§
    (ê[f$  ã                   óv   — d dl Z d dlmZ d dlmZ ddlmZ dZ e j        e	¦  «        Z
 G d„ d¦  «        Zd	„ ZdS )
é    N)Újwt)Ú	JoseErroré   )ÚInvalidClientErrorz6urn:ietf:params:oauth:client-assertion-type:jwt-bearerc                   óL   — e Zd ZdZeZdZdd„Zd„ Zd„ Z	d„ Z
d„ Zd	„ Zd
„ Zd„ ZdS )ÚJWTBearerClientAssertionz]Implementation of Using JWTs for Client Authentication, which is
    defined by RFC7523.
    Úclient_assertion_jwtTc                 ó"   — || _         || _        d S )N)Ú	token_urlÚ_validate_jti)Úselfr   Úvalidate_jtis      úQ/var/www/piapp/venv/lib/python3.11/site-packages/authlib/oauth2/rfc7523/client.pyÚ__init__z!JWTBearerClientAssertion.__init__   s   € Ø"ˆŒØ)ˆÔÐÐó    c                 óN  — |j         }|                     d¦  «        }|                     d¦  «        }|t          k    rH|rF|                      ||¦  «        }|                      ||¦  «         |                      |j        ¦  «        S t                               d| j	        ¦  «         d S )NÚclient_assertion_typeÚclient_assertionzAuthenticate via %r failed)
ÚformÚgetÚASSERTION_TYPEÚcreate_resolve_key_funcÚprocess_assertion_claimsÚauthenticate_clientÚclientÚlogÚdebugÚCLIENT_AUTH_METHOD)r   Úquery_clientÚrequestÚdataÚassertion_typeÚ	assertionÚresolve_keys          r   Ú__call__z!JWTBearerClientAssertion.__call__   sœ   € ØŒ|ˆØŸšÐ"9Ñ:Ô:ˆØ—H’HÐ/Ñ0Ô0ˆ	Ø�^Ò+Ð+°	Ð+Ø×6Ò6°|ÀWÑMÔMˆKØ×)Ò)¨)°[ÑAÔAÐAØ×+Ò+¨G¬NÑ;Ô;Ð;Ý�	Š	Ð.°Ô0GÑHÔHÐHÐHÐHr   c                 ód   — dt           dœddid| j        dœddidœ}| j        rd| j        dœ|d<   |S )z„Create a claims_options for verify JWT payload claims. Developers
        MAY overwrite this method to create a more strict options.T)Ú	essentialÚvalidater'   )r'   Úvalue)ÚissÚsubÚaudÚexpÚjti)Ú_validate_issr   r   r   )r   Úoptionss     r   Úcreate_claims_optionsz.JWTBearerClientAssertion.create_claims_options!   s_   € ð "&µ=ÐAÐAØ Ð&Ø!%°´Ð?Ð?Ø Ð&ð	
ð 
ˆð Ôð 	PØ+/¸TÔ=NÐOÐOˆG�E‰NØˆr   c                 óú   — 	 t          j        |||                      ¦   «         ¬¦  «        }|                     ¦   «          n;# t          $ r.}t
                               d|¦  «         t          ¦   «         ‚d}~ww xY w|S )aa  Extract JWT payload claims from request "assertion", per
        `Section 3.1`_.

        :param assertion: assertion string value in the request
        :param resolve_key: function to resolve the sign key
        :return: JWTClaims
        :raise: InvalidClientError

        .. _`Section 3.1`: https://tools.ietf.org/html/rfc7523#section-3.1
        )Úclaims_optionszAssertion Error: %rN)r   Údecoder1   r(   r   r   r   r   )r   r#   r$   ÚclaimsÚes        r   r   z1JWTBearerClientAssertion.process_assertion_claims0   s�   € ð	'Ý”ZØ˜;Ø#×9Ò9Ñ;Ô;ðñ ô ˆFð �OŠOÑÔÐÐøÝð 	'ð 	'ð 	'Ý�IŠIÐ+¨QÑ/Ô/Ð/Ý$Ñ&Ô&Ð&øøøøð	'øøøð ˆs   ‚=A  Á 
A8Á
)A3Á3A8c                 óX   — |                      | j        d¦  «        r|S t          ¦   «         ‚)NÚtoken)Úcheck_endpoint_auth_methodr   r   )r   r   s     r   r   z,JWTBearerClientAssertion.authenticate_clientF   s.   € Ø×,Ò,¨TÔ-DÀgÑNÔNð 	ØˆMÝ Ñ"Ô"Ð"r   c                 ó   ‡ ‡‡— ˆˆˆ fd„}|S )Nc                 ó„   •— |d         } ‰|¦  «        }|st          ¦   «         ‚|‰_        ‰                     || ¦  «        S ©Nr+   )r   r   Úresolve_client_public_key)ÚheadersÚpayloadÚ	client_idr   r   r    r   s       €€€r   r$   zEJWTBearerClientAssertion.create_resolve_key_func.<locals>.resolve_keyL   sN   ø€ ð   œˆIØ!�\ )Ñ,Ô,ˆFØð +Ý(Ñ*Ô*Ð*Ø#ˆGŒNØ×1Ò1°&¸'ÑBÔBÐBr   © )r   r   r    r$   s   ``` r   r   z0JWTBearerClientAssertion.create_resolve_key_funcK   s7   øøø€ ð		Cð 		Cð 		Cð 		Cð 		Cð 		Cð 		Cð Ðr   c                 ó   — t          ¦   «         ‚)af  Validate if the given ``jti`` value is used before. Developers
        MUST implement this method::

            def validate_jti(self, claims, jti):
                key = 'jti:{}-{}'.format(claims['sub'], jti)
                if redis.get(key):
                    return False
                redis.set(key, 1, ex=3600)
                return True
        ©ÚNotImplementedError)r   r5   r.   s      r   r   z%JWTBearerClientAssertion.validate_jtiX   s   € õ "Ñ#Ô#Ð#r   c                 ó   — t          ¦   «         ‚)aN  Resolve the client public key for verifying the JWT signature.
        A client may have many public keys, in this case, we can retrieve it
        via ``kid`` value in headers. Developers MUST implement this method::

            def resolve_client_public_key(self, client, headers):
                return client.public_key
        rC   )r   r   r>   s      r   r=   z2JWTBearerClientAssertion.resolve_client_public_keye   s   € õ "Ñ#Ô#Ð#r   N)T)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   ÚCLIENT_ASSERTION_TYPEr   r   r%   r1   r   r   r   r   r=   rA   r   r   r   r   
   s¬   € € € € € ðð ð +Ðà/Ðð*ð *ð *ð *ðIð Ið Iðð ð ðð ð ð,#ð #ð #ð
ð ð ð$ð $ð $ð$ð $ð $ð $ð $r   r   c                 ó   — | d         |k    S r<   rA   )r5   r*   s     r   r/   r/   p   s   € Ø�%Œ=˜CÒÐr   )ÚloggingÚauthlib.joser   Úauthlib.jose.errorsr   Úrfc6749r   r   Ú	getLoggerrF   r   r   r/   rA   r   r   ú<module>rQ      s¥   ðØ €€€Ø Ð Ð Ð Ð Ð Ø )Ð )Ð )Ð )Ð )Ð )Ø (Ð (Ð (Ð (Ð (Ð (àI€Ø€gÔ˜Ñ!Ô!€ðc$ð c$ð c$ð c$ð c$ñ c$ô c$ð c$ðL ð  ð  ð  ð  r   