o
    7bV                     @   s  d dl Z d dlZd dlZddlmZ ddlmZmZmZm	Z	m
Z
mZmZmZmZ zZd dlZd dlmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZmZ d d
lmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 dZ1W n e2y   dZ1Y nw h dZ3dd Z4G dd dZ5G dd de5Z6G dd de5Z7e1rG dd de5Z8G dd de5Z9G dd de8Z:G dd de5Z;dS dS )     N   InvalidKeyError)	base64url_decodebase64url_encodeder_to_raw_signatureforce_bytesfrom_base64url_uintis_pem_format
is_ssh_keyraw_to_der_signatureto_base64url_uint)InvalidSignature)hashes)ecpadding)EllipticCurvePrivateKeyEllipticCurvePublicKey)Ed448PrivateKeyEd448PublicKey)Ed25519PrivateKeyEd25519PublicKey)RSAPrivateKeyRSAPrivateNumbersRSAPublicKeyRSAPublicNumbersrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmprsa_recover_prime_factors)EncodingNoEncryptionPrivateFormatPublicFormatload_pem_private_keyload_pem_public_keyload_ssh_public_keyTF>   ES256ES384ES512ES521EdDSAPS256PS384PS512RS256RS384RS512ES256Kc                  C   s   t  ttjttjttjd} trG| ttjttjttjttjttjttjttjttjt	t	jt	t	jt	t	jt
 d | S )zE
    Returns the algorithms that are implemented by the library.
    )ZnoneZHS256ZHS384ZHS512)r/   r0   r1   r'   r2   r(   r*   r)   r,   r-   r.   r+   )NoneAlgorithmHMACAlgorithmSHA256SHA384SHA512
has_cryptoupdateRSAAlgorithmECAlgorithmRSAPSSAlgorithmOKPAlgorithm)Zdefault_algorithms r>   0/usr/lib/python3/dist-packages/jwt/algorithms.pyget_default_algorithmsK   s0   r@   c                   @   s@   e Zd ZdZdd Zdd Zdd Zedd	 Zed
d Z	dS )	AlgorithmzH
    The interface for an algorithm used to sign and verify tokens.
    c                 C      t )z
        Performs necessary validation and conversions on the key and returns
        the key value in the proper format for sign() and verify().
        NotImplementedErrorselfkeyr>   r>   r?   prepare_keyr      zAlgorithm.prepare_keyc                 C   rB   )zn
        Returns a digital signature for the specified message
        using the specified key value.
        rC   rF   msgrG   r>   r>   r?   signy   rI   zAlgorithm.signc                 C   rB   )zz
        Verifies that the specified digital signature is valid
        for the specified message and key values.
        rC   rF   rK   rG   sigr>   r>   r?   verify   rI   zAlgorithm.verifyc                 C   rB   )z7
        Serializes a given RSA key into a JWK
        rC   key_objr>   r>   r?   to_jwk   rI   zAlgorithm.to_jwkc                 C   rB   )zb
        Deserializes a given RSA key from JWK back into a PublicKey or PrivateKey object
        rC   )jwkr>   r>   r?   from_jwk   rI   zAlgorithm.from_jwkN)
__name__
__module____qualname____doc__rH   rL   rO   staticmethodrR   rT   r>   r>   r>   r?   rA   m   s    
rA   c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )	r3   zZ
    Placeholder for use when no signing or verification
    operations are required.
    c                 C   s    |dkrd }|d urt d|S )N z*When alg = "none", key value must be None.r   rE   r>   r>   r?   rH      s
   zNoneAlgorithm.prepare_keyc                 C      dS )N    r>   rJ   r>   r>   r?   rL         zNoneAlgorithm.signc                 C   r[   )NFr>   rM   r>   r>   r?   rO      r]   zNoneAlgorithm.verifyN)rU   rV   rW   rX   rH   rL   rO   r>   r>   r>   r?   r3      s
    	r3   c                   @   sZ   e Zd ZdZejZejZej	Z
dd Zdd Zedd Zedd	 Zd
d Zdd ZdS )r4   zf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                 C   
   || _ d S Nhash_algrF   ra   r>   r>   r?   __init__      
zHMACAlgorithm.__init__c                 C   s$   t |}t|st|rtd|S )NzdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   r
   r   r   rE   r>   r>   r?   rH      s   zHMACAlgorithm.prepare_keyc                 C   s   t tt|  ddS )Noct)kkty)jsondumpsr   r   decoderP   r>   r>   r?   rR      s
   zHMACAlgorithm.to_jwkc                 C   sh   zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdt|d S )NKey is not valid JSONrg   re   zNot an HMAC keyrf   )	
isinstancestrrh   loadsdict
ValueErrorr   getr   )rS   objr>   r>   r?   rT      s   

zHMACAlgorithm.from_jwkc                 C   s   t ||| j S r_   )hmacnewra   ZdigestrJ   r>   r>   r?   rL         zHMACAlgorithm.signc                 C   s   t || ||S r_   )rs   Zcompare_digestrL   rM   r>   r>   r?   rO      ru   zHMACAlgorithm.verifyN)rU   rV   rW   rX   hashlibZsha256r5   Zsha384r6   Zsha512r7   rc   rH   rY   rR   rT   rL   rO   r>   r>   r>   r?   r4      s    

r4   c                   @   sZ   e Zd ZdZejZejZejZdd Zdd Z	e
dd Ze
dd	 Zd
d Zdd ZdS )r:   z~
        Performs signing and verification operations using
        RSASSA-PKCS-v1_5 and the specified hash function.
        c                 C   r^   r_   r`   rb   r>   r>   r?   rc      rd   zRSAAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|d d}W |S  t
y;   t|}Y |S w )NExpecting a PEM-formatted key.s   ssh-rsaZpassword)rl   r   r   bytesrm   	TypeErrorr   
startswithr&   r$   rp   r%   rE   r>   r>   r?   rH      s   


zRSAAlgorithm.prepare_keyc                 C   s   d }t | dd rE|  }ddgt|jj t|jj t|j t|j t|j	 t|j
 t|j t|j d
}n!t | dd rb|  }ddgt|j t|j d}ntdt|S )Nprivate_numbersRSArL   )
rg   key_opsnedpqdpdqqirO   )rg   r~   r   r   Not a public or private key)getattrr|   r   public_numbersr   rj   r   r   r   r   dmp1dmq1iqmpr   rh   ri   )rQ   rr   numbersr>   r>   r?   rR     s.   
zRSAAlgorithm.to_jwkc           	   	      s  zt | trt|  n
t | tr|  ntW n ty"   tdw  ddkr.tdd v rd v rd v rd v rBtd	g d
} fdd|D }t|}|r]t	|s]tdt
t d t d }|rtt d t d t d t d t d t d |d}| S t d }t|j||j\}}t|||t||t||t|||d}| S d v rd v rt
t d t d }| S td)Nrk   rg   r}   zNot an RSA keyr   r   r   Zothz5Unsupported RSA private key: > 2 primes not supported)r   r   r   r   r   c                    s   g | ]}| v qS r>   r>   ).0Zproprr   r>   r?   
<listcomp>A  s    z)RSAAlgorithm.from_jwk.<locals>.<listcomp>z@RSA key must include all parameters if any are present besides dr   r   r   r   r   )r   r   r   r   r   r   r   r   )rl   rm   rh   rn   ro   rp   r   rq   anyallr   r	   r   r   r   r   r   r   r   private_key
public_key)	rS   Zother_propsZprops_foundZany_props_foundr   r   r   r   r   r>   r   r?   rT   *  sx   













zRSAAlgorithm.from_jwkc                 C   s   | |t |  S r_   )rL   r   PKCS1v15ra   rJ   r>   r>   r?   rL   t  s   zRSAAlgorithm.signc                 C   s4   z| ||t |   W dS  ty   Y dS w )NTF)rO   r   r   ra   r   rM   r>   r>   r?   rO   w  s   zRSAAlgorithm.verifyN)rU   rV   rW   rX   r   r5   r6   r7   rc   rH   rY   rR   rT   rL   rO   r>   r>   r>   r?   r:      s    
#
Ir:   c                   @   sN   e Zd ZdZejZejZejZdd Zdd Z	dd Z
dd	 Zed
d ZdS )r;   zr
        Performs signing and verification operations using
        ECDSA and the specified hash function
        c                 C   r^   r_   r`   rb   r>   r>   r?   rc     rd   zECAlgorithm.__init__c                 C   sx   t |ttfr	|S t |ttfstdt|}z|dr%t|}W |S t	|}W |S  t
y;   t|d d}Y |S w )Nrw   s   ecdsa-sha2-rx   )rl   r   r   ry   rm   rz   r   r{   r&   r%   rp   r$   rE   r>   r>   r?   rH     s   


zECAlgorithm.prepare_keyc                 C   s"   | |t|  }t||jS r_   )rL   r   ECDSAra   r   curve)rF   rK   rG   der_sigr>   r>   r?   rL     s   zECAlgorithm.signc                 C   sl   zt ||j}W n
 ty   Y dS w zt|tr| }|||t| 	  W dS  t
y5   Y dS w )NFT)r   r   rp   rl   r   r   rO   r   r   ra   r   )rF   rK   rG   rN   r   r>   r>   r?   rO     s   
zECAlgorithm.verifyc                 C   s&  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.tdd|vs6d|vr:tdt|d}t|d}|d}|dkrmt	|t	|  kr_d	krin td
t
 }nktd
|dkrt	|t	|  krdkrn tdt
 }nKtd|dkrt	|t	|  krdkrn tdt
 }n+td|dkrt	|t	|  krd	krn tdt
 }ntdtd| t
jtj|ddtj|dd|d}d|vr| S t|d}t	|t	|krtdt	||t
tj|dd| S )Nrk   rg   ZECzNot an Elliptic curve keyxycrvzP-256    z)Coords should be 32 bytes for curve P-256zP-3840   z)Coords should be 48 bytes for curve P-384zP-521B   z)Coords should be 66 bytes for curve P-521Z	secp256k1z-Coords should be 32 bytes for curve secp256k1Invalid curve: Zbig)	byteorder)r   r   r   r   z!D should be {} bytes for curve {})rl   rm   rh   rn   ro   rp   r   rq   r   lenr   Z	SECP256R1Z	SECP384R1Z	SECP521R1Z	SECP256K1ZEllipticCurvePublicNumbersint
from_bytesr   ZEllipticCurvePrivateNumbersr   )rS   rr   r   r   r   Z	curve_objr   r   r>   r>   r?   rT     sv   







zECAlgorithm.from_jwkN)rU   rV   rW   rX   r   r5   r6   r7   rc   rH   rL   rO   rY   rT   r>   r>   r>   r?   r;   ~  s    r;   c                   @   s    e Zd ZdZdd Zdd ZdS )r<   zA
        Performs a signature using RSASSA-PSS with MGF1
        c                 C   s*   | |tjt|  | jjd|  S )NZmgfZsalt_length)rL   r   PSSMGF1ra   digest_sizerJ   r>   r>   r?   rL     s   zRSAPSSAlgorithm.signc              	   C   sH   z| ||tjt|  | jjd|   W dS  ty#   Y dS w )Nr   TF)rO   r   r   r   ra   r   r   rM   r>   r>   r?   rO     s   	zRSAPSSAlgorithm.verifyN)rU   rV   rW   rX   rL   rO   r>   r>   r>   r?   r<     s    
r<   c                   @   sH   e Zd ZdZdd Zdd Zdd Zdd	 Zed
d Z	edd Z
dS )r=   z
        Performs signing and verification operations using EdDSA

        This class requires ``cryptography>=2.6`` to be installed.
        c                 K   s   d S r_   r>   )rF   kwargsr>   r>   r?   rc     r]   zOKPAlgorithm.__init__c                 C   s   t |ttfr6t |tr|d}|d}d|v rt|}nd|v r*t|d d}n|dd dkr6t|}t |tt	t
tfsCtd|S )	Nutf-8z-----BEGIN PUBLICz-----BEGIN PRIVATErx   r      zssh-zcExpecting a EllipticCurvePrivateKey/EllipticCurvePublicKey. Wrong key provided for EdDSA algorithms)rl   ry   rm   encoderj   r%   r$   r&   r   r   r   r   r   )rF   rG   Zstr_keyr>   r>   r?   rH     s$   




zOKPAlgorithm.prepare_keyc                 C   s$   t |turt|dn|}||S )aR  
            Sign a message ``msg`` using the EdDSA private key ``key``
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey}Ed448PrivateKey key: A :class:`.Ed25519PrivateKey`
                or :class:`.Ed448PrivateKey` iinstance
            :return bytes signature: The signature, as bytes
            r   )typery   rL   rJ   r>   r>   r?   rL   6  s   
zOKPAlgorithm.signc                 C   sv   z.t |turt|dn|}t |turt|dn|}t|ttfr&| }||| W dS  tjj	y:   Y dS w )a  
            Verify a given ``msg`` against a signature ``sig`` using the EdDSA key ``key``

            :param str|bytes sig: EdDSA signature to check ``msg`` against
            :param str|bytes msg: Message to sign
            :param Ed25519PrivateKey|Ed25519PublicKey|Ed448PrivateKey|Ed448PublicKey key:
                A private or public EdDSA key instance
            :return bool verified: True if signature is valid, False if not.
            r   TF)
r   ry   rl   r   r   r   rO   cryptography
exceptionsr   rM   r>   r>   r?   rO   A  s   
zOKPAlgorithm.verifyc                 C   s   t | ttfr(| jtjtjd}t | trdnd}tt	t
| d|dS t | ttfrd| jtjtjt d}|  jtjtjd}t | trLdnd}tt	t
| t	t
| d|dS td)	N)encodingformatEd25519Ed448OKP)r   rg   r   )r   r   Zencryption_algorithm)r   r   rg   r   r   )rl   r   r   Zpublic_bytesr    ZRawr#   rh   ri   r   r   rj   r   r   Zprivate_bytesr"   r!   r   r   )rG   r   r   r   r>   r>   r?   rR   V  s>   	zOKPAlgorithm.to_jwkc              
   C   s  zt | trt| }n
t | tr| }ntW n ty"   tdw |ddkr.td|d}|dkrB|dkrBtd| d	|vrJtd
t|d	}z+d|vrf|dkr`t	
|W S t
|W S t|d}|dkrwt|W S t|W S  ty } ztd|d }~ww )Nrk   rg   r   zNot an Octet Key Pairr   r   r   r   r   zOKP should have "x" parameterr   zInvalid key parameter)rl   rm   rh   rn   ro   rp   r   rq   r   r   Zfrom_public_bytesr   r   Zfrom_private_bytesr   )rS   rr   r   r   r   errr>   r>   r?   rT   ~  s>   



zOKPAlgorithm.from_jwkN)rU   rV   rW   rX   rc   rH   rL   rO   rY   rR   rT   r>   r>   r>   r?   r=     s    
'r=   )<rv   rs   rh   r   r   Zutilsr   r   r   r   r	   r
   r   r   r   Zcryptography.exceptionsr   r   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   r   Z,cryptography.hazmat.primitives.asymmetric.ecr   r   Z/cryptography.hazmat.primitives.asymmetric.ed448r   r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   r   Z-cryptography.hazmat.primitives.asymmetric.rsar   r   r   r   r   r   r   r   Z,cryptography.hazmat.primitives.serializationr    r!   r"   r#   r$   r%   r&   r8   ModuleNotFoundErrorZrequires_cryptographyr@   rA   r3   r4   r:   r;   r<   r=   r>   r>   r>   r?   <module>   sB    ,($

")9 x  