
    ]jk                        d Z ddlZddlZddlmZ ddlmZ ddlZddlZddl	m
Z
mZ ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ erddlZ ej0                  e      ZdZdZdZdZdZdZ ejB                  dfdZ" G d dejF                  ejH                  ejJ                  ejL                        Z' G d dejH                        Z(g fdZ)y)a  Google Cloud Impersonated credentials.

This module provides authentication for applications where local credentials
impersonates a remote service account using `IAM Credentials API`_.

This class can be used to impersonate a service account as long as the original
Credential object has the "Service Account Token Creator" role on the target
service account.

    .. _IAM Credentials API:
        https://cloud.google.com/iam/credentials/reference/rest/
    N)datetime)OptionalTYPE_CHECKING)_exponential_backoff)_helperscredentials)
exceptions)iam)jwt)metrics)_clientz*Unable to acquire impersonated credentialsi  z#https://oauth2.googleapis.com/tokenauthorized_userservice_account external_account_authorized_userc                    |xs= t         j                  j                  t        j                  |      j                  |      }t        j                  |      j                  d      } | |d||      }t        |j                  d      r|j                  j                  d      n|j                  }|j                  t        j                  k7  rt        j                   t"        |      	 t        j$                  |      }	|	d   }
t'        j(                  |	d   d      }|
|fS # t*        t,        f$ r1}t        j                   dj                  t"              |      }||d	}~ww xY w)
a  Makes a request to the Google Cloud IAM service for an access token.
    Args:
        request (Request): The Request object to use.
        principal (str): The principal to request an access token for.
        headers (Mapping[str, str]): Map of headers to transmit.
        body (Mapping[str, str]): JSON Payload body for the iamcredentials
            API call.
        iam_endpoint_override (Optiona[str]): The full IAM endpoint override
            with the target_principal embedded. This is useful when supporting
            impersonation with regional endpoints.

    Raises:
        google.auth.exceptions.TransportError: Raised if there is an underlying
            HTTP connection error
        google.auth.exceptions.RefreshError: Raised if the impersonated
            credentials are not available.  Common reasons are
            `iamcredentials.googleapis.com` is not enabled or the
            `Service Account Token Creator` is not assigned
    utf-8POSTurlmethodheadersbodydecodeaccessToken
expireTimez%Y-%m-%dT%H:%M:%SZz6{}: No access token or invalid expiration in response.N)r   _IAM_ENDPOINTreplacer	   DEFAULT_UNIVERSE_DOMAINformatjsondumpsencodehasattrdatar   statushttp_clientOKr
   RefreshError_REFRESH_ERRORloadsr   strptimeKeyError
ValueError)request	principalr   r   universe_domainiam_endpoint_overrideiam_endpointresponseresponse_bodytoken_responsetokenexpiry
caught_excnew_excs                 N/root/env/lib/python3.12/site-packages/google/auth/impersonated_credentials.py_make_iam_token_requestr<   A   s=   6 ) C,=,=,E,E++_-fY  ::d""7+D<dSH
 8==(+ 	W%]]  +..(%%nmDD&M2}-"">,#?AUVf}j! &))DKK 	
 :%&s   '6D E-,EEc                   v    e Zd ZdZddedddf fd	Zd Zd Z	 d	 ddZd Z	e
d        Ze
d	        Ze
d
        Ze
d        Z ej                   ej$                        d        Zd Z ej                   ej*                        d        Z ej                   ej.                        dd       Zedd       Z xZS )Credentialsar
  This module defines impersonated credentials which are essentially
    impersonated identities.

    Impersonated Credentials allows credentials issued to a user or
    service account to impersonate another. The target service account must
    grant the originating credential principal the
    `Service Account Token Creator`_ IAM role:

    For more information about Token Creator IAM role and
    IAMCredentials API, see
    `Creating Short-Lived Service Account Credentials`_.

    .. _Service Account Token Creator:
        https://cloud.google.com/iam/docs/service-accounts#the_service_account_token_creator_role

    .. _Creating Short-Lived Service Account Credentials:
        https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials

    Usage:

    First grant source_credentials the `Service Account Token Creator`
    role on the target account to impersonate.   In this example, the
    service account represented by svc_account.json has the
    token creator role on
    `impersonated-account@_project_.iam.gserviceaccount.com`.

    Enable the IAMCredentials API on the source project:
    `gcloud services enable iamcredentials.googleapis.com`.

    Initialize a source credential which does not have access to
    list bucket::

        from google.oauth2 import service_account

        target_scopes = [
            'https://www.googleapis.com/auth/devstorage.read_only']

        source_credentials = (
            service_account.Credentials.from_service_account_file(
                '/path/to/svc_account.json',
                scopes=target_scopes))

    Now use the source credentials to acquire credentials to impersonate
    another service account::

        from google.auth import impersonated_credentials

        target_credentials = impersonated_credentials.Credentials(
          source_credentials=source_credentials,
          target_principal='impersonated-account@_project_.iam.gserviceaccount.com',
          target_scopes = target_scopes,
          lifetime=500)

    Resource access is granted::

        client = storage.Client(credentials=target_credentials)
        buckets = client.list_buckets(project='your_project')
        for bucket in buckets:
          print(bucket.name)

    **IMPORTANT**:
    This class does not validate the credential configuration. A security
    risk occurs when a credential configuration configured with malicious urls
    is used.
    When the credential configuration is accepted from an
    untrusted source, you should validate it before using.
    Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details.
    Nc
                    t         t        |           t        j                  |      | _        t        | j                  t        j                        ru| j                  j                  t        j                        | _        t        | j                  d      r1| j                  j                  r| j                  j                  d       |j                  | _        || _        || _        || _        || _        |xs t(        | _        d| _        t/        j0                         | _        || _        || _        d| _        |	| _        y)ap  
        Args:
            source_credentials (google.auth.Credentials): The source credential
                used as to acquire the impersonated credentials.
            target_principal (str): The service account to impersonate.
            target_scopes (Sequence[str]): Scopes to request during the
                authorization grant.
            delegates (Sequence[str]): The chained list of delegates required
                to grant the final access_token.  If set, the sequence of
                identities must have "Service Account Token Creator" capability
                granted to the prceeding identity.  For example, if set to
                [serviceAccountB, serviceAccountC], the source_credential
                must have the Token Creator role on serviceAccountB.
                serviceAccountB must have the Token Creator on
                serviceAccountC.
                Finally, C must have Token Creator on target_principal.
                If left unset, source_credential must have that role on
                target_principal.
            lifetime (int): Number of seconds the delegated credential should
                be valid for (upto 3600).
            quota_project_id (Optional[str]): The project ID used for quota and billing.
                This project may be different from the project used to
                create the credentials.
            iam_endpoint_override (Optional[str]): The full IAM endpoint override
                with the target_principal embedded. This is useful when supporting
                impersonation with regional endpoints.
            subject (Optional[str]): sub field of a JWT. This field should only be set
                if you wish to impersonate as a user. This feature is useful when
                using domain wide delegation.
            trust_boundary (Mapping[str,str]): A credential trust boundary.
        _create_self_signed_jwtN)superr>   __init__copy_source_credentials
isinstancer	   Scopedwith_scopesr   
_IAM_SCOPEr$   _always_use_jwt_accessr@   r1   _universe_domain_target_principal_target_scopes
_delegates_subject_DEFAULT_TOKEN_LIFETIME_SECS	_lifetimer7   r   utcnowr8   _quota_project_id_iam_endpoint_override_cred_file_path_trust_boundary)selfsource_credentialstarget_principaltarget_scopes	delegatessubjectlifetimequota_project_idr2   trust_boundary	__class__s             r;   rB   zCredentials.__init__   s   X 	k4)+#'99-?#@  d..0B0BC'+'?'?'K'K(D$ 002KL,,CC((@@F 2 B B!1+#!A%A
oo'!1&;##-    c                 "    t         j                  S N)r   CRED_TYPE_SA_IMPERSONATErV   s    r;   _metric_header_for_usagez$Credentials._metric_header_for_usage  s    ///r`   c                 x   | j                   j                  t        j                  j                  k(  s1| j                   j                  t        j                  j
                  k(  r| j                   j                  |       | j                  | j                  t        | j                        dz   d}ddt        j                  t        j                         i}| j                   j                  |       | j                  r| j                   t        j"                  k7  rt%        j&                  d      t)        j*                         }| j,                  t)        j.                  | j                  xs d      | j                  t0        t)        j2                  |      t)        j2                  |      t4        z   d}t7        || j,                  ||| j                        }t9        j:                  |t0        |      \  | _        | _        }y	tA        || j,                  ||| j                   | jB                  
      \  | _        | _        y	)zUpdates credentials with a new access_token representing
        the impersonated account.

        Args:
            request (google.auth.transport.requests.Request): Request object
                to use for refreshing credentials.
        s)rZ   scoper\   Content-Typeapplication/jsonzNDomain-wide delegation is not supported in universes other than googleapis.com )issrh   subaudiatexp)r/   r0   r   payloadrZ   N)r/   r0   r   r   r1   r2   )"rD   token_stater	   
TokenStateSTALEINVALIDrefreshrM   rL   strrP   r   API_CLIENT_HEADER&token_request_access_token_impersonateapplyrN   r1   r   r
   GoogleAuthErrorr   rQ   rK   scopes_to_string_GOOGLE_OAUTH2_TOKEN_ENDPOINTdatetime_to_secsrO   _sign_jwt_requestr   	jwt_grantr7   r8   r<   rS   )rV   r/   r   r   nowrq   	assertion_s           r;   _perform_refresh_tokenz"Credentials._perform_refresh_token  s    $$00K4J4J4P4PP''33{7M7M7U7UU$$,,W5 ((DNN+c1
 .%%w'U'U'W
 	  &&w/ ==##{'J'JJ 00, 
 //#C--!2243F3F3L"M}}40050058TTG *00//I *1):):6	*&DJQ "9,, 00"&"="=#

DKr`   c                     | j                   st        j                  d       yt        j                  j                  | j                         S )a  Builds and returns the URL for the Regional Access Boundary lookup API.

        This method constructs the specific URL for the IAM Credentials API's
        `allowedLocations` endpoint, using the credential's universe domain
        and service account email.

        Returns:
            Optional[str]: The URL for the Regional Access Boundary lookup endpoint, or None
                 if the service account email is missing.
        zpService account email is required to build the Regional Access Boundary lookup URL for impersonated credentials.N)service_account_email)r   _LOGGERerrorr   9_SERVICE_ACCOUNT_REGIONAL_ACCESS_BOUNDARY_LOOKUP_ENDPOINTr    )rV   r/   s     r;   *_build_regional_access_boundary_lookup_urlz6Credentials._build_regional_access_boundary_lookup_urla  sL     ))MM C LLSS"&"<"< T 
 	
r`   c                 Z   ddl m} t        j                  j	                  t
        j                  | j                        j                  | j                        }t        j                  |      j                  d      | j                  d}ddi} || j                        }	 t        j                          }|D ]  }|j#                  |||      }	|	j$                  t        j&                  v r4|	j$                  t(        j*                  k7  r2t-        j.                  dj                  |	j1                                     t        j2                  |	j1                         d	         c |j5                          S  	 |j5                          t-        j.                  d
      # |j5                          w xY w)Nr   AuthorizedSessionr   )rq   rZ   ri   rj   )r   r   r!   zError calling sign_bytes: {}
signedBlobz#exhausted signBlob endpoint retries)google.auth.transport.requestsr   r   _IAM_SIGN_ENDPOINTr   r	   r   r1   r    rK   base64	b64encoder   rM   rD   r   ExponentialBackoffpoststatus_codeIAM_RETRY_CODESr'   r(   r
   TransportErrorr!   	b64decodeclose)
rV   messager   iam_sign_endpointr   r   authed_sessionretriesr   r4   s
             r;   
sign_byteszCredentials.sign_bytesw  sq   D22:://1E1E

&''
( 	
 ''077@

 "#56*4+C+CD	#*==?G G)..)7 /  ''3+>+>>'';>>9$336==hmmoN  ''(EFF  "G   "''(MNN   "s    C F 1F F*c                     | j                   S rb   rK   rd   s    r;   signer_emailzCredentials.signer_email      %%%r`   c                     | j                   S rb   r   rd   s    r;   r   z!Credentials.service_account_email  r   r`   c                     | S rb   rk   rd   s    r;   signerzCredentials.signer  s    r`   c                     | j                    S rb   )rL   rd   s    r;   requires_scopeszCredentials.requires_scopes  s    &&&&r`   c                 P    | j                   r| j                   d| j                  dS y )Nzimpersonated credentials)credential_sourcecredential_typer0   )rT   rK   rd   s    r;   get_cred_infozCredentials.get_cred_info  s/    %)%9%9#=!33 
 r`   c           
         | j                  | j                  | j                  | j                  | j                  | j
                  | j                  | j                  | j                        }| j                  |_	        | j                  |       |S )N)rX   rY   rZ   r\   r]   r2   r^   )r_   rD   rK   rL   rM   rP   rR   rS   rU   rT   &_copy_regional_access_boundary_manager)rV   creds     r;   
_make_copyzCredentials._make_copy  s|    ~~$$!33--oo^^!33"&"="=//  	
  $3333D9r`   c                 4    | j                         }||_        |S rb   )r   rR   )rV   r]   r   s      r;   with_quota_projectzCredentials.with_quota_project  s     !1r`   c                 <    | j                         }|xs ||_        |S rb   )r   rL   )rV   scopesdefault_scopesr   s       r;   rG   zCredentials.with_scopes  s      $6r`   c                    |j                  d      }|j                  d      }|t        k(  r"ddlm} |j                  j                  |      }nz|t        k(  r"ddlm} |j                  j                  |      }nO|t        k(  r"ddl
m} |j                  j                  |      }n$t        j                  dj                  |            |j                  d      }	|	j!                  d	      }
|	j#                  d
      }|
dk(  s
|dk(  s|
|kD  r$t        j$                  dj                  |	            |	|
dz   | }|j                  d      }|j                  d      }|xs |j                  d      }|j                  d      } | ||||||      S )a  Creates a Credentials instance from parsed impersonated service account credentials info.

        **IMPORTANT**:
        This method does not validate the credential configuration. A security
        risk occurs when a credential configuration configured with malicious urls
        is used.
        When the credential configuration is accepted from an
        untrusted source, you should validate it before using with this method.
        Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details.

        Args:
            info (Mapping[str, str]): The impersonated service account credentials info in Google
                format.
            scopes (Sequence[str]): Optional list of scopes to include in the
                credentials.

        Returns:
            google.oauth2.credentials.Credentials: The constructed
                credentials.

        Raises:
            InvalidType: If the info["source_credentials"] are not a supported impersonation type
            InvalidValue: If the info["service_account_impersonation_url"] is not in the expected format.
            ValueError: If the info is not in the expected format.
        rW   typer   r   )r   )r   z.source credential of type {} is not supported.!service_account_impersonation_url/z:generateAccessTokenz'Cannot extract target principal from {}   rZ   r]   r   r^   )r]   r^   )get'_SOURCE_CREDENTIAL_AUTHORIZED_USER_TYPEgoogle.oauth2r	   r>   from_authorized_user_info'_SOURCE_CREDENTIAL_SERVICE_ACCOUNT_TYPEr   from_service_account_info8_SOURCE_CREDENTIAL_EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPEgoogle.authr   	from_infor
   InvalidTyper    rfindfindInvalidValue)clsinfor   source_credentials_infosource_credentials_typer	   rW   r   r   impersonation_urlstart_index	end_indexrX   rZ   r]   r^   s                   r;   &from_impersonated_service_account_infoz2Credentials.from_impersonated_service_account_info  s   8 #'((+?"@"9"="=f"E"&MM1!,!8!8!R!R'" %(OO5!0!<!<!V!V'" $GH E!A!M!M!W!W'" ((@GG+  !HH%HI'--c2%**+AB	"	R;3J))9@@ARS  -[1_yIHH[)	88$67-488H-"23-)
 	
r`   rb   )r/   z'Optional[google.auth.transport.Request])__name__
__module____qualname____doc__rO   rB   re   r   r   r   propertyr   r   r   r   r   copy_docstringr	   r>   r   r   CredentialsWithQuotaProjectr   rF   rG   classmethodr   __classcell__r_   s   @r;   r>   r>      s-   CT -"J.X0F
R DH
@
, OD & & & &   ' ' X[445 6 X[DDE F
 X[//0 1
 M
 M
r`   r>   c                        e Zd ZdZ	 	 	 d fd	Zd	dZd Zd Z ej                  e
j                        d        Z ej                  e
j                        d        Z xZS )
IDTokenCredentialsz;Open ID Connect ID Token-based service account credentials.c                     t         t        |           t        |t              st        j                  d      || _        || _        || _	        || _
        y)a  
        Args:
            target_credentials (google.auth.Credentials): The target
                credential used as to acquire the id tokens for.
            target_audience (string): Audience to issue the token for.
            include_email (bool): Include email in IdToken
            quota_project_id (Optional[str]):  The project ID used for
                quota and billing.
        z4Provided Credential must be impersonated_credentialsN)rA   r   rB   rE   r>   r
   r{   _target_credentials_target_audience_include_emailrR   )rV   target_credentialstarget_audienceinclude_emailr]   r_   s        r;   rB   zIDTokenCredentials.__init__"  sV      	 $02,k:,,I  $6  /+!1r`   c                 T    | j                  ||| j                  | j                        S N)r   r   r   r]   )r_   r   rR   )rV   r   r   s      r;   from_credentialsz#IDTokenCredentials.from_credentials=  s0    ~~1+--!33	  
 	
r`   c                 h    | j                  | j                  || j                  | j                        S r   )r_   r   r   rR   )rV   r   s     r;   with_target_audiencez'IDTokenCredentials.with_target_audienceE  s6    ~~#77+--!33	  
 	
r`   c                 h    | j                  | j                  | j                  || j                        S r   )r_   r   r   rR   )rV   r   s     r;   with_include_emailz%IDTokenCredentials.with_include_emailM  s6    ~~#77 11'!33	  
 	
r`   c                 h    | j                  | j                  | j                  | j                  |      S r   )r_   r   r   r   )rV   r]   s     r;   r   z%IDTokenCredentials.with_quota_projectU  s6    ~~#77 11---	  
 	
r`   c                 *   ddl m} t        j                  j	                  t
        j                  | j                  j                        j                  | j                  j                        }| j                  | j                  j                  | j                  d}ddt        j                  t        j                          i} || j                  j"                  |      }	 |j%                  ||t'        j(                  |      j+                  d            }|j-                          |j.                  t0        j2                  k7  r2t5        j6                  d	j                  |j'                                     	 |j'                         d
   }|| _        t?        j@                  tC        jD                  |d      d         | _#        y # |j-                          w xY w# t8        t:        f$ r,}	t5        j6                  d|j'                               }
|
|	d }	~	ww xY w)Nr   r   )audiencerZ   includeEmailri   rj   )auth_requestr   )r   r   r%   zError getting ID token: {}r7   zNo ID token in response.F)verifyrp   )$r   r   r   _IAM_IDTOKEN_ENDPOINTr   r	   r   r   r1   r    r   r   rM   r   r   rx   "token_request_id_token_impersonaterD   r   r!   r"   r#   r   r   r'   r(   r
   r)   r-   r.   r7   r   utcfromtimestampr   r   r8   )rV   r/   r   r   r   r   r   r4   id_tokenr9   r:   s              r;   rv   zIDTokenCredentials.refresh^  s   D55==//$$44
 &))66
7 	 --11<< //
 .%%w'Q'Q'S

 +$$88w
	#%**%ZZ%,,W5 + H   ";>>1)),33HMMOD 	*}}w/H 
//JJx.u5
!   " *% 	* --*HMMOG z)		*s$   6G 5G GH&'HH)NFNrb   )r   r   r   r   rB   r   r   r   r   r   r	   r   r   r>   rv   r   r   s   @r;   r   r     st    E
 26


 X[DDE
 F
 X[4450
 60
r`   r   c                 x   t         j                  j                  |      }|t        j                  |      d}t        j                  |      j                  d      } | |d||      }t        |j                  d      r|j                  j                  d      n|j                  }|j                  t        j                  k7  rt        j                  t        |      	 t        j                  |      }	|	d   }
|
S # t         t"        f$ r1}t        j                  dj                  t              |      }||d}~ww xY w)	a  Makes a request to the Google Cloud IAM service to sign a JWT using a
    service account's system-managed private key.
    Args:
        request (Request): The Request object to use.
        principal (str): The principal to request an access token for.
        headers (Mapping[str, str]): Map of headers to transmit.
        payload (Mapping[str, str]): The JWT payload to sign. Must be a
            serialized JSON object that contains a JWT Claims Set.
        delegates (Sequence[str]): The chained list of delegates required
            to grant the final access_token.  If set, the sequence of
            identities must have "Service Account Token Creator" capability
            granted to the prceeding identity.  For example, if set to
            [serviceAccountB, serviceAccountC], the source_credential
            must have the Token Creator role on serviceAccountB.
            serviceAccountB must have the Token Creator on
            serviceAccountC.
            Finally, C must have Token Creator on target_principal.
            If left unset, source_credential must have that role on
            target_principal.

    Raises:
        google.auth.exceptions.TransportError: Raised if there is an underlying
            HTTP connection error
        google.auth.exceptions.RefreshError: Raised if the impersonated
            credentials are not available.  Common reasons are
            `iamcredentials.googleapis.com` is not enabled or the
            `Service Account Token Creator` is not assigned
    )rZ   rq   r   r   r   r   	signedJwtz{}: No signed JWT in response.N)r   _IAM_SIGNJWT_ENDPOINTr    r!   r"   r#   r$   r%   r   r&   r'   r(   r
   r)   r*   r+   r-   r.   )r/   r0   r   rq   rZ   r3   r   r4   r5   jwt_response
signed_jwtr9   r:   s                r;   r   r     s   : ,,33I>L"tzz'/BCD::d""7+D<dSH
 8==(+ 	W%]]  +..(%%nmDD	&zz-0!+.
j! &)),33NC]
 :%	&s   C9 9D9,D44D9)*r   r   rC   r   http.clientclientr'   r!   loggingtypingr   r   r   r   r   r	   r
   r   r   r   r   r   google.auth.transportgoogle	getLoggerr   r   r*   rO   r}   r   r   r   r   r<   rF   r   Signing%CredentialsWithRegionalAccessBoundaryr>   r   r   rk   r`   r;   <module>r     s       !   * -   # "    ! 
'

H
%=#  E  +< '*; '& 9  77;&|]
++55	]
@p
@@ p
f GI 7&r`   