
    xiv                        d Z ddlZddlmZ ddlZddlZddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ddlmZ ddlmZ ej                  ej                   ej"                  ej$                  hZd	gZ eed
      r ej,                         Zn$ ej0                  dd      j3                         dk(  Zerde
j4                   Znde
j4                   Zde dZedz   Zedz   Zedz   Zedz   Z  G d dejB                        Z!y)zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)mtlsz#https://www.googleapis.com/auth/iamshould_use_client_cert!GOOGLE_API_USE_CLIENT_CERTIFICATEfalsetrueziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                   p    e Zd ZdZd Zd Zed        Z ej                  e
j                        d        Zy)Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 .    || _         || _        || _        y)a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   service_account_emails       [/var/www/html/chatbot/card-advisor-bot/venv/lib/python3.12/site-packages/google/auth/iam.py__init__zSigner.__init__S   s       '&;#    c                 ^   t        j                  |      }d}t        j                  t        j
                  | j                  j                        j                  | j                        }ddi}t        j                  dt        j                  |      j                  d      i      j                  d      }t!        j"                         }|D ]  }| j                  j%                  | j&                  |||       | j'                  ||||      }|j(                  t*        v rS|j(                  t,        j.                  k7  r.t1        j2                  dj                  |j4                              t        j6                  |j4                  j                  d            c S  t1        j2                  d      )	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestzSigner._make_signing_requestg   sb   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99; 	=A,,T]]FCQ}}V$PW}XH/1+..0 //<CCHMMR  ::hmm227;<<	= ''(MNNr   c                      y)zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        N )r   s    r   key_idzSigner.key_id   s     r   c                 T    | j                  |      }t        j                  |d         S )N
signedBlob)r9   r(   	b64decode)r   r5   r8   s      r   signzSigner.sign   s(    --g6 677r   N)__name__
__module____qualname____doc__r   r9   propertyr<   r   copy_docstringr   r   r@   r;   r   r   r   r   H   sK    <(O<   XU\\*8 +8r   r   )"rD   r(   http.clientclientr0   r&   osgoogle.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr/   
_IAM_SCOPEhasattrr	   use_client_certgetenvlowerr#   _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr!   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr   r;   r   r   <module>rZ      s!    !  	 ,   #  " & %%##	 44
 4)*1d113O 			5w?EEG6Q  ()L)L(MNK#K$G$G#HIK ;-'JK  66"[0 %
2 %(:: J8U\\ J8r   