
    i[f                         d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm	Z	 ddl
mZmZ ddl
mZ dd	lmZ dd
lmZmZmZ  G d d          ZdS )    N)default_json_headersgenerate_token)JsonWebToken	JoseError   )AccessDeniedErrorInvalidRequestError)scope_to_list   )ClientMetadataClaims)InvalidClientMetadataError UnapprovedSoftwareStatementErrorInvalidSoftwareStatementErrorc                   x    e Zd ZdZdZeZdZd Zd Z	d Z
d Zd Zd	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd ZdS )ClientRegistrationEndpointzThe client registration endpoint is an OAuth 2.0 endpoint designed to
    allow a client to be registered with the authorization server.
    client_registrationNc                     || _         d S N)server)selfr   s     S/var/www/piapp/venv/lib/python3.11/site-packages/authlib/oauth2/rfc7591/endpoint.py__init__z#ClientRegistrationEndpoint.__init__   s        c                 ,    |                      |          S r   )create_registration_responser   requests     r   __call__z#ClientRegistrationEndpoint.__call__!   s    00999r   c                    |                      |          }|st                      ||_        |                     |          }|                                 }i }|                    |           |                    |           |                     |||          }|                     ||          }|r|                    |           d|t          fS )N   )	authenticate_tokenr	   
credentialextract_client_metadatagenerate_client_infoupdatesave_client!generate_client_registration_infor   )r   r   tokenclient_metadataclient_infobodyclientregistration_infos           r   r   z7ClientRegistrationEndpoint.create_registration_response$   s    ''00 	&#%%%"66w??//11O$$$K   !!+HH BB67SS 	+KK)***D...r   c                    |j         st                      |j                                         }|                    dd           }|r2| j        r+|                     ||          }|                    |           |                                 }|                     |i || 	                                          }	 |
                                 n&# t          $ r}t          |j                  d }~ww xY w|                                S )Nsoftware_statement)datar
   copypop'software_statement_alg_values_supportedextract_software_statementr&   get_claims_optionsclaims_classget_server_metadatavalidater   r   descriptionget_registered_claims)r   r   	json_datar0   r1   optionsclaimserrors           r   r$   z2ClientRegistrationEndpoint.extract_client_metadata6   s   | 	(%'''L%%''	&]]+?FF 	#$"N 	#223EwOODT"""))++""9b'4;S;S;U;UVV	@OO 	@ 	@ 	@,U->???	@++---s   8C 
C0C++C0c                     |                      |          }|st                      	 t          | j                  }|                    ||          }|S # t
          $ r t                      w xY wr   )resolve_public_keyr   r   r4   decoder   r   )r   r0   r   keyjwtr>   s         r   r5   z5ClientRegistrationEndpoint.extract_software_statementH   s~    %%g.. 	52444	2tKLLCZZ 2C88FM 	2 	2 	2/111	2s   +A A,c                   	 |                                  }|si S |                    d          	|                    d          |                    d          |                    d          }i }	t          	          		fd}d|i|d<   t                    fd	}d|i|d
<   t                    fd}d|i|d<   |d|i|d<   |S )zFGenerate claims options validation from Authorization Server metadata.scopes_supportedresponse_types_supportedgrant_types_supported%token_endpoint_auth_methods_supportedNc                 n    |sdS t          t          |                    }                    |          S )NT)setr   
issuperset)r>   valuescopesrF   s      r   _validate_scopezFClientRegistrationEndpoint.get_claims_options.<locals>._validate_scopec   s9      4]51122'226:::r   r9   scopec                 V    |rt          |          ndh}                    |          S )NcoderK   rL   )r>   rM   response_typesrG   s      r   _validate_response_typeszOClientRegistrationEndpoint.get_claims_options.<locals>._validate_response_typesn   s/     05!BU6(/::>JJJr   rT   c                 V    |rt          |          ndh}                    |          S )Nauthorization_coderS   )r>   rM   grant_typesrH   s      r   _validate_grant_typeszLClientRegistrationEndpoint.get_claims_options.<locals>._validate_grant_typesy   s1     -2Mc%jjj8L7M,77DDDr   rX   valuestoken_endpoint_auth_method)r8   getrK   )
r   metadataauth_methods_supportedr=   rO   rU   rY   rH   rG   rF   s
          @@@r   r6   z-ClientRegistrationEndpoint.get_claims_optionsU   sZ   ++-- 	I#<<(:;;#+<<0J#K#K  (-D E E!).U!V!V'"#344; ; ; ; ; !+O<GG#/'*+C'D'D$K K K K K *45M(NG$% ,$'(=$>$>!E E E E E '12G%HGM"!-5=?U4VG01r   c                     |                                  }|                                 }t          t          j                              }d}t	          ||||          S )Nr   )	client_idclient_secretclient_id_issued_atclient_secret_expires_at)generate_client_idgenerate_client_secretinttimedict)r   r`   ra   rb   rc   s        r   r%   z/ClientRegistrationEndpoint.generate_client_info   sa    ++--	3355!$)++..#$ ' 3%=	
 
 
 	
r   c                     dS )zGenerate ```registration_client_uri`` and ``registration_access_token``
        for RFC7592. This method returns ``None`` by default. Developers MAY rewrite
        this method to return registration information.N )r   r-   r   s      r   r(   z<ClientRegistrationEndpoint.generate_client_registration_info   s	     tr   c                 6    | j                             |          S r   )r   create_json_requestr   s     r   create_endpoint_requestz2ClientRegistrationEndpoint.create_endpoint_request   s    {..w777r   c                      t          d          S )zGenerate ``client_id`` value. Developers MAY rewrite this method
        to use their own way to generate ``client_id``.
        *   r   r   s    r   rd   z-ClientRegistrationEndpoint.generate_client_id   s     b!!!r   c                 t    t          j        t          j        d                                        d          S )zGenerate ``client_secret`` value. Developers MAY rewrite this method
        to use their own way to generate ``client_secret``.
           ascii)binasciihexlifyosurandomrB   rp   s    r   re   z1ClientRegistrationEndpoint.generate_client_secret   s+     
2//66w???r   c                     t                      )zeReturn server metadata which includes supported grant types,
        response types and etc.
        NotImplementedErrorrp   s    r   r8   z.ClientRegistrationEndpoint.get_server_metadata   s     "###r   c                     t                      )aL  Authenticate current credential who is requesting to register a client.
        Developers MUST implement this method in subclass::

            def authenticate_token(self, request):
                auth = request.headers.get('Authorization')
                return get_token_by_auth(auth)

        :return: token instance
        ry   r   s     r   r"   z-ClientRegistrationEndpoint.authenticate_token        "###r   c                     t                      )aI  Resolve a public key for decoding ``software_statement``. If
        ``enable_software_statement=True``, developers MUST implement this
        method in subclass::

            def resolve_public_key(self, request):
                return get_public_key_from_user(request.credential)

        :return: JWK or Key string
        ry   r   s     r   rA   z-ClientRegistrationEndpoint.resolve_public_key   r|   r   c                     t                      )a  Save client into database. Developers MUST implement this method
        in subclass::

            def save_client(self, client_info, client_metadata, request):
                client = OAuthClient(
                    client_id=client_info['client_id'],
                    client_secret=client_info['client_secret'],
                    ...
                )
                client.save()
                return client
        ry   )r   r+   r*   r   s       r   r'   z&ClientRegistrationEndpoint.save_client   s     "###r   )__name__
__module____qualname____doc__ENDPOINT_NAMEr   r7   r4   r   r   r   r$   r5   r6   r%   r(   rm   rd   re   r8   r"   rA   r'   rj   r   r   r   r      s         *M (L /3+  : : :/ / /$. . .$2 2 2/ / /b
 
 
  8 8 8" " "@ @ @$ $ $
$ 
$ 
$
$ 
$ 
$$ $ $ $ $r   r   )rv   rg   rt   authlib.constsr   authlib.common.securityr   authlib.joser   r   rfc6749r	   r
   r   r>   r   errorsr   r   r   r   rj   r   r   <module>r      s   				   / / / / / / 2 2 2 2 2 2 0 0 0 0 0 0 0 0 < < < < < < < < # # # # # # ( ( ( ( ( (         B$ B$ B$ B$ B$ B$ B$ B$ B$ B$r   