1   r2   rM   r*   r   r   r&   r+   r)   r   r     s[        11; ; ;(Y Y Y YU U U U U Ur+   r   c                   &    e Zd ZdZd ZddZd ZdS )r   z6Verifies Firebase JWTs (ID tokens or session cookies).c                 &   |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        | j        d                                         dv rd	| j         | _        nd
| j         | _        |                     d          | _	        |                     d          | _
        d S )NrY   r   r   r   r   r   r   aeiouzan za r   r   )poprY   r   r   ra   r   r   lowerarticled_short_name_invalid_token_error_expired_token_error)r(   r   s     r)   r*   z_JWTVerifier.__init__.  s     **\22 **\22K00::i((

:..jj**?1##%%00'>T_'>'>D$$'=DO'='=D$$*JJ/D$E$E!$*JJ/D$E$E!!!r+   r   c           
      p   t          |t                    r|                    d          n|}t          |t                    r|s#t	          d| j         d| d| j         d          | j        st	          d| j         d          |dk     s|d	k    rt	          d
| d          |                     |          \  }}|	                    d          }|	                    d          }|	                    d          }| j
        | j        z   }	d| j         d}
d| j         d| j         d}t          j                    }d}|t          k    r| j         d| j         d}nX|s~|	                    d          si|	                    d          dk    rD|	                    d          dk    r+d|	                    di           v r| j         d| j         d}nd| j         d}n|s=|	                    d          d k    r$d| j         d!|	                    d           d"| }n|| j        k    rd| j         d#| j         d$| d"|
 d%| 
}nr||	k    rd| j         d&|	 d$| d"|
 d%| 
}nU|t          |t                    sd| j         d'| }n0|sd| j         d(| }n t!          |          d)k    rd| j         d*| }|r|                     |          	 |r|}n3t$          j        j                            ||| j        | j        |+          }|d         |d<   |S # t$          j        j        j        $ r$}t5          t          |          |,          |d}~wt          $ r^}d-t          |          v r$|                     t          |          |,          |                     t          |          |,          d}~ww xY w).z5Verifies the signature and data for the provided JWT.r   zIllegal z provided: z. z must be a non-empty string.zfFailed to ascertain project ID from the credential or the environment. Project ID is required to call z. Initialize the app with a credentials.Certificate or set your Firebase project ID as an app option. Alternatively set the GOOGLE_CLOUD_PROJECT environment variable.r   <   z"Illegal clock_skew_seconds value: z&. Must be between 0 and 60, inclusive.r   r   r   zMake sure the z[ comes from the same Firebase project as the service account used to authenticate this SDK.zSee z  for details on how to retrieve rd   Nz	 expects z, but was given a custom token.kidr<   HS256vr|   dz&, but was given a legacy custom token.z	Firebase z has no "kid" claim.r    z4 has incorrect algorithm. Expected "RS256" but got "z". z1 has incorrect "aud" (audience) claim. Expected "z" but got " z/ has incorrect "iss" (issuer) claim. Expected "z has no "sub" (subject) claim. z, has an empty string "sub" (subject) claim. r{   z9 has a "sub" (subject) claim longer than 128 characters. )rF   audience	certs_urlclock_skew_in_secondscausezToken expired)rh   r   r   r   rq   r   rY   r   _decode_unverifiedrm   r   ra   r   re   r   r   r   r   ri   rj   r   verify_tokenr   r   r   r   CertificateFetchErrorr   )r(   tokenrF   r   r   r   r   r   subjectexpected_issuerproject_id_match_msgverify_id_token_msgemulatedr   verified_claimsrx   s                   r)   r   z_JWTVerifier.verify<  sy   )3E3)?)?JW%%%U%'' 	%u 	%$4? $ $u $ $ $ $ $% % %  	TS*..S S ST T T !!%7"%<%<5G         11%88U##;;u%%++e$$+75T_ 5 5 5 	 P48OOT_OOO 	 *,,(((>  D,D    M   	6&**U"3"3  	6zz%  G++1 11 1"'7;;sB+?+?"?"?~ $ $0H $ $ $  !RDO Q Q Q 	6fjj//7::@DO @ @JJu%%@ @*=@ @ M (()DO ) )O) )08) )=Q) )&) ) M &&)DO ) )#) )06) );O) )&) ) M _Jw$<$<_aDOaaL_aa M 	6)DO ) )&) ) M \\C5DO 5 525 5   	;++M:::	E >")"(-"8"E"E#!_"m*< #F #> #> &5U%;OE"""{%4 	L 	L 	L'E

%@@@eK 	E 	E 	E#e**,,//E

%/HHH++CJJe+DDD	Es&   AL N5+M

N5AN00N5c                     	 t          j        |          }t          j        |d          }||fS # t          $ r)}|                     t          |          |          d }~ww xY w)NF)r   r   )r   decode_headerrs   rq   r   r   )r(   r   r   r   rx   s        r)   r   z_JWTVerifier._decode_unverified  sx    	E&u--Fju555G7?" 	E 	E 	E++CJJe+DDD	Es   -0 
A#$AA#Nr   )r0   r1   r2   rM   r*   r   r   r&   r+   r)   r   r   +  s]        @@F F F]E ]E ]E ]E~E E E E Er+   r   c                       e Zd ZdZd ZdS )r   z7Unexpected error while signing a Firebase custom token.c                 H    t           j                            | ||           d S r%   r   UnknownErrorr*   r(   r.   r   s      r)   r*   zTokenSignError.__init__  #    ((w>>>>>r+   Nr0   r1   r2   rM   r*   r&   r+   r)   r   r     s)        AA? ? ? ? ?r+   r   c                       e Zd ZdZd ZdS )r   zHFailed to fetch some public key certificates required to verify a token.c                 H    t           j                            | ||           d S r%   r  r  s      r)   r*   zCertificateFetchError.__init__  r  r+   Nr  r&   r+   r)   r   r     s)        RR? ? ? ? ?r+   r   c                       e Zd ZdZd ZdS )r   z!The provided ID token is expired.c                 H    t           j                            | ||           d S r%   r   r   r*   r  s      r)   r*   zExpiredIdTokenError.__init__  s#    '00wFFFFFr+   Nr  r&   r+   r)   r   r     s.        ++G G G G Gr+   r   c                       e Zd ZdZd ZdS )RevokedIdTokenErrorz'The provided ID token has been revoked.c                 F    t           j                            | |           d S r%   r  r-   s     r)   r*   zRevokedIdTokenError.__init__  s!    '00w?????r+   Nr  r&   r+   r)   r  r    s.        11@ @ @ @ @r+   r  c                       e Zd ZdZddZdS )r   z;The provided string is not a valid Firebase session cookie.Nc                 H    t           j                            | ||           d S r%   )r   InvalidArgumentErrorr*   r  s      r)   r*   z"InvalidSessionCookieError.__init__  s#    '00wFFFFFr+   r%   r  r&   r+   r)   r   r     s4        EEG G G G G Gr+   r   c                       e Zd ZdZd ZdS )r   z'The provided session cookie is expired.c                 >    t                               | ||           d S r%   r   r*   r  s      r)   r*   z"ExpiredSessionCookieError.__init__  s     !**4%@@@@@r+   Nr  r&   r+   r)   r   r     s.        11A A A A Ar+   r   c                       e Zd ZdZd ZdS )RevokedSessionCookieErrorz-The provided session cookie has been revoked.c                 <    t                               | |           d S r%   r  r-   s     r)   r*   z"RevokedSessionCookieError.__init__  s    !**499999r+   Nr  r&   r+   r)   r  r    s)        77: : : : :r+   r  )7rM   r   r   r   rV   google.authr   r   r   r   google.auth.exceptionsri   google.oauth2.id_tokengoogle.oauth2.service_accountfirebase_adminr   r   r	   r   r   r   r   r   r   r   r   r   r   r   r   r   ro   rN   rK   rJ   r   cryptrE   r#   r5   rR   rW   r   r   r   r  r   r   r   r   r  r  r   r   r  r&   r+   r)   <module>r     sR   8 7        # # # # # #             ! ! ! ! ! !         $ $ $ $ % % % % % % & & & & & & ' ' ' ' ' ' ; >  > Y&)c*<(*<Q*G*G*G*U*U*W*W&X&X #&)c*<(*<"*E*E*E*S*S*U*U&V&V # !S!3!3!!<!<!<!J!J!L!LMM C #     9  ;     fk'.   X X X X X X X XDF) F) F) F) F) F) F) F)RW W W W Wi/ W W W2U U U U U U U U<vE vE vE vE vE vE vE vEr? ? ? ? ?Z, ? ? ?? ? ? ? ?J3 ? ? ?G G G G G+9 G G G@ @ @ @ @+9 @ @ @G G G G G
 ? G G GA A A A A 9 A A A: : : : : 9 : : : : :r+   