o
    ¤ó·i�‹  ã                   @  sL  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZm	Z	 d dl
mZmZmZmZmZmZmZmZmZ ddlmZ ddlmZmZ ddlmZmZmZmZmZmZm Z m!Z!m"Z" zÕd d	l#m$Z$m%Z% d d
l&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z;m<Z< d dl=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZE d dlFmGZGmHZHmIZImJZJmKZKmLZLmMZM ejNdkrÒd dl
mOZO nd dlPmOZO ee>e@f ZQdeRd< ee3e5f ZSdeRd< ee;e<e8e9f ZTdeRd< eeQeSeTf ZUdeRd< ee>e3e;e8f ZVdeRd< ee@e5e<e9f ZWdeRd< e�s'eXe Ydd¡ƒ�r/d dlZm[Z[m\Z\ dZ]W n+ e^�y]   ejNdk�rGd d l
m_Z_ nd d lPm_Z_ e_ZQe_ZSe_ZTe_ZUe_ZVe_ZWd!Z]Y nw h d"£Z`d5d%d&„ZaG d'd(„ d(eƒZbG d)d*„ d*ebƒZcG d+d,„ d,ebƒZde]�r¤G d-d.„ d.ebƒZeG d/d0„ d0ebƒZfG d1d2„ d2eeƒZgG d3d4„ d4ebƒZhdS dS )6é    )ÚannotationsN)ÚABCÚabstractmethod)	ÚTYPE_CHECKINGÚAnyÚClassVarÚLiteralÚNoReturnÚUnionÚcastÚget_argsÚoverloadé   ©ÚInvalidKeyError)ÚHashlibHashÚJWKDict)	Úbase64url_decodeÚbase64url_encodeÚder_to_raw_signatureÚforce_bytesÚfrom_base64url_uintÚis_pem_formatÚ
is_ssh_keyÚraw_to_der_signatureÚto_base64url_uint)ÚInvalidSignatureÚUnsupportedAlgorithm)Údefault_backend)Úhashes)Úpadding)
ÚECDSAÚ	SECP256K1Ú	SECP256R1Ú	SECP384R1Ú	SECP521R1ÚEllipticCurveÚEllipticCurvePrivateKeyÚEllipticCurvePrivateNumbersÚEllipticCurvePublicKeyÚEllipticCurvePublicNumbers)ÚEd448PrivateKeyÚEd448PublicKey)ÚEd25519PrivateKeyÚEd25519PublicKey)ÚRSAPrivateKeyÚRSAPrivateNumbersÚRSAPublicKeyÚRSAPublicNumbersÚrsa_crt_dmp1Úrsa_crt_dmq1Úrsa_crt_iqmpÚrsa_recover_prime_factors)ÚEncodingÚNoEncryptionÚPrivateFormatÚPublicFormatÚload_pem_private_keyÚload_pem_public_keyÚload_ssh_public_key)é   é
   )Ú	TypeAliasr@   ÚAllowedRSAKeysÚAllowedECKeysÚAllowedOKPKeysÚAllowedKeysÚAllowedPrivateKeysÚAllowedPublicKeysZSPHINX_BUILDÚ )ÚPrivateKeyTypesÚPublicKeyTypesT)r>   é   )ÚNeverF>   ÚRS384ÚES256KÚES256ÚES512ÚEdDSAÚPS384ÚRS512ÚES521ÚPS256ÚRS256ÚPS512ÚES384Úreturnúdict[str, Algorithm]c                  C  sœ   t ƒ ttjƒttjƒttjƒdœ} trL|  ttjƒttjƒttjƒttjt	ƒttjt
ƒttjtƒttjtƒttjtƒttjƒttjƒttjƒtƒ dœ¡ | S )zE
    Returns the algorithms that are implemented by the library.
    )ÚnoneZHS256ZHS384ZHS512)rU   rL   rR   rN   rM   rW   rS   rO   rT   rQ   rV   rP   N)ÚNoneAlgorithmÚHMACAlgorithmÚSHA256ÚSHA384ÚSHA512Ú
has_cryptoÚupdateÚRSAAlgorithmÚECAlgorithmr#   r"   r$   r%   ÚRSAPSSAlgorithmÚOKPAlgorithm)Zdefault_algorithms© rf   úTC:\Users\psant\Downloads\PAF backend\school\venv\Lib\site-packages\jwt/algorithms.pyÚget_default_algorithmsŒ   s0   ü



ÿòÿrh   c                   @  s¼   e Zd ZU dZdZded< d,dd	„Zd-dd„Zed.dd„ƒZ	ed/dd„ƒZ
ed0dd„ƒZeeed1dd„ƒƒƒZeee	d2d3d"d„ƒƒƒZeed2d4d$d„ƒƒZeed5d'd(„ƒƒZd6d*d+„ZdS )7Ú	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    Nz$tuple[type[AllowedKeys], ...] | NoneÚ_crypto_key_typesÚbytestrÚbytesrX   c                 C  sj   t | ddƒ}|du rt‚tr-t|tƒr-t|tjƒr-tj|ƒ t	ƒ d�}| 
|¡ t| ¡ ƒS t||ƒ ¡ ƒS )z�
        Compute a hash digest using the specified algorithm's hash algorithm.

        If there is no hash algorithm, raises a NotImplementedError.
        Úhash_algN)Úbackend)ÚgetattrÚNotImplementedErrorr`   Ú
isinstanceÚtypeÚ
issubclassr   ZHashAlgorithmZHashr   ra   rl   ÚfinalizeÚdigest)Úselfrk   rm   ru   rf   rf   rg   Úcompute_hash_digest¶   s   ÿþ
ý
zAlgorithm.compute_hash_digestÚkeyú PublicKeyTypes | PrivateKeyTypesÚNonec                 C  s`   t r| jdu rtdƒ‚t|| jƒs.dd„ | jD ƒ}|jj}| jj}td|› d|› d|› �ƒ‚dS )ac  Check that the key belongs to the right cryptographic family.

        Note that this method only works when ``cryptography`` is installed.

        :param key: Potentially a cryptography key
        :type key: :py:data:`PublicKeyTypes <cryptography.hazmat.primitives.asymmetric.types.PublicKeyTypes>` | :py:data:`PrivateKeyTypes <cryptography.hazmat.primitives.asymmetric.types.PrivateKeyTypes>`
        :raises ValueError: if ``cryptography`` is not installed, or this method is called by a non-cryptography algorithm
        :raises InvalidKeyError: if the key doesn't match the expected key classes
        NzhThis method requires the cryptography library, and should only be used by cryptography-based algorithms.c                 s  s   � | ]}|j V  qd S ©N)Ú__name__)Ú.0Úclsrf   rf   rg   Ú	<genexpr>Ü   s   € z2Algorithm.check_crypto_key_type.<locals>.<genexpr>zExpected one of z, got: z. Invalid Key type for )r`   rj   Ú
ValueErrorrq   Ú	__class__r|   r   )rv   rx   Zvalid_classesZactual_classZ
self_classrf   rf   rg   Úcheck_crypto_key_typeÌ   s   
ÿÿüzAlgorithm.check_crypto_key_typer   c                 C  ó   dS )zš
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        Nrf   ©rv   rx   rf   rf   rg   Úprepare_keyã   ó    zAlgorithm.prepare_keyÚmsgc                 C  rƒ   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        Nrf   ©rv   r‡   rx   rf   rf   rg   Úsignê   r†   zAlgorithm.signÚsigÚboolc                 C  rƒ   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        Nrf   ©rv   r‡   rx   rŠ   rf   rf   rg   Úverifyñ   r†   zAlgorithm.verifyÚkey_objÚas_dictúLiteral[True]r   c                 C  ó   d S r{   rf   ©rŽ   r�   rf   rf   rg   Úto_jwkø   s   zAlgorithm.to_jwkFúLiteral[False]Ústrc                 C  r‘   r{   rf   r’   rf   rf   rg   r“   ý   ó   úJWKDict | strc                 C  rƒ   )z3
        Serializes a given key into a JWK
        Nrf   r’   rf   rf   rg   r“     r†   Újwkústr | JWKDictc                 C  rƒ   )zJ
        Deserializes a given key from JWK back into a key object
        Nrf   ©r˜   rf   rf   rg   Úfrom_jwk  r†   zAlgorithm.from_jwkú
str | Nonec                 C  rƒ   )zŽ
        Return a warning message if the key is below the minimum
        recommended length for this algorithm, or None if adequate.
        Nrf   r„   rf   rf   rg   Úcheck_key_length  r–   zAlgorithm.check_key_length)rk   rl   rX   rl   )rx   ry   rX   rz   )rx   r   rX   r   )r‡   rl   rx   r   rX   rl   )r‡   rl   rx   r   rŠ   rl   rX   r‹   )rŽ   r   r�   r�   rX   r   ©F)rŽ   r   r�   r”   rX   r•   )rŽ   r   r�   r‹   rX   r—   )r˜   r™   rX   r   )rx   r   rX   rœ   )r|   Ú
__module__Ú__qualname__Ú__doc__rj   Ú__annotations__rw   r‚   r   r…   r‰   r�   r   Ústaticmethodr“   r›   r�   rf   rf   rf   rg   ri   ®   s6   
 

ÿri   c                   @  sL   e Zd ZdZddd„Zdd
d„Zddd„Zedd dd„ƒZed!dd„ƒZ	dS )"r[   zZ
    Placeholder for use when no signing or verification
    operations are required.
    rx   rœ   rX   rz   c                 C  s    |dkrd }|d urt dƒ‚|S )NrG   z*When alg = "none", key value must be None.r   r„   rf   rf   rg   r…      s
   zNoneAlgorithm.prepare_keyr‡   rl   c                 C  rƒ   )Nó    rf   rˆ   rf   rf   rg   r‰   )  ó   zNoneAlgorithm.signrŠ   r‹   c                 C  rƒ   )NFrf   rŒ   rf   rf   rg   r�   ,  r¥   zNoneAlgorithm.verifyFrŽ   r   r�   r	   c                 C  ó   t ƒ ‚r{   ©rp   r’   rf   rf   rg   r“   /  ó   zNoneAlgorithm.to_jwkr˜   r™   c                 C  r¦   r{   r§   rš   rf   rf   rg   r›   3  r¨   zNoneAlgorithm.from_jwkN)rx   rœ   rX   rz   )r‡   rl   rx   rz   rX   rl   )r‡   rl   rx   rz   rŠ   rl   rX   r‹   rž   )rŽ   r   r�   r‹   rX   r	   )r˜   r™   rX   r	   )
r|   rŸ   r    r¡   r…   r‰   r�   r£   r“   r›   rf   rf   rf   rg   r[     s    

	
r[   c                   @  s²   e Zd ZU dZejZded< ejZ	ded< ej
Zded< d,d
d„Zd-dd„Zeed.dd„ƒƒZeed/d0dd„ƒƒZed/d1dd„ƒZed2d d!„ƒZd3d#d$„Zd4d&d'„Zd5d)d*„Zd+S )6r\   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    zClassVar[HashlibHash]r]   r^   r_   rm   r   rX   rz   c                 C  ó
   || _ d S r{   ©rm   ©rv   rm   rf   rf   rg   Ú__init__B  ó   
zHMACAlgorithm.__init__rx   ústr | bytesrl   c                 C  s$   t |ƒ}t|ƒst|ƒrtdƒ‚|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r   r   r   )rv   rx   Ú	key_bytesrf   rf   rg   r…   E  s   ÿzHMACAlgorithm.prepare_keyrŽ   r�   r�   r   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   P  ó   zHMACAlgorithm.to_jwkFr”   r•   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   T  r°   r‹   r—   c                 C  s(   t t| ƒƒ ¡ ddœ}|r|S t |¡S )NÚoct)ÚkÚkty)r   r   ÚdecodeÚjsonÚdumps)rŽ   r�   r˜   rf   rf   rg   r“   X  s   þ
r˜   r™   c                 C  sj   zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr/tdƒ‚t|d ƒS )NúKey is not valid JSONr³   r±   zNot an HMAC keyr²   )	rq   r•   rµ   ÚloadsÚdictr€   r   Úgetr   )r˜   Úobjrf   rf   rg   r›   d  s   

€
ÿzHMACAlgorithm.from_jwkrœ   c                 C  s@   |   ¡ j}t|ƒ|k rdt|ƒ› d|› d|   ¡ j ¡ › d�S d S )NzThe HMAC key is z> bytes long, which is below the minimum recommended length of z bytes for z. See RFC 7518 Section 3.2.)rm   Údigest_sizeÚlenÚnameÚupper)rv   rx   Z
min_lengthrf   rf   rg   r�   u  s   
ÿþÿzHMACAlgorithm.check_key_lengthr‡   c                 C  s   t  ||| j¡ ¡ S r{   )ÚhmacÚnewrm   ru   rˆ   rf   rf   rg   r‰   €  ó   zHMACAlgorithm.signrŠ   c                 C  s   t  ||  ||¡¡S r{   )rÀ   Úcompare_digestr‰   rŒ   rf   rf   rg   r�   ƒ  rÂ   zHMACAlgorithm.verifyN)rm   r   rX   rz   )rx   r®   rX   rl   )rŽ   r®   r�   r�   rX   r   rž   )rŽ   r®   r�   r”   rX   r•   )rŽ   r®   r�   r‹   rX   r—   )r˜   r™   rX   rl   )rx   rl   rX   rœ   )r‡   rl   rx   rl   rX   rl   )r‡   rl   rx   rl   rŠ   rl   rX   r‹   )r|   rŸ   r    r¡   ÚhashlibÚsha256r]   r¢   Úsha384r^   Úsha512r_   r¬   r…   r   r£   r“   r›   r�   r‰   r�   rf   rf   rf   rg   r\   8  s(   
 



r\   c                   @  sà   e Zd ZU dZejZded< ejZded< ejZded< e	e
ee df eeeef ƒƒZdZded	< d3dd„Zd4dd„Zd5dd„Zeed6dd„ƒƒZeed7d8d!d„ƒƒZed7d9d$d„ƒZed:d'd(„ƒZd;d,d-„Zd<d0d1„Zd2S )=rb   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        ú$ClassVar[type[hashes.HashAlgorithm]]r]   r^   r_   .i   zClassVar[int]Ú_MIN_KEY_SIZErm   útype[hashes.HashAlgorithm]rX   rz   c                 C  r©   r{   rª   r«   rf   rf   rg   r¬   ™  r­   zRSAAlgorithm.__init__rx   rA   rœ   c                 C  s&   |j | jk rd|j › d| j› d�S d S )NzThe RSA key is z; bits long, which is below the minimum recommended size of z bits. See NIST SP 800-131A.)Úkey_sizerÉ   r„   rf   rf   rg   r�   œ  s   
ÿÿzRSAAlgorithm.check_key_lengthúAllowedRSAKeys | str | bytesc                 C  sÎ   t || jƒrtt|ƒS t |ttfƒstdƒ‚t|ƒ}z%| d¡r/t	|ƒ}|  
|¡ tt|ƒW S t|d d�}|  
|¡ tt|ƒW S  tyf   zt|ƒ}|  
|¡ tt|ƒW  Y S  ttfye   tdƒd ‚w w )NúExpecting a PEM-formatted key.s   ssh-rsa©Úpasswordz(Could not parse the provided public key.)rq   rj   r   rA   rl   r•   Ú	TypeErrorr   Ú
startswithr=   r‚   r1   r;   r/   r€   r<   r   r   )rv   rx   r¯   Ú
public_keyÚprivate_keyrf   rf   rg   r…   ¥  s8   


ÿ

ÿþÿûzRSAAlgorithm.prepare_keyrŽ   r�   r�   r   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   Ã  r°   zRSAAlgorithm.to_jwkFr”   r•   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   Ç  r°   r‹   r—   c                 C  sÚ   d }t | dƒrD|  ¡ }ddgt|jjƒ ¡ t|jjƒ ¡ t|jƒ ¡ t|jƒ ¡ t|j	ƒ ¡ t|j
ƒ ¡ t|jƒ ¡ t|jƒ ¡ dœ
}n t | dƒr`|  ¡ }ddgt|jƒ ¡ t|jƒ ¡ dœ}ntdƒ‚|rh|S t |¡S )NÚprivate_numbersÚRSAr‰   )
r³   Úkey_opsÚnÚeÚdÚpÚqÚdpÚdqÚqir�   )r³   rÖ   r×   rØ   úNot a public or private key)ÚhasattrrÔ   r   Úpublic_numbersr×   r´   rØ   rÙ   rÚ   rÛ   Údmp1Údmq1Úiqmpr   rµ   r¶   )rŽ   r�   r»   Únumbersrf   rf   rg   r“   Ë  s2   
ö
ü
r˜   r™   c           	   	     s²  zt | tƒrt | ¡‰ n
t | tƒr| ‰ nt‚W n ty#   tdƒd ‚w ˆ  d¡dkr0tdƒd ‚dˆ v r¾dˆ v r¾dˆ v r¾dˆ v rDtd	ƒ‚g d
¢}‡ fdd„|D ƒ}t|ƒ}|r`t	|ƒs`tdƒd ‚t
tˆ d ƒtˆ d ƒƒ}|r–ttˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒtˆ d ƒ|d�}| ¡ S tˆ d ƒ}t|j||jƒ\}}t|||t||ƒt||ƒt||ƒ|d�}| ¡ S dˆ v rÕdˆ v rÕt
tˆ d ƒtˆ d ƒƒ ¡ S tdƒ‚)Nr·   r³   rÕ   zNot an RSA keyrÙ   rØ   r×   Zothz5Unsupported RSA private key: > 2 primes not supported)rÚ   rÛ   rÜ   rÝ   rÞ   c                   s   g | ]}|ˆ v ‘qS rf   rf   )r}   Úprop©r»   rf   rg   Ú
<listcomp>	  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides drÚ   rÛ   rÜ   rÝ   rÞ   )rÙ   rÚ   rÛ   râ   rã   rä   rá   rß   )rq   r•   rµ   r¸   r¹   r€   r   rº   ÚanyÚallr2   r   r0   r6   r×   rØ   r3   r4   r5   rÓ   rÒ   )	r˜   Zother_propsZprops_foundZany_props_foundrá   rå   rÙ   rÚ   rÛ   rf   rç   rg   r›   ò  s~   

€
ÿ
ÿÿþ

þ





ùñ
ÿù


þýzRSAAlgorithm.from_jwkr‡   rl   r/   c                 C  s   |  |t ¡ |  ¡ ¡}|S r{   )r‰   r    ÚPKCS1v15rm   ©rv   r‡   rx   Ú	signaturerf   rf   rg   r‰   :  s   zRSAAlgorithm.signr1   rŠ   c                 C  s4   z|  ||t ¡ |  ¡ ¡ W dS  ty   Y dS w )NTF)r�   r    rë   rm   r   rŒ   rf   rf   rg   r�   >  s   ÿzRSAAlgorithm.verifyN)rm   rÊ   rX   rz   )rx   rA   rX   rœ   )rx   rÌ   rX   rA   )rŽ   rA   r�   r�   rX   r   rž   )rŽ   rA   r�   r”   rX   r•   )rŽ   rA   r�   r‹   rX   r—   )r˜   r™   rX   rA   ©r‡   rl   rx   r/   rX   rl   ©r‡   rl   rx   r1   rŠ   rl   rX   r‹   )r|   rŸ   r    r¡   r   r]   r¢   r^   r_   r   Útuplerr   rD   r   r
   r/   r1   rj   rÉ   r¬   r�   r…   r   r£   r“   r›   r‰   r�   rf   rf   rf   rg   rb   ‰  s2   
 þ


	&
Grb   c                   @  sØ   e Zd ZU dZejZded< ejZded< ejZded< e	e
ee df eeeef ƒƒZ	d0d1dd„Zd2dd„Zd3dd„Zd4dd„Zd5dd„Zeed6d$d%„ƒƒZeed7d8d)d%„ƒƒZed7d9d+d%„ƒZed:d.d/„ƒZdS );rc   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        rÈ   r]   r^   r_   .Nrm   rÊ   Úexpected_curveútype[EllipticCurve] | NonerX   rz   c                 C  s   || _ || _d S r{   )rm   rñ   )rv   rm   rñ   rf   rf   rg   r¬   T  s   
zECAlgorithm.__init__rx   rB   c                 C  s>   | j du rdS t|j| j ƒstd|jj› d| j j› d�ƒ‚dS )z9Validate that the key's curve matches the expected curve.NzThe key's curve 'z%' does not match the expected curve 'z' for this algorithm)rñ   rq   Úcurver   r¾   r„   rf   rf   rg   Ú_validate_curve\  s   
ÿÿÿzECAlgorithm._validate_curveúAllowedECKeys | str | bytesc                 C  sÄ   t || jƒrtt|ƒ}|  |¡ |S t |ttfƒstdƒ‚t|ƒ}z | 	d¡r,t
|ƒ}nt|ƒ}|  |¡ tt|ƒ}|  |¡ |W S  tya   t|d d�}|  |¡ tt|ƒ}|  |¡ | Y S w )NrÍ   s   ecdsa-sha2-rÎ   )rq   rj   r   rB   rô   rl   r•   rÐ   r   rÑ   r=   r<   r‚   r)   r€   r;   r'   )rv   rx   Zec_keyr¯   rÒ   Zec_public_keyrÓ   Zec_private_keyrf   rf   rg   r…   g  s,   









ûzECAlgorithm.prepare_keyr‡   rl   r'   c                 C  s    |  |t|  ¡ ƒ¡}t||jƒS r{   )r‰   r!   rm   r   ró   )rv   r‡   rx   Úder_sigrf   rf   rg   r‰   ‡  s   zECAlgorithm.signrŠ   r‹   c                 C  sn   zt ||jƒ}W n
 ty   Y dS w zt|tƒr| ¡ n|}| ||t|  ¡ ƒ¡ W dS  t	y6   Y dS w )NFT)
r   ró   r€   rq   r'   rÒ   r�   r!   rm   r   )rv   r‡   rx   rŠ   rö   rÒ   rf   rf   rg   r�   Œ  s   ÿ
ÿýÿzECAlgorithm.verifyrŽ   r�   r�   r   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   �  r°   zECAlgorithm.to_jwkFr”   r•   c                 C  r‘   r{   rf   r’   rf   rf   rg   r“   ¡  r°   r—   c                 C  sø   t | tƒr|  ¡  ¡ }nt | tƒr|  ¡ }ntdƒ‚t | jtƒr#d}n#t | jtƒr,d}nt | jt	ƒr5d}nt | jt
ƒr>d}ntd| j› �ƒ‚d|t|j| jjd� ¡ t|j| jjd� ¡ d	œ}t | tƒrst|  ¡ j| jjd� ¡ |d
< |rw|S t |¡S )Nrß   úP-256úP-384úP-521Ú	secp256k1úInvalid curve: ÚEC)Ú
bit_length)r³   ÚcrvÚxÚyrÙ   )rq   r'   rÒ   rá   r)   r   ró   r#   r$   r%   r"   r   rÿ   rË   r´   r   rÔ   Zprivate_valuerµ   r¶   )rŽ   r�   rá   rþ   r»   rf   rf   rg   r“   ¥  sJ   


þþö
þý
r˜   r™   c                 C  s  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr0tdƒd ‚d|vs8d|vr=tdƒd ‚t| d¡ƒ}t| d¡ƒ}| d¡}|dkrmt	|ƒt	|ƒ  krbd	krhn nt
ƒ }netd
ƒd ‚|dkrŠt	|ƒt	|ƒ  krdkr…n ntƒ }nHtdƒd ‚|dkr§t	|ƒt	|ƒ  krœdkr¢n ntƒ }n+tdƒd ‚|dkrÆt	|ƒt	|ƒ  kr¹d	krÂn tdƒ‚tƒ }ntdƒ‚td|› �ƒ‚ttj|dd�tj|dd�|d�}d|vræ| ¡ S t| d¡ƒ}t	|ƒt	|ƒkrýtdt	|ƒ|ƒ‚ttj|dd�|ƒ ¡ S )Nr·   r³   rü   zNot an Elliptic curve keyrÿ   r   rþ   r÷   é    z)Coords should be 32 bytes for curve P-256rø   é0   z)Coords should be 48 bytes for curve P-384rù   éB   z)Coords should be 66 bytes for curve P-521rú   z-Coords should be 32 bytes for curve secp256k1rû   Úbig)Ú	byteorder)rÿ   r   ró   rÙ   z!D should be {} bytes for curve {})rq   r•   rµ   r¸   r¹   r€   r   rº   r   r½   r#   r$   r%   r"   r*   ÚintÚ
from_bytesrÒ   r(   rÓ   )r˜   r»   rÿ   r   ró   Z	curve_objrá   rÙ   rf   rf   rg   r›   Ñ  sˆ   

€
ÿ


 ÿþ ÿþ ÿþÿþÿý
ÿÿþzECAlgorithm.from_jwkr{   )rm   rÊ   rñ   rò   rX   rz   )rx   rB   rX   rz   )rx   rõ   rX   rB   )r‡   rl   rx   r'   rX   rl   )r‡   rl   rx   rB   rŠ   rl   rX   r‹   )rŽ   rB   r�   r�   rX   r   rž   )rŽ   rB   r�   r”   rX   r•   )rŽ   rB   r�   r‹   rX   r—   )r˜   r™   rX   rB   )r|   rŸ   r    r¡   r   r]   r¢   r^   r_   r   rð   rr   rD   r   r
   r'   r)   rj   r¬   rô   r…   r‰   r�   r   r£   r“   r›   rf   rf   rf   rg   rc   E  s2   
 þý


 
+rc   c                   @  s$   e Zd ZdZddd„Zddd„ZdS )rd   zA
        Performs a signature using RSASSA-PSS with MGF1
        r‡   rl   rx   r/   rX   c                 C  s0   |  |tjt |  ¡ ¡|  ¡ jd�|  ¡ ¡}|S )N©ZmgfZsalt_length)r‰   r    ÚPSSÚMGF1rm   r¼   rì   rf   rf   rg   r‰      s   þúzRSAPSSAlgorithm.signr1   rŠ   r‹   c              	   C  sJ   z|  ||tjt |  ¡ ¡|  ¡ jd�|  ¡ ¡ W dS  ty$   Y dS w )Nr  TF)r�   r    r	  r
  rm   r¼   r   rŒ   rf   rf   rg   r�   +  s   þù	ÿzRSAPSSAlgorithm.verifyNrî   rï   )r|   rŸ   r    r¡   r‰   r�   rf   rf   rf   rg   rd     s    
rd   c                   @  s¢   e Zd ZdZeeee df ee	e
eeef ƒƒZd(dd„Zd)dd„Zd*dd„Zd+dd„Zeed,dd„ƒƒZeed-d.d d„ƒƒZed-d/d"d„ƒZed0d%d&„ƒZd'S )1re   zŽ
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        .Úkwargsr   rX   rz   c                 K  r‘   r{   rf   )rv   r  rf   rf   rg   r¬   M  r¥   zOKPAlgorithm.__init__rx   úAllowedOKPKeys | str | bytesrC   c                 C  sª   t |ttfƒs|  |¡ |S t |tƒr| d¡n|}t |tƒr$| d¡n|}d|v r/t|ƒ}nd|v r:t|d d�}n|dd… dkrGt|ƒ}nt	dƒ‚|  |¡ t
d	|ƒS )
Núutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErÎ   r   é   zssh-rß   rC   )rq   r•   rl   r‚   r´   Úencoder<   r;   r=   r   r   )rv   rx   Zkey_strr¯   Z
loaded_keyrf   rf   rg   r…   P  s   




zOKPAlgorithm.prepare_keyr‡   r®   ú#Ed25519PrivateKey | Ed448PrivateKeyrl   c                 C  s&   t |tƒr
| d¡n|}| |¡}|S )aS  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` isinstance
            :return bytes signature: The signature, as bytes
            r  N)rq   r•   r  r‰   )rv   r‡   rx   Ú	msg_bytesrí   rf   rf   rg   r‰   f  s   

zOKPAlgorithm.signrŠ   r‹   c                 C  sr   z.t |tƒr| d¡n|}t |tƒr| d¡n|}t |ttfƒr$| ¡ n|}| ||¡ W dS  ty8   Y dS w )aÄ  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r  TFN)rq   r•   r  r-   r+   rÒ   r�   r   )rv   r‡   rx   rŠ   r  Z	sig_bytesrÒ   rf   rf   rg   r�   t  s   
ÿýÿzOKPAlgorithm.verifyr�   r�   r   c                 C  r‘   r{   rf   ©rx   r�   rf   rf   rg   r“   Ž  r°   zOKPAlgorithm.to_jwkFr”   r•   c                 C  r‘   r{   rf   r  rf   rf   rg   r“   ’  r°   r—   c                 C  sè   t | ttfƒr.| jtjtjd�}t | tƒrdnd}tt|ƒƒ 	¡ d|dœ}|r)|S t
 |¡S t | ttfƒrp| jtjtjtƒ d�}|  ¡ jtjtjd�}t | tƒrRdnd}tt|ƒƒ 	¡ tt|ƒƒ 	¡ d|dœ}|rk|S t
 |¡S tdƒ‚)	N)ÚencodingÚformatÚEd25519ÚEd448ÚOKP)rÿ   r³   rþ   )r  r  Zencryption_algorithm)rÿ   rÙ   r³   rþ   rß   )rq   r.   r,   Úpublic_bytesr7   ZRawr:   r   r   r´   rµ   r¶   r-   r+   Zprivate_bytesr9   r8   rÒ   r   )rx   r�   rÿ   rþ   r»   rÙ   rf   rf   rg   r“   –  sB   þý
ýþü
r˜   r™   c              
   C  s  zt | tƒrt | ¡}n
t | tƒr| }nt‚W n ty#   tdƒd ‚w | d¡dkr/tdƒ‚| d¡}|dkrC|dkrCtd|› �ƒ‚d	|vrKtd
ƒ‚t| d	¡ƒ}z+d|vrg|dkrat	 
|¡W S t 
|¡W S t| d¡ƒ}|dkrxt |¡W S t |¡W S  tyŽ } ztdƒ|‚d }~ww )Nr·   r³   r  zNot an Octet Key Pairrþ   r  r  rû   rÿ   zOKP should have "x" parameterrÙ   zInvalid key parameter)rq   r•   rµ   r¸   r¹   r€   r   rº   r   r.   Zfrom_public_bytesr,   r-   Zfrom_private_bytesr+   )r˜   r»   ró   rÿ   rÙ   Úerrrf   rf   rg   r›   Å  s>   

€
ÿ

€ÿzOKPAlgorithm.from_jwkN)r  r   rX   rz   )rx   r  rX   rC   )r‡   r®   rx   r  rX   rl   )r‡   r®   rx   rC   rŠ   r®   rX   r‹   )rx   rC   r�   r�   rX   r   rž   )rx   rC   r�   r”   rX   r•   )rx   rC   r�   r‹   rX   r—   )r˜   r™   rX   rC   )r|   rŸ   r    r¡   r   rð   rr   rD   r   r
   r-   r.   r+   r,   rj   r¬   r…   r‰   r�   r   r£   r“   r›   rf   rf   rf   rg   re   :  s8    ýÿÿþ



.re   )rX   rY   )iÚ
__future__r   rÄ   rÀ   rµ   ÚosÚsysÚabcr   r   Útypingr   r   r   r   r	   r
   r   r   r   Ú
exceptionsr   Útypesr   r   Úutilsr   r   r   r   r   r   r   r   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr    Z,cryptography.hazmat.primitives.asymmetric.ecr!   r"   r#   r$   r%   r&   r'   r(   r)   r*   Z/cryptography.hazmat.primitives.asymmetric.ed448r+   r,   Z1cryptography.hazmat.primitives.asymmetric.ed25519r-   r.   Z-cryptography.hazmat.primitives.asymmetric.rsar/   r0   r1   r2   r3   r4   r5   r6   Z,cryptography.hazmat.primitives.serializationr7   r8   r9   r:   r;   r<   r=   Úversion_infor@   Ztyping_extensionsrA   r¢   rB   rC   rD   rE   rF   r‹   ÚgetenvZ/cryptography.hazmat.primitives.asymmetric.typesrH   rI   r`   ÚModuleNotFoundErrorrK   Zrequires_cryptographyrh   ri   r[   r\   rb   rc   rd   re   rf   rf   rf   rg   Ú<module>   s†    ,,0($



ÿ
ÿ
ÿô
"lO = W � � �Ê