Server : LiteSpeed
System : Linux server51.dnsbootclub.com 4.18.0-553.62.1.lve.el8.x86_64 #1 SMP Mon Jul 21 17:50:35 UTC 2025 x86_64
User : nandedex ( 1060)
PHP Version : 8.1.33
Disable Function : NONE
Directory :  /opt/cppython/lib/python3.8/site-packages/google/auth/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]


Current File : //opt/cppython/lib/python3.8/site-packages/google/auth/__pycache__/pluggable.cpython-38.pyc
U

O��g�C�@s�dZzddlmZWn ek
r4ddlmZYnXddlZddlZddlZddlZddl	Z	ddl
mZddl
mZddl
m
Z
dZdZd	Zd
ZdZdZGdd
�d
e
j�ZdS)a�Pluggable Credentials.
Pluggable Credentials are initialized using external_account arguments which
are typically loaded from third-party executables. Unlike other
credentials that can be initialized with a list of explicit arguments, secrets
or credentials, external account clients use the environment and hints/guidelines
provided by the external_account JSON file to retrieve credentials and exchange
them for Google access tokens.

Example credential_source for pluggable credential:
{
    "executable": {
        "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
        "timeout_millis": 5000,
        "output_file": "/path/to/generated/cached/credentials"
    }
}
�)�MappingN)�_helpers)�
exceptions)�external_account�i0ui�i��i@wcs�eZdZdZ�fdd�Ze�ej�dd��Z	dd�Z
edd	��Ze
�fd
d��Ze
�fdd
��Zdd�Zdd�Zdd�Zdd�Zdd�Z�fdd�Z�ZS)�Credentialsz6External account credentials sourced from executables.cs
|�dd�|_tt|�j|||||d�|��t|t�sHd|_t�	d��|�
d�|_|jsdt�	d��|j�
d�|_|j�
d	�|_|j�
d
�|_
|j�
d�|_d|_|js�t�	d
��|js�t|_n|jtks�|jtkr�t�d��|j
�r|j
tks�|j
tk�rt�d��dS)adInstantiates an external account credentials object from a executables.

        Args:
            audience (str): The STS audience field.
            subject_token_type (str): The subject token type.
            token_url (str): The STS endpoint URL.
            credential_source (Mapping): The credential source dictionary used to
                provide instructions on how to retrieve external credential to be
                exchanged for Google access tokens.

                Example credential_source for pluggable credential:

                    {
                        "executable": {
                            "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
                            "timeout_millis": 5000,
                            "output_file": "/path/to/generated/cached/credentials"
                        }
                    }
            args (List): Optional positional arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.
            kwargs (Mapping): Optional keyword arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.

        Raises:
            google.auth.exceptions.RefreshError: If an error is encountered during
                access token retrieval logic.
            google.auth.exceptions.InvalidValue: For invalid parameters.
            google.auth.exceptions.MalformedError: For invalid parameters.

        .. note:: Typically one of the helper constructors
            :meth:`from_file` or
            :meth:`from_info` are used instead of calling the constructor directly.
        �interactiveF)�audience�subject_token_type�	token_url�credential_sourceNz?Missing credential_source. The credential_source is not a dict.�
executablez<Missing credential_source. An 'executable' must be provided.�commandZtimeout_millisZinteractive_timeout_millis�output_file�z;Missing command field. Executable command must be provided.z*Timeout must be between 5 and 120 seconds.z>Interactive timeout must be between 30 seconds and 30 minutes.)�popr�superr�__init__�
isinstancerZ_credential_source_executabler�MalformedError�get�%_credential_source_executable_command�,_credential_source_executable_timeout_millis�8_credential_source_executable_interactive_timeout_millis�)_credential_source_executable_output_file�_tokeninfo_username�!EXECUTABLE_TIMEOUT_MILLIS_DEFAULT�%EXECUTABLE_TIMEOUT_MILLIS_LOWER_BOUND�%EXECUTABLE_TIMEOUT_MILLIS_UPPER_BOUND�InvalidValue�1EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS_LOWER_BOUND�1EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS_UPPER_BOUND)�selfr	r
rr�args�kwargs��	__class__��B/opt/cppython/lib/python3.8/site-packages/google/auth/pluggable.pyr>sz*
���
������������
�����zCredentials.__init__c	Cs�|��|jdk	r�z(t|jdd��}t�|�}W5QRXWntk
rNYnVXz|�|�}d|krjtj�Wn2tj	tj
fk
r��Yntjk
r�YnX|St��s�t�d��t
j��}|�|�d|d<|jr�|jdn|jd}|jr�tjnd}|j�r
tjntj}|j�rtjntj}	tj|j��||||	|d�}
|
jd	k�rbt�d
�|
j|
j���|
j�r|t�|
j� d��nd}|�s�|jdk	�r�t�t|jdd��}|�|�}|S)N�utf-8)�encoding�expiration_time�0Pluggable auth is only supported for python 3.7+�0�GOOGLE_EXTERNAL_ACCOUNT_REVOKE��)�timeout�stdin�stdout�stderr�envrz9Executable exited with non-zero return code {}. Error: {})!�_validate_running_moder�open�json�load�	Exception�_parse_subject_tokenr�RefreshErrorrrr�is_python_3�os�environ�copy�_inject_env_variablesrrr�sysr1r2�
subprocess�PIPE�STDOUT�runr�split�
returncode�format�loads�decode)r"�requestr�responseZ
subject_tokenr4Zexe_timeoutZ	exe_stdinZ
exe_stdoutZ
exe_stderr�resultr'r'r(�retrieve_subject_token�sr
�
�
�

������
z"Credentials.retrieve_subject_tokencCs�|jst�d��|��t��s*t�d��tj�	�}|�
|�d|d<tj|j
��|jdtjtj|d�}|jdkr�t�d�|j|j���t�|j�d	��}|�|�d
S)aGRevokes the subject token using the credential_source object.

        Args:
            request (google.auth.transport.Request): A callable used to make
                HTTP requests.
        Raises:
            google.auth.exceptions.RefreshError: If the executable revocation
                not properly executed.

        z.Revoke is only enabled under interactive mode.r,�1r.r/)r0r2r3r4rzNAuth revoke failed on executable. Exit with non-zero return code {}. Error: {}r)N)rrrr5rr<r;r=r>r?r@rBrErrFrrCrDrGrHr2r7rIrJ�_validate_revoke_response)r"rKr4rMrLr'r'r(�revoke�s<��

��	
��zCredentials.revokecCs|jp
|jS)a1Returns the external account identifier.

        When service account impersonation is used the identifier is the service
        account email.

        Without service account impersonation, this returns None, unless it is
        being used by the Google Cloud CLI which populates this field.
        )�service_account_emailr)r"r'r'r(�external_account_idszCredentials.external_account_idcstt|�j|f|�S)a'Creates a Pluggable Credentials instance from parsed external account info.

        Args:
            info (Mapping[str, str]): The Pluggable external account info in Google
                format.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.pluggable.Credentials: The constructed
                credentials.

        Raises:
            google.auth.exceptions.InvalidValue: For invalid parameters.
            google.auth.exceptions.MalformedError: For invalid parameters.
        )rr�	from_info)�cls�infor$r%r'r(rT+szCredentials.from_infocstt|�j|f|�S)ajCreates an Pluggable Credentials instance from an external account json file.

        Args:
            filename (str): The path to the Pluggable external account json file.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.pluggable.Credentials: The constructed
                credentials.
        )rr�	from_file)rU�filenamer$r%r'r(rW>szCredentials.from_filecCs\|j|d<|j|d<|j|d<|jr(dnd|d<|jdk	rD|j|d<|jdk	rX|j|d<dS)	NZ GOOGLE_EXTERNAL_ACCOUNT_AUDIENCEZ"GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPEZGOOGLE_EXTERNAL_ACCOUNT_IDrOr-Z#GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVEZ*GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAILZ#GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE)Z	_audienceZ_subject_token_typerSrZ"_service_account_impersonation_urlrRr)r"r4r'r'r(r@Ls



��
��z!Credentials._inject_env_variablescCs�|�|�|dsFd|ks"d|kr,t�d��t�d�|d|d���d|krh|dt��krht�d��d|krzt�d	��|dd
ks�|ddkr�|dS|dd
kr�|dSt�d��dS)N�success�code�messagez;Error code and message fields are required in the response.zAExecutable returned unsuccessful response: code: {}, message: {}.r+z0The token returned by the executable is expired.�
token_typez8The executable response is missing the token_type field.z$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_tokenZid_tokenz&urn:ietf:params:oauth:token-type:saml2Z
saml_responsez+Executable returned unsupported token type.)�_validate_response_schemarrr;rH�time�r"rLr'r'r(r:[s8
�����
�
�z Credentials._parse_subject_tokencCs |�|�|dst�d��dS)NrYz)Revoke failed with unsuccessful response.)r]rr;r_r'r'r(rPys
z%Credentials._validate_revoke_responsecCsHd|krt�d��|dtkr2t�d�|d���d|krDt�d��dS)N�versionz5The executable response is missing the version field.z+Executable returned unsupported version {}.rYz5The executable response is missing the success field.)rr� EXECUTABLE_SUPPORTED_MAX_VERSIONr;rHr_r'r'r(r]~s����z%Credentials._validate_response_schemacCsdtj�d�}|dkrt�d��|jr4|js4t�d��|jrJ|jsJt�d��|jr`|j	s`t�
d��dS)NZ)GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLESrOzhExecutables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run.zVAn output_file must be specified in the credential configuration for interactive mode.z;Interactive mode cannot run without an interactive timeout.z4Interactive mode is only enabled for workforce pool.)r=r>rrrrrr�InvalidOperationZis_workforce_poolr)r"Zenv_allow_executablesr'r'r(r5�s,�������z"Credentials._validate_running_modecstt|���}d|d<|S)Nr
�source)rr�_create_default_metrics_options)r"Zmetrics_optionsr%r'r(rd�sz+Credentials._create_default_metrics_options)�__name__�
__module__�__qualname__�__doc__rrZcopy_docstringrrrNrQ�propertyrS�classmethodrTrWr@r:rPr]r5rd�
__classcell__r'r'r%r(r;s"h

H/

r)rh�collections.abcr�ImportError�collectionsr7r=rBrAr^Zgoogle.authrrrrarrrr r!rr'r'r'r(�<module>s&

F1le Man4ger