
    Pe                        d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZ d dlmZmZ d dlmZm Z m!Z! d d	lm"Z"  ejF                  e$      Z%d
Z&dZ'dZ(dZ)g dZ*dZ+dZ,d Z-d Z. G d d      Z/ G d de/      Z0 G d de/      Z1 G d de/      Z2 G d de/      Z3 G d de3      Z4 G d d e4      Z5 G d! d"e5      Z6 G d# d$e5      Z7 G d% d&e3      Z8 G d' d(e8      Z9 G d) d*e3      Z: G d+ d,e/      Z; G d- d.e;      Z< G d/ d0e;      Z= G d1 d2e0      Z>e1e2e2e;e<e=e:e5e7e6e>d3Z?erd d4l@mAZA e?j                  eA       ye?j                  e3e8e4e9d5       y)6    N)Mapping
formatdate)sha1sha256)
itemgetter)	HAS_CRTHTTPHeadersencodebytesensure_unicodeparse_qsquoteunquoteurlsplit
urlunsplit)NoAuthTokenErrorNoCredentialsError)is_valid_ipv6_endpoint_urlnormalize_url_pathpercent_encode_sequence)MD5_AVAILABLE@e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855i   z%Y-%m-%dT%H:%M:%SZz%Y%m%dT%H%M%SZ)expectz
user-agentzx-amzn-trace-idzUNSIGNED-PAYLOADz"STREAMING-UNSIGNED-PAYLOAD-TRAILERc                     t        |       }|j                  }t        |       rd| d}ddd}|j                  9|j                  |j	                  |j
                        k7  rd||j                  fz  }|S )N[]P   i  )httphttpsz%s:%d)r   hostnamer   portgetscheme)url	url_partshostdefault_portss       //usr/lib/python3/dist-packages/botocore/auth.py_host_from_urlr)   F   s{    
 ID!#&4&{M ~~!>>]..y/?/?@@dINN33DK    c                     | j                   }t        |t              r&t        j                  |j                  d            }|S t        |t              rt        j                  |      }|S Nutf-8)data
isinstancebytesjsonloadsdecodestr)requestr.   s     r(   _get_body_as_dictr6   Y   sT    
 <<D$zz$++g./ K 
D#	zz$Kr*   c                       e Zd ZdZdZd Zy)
BaseSignerFc                     t        d      )Nadd_auth)NotImplementedErrorselfr5   s     r(   r:   zBaseSigner.add_authj   s    !*--r*   N)__name__
__module____qualname__REQUIRES_REGIONREQUIRES_TOKENr:    r*   r(   r8   r8   f   s    ON.r*   r8   c                       e Zd ZdZ	 d Zy)TokenSignerTc                     || _         y N)
auth_token)r=   rH   s     r(   __init__zTokenSigner.__init__t   s	    $r*   N)r>   r?   r@   rB   rI   rC   r*   r(   rE   rE   n   s    N%r*   rE   c                   "    e Zd ZdZd Zd Zd Zy)	SigV2Authz+
    Sign a request with Signature V2.
    c                     || _         y rG   credentialsr=   rN   s     r(   rI   zSigV2Auth.__init__}   
    &r*   c                 P   t         j                  d       t        |j                        }|j                  }t        |      dk(  rd}|j                   d|j                   d| d}t        j                  | j                  j                  j                  d      t              }g }t        |      D ]d  }|dk(  r	t        ||         }	t!        |j                  d      d	      }
t!        |	j                  d      d
	      }|j#                  |
 d|        f dj%                  |      }||z  }t         j                  d|       |j'                  |j                  d             t)        j*                  |j-                               j/                         j1                  d      }||fS )Nz$Calculating signature using v2 auth.r   /
r-   	digestmod	Signature safez-_~=&zString to sign: %s)loggerdebugr   r$   pathlenmethodnetlochmacnewrN   
secret_keyencoder   sortedr4   r   appendjoinupdatebase64	b64encodedigeststripr3   )r=   r5   paramssplitr^   string_to_signlhmacpairskeyvalue
quoted_keyquoted_valueqsb64s                 r(   calc_signaturezSigV2Auth.calc_signature   sj   ;<%zzt9>D#NN+2ell^2dV2F''..w76
 &> 		9C k!s$Eszz'2<J g!6UCLLLJ<q78		9 XXe_")>:^**734u||~.446==gFCyr*   c                    | j                   
t               |j                  r|j                  }n|j                  }| j                   j                  |d<   d|d<   d|d<   t        j                  t        t        j                               |d<   | j                   j                  r| j                   j                  |d<   | j                  ||      \  }}||d<   |S )	NAWSAccessKeyId2SignatureVersion
HmacSHA256SignatureMethod	TimestampSecurityTokenrV   )rN   r   r.   rn   
access_keytimestrftimeISO8601gmtimetokenry   )r=   r5   rn   rw   	signatures        r(   r:   zSigV2Auth.add_auth   s     #$&&<<\\F ^^F#'#3#3#>#> %(!"$0 !"mmGT[[]C{!!&*&6&6&<&<F?#++GV<I'{r*   N)r>   r?   r@   __doc__rI   ry   r:   rC   r*   r(   rK   rK   x   s    '8r*   rK   c                       e Zd Zd Zd Zy)	SigV3Authc                     || _         y rG   rM   rO   s     r(   rI   zSigV3Auth.__init__   rP   r*   c                    | j                   
t               d|j                  v r|j                  d= t        d      |j                  d<   | j                   j                  r>d|j                  v r|j                  d= | j                   j                  |j                  d<   t        j                  | j                   j                  j                  d      t              }|j                  |j                  d   j                  d             t        |j                               j                         }d| j                   j                   d|j                  d       }d	|j                  v r|j                  d	= ||j                  d	<   y )
NDateTusegmtX-Amz-Security-Tokenr-   rT   zAWS3-HTTPS AWSAccessKeyId=z ,Algorithm=HmacSHA256,Signature=zX-Amzn-Authorization)rN   r   headersr   r   rb   rc   rd   re   r   ri   r   rl   rm   r   r3   )r=   r5   new_hmacencoded_signaturer   s        r(   r:   zSigV3Auth.add_auth   sL   #$&&W__$'",D"9!!%8OO$:;6:6F6F6L6LGOO2388''..w76
 	/66w?@'(9:@@B()9)9)D)D(E F..?.F.Fw.O-PR 	 "W__4 672;./r*   N)r>   r?   r@   rI   r:   rC   r*   r(   r   r      s    '<r*   r   c                       e Zd ZdZdZd ZddZd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zy)	SigV4Authz+
    Sign a request with Signature V4.
    Tc                 .    || _         || _        || _        y rG   )rN   _region_name_service_namer=   rN   service_nameregion_names       r(   rI   zSigV4Auth.__init__   s    & ()r*   c                     |r:t        j                  ||j                  d      t              j	                         }|S t        j                  ||j                  d      t              j                         }|S r,   )rb   rc   re   r   	hexdigestrl   )r=   rs   msghexsigs        r(   _signzSigV4Auth._sign   s[    ((3

7 3V<FFHC 
 ((3

7 3V<CCEC
r*   c                     t               }|j                  j                         D ]#  \  }}|j                         }|t        vs|||<   % d|vrt        |j                        |d<   |S )zk
        Select the headers from the request that need to be included
        in the StringToSign.
        r&   )r
   r   itemslowerSIGNED_HEADERS_BLACKLISTr)   r$   )r=   r5   
header_mapnamert   lnames         r(   headers_to_signzSigV4Auth.headers_to_sign   sn    
 !]
"??002 	*KD%JJLE44$)
5!	* # "0!<Jvr*   c                     |j                   r| j                  |j                         S | j                  t        |j                              S rG   )rn   _canonical_query_string_params_canonical_query_string_urlr   r$   r<   s     r(   canonical_query_stringz SigV4Auth.canonical_query_string   s:    
 >>66w~~FF33HW[[4IJJr*   c           	      :   g }t        |t              r|j                         }|D ]7  \  }}|j                  t	        |d      t	        t        |      d      f       9 g }t        |      D ]  \  }}|j                  | d|         dj                  |      }|S )Nz-_.~rX   rZ   r[   )r/   r   r   rg   r   r4   rf   rh   )r=   rn   key_val_pairsrs   rt   sorted_key_valsr   s          r(   r   z(SigV4Auth._canonical_query_string_params  s    fg&\\^F  	JC  s(%E
*HI	  !/ 	5JC""cU!E7#34	5!$/!:%%r*   c                 .   d}|j                   rg }|j                   j                  d      D ]*  }|j                  d      \  }}}|j                  ||f       , g }t	        |      D ]  \  }}|j                  | d|         dj                  |      }|S )NrW   r[   rZ   )queryro   	partitionrg   rf   rh   )	r=   partsr   r   pairrs   _rt   r   s	            r(   r   z%SigV4Auth._canonical_query_string_url  s    !#;;M))#. 3 $s 3Q$$c5\23 !O %]3 9
U&&#aw'789%(XXo%>"%%r*   c                      g }t        t        |            }|D ]J  }dj                   fd|j                  |      D              }|j	                  | dt        |              L dj                  |      S )a  
        Return the headers that need to be included in the StringToSign
        in their canonical form by converting all header keys to lower
        case, sorting them in alphabetical order and then joining
        them into a string, separated by newlines.
        ,c              3   @   K   | ]  }j                  |        y wrG   )_header_value).0vr=   s     r(   	<genexpr>z.SigV4Auth.canonical_headers.<locals>.<genexpr>,  s!      *+""1%s   :rS   )rf   setrh   get_allrg   r   )r=   r   r   sorted_header_namesrs   rt   s   `     r(   canonical_headerszSigV4Auth.canonical_headers"  s     $S%9:& 	=CHH />/F/Fs/K E NNcU!N5$9#:;<		=
 yy!!r*   c                 @    dj                  |j                               S )N )rh   ro   )r=   rt   s     r(   r   zSigV4Auth._header_value2  s     xx&&r*   c                 Z    t        d t        |      D              }dj                  |      S )Nc              3   X   K   | ]"  }|j                         j                          $ y wrG   )r   rm   )r   ns     r(   r   z+SigV4Auth.signed_headers.<locals>.<genexpr>;  s     Iq*Is   (*;)rf   r   rh   )r=   r   r   s      r(   signed_headerszSigV4Auth.signed_headers:  s&    IC4HIIxx  r*   c                     |j                   j                  di       }|j                  d      }t        |t              xr |j                  d      dk(  S )Nchecksumrequest_algorithmintrailer)contextr"   r/   dict)r=   r5   checksum_context	algorithms       r(   _is_streaming_checksum_payloadz(SigV4Auth._is_streaming_checksum_payload>  sJ    "??..z2>$(()<=	)T*Oy}}T/Bi/OOr*   c                    | j                  |      rt        S | j                  |      st        S |j                  }|rt        |d      r|j                         }t        j                  |j                  t              }t               }t        |d      D ]  }|j                  |        |j                         }|j                  |       |S |rt        |      j                         S t         S )Nseekr*   )r   "STREAMING_UNSIGNED_PAYLOAD_TRAILER_should_sha256_sign_payloadUNSIGNED_PAYLOADbodyhasattrtell	functoolspartialreadPAYLOAD_BUFFERr   iterri   r   r   EMPTY_SHA256_HASH)r=   r5   request_bodypositionread_chunksizer   chunkhex_checksums           r(   payloadzSigV4Auth.payloadC  s    ..w75511': $#||GL&9#((*H&..!!>N xHnc2 '&'#--/Lh' ,'1133$$r*   c                 r    |j                   j                  d      sy|j                  j                  dd      S )Nr   Tpayload_signing_enabled)r$   
startswithr   r"   r<   s     r(   r   z%SigV4Auth._should_sha256_sign_payload]  s1    {{%%g.
 ""#<dCCr*   c                 @   |j                   j                         g}| j                  t        |j                        j
                        }|j                  |       |j                  | j                  |             | j                  |      }|j                  | j                  |      dz          |j                  | j                  |             d|j                  v r|j                  d   }n| j                  |      }|j                  |       dj                  |      S )NrS   X-Amz-Content-SHA256)r`   upper_normalize_url_pathr   r$   r^   rg   r   r   r   r   r   r   rh   )r=   r5   crr^   r   body_checksums         r(   canonical_requestzSigV4Auth.canonical_requestg  s    nn""$%''(=(B(BC
		$
		$--g67..w7
		$((9D@A
		$%%o67!W__4#OO,BCM LL1M
		- yy}r*   c                 2    t        t        |      d      }|S )Nz/~rX   )r   r   )r=   r^   normalized_paths      r(   r   zSigV4Auth._normalize_url_pathv  s     24 8tDr*   c                 "   | j                   j                  g}|j                  |j                  d   dd        |j                  | j                         |j                  | j
                         |j                  d       dj                  |      S N	timestampr      aws4_requestrR   )rN   r   rg   r   r   r   rh   r=   r5   scopes      r(   r   zSigV4Auth.scopez  sp    !!,,-W__[1!A67T&&'T''(^$xxr*   c                     g }|j                  |j                  d   dd        |j                  | j                         |j                  | j                         |j                  d       dj	                  |      S r   )rg   r   r   r   rh   r   s      r(   credential_scopezSigV4Auth.credential_scope  sa    W__[1!A67T&&'T''(^$xxr*   c                    dg}|j                  |j                  d          |j                  | j                  |             |j                  t        |j	                  d            j                                dj                  |      S )z
        Return the canonical StringToSign as well as a dict
        containing the original version of all headers that
        were included in the StringToSign.
        AWS4-HMAC-SHA256r   r-   rS   )rg   r   r   r   re   r   rh   )r=   r5   r   stss       r(   rp   zSigV4Auth.string_to_sign  sl     ""

7??;/0

4((12

6+227;<FFHIyy~r*   c                 P   | j                   j                  }| j                  d| j                         |j                  d   dd       }| j                  || j
                        }| j                  || j                        }| j                  |d      }| j                  ||d      S )NAWS4r   r   r   r   T)r   )rN   rd   r   re   r   r   r   )r=   rp   r5   rs   k_datek_region	k_service	k_signings           r(   r   zSigV4Auth.signature  s    ))C5\!!#W__[%A!A%F
 ::fd&7&78JJx););<	JJy.9	zz)^z>>r*   c                    | j                   
t               t        j                  j                         }|j	                  t
              |j                  d<   | j                  |       | j                  |      }t        j                  d       t        j                  d|       | j                  ||      }t        j                  d|       | j                  ||      }t        j                  d|       | j                  ||       y )Nr   z$Calculating signature using v4 auth.zCanonicalRequest:
%sStringToSign:
%szSignature:
%s)rN   r   datetimeutcnowr   SIGV4_TIMESTAMPr   _modify_request_before_signingr   r\   r]   rp   r   _inject_signature_to_request)r=   r5   datetime_nowr   rp   r   s         r(   r:   zSigV4Auth.add_auth  s    #$&&((//1'3'<'<_'M$ 	++G4 227;;<,.?@,,W6GH(.9NN>7;	%y1))'9=r*   c                     d| j                  |      z  g}| j                  |      }|j                  d| j                  |              |j                  d|z         dj	                  |      |j
                  d<   |S )NzAWS4-HMAC-SHA256 Credential=%szSignedHeaders=zSignature=%sz, Authorization)r   r   rg   r   rh   r   )r=   r5   r   auth_strr   s        r(   r  z&SigV4Auth._inject_signature_to_request  sy    4tzz'7JJK..w7T00ABC	
 	23+/99X+>(r*   c                    d|j                   v r|j                   d= | j                  |       | j                  j                  r>d|j                   v r|j                   d= | j                  j                  |j                   d<   |j                  j                  dd      s/d|j                   v r|j                   d= t        |j                   d<   y y )Nr  r   r   Tr   )r   _set_necessary_date_headersrN   r   r   r"   r   r<   s     r(   r  z(SigV4Auth._modify_request_before_signing  s    goo-0((1!!%8OO$:;6:6F6F6L6LGOO23""#<dC%8OO$:;6FGOO23 Dr*   c                    d|j                   v r|j                   d= t        j                  j                  |j                  d   t              }t        t        t        j                  |j                                           |j                   d<   d|j                   v r|j                   d= y y d|j                   v r|j                   d= |j                  d   |j                   d<   y )Nr   r   
X-Amz-Date)
r   r	  strptimer   r  r   intcalendartimegm	timetuple)r=   r5   datetime_timestamps      r(   r  z%SigV4Auth._set_necessary_date_headers  s     W__$'!)!2!2!;!;,o" '1HOO$6$@$@$BCD'GOOF# w.OOL1 / w.OOL1,3OOK,HGOOL)r*   N)F)r>   r?   r@   r   rA   rI   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rp   r   r:   r  r  r  rC   r*   r(   r   r      s     O* K&"& " '!P
%4D
?>$GIr*   r   c                   .     e Zd Z fdZ fdZd Z xZS )S3SigV4Authc                     t         |   |       d|j                  v r|j                  d= | j                  |      |j                  d<   y )Nr   )superr  r   r   r=   r5   	__class__s     r(   r  z*S3SigV4Auth._modify_request_before_signing  sA    .w7!W__4 6726,,w2G./r*   c                    |j                   j                  d      }t        |dd       }|i }|j                  dd       }||S d}|j                   j                  di       }|j                  d      }t        |t              r|j                  d      dk(  r|d	   }|j
                  j                  d
      r||j                  vry|j                   j                  dd      ryt        | %  |      S )Nclient_configs3r   zContent-MD5r   r   r   headerr   r   Thas_streaming_inputF)
r   r"   getattrr/   r   r$   r   r   r  r   )	r=   r5   r#  	s3_configsign_payloadchecksum_headerr   r   r!  s	           r(   r   z'S3SigV4Auth._should_sha256_sign_payload  s      ++O<M46	 I !}}%>E# ("??..z2>$(()<=	i&9==+>(+J'/O&&w/goo5 ??4e< w27;;r*   c                     |S rG   rC   r=   r^   s     r(   r   zS3SigV4Auth._normalize_url_path      r*   )r>   r?   r@   r  r   r   __classcell__r!  s   @r(   r  r    s    H'<Rr*   r  c                   6     e Zd ZdZ fdZ fdZ fdZ xZS )S3ExpressAuthTc                6    t         |   |||       || _        y rG   )r  rI   _identity_cache)r=   rN   r   r   identity_cacher!  s        r(   rI   zS3ExpressAuth.__init__  s     	lK@-r*   c                 $    t         |   |       y rG   )r  r:   r   s     r(   r:   zS3ExpressAuth.add_auth  s    !r*   c                     t         |   |       d|j                  vr#| j                  j                  |j                  d<   d|j                  v r|j                  d= y y )Nzx-amz-s3session-tokenr   )r  r  r   rN   r   r   s     r(   r  z,S3ExpressAuth._modify_request_before_signing   sU    .w7"'//97;7G7G7M7MGOO34!W__4 67 5r*   )r>   r?   r@   REQUIRES_IDENTITY_CACHErI   r:   r  r.  r/  s   @r(   r1  r1    s    "."8 8r*   r1  c                       e Zd ZdZd Zy)S3ExpressPostAuthTc                    t         j                   j                         }|j                  t              |j                  d<   i }|j                  j                  dd       |j                  d   }i }g }|j                  j                  dd       &|j                  d   }|j                  dd       |d   }||d<   d|d<   | j                  |      |d<   |j                  d   |d<   |j                  ddi       |j                  d| j                  |      i       |j                  d|j                  d   i       | j                  j                  @| j                  j                  |d	<   |j                  d	| j                  j                  i       t        j                  t        j                  |      j                  d
            j                  d
      |d<   | j!                  |d   |      |d<   ||j                  d<   ||j                  d<   y )Nr   s3-presign-post-fieldss3-presign-post-policy
conditionsr   x-amz-algorithmx-amz-credential
x-amz-dateX-Amz-S3session-Tokenr-   policyx-amz-signaturer	  r
  r   r  r   r"   r   rg   rN   r   rj   rk   r1   dumpsre   r3   r   r=   r5   r  fieldsrB  r=  s         r(   r:   zS3ExpressPostAuth.add_auth,  s   ((//1'3'<'<_'M$??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|$6 !%)ZZ%8!"&{;|,.@AB-tzz'/BCD<)EFG!!-.2.>.>.D.DF*+($*:*:*@*@A
 "++JJv%%g.

&/ 	x %)NN6(3CW$M !4:014:01r*   N)r>   r?   r@   r7  r:   rC   r*   r(   r9  r9  )  s    "';r*   r9  c                   D     e Zd ZdZdZed fd
Zd Zd Zd Zd Z	 xZ
S )	S3ExpressQueryAuthi,  T)expiresc                :    t         |   ||||       || _        y )N)r4  r  rI   _expires)r=   rN   r   r   r4  rJ  r!  s         r(   rI   zS3ExpressQueryAuth.__init__Z  s,     	)	 	 	
  r*   c                 N   |j                   j                  d      }d}||k(  r|j                   d= | j                  | j                  |            }d| j	                  |      |j
                  d   | j                  |d}| j                  j                  | j                  j                  |d<   t        |j                        }t        |j                  d      }|j                         D 	ci c]  \  }}	||	d	    }
}}	|j                  r"|
j                  |j                         i |_        d
}|j                   r!|
j                  t#        |             d
|_        |
rt%        |
      dz   }| t%        |       }|}|d	   |d   |d   ||d   f}t'        |      |_
        y c c}	}w )Ncontent-type0application/x-www-form-urlencoded; charset=utf-8r   r   zX-Amz-AlgorithmzX-Amz-Credentialr  zX-Amz-ExpireszX-Amz-SignedHeadersrA  Tkeep_blank_valuesr   rW   r[            r   r"   r   r   r   r   rM  rN   r   r   r$   r   r   r   rn   ri   r.   r6   r   r   )r=   r5   content_typeblocklisted_content_typer   auth_paramsr%   query_string_partskr   
query_dictoperation_paramsnew_query_stringpnew_url_partss                  r(   r  z1S3ExpressQueryAuth._modify_request_before_signingk  s    **>:> 	! 33/
 ,,T-A-A'-JK  2 $

7 3!//+6!]]#1
 !!-373C3C3I3IK/0 W[[)	 &iooN*<*B*B*DE$!Qa1gE
E>>gnn-GN << /89GL6zBSH !8!E FG 	 1qtQqT+;QqTB /A F   ,F!c                 4    |xj                   d|z  z  c_         y Nz&X-Amz-Signature=%sr$   r=   r5   r   s      r(   r  z/S3ExpressQueryAuth._inject_signature_to_request       	,y88r*   c                     |S rG   rC   r,  s     r(   r   z&S3ExpressQueryAuth._normalize_url_path  r-  r*   c                     t         S rG   r   r<   s     r(   r   zS3ExpressQueryAuth.payload  
    
  r*   )r>   r?   r@   DEFAULT_EXPIRESr7  rI   r  r  r   r   r.  r/  s   @r(   rI  rI  V  s-    O"   "?0B9 r*   rI  c                   2     e Zd ZdZef fd	Zd Zd Z xZS )SigV4QueryAuth  c                 6    t         |   |||       || _        y rG   rL  )r=   rN   r   r   rJ  r!  s        r(   rI   zSigV4QueryAuth.__init__  s     	lK@r*   c                 N   |j                   j                  d      }d}||k(  r|j                   d= | j                  | j                  |            }d| j	                  |      |j
                  d   | j                  |d}| j                  j                  | j                  j                  |d<   t        |j                        }t        |j                  d      }|j                         D 	ci c]  \  }}	||	d	    }
}}	|j                  r"|
j                  |j                         i |_        d
}|j                   r!|
j                  t#        |             d
|_        |
rt%        |
      dz   }| t%        |       }|}|d	   |d   |d   ||d   f}t'        |      |_
        y c c}	}w )NrO  rP  r   r   rQ  r   TrR  r   rW   r[   rT  rU  rV  rW  )r=   r5   rX  blacklisted_content_typer   rZ  r%   r[  r\  r   r]  r^  r_  r`  ra  s                  r(   r  z-SigV4QueryAuth._modify_request_before_signing  s    **>:> 	! 33/
 ,,T-A-A'-JK  2 $

7 3!//+6!]]#1
 !!-262B2B2H2HK./ W[[)	 &iooN*<*B*B*DE$!Qa1gE
E>>gnn-GN << /89GL6zBSH !8!E FG 	 1qtQqT+;QqTB /A Frb  c                 4    |xj                   d|z  z  c_         y rd  re  rf  s      r(   r  z+SigV4QueryAuth._inject_signature_to_request  rg  r*   )r>   r?   r@   rl  rI   r  r  r.  r/  s   @r(   rn  rn    s    O ?N ?0B9r*   rn  c                       e Zd ZdZd Zd Zy)S3SigV4QueryAutha  S3 SigV4 auth using query parameters.

    This signer will sign a request using query parameters and signature
    version 4, i.e a "presigned url" signer.

    Based off of:

    http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

    c                     |S rG   rC   r,  s     r(   r   z$S3SigV4QueryAuth._normalize_url_path  r-  r*   c                     t         S rG   rj  r<   s     r(   r   zS3SigV4QueryAuth.payload  rk  r*   N)r>   r?   r@   r   r   r   rC   r*   r(   ru  ru    s    	 r*   ru  c                       e Zd ZdZd Zy)S3SigV4PostAuthz
    Presigns a s3 post

    Implementation doc here:
    http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html
    c                    t         j                   j                         }|j                  t              |j                  d<   i }|j                  j                  dd       |j                  d   }i }g }|j                  j                  dd       &|j                  d   }|j                  dd       |d   }||d<   d|d<   | j                  |      |d<   |j                  d   |d<   |j                  ddi       |j                  d| j                  |      i       |j                  d|j                  d   i       | j                  j                  @| j                  j                  |d	<   |j                  d	| j                  j                  i       t        j                  t        j                  |      j                  d
            j                  d
      |d<   | j!                  |d   |      |d<   ||j                  d<   ||j                  d<   y )Nr   r;  r<  r=  r   r>  r?  r@  x-amz-security-tokenr-   rB  rC  rD  rF  s         r(   r:   zS3SigV4PostAuth.add_auth/  s   ((//1'3'<'<_'M$??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|$6 !%)ZZ%8!"&{;|,.@AB-tzz'/BCD<)EFG!!--1-=-=-C-CF)*5t7G7G7M7MNO "++JJv%%g.

&/ 	x %)NN6(3CW$M !4:014:01r*   Nr>   r?   r@   r   r:   rC   r*   r(   ry  ry  '  s    %;r*   ry  c                   b    e Zd Zg dZddZd Zd Zd Zd ZddZ		 dd	Z
	 dd
Zd Zd Zd Zy)
HmacV1Auth)$
accelerateaclcorsdefaultObjectAcllocationlogging
partNumberrB  requestPaymenttorrent
versioning	versionIdversionswebsiteuploadsuploadIdzresponse-content-typezresponse-content-languagezresponse-expireszresponse-cache-controlzresponse-content-dispositionzresponse-content-encodingdelete	lifecycletaggingrestorestorageClassnotificationreplicationr  	analyticsmetrics	inventoryselectzselect-typezobject-lockNc                     || _         y rG   rM   r   s       r(   rI   zHmacV1Auth.__init__  rP   r*   c                 *   t        j                  | j                  j                  j	                  d      t
              }|j                  |j	                  d             t        |j                               j                         j                  d      S )Nr-   rT   )rb   rc   rN   rd   re   r   ri   r   rl   rm   r3   )r=   rp   r   s      r(   sign_stringzHmacV1Auth.sign_string  sk    88''..w74
 	--g678??,-335<<WEEr*   c                 ,   g d}g }d|v r|d= | j                         |d<   |D ]_  }d}|D ]B  }|j                         }||   ||k(  s|j                  ||   j                                d}D |rO|j                  d       a dj	                  |      S )N)content-md5rO  dater   FTrW   rS   )	_get_dater   rg   rm   rh   )r=   r   interesting_headershoiihfoundrs   lks           r(   canonical_standard_headersz%HmacV1Auth.canonical_standard_headers  s    EW..*% 	BE !YY[3<+bJJws|1134 E	!
 

2	 yy~r*   c                 P   g }i }|D ]T  }|j                         }||   |j                  d      s+dj                  d |j                  |      D              ||<   V t	        |j                               }|D ]  }|j                  | d||            dj                  |      S )Nx-amz-r   c              3   <   K   | ]  }|j                           y wrG   )rm   )r   r   s     r(   r   z6HmacV1Auth.canonical_custom_headers.<locals>.<genexpr>  s      2&'	2s   r   rS   )r   r   rh   r   rf   keysrg   )r=   r   r  custom_headersrs   r  sorted_header_keyss          r(   canonical_custom_headersz#HmacV1Auth.canonical_custom_headers  s     	CBs|'==*), 2+2??3+?2 *N2&		 $N$7$7$9:% 	7CJJ#as 3456	7yy~r*   c                 H    t        |      dk(  r|S |d   t        |d         fS )z(
        TODO: Do we need this?
        rT  r   )r_   r   )r=   nvs     r(   	unquote_vzHmacV1Auth.unquote_v  s+     r7a<IqE72a5>**r*   c                    ||}n|j                   }|j                  r|j                  j                  d      }|D cg c]  }|j                  dd       }}|D cg c]%  }|d   | j                  v s| j	                  |      ' }}t        |      dkD  rR|j                  t        d             |D cg c]  }dj                  |       }}|dz  }|dj                  |      z  }|S c c}w c c}w c c}w )Nr[   rZ   rT  r   )rs   ?)	r^   r   ro   QSAOfInterestr  r_   sortr   rh   )r=   ro   	auth_pathbufqsaas         r(   canonical_resourcezHmacV1Auth.canonical_resource  s      C**C;;++##C(C,/0q1773?0C0+.&'!A$$:L:L2Lq!C  3x!|Z]+,/0qsxx{00s
sxx}$
 1
 1s   C*C/3C/5C4c                     |j                         dz   }|| j                  |      dz   z  }| j                  |      }|r||dz   z  }|| j                  ||      z  }|S )NrS   r  )r   r  r  r  )r=   r`   ro   r   rJ  r  csr  s           r(   canonical_stringzHmacV1Auth.canonical_string  so     \\^d"
d--g6==66w?.4''B
d%%ey%AA	r*   c                     | j                   j                  r|d= | j                   j                  |d<   | j                  ||||      }t        j	                  d|       | j                  |      S )Nr{  r  r  )rN   r   r  r\   r]   r  )r=   r`   ro   r   rJ  r  rp   s          r(   get_signaturezHmacV1Auth.get_signature  ss     !!./.2.>.>.D.DG*+..E7i / 
 	(.9//r*   c                 F   | j                   t        t        j                  d       t	        |j
                        }t        j                  d|j                         | j                  |j                  ||j                  |j                        }| j                  ||       y )Nz(Calculating signature using hmacv1 auth.zHTTP request method: %sr  )rN   r   r\   r]   r   r$   r`   r  r   r  _inject_signature)r=   r5   ro   r   s       r(   r:   zHmacV1Auth.add_auth  s    #$$?@%.?&&NNE7??g>O>O ' 
	 	w	2r*   c                     t        d      S )NTr   r   r=   s    r(   r  zHmacV1Auth._get_date  s    &&r*   c                     d|j                   v r|j                   d= d| j                  j                   d| }||j                   d<   y )Nr  zAWS r   )r   rN   r   )r=   r5   r   auth_headers       r(   r  zHmacV1Auth._inject_signature  sI    goo- 0T--8899+F+6(r*   )NNrG   )r>   r?   r@   r  rI   r  r  r  r  r  r  r  r:   r  r  rC   r*   r(   r~  r~  W  sN    %MN'F"+6 ?C	 ?C
0	3'7r*   r~  c                   *    e Zd ZdZdZefdZd Zd Zy)HmacV1QueryAuthz
    Generates a presigned request for s3.

    Spec from this document:

    http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
    #RESTAuthenticationQueryStringAuth

    ro  c                      || _         || _        y rG   )rN   rM  )r=   rN   rJ  s      r(   rI   zHmacV1QueryAuth.__init__  s    &r*   c                 z    t        t        t        j                         t        | j                        z               S rG   )r4   r  r   rM  r  s    r(   r  zHmacV1QueryAuth._get_date  s&    3tyy{S%77899r*   c                    i }| j                   j                  |d<   ||d<   |j                  D ]R  }|j                         }|dk(  r|j                  d   |d<   +|j	                  d      s|dv sA|j                  |   ||<   T t        |      }t        |j                        }|d   r
|d    d| }|d	   |d
   |d   ||d   f}t        |      |_        y )Nr{   rV   r   Expiresr  )r  rO     r[   r   rT  rU  rV  )	rN   r   r   r   r   r   r   r$   r   )	r=   r5   r   r]  
header_keyr  r_  r`  ra  s	            r(   r  z!HmacV1QueryAuth._inject_signature  s    
'+'7'7'B'B
#$"+
;!// 	5J!!#B V#(/(?
9% x(B 3 - ")!4
2	5  3:> W[[!Q4 #$A$q)9(:;1qtQqT+;QqTB /r*   N)r>   r?   r@   r   rl  rI   r  r  rC   r*   r(   r  r     s      O,;  :0r*   r  c                       e Zd ZdZd Zy)HmacV1PostAuthz
    Generates a presigned post for s3.

    Spec from this document:

    http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingHTTPPOST.html
    c                    i }|j                   j                  dd       |j                   d   }i }g }|j                   j                  dd       &|j                   d   }|j                  dd       |d   }||d<   | j                  j                  |d<   | j                  j                  @| j                  j                  |d<   |j                  d| j                  j                  i       t        j                  t        j                  |      j                  d            j                  d      |d<   | j                  |d         |d<   ||j                   d<   ||j                   d<   y )	Nr;  r<  r=  r{   r{  r-   rB  r   )r   r"   rN   r   r   rg   rj   rk   r1   rE  re   r3   r  )r=   r5   rG  rB  r=  s        r(   r:   zHmacV1PostAuth.add_auth>  sX   ??7>J__%=>F
??7>J__%=>Fzz,-9#L1
)|#'#3#3#>#> !!--1-=-=-C-CF)*5t7G7G7M7MNO "++JJv%%g.

&/ 	x #..vh/?@{4:014:01r*   Nr|  rC   r*   r(   r  r  5  s    ;r*   r  c                       e Zd ZdZd Zy)
BearerAuthz
    Performs bearer token authorization by placing the bearer token in the
    Authorization header as specified by Section 2.1 of RFC 6750.

    https://datatracker.ietf.org/doc/html/rfc6750#section-2.1
    c                     | j                   
t               d| j                   j                   }d|j                  v r|j                  d= ||j                  d<   y )NzBearer r  )rH   r   r   r   )r=   r5   r  s      r(   r:   zBearerAuth.add_authe  sR    ??""$$ 5 567goo-0+6(r*   Nr|  rC   r*   r(   r  r  ]  s    7r*   r  )v2v3v3httpsr$  zs3-queryzs3-presign-postzs3v4-presign-postzv4-s3expresszv4-s3express-queryzv4-s3express-presign-postbearer)CRT_AUTH_TYPE_MAPS)v4zv4-querys3v4z
s3v4-query)Crj   r  r	  r   rb   r1   r  r   collections.abcr   email.utilsr   hashlibr   r   operatorr   botocore.compatr	   r
   r   r   r   r   r   r   r   botocore.exceptionsr   r   botocore.utilsr   r   r   r   	getLoggerr>   r\   r   r   r   r  r   r   r   r)   r6   r8   rE   rK   r   r   r  r1  r9  rI  rn  ru  ry  r~  r  r  r  AUTH_TYPE_MAPSbotocore.crt.authr  ri   rC   r*   r(   <module>r     s           # "   
 
 
 E  * 
		8	$ G  
" 
 & %I "&
. .%* %:
 :z<
 <8JI
 JIZ3) 3l8K 8**; *;Ze  e PN9Y N9b ~  0-;i -;`f7 f7R20j 20j%;Z %;P7 7& 

%(!,!2 4,-&*		
r*   