�
�bl+����dZddlZddlZddlZddlmZddlmZddlm Z ddl
mZmZddl
mZGd �d
e��Z dd
�Zd�Zdd�Zdd�Zdd�Zd�Zd�ZGd�d��ZGd�de��ZdS)z�
oauthlib.oauth2.rfc6749.tokens
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This module contains methods for adding two types of access tokens to requests.
- Bearer https://tools.ietf.org/html/rfc6750
- MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
�N)�
b2a_base64)�urlparse)�common)�add_params_to_qs�add_params_to_uri�)�utilsc���eZdZd
�fd� Zed���Zed���Zed���Zed���Zed���Z ed���Z
ed ���Z�xZS)�OAuth2TokenNc�^��t���|��d|_d|vr4|dr,tt j|d����|_|�=tt j|����|_|j�|j|_dSdS|j|_dS)N�scope)�super�__init__�
_new_scope�setr �
scope_to_list�
_old_scope)�self�params� old_scope� __class__s ��@/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/tokens.pyrzOAuth2Token.__init__s����
������ � � �����f�������!�%�"5�f�W�o�"F�"F�G�G�D�O�� �!�%�"5�i�"@�"@�A�A�D�O���&�#'�/�����'�&�
#�o�D�O�O�O�c�"�|j|jkS�N)rr�rs r�
scope_changedzOAuth2Token.scope_changed&s����$�/�1�1rc�4�tj|j��Sr)r �
list_to_scoperrs rrzOAuth2Token.old_scope*����"�4�?�3�3�3rc�*�t|j��Sr)�listrrs r�
old_scopeszOAuth2Token.old_scopes.����D�O�$�$�$rc�4�tj|j��Sr)r rrrs rr
zOAuth2Token.scope2r rc�*�t|j��Sr)r"rrs r�scopeszOAuth2Token.scopes6r$rc�:�t|j|jz
��Sr)r"rrrs r�missing_scopeszOAuth2Token.missing_scopes:����D�O�d�o�5�6�6�6rc�:�t|j|jz
��Sr)r"rrrs r�additional_scopeszOAuth2Token.additional_scopes>r*rr)
�__name__�
__module__�__qualname__r�propertyrrr#r
r'r)r,�
__classcell__)rs@rrrs��������.�.�.�.�.�.��2�2��X�2��4�4��X�4��%�%��X�%��4�4��X�4��%�%��X�%��7�7��X�7��7�7��X�7�7�7�7�7rr��
hmac-sha-1c�l�|���}tj|��\}}|���dkr
tj}
n4|���dkr
tj}
ntd���|
dkr<|p8d�tj | ��tj����}n&tj��}tj��}t|��\}}}}}}|r |dz|z}n|}|�a|
dkr[|�d��}t|
|�������dd ��d��}nd
}g}|
dkr|�|��n*|�|��|�|��|�|�����|�|��|�|��|�|��|
dkr|�|��|�|pd
��d�|��dz}t)|t*��r|�d��}t-j||�d��|
��}t|�����dd ��d��}g}|�d|z��|
dkr|�d
|z��|�d|z��|r|�d|z��|r|�d|z��|�d|z��|pi}d�|��|d<|S)a_Add an `MAC Access Authentication`_ signature to headers.
Unlike OAuth 1, this HMAC signature does not require inclusion of the
request payload/body, neither does it use a combination of client_secret
and token_secret but rather a mac_key provided together with the access
token.
Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
`extension algorithms`_ are not supported.
Example MAC Authorization header, linebreaks added for clarity
Authorization: MAC id="h480djs93hd8",
nonce="1336363200:dj83hs9s",
mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="
.. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
.. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1
:param token:
:param uri: Request URI.
:param key: MAC given provided by token endpoint.
:param http_method: HTTP Request method.
:param nonce:
:param headers: Request headers as a dictionary.
:param body:
:param ext:
:param hash_algorithm: HMAC algorithm provided by token endpoint.
:param issue_time: Time when the MAC credentials were issued (datetime).
:param draft: MAC authentication specification version.
:return: headers dictionary with the authorization field added.
r3zhmac-sha-256zunknown hash algorithmrz{}:{}�?Nzutf-8���r2�
zMAC id="%s"zts="%s"z
nonce="%s"z
bodyhash="%s"zext="%s"zmac="%s"z, �
Authorization)�upperr �
host_from_uri�lower�hashlib�sha1�sha256�
ValueError�format�generate_ager�generate_nonce�generate_timestampr�encoder�digest�decode�append�join�
isinstance�str�hmac�new)�token�uri�key�http_method�nonce�headers�body�ext�hash_algorithm�
issue_time�draft�host�port�h�ts�sch�net�path�par�query�fra�request_uri�bodyhash�base�base_string�sign�headers r�prepare_mac_headerrhCs���P�#�#�%�%�K��$�S�)�)�J�D�$�������-�-��L��� � � � � �>� 1� 1��N����1�2�2�2���z�z��C�����(:�:�(F�(F�*0�*?�*A�*A�C�C����
&�
(�
(���%�'�'��&.�s�m�m�#�C��d�C������S�j�5�(�������E�Q�J�J��{�{�7�#�#���a�a��g�g�n�n�.�.�/�/����4�;�;�G�D�D������D���z�z����E��������B�������E�����K�K��!�!�#�#�$�$�$��K�K������K�K������K�K�������z�z����H�����K�K�� �r�����)�)�D�/�/�D�(�K��#�s���"��j�j��!�!���8�C��+�+�G�4�4�a�8�8�D��d�k�k�m�m�$�$�S�b�S�)�0�0��9�9�D�
�F�
�M�M�-�%�'�(�(�(���z�z��
�
�i�"�n�%�%�%�
�M�M�,��&�'�'�'��2��
�
�o��0�1�1�1�
�(��
�
�j�3�&�'�'�'�
�M�M�*�t�#�$�$�$��m��G�#�y�y��0�0�G�O���Nrc�(�t|d|fg��S)aAdd a `Bearer Token`_ to the request URI.
Not recommended, use only if client can't use authorization header or body.
http://www.example.com/path?access_token=h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
:param token:
:param uri:
�access_token)r)rMrNs r�prepare_bearer_urirk�s���S�^�U�$;�"=�>�>�>rc��|pi}d|z|d<|S)z�Add a `Bearer Token`_ to the request URI.
Recommended method of passing bearer tokens.
Authorization: Bearer h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
:param token:
:param headers:
z Bearer %sr8�)rMrRs r�prepare_bearer_headersrn�s!���m��G�*�U�2�G�O���Nrc�(�t|d|fg��S)z�Add a `Bearer Token`_ to the request body.
access_token=h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
:param token:
:param body:
rj)r)rMrSs r�prepare_bearer_bodyrp�s���D�^�U�$;�"=�>�>�>rFc�(�tj��S)zp
:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:
)r�generate_token)�request�
refresh_tokens r�random_token_generatorru�s��� �"�"�"rc������fd�}|S)z
:param private_pem:
c�<���|_tj�|��Sr)�claimsr�generate_signed_token)rs�kwargs�private_pems ��r�signed_token_generatorz6signed_token_generator.<locals>.signed_token_generator�s�������+�K��A�A�Arrm)r{rzr|s`` rr|r|�s0����B�B�B�B�B�B�"�!rc��d}d|jvrf|j�d�����}t|��dkr&|d���dkr|d}n|j}|S)z�
Helper function to extract a token from the request header.
:param request: OAuthlib request.
:type request: oauthlib.common.Request
:return: Return the token or None if the Authorization header is malformed.
Nr8�r�bearerr)rR�get�split�lenr;rj)rsrM�split_headers r�get_token_from_headerr��s{��
�E��'�/�)�)���*�*�?�;�;�A�A�C�C���|����!�!�l�1�o�&;�&;�&=�&=��&I�&I� ��O�E���$���Lrc�&�eZdZdZdd�Zd�Zd�ZdS)� TokenBasermFc� �td���)N�&Subclasses must implement this method.��NotImplementedError)rrsrts r�__call__zTokenBase.__call__s��!�"J�K�K�Krc� �td�����b
:param request: OAuthlib request.
:type request: oauthlib.common.Request
r�r��rrss r�validate_requestzTokenBase.validate_request ���
"�"J�K�K�Krc� �td���r�r�r�s r�
estimate_typezTokenBase.estimate_typer�rN�F)r-r.r/� __slots__r�r�r�rmrrr�r�sW�������I�L�L�L�L�L�L�L�L�L�L�L�Lrr�c�2�eZdZdZ dd�Zd d�Zd�Zd�ZdS)
�BearerToken)�request_validator�token_generator�refresh_token_generator�
expires_inNc�^�||_|pt|_|p|j|_|pd|_dS)Ni)r�rur�r�r�)rr�r�r�r�s rrzBearerToken.__init__s=��!2���.�H�2H���#�;�t�';�
�$�%�,�����rFc�
�d|vrtjdt��t|j��r|�|��}n|j}||_|�|��|dd�}|j�d�|j��|d<|rD|jr%|j �
|��s|j|d<n|�|��|d<|�|j
pi��t|��S) z�
Create a BearerToken, by default without refresh token.
:param request: OAuthlib request.
:type request: oauthlib.common.Request
:param refresh_token:
�
save_tokenzx`save_token` has been deprecated, it was not called internally.If you do, call `request_validator.save_token()` instead.�Bearer)rjr��
token_typeN� r
rt)�warnings�warn�DeprecationWarning�callabler�r�r'rHrtr��rotate_refresh_tokenr��update�extra_credentialsr)rrsrtrzr�rMs r�create_tokenzBearerToken.create_token's'���6�!�!��M�V�,�
.�
.�
.��D�O�$�$� )�����1�1�J�J���J�'���!�0�0��9�9�$�"�
�
���>�%� �X�X�g�n�5�5�E�'�N�� O��%�
O��.�C�C�G�L�L�
O�)0�)>��o�&�&�)-�)E�)E�g�)N�)N��o�&�
���W�.�4�"�5�5�5��5�!�!�!rc�b�t|��}|j�||j|��S)r�)r�r��validate_bearer_tokenr')rrsrMs rr�zBearerToken.validate_requestQs5��
&�g�.�.���%�;�;��7�>�7�,�,� ,rc��|j�dd���d��d���dkrdS|j�dSdS) r�r8r2r�rr� N�)rRr�r�r;rjr�s rr�zBearerToken.estimate_typeZsX��
�?�����3�3�9�9�#�>�>�q�A�G�G�I�I�X�U�U��1�
�
!�
-��1��1r)NNNNr�)r-r.r/r�rr�r�r�rmrrr�r�sl�������I�
@D�:>�-�-�-�-�("�("�("�("�T,�,�,�
�
�
�
�
rr�)NNNr2r3Nrr)r2r�)�__doc__r<rKr��binasciir�urllib.parser�oauthlibr�oauthlib.commonrrr2r �dictrrhrkrnrprur|r�r�r�rmrr�<module>r�s�����������������������!�!�!�!�!�!�������?�?�?�?�?�?�?�?�������*7�*7�*7�*7�*7�$�*7�*7�*7�\"�#� ��&2�"&��j�j�j�j�Z?�?�?�
�
�
�
�
?�
?�
?�
?�#�#�#�#�"�"�"����(L�L�L�L�L�L�L�L�*L�L�L�L�L�)�L�L�L�L�Lr |