
     h)V                        d dl Z d dlZd dlmZ d dlmZmZmZmZm	Z	m
Z
 d dlmZ d dlmZ ddlmZmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZ  G d de j                  Z G d dee j                  Z G d de          Zee
ej        ef                  Z  G d d          Z! G d de!          Z" G d de          Z# G d d          Z$ G d d          Z% G d d          Z& G d dee                   Z' G d  d!e          Z(dS )"    N)defaultdict)AsyncGeneratorIterableIteratorListOptionalUnion)x509)
trust_list   )CertTrustAnchorTrustAnchor)PathBuildingError)CertificateFetcher)ValidationPath)CancelableAsyncIteratorConsListc                   F    e Zd ZdZdefdZdefdZdej        fdZ	d Z
dS )	CertificateCollectionzS
    Abstract base class for read-only access to a collection of certificates.
    key_identifierc                 D    |                      |          }|sdS |d         S )z
        Retrieves a cert via its key identifier

        :param key_identifier:
            A byte string of the key identifier

        :return:
            None or an asn1crypto.x509.Certificate object
        Nr   )retrieve_many_by_key_identifier)selfr   
candidatess      Z/var/www/html/Sam_Eipo/venv/lib/python3.11/site-packages/pyhanko_certvalidator/registry.pyretrieve_by_key_identifierz0CertificateCollection.retrieve_by_key_identifier   s.     99.II
 	!4a=     c                     t           )z
        Retrieves possibly multiple certs via the corresponding key identifiers

        :param key_identifier:
            A byte string of the key identifier

        :return:
            A list of asn1crypto.x509.Certificate objects
        NotImplementedErrorr   r   s     r   r   z5CertificateCollection.retrieve_many_by_key_identifier'   
     "!r   namec                     t           )z
        Retrieves a list certs via their subject name

        :param name:
            An asn1crypto.x509.Name object

        :return:
            A list of asn1crypto.x509.Certificate objects
        r   r   r#   s     r   retrieve_by_namez&CertificateCollection.retrieve_by_name3   r"   r   c                     t           )a]  
        Retrieve a certificate by its ``issuer_serial`` value.

        :param issuer_serial:
            The ``issuer_serial`` value of the certificate.
        :return:
            The certificate corresponding to the ``issuer_serial`` key
            passed in.
        :return:
            None or an asn1crypto.x509.Certificate object
        r   r   issuer_serials     r   retrieve_by_issuer_serialz/CertificateCollection.retrieve_by_issuer_serial?   
     "!r   N)__name__
__module____qualname____doc__bytesr   r   r
   Namer&   r*    r   r   r   r      s         ! ! ! ! ! 
"e 
" 
" 
" 
"
"TY 
" 
" 
" 
"" " " " "r   r   c                   P    e Zd Zdej        defdZdeej                 fdZd Z	dS )CertificateStorecertreturnc                     t           )
        Register a single certificate.

        :param cert:
            Certificate to add.
        :return:
            ``True`` if the certificate was added, ``False`` if it already
            existed in this store.
        r   r   r5   s     r   registerzCertificateStore.registerO   r"   r   certsc                 D    d}|D ]}||                      |          z  }|S )a  
        Register multiple certificates.

        :param certs:
            Certificates to register.
        :return:
            ``True`` if at least one certificate was added, ``False``
            if all certificates already existed in this store.
        Fr:   )r   r;   addedr5   s       r   register_multiplez"CertificateStore.register_multiple[   s5      	) 	)DT]]4(((EEr   c                     t           Nr   r   s    r   __iter__zCertificateStore.__iter__k   s    !!r   N)
r,   r-   r.   r
   Certificateboolr:   r   r?   rC   r2   r   r   r4   r4   N   sk        
"T- 
"$ 
" 
" 
" 
"x0@'A     " " " " "r   r4   c                   |    e Zd ZdZed             Zd Zdej        de	fdZ
d Zd Zd	efd
Zdej        fdZd ZdS )SimpleCertificateStorez-
    Simple trustless certificate store.
    c                 N     |             }|D ]}|                     |           |S rA   r=   )clsr;   resultr5   s       r   
from_certsz!SimpleCertificateStore.from_certst   s6     	" 	"DOOD!!!!r   c                 x    i | _         t          t                    | _        t          t                    | _        d S rA   )r;   r   list_subject_map_key_identifier_maprB   s    r   __init__zSimpleCertificateStore.__init__{   s/    
'--#.t#4#4   r   r5   r6   c                 F   |j         | j        v rdS || j        |j         <   | j        |j        j                                     |           |j        r&| j        |j                                     |           n*| j        |j        j	                                     |           dS )r8   FT)
r)   r;   rN   subjecthashableappendr   rO   
public_keysha1r9   s     r   r:   zSimpleCertificateStore.register   s     ++5)-
4%&$,/077=== 	H$T%89@@FFFF$T_%9:AA$GGGtr   c                     | j         |         S rA   )r;   )r   items     r   __getitem__z"SimpleCertificateStore.__getitem__   s    z$r   c                 N    t          | j                                                  S rA   )iterr;   valuesrB   s    r   rC   zSimpleCertificateStore.__iter__   s    DJ%%''(((r   r   c                     | j         |         S rA   )rO   r!   s     r   r   z6SimpleCertificateStore.retrieve_many_by_key_identifier   s    '77r   r#   c                 &    | j         |j                 S rA   )rN   rS   r%   s     r   r&   z'SimpleCertificateStore.retrieve_by_name   s     //r   c                 6    	 | |         S # t           $ r Y d S w xY wrA   )KeyErrorr(   s     r   r*   z0SimpleCertificateStore.retrieve_by_issuer_serial   s4    	&& 	 	 	44	s   
 
N)r,   r-   r.   r/   classmethodrK   rP   r
   rD   rE   r:   rY   rC   r0   r   r1   r&   r*   r2   r   r   rG   rG   o   s            [5 5 5
T- $    (     ) ) )8e 8 8 8 80TY 0 0 0 0    r   rG   c                   R    e Zd ZdZdej        defdZdej        dee	         fdZ
dS )TrustManagerz%
    Abstract trust manager API.
    r5   r6   c                     t           z
        Checks if a certificate is in the list of trust roots in this registry

        :param cert:
            An asn1crypto.x509.Certificate object

        :return:
            A boolean - if the certificate is in the CA list
        r   r9   s     r   is_rootzTrustManager.is_root   r"   r   c                     t           )z
        Find potential issuers that might have (directly) issued
        a particular certificate.

        :param cert:
            Issued certificate.
        :return:
            An iterator with potentially relevant trust anchors.
        r   r9   s     r   find_potential_issuersz#TrustManager.find_potential_issuers   r+   r   N)r,   r-   r.   r/   r
   rD   rE   rf   r   r   rh   r2   r   r   rc   rc      so         
"D, 
" 
" 
" 
" 
""$"	+	" " " " " "r   rc   c                       e Zd ZdZd Ze	 	 ddee         dee         dd fd            Zde	e
ej        f         fd	Zd
ej        fdZdeej                 fdZd
ej        dee
         fdZdS )SimpleTrustManagerzk
    Trust manager backed by a list of trust roots, possibly in addition to the
    system trust list.
    c                 ^    t                      | _        t          t                    | _        d S rA   )set_rootsr   rM   _root_subject_maprB   s    r   rP   zSimpleTrustManager.__init__   s#    ee!,T!2!2r   Ntrust_rootsextra_trust_rootsr6   c                     |d t          j                    D             }nt          |          }||                    |           t	                      }|D ]}|                    |           |S )a  
        :param trust_roots:
            If the operating system's trust list should not be used, instead
            pass a list of asn1crypto.x509.Certificate objects. These
            certificates will be used as the trust roots for the path being
            built.

        :param extra_trust_roots:
            If the operating system's trust list should be used, but augmented
            with one or more extra certificates. This should be a list of
            asn1crypto.x509.Certificate objects.
        :return:
        Nc                     g | ]
}|d          S )r   r2   ).0es     r   
<listcomp>z,SimpleTrustManager.build.<locals>.<listcomp>   s    ???A1Q4???r   )r   get_listrM   extendrj   _register_root)rI   ro   rp   manager
trust_roots        r   buildzSimpleTrustManager.build   s    & ??)<)>)>???KK{++K(0111$&&% 	/ 	/J"":....r   rz   c                     t          |t                    r|}nt          |          }|| j        vrM|j        }| j                            |           | j        |j        j                 	                    |           d S d S rA   )

isinstancer   r   rm   	authorityaddrn   r#   rS   rT   )r   rz   anchorr~   s       r   rx   z!SimpleTrustManager._register_root   s    j+.. 	1FF$Z00F$$(IKOOF###"9>#:;BB6JJJJJ %$r   r5   c                 .    t          |          | j        v S re   )r   rm   r9   s     r   rf   zSimpleTrustManager.is_root   s     t$$33r   c                 $    d | j         D             S )Nc              3   N   K   | ] }t          |t                    |j        V  !d S rA   )r}   r   certificate)rs   roots     r   	<genexpr>z0SimpleTrustManager.iter_certs.<locals>.<genexpr>  sI       
 
$00

 
 
 
 
 
r   )rm   rB   s    r   
iter_certszSimpleTrustManager.iter_certs  s%    
 

 
 
 	
r   c              #   ~   K   |j         j        }| j        |         D ] }|j                            |          r|V  !d S rA   )issuerrS   rn   r~   is_potential_issuer_of)r   r5   issuer_hashabler   s       r   rh   z)SimpleTrustManager.find_potential_issuers  sU       +.*?; 	 	D~44T:: 


	 	r   )NN)r,   r-   r.   r/   rP   ra   r   TrustRootListr{   r	   r   r
   rD   rx   rf   r   r   rh   r2   r   r   rj   rj      s        
3 3 3  0459 m, $M2 
	   [>K{D<L/L)M K K K K4D, 4 4 4 4
HT%56 
 
 
 
$	+	     r   rj   c            	           e Zd ZdZdddee         f fdZe	 ddddee	j
                 dee         fd            Z	 dd	e	j        d
ee	j
                 f fdZde	j
        dedeeee	j
        f                  fdZde	j
        fdZ xZS )CertificateRegistryz
    Contains certificate lists used to build validation paths, and
    is also capable of fetching missing certificates if a certificate
    fetcher is supplied.
    Ncert_fetcherr   c                V    t                                                       || _        d S rA   )superrP   fetcher)r   r   	__class__s     r   rP   zCertificateRegistry.__init__#  s$    #r   r2   r;   c                `     | |          }|D ]}|                     |           ||_        |S )a  
        Convenience method to set up a certificate registry and import
        certs into it.

        :param certs:
            Initial list of certificates to import.
        :param cert_fetcher:
            Certificate fetcher to handle retrieval of missing certificates
            (in situations where that is possible).
        :return:
            A populated certificate registry.
        r   )r:   r   )rI   r;   r   rJ   r5   s        r   r{   zCertificateRegistry.build'  sF    ( '*c|&D&D&D 	" 	"DOOD!!!!%r   r#   first_certificatec                     g }d}t                                          |          D ],}|r|j        |j        k    r|}|                    |           -|r|                    d|           |S )af  
        Retrieves a list certs via their subject name

        :param name:
            An asn1crypto.x509.Name object

        :param first_certificate:
            An asn1crypto.x509.Certificate object that if found, should be
            placed first in the result list

        :return:
            A list of asn1crypto.x509.Certificate objects
        Nr   )r   r&   sha256rT   insert)r   r#   r   outputfirstr5   r   s         r   r&   z$CertificateRegistry.retrieve_by_nameB  s    & GG,,T22 	$ 	$D  $%6%=%L%Ld#### 	$MM!U###r   r5   trust_managerr6   c              #     K   |j         j        }|                    |          E d {V  | j        |         D ]T}|                    |          r|j        r|j        r|j        |j        k    r7n|j        r|j        |j        k    rP|V  Ud S rA   )	r   rS   rh   rN   rf   authority_key_identifierr   authority_issuer_serialr)   )r   r5   r   r   r   s        r   rh   z*CertificateRegistry.find_potential_issuers`  s       +. !77========='8 
	 
	F$$V,, , 1F 0F4III J- /63GGGLLLL
	 
	r   c                   K   | j         d S | j                             |          2 3 d {V }|                     |           |W V  "6 d S rA   )r   fetch_cert_issuersr:   )r   r5   r   s      r   fetch_missing_potential_issuersz3CertificateRegistry.fetch_missing_potential_issuersx  sv      <F L;;DAA 	 	 	 	 	 	 	&MM&!!!LLLLL BAAs   A)r2   rA   )r,   r-   r.   r/   r   r   rP   ra   r   r
   rD   r{   r1   r&   rc   r   r	   r   rh   r   __classcell__)r   s   @r   r   r     sa         HL $ $ $1C(D $ $ $ $ $ $  -/ 6:	  () 12	   [: 9= i $D$45     <$5A	%T%556	7   0$:J        r   r   c                   d    e Zd ZdZdedefdZd Zdej	        fdZ
dej	        dee         fd	Zd
S )PathBuilderz(
    Class to handle path building.
    r   registryc                 "    || _         || _        d S rA   )r   r   )r   r   r   s      r   rP   zPathBuilder.__init__  s     + r   c                 P    t          j        |                     |                    S )a  
        Builds a list of ValidationPath objects from a certificate in the
        operating system trust store to the end-entity certificate

        .. note::
            This is a synchronous equivalent of :meth:`async_build_paths`
            that calls the latter in a new event loop. As such, it can't be used
            from within asynchronous code.

        :param end_entity_cert:
            A byte string of a DER or PEM-encoded X.509 certificate, or an
            instance of asn1crypto.x509.Certificate

        :return:
            A list of pyhanko_certvalidator.path.ValidationPath objects that
            represent the possible paths from the end-entity certificate to one
            of the CA certs.
        )asynciorunasync_build_paths)r   end_entity_certs     r   build_pathszPathBuilder.build_paths  s"    & {411/BBCCCr   r   c                 t   K   g }|                      |          2 3 d{V }|                    |           6 |S )a1  
        Builds a list of ValidationPath objects from a certificate in the
        operating system trust store to the end-entity certificate, returning
        all paths in a single list.

        :param end_entity_cert:
            A byte string of a DER or PEM-encoded X.509 certificate, or an
            instance of asn1crypto.x509.Certificate

        :return:
            A list of pyhanko_certvalidator.path.ValidationPath objects that
            represent the possible paths from the end-entity certificate to one
            of the CA certs.
        N)async_build_paths_lazyrT   )r   r   pathsrJ   s       r   r   zPathBuilder.async_build_paths  se        ') 77HH 	! 	! 	! 	! 	! 	! 	!&LL     I s   7r6   c                     t          | t          j        |          t          j        |j                  g           }t	          ||          S )a  
        Builds a list of ValidationPath objects from a certificate in the
        operating system trust store to the end-entity certificate, and emit
        them as an asynchronous generator.

        :param end_entity_cert:
            A byte string of a DER or PEM-encoded X.509 certificate, or an
            instance of asn1crypto.x509.Certificate

        :return:
            An asynchronous iterator that yields
            pyhanko_certvalidator.path.ValidationPath objects that
            represent the possible paths from the end-entity certificate to one
            of the CA certs, and raises PathBuildingError
            if no paths could be built
        )path
certs_seenfailed_paths)_PathWalkerr   singr)   LazyPathIterator)r   r   walkers      r   r   z"PathBuilder.async_build_paths_lazy  sM    ( //}_%BCC	
 
 
  888r   N)r,   r-   r.   r/   rc   r   rP   r   r
   rD   r   r   r   r   r2   r   r   r   r     s         !)!5H! ! ! !D D D*t7G    ,9#/9	 	09 9 9 9 9 9r   r   c                       e Zd Zdddej        dee         fdZed             Z	d Z
d Zd	eeej        f         fd
Zd	eeej        f         fdZd ZdS )_IssuerFetcherpath_builderr   r5   r   c                     || _         || _        || _        | j        j                            || j        j                  }t          |          | _        d| _        d| _	        d | _
        d| _        d S )Nr   F)r5   r   r   r   rh   r   r[   local_iss_iterlocal_issuers_foundfetched_issuers_found_fetched_cas_fetching_done)r   r   r5   r   local_issuerss        r   rP   z_IssuerFetcher.__init__  s     	($)2II$#1
 
 #=11#$ %&"  	 $r   c                      | j         | j        z   S rA   )r   r   rB   s    r   issuers_foundz_IssuerFetcher.issuers_found  s    '$*DDDr   c                     | S rA   r2   rB   s    r   	__aiter__z_IssuerFetcher.__aiter__      r   c                     | S rA   r2   rB   s    r   rC   z_IssuerFetcher.__iter__  r   r   r6   c                     | j         D ]@}t          |t          j                  r|j        }|| j        v r-| xj        dz  c_        |c S t          )Nr   )r   r}   r
   rD   r)   r   r   StopIterationr   r   cert_ids      r   __next__z_IssuerFetcher.__next__  sd    ) 	 	F&$"233  .do--$$)$$MMMr   c                 T  K   	 t          |           S # t          $ r Y nw xY w| j        7| j        s0| j        s)| j        j                            | j                  | _        | j        ;| j        2 3 d {V }|j	        }|| j
        v r| xj        dz  c_        |c S 6 d| _        t          )Nr   T)nextr   r   r   r   r   r   r   r5   r)   r   r   StopAsyncIterationr   s      r   	__anext__z_IssuerFetcher.__anext__  s      	:: 	 	 	D	 %, &' & !*JJI   ( $ 1       f .do--**a/** !2 #'D  s    
  /Bc                 v   K   | j         /| j                                          d {V  d | _         d| _        d S d S )NT)r   acloser   rB   s    r   cancelz_IssuerFetcher.cancel  sT      (#**,,,,,,,,, $D"&D )(r   N)r,   r-   r.   r
   rD   r   r0   rP   propertyr   r   rC   r	   r   r   r   r   r2   r   r   r   r     s        $#$ $ UO	$ $ $ $( E E XE    %T-= =>    !{D4D'D!E ! ! ! !8' ' ' ' 'r   r   c            
       |    e Zd Zdddeej                 dee         deeej                          fdZd Z	d Z
d	 Zd
S )r   r   r   r   r   r   c                     || _         || _        || _        |j        }t	          |t
          j                  sJ t          |||          | _        || _	        d | _
        d S rA   )r   r   r   headr}   r
   rD   r   _issuer_fetcherr   _next_level)r   r   r   r   r   r5   s         r   rP   z_PathWalker.__init__"  sd     	($y$ 011111-lD*MM(26r   c                    K   | j         &| j                                          d {V  d | _         | j        (| j                                         d {V  d | _        d S d S rA   )r   r   r   rB   s    r   r   z_PathWalker.cancel2  s      +&--/////////#'D '"))+++++++++#D ('r   c                     | S rA   r2   rB   s    r   r   z_PathWalker.__aiter__:  r   r   c                   K   | j         t          d }|H| j        	 | j                                          d {V }nF# t          $ r9}| j         j        s| j                            | j                   d | _         |d }~ww xY wt          |t                    r3t          | j                  }t          ||d d         |d                   S t          | j        | j                            |          | j                            |j                  | j                  | _        	 | j                                         d {V }n# t          $ r
 d | _        Y nw xY w|H|S )N)r   r   r   r   r   r   rT   r   r}   r   rM   r   r   r   consr   r)   )r   	next_pathnext_issuerrt   r;   s        r   r   z_PathWalker.__anext__=  s     '$$	'(,(<(F(F(H(H"H"H"H"H"H"HKK)   /= <)00;;;+/D(G	
 k;77  OOE)+uSbSz59MMM (3)	{33,,[-FGG)	( (D$("&"2"<"<">">>>>>>>		% ( ( (#'   (5 8 s'   ? 
B	4A==B$E EEN)r,   r-   r.   r   r
   rD   r0   r   rP   r   r   r   r2   r   r   r   r   !  s        7#7 t'(7 UO	7
 8D$4567 7 7 7 $ $ $           r   r   c                   \    e Zd ZU dZee         ed<   dedej	        fdZ
d Zd Zdefd	ZdS )
r   N_as_rootr   r5   c                     |j         j                            |          r#t          t	          |          g d           | _        || _        d| _        |j        j	        | _
        d S )Nr   )r   r   rf   r   r   r   _walkeremitted_countrR   human_friendly_name)r   r   r5   s      r   rP   zLazyPathIterator.__init__c  sY    ,44T:: 	L*?4+@+@"dKKDM.4\0


r   c                 Z   K   | j         !| j                                          d {V  d S d S rA   )r   r   rB   s    r   r   zLazyPathIterator.cancelk  sB      <#,%%''''''''''' $#r   c                     | S rA   r2   rB   s    r   r   zLazyPathIterator.__aiter__o  r   r   r6   c                   K   | j         t          | j        | xj        dz  c_        d | _         | j        S 	 | j                                          d {V }| xj        dz  c_        |S # t          $ r Y nw xY w| j        dk    ra| j         j        d         j        }t          |t          j	                  sJ |j
        j        }d | _         t          d| j         d| d          t          )Nr   r   z7Unable to build a validation path for the certificate "z" - no issuer matching "z" was found)r   r   r   r   r   r   r   r}   r
   rD   r   r   r   r   )r   r   	path_headmissing_issuer_names       r   r   zLazyPathIterator.__anext__r  s1     <$$]&!#DL= 	"l4466666666I!#! 	 	 	D	 ""1!49Ii)9:::::"+"2"ADL#7Z7 7(7 7 7  
 ! s   0A( (
A54A5)r,   r-   r.   r   r   r   __annotations__r   r
   rD   rP   r   r   r   r2   r   r   r   r   `  s         )-Hh~&---1{ 1$2B 1 1 1 1( ( (  ! ! ! ! ! ! !r   r   c                   R    e Zd ZdZdee         fdZdefdZde	j
        fdZd Zd	S )
LayeredCertificateStorezi
    Trustless certificate store that looks up certificates in other stores
    in a specific order.
    storesc                     || _         d S rA   )_stores)r   r   s     r   rP   z LayeredCertificateStore.__init__  s    r   r   c                 @      fd}t           |                      S )Nc               3   V   K   j         D ]} |                               E d {V  d S rA   )r   r   )storer   r   s    r   _genzELayeredCertificateStore.retrieve_many_by_key_identifier.<locals>._gen  sO       Q Q @@PPPPPPPPPPQ Qr   rM   )r   r   r   s   `` r   r   z7LayeredCertificateStore.retrieve_many_by_key_identifier  s<    	Q 	Q 	Q 	Q 	Q 	Q DDFF||r   r#   c                 @      fd}t           |                      S )Nc               3   V   K   j         D ]} |                               E d {V  d S rA   )r   r&   )r   r#   r   s    r   r   z6LayeredCertificateStore.retrieve_by_name.<locals>._gen  sK       8 8 11$77777777778 8r   r   )r   r#   r   s   `` r   r&   z(LayeredCertificateStore.retrieve_by_name  s6    	8 	8 	8 	8 	8 	8 DDFF||r   c                 P    | j         D ]}|                    |          }||c S d S rA   )r   r*   )r   r)   r   rJ   s       r   r*   z1LayeredCertificateStore.retrieve_by_issuer_serial  s?    \ 	 	E44]CCF! "tr   N)r,   r-   r.   r/   r   r   rP   r0   r   r
   r1   r&   r*   r2   r   r   r   r     s         
t$9:    e    TY        r   r   ))abcr   collectionsr   typingr   r   r   r   r   r	   
asn1cryptor
   oscryptor   r~   r   r   errorsr   fetchersr   r   r   utilr   r   ABCr   r4   rG   rD   r   rc   rj   r   r   r   r   r   r   r2   r   r   <module>r     s   


  # # # # # # L L L L L L L L L L L L L L L L             3 3 3 3 3 3 3 3 % % % % % % ( ( ( ( ( (             3 3 3 3 3 3 3 39" 9" 9" 9" 9"CG 9" 9" 9"x" " " " ",cg " " "B5 5 5 5 5- 5 5 5p t/<=>" " " " " " " "@O O O O O O O Odc c c c c0 c c cLP9 P9 P9 P9 P9 P9 P9 P9fI' I' I' I' I' I' I' I'X< < < < < < < <~+! +! +! +! +!.~> +! +! +!\    3     r   