
    *                        d Z ddlmZmZ ddlZddlZddlmZ ddlZddl	m
Z
 ddlmZmZmZ ddlmZ 	 dd	lmZ  G d
 de      Z	 	 	 	 	 	 	 ddZd ZddZddZddZd Zd Z G d de      Z G d de      Zy# e$ r	 dd	lmZ Y Ow xY w)zoauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module contains methods for adding two types of access tokens to requests.

- Bearer https://tools.ietf.org/html/rfc6750
- MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
    )absolute_importunicode_literalsN)
b2a_base64)common)add_params_to_qsadd_params_to_uriunicode_type   )utils)urlparsec                        e Zd Zd	 fd	Zed        Zed        Zed        Zed        Zed        Z	ed        Z
ed        Z xZS )
OAuth2Tokenc                 B   t         t        |   |       d | _        d|v r+|d   r&t	        t        j                  |d               | _        |Bt	        t        j                  |            | _        | j                  | j                  | _        y y | j                  | _        y )Nscope)superr   __init__
_new_scopesetr   scope_to_list
_old_scope)selfparams	old_scope	__class__s      1lib/third_party/oauthlib/oauth2/rfc6749/tokens.pyr   zOAuth2Token.__init__   s    	+t%f-DO&VG_E//w@AdoE//	:;do		  // 
!
 do    c                 4    | j                   | j                  k7  S N)r   r   r   s    r   scope_changedzOAuth2Token.scope_changed*   s    ??doo--r   c                 @    t        j                  | j                        S r   )r   list_to_scoper   r   s    r   r   zOAuth2Token.old_scope.       t//r   c                 ,    t        | j                        S r   )listr   r   s    r   
old_scopeszOAuth2Token.old_scopes2         r   c                 @    t        j                  | j                        S r   )r   r"   r   r   s    r   r   zOAuth2Token.scope6   r#   r   c                 ,    t        | j                        S r   )r%   r   r   s    r   scopeszOAuth2Token.scopes:   r'   r   c                 F    t        | j                  | j                  z
        S r   )r%   r   r   r   s    r   missing_scopeszOAuth2Token.missing_scopes>       $//122r   c                 F    t        | j                  | j                  z
        S r   )r%   r   r   r   s    r   additional_scopeszOAuth2Token.additional_scopesB   r-   r   r   )__name__
__module____qualname__r   propertyr    r   r&   r   r*   r,   r/   __classcell__)r   s   @r   r   r      s    ( . . 0 0 ! ! 0 0 ! ! 3 3 3 3r   r   c                 Z   |j                         }t        j                  |      \  }}|j                         dk(  rt        j
                  }n/|j                         dk(  rt        j                  }nt        d      |
dk(  r<|xs7 dj                  t        j                  |	      t        j                               }n(t        j                         }t        j                         }t        |      \  }}}}}}|r	|dz   |z   }n|}|H|
dk(  rC|j                  d      }t         ||      j!                               dd	 j#                  d      }nd
}g }|
dk(  r|j%                  |       n"|j%                         |j%                  |       |j%                  |j                                |j%                  |       |j%                  |       |j%                  |       |
dk(  r|j%                  |       |j%                  |xs d
       dj'                  |      dz   }t)        |t*              r|j                  d      }t-        j.                  ||j                  d      |      }t        |j!                               dd	 j#                  d      }g }|j%                  d| z         |
dk7  r|j%                  dz         |j%                  d|z         |r|j%                  d|z         |r|j%                  d|z         |j%                  d|z         |xs i }dj'                  |      |d<   |S )ag  Add an `MAC Access Authentication`_ signature to headers.

    Unlike OAuth 1, this HMAC signature does not require inclusion of the
    request payload/body, neither does it use a combination of client_secret
    and token_secret but rather a mac_key provided together with the access
    token.

    Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
    `extension algorithms`_ are not supported.

    Example MAC Authorization header, linebreaks added for clarity

    Authorization: MAC id="h480djs93hd8",
                       nonce="1336363200:dj83hs9s",
                       mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="

    .. _`MAC Access Authentication`:
    https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
    .. _`extension algorithms`:
    https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1

    :param token:
    :param uri: Request URI.
    :param key: MAC given provided by token endpoint.
    :param http_method: HTTP Request method.
    :param nonce:
    :param headers: Request headers as a dictionary.
    :param body:
    :param ext:
    :param hash_algorithm: HMAC algorithm provided by token endpoint.
    :param issue_time: Time when the MAC credentials were issued (datetime).
    :param draft: MAC authentication specification version.
    :return: headers dictionary with the authorization field added.
    
hmac-sha-1zhmac-sha-256zunknown hash algorithmr   z{0}:{1}?Nzutf-8 
zMAC id="%s"zts="%s"z
nonce="%s"zbodyhash="%s"zext="%s"zmac="%s"z, Authorization)upperr   host_from_urilowerhashlibsha1sha256
ValueErrorformatgenerate_ager   generate_noncegenerate_timestampr   encoder   digestdecodeappendjoin
isinstancer	   hmacnew)tokenurikeyhttp_methodnonceheadersbodyexthash_algorithm
issue_timedrafthostporthtsschnetpathparqueryfrarequest_uribodyhashbasebase_stringsignheaders                              r   prepare_mac_headerrj   G   s   Z !!#+""3'*$|+A/A
-
..
aZ AY%%:&(=(=(?AE 
	"	"	$B!!#E$,SM!#sD#uc
*u$KK 
%1*;;wD!D'..*+CR077@HH 
$
aZKKKKOKK++k!"++k++d++d
aZKK++ciR		$$&+ \"
**W
C	#{))'2A	6$	DKKM	"3B	'	.	.w	7$&--%&
aZ
MM)b.!--u$%
MM/H,-
MM*s"#--
T!"Mr'!YYv.'/	.r   c                      t        |d| fg      S )a  Add a `Bearer Token`_ to the request URI.

    Not recommended, use only if client can't use authorization header or body.

    http://www.example.com/path?access_token=h480djs93hd8

    .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

    :param token:
    :param uri:
    access_token)r   )rO   rP   s     r   prepare_bearer_urirm      s     
3>5"9 ;	<<r   c                 "    |xs i }d| z  |d<   |S )zAdd a `Bearer Token`_ to the request URI.

    Recommended method of passing bearer tokens.

    Authorization: Bearer h480djs93hd8

    .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

    :param token:
    :param headers:
    z	Bearer %sr;    )rO   rT   s     r   prepare_bearer_headersrp      s!     Mr'(50'/	.r   c                      t        |d| fg      S )zAdd a `Bearer Token`_ to the request body.

    access_token=h480djs93hd8

    .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750

    :param token:
    :param body:
    rl   )r   )rO   rU   s     r   prepare_bearer_bodyrr      s     
$>5"9 ;	<<r   c                 *    t        j                         S )zp
    :param request: OAuthlib request.
    :type request: oauthlib.common.Request
    :param refresh_token:
    )r   generate_token)requestrefresh_tokens     r   random_token_generatorrw      s     
			  r   c                       fd}|S )z
    :param private_pem:
    c                 >    | _         t        j                  |       S r   )claimsr   generate_signed_token)ru   kwargsprivate_pems    r   signed_token_generatorz6signed_token_generator.<locals>.signed_token_generator   s    GN''W==r   ro   )r}   r|   r~   s   `` r   r~   r~      s    
> 
 r   c                     d}d| j                   v rF| j                   j                  d      j                         }t        |      dk(  r|d   dk(  r|d   }|S | j                  }|S )z
    Helper function to extract a token from the request header.

    :param request: OAuthlib request.
    :type request: oauthlib.common.Request
    :return: Return the token or None if the Authorization header is malformed.
    Nr;      r   Bearerr
   )rT   getsplitlenrl   )ru   rO   split_headers      r   get_token_from_headerr      sl     %'??&&7==?L
<A,q/X"=1oe 
,   E	,r   c                        e Zd ZddZd Zd Zy)	TokenBasec                     t        d      )N&Subclasses must implement this method.NotImplementedError)r   ru   rv   s      r   __call__zTokenBase.__call__  s    
F
GGr   c                     t        d      b
        :param request: OAuthlib request.
        :type request: oauthlib.common.Request
        r   r   r   ru   s     r   validate_requestzTokenBase.validate_request      
 F
GGr   c                     t        d      r   r   r   s     r   estimate_typezTokenBase.estimate_type  r   r   NF)r0   r1   r2   r   r   r   ro   r   r   r   r     s    HHHr   r   c                   4    e Zd ZdZ	 	 	 	 ddZddZd Zd Zy)	BearerToken)request_validatortoken_generatorrefresh_token_generator
expires_inNc                 p    || _         |xs t        | _        |xs | j                  | _        |xs d| _        y )Ni  )r   rw   r   r   r   )r   r   r   r   r   s        r   r   zBearerToken.__init__'  s<    
 /D*D.DD74#7#7 	  (DDOr   c                    d|v rt        j                  dt               t        | j                        r| j	                  |      }n| j                  }||_        | j                  |      |dd}|j                  dj                  |j                        |d<   |rK|j                  r+| j                  j                  |      s|j                  |d<   n| j                  |      |d<   |j                  |j                  xs i        t        |      S )z
        Create a BearerToken, by default without refresh token.

        :param request: OAuthlib request.
        :type request: oauthlib.common.Request
        :param refresh_token:
        
save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.r   )rl   r   
token_type r   rv   )warningswarnDeprecationWarningcallabler   r   r*   rK   rv   r   rotate_refresh_tokenr   updateextra_credentialsr   )r   ru   rv   r|   r   rO   s         r   create_tokenzBearerToken.create_token2  s     vmmF

  ??7+j??j#G ,,W5 E ~~!xx/eGn


$$99'B!(!6!6o!%!=!=g!Fo	LL**0b1ur   c                 f    t        |      }| j                  j                  ||j                  |      S )r   )r   r   validate_bearer_tokenr*   )r   ru   rO   s      r   r   zBearerToken.validate_request]  s4    
 "'*E!!77w~~8?A Ar   c                     |j                   j                  dd      j                  d      d   dk(  ry|j                  yy)r   r;   r9   r   r   r   	      )rT   r   r   rl   r   s     r   r   zBearerToken.estimate_typef  sB    
 ?B/55c:1=I				)r   )NNNNr   )r0   r1   r2   	__slots__r   r   r   r   ro   r   r   r   r   #  s-    8) "&#'+		))VA
r   r   )NNNr9   r6   Nr   r   )r9   r   ) __doc__
__future__r   r   r?   rM   binasciir   r   oauthlibr   oauthlib.commonr   r   r	   r9   r   r   ImportErrorurllib.parsedictr   rj   rm   rp   rr   rw   r~   r   objectr   r   ro   r   r   <module>r      s    9      M M $
*3$ *3b "# &2"&od="
=!	 (H H(M) M[  $#$s   A< <B
	B
