-Gj:BdZddlZddlmZddlZddlZddlmZddlm Z ddlm Z ddlm Z ddl m Z dd Z dd Zdd Zdd Z ddZddZ ddZ ddZdS)aOAuth 2.0 async client. This is a client for interacting with an OAuth 2.0 authorization server's token endpoint. For more information about the token endpoint, see `Section 3.1 of rfc6749`_ .. _Section 3.1 of rfc6749: https://tools.ietf.org/html/rfc6749#section-3.2 N)_exponential_backoff)_helpers) exceptions)jwt)_clientFTcK|r6dtji}tj|d}n@dtji}t j|d}|rd ||d<i}d}tj } | D]} |d|||d{V} | d{V} t| d r| dn| } tj| }n#t $r| }YnwxYw| jt$jkrd |dfcStj| j| }|r|sd||fcSd||fS) aMakes a request to the OAuth 2.0 authorization server's token endpoint. This function doesn't throw on response errors. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorizations server's token endpoint URI. body (Mapping[str, str]): The parameters to send in the request body. access_token (Optional(str)): The access token needed to make the request. use_json (Optional(bool)): Use urlencoded format or json format for the content type. The default value is False. can_retry (bool): Enable or disable request retry behavior. Returns: Tuple(bool, Mapping[str, str], Optional[bool]): A boolean indicating if the request is successful, a mapping for the JSON-decoded response data and in the case of an error a boolean indicating if the error is retryable. z Content-Typeutf-8z Bearer {} AuthorizationFPOST)methodurlheadersbodyNdecodeT status_code response_data)client_JSON_CONTENT_TYPEjsondumpsencode_URLENCODED_CONTENT_TYPEurllibparse urlencodeformatrExponentialBackoffcontenthasattrrloads ValueErrorstatus http_clientOK _can_retry)request token_urir access_tokenuse_json can_retryrrretryable_errorretries_responseresponse_body1 response_bodys c/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/google/oauth2/_client_async.py _token_endpoint_request_no_throwr3&s.<!6#<=z$&&w//!6#BC|%%d++227;;D#.#5#5l#C#C MO"577G 99 y'          (//11111111~x00 N ! !' * * *   * J}55MM * * *)MMM * ?kn , ,, , , , + }    9 9-8 8 8 8 9 - 00sD D+*D+cvKt||||||d{V\}}}|stj|||S)a=Makes a request to the OAuth 2.0 authorization server's token endpoint. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorizations server's token endpoint URI. body (Mapping[str, str]): The parameters to send in the request body. access_token (Optional(str)): The access token needed to make the request. use_json (Optional(bool)): Use urlencoded format or json format for the content type. The default value is False. can_retry (bool): Enable or disable request retry behavior. Returns: Mapping[str, str]: The JSON-decoded response data. Raises: google.auth.exceptions.RefreshError: If the token endpoint returned an error. )r)r*r+N)r3r_handle_error_response) r'r(rr)r*r+response_status_okrr,s r2_token_endpoint_requestr7ks|8/ !         F%m_EEE cK|tjd}t||||d{V} |d}n,#t$r}t jd|d}||d}~wwxYwtj|} || |fS)aImplements the JWT Profile for OAuth 2.0 Authorization Grants. For more details, see `rfc7523 section 4`_. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorizations server's token endpoint URI. assertion (str): The OAuth 2.0 assertion. can_retry (bool): Enable or disable request retry behavior. Returns: Tuple[str, Optional[datetime], Mapping[str, str]]: The access token, expiration, and additional data returned by the token endpoint. Raises: google.auth.exceptions.RefreshError: If the token endpoint returned an error. .. _rfc7523 section 4: https://tools.ietf.org/html/rfc7523#section-4  assertion grant_typer+Nr)zNo access token in response.F retryable)r_JWT_GRANT_TYPEr7KeyErrorr RefreshError _parse_expiry) r'r(r;r+rrr) caught_excnew_excexpirys r2 jwt_grantrGs.#&2H I ID1DIM&$^4 &&&) *MU   :% &  !- 0 0F  ..5 AAAc,K|tjd}t||||d{V} |d}n,#t$r}t jd|d}||d}~wwxYwt j|d} tj | d } || |fS) a:Implements the JWT Profile for OAuth 2.0 Authorization Grants, but requests an OpenID Connect ID Token instead of an access token. This is a variant on the standard JWT Profile that is currently unique to Google. This was added for the benefit of authenticating to services that require ID Tokens instead of access tokens or JWT bearer tokens. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorization server's token endpoint URI. assertion (str): JWT token signed by a service account. The token's payload must include a ``target_audience`` claim. can_retry (bool): Enable or disable request retry behavior. Returns: Tuple[str, Optional[datetime], Mapping[str, str]]: The (encoded) Open ID Connect ID Token, expiration, and additional data returned by the endpoint. Raises: google.auth.exceptions.RefreshError: If the token endpoint returned an error. r:r=Nid_tokenzNo ID token in response.Fr>)verifyexp) rr@r7rArrBrrrutcfromtimestamp) r'r(r;r+rrrJrDrEpayloadrFs r2id_token_jwt_grantrOs4#&2H I ID1DIM& , &&&) &    :% & j%000G  &wu~ 6 6F V] **rHcKtj|||d}|rd||d<|r||d<t||||d{V} tj| |S)a0Implements the OAuth 2.0 refresh token grant. For more details, see `rfc678 section 6`_. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorizations server's token endpoint URI. refresh_token (str): The refresh token to use to get a new access token. client_id (str): The OAuth 2.0 application's client ID. client_secret (str): The Oauth 2.0 appliaction's client secret. scopes (Optional(Sequence[str])): Scopes to request. If present, all scopes must be authorized for the refresh token. Useful if refresh token has a wild card scope (e.g. 'https://www.googleapis.com/auth/any-api'). rapt_token (Optional(str)): The reauth Proof Token. can_retry (bool): Enable or disable request retry behavior. Returns: Tuple[str, Optional[str], Optional[datetime], Mapping[str, str]]: The access token, new or current refresh token, expiration, and additional data returned by the token endpoint. Raises: google.auth.exceptions.RefreshError: If the token endpoint returned an error. .. _rfc6748 section 6: https://tools.ietf.org/html/rfc6749#section-6 )r< client_id client_secret refresh_token scoperaptr=N)r_REFRESH_GRANT_TYPEjoinr7_handle_refresh_grant_response) r'r(rSrQrRscopes rapt_tokenr+rrs r2 refresh_grantr\sT0&&   D )((W "!V 1DIM  0 N NNr8cKt||||d{V}|dSt|trd|vr"tjd|dS|S)aImplements the global lookup of a credential Regional Access Boundary. For the lookup, we send a request to the global lookup endpoint and then parse the response. Service account credentials, workload identity pools and workforce pools implementation may have Regional Access Boundaries configured. Args: request (google.auth.aio.transport.Request): A callable used to make HTTP requests. The returned response must support `await response.read()` (standard async transport) or `await response.content()` (legacy/custom transport). url (str): The Regional Access Boundary lookup url. headers (Optional[Mapping[str, str]]): The headers for the request. fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries). Returns: Optional[Mapping[str,list|str]]: A dictionary containing "locations" as a list of allowed locations as strings and "encodedLocations" as a hex string. e.g: { "locations": [ "us-central1", "us-east1", "europe-west1", "asia-east1" ], "encodedLocations": "0xA30" } )r fail_fastNencodedLocationszQRegional Access Boundary response malformed: missing 'encodedLocations' key in %s)(_lookup_regional_access_boundary_request isinstancedictr_LOGGERerror)r'r rr^rs r2 _lookup_regional_access_boundaryre&s0CgMt mT * *.@ .U.U _    t r8cKt|||||d{V\}}}|s#tjd||dS|S)aMakes a request to the Regional Access Boundary lookup endpoint. Args: request (google.auth.aio.transport.Request): A callable used to make HTTP requests. The returned response must support `await response.read()` (standard async transport) or `await response.content()` (legacy/custom transport). url (str): The Regional Access Boundary lookup url. can_retry (bool): Enable or disable request retry behavior. Defaults to true. headers (Optional[Mapping[str, str]]): The headers for the request. fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries). Returns: Optional[Mapping[str, str]]: The JSON-decoded response data on success, or None on failure. )r+rr^Nz`Regional Access Boundary HTTP request failed after retries: response_data=%s, retryable_error=%s)1_lookup_regional_access_boundary_request_no_throwrrcdebug)r'r r+rr^r6rr,s r2r`r`Ns*@ 7i         n     t r8c Ki}d}|r tjnd}|rdnd}tj|} | 23d{V} |r*t j|d||||d{V} n|d|| d{V} t | d r| d{V} n| d{V} n@#tj tj f$rd }|s di|fcYcSYt$r didfcYcSwxYw t | d r| d n| } tj| }n#t t"f$ri}YnwxYwt | dr| jn| j}|t(jkrd |dfcStj||}|t(jkrd }|r|sd||fcS6d||fS)aMakes a request to the Regional Access Boundary lookup endpoint. This function doesn't throw on response errors. Args: request (google.auth.aio.transport.Request): A callable used to make HTTP requests. The returned response must support `await response.read()` (standard async transport) or `await response.content()` (legacy/custom transport). url (str): The Regional Access Boundary lookup url. can_retry (bool): Enable or disable request retry behavior. Defaults to true. headers (Optional[Mapping[str, str]]): The headers for the request. fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries). Returns: Tuple(bool, Mapping[str, str], Optional[bool]): A boolean indicating if the request is successful, a mapping for the JSON-decoded response data and in the case of an error a boolean indicating if the error is retryable. FN)total_attemptsGET)r r rtimeout)rn)r r rreadTrr rr)r1_BLOCKING_REGIONAL_ACCESS_BOUNDARY_LOOKUP_TIMEOUTrAsyncExponentialBackoffasynciowait_forr ror TimeoutErrorrTransportError Exceptionrrr!UnicodeDecodeErrorr"rr#r$r%r& BAD_GATEWAY)r'r r+rr^rr,rnrlr-r.r/response_bytesr1rs r2rgrgps,MOENW@@SW $*QQN":%G39393939393939a $ Q!(!1G5c7GTTT#""" ")3!P!P!PPPPPPPx(( :'/}}!6!6!6!6!6!6'/'7'7'9'9!9!9!9!9!9!9$j&?@   "O 2b/111111 H $ $ $"e# # # # # # $ >844$%%g...#  !J}55MM"J/   MMM  x// !H   +. ( (, , , , +#=    +1 1 1"O 9 9-8 8 8 8 9ej - 00s/GBC$C?,C?>C?;D??EE)NFT)T)NNT)NF)TNF)__doc__rr http.clientrr$rr google.authrrrr google.oauth2rr3r7rGrOr\rer`rgr8r2rs|  !!!!!! ,,,,,, """"""++++++LPB1B1B1B1LLP&&&&R'/'/'/'/T++++++++h 7O7O7O7Ot%%%%R;@F;@V1V1V1V1V1V1r8