mxi/%dZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z ddl m Z ejeZdZddgZd Zd Zd Zd Zd Zeeeezz ez ZegezegezzZdZdZdZdZdZdZdZ dZ!y)z'Helpers for Agent Identity credentials.N)quoteurlparse)environment_vars) exceptionszThe cryptography library is required for certificate-based authentication.Please install it with `pip install google-auth[cryptography]`.z+^agents\.global\.org-\d+\.system\.id\.goog$z,^agents\.global\.proj-\d+\.system\.id\.goog$z=/var/run/secrets/workload-spiffe-credentials/certificates.pem2g?g?c|xrCtjj|xr"tjj|dkDS)z)Checks if a file exists and is not empty.r)ospathexistsgetsize)r s X/home/htdocs/ttos/venv/lib/python3.12/site-packages/google/auth/_agent_identity_utils.py_is_certificate_file_readyr<s1  FBGGNN4( FRWW__T-BQ-FFcddl}tjjtj }|syd}t D]} t|d5}|j|}|jdijdijd}t|r |cdddcS dddtt rt cSt#j$|t'j(d tj*d #1swY^xYw#tttf$r1|s,tjd|tj td }YwxYw) a/Gets the certificate path from the certificate config file. The path to the certificate config file is read from the GOOGLE_API_CERTIFICATE_CONFIG environment variable. This function implements a retry mechanism to handle cases where the environment variable is set before the files are available on the filesystem. Returns: str: The path to the leaf certificate file. Raises: google.auth.exceptions.RefreshError: If the certificate config file or the certificate file cannot be found after retries. rNFr cert_configsworkload cert_pathzfCertificate config file not found at %s (from %s environment variable). Retrying for up to %s seconds.TzCertificate config or certificate file not found after multiple retries. Token binding protection is failing. You can turn off this protection by setting z) to false to fall back to unbound tokens.)jsonr environgetrGOOGLE_API_CERTIFICATE_CONFIG_POLLING_INTERVALSopenloadrIOError ValueErrorKeyError_LOGGERwarning_TOTAL_TIMEOUT_WELL_KNOWN_CERT_PATHtimesleepr RefreshError7GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES)rcert_config_pathhas_logged_warningintervalf cert_configrs r#get_agent_identity_certificate_pathr-AsOzz~~&6&T&TU &  &, %"iil OONB7SR(S% .i8$ % %9 %, &&; <( ( 8A D  ! ! \  S S TU* * A % %X. %@$$BB" &*"  s2 D AD D)DD DAEEc,tjjtjdj dk(}|ryt }|syt|d5}|j}dddt|S#1swYtSxYw)a1Gets and parses the agent identity certificate if not opted out. Checks if the user has opted out of certificate-bound tokens. If not, it gets the certificate path, reads the file, and parses it. Returns: The parsed certificate object if found and not opted out, otherwise None. truefalseNrb) r rrrr'lowerr-rreadparse_certificate) is_opted_outr cert_file cert_bytess r(get_and_parse_agent_identity_certificater8s   T T   %'   35I  i &)^^% & Z ((& Z ((s BBct ddlm}|j|S#t$r}tt|d}~wwxYw)zParses a PEM-encoded certificate. Args: cert_bytes (bytes): The PEM-encoded certificate bytes. Returns: cryptography.x509.Certificate: The parsed certificate object. rx509N) cryptographyr;load_pem_x509_certificate ImportErrorCRYPTOGRAPHY_NOT_FOUND_ERROR)r7r;es rr4r4s9?%--j99 ?67Q>?s 727c ddlm}ddlm} |jj |j }|jj|j}|D]M}t|}|jdk(s|j}tD]}tj ||syOy#|j$rYywxYw#t"$r} t#t$| d} ~ wwxYw)aChecks if a certificate is an Agent Identity certificate. This is determined by checking the Subject Alternative Name (SAN) for a SPIFFE ID with a trust domain matching Agent Identity patterns. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: bool: True if the certificate is an Agent Identity certificate, False otherwise. rr:) ExtensionOIDFspiffeTN)r<r;cryptography.x509.oidrB extensionsget_extension_for_oidSUBJECT_ALTERNATIVE_NAMEExtensionNotFoundvalueget_values_for_typeUniformResourceIdentifierrschemenetloc,_AGENT_IDENTITY_SPIFFE_TRUST_DOMAIN_PATTERNSrematchr>r?) certr;rBexturisuri parsed_uri trust_domainpatternr@s r_is_agent_identity_certificaterXs?%6 //7755C yy,,T-K-KL $C!#J  H,)00 K$Gxx6#$  $%%   ?67Q>?sL C%B,AC9+C%C(C,B>;C=B>>C C CCcb ddlm}|j|jj}t j |j}tj|jd}|jd}t|S#t$r}tt|d}~wwxYw)aCalculates the URL-encoded, unpadded, base64-encoded SHA256 hash of a DER-encoded certificate. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: str: The URL-encoded, unpadded, base64-encoded SHA256 fingerprint. r) serializationzutf-8=N)cryptography.hazmat.primitivesrZ public_bytesEncodingDERhashlibsha256digestbase64 b64encodedecoderstriprr>r?)rQrZder_cert fingerprintbase64_fingerprintunpadded_base64_fingerprintr@s r!calculate_certificate_fingerprintrks?@$$]%;%;%?%?@nnX.557 $--k:AA'J&8&?&?&D#011 ?67Q>?sB B B.B))B.ct|}tjjtj dj dk(}|xr|S)aDetermines if a bound token should be requested. This is based on the GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES environment variable and whether the certificate is an agent identity cert. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: bool: True if a bound token should be requested, False otherwise. r/)rXr rrrr'r2)rQ is_agent_cert is_opted_ins rshould_request_bound_tokenrosM348M   T T   %'     ([(rcL|rt|}t|}|Std)z2Returns the fingerprint of the cached certificate.z"mTLS connection is not configured.)r4rkr) cached_certcert_objcached_cert_fingerprints rget_cached_cert_fingerprintrt s0$[1"CH"M #"=>>r)"__doc__rcr`loggingr rOr$ urllib.parserr google.authrr getLogger__name__r r?rNr#_FAST_POLL_CYCLES_FAST_POLL_INTERVAL_SLOW_POLL_INTERVALr"int_SLOW_POLL_CYCLESrrr-r8r4rXrkrortrrrs.  ((" '  H %F330, X(+>>?CVV++.??-- G >B)>?""?J?6).#r