File: //opt/gsutil/third_party/apitools/apitools/base/py/__pycache__/credentials_lib.cpython-39.pyc
a
�z�g�u � @ s� d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl m
Z
ddl mZ ddlZddlmZ ddlmZ ddlmZ dd lmZ zddlZd
ZW nP e�y Z z6ej�d d �Z e � d
�s�e � d�s�e�dZW Y dZ[n
dZ[0 0 zddl m Z W n e�yB ddl m Z Y n0 zddl m Z d
Z!W nJ e�y� dZ!zddl m"Z" W n e�y� ddl m"Z" Y n0 Y n0 zddl#Z#e#j$Z$W n e�y� dZ$Y n0 g d�Z%e�&� a'dd� Z(g Z)d6dd�Z*d7dd�Z+d8dd�Z,d d � Z-d9d d �Z.G d d!� d!e j/�Z0G d"d#� d#e j1j2�Z3d:d$d%�Z4d;d&d'�Z5G d(d)� d)e6�Z7d<d*d+�Z8d,d-� Z9e*d=d.d/��Z:e*d0d1� �Z;e*d2d3� �Z<e*d>d4d5��Z=dS )?z,Common credentials classes and constructors.� )�print_functionN)�service_account)�tools)� http_client)�urllib)�
exceptions)�utilT�SERVER_SOFTWARE� Z DevelopmentzGoogle App EngineF)�gce)�multiprocess_file_storage)�multistore_file)�CredentialsFromFile�GaeAssertionCredentials�GceAssertionCredentials�GetCredentials� GetUserinfo�!ServiceAccountCredentialsFromFilec C s | a d S �N)�cache_file_lock)�lock� r �D/opt/gsutil/third_party/apitools/apitools/base/py/credentials_lib.py�SetCredentialsCacheFileLock_ s r c C s0 |du rt t�}nt|t t��}t�|| � | S )aP Register a new method for fetching credentials.
This new method should be a function with signature:
client_info, **kwds -> Credentials or None
This method can be used as a decorator, unless position needs to
be supplied.
Note that method must *always* accept arbitrary keyword arguments.
Args:
method: New credential-fetching method.
position: (default: None) Where in the list of methods to
add this; if None, we append. In all but rare cases,
this should be either 0 or None.
Returns:
method, for use as a decorator.
N)�len�_CREDENTIALS_METHODS�min�insert)�method�positionr r r �_RegisterCredentialsMethodj s
r c
K s� t �|�}||d�t|��|p$d| d�}
tD ]$} | |
fi | ��} | dur.| S q.|pbtj�d�}t||
|d�} | dur~| S t �
d��dS )zDAttempt to get credentials, using an oauth dance as the last resort.� z%s-generated/0.1)� client_id�
client_secret�scope�
user_agentNz~/.apitools.token)�oauth2client_argsz"Could not create valid credentials) r �NormalizeScopes�join�sortedr �os�path�
expanduserr r �CredentialsError)
� package_name�scopesr" r# r% �credentials_filename�api_key�clientr& �kwds� client_infor � credentialsr r r r � s&
�
��r c C s� t j�| �} tjdkr@tjj| |d�}|dur<|dur<||_|S t | ��}t
� |�}W d � n1 sh0 Y |� d�}|tj
jkr�t�d| f ��tj|d |d |d |d ||d
�}|S dS ) z=Use the credentials in filename to create a token for scopes.�1.5.2�r/ N�typez'Invalid service account credentials: %sr" � client_email�private_key_id� private_key)Zservice_account_id�service_account_emailr: Zprivate_key_pkcs8_textr/ r% )r* r+ r, � oauth2client� __version__r �ServiceAccountCredentialsZfrom_json_keyfile_namer% �open�json�load�getr2 �SERVICE_ACCOUNTr r- Z_ServiceAccountCredentials)�filenamer/ r% r5 �keyfileZservice_account_infoZ account_typer r r r � s2
��
(
��r c C s� t j�|�}t�|�}tjdkrDtjj | ||d�}|dur@||_
|S t |d��(}tj j
| |�� ||d�W d � S 1 s|0 Y dS )z4Create a new credential from the named .p12 keyfile.r6 r7 N�rb�r% )r* r+ r, r r' r= r> r r? Zfrom_p12_keyfiler% r@ r2 Z SignedJwtAssertionCredentials�read)�service_account_nameZprivate_key_filenamer/ r% r5 �key_filer r r �$ServiceAccountCredentialsFromP12File� s
��
�rL c
C s� |rt j�dd�}nt j�dd�}d| d | }ddi}tjj||d �}tj�tj�i ��}z|�|�}W n8 tj j
y� } z t � d
|j
��W Y d }~n
d }~0 0 |S ) z4Request the given url from the GCE metadata service.�GCE_METADATA_IPz169.254.169.254�GCE_METADATA_ROOTzmetadata.google.internalzhttp://z/computeMetadata/v1/zMetadata-Flavor�Google)�headersz$Could not reach metadata service: %sN)r* �environrC r �request�Request� build_opener� ProxyHandlerr@ �error�URLErrorr �CommunicationError�reason) � relative_urlZuse_metadata_ip�base_url�urlrP rR �opener�response�er r r �_GceMetadataRequest� s ��r` c s� e Zd ZdZd � fdd� Zedd� �Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
� fdd�Zedd� �Zedd� �Z� ZS ) r z(Assertion credentials for GCE instances.N�defaultc s� t j|dd�| _d}|�d�}|r.| �||�}|p:| �|�}|rP|sP| �||� t�� �4 t� d� t
t | �j f d|i|�� W d � n1 s�0 Y dS )aA Initializes the credentials instance.
Args:
scopes: The scopes to get. If None, whatever scopes that are
available to the instance are used.
service_account_name: The service account to retrieve the scopes
from.
**kwds: Additional keyword args.
�utf-8��encodingN�cache_filename�ignorer$ )
�six� ensure_text�._GceAssertionCredentials__service_account_namerC �_CheckCacheFileForMatch�_ScopesFromMetadataServer�_WriteCacheFile�warnings�catch_warnings� simplefilter�superr �__init__)�selfr/ rJ r3 Z
cached_scopesre �� __class__r r rq � s �
�
z GceAssertionCredentials.__init__c O s, z| |i |��W S t jy& Y d S 0 d S r �r �Error��cls�argsr3 r r r �Get s zGceAssertionCredentials.Getc C s� |rt t|��nd| jd�}t|�}zN|�� }|s8W dS t�|�}|d |d krp|d d|d fv rp|d W S W n ty� � Y n Y n0 dS )a Checks the cache file to see if it matches the given credentials.
Args:
cache_filename: Cache filename to check.
scopes: Scopes for the desired credentials.
Returns:
List of scopes (if cache matches) or None.
N�r/ �
svc_acct_namer| r/ )r) �listri �_MultiProcessCacheFile�
LockedReadrA �loads�KeyboardInterrupt)rr re r/ �creds�
cache_fileZcached_creds_strZ cached_credsr r r rj s �
z/GceAssertionCredentials._CheckCacheFileForMatchc C sb t dd� |D ��}|| jd�}t�|�}t|�}z|�|� W n tyR � Y n Y n0 dS )aB Writes the credential metadata to the cache file.
This does not save the credentials themselves (CredentialStore class
optionally handles that after this class is initialized).
Args:
cache_filename: Cache filename to check.
scopes: Scopes for the desired credentials.
c S s g | ]}t �|��qS r )rg rh ��.0r$ r r r �
<listcomp>C � z;GceAssertionCredentials._WriteCacheFile.<locals>.<listcomp>r{ N)r) ri rA �dumpsr~ � LockedWriter� )rr re r/ r� Z creds_strr� r r r rl 8 s �
z'GceAssertionCredentials._WriteCacheFilec C sv t �� st�d��| �| j�s.t�d| j ��|rjt �|�}| �� }||krrt�dt t
|| ��f ��n| �� }|S )z5Returns instance scopes based on GCE metadata server.�0GCE credentials requested outside a GCE instancez@GCE credentials requested but service account %s does not exist.z)Instance did not have access to scopes %s) r � DetectGcer �ResourceUnavailableError�GetServiceAccountri r' �GetInstanceScopesr- r) r} )rr r/ Zscope_lsZinstance_scopesr r r rk P s* � ��
��z1GceAssertionCredentials._ScopesFromMetadataServerc C s& d}t |�}dd� |�� D �}||v S )Nzinstance/service-accountsc S s g | ]}t �|��d ��qS )z/
)rg �
ensure_str�rstrip)r� �liner r r r� g s �z=GceAssertionCredentials.GetServiceAccount.<locals>.<listcomp>)r` � readlines)rr ZaccountrZ r^ Zresponse_linesr r r r� d s �z)GceAssertionCredentials.GetServiceAccountc C s, d� | j�}t|�}t�dd� |�� D ��S )Nz$instance/service-accounts/{0}/scopesc s s | ]}t �|��� V qd S r )rg r� �stripr� r r r � <genexpr>o s �z<GceAssertionCredentials.GetInstanceScopes.<locals>.<genexpr>)�formatri r` r r' r� )rr rZ r^ r r r r� k s �
�z)GceAssertionCredentials.GetInstanceScopesc C s t jj�| |� dS )a7 Refresh self.access_token.
This function replaces AppAssertionCredentials._refresh, which
does not use the credential store and is therefore poorly
suited for multi-threaded scenarios.
Args:
do_request: A function matching httplib2.Http.request's signature.
N)r= r2 �OAuth2Credentials�_refresh)rr Z
do_requestr r r r� s s z GceAssertionCredentials._refreshc C s� d� | j�}z t|�}W n. tjyF d| _| jr@| j�| � � Y n0 t� |�
� �}zt � |�}W n t
y� t�d| ��Y n0 |d | _d|v r�t|d �}tj|d�tjjtjjd�jdd � | _nd| _d
| _| jr�| j�| � dS ) z�Refresh self.access_token by querying the metadata server.
If self.store is initialized, store acquired credentials there.
z#instance/service-accounts/{0}/tokenTz$Could not parse response as JSON: %s� access_token�
expires_in)�seconds)�tzN)�tzinfoF)r� ri r` r rX �invalid�store�
locked_putrg r� rI rA r� �
ValueErrorr- r� �int�datetime� timedelta�now�timezone�utc�replace� token_expiry)rr Zunused_http_requestrZ r^ �contentZcredential_infor� r r r �_do_refresh_request� s8 � �
��z+GceAssertionCredentials._do_refresh_requestc s t tj| ��� S r )rp r �AppAssertionCredentials�to_json�rr rs r r r� � s z GceAssertionCredentials.to_jsonc C s� t �|�}i }d|�dg �v r.|d d |d< d }d|v rD|d g}tf d|i|��}d|v rh|d |_d|v r�tj�|d tjj �|_
d|v r�|d |_ |S )Nre �kwargsr$ r/ r� r� r� ) rA r� rC r r� r� �strptimer= r2 �
EXPIRY_FORMATr� r� )rx � json_data�datar� Z
scope_listr5 r r r � from_json� s"
�
z!GceAssertionCredentials.from_jsonc C s t d��d S )Nz6Cannot serialize credentials for GCE service accounts.��NotImplementedErrorr� r r r �serialization_data� s �z*GceAssertionCredentials.serialization_data)Nra )�__name__�
__module__� __qualname__�__doc__rq � classmethodrz rj rl rk r� r� r� r� r� r� �propertyr� �
__classcell__r r rs r r � s &
!
r c sH e Zd ZdZ� fdd�Zedd� �Zedd� �Zdd � Zd
d � Z � Z
S ) r z1Assertion credentials for Google App Engine apps.c s< t �� st�d��tt �|��| _tt| �j di |�� d S )Nr� )N)
r � DetectGaer r� r} r' �_scopesrp r rq )rr r/ r3 rs r r rq � s �z GaeAssertionCredentials.__init__c O s, z| |i |��W S t jy& Y d S 0 d S r ru rw r r r rz � s zGaeAssertionCredentials.Getc C s t �|�}t|d �S )Nr� )rA r� r )rx r� r� r r r r� � s
z!GaeAssertionCredentials.from_jsonc
C s` ddl m} z|�| j�\}}W n4 |jyT } zt�t|���W Y d}~n
d}~0 0 || _dS )z�Refresh self.access_token.
Args:
_: (ignored) A function matching httplib2.Http.request's signature.
r )� app_identityN) Zgoogle.appengine.apir� �get_access_tokenr� rv r r- �strr� )rr �_r� �tokenr_ r r r r� � s $z GaeAssertionCredentials._refreshc C s t d��dS )au Cryptographically sign a blob (of bytes).
This method is provided to support a common interface, but
the actual key used for a Google Compute Engine service account
is not available, so it can't be used to sign content.
Args:
blob: bytes, Message to be signed.
Raises:
NotImplementedError, always.
z1Compute Engine service accounts cannot sign blobsNr� )rr �blobr r r � sign_blob� s
�z!GaeAssertionCredentials.sign_blob) r� r� r� r� rq r� rz r� r� r� r� r r rs r r � s
r c C s\ t jtjgd�}|j| d�\}}ttd�r2tj|_ttd�rDtj|_ttd�rXtj |_
|S )z4Retrieves command line flags based on gflags module.)�parents�ry �auth_host_name�auth_host_port�auth_local_webserver) �argparse�ArgumentParserr Z argparserZparse_known_args�hasattr�FLAGSr� r� r� Znoauth_local_webserver)ry �parser�flagsr� r r r �_GetRunFlowFlags s
r� c C sL |d }|d }t |tj�s&d�|�}|d | | }trHt�| |�}n t�| |�}t t
d�rddt
_ |� � }|du s||j
�rHtd� td �D ]�}z6tjjf i |��} t|d
�}
t�| ||
�}W �qHW q� tjjtf�y } ztd | f � W Y d} ~ q�d} ~ 0 tj�yD } z(td | f � t�d
| ��W Y d} ~ q�d} ~ 0 0 q�|S )z Read credentials from a file.r% r$ �:r" r� FNz$Generating new OAuth credentials ...� r� zInvalid authorization: %szCommunication error: %sz,Communication error creating credentials: %s) �
isinstancerg � string_typesr( �_NEW_FILESTOREr ZMultiprocessFileStorager
Z(get_credential_storage_custom_string_keyr� r� r� rC r� �print�ranger= r2 �OAuth2WebServerFlowr� r Zrun_flow�FlowExchangeError�
SystemExit�httplib2�
HttpLib2Errorr r- ) r+ r4 r& r% Z scope_keyZ storage_keyZcredential_storer5 r� �flowr� r_ r r r r s>
��
"� r c @ s\ e Zd ZdZdZdZe�� Zdd� Z e
j dd� �Z e
j dd � �Z
d
d � Zd d
� Zdd� ZdS )r~ aO Simple multithreading and multiprocessing safe cache file.
Notes on behavior:
* the fasteners.InterProcessLock object cannot reliably prevent threads
from double-acquiring a lock. A threading lock is used in addition to
the InterProcessLock. The threading lock is always acquired first and
released last.
* The interprocess lock will not deadlock. If a process can not acquire
the interprocess lock within `_lock_timeout` the call will return as
a cache miss or unsuccessful cache write.
* App Engine environments cannot be process locked because (1) the runtime
does not provide monotonic time and (2) different processes may or may
not share the same machine. Because of this, process locks are disabled
and locking is only guaranteed to protect against multithreaded access.
� rb c C s> d | _ || _tr,| j| _t�d�|��| _n| j | _d | _d S )Nz{0}.lock)
�_file� _filename�_FASTENERS_AVAILABLE�_ProcessLockAcquired�_process_lock_getter� fastenersZInterProcessLockr� �
_process_lock�_DummyLockAcquired)rr rE r r r rq S s �z _MultiProcessCacheFile.__init__c c s> z(| j j| jd�}|V W |r:| j �� n|r8| j �� 0 dS )z/Context manager for process locks with timeout.)�timeoutN)r� �acquire�
_lock_timeout�release)rr Z is_lockedr r r r� ^ s �z+_MultiProcessCacheFile._ProcessLockAcquiredc c s
dV dS )z<Lock context manager for environments without process locks.TNr r� r r r r� h s z)_MultiProcessCacheFile._DummyLockAcquiredc
C s� d}| j �� | �� s$W d � dS | �� �n}|sNW d � W d � dS t| jd��"}|�� j| jd�}W d � n1 s�0 Y W d � n1 s�0 Y W d � n1 s�0 Y |S )a Acquire an interprocess lock and dump cache contents.
This method safely acquires the locks then reads a string
from the cache file. If the file does not exist and cannot
be created, it will return None. If the locks cannot be
acquired, this will also return None.
Returns:
cache data - string if present, None on failure.
NrG rc )� _thread_lock�_EnsureFileExistsr� r@ r� rI �decode� _encoding)rr �
file_contents�acquired_plock�fr r r r m s
lz!_MultiProcessCacheFile.LockedReadc
C s� t |tj�r|j| jd�}| j�� | �� s:W d � dS | �� �t}|sdW d � W d � dS t| j d��}|�
|� W d � n1 s�0 Y W d � W d � dS 1 s�0 Y W d � n1 s�0 Y dS )a� Acquire an interprocess lock and write a string.
This method safely acquires the locks then writes a string
to the cache file. If the string is written successfully
the function will return True, if the write fails for any
reason it will return False.
Args:
cache_data: string or bytes to write.
Returns:
bool: success
rc NF�wbT) r� rg � text_type�encoder� r� r� r� r@ r� �write)rr Z
cache_datar� r� r r r r� � s
(z"_MultiProcessCacheFile.LockedWritec C sn t j�| j�sjt �d�}zDzt| jd��� W n tyN Y W t �|� dS 0 W t �|� n t �|� 0 dS )z8Touches a file; returns False on error, True on success.� za+bFT)r* r+ �existsr� �umaskr@ �close�OSError)rr Z old_umaskr r r r� � s
�z(_MultiProcessCacheFile._EnsureFileExistsN)r� r� r� r� r� r� � threading�Lockr� rq �
contextlib�contextmanagerr� r� r r� r� r r r r r~ > s
r~ c C s\ |p
t �� }t| �}|�|�\}}|jtjkrN| �|� t| �}|�|�\}}t� |pXd�S )a� Get the userinfo associated with the given credentials.
This is dependent on the token having either the userinfo.email or
userinfo.profile scope for the given token.
Args:
credentials: (oauth2client.client.Credentials) incoming credentials
http: (httplib2.Http, optional) http instance to use
Returns:
The email address for this token, or None if the required scopes
aren't available.
z{})
r� �Http�_GetUserinfoUrlrR �statusr � BAD_REQUEST�refreshrA r� )r5 �httpr\ r^ r� r r r r � s
r c C s$ d}d| j i}d�|tj�|�f�S )Nz'https://oauth2.googleapis.com/tokeninfor� �?)r� r( r �parse� urlencode)r5 Zurl_root�
query_argsr r r r � s
r c K sZ | d � � }| d }|r&t|||d�S |r.|r6|r@|s@t�d��|durVt||||�S dS )z1Returns ServiceAccountCredentials from give file.r$ r% rH z:Service account name or keyfile provided without the otherN)�splitr r r- rL )r4 rJ Zservice_account_keyfileZ service_account_json_keyfile� unused_kwdsr/ r% r r r � _GetServiceAccountCredentials� s$ �����r
c K s | d � d�}tj|d�S �Nr$ r! r7 )r r rz �r4 r r/ r r r �_GetGaeServiceAccount� s r c K s | d � d�}tj|d�S r )r r rz r r r r �_GetGceServiceAccount� s r c K s� | d � � }|rdS tjj}t�B z |�� }W n$ tjjyR Y W d � dS 0 W d � n1 sh0 Y d}|du r�dS t||�r�||v r�|�|�S dS )z Returns ADC with right scopes.r$ Nz.https://www.googleapis.com/auth/cloud-platform) r r= r2 �GoogleCredentialsr � _implicit_credentials_from_files�"ApplicationDefaultCredentialsErrorr� �
create_scoped)r4 Z$skip_application_default_credentialsr r/ �gcr5 �cpr r r �!_GetApplicationDefaultCredentials� s 2
r )N)NNNN)N)F)N)N)N)NNN)F)>r� �
__future__r r� r� r� rA r* r� rm r� r= �oauth2client.clientr r rg � six.movesr r �apitools.base.pyr r r� r� � ImportErrorZ import_errorrQ rC Z
server_env�
startswithZoauth2client.contribr r r� r
Zgflagsr� �__all__r� r r r r r r rL r` r� r r2 �AssertionCredentialsr r� r �objectr~ r r r
r r r r r r r �<module> s�
�
�
a6
(n
�
�