
    .
0hM                        d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
ZddlZddlZddlmZ ddlmZ dd	lmZ d
ZdZdZdZ e ej        d                                                    Z e ej        d                                                    Z e ej        d                                                    ZdZ eg d          ZdZdZ dZ!dZ" G d dej#        j$        j%                  Z& G d d          Z' G d d          Z( G d  d!e	j)                  Z* G d" d#          Z+ G d$ d%          Z, G d& d'ej-                  Z. G d( d)ej-                  Z/ G d* d+ej0                  Z1 G d, d-ej0                  Z2 G d. d/ej3                  Z4 G d0 d1e4          Z5 G d2 d3e4          Z6dS )4z1Firebase token minting and validation sub module.    N)credentials)iam)jwt)	transport)
exceptions)_auth_utils)_http_clientzhttps://securetoken.google.com/zXhttps://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.comz$https://session.firebase.google.com/zEhttps://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys   )minutes   )days   )hourszYhttps://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit)acramrat_hashaud	auth_timeazpcnfc_hashexpfirebaseiatissjtinbfnoncesubzZhttp://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/emailRS256nonez"firebase-auth-emulator@example.comc                       e Zd ZdZd Zd ZdS )_EmulatedSignerNc                     d S N selfs    T/var/www/html/nourish/venv/lib/python3.11/site-packages/firebase_admin/_token_gen.py__init__z_EmulatedSigner.__init__B   s        c                     dS )Nr+   r&   r(   messages     r)   signz_EmulatedSigner.signE   s    sr+   )__name__
__module____qualname__key_idr*   r/   r&   r+   r)   r#   r#   ?   s7        F      r+   r#   c                       e Zd ZdZefdZed             Zed             Zed             Z	e
d             Ze
d             Ze
d             Zd	S )
_SigningProviderz2Stores a reference to a google.auth.crypto.Signer.c                 0    || _         || _        || _        d S r%   )_signer_signer_email_alg)r(   signersigner_emailalgs       r)   r*   z_SigningProvider.__init__L   s    )			r+   c                     | j         S r%   )r7   r'   s    r)   r:   z_SigningProvider.signerQ   s
    |r+   c                     | j         S r%   )r8   r'   s    r)   r;   z_SigningProvider.signer_emailU   s    !!r+   c                     | j         S r%   )r9   r'   s    r)   r<   z_SigningProvider.algY   s
    yr+   c                 6    t          |j        |j                  S r%   )r5   r:   r;   )clsgoogle_creds     r)   from_credentialz _SigningProvider.from_credential]   s     2K4LMMMr+   c                 N    t          j        |||          }t          ||          S r%   )r   Signerr5   )rA   requestrB   service_accountr:   s        r)   from_iamz_SigningProvider.from_iama   s%    G[/BB888r+   c                 P    t          t                      t          t                    S r%   )r5   r#   AUTH_EMULATOR_EMAILALGORITHM_NONE)rA   s    r)   for_emulatorz_SigningProvider.for_emulatorf   s     1 13FWWWr+   N)r0   r1   r2   __doc__ALGORITHM_RS256r*   propertyr:   r;   r<   classmethodrC   rH   rL   r&   r+   r)   r5   r5   I   s        <<1@    
   X " " X"   X N N [N 9 9 [9 X X [X X Xr+   r5   c                   H    e Zd ZdZdZd	dZd Zed             Zd
dZ	d Z
dS )TokenGeneratorz,Generates custom tokens and session cookies.z)https://identitytoolkit.googleapis.com/v1Nc                     || _         || _        t          j                                        | _        |p| j        }d                    ||j                  | _	        d | _
        d S )Nz{0}/projects/{1})apphttp_clientr   requestsRequestrF   ID_TOOLKIT_URLformat
project_idbase_url_signing_provider)r(   rT   rU   url_override
url_prefixs        r)   r*   zTokenGenerator.__init__p   s[    & )1133!8T%8
*11*cnMM!%r+   c                 6   t          j                    rt                                          S | j        j                                        }t          |t          j	        j
        j                  rt                              |          S | j        j                            d          }|r!t                              | j        ||          S t          |t"          j                  rt                              |          S |                     t&          ddi          }|j        dk    r9t+          d                    |j                                                            |j                                        }t                              | j        ||          S )zPInitializes a signing provider by following the go/firebase-admin-sign protocol.serviceAccountIdzMetadata-FlavorGoogle)urlheaders   z2Failed to contact the local metadata service: {0}.)r   is_emulatedr5   rL   rT   
credentialget_credential
isinstancegoogleoauth2rG   CredentialsrC   optionsgetrH   rF   r   SigningMETADATA_SERVICE_URLstatus
ValueErrorrY   datadecode)r(   rB   rG   resps       r)   _init_signing_providerz%TokenGenerator._init_signing_providerx   sa   "$$ 	3#00222h)88::k6=#@#LMM 	A#33K@@@ (*../ABB 	Y#,,T\;XXX k;#677 	A#33K@@@ || 4?PRZ>[|\\;#DKKDIL\L\L^L^__a a a)**,,(({OTTTr+   c                     | j         sR	 |                                 | _         n7# t          $ r*}d}t          d                    ||                    d}~ww xY w| j         S )z@Initializes and returns the SigningProvider instance to be used.z@https://firebase.google.com/docs/auth/admin/create-custom-tokenszFailed to determine service account: {0}. Make sure to initialize the SDK with service account credentials or specify a service account ID with iam.serviceAccounts.signBlob permission. Please refer to {1} for more details on creating custom tokens.N)r\   ru   	Exceptionrq   rY   )r(   errorrb   s      r)   signing_providerzTokenGenerator.signing_provider   s     % 		MM)-)D)D)F)F&& M M MX 9 :@s9K9K	M M MM %%s   # 
A%AAc                 ~   |t          |t                    st          d          t          |                                          t
          z  }|rst          |          dk    r)d                    d                    |                    }n(d                    d                    |                    }t          |          |r(t          |t                    rt          |          dk    rt          d          | j
        }t          t          j                              }|j        |j        t          |||t          z   d	}|r||d
<   |||d<   d|j        i}		 t#          j        |j        ||	          S # t(          j        j        j        $ r*}
d                    |
          }t1          ||
          d}
~
ww xY w)z.Builds and signs a Firebase custom auth token.Nz%developer_claims must be a dictionaryr   z:Developer claims {0} are reserved and cannot be specified.z, z8Developer claim {0} is reserved and cannot be specified.   z2uid must be a string between 1 and 128 characters.)r   r   r   uidr   r   	tenant_idclaimsr<   )headerz Failed to sign custom token. {0})rh   dictrq   setkeysRESERVED_CLAIMSlenrY   joinstrry   inttimer;   FIREBASE_AUDIENCEMAX_TOKEN_LIFETIME_SECONDSr<   r   encoder:   ri   authr   TransportErrorTokenSignError)r(   r|   developer_claimsr}   disallowed_keyserror_messagery   nowpayloadr   rx   msgs               r)   create_custom_tokenz"TokenGenerator.create_custom_token   s   '.55 J !HIII!"2"7"7"9"9::_LO 	0''!++&<<BF)-?)C)C=E =E "M&<<BF)-?)C)C=E =E " !/// 	S*S#.. 	S#c((S..QRRR0$)++#0#0$33
 
  	-#,GK ' 0GH)-.	-:.5wvNNNN{%4 	- 	- 	-4;;EBBC e,,,	-s   E9 9F<%F77F<c                 
   t          |t                    r|                    d          n|}t          |t                    r|s"t	          d                    |                    t          |t          j                  r!t          |	                                          }t          |t                    st          |t                    s"t	          d                    |                    |t          k     r(t	          d                    |t                              |t          k    r(t	          d                    |t                              d                    | j                  }||d}	 | j                            d||	          \  }}|r|                    d
          st#          j        d|          |                    d
          S # t&          j        j        $ r}t#          j        |          d}~ww xY w)z4Creates a session cookie from the provided ID token.utf-8zDIllegal ID token provided: {0}. ID token must be a non-empty string.zIllegal expiry duration: {0}.zDIllegal expiry duration: {0}. Duration must be at least {1} seconds.zCIllegal expiry duration: {0}. Duration must be at most {1} seconds.z{0}:createSessionCookie)idTokenvalidDurationpost)jsonsessionCookiez Failed to create session cookie.)http_responseN)rh   bytesrs   r   rq   rY   datetime	timedeltar   total_secondsbool#MIN_SESSION_COOKIE_DURATION_SECONDS#MAX_SESSION_COOKIE_DURATION_SECONDSr[   rU   body_and_responserm   r   UnexpectedResponseErrorrV   r   RequestExceptionhandle_auth_backend_error)r(   id_token
expires_inrb   r   body	http_resprx   s           r)   create_session_cookiez$TokenGenerator.create_session_cookie   s   /9(E/J/JX8??7+++PX(C(( 	, 	, &**, , , j("455 	9Z557788Jj$'' 	Qz*c/J/J 	Q<CCJOOPPP;;; ((.z;^(_(_a a a;;; ((.z;^(_(_a a a (..t}=='
 
	-".@@SZ@[[OD)  Qtxx88 Q!96iQ Q Q Q88O,,, "3 	? 	? 	?7>>>	?s   3 G H)G==Hr%   )NN)r0   r1   r2   rM   rX   r*   ru   rO   ry   r   r   r&   r+   r)   rR   rR   k   s        66@N& & & &U U U: & & X&*- *- *- *-Z -  -  -  -  -r+   rR   c                   N    e Zd ZdZddZed             Zed             Zd	dZdS )
CertificateFetchRequestzyA google-auth transport that supports HTTP cache-control.

    Also injects a timeout to each outgoing HTTP request.
    Nc                     t          j        t          j                              | _        t
          j                            | j                  | _        || _	        d S r%   )
cachecontrolCacheControlrV   Session_sessionr   rW   session	_delegate_timeout_seconds)r(   timeout_secondss     r)   r*   z CertificateFetchRequest.__init__   sE    $1(2B2D2DEE"+33DLAA /r+   c                     | j         S r%   )r   r'   s    r)   r   zCertificateFetchRequest.session   s
    }r+   c                     | j         S r%   )r   r'   s    r)   r   z'CertificateFetchRequest.timeout_seconds  s    $$r+   GETc                 :    |p| j         } | j        |f||||d|S )N)methodr   rc   timeout)r   r   )r(   rb   r   r   rc   r   kwargss          r)   __call__z CertificateFetchRequest.__call__  sI    1T1t~WT7GW WOUW W 	Wr+   r%   )r   NNN)	r0   r1   r2   rM   r*   rO   r   r   r   r&   r+   r)   r   r      s         
0 0 0 0
   X % % X%W W W W W Wr+   r   c                   (    e Zd ZdZd ZddZddZdS )TokenVerifierz'Verifies ID tokens and session cookies.c           
      V   |j                             dt          j                  }t	          |          | _        t          |j        dddt          t          t          j        t                    | _        t          |j        dddt          t          t           t"                    | _        d S )NhttpTimeoutzID tokenzverify_id_token()z<https://firebase.google.com/docs/auth/admin/verify-id-tokens)rZ   
short_name	operationdoc_urlcert_urlissuerinvalid_token_errorexpired_token_errorzsession cookiezverify_session_cookie())rl   rm   r	   DEFAULT_TIMEOUT_SECONDSr   rF   _JWTVerifierrZ   ID_TOKEN_CERT_URIID_TOKEN_ISSUER_PREFIXr   InvalidIdTokenErrorExpiredIdTokenErrorid_token_verifierCOOKIE_CERT_URICOOKIE_ISSUER_PREFIXInvalidSessionCookieErrorExpiredSessionCookieErrorcookie_verifier)r(   rT   r   s      r)   r*   zTokenVerifier.__init__  s    +//-1UVV.w77!-~*)R&) + ? 3"5 "5 "5  ,~2B/R$' 9 9 ;  ;  ;r+   r   c                 D    | j                             || j        |          S r%   )r   verifyrF   )r(   r   clock_skew_secondss      r)   verify_id_tokenzTokenVerifier.verify_id_token$  s     %,,Xt|EWXXXr+   c                 D    | j                             || j        |          S r%   )r   r   rF   )r(   cookier   s      r)   verify_session_cookiez#TokenVerifier.verify_session_cookie'  s     #**64<ASTTTr+   Nr   )r0   r1   r2   rM   r*   r   r   r&   r+   r)   r   r     s[        11; ; ;(Y Y Y YU U U U U Ur+   r   c                   &    e Zd ZdZd ZddZd ZdS )r   z6Verifies Firebase JWTs (ID tokens or session cookies).c                 f   |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        |                     d          | _        | j        d                                         dv r d	                    | j                  | _	        nd
                    | j                  | _	        |                     d          | _
        |                     d          | _        d S )NrZ   r   r   r   r   r   r   aeiouzan {0}za {0}r   r   )poprZ   r   r   rb   r   r   lowerrY   articled_short_name_invalid_token_error_expired_token_error)r(   r   s     r)   r*   z_JWTVerifier.__init__.  s     **\22 **\22K00::i((

:..jj**?1##%%00'/t'G'GD$$'.~~do'F'FD$$*JJ/D$E$E!$*JJ/D$E$E!!!r+   r   c                    t          |t                    r|                    d          n|}t          |t                    r|s(t	          d                    | j        |                    | j        s't	          d                    | j                            |dk     s|dk    r"t	          d                    |                    | 	                    |          \  }}|
                    d          }|
                    d          }|
                    d	          }| j        | j        z   }	d
                    | j                  }
d                    | j        | j                  }t          j                    }d}|t          k    r"d                    | j        | j                  }n|s|
                    d          s|
                    d          dk    rS|
                    d          dk    r:d|
                    di           v r"d                    | j        | j                  }n:d                    | j                  }n|sI|
                    d          dk    r0d                    | j        |
                    d          |          }n|| j        k    r$d                    | j        | j        ||
|          }n||	k    rd                    | j        |	||
|          }n|t          |t                    sd                    | j        |          }nL|sd                    | j        |          }n.t#          |          dk    rd                    | j        |          }|r|                     |          	 |r|}n3t&          j        j                            ||| j        | j        |          }|d	         |d<   |S # t&          j        j        j        $ r#}t7          t          |          |          d}~wt          $ r^}d t          |          v r$|                     t          |          |          |                     t          |          |          d}~ww xY w)!z5Verifies the signature and data for the provided JWT.r   z:Illegal {0} provided: {1}. {0} must be a non-empty string.a  Failed to ascertain project ID from the credential or the environment. Project ID is required to call {0}. Initialize the app with a credentials.Certificate or set your Firebase project ID as an app option. Alternatively set the GOOGLE_CLOUD_PROJECT environment variable.r   <   zKIllegal clock_skew_seconds value: {0}. Must be between 0 and 60, inclusive.r   r   r   zlMake sure the {0} comes from the same Firebase project as the service account used to authenticate this SDK.z+See {0} for details on how to retrieve {1}.Nz.{0} expects {1}, but was given a custom token.kidr<   HS256vr|   dz5{0} expects {1}, but was given a legacy custom token.z Firebase {0} has no "kid" claim.r    zIFirebase {0} has incorrect algorithm. Expected "RS256" but got "{1}". {2}zXFirebase {0} has incorrect "aud" (audience) claim. Expected "{1}" but got "{2}". {3} {4}zVFirebase {0} has incorrect "iss" (issuer) claim. Expected "{1}" but got "{2}". {3} {4}z.Firebase {0} has no "sub" (subject) claim. {1}z;Firebase {0} has an empty string "sub" (subject) claim. {1}r{   zHFirebase {0} has a "sub" (subject) claim longer than 128 characters. {1})rF   audience	certs_urlclock_skew_in_secondscausezToken expired)rh   r   r   r   rq   rY   r   rZ   r   _decode_unverifiedrm   r   rb   r   re   r   r   r   r   ri   rj   r   verify_tokenr   r   r   r   CertificateFetchErrorr   )r(   tokenrF   r   r   r   r   r   subjectexpected_issuerproject_id_match_msgverify_id_token_msgemulatedr   verified_claimsrx   s                   r)   r   z_JWTVerifier.verify<  s   )3E3)?)?JW%%%U%'' 	:u 	: &%88: : :  	U= >DVDN=S=S	U U U !!%7"%<%<]*++- - - 11%88U##;;u%%++e$$+7((.t(?(? 	 :@@4?[[ 	 *,,(((0HII M  !	D&**U"3"3 !	Dzz%  G++1 11 1"'7;;sB+?+?"?"?#VDND4LMM  !C I I$/ Z Z 	Dfjj//7::#VDOVZZ5F5FH[\\ M ((%%+VDOT_h,@BU&W &W M &&%%+VDO_f,@BU&W &W M _Jw$<$<_fT_.ABB M  	DfT_.ABB M \\CfT_.ABB   	;++M:::	E >")"(-"8"E"E#!_"m*< #F #> #> &5U%;OE"""{%4 	A 	A 	A'E

%@@@@ 	E 	E 	E#e**,,//E

%/HHH++CJJe+DDD	Es&   ?AO Q&O;;Q&AQ!!Q&c                     	 t          j        |          }t          j        |d          }||fS # t          $ r)}|                     t          |          |          d }~ww xY w)NF)r   r   )r   decode_headerrs   rq   r   r   )r(   r   r   r   rx   s        r)   r   z_JWTVerifier._decode_unverified  sx    	E&u--Fju555G7?" 	E 	E 	E++CJJe+DDD	Es   -0 
A#$AA#Nr   )r0   r1   r2   rM   r*   r   r   r&   r+   r)   r   r   +  s]        @@F F F^E ^E ^E ^E@E E E E Er+   r   c                       e Zd ZdZd ZdS )r   z7Unexpected error while signing a Firebase custom token.c                 H    t           j                            | ||           d S r%   r   UnknownErrorr*   r(   r.   r   s      r)   r*   zTokenSignError.__init__  #    ((w>>>>>r+   Nr0   r1   r2   rM   r*   r&   r+   r)   r   r     s)        AA? ? ? ? ?r+   r   c                       e Zd ZdZd ZdS )r   zHFailed to fetch some public key certificates required to verify a token.c                 H    t           j                            | ||           d S r%   r  r  s      r)   r*   zCertificateFetchError.__init__  r  r+   Nr  r&   r+   r)   r   r     s)        RR? ? ? ? ?r+   r   c                       e Zd ZdZd ZdS )r   z!The provided ID token is expired.c                 H    t           j                            | ||           d S r%   r   r   r*   r  s      r)   r*   zExpiredIdTokenError.__init__  s#    '00wFFFFFr+   Nr  r&   r+   r)   r   r     s.        ++G G G G Gr+   r   c                       e Zd ZdZd ZdS )RevokedIdTokenErrorz'The provided ID token has been revoked.c                 F    t           j                            | |           d S r%   r
  r-   s     r)   r*   zRevokedIdTokenError.__init__  s!    '00w?????r+   Nr  r&   r+   r)   r  r    s.        11@ @ @ @ @r+   r  c                       e Zd ZdZddZdS )r   z;The provided string is not a valid Firebase session cookie.Nc                 H    t           j                            | ||           d S r%   )r   InvalidArgumentErrorr*   r  s      r)   r*   z"InvalidSessionCookieError.__init__  s#    '00wFFFFFr+   r%   r  r&   r+   r)   r   r     s4        EEG G G G G Gr+   r   c                       e Zd ZdZd ZdS )r   z'The provided session cookie is expired.c                 >    t                               | ||           d S r%   r   r*   r  s      r)   r*   z"ExpiredSessionCookieError.__init__  s     !**4%@@@@@r+   Nr  r&   r+   r)   r   r     s.        11A A A A Ar+   r   c                       e Zd ZdZd ZdS )RevokedSessionCookieErrorz-The provided session cookie has been revoked.c                 <    t                               | |           d S r%   r  r-   s     r)   r*   z"RevokedSessionCookieError.__init__  s    !**499999r+   Nr  r&   r+   r)   r  r    s)        77: : : : :r+   r  )7rM   r   r   r   rV   google.authr   r   r   r   google.auth.exceptionsri   google.oauth2.id_tokengoogle.oauth2.service_accountfirebase_adminr   r   r	   r   r   r   r   r   r   r   r   r   r   r   r   r   ro   rN   rK   rJ   r   cryptrE   r#   r5   rR   rW   r   r   r   r  r   r   r   r   r  r  r   r   r  r&   r+   r)   <module>r     sR   8 7        # # # # # #             ! ! ! ! ! !         $ $ $ $ % % % % % % & & & & & & ' ' ' ' ' ' ; >  > Y&)c*<(*<Q*G*G*G*U*U*W*W&X&X #&)c*<(*<"*E*E*E*S*S*U*U&V&V # !S!3!3!!<!<!<!J!J!L!LMM C #     9  ;     fk'.   X X X X X X X XDF- F- F- F- F- F- F- F-RW W W W Wi/ W W W2U U U U U U U U<wE wE wE wE wE wE wE wEt? ? ? ? ?Z, ? ? ?? ? ? ? ?J3 ? ? ?G G G G G+9 G G G@ @ @ @ @+9 @ @ @G G G G G
 ? G G GA A A A A 9 A A A: : : : : 9 : : : : :r+   