mxi`JdZ ddlmZddlZddlZddlZddlZddl m Z ddl m Z ddl m Z ddl mZddlmZGd d ej" ZGd d e ZGddeZGddeZGddeZddZGddej0Zy#e$r ddlmZYwxYw)a=Identity Pool Credentials. This module provides credentials to access Google Cloud resources from on-prem or non-Google Cloud platforms which support external credentials (e.g. OIDC ID tokens) retrieved from local file locations or local servers. This includes Microsoft Azure and OIDC identity providers (e.g. K8s workloads registered with Hub with Hub workload identity enabled). These credentials are recommended over the use of service account credentials in on-prem/non-Google Cloud platforms as they do not involve the management of long-live service account private keys. Identity Pool Credentials are initialized using external_account arguments which are typically loaded from an external credentials file or an external credentials URL. This module also provides a definition for an abstract subject token supplier. This supplier can be implemented to return a valid OIDC or SAML2.0 subject token and used to create Identity Pool credentials. The credentials will then call the supplier instead of using pre-defined methods such as reading a local file or calling a URL. )MappingN) NamedTuple)_helpers) exceptions)external_account) _mtls_helperc4eZdZdZej dZy)SubjectTokenSupplieraWBase class for subject token suppliers. This can be implemented with custom logic to retrieve a subject token to exchange for a Google Cloud access token when using Workload or Workforce Identity Federation. The identity pool credential does not cache the subject token, so caching logic should be added in the implementation. ctd)aReturns the requested subject token. The subject token must be valid. .. warning: This is not cached by the calling Google credential, so caching logic should be implemented in the supplier. Args: context (google.auth.externalaccount.SupplierContext): The context object containing information about the requested audience and subject token type. request (google.auth.transport.Request): The object used to make HTTP requests. Raises: google.auth.exceptions.RefreshError: If an error is encountered during subject token retrieval logic. Returns: str: The requested subject token string. )NotImplementedError)selfcontextrequests P/home/htdocs/ttos/venv/lib/python3.12/site-packages/google/auth/identity_pool.pyget_subject_tokenz&SubjectTokenSupplier.get_subject_token>s&""%%N)__name__ __module__ __qualname____doc__abcabstractmethodrrrr r 7s!  &&rr ) metaclassc&eZdZUdZeed<eed<y) _TokenContentaModels the token content response from file and url internal suppliers. Attributes: content (str): The string content of the file or URL response. location (str): The location the content was retrieved from. This will either be a file location or a URL. contentlocationN)rrrrstr__annotations__rrrrrTs LMrrcFeZdZdZdZej edZy) _FileSupplierzeInternal implementation of subject token supplier which supports reading a subject token from a file.c.||_||_||_yN)_path _format_type_subject_token_field_name)rpath format_typesubject_token_field_names r__init__z_FileSupplier.__init__bs ')A&rctjj|js.t j dj |jt|jdd5}t|j|j}dddt|j|jS#1swY*xYw)NzFile '{}' was not found.rutf-8)encoding) osr)existsr&r RefreshErrorformatopenrread_parse_token_datar'r()rrrfile_obj token_contents rrz_FileSupplier.get_subject_tokengsww~~djj)))*D*K*KDJJ*WX X $**cG 4 G)(--/4::FM G! 4,,d.L.L   G Gs 0%B>>CN rrrrr,rcopy_docstringr rrrrr#r#_s-oB X12  3  rr#cFeZdZdZdZej edZy) _UrlSupplierzvInternal implementation of subject token supplier which supports retrieving a subject token by calling a URL endpoint.c<||_||_||_||_yr%)_urlr'r(_headers)rurlr*r+headerss rr,z_UrlSupplier.__init__ws  ')A& rcr||jd|j}t|jdr|jj dn |j}|j dk7rt jd|t||j}t||j|jS)NGET)rAmethodrBdecoder/z.Unable to retrieve Identity Pool subject token) r?r@hasattrdatarFstatusrr3rr7r'r()rrrresponse response_bodyr9s rrz_UrlSupplier.get_subject_token}styy N x}}h/ MM  )  ??c !))@- &mTYY?  4,,d.L.L  rNr:rrrr=r=ts/A X12 3 rr=cReZdZdZdZej edZdZ dZ y) _X509SupplierzInternal supplier for X509 workload credentials. This class is used internally and always returns an empty string as the subject token.c ||_||_yr%)_trust_chain_path_leaf_cert_callback)rtrust_chain_pathleaf_cert_callbacks rr,z_X509Supplier.__init__s!1#5 rcdddlm}|j|j|j }|j }g}|j tj||t|dk(rtj|Stj|d}||dk7r|j |tdt|D]H}tj||} | |dk(rtjd|j | Jtj|S)Nrcryptoz?The leaf certificate must be at the top of the trust chain file)OpenSSLrVload_certificate FILETYPE_PEMrQ_read_trust_chainappendrN _encode_certlenjsondumpsrangerr3) rrrrV leaf_cert trust_chain cert_chain first_certiencodeds rrz_X509Supplier.get_subject_tokens #++   !9!9!; ,,.  -44Y?@  #k"2a"7::j) )#// A? A &   j )q#k*+ +A#00Q@G*Q-' --U!!'* +zz*%%rcxddlm}g}|j|jdk(r|S t|jd5}|j }|j d}|D]F}|j sd|z} |j|j|}|j|H|cdddS#t$r4} tjdj|j| d} ~ wwxYw#1swYyxYw#t$r/tjdj|jwxYw)NrrUr rbs-----BEGIN CERTIFICATE-----z=Error loading PEM certificates from the trust chain file '{}'z$Trust chain file '{}' was not found.)rXrVrPr5r6splitstriprYrZr\ Exceptionrr3r4FileNotFoundError) rrVcertificate_trust_chainftrust_chain_data cert_blocks cert_block cert_datacertes rr[z_X509Supplier._read_trust_chainsL #"$  ! ! )T-C-Cr-I* * d,,d3 /q#$668 .445ST "-%J!'')$BZ$O  %#)#:#: & 3 3Y$D4::4@% /) / / )%","9"9 _ f f$($:$:!"#$% %% / /*! ))6==d>T>TU  sRD7C55C5;-B5(C5+ D5 C2>/C--C22C55C>:D>D8D9cddlm}tj|j |j |j dS)NrrUr/)rXrVbase64 b64encodedump_certificate FILETYPE_ASN1rF)rtrVs rr]z_X509Supplier._encode_certs9 #  # #F$8$8$ ? &/ rN) rrrrr,rr;r rr[r]rrrrNrNs;R6X12&3&@#JrrNc&|dk(r |j}n% tj|j}||}|st j d|S#ttf$r0t j dj|j|wxYw)Ntextz@Unable to parse subject_token from JSON file '{}' using key '{}'z3Missing subject_token in the credential_source file) rr_loadsKeyError ValueErrorrr3r4r)r9r*r+token response_datas rr7r7sf%%  JJ}'<'<=M!":;E %% A   L*% ))RYY!**,D  s $A?BceZdZdZej ddffd ZejejdZ dZ dZ dZ fdZd Zfd Zd Zd Zd ZefdZefdZdZxZS) CredentialsaExternal account credentials sourced from files and URLs. **IMPORTANT**: This class does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. When the credential configuration is accepted from an untrusted source, you should validate it before using. Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details. Nctt| |||||d|||tjd||tjd|||_d|_d|_d|_yt|tsd|_ tjd|jd|_|jd|_|jd|_d |vrtjd |j|jr|jn|j!||j r1t#|j |j$|j&|_y|jrInvalid Identity Pool credential_source field 'environment_id')superrr,r InvalidValue_subject_token_supplier_credential_source_file_credential_source_url_credential_source_certificate isinstancer_credential_source_executableMalformedErrorget_validate_single_source_validate_certificate_config_validate_file_or_url_configr#_credential_source_format_type_credential_source_field_namer=_credential_source_headersrNrP_get_cert_bytes) rrrrrsubject_token_supplierargskwargs __class__s rr,zCredentials.__init__ sx k4)  1/      $)?)G))Y   (-C-O))m  " -+AD (+/D (*.D '26D //9592 //U,=+@+@+HD (*;*?*?*FD '2C2G2G 2VD / #44 //T  ( ( *22113112CD++/<0077660, ,,/;//776633 0,0=**D,@,@0,rcN|jj|j|Sr%)rr_supplier_context)rrs rretrieve_subject_tokenz"Credentials.retrieve_subject_tokens&++==  " "G  rc|jtjdtj|j S)NzThe credential is not configured to use mtls requests. The credential should include a "certificate" section in the credential source.)rrr3r _get_workload_cert_and_key_paths_certificate_config_locationrs r_get_mtls_cert_and_key_pathsz(Credentials._get_mtls_cert_and_key_pathssE  . . 6))Y  @@11 rcR|j\}}tj|Sr%)rr_read_cert_file)r cert_path_s rrzCredentials._get_cert_bytess%88: 1++I66rc|jduSr%)rrs r_mtls_requiredzCredentials._mtls_requireds22$>>rctt| }t|jt rK|jj drd|d<|S|jj drd|d<|Sd|d<|Sd|d<|S)NrsourcerAx509 programmatic)rr_create_default_metrics_optionsr_credential_sourcerr)rmetrics_optionsrs rrz+Credentials._create_default_metrics_optionss TRT d--w 7&&**62,2) ((,,U3,1) -3))7OH %rc|jduSr%)rrs r_has_custom_supplierz Credentials._has_custom_suppliers&&$..rctt| }|jr|j d|j i|S)Nr)rr_constructor_argsrupdater)rrrs rrzCredentials._constructor_argss;[$9;  $ $ & KK143O3OP Q rcH|jjd|_|jjd}|jjd|_|jr|rt j d|js|st j dyy)Ncertificate_config_locationuse_default_certificate_configrRz~Invalid certificate configuration, certificate_config_location cannot be specified when use_default_certificate_config = true.zInvalid certificate configuration, use_default_certificate_config should be true if no certificate_config_location is provided.)rrrrPrr)r use_defaults rrz(Credentials._validate_certificate_configs,0,O,O,S,S )- )99== , "&!D!D!H!H "   , ,++Q 00++R :E0rc|jd|_|jdi}|jdxsd|_|jdvr.tjdj |j|jdk(r8|jd|_|j tjd yd|_y) NrBr4typer|)r|r_z%Invalid credential_source format '{}'r_r+zBMissing subject_token_field_name for JSON credential_source format)rrrrrr4r)rrcredential_source_formats rrz(Credentials._validate_file_or_url_configs*;*?*? *J'#4#8#82#F  % ( ( 0 :F +  . .6F F++7>>77   . .& 81I1M1M*2D .119 //X: 26D .rc|j|j|jg}tt d|}t |dkDrt jdt |dk7rt jdy)Nc |duSr%r)rs rz5Credentials._validate_single_source..s &"4rrWzVAmbiguous credential_source. 'file', 'url', and 'certificate' are mutually exclusive..zNMissing credential_source. A 'file', 'url', or 'certificate' must be provided.)rrrlistfilterr^rr)rcredential_sourcesvalid_credential_sourcess rrz#Credentials._validate_single_sources  ( (  ' '  / /  $( 46H I$   ' (1 ,++h  ' (A -++`  .rc t|jd}|jd|itt||fi|S)aCreates an Identity Pool Credentials instance from parsed external account info. **IMPORTANT**: This method does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. When the credential configuration is accepted from an untrusted source, you should validate it before using with this method. Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details. Args: info (Mapping[str, str]): The Identity Pool external account info in Google format. kwargs: Additional arguments to pass to the constructor. Returns: google.auth.identity_pool.Credentials: The constructed credentials. Raises: ValueError: For invalid parameters. r)rrrr from_info)clsinforrrs rrzCredentials.from_infos?0"&*B!C /1GHI[#0@@@rc ,tt| |fi|S)aBCreates an IdentityPool Credentials instance from an external account json file. **IMPORTANT**: This method does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. When the credential configuration is accepted from an untrusted source, you should validate it before using with this method. Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details. Args: filename (str): The path to the IdentityPool external account json file. kwargs: Additional arguments to pass to the constructor. Returns: google.auth.identity_pool.Credentials: The constructed credentials. )rr from_file)rfilenamerrs rrzCredentials.from_files([#0DVDDrcddlm}d}|jC|j}|j |}|j |r|j |}|j|||j|y)zRefreshes the access token. Args: request (google.auth.transport.Request): The object used to make HTTP requests. r)_agent_identity_utilsN)cert_fingerprint) google.authrrrparse_certificateshould_request_bound_token!calculate_certificate_fingerprint_perform_refresh_token_handle_trust_boundary)rrrr cert_bytesrts rrefreshzCredentials.refresh+s| 6  . . :--/J(:::FD$??E)KKDQ! ##G>N#O ##G,r)rrrrr_DEFAULT_TOKEN_URLr,rr;rrrrrrrrrrr classmethodrrr __classcell__)rs@rrrs #55# {zX-99: ; 7? /&64&AA6EE*-rr)r|N)rcollections.abcr ImportError collectionsrrwr_r1typingrrrrrgoogle.auth.transportrABCMetar rr#r=rNr7rrrrrs.$'  "(.&S[[&:J ( * '