
    ([f$                     v    d dl Z d dlmZ d dlmZ ddlmZ dZ e j        e	          Z
 G d d          Zd	 ZdS )
    N)jwt)	JoseError   )InvalidClientErrorz6urn:ietf:params:oauth:client-assertion-type:jwt-bearerc                   L    e Zd ZdZeZdZddZd Zd Z	d Z
d Zd	 Zd
 Zd ZdS )JWTBearerClientAssertionz]Implementation of Using JWTs for Client Authentication, which is
    defined by RFC7523.
    client_assertion_jwtTc                 "    || _         || _        d S )N)	token_url_validate_jti)selfr   validate_jtis      Q/var/www/piapp/venv/lib/python3.11/site-packages/authlib/oauth2/rfc7523/client.py__init__z!JWTBearerClientAssertion.__init__   s    ")    c                 N   |j         }|                    d          }|                    d          }|t          k    rH|rF|                     ||          }|                     ||           |                     |j                  S t                              d| j	                   d S )Nclient_assertion_typeclient_assertionzAuthenticate via %r failed)
formgetASSERTION_TYPEcreate_resolve_key_funcprocess_assertion_claimsauthenticate_clientclientlogdebugCLIENT_AUTH_METHOD)r   query_clientrequestdataassertion_type	assertionresolve_keys          r   __call__z!JWTBearerClientAssertion.__call__   s    |"9::HH/00	^++	+66|WMMK)))[AAA++GN;;;		.0GHHHHHr   c                 d    dt           dddid| j        dddid}| j        rd| j        d|d<   |S )zCreate a claims_options for verify JWT payload claims. Developers
        MAY overwrite this method to create a more strict options.T)	essentialvalidater'   )r'   value)isssubaudexpjti)_validate_issr   r   r   )r   optionss     r   create_claims_optionsz.JWTBearerClientAssertion.create_claims_options!   s_     "&=AA&!%??&	
 
  	P+/T=NOOGENr   c                     	 t          j        |||                                           }|                                 n;# t          $ r.}t
                              d|           t                      d}~ww xY w|S )aa  Extract JWT payload claims from request "assertion", per
        `Section 3.1`_.

        :param assertion: assertion string value in the request
        :param resolve_key: function to resolve the sign key
        :return: JWTClaims
        :raise: InvalidClientError

        .. _`Section 3.1`: https://tools.ietf.org/html/rfc7523#section-3.1
        )claims_optionszAssertion Error: %rN)r   decoder1   r(   r   r   r   r   )r   r#   r$   claimses        r   r   z1JWTBearerClientAssertion.process_assertion_claims0   s    	'Z;#99;;  F OO 	' 	' 	'II+Q///$&&&	' s   =A   
A8
)A33A8c                 X    |                     | j        d          r|S t                      )Ntoken)check_endpoint_auth_methodr   r   )r   r   s     r   r   z,JWTBearerClientAssertion.authenticate_clientF   s.    ,,T-DgNN 	M """r   c                       fd}|S )Nc                     |d         } |          }|st                      |_                            ||           S Nr+   )r   r   resolve_client_public_key)headerspayload	client_idr   r   r    r   s       r   r$   zEJWTBearerClientAssertion.create_resolve_key_func.<locals>.resolve_keyL   sN      I!\),,F +(***#GN11&'BBBr    )r   r   r    r$   s   ``` r   r   z0JWTBearerClientAssertion.create_resolve_key_funcK   s7    		C 		C 		C 		C 		C 		C 		C r   c                     t                      )af  Validate if the given ``jti`` value is used before. Developers
        MUST implement this method::

            def validate_jti(self, claims, jti):
                key = 'jti:{}-{}'.format(claims['sub'], jti)
                if redis.get(key):
                    return False
                redis.set(key, 1, ex=3600)
                return True
        NotImplementedError)r   r5   r.   s      r   r   z%JWTBearerClientAssertion.validate_jtiX   s     "###r   c                     t                      )aN  Resolve the client public key for verifying the JWT signature.
        A client may have many public keys, in this case, we can retrieve it
        via ``kid`` value in headers. Developers MUST implement this method::

            def resolve_client_public_key(self, client, headers):
                return client.public_key
        rC   )r   r   r>   s      r   r=   z2JWTBearerClientAssertion.resolve_client_public_keye   s     "###r   N)T)__name__
__module____qualname____doc__r   CLIENT_ASSERTION_TYPEr   r   r%   r1   r   r   r   r   r=   rA   r   r   r   r   
   s          +/* * * *I I I    ,# # #
  $ $ $$ $ $ $ $r   r   c                     | d         |k    S r<   rA   )r5   r*   s     r   r/   r/   p   s    %=Cr   )loggingauthlib.joser   authlib.jose.errorsr   rfc6749r   r   	getLoggerrF   r   r   r/   rA   r   r   <module>rQ      s           ) ) ) ) ) ) ( ( ( ( ( (Ig!!c$ c$ c$ c$ c$ c$ c$ c$L         r   