OXIESEC PANEL
- Current Dir:
/
/
opt
/
gsutil
/
gslib
/
vendored
/
oauth2client
/
oauth2client
/
__pycache__
Server IP: 2a02:4780:11:1594:0:ef5:22d7:a
Upload:
Create Dir:
Name
Size
Modified
Perms
📁
..
-
02/11/2025 08:19:48 AM
rwxr-xr-x
📄
__init__.cpython-39.pyc
585 bytes
02/11/2025 08:19:48 AM
rw-r--r--
📄
_helpers.cpython-39.pyc
9.94 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
_openssl_crypt.cpython-39.pyc
4.16 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
_pkce.cpython-39.pyc
1.68 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
_pure_python_crypt.cpython-39.pyc
5.97 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
_pycrypto_crypt.cpython-39.pyc
3.91 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
client.cpython-39.pyc
66.44 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
clientsecrets.cpython-39.pyc
4.07 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
crypt.cpython-39.pyc
6.15 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
service_account.cpython-39.pyc
21.45 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
tools.cpython-39.pyc
7.86 KB
02/11/2025 08:19:48 AM
rw-r--r--
📄
transport.cpython-39.pyc
7.8 KB
02/11/2025 08:19:48 AM
rw-r--r--
Editing: service_account.cpython-39.pyc
Close
a ��a2n � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZ ddlmZ ddlm Z ddlm Z dZ dZ d Z G d d � d ej�Zd d � ZG dd� de�ZdS )z/oauth2client Service account credentials class.� N)�_helpers)�client)�crypt)� transport� notasecret�_private_key_pkcs12a This library only implements PKCS#12 support via the pyOpenSSL library. Either install pyOpenSSL, or please convert the .p12 file to .pem format: $ cat key.p12 | \ > openssl pkcs12 -nodes -nocerts -passin pass:notasecret | \ > openssl rsa > key.pem c s. e Zd ZdZdZedg�ejjB ZdZ dZ dZ dddde j e jf� fdd� Zd(� fdd � Zed)d d ��Zed*d d ��Zed+dd��Zedde j e jfdd��Zedde j e jfdd��Zedde j e jfdd��Zdd� Zdd� Zedd� �Zed d � �Z ed d � �Z d d!� Z d"d#� Z d$d%� Z d&d'� Z!� Z"S ),�ServiceAccountCredentialsa� Service Account credential for OAuth 2.0 signed JWT grants. Supports * JSON keyfile (typically contains a PKCS8 key stored as PEM text) * ``.p12`` key (stores PKCS12 key and certificate) Makes an assertion to server using a signed JWT assertion in exchange for an access token. This credential does not require a flow to instantiate because it represents a two legged flow, and therefore has all of the required information to generate and refresh its own access tokens. Args: service_account_email: string, The email associated with the service account. signer: ``crypt.Signer``, A signer which can be used to sign content. scopes: List or string, (Optional) Scopes to use when acquiring an access token. private_key_id: string, (Optional) Private key identifier. Typically only used with a JSON keyfile. Can be sent in the header of a JWT token assertion. client_id: string, (Optional) Client ID for the project that owns the service account. user_agent: string, (Optional) User agent to use when sending request. token_uri: string, URI for token endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. revoke_uri: string, URI for revoke endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. kwargs: dict, Extra key-value pairs (both strings) to send in the payload body when making an assertion. � �_signerN� c sL t t| �jd |||d� || _|| _t�|�| _|| _|| _ || _ | | _ d S )N)� user_agent� token_uri� revoke_uri) �superr �__init__�_service_account_emailr r �scopes_to_string�_scopes�_private_key_id� client_id� _user_agent�_kwargs) �self�service_account_email�signer�scopes�private_key_idr r r r �kwargs�� __class__� �G/opt/gsutil/gslib/vendored/oauth2client/oauth2client/service_account.pyr _ s � z"ServiceAccountCredentials.__init__c sH |du rt � | j�}|�t�}|dur4t�|�|t< tt| �j||d�S )ac Utility function that creates JSON repr. of a credentials object. Over-ride is needed since PKCS#12 keys will not in general be JSON serializable. Args: strip: array, An array of names of members to exclude from the JSON. to_serialize: dict, (Optional) The properties for this object that will be serialized. This allows callers to modify before serializing. Returns: string, a JSON representation of this instance, suitable to pass to from_json(). N)� to_serialize) �copy�__dict__�get� _PKCS12_KEY�base64� b64encoder r �_to_json)r �stripr" � pkcs12_valr r r! r) v s �z"ServiceAccountCredentials._to_jsonc C s� |� d�}|tjkr$td|dtj��|d }|d }|d }|d } |sV|� dtj�}|sh|� d tj�}tj� |�} | || ||| ||d �} || _ | S ) a Helper for factory constructors from JSON keyfile. Args: keyfile_dict: dict-like object, The parsed dictionary-like object containing the contents of the JSON keyfile. scopes: List or string, Scopes to use when acquiring an access token. token_uri: string, URI for OAuth 2.0 provider token endpoint. If unset and not present in keyfile_dict, defaults to Google's endpoints. revoke_uri: string, URI for OAuth 2.0 provider revoke endpoint. If unset and not present in keyfile_dict, defaults to Google's endpoints. Returns: ServiceAccountCredentials, a credentials object created from the keyfile contents. Raises: ValueError, if the credential type is not :data:`SERVICE_ACCOUNT`. KeyError, if one of the expected keys is not present in the keyfile. �typezUnexpected credentials typeZExpected� client_email� private_keyr r r r )r r r r r ) r% r �SERVICE_ACCOUNT� ValueError� oauth2client�GOOGLE_TOKEN_URI�GOOGLE_REVOKE_URIr �Signer� from_string�_private_key_pkcs8_pem) �cls� keyfile_dictr r r Z creds_typer �private_key_pkcs8_pemr r r � credentialsr r r! �_from_parsed_json_keyfile� s2 ��� �z3ServiceAccountCredentials._from_parsed_json_keyfilec C sF t |d��}t�|�}W d � n1 s*0 Y | j||||d�S )a� Factory constructor from JSON keyfile by name. Args: filename: string, The location of the keyfile. scopes: List or string, (Optional) Scopes to use when acquiring an access token. token_uri: string, URI for OAuth 2.0 provider token endpoint. If unset and not present in the key file, defaults to Google's endpoints. revoke_uri: string, URI for OAuth 2.0 provider revoke endpoint. If unset and not present in the key file, defaults to Google's endpoints. Returns: ServiceAccountCredentials, a credentials object created from the keyfile. Raises: ValueError, if the credential type is not :data:`SERVICE_ACCOUNT`. KeyError, if one of the expected keys is not present in the keyfile. �rN�r r )�open�json�loadr; )r7 �filenamer r r �file_obj�client_credentialsr r r! �from_json_keyfile_name� s (�z0ServiceAccountCredentials.from_json_keyfile_namec C s | j ||||d�S )a Factory constructor from parsed JSON keyfile. Args: keyfile_dict: dict-like object, The parsed dictionary-like object containing the contents of the JSON keyfile. scopes: List or string, (Optional) Scopes to use when acquiring an access token. token_uri: string, URI for OAuth 2.0 provider token endpoint. If unset and not present in keyfile_dict, defaults to Google's endpoints. revoke_uri: string, URI for OAuth 2.0 provider revoke endpoint. If unset and not present in keyfile_dict, defaults to Google's endpoints. Returns: ServiceAccountCredentials, a credentials object created from the keyfile. Raises: ValueError, if the credential type is not :data:`SERVICE_ACCOUNT`. KeyError, if one of the expected keys is not present in the keyfile. r= )r; )r7 r8 r r r r r r! �from_json_keyfile_dict� s �z0ServiceAccountCredentials.from_json_keyfile_dictc C sP |du r t }tjtjur tt��tj�||�}| |||||d�}||_||_|S )ax Factory constructor from JSON keyfile. Args: service_account_email: string, The email associated with the service account. private_key_pkcs12: string, The contents of a PKCS#12 keyfile. private_key_password: string, (Optional) Password for PKCS#12 private key. Defaults to ``notasecret``. scopes: List or string, (Optional) Scopes to use when acquiring an access token. token_uri: string, URI for token endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. revoke_uri: string, URI for revoke endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. Returns: ServiceAccountCredentials, a credentials object created from the keyfile. Raises: NotImplementedError if pyOpenSSL is not installed / not the active crypto library. N)r r r ) �_PASSWORD_DEFAULTr r4 � OpenSSLSigner�NotImplementedError� _PKCS12_ERRORr5 r �_private_key_password) r7 r �private_key_pkcs12�private_key_passwordr r r r r: r r r! �_from_p12_keyfile_contents� s ��z4ServiceAccountCredentials._from_p12_keyfile_contentsc C sH t |d��}|�� }W d � n1 s(0 Y | j||||||d�S )ap Factory constructor from JSON keyfile. Args: service_account_email: string, The email associated with the service account. filename: string, The location of the PKCS#12 keyfile. private_key_password: string, (Optional) Password for PKCS#12 private key. Defaults to ``notasecret``. scopes: List or string, (Optional) Scopes to use when acquiring an access token. token_uri: string, URI for token endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. revoke_uri: string, URI for revoke endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. Returns: ServiceAccountCredentials, a credentials object created from the keyfile. Raises: NotImplementedError if pyOpenSSL is not installed / not the active crypto library. �rbN�rL r r r )r> �readrM ) r7 r rA rL r r r rB rK r r r! �from_p12_keyfile* s &�z*ServiceAccountCredentials.from_p12_keyfilec C s |� � }| j||||||d�S )a� Factory constructor from JSON keyfile. Args: service_account_email: string, The email associated with the service account. file_buffer: stream, A buffer that implements ``read()`` and contains the PKCS#12 key contents. private_key_password: string, (Optional) Password for PKCS#12 private key. Defaults to ``notasecret``. scopes: List or string, (Optional) Scopes to use when acquiring an access token. token_uri: string, URI for token endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. revoke_uri: string, URI for revoke endpoint. For convenience defaults to Google's endpoints but any OAuth 2.0 provider can be used. Returns: ServiceAccountCredentials, a credentials object created from the keyfile. Raises: NotImplementedError if pyOpenSSL is not installed / not the active crypto library. rO )rP rM )r7 r Z file_bufferrL r r r rK r r r! �from_p12_keyfile_bufferP s �z1ServiceAccountCredentials.from_p12_keyfile_bufferc C sH t t�� �}tj| j||| j | jd�}|�| j� t j | j || j d�S )z8Generate the assertion that will be used in the request.)�aud�scope�iat�exp�iss��key_id) �int�timer1 r2 r �MAX_TOKEN_LIFETIME_SECSr �updater r �make_signed_jwtr r )r �now�payloadr r r! �_generate_assertionu s � �z-ServiceAccountCredentials._generate_assertionc C s | j | j�|�fS )aU Cryptographically sign a blob (of bytes). Implements abstract method :meth:`oauth2client.client.AssertionCredentials.sign_blob`. Args: blob: bytes, Message to be signed. Returns: tuple, A pair of the private key ID used to sign the blob and the signed contents. )r r �sign)r �blobr r r! � sign_blob� s z#ServiceAccountCredentials.sign_blobc C s | j S )z�Get the email for the current service account. Returns: string, The email associated with the service account. )r �r r r r! r � s z/ServiceAccountCredentials.service_account_emailc C s d| j | j| j| jd�S )N�service_account)r, r- r r. r )r r r6 r re r r r! �serialization_data� s �z,ServiceAccountCredentials.serialization_datac C s t |t�st�t�|��}d}|�t�}d}|du rJ|d }tj � |�}n t � |�}|d }tj � ||�}| |d |f|d |d |d |d d �|d ��}|dur�||_ |dur�||_|dur�||_|d |_|d |_|d |_|d |_|�dd�}|du�rtj�|tj�|_|S )aM Deserialize a JSON-serialized instance. Inverse to :meth:`to_json`. Args: json_data: dict or string, Serialized JSON (as a string or an already parsed dictionary) representing a credential. Returns: ServiceAccountCredentials from the serialized data. Nr6 rJ r r r r r �r r r r r �invalid� access_tokenr r � token_expiry)� isinstance�dictr? �loadsr � _from_bytesr% r& r r4 r5 r' � b64decoder6 r rJ ri rj r r �datetime�strptimer � EXPIRY_FORMATrk )r7 � json_datar9 r+ �passwordr r: rk r r r! � from_json� sL ��� �z#ServiceAccountCredentials.from_jsonc C s | j S )N)r re r r r! �create_scoped_required� s z0ServiceAccountCredentials.create_scoped_requiredc C sV | j | j| jf|| j| j| jd�| j��}| j|_| j|_| j |_ | j |_ | j |_ |S )Nrh ) r r r r r r r r r r6 r rJ )r r �resultr r r! � create_scoped� s ���z'ServiceAccountCredentials.create_scopedc C sj t | j�}|�|� | j| j| jf| j| j| j| j d�|��}| j |_ | j |_ | j |_ | j |_ | j|_|S )a< Create credentials that specify additional claims. Args: claims: dict, key-value pairs for claims. Returns: ServiceAccountCredentials, a copy of the current service account credentials with updated claims to use when obtaining access tokens. rh )rm r r] r r r r r r r r r r6 r rJ )r ZclaimsZ new_kwargsrx r r r! �create_with_claims� s$ ���z,ServiceAccountCredentials.create_with_claimsc C s | � d|i�S )aY Create credentials that act as domain-wide delegation of authority. Use the ``sub`` parameter as the subject to delegate on behalf of that user. For example:: >>> account_sub = 'foo@email.com' >>> delegate_creds = creds.create_delegated(account_sub) Args: sub: string, An email address that this service account will act on behalf of (via domain-wide delegation). Returns: ServiceAccountCredentials, a copy of the current service account updated to act on behalf of ``sub``. �sub)rz )r r{ r r r! �create_delegated s z*ServiceAccountCredentials.create_delegated)N)NN)r NN)r NN)#�__name__� __module__� __qualname__�__doc__r\ � frozensetr �AssertionCredentials�NON_SERIALIZED_MEMBERSr6 r rJ r1 r2 r3 r r) � classmethodr; rD rE rM rQ rR ra rd �propertyr rg rv rw ry rz r| � __classcell__r r r r! r * sn &��� � 1 � � � *� %� $ 6r c C s& t � ddd�}| | }|jd |j S )Ni� � i�Q )rq �days�seconds)Zutc_timeZepoch� time_deltar r r! �_datetime_to_secs s r� c s� e Zd ZdZdZddddejejdf� fdd� Zdd� Z ddd �Z d d � Z d d � Z ejejfdd�Z dd� Zdd� Zddd�Z� ZS )�_JWTAccessCredentialsz�Self signed JWT credentials. Makes an assertion to server using a self signed JWT from service account credentials. These credentials do NOT use OAuth 2.0 and instead authenticate directly. r Nc s6 | d u r i } t t| �j||f|||||d�| �� d S )N)r r r r r )r r� r ) r r r r r r r r r �additional_claimsr r r! r 2 s ���z _JWTAccessCredentials.__init__c C s t �| |� |S )a� Authorize an httplib2.Http instance with a JWT assertion. Unless specified, the 'aud' of the assertion will be the base uri of the request. Args: http: An instance of ``httplib2.Http`` or something that acts like it. Returns: A modified instance of http that was passed in. Example:: h = httplib2.Http() h = credentials.authorize(h) )r �wrap_http_for_jwt_access�r �httpr r r! � authorizeH s z _JWTAccessCredentials.authorizec C sX |du r6| j du s| jr"| �d� tj| j | �� d�S | �|�\}}tj|| jd�S dS )z�Create a signed jwt. Args: http: unused additional_claims: dict, additional claims to add to the payload of the JWT. Returns: An AccessTokenInfo with the signed jwt N)rj � expires_in)rj �access_token_expired�refreshr �AccessTokenInfo� _expires_in� _create_token�_MAX_TOKEN_LIFETIME_SECS)r r� r� �token� unused_expiryr r r! �get_access_tokenZ s ��z&_JWTAccessCredentials.get_access_tokenc C s dS )z*Cannot revoke JWTAccessCredentials tokens.Nr r� r r r! �revokeo s z _JWTAccessCredentials.revokec C s dS )NTr re r r r! rw s s z,_JWTAccessCredentials.create_scoped_requiredc C sf t | j| jf|| j| j| j||d�| j��}| jd ur>| j|_| jd urP| j|_| j d urb| j |_ |S )N)r r r r r r ) r r r r r r r r6 r rJ )r r r r rx r r r! ry w s& ��� z#_JWTAccessCredentials.create_scopedc C s | � d� dS )z�Refreshes the access_token. The HTTP object is unused since no request needs to be made to get a new token, it can just be generated locally. Args: http: unused HTTP object N)�_refreshr� r r r! r� � s z _JWTAccessCredentials.refreshc C s | � � \| _| _dS )zXRefreshes the access_token. Args: http: unused HTTP object N)r� rj rk r� r r r! r� � s z _JWTAccessCredentials._refreshc C sx t �� }tj| jd�}|| }t|�t|�| j| jd�}|�| j� |d urV|�|� t j | j || j d�}|� d�|fS )N)r� )rU rV rW r{ rX �ascii)r �_UTCNOWrq � timedeltar� r� r r] r r r^ r r �decode)r r� r_ Zlifetime�expiryr` �jwtr r r! r� � s � �z#_JWTAccessCredentials._create_token)NN)N)r} r~ r r� r� r1 r2 r3 r r� r� r� rw ry r� r� r� r� r r r r! r� ( s( � � r� )r� r' r# rq r? r[ r1 r r r r rF r& rI r� r r� r� r r r r! �<module> s& y