
    e<                     n   d Z ddlZddlZddlZddlmZmZmZmZm	Z	m
Z
mZmZmZ ddlmZ ddlZddlmZmZmZmZ ddlmZ ddlmZ  G d d	      Z G d
 dej2                        Z G d dej2                        Z G d dej2                        Z G d d      Zedk(  r eejA                                yy)zJSON Web Signature.    N)	AnyDict	FrozenSetListMappingOptionalTupleTypecast)crypto)b64errors	json_utiljwa)jwk)utilc                   J    e Zd ZdZdZ	 ededefd       Zededefd       Zy)	MediaTypez MediaType field encoder/decoder.zapplication/valuereturnc                 ^    d|vr(d|v rt        j                  d      | j                  |z   S |S )zDecoder./;zUnexpected semi-colon)r   DeserializationErrorPREFIXclsr   s     ,/usr/lib/python3/dist-packages/josepy/jws.pydecodezMediaType.decode   s9     ee|112IJJ::%%    c                 x    d|vr5|j                  | j                        sJ |t        | j                        d S |S )zEncoder.r   N)
startswithr   lenr   s     r   encodezMediaType.encode)   s?     e##CJJ///SZZ*++r    N)	__name__
__module____qualname____doc__r   classmethodstrr   r$    r    r   r   r      sO    *F23 3   3 3  r    r   c                      e Zd ZU dZ ej
                  dej                  j                  d      Z	e
ej                     ed<    ej
                  dd      Ze
e   ed<    ej
                  dej                  j                  d      Ze
ej                     ed<    ej
                  dd      Ze
e   ed<    ej
                  d	d      Ze
e   ed	<    ej
                  d
dd      Zeej.                  df   ed
<    ej
                  dej0                  d      Ze
e   ed<    ej
                  dej0                  d      Ze
e   ed<    ej
                  dej8                  ej:                  d      Ze
e   ed<    ej
                  dej8                  ej:                  d      Ze
e   ed<    ej
                  ddd      Z ee!df   ed<   e"eejF                  f   ed<   de"eejF                  f   fdZ$de!dd fdZ%de&j                  fdZ'e jP                  de!de!fd       Z ejR                  d        ZejP                  d        Zy) Headera6  JOSE Header.

    .. warning:: This class supports **only** Registered Header
        Parameter Names (as defined in section 4.1 of the
        protocol). If you need Public Header Parameter Names (4.2)
        or Private Header Parameter Names (4.3), you must subclass
        and override :meth:`from_json` and :meth:`to_partial_json`
        appropriately.

    .. warning:: This class does not support any extensions through
        the "crit" (Critical) Header Parameter (4.1.11) and as a
        conforming implementation, :meth:`from_json` treats its
        occurrence as an error. Please subclass if you seek for
        a different behaviour.

    :ivar x5tS256: "x5t#S256"
    :ivar str typ: MIME Media Type, inc. :const:`MediaType.PREFIX`.
    :ivar str cty: Content-Type, inc. :const:`MediaType.PREFIX`.

    algT)decoder	omitemptyjku)r0   r   kidx5ux5cr+   r0   default.x5tzx5t#S256x5tS256typ)encoderr/   r0   ctycrit_fieldsr   c           
          | j                   j                         D ci c]-  \  }}|j                  t        | |            s|t        | |      / c}}S c c}}w )z4Fields that would not be omitted in the JSON object.)r=   itemsomitgetattr)selfnamefields      r   not_omittedzHeader.not_omitted`   sT      $||113
e::gdD12 '$%%
 	
 
s   2Aotherc                 @   t        |t        |             s#t        dj                  t        |                  | j	                         }|j	                         }t        |      j                  |      rt        d      |j                  |        t        |       di |S )NzHeader cannot be added to: {0}z+Addition of overlapping headers not definedr+   )
isinstancetype	TypeErrorformatrE   setintersectionupdate)rB   rF   not_omitted_selfnot_omitted_others       r   __add__zHeader.__add__h   s    %d,<CCDKPQQ++-!--/ --.?@IJJ 12tDz-,--r    c                 \    | j                   t        j                  d      | j                   S )zFind key based on header.

        .. todo:: Supports only "jwk" header parameter lookup.

        :returns: (Public) key found in the header.
        :rtype: .JWK

        :raises josepy.errors.Error: if key could not be found

        zNo key found)r   r   ErrorrB   s    r   find_keyzHeader.find_keyu   s&     88,,~..xxr    unused_valuec                 ,    t        j                  d      )Nz("crit" is not supported, please subclass)r   r   )rV   s    r   r<   zHeader.crit   s    ))*TUUr    c           	          | D cg c]C  }t        j                  t        j                  t        j                  |j
                              E c}S c c}w N)base64	b64encoder   dump_certificateFILETYPE_ASN1wrapped)r   certs     r   r4   z
Header.x5c   sF     
 V44V5I5I4<<XY
 	
 
s   AAc                     	 t        d | D              S # t        j                  $ r}t        j                  |      d }~ww xY w)Nc           	   3      K   | ]N  }t        j                  t        j                  t        j                  t        j                  |                   P y wrY   )r   ComparableX509r   load_certificater]   rZ   	b64decode).0r_   s     r   	<genexpr>zHeader.x5c.<locals>.<genexpr>   sG        ##++F,@,@&BRBRSWBXYs   AA)tupler   rS   r   r   )r   errors     r   r4   z
Header.x5c   sJ    	5  "	   || 	5--e44	5s    A<AN)*r%   r&   r'   r(   r   rD   r   JWASignature	from_jsonr.   r   __annotations__r1   bytesjwk_modJWKr   r2   r*   r3   r4   r	   r   rb   decode_b64joser7   r8   r   r$   r   r9   r;   r<   r   r   FieldrE   rQ   josepyrU   r/   r:   r+   r    r   r-   r-   3   sn   * '6ioos''11T'C#""	#  +9??5DAC%A!0w{{,,"C'++	  )$?C#?*9??5DAC%A+:9??5DZ\+]Ct""C'	(]*9??5):R:R^bcC%c.yI44 GXe_   /yy''1A1AT C)	   /yy''1A1AT C)	  ,IOOFdBOD%S/O#y&''
T#y"67 
.S .X .&**  
\\V3 V3 V V
 	[[
 
 	[[	5 	5r    r-   c                       e Zd ZU dZeZeed<   dZ ej                  ddd      Z
eed<    ej                  dd e       ej                  	      Zeed<    ej                  d
ej                  ej                        Zeed
<   e
j$                  dedefd       Z
e
j&                  dedefd       Z
deddf fdZededeeef   fd       Zedededefd       Zddedeej8                     defdZed e       fdedej8                  dej@                  dede!dedd fd       Z"deeef   f fdZ#ede$eef   deeef   f fd       Z% xZ&S ) 	Signaturea  JWS Signature.

    :ivar combined: Combined Header (protected and unprotected,
        :class:`Header`).
    :ivar unicode protected: JWS protected header (Jose Base-64 decoded).
    :ivar header: JWS Unprotected Header (:class:`Header`).
    :ivar str signature: The signature.

    combined)rt   	protectedT r5   header)r0   r6   r/   	signature)r/   r:   r   r   c                 J    t        j                  | j                  d            S Nutf-8)r   encode_b64joser$   r   s    r   ru   zSignature.protected   s     ''W(=>>r    c                 J    t        j                  |       j                  d      S rz   )r   ro   r   r}   s    r   ru   zSignature.protected   s    ''.55g>>r    kwargsNc                 ~    d|vr| j                  |      }t        |   di | | j                  j                  J y )Nrt   r+   )_with_combinedsuper__init__rt   r.   )rB   r   	__class__s     r   r   zSignature.__init__   sA    V#((0F"6"}}  ,,,r    c                    d|vsJ |j                  d| j                  d   j                        }|j                  d| j                  d   j                        }|r|| j                  j	                  |      z   }n|}||d<   |S )Nrt   rw   ru   )getr=   r6   
header_cls
json_loads)r   r   rw   ru   rt   s        r   r   zSignature._with_combined   s~    '''Hckk(&;&C&CDJJ{CKK,D,L,LM	 9 9) DDHH%zr    payloadc                 |    t        j                  |j                  d            dz   t        j                  |      z   S )Nr{      .)r   r[   r$   )r   ru   r   s      r   _msgzSignature._msg   s/    }}Y--g67$>wAWWWr    keyc                 @   || j                   j                         n|}| j                   j                  st        j                  d      | j                   j                  j                  |j                  | j                  | j                  | j                  |            S )zvVerify.

        :param bytes payload: Payload to verify.
        :param JWK key: Key used for verification.

        z Not signature algorithm defined.)r   sigmsg)
rt   rU   r.   rq   rS   verifyr   rx   r   ru   )rB   r   r   
actual_keys       r   r   zSignature.verify   s{     >A[!7!7!9c
}}  ,,ABB}}  ''DNN		$..RY8Z ( 
 	
r    r.   include_jwkprotectc                 8   t        ||j                        sJ |}||d<   |r|j                         |d<   t        |      j	                  | j
                  j                        sJ |j	                  | j
                  j                        sJ i }|D ]  }	|	|v s|j                  |	      ||	<    |r! | j
                  di |j                         }
nd}
 | j
                  di |}	|j                  |j                  | j                  |
|            } | |
|	|      S )aD  Sign.

        :param bytes payload: Payload to sign.
        :param JWK key: Key for signature.
        :param JWASignature alg: Signature algorithm to use to sign.
        :param bool include_jwk: If True, insert the JWK inside the signature headers.
        :param FrozenSet protect: List of headers to protect.

        r.   r   rv   )ru   rw   rx   r+   )rH   kty
public_keyrL   issubsetr   r=   pop
json_dumpssignr   r   )r   r   r   r.   r   r   r   header_paramsprotected_paramsrw   ru   rx   s               r   r   zSignature.sign   s   & #sww'''"e#&>>#3M% =!**3>>+A+ABBB 6 6777 	EF&+8+<+<V+D (	E &:)9:EEGII0-0HHSWWchhy'&BC	YvKKr    c                 P    t         |          }|d   j                         s|d= |S )Nrw   )r   fields_to_partial_jsonrE   )rB   fieldsr   s     r   r   z Signature.fields_to_partial_json  s.    /1h++-x r    jobjc                     t         |   |      }| j                  |      }d|d   j                         vrt	        j
                  d      |S )Nr.   rt   zalg not present)r   fields_from_jsonr   rE   r   r   )r   r   r   fields_with_combinedr   s       r   r   zSignature.fields_from_json  sR    )$/"11&9,Z8DDFF--.?@@##r    rY   )'r%   r&   r'   r(   r-   r   rk   	__slots__r   rD   ru   r*   rj   rw   ro   r|   rx   rl   r:   r/   r   r   r)   r   r   r   r   rq   rn   boolr   	frozensetri   r   r   r   r   r   __classcell__)r   s   @r   rs   rs      s"    JI$Y__[D"MIsM$Y__D*,
@T@TFF  'yY55y?W?WIu  ? ? ? ? ? ? ? ?- - - C DcN   XS X5 XU X X
e 
(6::*> 
$ 
  !&[(L(L ZZ(L   	(L
 (L (L (L 
(L (LTS#X  $GCH$5 $$sCx. $ $r    rs   c                       e Zd ZU dZdZeed<   ee   ed<   eZ	dde
ej                     defdZeded	edd fd
       Zedefd       ZdefdZededd fd       Zddedeeef   fdZedeeef   dd fd       Zy)JWSzgJSON Web Signature.

    :ivar str payload: JWS Payload.
    :ivar str signature: JWS Signatures.

    r   
signaturesr   r   Nr   r   c                 D     t         fd j                  D              S )Verify.c              3   V   K   | ]   }|j                  j                         " y wrY   )r   r   )re   r   r   rB   s     r   rf   zJWS.verify.<locals>.<genexpr>.  s      LS3::dllC0Ls   &))allr   )rB   r   s   ``r   r   z
JWS.verify,  s    LDOOLLLr    r   c                 P     | | | j                   j                  dd|i|f      S )Sign.r   r   r+   )signature_clsr   )r   r   r   s      r   r   zJWS.sign0  s1     70F0A0A0F0F0aw0aZ`0a/cddr    c                 T    t        | j                        dk(  sJ | j                  d   S )zPGet a singleton signature.

        :rtype: :class:`JWS.signature_cls`

           r   )r#   r   rT   s    r   rx   zJWS.signature5  s*     4??#q(((q!!r    c                    t        | j                        dk(  sJ d| j                  j                  j	                         vsJ t        j                  | j                  j                  j                  d            dz   t        j                  | j                        z   dz   t        j                  | j                  j                        z   S )z7Compact serialization.

        :rtype: bytes

        r   r.   r{   r   )
r#   r   rx   rw   rE   r   r[   ru   r$   r   rT   s    r   
to_compactzJWS.to_compact?  s     4??#q(((DNN11==???? MM$..2299'BCmmDLL)*  mmDNN445	6	
r    compactc                 >   	 |j                  d      \  }}}| j	                  t        j                  |      j                  d      t        j                  |            } | t        j                  |      |f      S # t        $ r t        j                  d      w xY w)zACompact deserialization.

        :param bytes compact:

        r   zOCompact JWS serialization should comprise of exactly 3 dot-separated componentsr{   )ru   rx   r   )split
ValueErrorr   r   r   r   rd   r   )r   r   ru   r   rx   r   s         r   from_compactzJWS.from_compactR  s    	,3MM$,?)Iw	 mmI.55g>#--XaJb   
 3==1sfEE  	--d 	s   A= =Bflatc                     | j                   sJ t        j                  | j                        }|r<t	        | j                         dk(  r$| j                   d   j                         }||d<   |S || j                   dS )Nr   r   r   r   )r   r   r|   r   r#   to_partial_json)rB   r   r   rets       r   r   zJWS.to_partial_jsone  sp    **4<<8C(A-//!$446C$C	NJ #"oo r    r   c                     d|v rd|v rt        j                  d      d|v rc|j                         D ci c]  \  }}|dk7  s|| }}}  t        j                  |d          j
                  j                  |      f      S   t        j                  |d         t         fd|d   D                    S c c}}w )Nrx   r   zFlat mixed with non-flatr   r   c              3   T   K   | ]  }j                   j                  |       ! y wrY   )r   rj   )re   r   r   s     r   rf   z JWS.from_json.<locals>.<genexpr>  s"      `c!2!2!<!<S!A `s   %()r   r   r?   r   ro   r   rj   rg   )r   r   r   r   filtereds   `    r   rj   zJWS.from_jsons  s    $<4#7--.HIID 59ZZ\VzsESIEUU
VHV!00iA--77AC 
 !00iA  `TR^M_ ``  Ws   B;B;rY   )T)r%   r&   r'   r(   r   rl   rk   r   rs   r   r   rq   rn   r   r   r)   r   r   propertyrx   r   r   r   r*   r   r   rj   r+   r    r   r   r     s    *INYMM(6::. M$ M e5 eC eE e e "9 " "
E 
& F5 FU F F$D DcN  WS#X. 5  r    r   c                      e Zd ZdZedej                  ddfd       Zedej                  defd       Z	ede
dej                  fd       Zede
de
fd	       Zede
deej"                     fd
       Zeddeee      dee   fd       Zy)CLIzJWS CLI.argsr   Nc                    |j                   j                  j                  |j                  j	                               }|j                  j                          |j                  g |_        |j                  r|j                  j                  d       t        j                  t        j                  j	                         j                         ||j                   t        |j                              }|j                  r)t        |j!                         j#                  d             yt        |j%                                y)r   Nr.   )r   r   r.   r   r{   )r.   r   loadr   readcloser   r   appendr   r   sysstdinr$   rL   printr   r   json_dumps_pretty)r   r   r   r   s       r   r   zCLI.sign  s     hhll0<<DL<<LL&hhIINN$++-3DHHcRVR^R^N_  
 <<#.."))'23#'')*r    c                    |j                   r@t        j                  t        j                  j                         j                               }n@	 t        t        t        j                  t        j                  j                                     }|j                  j|j                  J |j                  j                  |j                  j                               j                         }|j                  j!                          nd}t        j"                  j%                  |j&                  j)                                |j+                  |       S # t        j                  $ r}t        |       Y d}~yd}~ww xY w)r   NF)r   )r   r   r   r   r   r   r$   r   r   r   rS   r   r   r   r   r   r   stdoutwriter   r   r   )r   r   r   rh   r   s        r   r   z
CLI.verify  s     <<""399>>#3#:#:#<=C3syy~~/? @A
 8888'''((--0;;=CHHNNC

++-.::#:&&& << es   ?E E7"E22E7argc                 @    t         j                  j                  |      S rY   )r   ri   rj   r   r   s     r   	_alg_typezCLI._alg_type  s    ))#..r    c                 B    |t         j                  j                  v sJ |S rY   )rs   r   r=   r   s     r   _header_typezCLI._header_type  s!    i**22222
r    c                 x    |t         j                  j                  v sJ t         j                  j                  |   S rY   )rm   rn   TYPESr   s     r   	_kty_typezCLI._kty_type  s/    gkk'''''{{  %%r    c                    |t         j                  dd }t        j                         }|j	                  dd       |j                         }|j                  d      }|j                  | j                         |j	                  dd	t        j                  d
      d       |j	                  dd| j                  t        j                         |j	                  ddd| j                         |j                  d      }|j                  | j                         |j	                  dd	t        j                  d
      d       |j	                  d| j                  d       |j!                  |      }|j#                  |      S )z Parse arguments and sign/verify.Nr   z	--compact
store_true)actionr   )funcz-kz--keyrbT)rI   requiredz-az--alg)rI   r6   z-pz	--protectr   )r   rI   r   Fz--kty)r   argvargparseArgumentParseradd_argumentadd_subparsers
add_parserset_defaultsr   FileTyper   r   RS256r   r   r   
parse_argsr   )r   r   parser
subparsersparser_signparser_verifyparseds          r   runzCLI.run  sK    <88AB<D((*K=**,
 ++F3  chh /  wX5F5Ft5LW[ \  wS]]CII V  {8#JZJZ ["--h7""

"3""4x7H7H7NY^"_""7"O""4({{6""r    rY   )r%   r&   r'   r(   r)   r   	Namespacer   r   r   r   r   ri   r   r   r
   rm   rn   r   r   r   r*   r   r+   r    r   r   r     s    +** +t + +$ '(,, ' ' '* /C /C$4$4 / / s s   &C &D$5 & & #xS	* #htn # #r    r   __main__)!r(   r   rZ   r   typingr   r   r   r   r   r   r	   r
   r   OpenSSLr   rq   r   r   r   r   r   rm   r   r   JSONObjectWithFieldsr-   rs   r   r   r%   exitr   r+   r    r   <module>r      s       

 
 
   . . !  4h5Y++ h5V}$	.. }$@c)
(
( cLO# O#d zO r    