e<ndZddlZddlZddlZddlmZmZmZmZm Z m Z m Z m Z m Z ddlmZddlZddlmZmZmZmZddlmZddlmZGdd ZGd d ej2ZGd d ej2ZGddej2ZGddZedk(reejAyy)zJSON Web Signature.N) AnyDict FrozenSetListMappingOptionalTupleTypecast)crypto)b64errors json_utiljwa)jwk)utilcJeZdZdZdZ ededefdZededefdZy) MediaTypez MediaType field encoder/decoder.z application/valuereturnc^d|vr(d|vrtjd|j|zS|S)zDecoder./;zUnexpected semi-colon)rDeserializationErrorPREFIXclsrs ,/usr/lib/python3/dist-packages/josepy/jws.pydecodezMediaType.decodes9 e e|112IJJ::% % cxd|vr5|j|jsJ|t|jdS|S)zEncoder.rN) startswithrlenrs rencodezMediaType.encode)s? e ##CJJ/ //SZZ*+ + r N) __name__ __module__ __qualname____doc__r classmethodstrrr$r rrrsO* F23333r rceZdZUdZej dejjdZ e eje d<ej ddZ e e e d<ej dejjdZe eje d<ej ddZe ee d<ej d dZe e e d <ej d dd Zeej.d fe d <ej dej0dZe e e d<ej dej0dZe e e d<ej dej8ej:dZe ee d<ej dej8ej:dZe ee d<ej ddd Z ee!d fe d<e"eejFfe d<de"eejFffdZ$de!ddfdZ%de&jfdZ'e jPde!de!fdZ ejRdZejPdZy) Headera6JOSE Header. .. warning:: This class supports **only** Registered Header Parameter Names (as defined in section 4.1 of the protocol). If you need Public Header Parameter Names (4.2) or Private Header Parameter Names (4.3), you must subclass and override :meth:`from_json` and :meth:`to_partial_json` appropriately. .. warning:: This class does not support any extensions through the "crit" (Critical) Header Parameter (4.1.11) and as a conforming implementation, :meth:`from_json` treats its occurrence as an error. Please subclass if you seek for a different behaviour. :ivar x5tS256: "x5t#S256" :ivar str typ: MIME Media Type, inc. :const:`MediaType.PREFIX`. :ivar str cty: Content-Type, inc. :const:`MediaType.PREFIX`. algT)decoder omitemptyjku)r0rkidx5ux5cr+r0default.x5tzx5t#S256x5tS256typ)encoderr/r0ctycrit_fieldsrc |jjDcic]-\}}|jt||s |t||/c}}Scc}}w)z4Fields that would not be omitted in the JSON object.)r=itemsomitgetattr)selfnamefields r not_omittedzHeader.not_omitted`sT $||113 e::gdD12 '$% %   s2Aotherc@t|t|s#tdjt||j }|j }t |j |r td|j|t|di|S)NzHeader cannot be added to: {0}z+Addition of overlapping headers not definedr+) isinstancetype TypeErrorformatrEset intersectionupdate)rBrFnot_omitted_selfnot_omitted_others r__add__zHeader.__add__hs%d,<CCDKPQ Q++-!--/  - -.? @IJ J 12tDz-,--r c\|jtjd|jS)zFind key based on header. .. todo:: Supports only "jwk" header parameter lookup. :returns: (Public) key found in the header. :rtype: .JWK :raises josepy.errors.Error: if key could not be found z No key found)rrErrorrBs rfind_keyzHeader.find_keyus& 88 ,,~. .xxr unused_valuec,tjd)Nz("crit" is not supported, please subclass)rr)rVs rr<z Header.crits))*TUUr c |Dcgc]C}tjtjtj|j Ec}Scc}wN)base64 b64encoder dump_certificate FILETYPE_ASN1wrapped)rcerts rr4z Header.x5csF    V44V5I5I4<<X Y   sAAc td|DS#tj$r}tj|d}~wwxYw)Nc 3K|]N}tjtjtjt j |PywrY)rComparableX509r load_certificater]rZ b64decode).0r_s r zHeader.x5c..sG##++F,@,@&BRBRSWBXYsAA)tupler rSrr)rerrors rr4z Header.x5csJ 5"   || 5--e4 4 5sA<AN)*r%r&r'r(rrDr JWASignature from_jsonr.r__annotations__r1bytesjwk_modJWKrr2r*r3r4r rrbdecode_b64joser7r8rr$rr9r;r<rrFieldrErQjosepyrUr/r:r+r rr-r-3sn*'6ioo s''11T'C#"" #+9??5DAC%A!0 w{{,,"C'++ )$?C#?*9??5DAC%A+:9??5DZ\+]Ct""C' (]*9??5):R:R^bcC%c.yI44 GXe_ /y y''1A1AT C)  /y y''1A1AT C) ,IOOFdBOD%S/O #y& '' T#y"67  .S .X . &**  \\V3V3VV  [[   [[ 5 5r r-ceZdZUdZeZeed<dZejdddZ e ed<ejddeej Z eed<ejd ejej Zeed <e j$d e d e fdZ e j&d e d e fdZ ded dffd Zeded ee effdZede ded efdZddedeej8d efdZedefdedej8dej@dede!ded dfdZ"d ee efffd Z#ede$e efd ee efffd Z%xZ&S) SignatureaJWS Signature. :ivar combined: Combined Header (protected and unprotected, :class:`Header`). :ivar unicode protected: JWS protected header (Jose Base-64 decoded). :ivar header: JWS Unprotected Header (:class:`Header`). :ivar str signature: The signature. combined)rt protectedTr5header)r0r6r/ signature)r/r:rrcJtj|jdSNutf-8)rencode_b64joser$rs rruzSignature.protecteds'' W(=>>r cJtj|jdSrz)rrorr}s rruzSignature.protecteds''.55g>>r kwargsNc ~d|vr|j|}t|di||jjJy)Nrtr+)_with_combinedsuper__init__rtr.)rBr __class__s rrzSignature.__init__sA V #((0F "6"}}  ,,,r cd|vsJ|jd|jdj}|jd|jdj}|r||jj |z}n|}||d<|S)Nrtrwru)getr=r6 header_cls json_loads)rrrwrurts rrzSignature._with_combineds~'''Hckk(&;&C&CDJJ{CKK ,D,L,LM  9 9) DDHH%z r payloadc|tj|jddztj|zS)Nr{.)r r[r$)rrurs r_msgzSignature._msgs/}}Y--g67$>wAWWWr keyc@||jjn|}|jjstjd|jjj |j |j|j|j|S)zvVerify. :param bytes payload: Payload to verify. :param JWK key: Key used for verification. z Not signature algorithm defined.)rsigmsg) rtrUr.rqrSverifyrrxrru)rBrr actual_keys rrzSignature.verifys{>A[!7!7!9c }}  ,,AB B}}  ''DNN $..RY8Z(  r r. include_jwkprotectc 8t||jsJ|}||d<|r|j|d<t|j |j j sJ|j |j j sJi}|D]} | |vs|j| || <|r!|j di|j} nd} |j di|} |j|j|j| |} || | | S)aDSign. :param bytes payload: Payload to sign. :param JWK key: Key for signature. :param JWASignature alg: Signature algorithm to use to sign. :param bool include_jwk: If True, insert the JWK inside the signature headers. :param FrozenSet protect: List of headers to protect. r.rrv)rurwrxr+) rHkty public_keyrLissubsetrr=pop json_dumpssignrr) rrrr.rrr header_paramsprotected_paramsrwrurxs rrzSignature.signs&#sww''' " e #&>>#3M% =!**3>>+A+ABBB 6 6777 EF&+8+<+  $   !&[ (L(LZZ(L (L  (L  (L(L (L(LTS#X $GCH$5$$sCx.$$r rsceZdZUdZdZeed<eeed<eZ dde e jde fdZeded eddfd Zedefd Zdefd Zed eddfdZdde deeeffdZedeeefddfdZy)JWSzgJSON Web Signature. :ivar str payload: JWS Payload. :ivar str signature: JWS Signatures. r signaturesrrNrrcDtfdjDS)Verify.c3VK|] }|jj"ywrY)rr)rerrrBs rrfzJWS.verify...s LS3::dllC0Ls&))allr)rBrs``rrz JWS.verify,sLDOOLLLr rc P|||jjdd|i|fS)Sign.rrr+) signature_clsr)rrrs rrzJWS.sign0s170F0A0A0F0F0aw0aZ`0a/cddr cTt|jdk(sJ|jdS)zPGet a singleton signature. :rtype: :class:`JWS.signature_cls` r)r#rrTs rrxz JWS.signature5s*4??#q(((q!!r ct|jdk(sJd|jjj vsJt j |jjjddzt j |jzdzt j |jjzS)z7Compact serialization. :rtype: bytes rr.r{r) r#rrxrwrEr r[rur$rrTs r to_compactzJWS.to_compact?s 4??#q(((DNN11==???? MM$..2299'B C mmDLL) * mmDNN445  6 r compactc> |jd\}}}|j t j |jdt j |}|t j ||fS#t$rtjdwxYw)zACompact deserialization. :param bytes compact: rzOCompact JWS serialization should comprise of exactly 3 dot-separated componentsr{)rurxr)split ValueErrorrrrr rdr)rrrurrxrs r from_compactzJWS.from_compactRs ,3MM$,? )Iw mmI.55g>#--XaJb  3==1sfEE --d  s A==Bflatc|jsJtj|j}|r.s" `c!2!2!>#3#:#:#<=C 3syy~~/? @A 88 88' ''((-- 0;;=C HHNN C ++-.::#:&&&<< e  s?EE7" E22E7argc@tjj|SrY)rrirjrrs r _alg_typez CLI._alg_types))#..r cB|tjjvsJ|SrY)rsrr=rs r _header_typezCLI._header_types!i**22222 r cx|tjjvsJtjj|SrY)rmrnTYPESrs r _kty_typez CLI._kty_types/gkk'''''{{  %%r c|tjdd}tj}|j dd|j }|j d}|j|j|j dd tjd d |j d d|jtj|j ddd|j|j d}|j|j|j dd tjd d |j d|jd |j!|}|j#|S)z Parse arguments and sign/verify.Nrz --compact store_true)actionr)funcz-kz--keyrbT)rIrequiredz-az--alg)rIr6z-pz --protectr)rrIrFz--kty)rargvargparseArgumentParser add_argumentadd_subparsers add_parser set_defaultsrFileTyperrRS256rrr parse_argsr)rrparser subparsers parser_sign parser_verifyparseds rrunzCLI.runsK <88ABrs     ..!4h5Y + +h5V}$ ..}$@c) ( (cLO#O#d zOr