o
    \|]aV                     @   s  d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZ zZd dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. dZ/W n e0y   dZ/Y nw h dZ1dd Z2G dd dZ3G dd de3Z4G dd de3Z5e/rG dd de3Z6G dd de3Z7G dd de6Z8G dd de3Z9dS dS )     N   InvalidKeyError)base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTF>   ES256ES384ES512ES521EdDSAPS256PS384PS512RS256RS384RS512ES256Kc                  C   s   t  ttjttjttjd} trG| ttjttjttjttjttjttjttjttjt	t	jt	t	jt	t	jt
 d | S )zE
    Returns the algorithms that are implemented by the library.
    )ZnoneZHS256ZHS384ZHS512)r-   r.   r/   r%   r0   r&   r(   r'   r*   r+   r,   r)   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)Zdefault_algorithms r<   0/usr/lib/python3/dist-packages/jwt/algorithms.pyget_default_algorithmsI   s0   r>   c                   @   s@   e Zd ZdZdd Zdd Zdd Zedd	 Zed
d Z	dS )	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                 C      t )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NotImplementedErrorselfkeyr<   r<   r=   prepare_keyp      zAlgorithm.prepare_keyc                 C   r@   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        rA   rD   msgrE   r<   r<   r=   signw   rG   zAlgorithm.signc                 C   r@   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        rA   rD   rI   rE   sigr<   r<   r=   verify~   rG   zAlgorithm.verifyc                 C   r@   )z7
        Serializes a given RSA key into a JWK
        rA   key_objr<   r<   r=   to_jwk   rG   zAlgorithm.to_jwkc                 C   r@   )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        rA   )jwkr<   r<   r=   from_jwk   rG   zAlgorithm.from_jwkN)
__name__
__module____qualname____doc__rF   rJ   rM   staticmethodrP   rR   r<   r<   r<   r=   r?   k   s    
r?   c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )	r1   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 C   s    |dkrd }|d urt d|S )N z*When alg = "none", key value must be None.r   rC   r<   r<   r=   rF      s
   zNoneAlgorithm.prepare_keyc                 C      dS )N    r<   rH   r<   r<   r=   rJ         zNoneAlgorithm.signc                 C   rY   )NFr<   rK   r<   r<   r=   rM      r[   zNoneAlgorithm.verifyN)rS   rT   rU   rV   rF   rJ   rM   r<   r<   r<   r=   r1      s
    	r1   c                   @   sZ   e Zd ZdZejZejZej	Z
dd Zdd Zedd Zedd	 Zd
d Zdd ZdS )r2   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   
   || _ d S Nhash_algrD   r_   r<   r<   r=   __init__      
zHMACAlgorithm.__init__c                    s2   t   g d}t fdd|D rtd S )N)s   -----BEGIN PUBLIC KEY-----s   -----BEGIN CERTIFICATE-----s   -----BEGIN RSA PUBLIC KEY-----   ssh-rsac                 3   s    | ]}| v V  qd S r]   r<   ).0Zstring_valuerE   r<   r=   	<genexpr>   s    z,HMACAlgorithm.prepare_key.<locals>.<genexpr>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   anyr   )rD   rE   Zinvalid_stringsr<   re   r=   rF      s   zHMACAlgorithm.prepare_keyc                 C   s   t tt|  ddS )Noct)kkty)jsondumpsr   r   decoderN   r<   r<   r=   rP      s
   zHMACAlgorithm.to_jwkc                 C   sh   zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdt|d S )NKey is not valid JSONrj   rh   zNot an HMAC keyri   )	
isinstancestrrk   loadsdict
ValueErrorr   getr   )rQ   objr<   r<   r=   rR      s   

zHMACAlgorithm.from_jwkc                 C   s   t ||| j S r]   )hmacnewr_   ZdigestrH   r<   r<   r=   rJ         zHMACAlgorithm.signc                 C   s   t || ||S r]   )rv   Zcompare_digestrJ   rK   r<   r<   r=   rM      rx   zHMACAlgorithm.verifyN)rS   rT   rU   rV   hashlibZsha256r3   Zsha384r4   Zsha512r5   ra   rF   rW   rP   rR   rJ   rM   r<   r<   r<   r=   r2      s    

r2   c                   @   sZ   e Zd ZdZejZejZejZdd Zdd Z	e
dd Ze
dd	 Zd
d Zdd ZdS )r8   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                 C   r\   r]   r^   r`   r<   r<   r=   ra      rb   zRSAAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|d d}W |S  t
y;   t|}Y |S w )NExpecting a PEM-formatted key.rc   Zpassword)ro   r   r   bytesrp   	TypeErrorr   
startswithr$   r"   rs   r#   rC   r<   r<   r=   rF      s   


zRSAAlgorithm.prepare_keyc                 C   s   d }t | dd rE|  }ddgt|jj t|jj t|j t|j t|j	 t|j
 t|j t|j d
}n!t | dd rb|  }ddgt|j t|j d}ntdt|S )Nprivate_numbersRSArJ   )
rj   key_opsnedpqdpdqqirM   )rj   r   r   r   Not a public or private key)getattrr   r   public_numbersr   rm   r   r   r   r   dmp1dmq1iqmpr   rk   rl   )rO   ru   numbersr<   r<   r=   rP     s.   
zRSAAlgorithm.to_jwkc           	   	      s  zt | trt|  n
t | tr|  ntW n ty"   tdw  ddkr.tdd v rd v rd v rd v rBtd	g d
} fdd|D }t|}|r]t	|s]tdt
t d t d }|rtt d t d t d t d t d t d |d}| S t d }t|j||j\}}t|||t||t||t|||d}| S d v rd v rt
t d t d }| S td)Nrn   rj   r   zNot an RSA keyr   r   r   Zothz5Unsupported RSA private key: > 2 primes not supported)r   r   r   r   r   c                    s   g | ]}| v qS r<   r<   )rd   Zpropru   r<   r=   
<listcomp>F  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr   r   r   r   r   )r   r   r   r   r   r   r   r   )ro   rp   rk   rq   rr   rs   r   rt   rg   allr   r	   r   r   r   r   r   r   r   private_key
public_key)	rQ   Zother_propsZprops_foundZany_props_foundr   r   r   r   r   r<   r   r=   rR   /  sx   













zRSAAlgorithm.from_jwkc                 C   s   | |t |  S r]   )rJ   r   PKCS1v15r_   rH   r<   r<   r=   rJ   y  s   zRSAAlgorithm.signc                 C   s4   z| ||t |   W dS  ty   Y dS w )NTF)rM   r   r   r_   r   rK   r<   r<   r=   rM   |  s   zRSAAlgorithm.verifyN)rS   rT   rU   rV   r   r3   r4   r5   ra   rF   rW   rP   rR   rJ   rM   r<   r<   r<   r=   r8      s    
#
Ir8   c                   @   sN   e Zd ZdZejZejZejZdd Zdd Z	dd Z
dd	 Zed
d ZdS )r9   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                 C   r\   r]   r^   r`   r<   r<   r=   ra     rb   zECAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|}W |S  t
y;   t|d d}Y |S w )Nrz   s   ecdsa-sha2-r{   )ro   r   r   r|   rp   r}   r   r~   r$   r#   rs   r"   rC   r<   r<   r=   rF     s   


zECAlgorithm.prepare_keyc                 C   s"   | |t|  }t||jS r]   )rJ   r   ECDSAr_   r   curve)rD   rI   rE   der_sigr<   r<   r=   rJ     s   zECAlgorithm.signc                 C   sl   zt ||j}W n
 ty   Y dS w zt|tr| }|||t| 	  W dS  t
y5   Y dS w )NFT)r
   r   rs   ro   r   r   rM   r   r   r_   r   )rD   rI   rE   rL   r   r<   r<   r=   rM     s   
zECAlgorithm.verifyc                 C   s&  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdd|vs6d|vr:tdt|d}t|d}|d}|dkrmt	|t	|  kr_d	krin td
t
 }nktd
|dkrt	|t	|  krdkrn tdt
 }nKtd|dkrt	|t	|  krdkrn tdt
 }n+td|dkrt	|t	|  krd	krn tdt
 }ntdtd| t
jtj|ddtj|dd|d}d|vr| S t|d}t	|t	|krtdt	||t
tj|dd| S )Nrn   rj   ZECzNot an Elliptic curve keyxycrvzP-256    z)Coords should be 32 bytes for curve P-256zP-3840   z)Coords should be 48 bytes for curve P-384zP-521B   z)Coords should be 66 bytes for curve P-521Z	secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: Zbig)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})ro   rp   rk   rq   rr   rs   r   rt   r   lenr   Z	SECP256R1Z	SECP384R1Z	SECP521R1Z	SECP256K1ZEllipticCurvePublicNumbersint
from_bytesr   ZEllipticCurvePrivateNumbersr   )rQ   ru   r   r   r   Z	curve_objr   r   r<   r<   r=   rR     sv   







zECAlgorithm.from_jwkN)rS   rT   rU   rV   r   r3   r4   r5   ra   rF   rJ   rM   rW   rR   r<   r<   r<   r=   r9     s    r9   c                   @   s    e Zd ZdZdd Zdd ZdS )r:   zA
        Performs a signature using RSASSA-PSS with MGF1
        c                 C   s*   | |tjt|  | jjd|  S )NZmgfZsalt_length)rJ   r   PSSMGF1r_   digest_sizerH   r<   r<   r=   rJ      s   zRSAPSSAlgorithm.signc              	   C   sH   z| ||tjt|  | jjd|   W dS  ty#   Y dS w )Nr   TF)rM   r   r   r   r_   r   r   rK   r<   r<   r=   rM   
  s   	zRSAPSSAlgorithm.verifyN)rS   rT   rU   rV   rJ   rM   r<   r<   r<   r=   r:     s    
r:   c                   @   sH   e Zd ZdZdd Zdd Zdd Zdd	 Zed
d Z	edd Z
dS )r;   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c                 K   s   d S r]   r<   )rD   kwargsr<   r<   r=   ra      r[   zOKPAlgorithm.__init__c                 C   s   t |ttttfr|S t |ttfr?t |tr|d}|d}d|v r)t	|S d|v r3t
|d dS |dd dkr?t|S td)	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATEr{   r      zssh-z)Expecting a PEM-formatted or OpenSSH key.)ro   r   r   r   r   r|   rp   encoderm   r#   r"   r$   r}   )rD   rE   Zstr_keyr<   r<   r=   rF   #  s    



zOKPAlgorithm.prepare_keyc                 C   s$   t |turt|dn|}||S )aR  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` iinstance
            :return bytes signature: The signature, as bytes
            r   )typer|   rJ   rH   r<   r<   r=   rJ   9  s   
zOKPAlgorithm.signc                 C   sv   z.t |turt|dn|}t |turt|dn|}t|ttfr&| }||| W dS  tjj	y:   Y dS w )a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TF)
r   r|   ro   r   r   r   rM   cryptography
exceptionsr   rK   r<   r<   r=   rM   D  s   
zOKPAlgorithm.verifyc                 C   s   t | ttfr(| jtjtjd}t | trdnd}tt	t
| d|dS t | ttfrd| jtjtjt d}|  jtjtjd}t | trLdnd}tt	t
| t	t
| d|dS td)	N)encodingformatEd25519Ed448OKP)r   rj   r   )r   r   Zencryption_algorithm)r   r   rj   r   r   )ro   r   r   Zpublic_bytesr   ZRawr!   rk   rl   r   r   rm   r   r   Zprivate_bytesr    r   r   r   )rE   r   r   r   r<   r<   r=   rP   Y  s>   	zOKPAlgorithm.to_jwkc              
   C   s  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.td|d}|dkrB|dkrBtd| d	|vrJtd
t|d	}z+d|vrf|dkr`t	
|W S t
|W S t|d}|dkrwt|W S t|W S  ty } ztd|d }~ww )Nrn   rj   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)ro   rp   rk   rq   rr   rs   r   rt   r   r   Zfrom_public_bytesr   r   Zfrom_private_bytesr   )rQ   ru   r   r   r   errr<   r<   r=   rR     s>   



zOKPAlgorithm.from_jwkN)rS   rT   rU   rV   ra   rF   rJ   rM   rW   rP   rR   r<   r<   r<   r=   r;     s    
'r;   ):ry   rv   rk   r   r   Zutilsr   r   r   r   r	   r
   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   r   Z,cryptography.hazmat.primitives.asymmetric.ecr   r   Z/cryptography.hazmat.primitives.asymmetric.ed448r   r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   r   Z-cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   Z,cryptography.hazmat.primitives.serializationr   r   r    r!   r"   r#   r$   r6   ModuleNotFoundErrorZrequires_cryptographyr>   r?   r1   r2   r8   r9   r:   r;   r<   r<   r<   r=   <module>   sB    $
($

")@ x  