
    g                         d Z ddlZddlmZ ddlZddlmZ ddlmZ ddlm	Z	 ddlm
Z
 ddlmZ ej                  ej                  ej                  ej                  hZdgZd	Zd
ZdZ G d de
j*                        Zy)zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc                   p    e Zd ZdZd Zd Zed        Z ej                  e
j                        d        Zy)Signera  Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    c                 .    || _         || _        || _        y)a  
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)_request_credentials_service_account_email)selfrequestr   service_account_emails       D/var/www/openai/venv/lib/python3.12/site-packages/google/auth/iam.py__init__zSigner.__init__D   s       '&;#    c                 ^   t        j                  |      }d}t        j                  t        j
                  | j                  j                        j                  | j                        }ddi}t        j                  dt        j                  |      j                  d      i      j                  d      }t!        j"                         }|D ]  }| j                  j%                  | j&                  |||       | j'                  ||||      }|j(                  t*        v rS|j(                  t,        j.                  k7  r.t1        j2                  dj                  |j4                              t        j6                  |j4                  j                  d            c S  t1        j2                  d      )	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestzSigner._make_signing_requestX   s]   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99;A,,T]]FCQ}}V$PW}XH/1+..0 //<CCHMMR  ::hmm227;<<  ''(MNNr   c                      y)zOptional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        N )r   s    r   key_idzSigner.key_idv   s     r   c                 T    | j                  |      }t        j                  |d         S )N
signedBlob)r4   r#   	b64decode)r   r0   r3   s      r   signzSigner.sign   s(    --g6 677r   N)__name__
__module____qualname____doc__r   r4   propertyr7   r   copy_docstringr   r	   r;   r6   r   r   r	   r	   9   sK    <(O<   XU\\*8 +8r   r	   )r?   r#   http.clientclientr+   r!   google.authr   r   r   r   r   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr*   
_IAM_SCOPE_IAM_ENDPOINTr   _IAM_IDTOKEN_ENDPOINTr	   r6   r   r   <module>rL      s     !  ,   #  " %%##	 44
0 % 6 J8U\\ J8r   