o
    7bV                     @   s  d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZ zZd dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 dZ1W n e2y   dZ1Y nw h dZ3dd Z4G dd dZ5G dd de5Z6G dd de5Z7e1rG dd de5Z8G dd de5Z9G dd de8Z:G dd de5Z;dS dS )     N   InvalidKeyError)	base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintis_pem_format
is_ssh_keyraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTF>   ES256ES384ES512ES521EdDSAPS256PS384PS512RS256RS384RS512ES256Kc                  C   s   t  ttjttjttjd} trG| ttjttjttjttjttjttjttjttjt	t	jt	t	jt	t	jt
 d | S )zE
    Returns the algorithms that are implemented by the library.
    )noneHS256HS384HS512)r/   r0   r1   r'   r2   r(   r*   r)   r,   r-   r.   r+   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)default_algorithms rC   0/usr/lib/python3/dist-packages/jwt/algorithms.pyget_default_algorithmsK   s0   rE   c                   @   s@   e Zd ZdZdd Zdd Zdd Zedd	 Zed
d Z	dS )	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                 C      t )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NotImplementedErrorselfkeyrC   rC   rD   prepare_keyr      zAlgorithm.prepare_keyc                 C   rG   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        rH   rK   msgrL   rC   rC   rD   signy   rN   zAlgorithm.signc                 C   rG   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        rH   rK   rP   rL   sigrC   rC   rD   verify   rN   zAlgorithm.verifyc                 C   rG   )z7
        Serializes a given RSA key into a JWK
        rH   key_objrC   rC   rD   to_jwk   rN   zAlgorithm.to_jwkc                 C   rG   )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        rH   )jwkrC   rC   rD   from_jwk   rN   zAlgorithm.from_jwkN)
__name__
__module____qualname____doc__rM   rQ   rT   staticmethodrW   rY   rC   rC   rC   rD   rF   m   s    
rF   c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )	r7   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 C   s    |dkrd }|d urt d|S )N z*When alg = "none", key value must be None.r   rJ   rC   rC   rD   rM      s
   zNoneAlgorithm.prepare_keyc                 C      dS )N    rC   rO   rC   rC   rD   rQ         zNoneAlgorithm.signc                 C   r`   )NFrC   rR   rC   rC   rD   rT      rb   zNoneAlgorithm.verifyN)rZ   r[   r\   r]   rM   rQ   rT   rC   rC   rC   rD   r7      s
    	r7   c                   @   sZ   e Zd ZdZejZejZej	Z
dd Zdd Zedd Zedd	 Zd
d Zdd ZdS )r8   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   
   || _ d S Nhash_algrK   rf   rC   rC   rD   __init__      
zHMACAlgorithm.__init__c                 C   s$   t |}t|st|rtd|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r
   r   r   rJ   rC   rC   rD   rM      s   zHMACAlgorithm.prepare_keyc                 C   s   t tt|  ddS )Noct)kkty)jsondumpsr   r   decoderU   rC   rC   rD   rW      s
   zHMACAlgorithm.to_jwkc                 C   sh   zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdt|d S )NKey is not valid JSONrl   rj   zNot an HMAC keyrk   )	
isinstancestrrm   loadsdict
ValueErrorr   getr   )rX   objrC   rC   rD   rY      s   

zHMACAlgorithm.from_jwkc                 C   s   t ||| j S rd   )hmacnewrf   digestrO   rC   rC   rD   rQ         zHMACAlgorithm.signc                 C   s   t || ||S rd   )rx   compare_digestrQ   rR   rC   rC   rD   rT      r{   zHMACAlgorithm.verifyN)rZ   r[   r\   r]   hashlibsha256r9   sha384r:   sha512r;   rh   rM   r^   rW   rY   rQ   rT   rC   rC   rC   rD   r8      s    

r8   c                   @   sZ   e Zd ZdZejZejZejZdd Zdd Z	e
dd Ze
dd	 Zd
d Zdd ZdS )r>   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                 C   rc   rd   re   rg   rC   rC   rD   rh      ri   zRSAAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|d d}W |S  t
y;   t|}Y |S w )NExpecting a PEM-formatted key.s   ssh-rsapassword)rq   r   r   bytesrr   	TypeErrorr   
startswithr&   r$   ru   r%   rJ   rC   rC   rD   rM      s   


zRSAAlgorithm.prepare_keyc                 C   s   d }t | dd rE|  }ddgt|jj t|jj t|j t|j t|j	 t|j
 t|j t|j d
}n!t | dd rb|  }ddgt|j t|j d}ntdt|S )Nprivate_numbersRSArQ   )
rl   key_opsnedpqdpdqqirT   )rl   r   r   r   Not a public or private key)getattrr   r   public_numbersr   ro   r   r   r   r   dmp1dmq1iqmpr   rm   rn   )rV   rw   numbersrC   rC   rD   rW     s.   
zRSAAlgorithm.to_jwkc           	   	      s  zt | trt|  n
t | tr|  ntW n ty"   tdw  ddkr.tdd v rd v rd v rd v rBtd	g d
} fdd|D }t|}|r]t	|s]tdt
t d t d }|rtt d t d t d t d t d t d |d}| S t d }t|j||j\}}t|||t||t||t|||d}| S d v rd v rt
t d t d }| S td)Nrp   rl   r   zNot an RSA keyr   r   r   othz5Unsupported RSA private key: > 2 primes not supported)r   r   r   r   r   c                    s   g | ]}| v qS rC   rC   ).0proprw   rC   rD   
<listcomp>A  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr   r   r   r   r   )r   r   r   r   r   r   r   r   )rq   rr   rm   rs   rt   ru   r   rv   anyallr   r	   r   r   r   r   r   r   r   private_key
public_key)	rX   other_propsprops_foundany_props_foundr   r   r   r   r   rC   r   rD   rY   *  sx   













zRSAAlgorithm.from_jwkc                 C   s   | |t |  S rd   )rQ   r   PKCS1v15rf   rO   rC   rC   rD   rQ   t  s   zRSAAlgorithm.signc                 C   s4   z| ||t |   W dS  ty   Y dS w )NTF)rT   r   r   rf   r   rR   rC   rC   rD   rT   w  s   zRSAAlgorithm.verifyN)rZ   r[   r\   r]   r   r9   r:   r;   rh   rM   r^   rW   rY   rQ   rT   rC   rC   rC   rD   r>      s    
#
Ir>   c                   @   sN   e Zd ZdZejZejZejZdd Zdd Z	dd Z
dd	 Zed
d ZdS )r?   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                 C   rc   rd   re   rg   rC   rC   rD   rh     ri   zECAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|}W |S  t
y;   t|d d}Y |S w )Nr   s   ecdsa-sha2-r   )rq   r   r   r   rr   r   r   r   r&   r%   ru   r$   rJ   rC   rC   rD   rM     s   


zECAlgorithm.prepare_keyc                 C   s"   | |t|  }t||jS rd   )rQ   r   ECDSArf   r   curve)rK   rP   rL   der_sigrC   rC   rD   rQ     s   zECAlgorithm.signc                 C   sl   zt ||j}W n
 ty   Y dS w zt|tr| }|||t| 	  W dS  t
y5   Y dS w )NFT)r   r   ru   rq   r   r   rT   r   r   rf   r   )rK   rP   rL   rS   r   rC   rC   rD   rT     s   
zECAlgorithm.verifyc                 C   s&  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdd|vs6d|vr:tdt|d}t|d}|d}|dkrmt	|t	|  kr_d	krin td
t
 }nktd
|dkrt	|t	|  krdkrn tdt
 }nKtd|dkrt	|t	|  krdkrn tdt
 }n+td|dkrt	|t	|  krd	krn tdt
 }ntdtd| t
jtj|ddtj|dd|d}d|vr| S t|d}t	|t	|krtdt	||t
tj|dd| S )Nrp   rl   ECzNot an Elliptic curve keyxycrvzP-256    z)Coords should be 32 bytes for curve P-256zP-3840   z)Coords should be 48 bytes for curve P-384zP-521B   z)Coords should be 66 bytes for curve P-521	secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: big)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})rq   rr   rm   rs   rt   ru   r   rv   r   lenr   	SECP256R1	SECP384R1	SECP521R1	SECP256K1EllipticCurvePublicNumbersint
from_bytesr   EllipticCurvePrivateNumbersr   )rX   rw   r   r   r   	curve_objr   r   rC   rC   rD   rY     sv   







zECAlgorithm.from_jwkN)rZ   r[   r\   r]   r   r9   r:   r;   rh   rM   rQ   rT   r^   rY   rC   rC   rC   rD   r?   ~  s    r?   c                   @   s    e Zd ZdZdd Zdd ZdS )r@   zA
        Performs a signature using RSASSA-PSS with MGF1
        c                 C   s*   | |tjt|  | jjd|  S )Nmgfsalt_length)rQ   r   PSSMGF1rf   digest_sizerO   rC   rC   rD   rQ     s   zRSAPSSAlgorithm.signc              	   C   sH   z| ||tjt|  | jjd|   W dS  ty#   Y dS w )Nr   TF)rT   r   r   r   rf   r   r   rR   rC   rC   rD   rT     s   	zRSAPSSAlgorithm.verifyN)rZ   r[   r\   r]   rQ   rT   rC   rC   rC   rD   r@     s    
r@   c                   @   sH   e Zd ZdZdd Zdd Zdd Zdd	 Zed
d Z	edd Z
dS )rA   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c                 K   s   d S rd   rC   )rK   kwargsrC   rC   rD   rh     rb   zOKPAlgorithm.__init__c                 C   s   t |ttfr6t |tr|d}|d}d|v rt|}nd|v r*t|d d}n|dd dkr6t|}t |tt	t
tfsCtd|S )	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr   r      zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)rq   r   rr   encodero   r%   r$   r&   r   r   r   r   r   )rK   rL   str_keyrC   rC   rD   rM     s$   




zOKPAlgorithm.prepare_keyc                 C   s$   t |turt|dn|}||S )aR  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` iinstance
            :return bytes signature: The signature, as bytes
            r   )typer   rQ   rO   rC   rC   rD   rQ   6  s   
zOKPAlgorithm.signc                 C   sv   z.t |turt|dn|}t |turt|dn|}t|ttfr&| }||| W dS  tjj	y:   Y dS w )a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TF)
r   r   rq   r   r   r   rT   cryptography
exceptionsr   rR   rC   rC   rD   rT   A  s   
zOKPAlgorithm.verifyc                 C   s   t | ttfr(| jtjtjd}t | trdnd}tt	t
| d|dS t | ttfrd| jtjtjt d}|  jtjtjd}t | trLdnd}tt	t
| t	t
| d|dS td)	N)encodingformatEd25519Ed448OKP)r   rl   r   )r   r   encryption_algorithm)r   r   rl   r   r   )rq   r   r   public_bytesr    Rawr#   rm   rn   r   r   ro   r   r   private_bytesr"   r!   r   r   )rL   r   r   r   rC   rC   rD   rW   V  s>   	zOKPAlgorithm.to_jwkc              
   C   s  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.td|d}|dkrB|dkrBtd| d	|vrJtd
t|d	}z+d|vrf|dkr`t	
|W S t
|W S t|d}|dkrwt|W S t|W S  ty } ztd|d }~ww )Nrp   rl   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)rq   rr   rm   rs   rt   ru   r   rv   r   r   from_public_bytesr   r   from_private_bytesr   )rX   rw   r   r   r   errrC   rC   rD   rY   ~  s>   



zOKPAlgorithm.from_jwkN)rZ   r[   r\   r]   rh   rM   rQ   rT   r^   rW   rY   rC   rC   rC   rD   rA     s    
'rA   )<r}   rx   rm   r   r   utilsr   r   r   r   r	   r
   r   r   r   cryptography.exceptionsr   r   cryptography.hazmat.primitivesr   )cryptography.hazmat.primitives.asymmetricr   r   ,cryptography.hazmat.primitives.asymmetric.ecr   r   /cryptography.hazmat.primitives.asymmetric.ed448r   r   1cryptography.hazmat.primitives.asymmetric.ed25519r   r   -cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   ,cryptography.hazmat.primitives.serializationr    r!   r"   r#   r$   r%   r&   r<   ModuleNotFoundErrorrequires_cryptographyrE   rF   r7   r8   r>   r?   r@   rA   rC   rC   rC   rD   <module>   sB    ,($

")9 x  