o 0= jK@sdZddlZddlZddlZddlZddlmZddlmZddlmZddlm Z ddl Z ddl Z ddl Z ddlmZddlmZdd lmZd Zd Zd Zd ZeejddZeejddZeejddZdZegdZdZdZ dZ!dZ"Gddde j#j$j%Z&GdddZ'GdddZ(Gd d!d!e j)Z*Gd"d#d#Z+Gd$d%d%Z,Gd&d'd'ej-Z.Gd(d)d)ej-Z/Gd*d+d+ej0Z1Gd,d-d-ej0Z2Gd.d/d/ej3Z4Gd0d1d1e4Z5Gd2d3d3e4Z6dS)4z1Firebase token minting and validation sub module.N) credentials)iam)jwt) transport) exceptions) _auth_utils) _http_clientzhttps://securetoken.google.com/zXhttps://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.comz$https://session.firebase.google.com/zEhttps://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys)minutes)days)hourszYhttps://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit)ZacrZamrZat_hashaudZ auth_timeZazpZcnfZc_hashexpZfirebaseiatissZjtiZnbfnoncesubzZhttp://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/emailRS256nonez"firebase-auth-emulator@example.comc@s eZdZdZddZddZdS)_EmulatedSignerNcCsdSNselfrrcC:\Users\psant\Downloads\Anu Raj Backend\school\venv\Lib\site-packages\firebase_admin/_token_gen.py__init__Bz_EmulatedSigner.__init__cCsdS)NrrmessagerrrsignErz_EmulatedSigner.sign)__name__ __module__ __qualname__Zkey_idrr"rrrrr?s rc@sdeZdZdZefddZeddZeddZedd Z e d d Z e d d Z e ddZ dS)_SigningProviderz2Stores a reference to a google.auth.crypto.Signer.cCs||_||_||_dSr)_signer _signer_email_alg)rsigner signer_emailalgrrrrLs z_SigningProvider.__init__cC|jSr)r'rrrrr*Qz_SigningProvider.signercCr-r)r(rrrrr+Ur.z_SigningProvider.signer_emailcCr-r)r)rrrrr,Yr.z_SigningProvider.algcCst|j|jSr)r&r*r+)cls google_credrrrfrom_credential]z _SigningProvider.from_credentialcCst|||}t||Sr)rSignerr&)r/requestr0service_accountr*rrrfrom_iamas z_SigningProvider.from_iamcCsttttSr)r&rAUTH_EMULATOR_EMAILALGORITHM_NONE)r/rrr for_emulatorfr2z_SigningProvider.for_emulatorN)r#r$r%__doc__ALGORITHM_RS256rpropertyr*r+r, classmethodr1r6r9rrrrr&Is      r&c@sDeZdZdZdZdddZddZedd Zdd d Z d d Z dS)TokenGeneratorz,Generates custom tokens and session cookies.z)https://identitytoolkit.googleapis.com/v1NcCs>||_||_tj|_|p|j}|d|j|_d|_ dS)Nz /projects/) app http_clientrrequestsRequestr4ID_TOOLKIT_URL project_idbase_url_signing_provider)rr?r@Z url_overrideZ url_prefixrrrrps    zTokenGenerator.__init__cCstrtS|jj}t|tj j j rt |S|jj d}|r,t|j||St|tjr7t |S|jtddid}|jdkrPtd|jd|j}t|j||S) zPInitializes a signing provider by following the go/firebase-admin-sign protocol.ZserviceAccountIdzMetadata-FlavorZGoogle)urlheadersz.Failed to contact the local metadata service: .N)r is_emulatedr&r9r?Z credentialget_credential isinstancegoogleoauth2r5 Credentialsr1optionsgetr6r4rZSigningMETADATA_SERVICE_URLstatus ValueErrordatadecode)rr0r5resprrr_init_signing_providerxs"      z%TokenGenerator._init_signing_providerc CsT|js'z ||_W|jSty&}zd}td|d|d|d}~ww|jS)z@Initializes and returns the SigningProvider instance to be used.z@https://firebase.google.com/docs/auth/admin/create-custom-tokensz%Failed to determine service account: z. Make sure to initialize the SDK with service account credentials or specify a service account ID with iam.serviceAccounts.signBlob permission. Please refer to z, for more details on creating custom tokens.N)rFrY ExceptionrU)rerrorrGrrrsigning_providers  zTokenGenerator.signing_providerc Cs,|dur7t|ts tdt|t@}|r7t|dkr*dd|d}t|dd|d}t||rDt|trDt|d krHtd |j }t t }|j |j t |||td }|rd||d <|durl||d <d|ji} z tj|j|| dWStjjjy} z d| } t| | | d} ~ ww)z.Builds and signs a Firebase custom auth token.Nz%developer_claims must be a dictionaryr zDeveloper claims z, z& are reserved and cannot be specified.zDeveloper claim z% is reserved and cannot be specified.z2uid must be a string between 1 and 128 characters.)rrruidrr tenant_idZclaimsr,)headerzFailed to sign custom token. )rMdictrUsetkeysRESERVED_CLAIMSlenjoinstrr\inttimer+FIREBASE_AUDIENCEMAX_TOKEN_LIFETIME_SECONDSr,rencoder*rNauthrTransportErrorTokenSignError) rr^Zdeveloper_claimsr_Zdisallowed_keys error_messager\nowpayloadr`r[msgrrrcreate_custom_tokensF      z"TokenGenerator.create_custom_tokenc Cs,t|tr |dn|}t|tr|std|dt|tjr't|}t|t s1t|ts9td|d|t krHtd|dt d|t krWtd|dt d|j d }||d }z |j jd ||d \}}Wntjjy}zt|d }~ww|r|dstjd|d|dS)z4Creates a session cookie from the provided ID token.utf-8zIllegal ID token provided: z&. ID token must be a non-empty string.zIllegal expiry duration: rJz. Duration must be at least z seconds.z. Duration must be at most z:createSessionCookie)ZidTokenZ validDurationpost)jsonNZ sessionCookiez Failed to create session cookie.) http_response)rMbytesrWrgrUdatetime timedeltarh total_secondsbool#MIN_SESSION_COOKIE_DURATION_SECONDS#MAX_SESSION_COOKIE_DURATION_SECONDSrEr@Zbody_and_responserArRequestExceptionrZhandle_auth_backend_errorrRZUnexpectedResponseError)rid_tokenZ expires_inrGrrbodyZ http_respr[rrrcreate_session_cookiesH      z$TokenGenerator.create_session_cookier)NN) r#r$r%r:rCrrYr<r\rtrrrrrr>ks    -r>c@s<eZdZdZd ddZeddZeddZd d d ZdS)CertificateFetchRequestzyA google-auth transport that supports HTTP cache-control. Also injects a timeout to each outgoing HTTP request. NcCs*tt|_tj|j|_||_ dSr) cachecontrol CacheControlrASession_sessionrrBsession _delegate_timeout_seconds)rtimeout_secondsrrrrs z CertificateFetchRequest.__init__cCr-r)rrrrrrr.zCertificateFetchRequest.sessioncCr-r)rrrrrrr.z'CertificateFetchRequest.timeout_secondsGETcKs&|p|j}|j|f||||d|S)N)methodrrHtimeout)rr)rrGrrrHrkwargsrrr__call__s z CertificateFetchRequest.__call__r)rNNN) r#r$r%r:rr<rrrrrrrrs   rc@s,eZdZdZddZd ddZd ddZd S) TokenVerifierz'Verifies ID tokens and session cookies.c CsX|jdtj}t||_t|jdddtt t j t d|_ t|jdddttttd|_dS)NZ httpTimeoutzID tokenzverify_id_token()zrBrrrrrorrrrrrrrrrrrsT         " y