Server : LiteSpeed
System : Linux server51.dnsbootclub.com 4.18.0-553.62.1.lve.el8.x86_64 #1 SMP Mon Jul 21 17:50:35 UTC 2025 x86_64
User : nandedex ( 1060)
PHP Version : 8.1.33
Disable Function : NONE
Directory :  /opt/cppython/lib/python3.8/site-packages/oauth2client/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]


Current File : //opt/cppython/lib/python3.8/site-packages/oauth2client/__pycache__/client.cpython-38.pyc
U

O��gYE�@sdZddlZddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlm
Z
ddlmZddlZddlmZddlmZddlmZddlmZd	Zd	Zzdd
lmZdZejdk	ZWnek
r�YnXe�e�ZdZd
ZeZdZdZ dZ!dZ"dZ#dZ$de"dZ%dZ&e�'dddg�Z(dZ)e�*dd�Z+ze,e�*dd��Z-Wne.k
�rtdZ-YnXdZ/d e�*d!d"�Z0d#Z1d$Z2e1e2iZ3ejj4Z5ej6Z6ej7Z7ej8Z8Gd%d&�d&e9�Z:Gd'd(�d(e;�Z<Gd)d*�d*e<�Z=Gd+d,�d,e<�Z>Gd-d.�d.e>�Z?Gd/d0�d0e<�Z@Gd1d2�d2e<�ZAGd3d4�d4e<�ZBGd5d6�d6e<�ZCGd7d8�d8e<�ZDGd9d:�d:e<�ZEGd;d<�d<e<�ZFGd=d>�d>e<eG�ZHd?d@�ZIGdAdB�dBe9�ZJGdCdD�dDe9�ZKGdEdF�dFe9�ZLGdGdH�dHeJ�ZMGdIdJ�dJeM�ZNdKdL�ZOdMdN�ZPdOdP�ZQGdQdR�dReM�ZRdSdT�ZSddUdV�ZTdWdX�ZUdYdZ�ZVd[d\�ZWd]d^�ZXd_d`�ZYdadb�ZZdcdd�Z[Gdedf�dfeR�Z\dgdh�Z]e�^di�defdjdk��Z_dldm�Z`dndo�Zae�^dp�dqddejbejcejdejeejfd	df
drds��Zge�^d�d�dtdu��ZhGdvdw�dwe�'dwdx��Zidydz�ZjGd{d|�d|eK�Zke�^di�d�d}d~��ZldS)�zPAn OAuth 2.0 client.

Tools for interacting with OAuth 2.0 protected resources.
�N)�http_client)�urllib)�_helpers)�_pkce)�
clientsecrets)�	transportF)�cryptTz%Y-%m-%dT%H:%M:%SZz*https://www.googleapis.com/oauth2/v1/certszurn:ietf:wg:oauth:2.0:oob�authorized_user�service_account�GOOGLE_APPLICATION_CREDENTIALSZgcloudZCLOUDSDK_CONFIGz�The Application Default Credentials are not available. They are available if running in Google Compute Engine. Otherwise, the environment variable z� must be defined pointing to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.z$application_default_credentials.json�AccessTokenInfo�access_token�
expires_in�UNKNOWN�NO_GCE_CHECK�False�GCE_METADATA_TIMEOUT��SERVER_SOFTWAREzhttp://ZGCE_METADATA_IPz169.254.169.254zmetadata-flavorZGooglec@seZdZdZdZdS)�SETTINGSz/Settings namespace for globally defined values.N)�__name__�
__module__�__qualname__�__doc__�env_name�rr�@/opt/cppython/lib/python3.8/site-packages/oauth2client/client.pyrsrc@seZdZdZdS)�ErrorzBase error for this module.N�rrrrrrrrr�src@seZdZdZdS)�FlowExchangeErrorzDError trying to exchange an authorization grant for an access token.Nrrrrrr�src@seZdZdZdS)�AccessTokenRefreshErrorz0Error trying to refresh an expired access token.Nrrrrrr �sr cs eZdZdZ�fdd�Z�ZS)�HttpAccessTokenRefreshErrorzCError (with HTTP status) trying to refresh an expired access token.cs tt|�j|�|�d�|_dS)N�status)�superr!�__init__�getr")�self�args�kwargs��	__class__rrr$�sz$HttpAccessTokenRefreshError.__init__)rrrrr$�
__classcell__rrr)rr!�sr!c@seZdZdZdS)�TokenRevokeErrorzError trying to revoke a token.Nrrrrrr,�sr,c@seZdZdZdS)�UnknownClientSecretsFlowErrorzEThe client secrets file called for an unknown type of OAuth 2.0 flow.Nrrrrrr-�sr-c@seZdZdZdS)�AccessTokenCredentialsErrorz:Having only the access_token means no refresh is possible.Nrrrrrr.�sr.c@seZdZdZdS)�VerifyJwtTokenErrorz/Could not retrieve certificates for validation.Nrrrrrr/�sr/c@seZdZdZdS)�NonAsciiHeaderErrorz.Header names and values must be ASCII strings.Nrrrrrr0�sr0c@seZdZdZdS)�"ApplicationDefaultCredentialsErrorz5Error retrieving the Application Default Credentials.Nrrrrrr1�sr1c@seZdZdZdS)�OAuth2DeviceCodeErrorz'Error trying to retrieve a device code.Nrrrrrr2�sr2c@seZdZdZdS)�CryptoUnavailableErrorz@Raised when a crypto library is required, but none is available.Nrrrrrr3�sr3cCs"|rt|tj�r|�t�SdSdS)N)�
isinstance�datetime�strftime�
EXPIRY_FORMAT)Zexpiryrrr�
_parse_expiry�s
r8c@sdeZdZdZedg�Zdd�Zdd�Zdd�Zd	d
�Z	ddd
�Z
dd�Zedd��Z
edd��ZdS)�Credentialsa-Base class for all Credentials objects.

    Subclasses must define an authorize() method that applies the credentials
    to an HTTP transport.

    Subclasses must also specify a classmethod named 'from_json' that takes a
    JSON string as input and returns an instantiated Credentials object.
    �storecCst�dS)a�Take an httplib2.Http instance (or equivalent) and authorizes it.

        Authorizes it for the set of credentials, usually by replacing
        http.request() with a method that adds in the appropriate headers and
        then delegates to the original Http.request() method.

        Args:
            http: httplib2.Http, an http object to be used to make the refresh
                  request.
        N��NotImplementedError�r&�httprrr�	authorize�szCredentials.authorizecCst�dS�z�Forces a refresh of the access_token.

        Args:
            http: httplib2.Http, an http object to be used to make the refresh
                  request.
        Nr;r=rrr�refresh�szCredentials.refreshcCst�dS�z�Revokes a refresh_token and makes the credentials void.

        Args:
            http: httplib2.Http, an http object to be used to make the revoke
                  request.
        Nr;r=rrr�revoke�szCredentials.revokecCst�dS)��Add the authorization to the headers.

        Args:
            headers: dict, the headers to add the Authorization header to.
        Nr;�r&�headersrrr�apply�szCredentials.applyNcCs�|j}|dkrt�|j�}n
t�|�}|D]}||kr*||=q*t|�d��|d<|j|d<|j|d<|��D]6\}}t|t	�r�|�
d�||<t|t�rlt|�||<qlt
�|�S)aUtility function that creates JSON repr. of a Credentials object.

        Args:
            strip: array, An array of names of members to exclude from the
                   JSON.
            to_serialize: dict, (Optional) The properties for this object
                          that will be serialized. This allows callers to
                          modify before serializing.

        Returns:
            string, a JSON representation of this instance, suitable to pass to
            from_json().
        N�token_expiry�_class�_modulezutf-8)r*�copy�__dict__r8r%rr�itemsr4�bytes�decode�set�list�json�dumps)r&�stripZto_serializeZ	curr_type�member�key�valrrr�_to_json�s$
�



zCredentials._to_jsoncCs|�|j�S)z�Creating a JSON representation of an instance of Credentials.

        Returns:
            string, a JSON representation of this instance, suitable to pass to
            from_json().
        )rX�NON_SERIALIZED_MEMBERS�r&rrr�to_jsonszCredentials.to_jsoncCs�t�|�}t�|�}|d}zt|�}Wn(tk
rP|�dd�}t|�}YnXt||�d�dd�d�}t||d�}|�	|�S)	aXUtility class method to instantiate a Credentials subclass from JSON.

        Expects the JSON string to have been produced by to_json().

        Args:
            json_data: string or bytes, JSON from to_json().

        Returns:
            An instance of the subclass of Credentials that was serialized with
            to_json().
        rJz.googleapiclient��.N���)�fromlistrI)
r�_from_bytesrR�loads�
__import__�ImportError�replace�split�getattr�	from_json)�cls�	json_dataZjson_data_as_unicode�data�module_nameZ
module_objZklsrrr�
new_from_jsons

�zCredentials.new_from_jsoncCst�S)a(Instantiate a Credentials object from a JSON description of it.

        The JSON should have been produced by calling .to_json() on the object.

        Args:
            unused_data: dict, A deserialized JSON object.

        Returns:
            An instance of a Credentials subclass.
        )r9)rh�unused_datarrrrg<szCredentials.from_json)N)rrrr�	frozensetrYr?rArCrGrXr[�classmethodrlrgrrrrr9�s	

		
#	
r9c@seZdZdZdS)�Flowz Base class for all Flow objects.NrrrrrrpKsrpc@sZeZdZdZddd�Zdd�Zdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
dd�Zdd�ZdS)�Storagez�Base class for all Storage objects.

    Store and retrieve a single credential. This class supports locking
    such that multiple processes and threads can operate on a single
    store.
    NcCs
||_dS)z�Create a Storage instance.

        Args:
            lock: An optional threading.Lock-like object. Must implement at
                  least acquire() and release(). Does not need to be
                  re-entrant.
        N)�_lock)r&�lockrrrr$WszStorage.__init__cCs|jdk	r|j��dS)zaAcquires any lock necessary to access this Storage.

        This lock is not reentrant.
        N)rr�acquirerZrrr�acquire_lockas
zStorage.acquire_lockcCs|jdk	r|j��dS)z�Release the Storage lock.

        Trying to release a lock that isn't held will result in a
        RuntimeError in the case of a threading.Lock or multiprocessing.Lock.
        N)rr�releaserZrrr�release_lockis
zStorage.release_lockcCst�dS)z�Retrieve credential.

        The Storage lock must be held when this is called.

        Returns:
            oauth2client.client.Credentials
        Nr;rZrrr�
locked_getrszStorage.locked_getcCst�dS�z�Write a credential.

        The Storage lock must be held when this is called.

        Args:
            credentials: Credentials, the credentials to store.
        Nr;�r&�credentialsrrr�
locked_put|szStorage.locked_putcCst�dS)zYDelete a credential.

        The Storage lock must be held when this is called.
        Nr;rZrrr�
locked_delete�szStorage.locked_deletecCs$|��z|��W�S|��XdS)z�Retrieve credential.

        The Storage lock must *not* be held when this is called.

        Returns:
            oauth2client.client.Credentials
        N)rurwrxrZrrrr%�szStorage.getcCs&|��z|�|�W5|��XdSry)rurwr|rzrrr�put�szStorage.putcCs$|��z|��W�S|��XdS)z�Delete credential.

        Frees any resources associated with storing the credential.
        The Storage lock must *not* be held when this is called.

        Returns:
            None
        N)rurwr}rZrrr�delete�s	zStorage.delete)N)
rrrrr$rurwrxr|r}r%r~rrrrrrqPs

	

rqc@s�eZdZdZe�d�d2dd��Zdd�Zdd	�Zd
d�Z	dd
�Z
dd�Zdd�Ze
dd��Zedd��Zd3dd�Zdd�Zdd�Zdd�Zdd�Zd d!�Zd"d#�Zd$d%�Zd&d'�Zd(d)�Zd*d+�Zd,d-�Zd.d/�Zd0d1�ZdS)4�OAuth2CredentialsaCredentials object for OAuth 2.0.

    Credentials can be applied to an httplib2.Http object using the authorize()
    method, which then adds the OAuth 2.0 access token to each request.

    OAuth2Credentials objects may be safely pickled and unpickled.
    �NcCsl||_||_||_||_d|_||_||_||_||_|	|_	|
|_
|
|_tt
�|pTg��|_||_d|_dS)a,Create an instance of OAuth2Credentials.

        This constructor is not usually called by the user, instead
        OAuth2Credentials objects are instantiated by the OAuth2WebServerFlow.

        Args:
            access_token: string, access token.
            client_id: string, client identifier.
            client_secret: string, client secret.
            refresh_token: string, refresh token.
            token_expiry: datetime, when the access_token expires.
            token_uri: string, URI of token endpoint.
            user_agent: string, The HTTP User-Agent to provide for this
                        application.
            revoke_uri: string, URI for revoke endpoint. Defaults to None; a
                        token can't be revoked if this is None.
            id_token: object, The identity of the resource owner.
            token_response: dict, the decoded response to the token request.
                            None if a token hasn't been requested yet. Stored
                            because some providers (e.g. wordpress.com) include
                            extra fields that clients may want.
            scopes: list, authorized scopes for these credentials.
            token_info_uri: string, the URI for the token info endpoint.
                            Defaults to None; scopes can not be refreshed if
                            this is None.
            id_token_jwt: string, the encoded and signed identity JWT. The
                          decoded version of this is stored in id_token.

        Notes:
            store: callable, A callable that when passed a Credential
                   will store the credential back to where it came from.
                   This is needed to store the latest access_token if it
                   has expired and been refreshed.
        NF)r
�	client_id�
client_secret�
refresh_tokenr:rH�	token_uri�
user_agent�
revoke_uri�id_token�id_token_jwt�token_responserPr�string_to_scopes�scopes�token_info_uri�invalid)r&r
r�r�r�rHr�r�r�r�r�r�r�r�rrrr$�s'zOAuth2Credentials.__init__cCst�||�|S)a�Authorize an httplib2.Http instance with these credentials.

        The modified http.request method will add authentication headers to
        each request and will refresh access_tokens when a 401 is received on a
        request. In addition the http.request method has a credentials
        property, http.request.credentials, which is the Credentials object
        that authorized it.

        Args:
            http: An instance of ``httplib2.Http`` or something that acts
                  like it.

        Returns:
            A modified instance of http that was passed in.

        Example::

            h = httplib2.Http()
            h = credentials.authorize(h)

        You can't create a new OAuth subclass of httplib2.Authentication
        because it never gets passed the absolute URI, which is needed for
        signing. So instead we have to overload 'request' with a closure
        that adds in the Authorization header and then calls the original
        version of 'request()'.
        )rZwrap_http_for_authr=rrrr?�szOAuth2Credentials.authorizecCs|�|�dSr@)�_refreshr=rrrrAszOAuth2Credentials.refreshcCs|�|�dSrB)�_revoker=rrrrC#szOAuth2Credentials.revokecCsd|j|d<dS)rDzBearer �
AuthorizationN)r
rErrrrG,szOAuth2Credentials.applycCst�|�}t|��|j�S)akVerify that the credentials are authorized for the given scopes.

        Returns True if the credentials authorized scopes contain all of the
        scopes given.

        Args:
            scopes: list or string, the scopes to check.

        Notes:
            There are cases where the credentials are unaware of which scopes
            are authorized. Notably, credentials obtained and stored before
            this code was added will not have scopes, AccessTokenCredentials do
            not have scopes. In both cases, you can use refresh_scopes() to
            obtain the canonical set of scopes.
        )rr�rP�issubsetr��r&r�rrr�
has_scopes4s
zOAuth2Credentials.has_scopescCs|�|�|jS)aJRetrieves the canonical list of scopes for this access token.

        Gets the scopes from the OAuth2 provider.

        Args:
            http: httplib2.Http, an http object to be used to make the refresh
                  request.

        Returns:
            A set of strings containing the canonical list of scopes.
        )�_retrieve_scopesr�r=rrr�retrieve_scopesGs
z!OAuth2Credentials.retrieve_scopescCs�t�t�|��}|�d�rbt|dtj�sbztj�|dt�|d<Wnt	k
r`d|d<YnX||d|d|d|d|d|d|d|�d	d�|�d
d�|�dd�|�dd�|�d
d�|�dd�d�
}|d|_
|S)a*Instantiate a Credentials object from a JSON description of it.

        The JSON should have been produced by calling .to_json() on the object.

        Args:
            json_data: string or bytes, JSON to deserialize.

        Returns:
            An instance of a Credentials subclass.
        rHNr
r�r�r�r�r�r�r�r�r�r�r��r�r�r�r�r�r�r�)rRrarr`r%r4r5�strptimer7�
ValueErrorr��rhrirj�retvalrrrrgVs8
��





�
zOAuth2Credentials.from_jsoncCs<|jr
dS|jsdSt�}||jkr8t�d||j�dSdS)z�True if the credential is expired or invalid.

        If the token_expiry isn't set, we assume the token doesn't expire.
        TFz2access_token is expired. Now: %s, token_expiry: %s)r�rH�_UTCNOW�logger�info)r&�nowrrr�access_token_expired{s
�z&OAuth2Credentials.access_token_expiredcCs4|jr|jr"|st��}|�|�t|j|��d�S)z�Return the access token and its expiration information.

        If the token does not exist, get one.
        If the token expired, refresh it.
        )r
r)r
r�r�get_http_objectrAr�_expires_inr=rrr�get_access_token�s
�z"OAuth2Credentials.get_access_tokencCs
||_dS)avSet the Storage for the credential.

        Args:
            store: Storage, an implementation of Storage object.
                   This is needed to store the latest access_token if it
                   has expired and been refreshed. This implementation uses
                   locking to check for updates before updating the
                   access_token.
        N)r:)r&r:rrr�	set_store�s
zOAuth2Credentials.set_storecCs8|jr4t�}|j|kr0|j|}|jd|jSdSdS)a~Return the number of seconds until this token expires.

        If token_expiry is in the past, this method will return 0, meaning the
        token has already expired.

        If token_expiry is None, this method will return None. Note that
        returning 0 in such a case would not be fair: the token may still be
        valid; we just don't know anything about it.
        i�QrN)rHr��days�seconds)r&r�Z
time_deltarrrr��s


zOAuth2Credentials._expires_incCs|j�|���dS)z-Update this Credential from another instance.N)rL�update�__getstate__)r&�otherrrr�_updateFromCredential�sz'OAuth2Credentials._updateFromCredentialcCst�|j�}|d=|S)z5Trim the state down to something that can be pickled.r:)rKrL)r&�drrrr��szOAuth2Credentials.__getstate__cCs|j�|�d|_dS)z8Reconstitute the state of the object from being pickled.N)rLr�r:)r&�staterrr�__setstate__�szOAuth2Credentials.__setstate__cCs tj�d|j|j|jd��}|S)z;Generate the body that will be used in the refresh request.r�)�
grant_typer�r�r�)r�parse�	urlencoder�r�r�)r&�bodyrrr�_generate_refresh_request_body�s�z0OAuth2Credentials._generate_refresh_request_bodycCs ddi}|jdk	r|j|d<|S)z>Generate the headers that will be used in the refresh request.�content-type�!application/x-www-form-urlencodedN�
user-agent)r�rErrr�!_generate_refresh_request_headers�s�

z3OAuth2Credentials._generate_refresh_request_headerscCsx|js|�|�nb|j��zJ|j��}|rZ|jsZ|j|jkrZ|jsZt�	d�|�
|�n
|�|�W5|j��XdS)ayRefreshes the access_token.

        This method first checks by reading the Storage object if available.
        If a refresh is still needed, it holds the Storage lock until the
        refresh is completed.

        Args:
            http: an object to be used to make HTTP requests.

        Raises:
            HttpAccessTokenRefreshError: When the refresh fails.
        z&Updated access_token read from StorageN)r:�_do_refresh_requestrurwrxr�r
r�r�r�r�)r&r>Znew_credrrrr��s




��
zOAuth2Credentials._refreshc		Cs�|��}|��}t�d�tj||jd||d�\}}t�|�}|j	t
jkr�t�
|�}||_|d|_|�d|j�|_d|kr�tjt|d�d�}|t�|_nd|_d	|kr�t|d	�|_|d	|_nd|_d|_d
|_|jr�|j�|�n�t�d|�d�|j	�}zXt�
|�}d
|k�rZ|d
}d|k�r<|d|d7}d|_|jdk	�rZ|j�|�Wnttfk
�rvYnXt ||j	d��dS)z�Refresh the access_token using the refresh_token.

        Args:
            http: an object to be used to make HTTP requests.

        Raises:
            HttpAccessTokenRefreshError: When the refresh fails.
        zRefreshing access_token�POST��methodr�rFr
r�r�r�Nr�F�#Failed to retrieve access token: %s�Invalid response {0}.�error�error_description�: T)r")!r�r�r�r�r�requestr�rr`r"r�OKrRrar�r
r%r�r5�	timedelta�intr�rH�_extract_id_tokenr�r�r�r:r|�format�	TypeErrorr�r!)	r&r>r�rF�resp�contentr��delta�	error_msgrrrr��sT	
�






z%OAuth2Credentials._do_refresh_requestcCs|�||jp|j�dS)z�Revokes this credential and deletes the stored copy (if it exists).

        Args:
            http: an object to be used to make HTTP requests.
        N)�
_do_revoker�r
r=rrrr�5szOAuth2Credentials._revokec
	Cs�t�d�d|i}t�|j|�}t�||�\}}|jtj	kr^t
j�|�}tj||d|d�\}}|jtj
krrd|_nRd�|j�}z$t�t�|��}	d|	kr�|	d}Wnttfk
r�YnXt|��|jr�|j��dS)	a�Revokes this credential and deletes the stored copy (if it exists).

        Args:
            http: an object to be used to make HTTP requests.
            token: A string used as the token to be revoked. Can be either an
                   access_token or refresh_token.

        Raises:
            TokenRevokeError: If the revoke request does not return with a
                              200 OK.
        zRevoking token�tokenr�)r�r�Tr�r�N)r�r�r�update_query_paramsr�rr�r"r�METHOD_NOT_ALLOWEDrr�r�r�r�r�rRrar`r�r�r,r:r)
r&r>r��query_paramsZtoken_revoke_urir�r�r�r�r�rrrr�=s2
��
zOAuth2Credentials._do_revokecCs|�||j�dS)z�Retrieves the list of authorized scopes from the OAuth2 provider.

        Args:
            http: an object to be used to make HTTP requests.
        N)�_do_retrieve_scopesr
r=rrrr�asz"OAuth2Credentials._retrieve_scopesc		Cs�t�d�|dd�}t�|j|�}t�||�\}}t�|�}|jt	j
krlt�|�}t
t�|�dd���|_nLd�|j�}zt�|�}d|kr�|d}Wnttfk
r�YnXt|��dS)a|Retrieves the list of authorized scopes from the OAuth2 provider.

        Args:
            http: an object to be used to make HTTP requests.
            token: A string used as the token to identify the credentials to
                   the provider.

        Raises:
            Error: When refresh fails, indicating the the access token is
                   invalid.
        zRefreshing scopes�scope)r
�fieldsr\r�r�N)r�r�rr�r�rr�r`r"rr�rRrarPr�r%r�r�r�r�r)	r&r>r�r�r�r�r�r�r�rrrr�is&

�


z%OAuth2Credentials._do_retrieve_scopes)NNNNNN)N)rrrrr�
positionalr$r?rArCrGr�r�rorg�propertyr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrrr��sB�9		
$



8$r�cs>eZdZdZd�fdd�	Zedd��Zdd�Zd	d
�Z�Z	S)�AccessTokenCredentialsa�Credentials object for OAuth 2.0.

    Credentials can be applied to an httplib2.Http object using the
    authorize() method, which then signs each request from that object
    with the OAuth 2.0 access token. This set of credentials is for the
    use case where you have acquired an OAuth 2.0 access_token from
    another place such as a JavaScript client or another web
    application, and wish to use it from Python. Because only the
    access_token is present it can not be refreshed and will in time
    expire.

    AccessTokenCredentials objects may be safely pickled and unpickled.

    Usage::

        credentials = AccessTokenCredentials('<an access token>',
            'my-user-agent/1.0')
        http = httplib2.Http()
        http = credentials.authorize(http)

    Raises:
        AccessTokenCredentialsExpired: raised when the access_token expires or
                                       is revoked.
    Nc
s$tt|�j|ddddd||d�dS)a�Create an instance of OAuth2Credentials

        This is one of the few types if Credentials that you should contrust,
        Credentials objects are usually instantiated by a Flow.

        Args:
            access_token: string, access token.
            user_agent: string, The HTTP User-Agent to provide for this
                        application.
            revoke_uri: string, URI for revoke endpoint. Defaults to None; a
                        token can't be revoked if this is None.
        N�r�)r#r�r$)r&r
r�r�r)rrr$�s
�zAccessTokenCredentials.__init__cCs&t�t�|��}t|d|d�}|S)Nr
r�)rRrarr`r�r�rrrrg�s�z AccessTokenCredentials.from_jsoncCstd��dS)z�Refreshes the access token.

        Args:
            http: unused HTTP object.

        Raises:
            AccessTokenCredentialsError: always
        z>The access_token is expired or invalid and can't be refreshed.N)r.r=rrrr��s	�zAccessTokenCredentials._refreshcCs|�||j�dS�z�Revokes the access_token and deletes the store if available.

        Args:
            http: an object to be used to make HTTP requests.
        N�r�r
r=rrrr��szAccessTokenCredentials._revoke)N)
rrrrr$rorgr�r�r+rrr)rr��s
r�cCsdtjtd�}z0tj|ttd�\}}|jtjko:|�	t
�tkWStj
k
r^t�d�YdSXdS)z�Determine if the current environment is Compute Engine.

    Returns:
        Boolean indicating whether or not the current environment is Google
        Compute Engine.
    )�timeout)rFz1Timeout attempting to reach GCE metadata service.FN)rr�rr��_GCE_METADATA_URI�_GCE_HEADERSr"rr�r%�_METADATA_FLAVOR_HEADER�_DESIRED_METADATA_FLAVOR�socketr�r�r�)r>�response�_rrr�_detect_gce_environment�s
�
�
r�cCsptjdk	rtjdkSzddl}Wntk
r4Yn8Xtj�td�}|�d�rXdt_dS|�d�rld	t_dSd
S)z�Detects if the code is running in the App Engine environment.

    Returns:
        True if running in the GAE environment, False otherwise.
    N)�GAE_PRODUCTION�	GAE_LOCALrr\zGoogle App Engine/r�TzDevelopment/r�F)	rrZgoogle.appenginerc�os�environr%�_SERVER_SOFTWARE�
startswith)ZgoogleZserver_softwarerrr�_in_gae_environment�s



r�cCs0tjdk	rtjdkStdkr,t�r,dt_dSdS)z�Detect if the code is running in the Compute Engine environment.

    Returns:
        True if running in the GCE environment, False otherwise.
    NZGCE_PRODUCTION�TrueTF)rrrr�rrrr�_in_gce_environment	s

r�cs�eZdZdZedg�ejBZejf�fdd�	Z	dd�Z
dd�Zed	d
��Z
edd��Zed
d��Zedd��Zedd��Zedd��Zedd��Zedd��Z�ZS)�GoogleCredentialsa|Application Default Credentials for use in calling Google APIs.

    The Application Default Credentials are being constructed as a function of
    the environment where the code is being run.
    More details can be found on this page:
    https://developers.google.com/accounts/docs/application-default-credentials

    Here is an example of how to use the Application Default Credentials for a
    service that requires authentication::

        from googleapiclient.discovery import build
        from oauth2client.client import GoogleCredentials

        credentials = GoogleCredentials.get_application_default()
        service = build('compute', 'v1', credentials=credentials)

        PROJECT = 'bamboo-machine-422'
        ZONE = 'us-central1-a'
        request = service.instances().list(project=PROJECT, zone=ZONE)
        response = request.execute()

        print(response)
    Z_private_keyc		
s$tt|�j||||||||d�dS)a�Create an instance of GoogleCredentials.

        This constructor is not usually called by the user, instead
        GoogleCredentials objects are instantiated by
        GoogleCredentials.from_stream() or
        GoogleCredentials.get_application_default().

        Args:
            access_token: string, access token.
            client_id: string, client identifier.
            client_secret: string, client secret.
            refresh_token: string, refresh token.
            token_expiry: datetime, when the access_token expires.
            token_uri: string, URI of token endpoint.
            user_agent: string, The HTTP User-Agent to provide for this
                        application.
            revoke_uri: string, URI for revoke endpoint. Defaults to
                        oauth2client.GOOGLE_REVOKE_URI; a token can't be
                        revoked if this is None.
        r�N)r#r�r$)	r&r
r�r�r�rHr�r�r�r)rrr$6s
�zGoogleCredentials.__init__cCsdS)z�Whether this Credentials object is scopeless.

        create_scoped(scopes) method needs to be called in order to create
        a Credentials object for API calls.
        FrrZrrr�create_scoped_requiredQsz(GoogleCredentials.create_scoped_requiredcCs|S)zfCreate a Credentials object for the given scopes.

        The Credentials type is preserved.
        rr�rrr�
create_scopedYszGoogleCredentials.create_scopedcCs�ddlm}t�t�|��}|ddkr@|ddkr@|j�|�S|ddkrd|ddkrd|j�|�St	|�
d��}||d	|d
|d|d||d
|d|�
dd�d�}|d|_|S)Nr�r
rJzoauth2client.service_accountrI�ServiceAccountCredentials�_JWTAccessCredentialsrHr
r�r�r�r�r�r�r�r�)�oauth2clientr
rRrarr`r�rgr�r8r%r�)rhrir
rjrHZgoogle_credentialsrrrrg`s.
�
�
�	
zGoogleCredentials.from_jsoncCsd|j|j|jd�S)z>Get the fields and values identifying the current credentials.r	)�typer�r�r�)r�r�r�rZrrr�serialization_data}s
�z$GoogleCredentials.serialization_datacCst�s
dSt�S)asAttempts to get implicit credentials in Google App Engine env.

        If the current environment is not detected as App Engine, returns None,
        indicating no Google App Engine credentials can be detected from the
        current environment.

        Returns:
            None, if not in GAE, else an appengine.AppAssertionCredentials
            object.
        N)r��'_get_application_default_credential_GAErrrr�_implicit_credentials_from_gae�sz0GoogleCredentials._implicit_credentials_from_gaecCst�s
dSt�S)alAttempts to get implicit credentials in Google Compute Engine env.

        If the current environment is not detected as Compute Engine, returns
        None, indicating no Google Compute Engine credentials can be detected
        from the current environment.

        Returns:
            None, if not in GCE, else a gce.AppAssertionCredentials object.
        N)r��'_get_application_default_credential_GCErrrr�_implicit_credentials_from_gce�sz0GoogleCredentials._implicit_credentials_from_gcec
Cs�t�}|s(t�}tj�|�r"d}q4d}ndtd}|s<dStt_z
t	|�WSt
tfk
r~}zt|||�W5d}~XYnXdS)asAttempts to get implicit credentials from local credential files.

        First checks if the environment variable GOOGLE_APPLICATION_CREDENTIALS
        is set with a filename and then falls back to a configuration file (the
        "well known" file) associated with the 'gcloud' command line tool.

        Returns:
            Credentials object associated with the
            GOOGLE_APPLICATION_CREDENTIALS file or the "well known" file if
            either exist. If neither file is define, returns None, indicating
            no credentials from a file can detected from the current
            environment.
        zB (produced automatically when running "gcloud auth login" command)Nz (pointed to by z environment variable))
�_get_environment_variable_file�_get_well_known_filer��path�isfiler�DEFAULT_ENV_NAMErr�-_get_application_default_credential_from_filer1r��!_raise_exception_for_reading_json)Zcredentials_filename�
extra_helpr�rrr� _implicit_credentials_from_files�s*���z2GoogleCredentials._implicit_credentials_from_filescCs<|j|j|jg}|D]}|�}|dk	r|Sqtt��dS)aMGets credentials implicitly from the environment.

        Checks environment in order of precedence:
        - Environment variable GOOGLE_APPLICATION_CREDENTIALS pointing to
          a file with stored credentials information.
        - Stored "well known" file associated with `gcloud` command line tool.
        - Google App Engine (production and testing)
        - Google Compute Engine production environment.

        Raises:
            ApplicationDefaultCredentialsError: raised when the credentials
                                                fail to be retrieved.
        N)rr�r�r1�ADC_HELP_MSG)rhZenviron_checkers�checkerr{rrr�_get_implicit_credentials�s�
z+GoogleCredentials._get_implicit_credentialscCst��S)z�Get the Application Default Credentials for the current environment.

        Raises:
            ApplicationDefaultCredentialsError: raised when the credentials
                                                fail to be retrieved.
        )r�rrrrr�get_application_default�sz)GoogleCredentials.get_application_defaultc
Cs`|rTtj�|�rTz
t|�WSttfk
rP}zd}t|||�W5d}~XYq\Xntd��dS)a�Create a Credentials object by reading information from a file.

        It returns an object of type GoogleCredentials.

        Args:
            credential_filename: the path to the file from where the
                                 credentials are to be read

        Raises:
            ApplicationDefaultCredentialsError: raised when the credentials
                                                fail to be retrieved.
        z4 (provided as parameter to the from_stream() method)NzHThe parameter passed to the from_stream() method should point to a file.)r�r�r�r�r1r�r�)Zcredential_filenamer�rrrr�from_stream�s���zGoogleCredentials.from_stream)rrrrrnr�rYr��GOOGLE_REVOKE_URIr$r�r�rorgr�r��staticmethodr�r�rrrrr+rrr)rr�s2���

	


(

	r�c	CsZt��}t�|tjtjBd�}t�|d��}tj||dddd�W5QRXt	�
||�dS)z�Saves a file with read-write permissions on for the owner.

    Args:
        filename: String. Absolute path to file.
        json_contents: JSON serializable object to be saved.
    i��wT�)�,r�)�	sort_keys�indent�
separatorsN)�tempfile�mktempr��open�O_WRONLY�O_CREAT�fdopenrR�dump�shutil�move)�filenameZ
json_contentsZ
temp_filenameZ	file_descZfile_handlerrr�_save_private_files
�rcCsH|dkrt�}tj�|�}tj�|�s4td�|���|j}t||�dS)a�Save the provided GoogleCredentials to the well known file.

    Args:
        credentials: the credentials to be saved to the well known file;
                     it should be an instance of GoogleCredentials
        well_known_file: the name of the file where the credentials are to be
                         saved; this parameter is supposed to be used for
                         testing only
    Nz$Config directory does not exist: {0})	r�r�r��dirname�isdir�OSErrorr�r�r)r{Zwell_known_fileZ
config_dirZcredentials_datarrr�save_to_well_known_file&s
�rcCs>tj�td�}|r:tj�|�r"|Std|dtd��dS)NzFile z
 (pointed by z& environment variable) does not exist!)r�r�r%rr�r�r1)Z'application_default_credential_filenamerrrr�?s�����r�cCs�t�t�}|dkr�tjdkrjztj�tjdt�}Wq�tk
rftj�	dd�}tj�|dt�}Yq�Xntj�tj�
d�dt�}tj�|t�S)	z@Get the well known file produced by command 'gcloud auth login'.N�nt�APPDATAZSystemDrivezC:�\�~z.config)r��getenv�_CLOUDSDK_CONFIG_ENV_VAR�namer��joinr��_CLOUDSDK_CONFIG_DIRECTORY�KeyErrorr%�
expanduser�_WELL_KNOWN_CREDENTIALS_FILE)Zdefault_config_dir�driverrrr�Ns"

�
��r�c	Cs�t|��}t�|�}W5QRX|�d�}|tkr@tdddg�}n2|tkrZtddddg�}ntdtd	td
��|�|�	��}|r�t
|�|dtkr�td|d|d|ddtj
dd
�Sddlm}|j�|�SdS)z4Build the Application Default Credentials from file.r�r�r�r�Zclient_emailZprivate_key_idZprivate_keyz5'type' field should be defined (and have one of the 'z' or 'z	' values)NzPython client library)r
r�r�r�rHr�r�rr�)rrR�loadr%�AUTHORIZED_USERrP�SERVICE_ACCOUNTr1�
difference�keys�#_raise_exception_for_missing_fieldsr�r��GOOGLE_TOKEN_URIr
r�Zfrom_json_keyfile_dict)rZfile_objZclient_credentialsZcredentials_typeZrequired_fields�missing_fieldsr
rrrr�fsJ

�������	�r�cCstdd�|���dS)Nz(The following field(s) must be defined: z, )r1r%)r2rrrr0�s�r0cCs td||dt|���dS)Nz2An error was encountered while reading json file: r�)r1�str)Zcredential_filerr�rrrr��s�����r�cCsddlm}|g�S�Nr��AppAssertionCredentials)Zoauth2client.contrib.appenginer6r5rrrr��sr�cCsddlm}|�Sr4)Zoauth2client.contrib.gcer6r5rrrr��sr�csVeZdZdZe�d�dejejf�fdd�	�Z	dd�Z
dd	�Zd
d�Zdd
�Z
�ZS)�AssertionCredentialsa�Abstract Credentials object used for OAuth 2.0 assertion grants.

    This credential does not require a flow to instantiate because it
    represents a two legged flow, and therefore has all of the required
    information to generate and refresh its own access tokens. It must
    be subclassed to generate the appropriate assertion string.

    AssertionCredentials objects may be safely pickled and unpickled.
    r
Nc
s*tt|�jddddd|||d�||_dS)aConstructor for AssertionFlowCredentials.

        Args:
            assertion_type: string, assertion type that will be declared to the
                            auth server
            user_agent: string, The HTTP User-Agent to provide for this
                        application.
            token_uri: string, URI for token endpoint. For convenience defaults
                       to Google's endpoints but any OAuth 2.0 provider can be
                       used.
            revoke_uri: string, URI for revoke endpoint.
        Nr�)r#r7r$�assertion_type)r&r8r�r�r�Z
unused_kwargsr)rrr$�s
�	zAssertionCredentials.__init__cCs|��}tj�|dd��}|S)Nz+urn:ietf:params:oauth:grant-type:jwt-bearer)�	assertionr�)�_generate_assertionrr�r�)r&r9r�rrrr��s�z3AssertionCredentials._generate_refresh_request_bodycCst�dS)zAGenerate assertion string to be used in the access token request.Nr;rZrrrr:�sz(AssertionCredentials._generate_assertioncCs|�||j�dSr�r�r=rrrr��szAssertionCredentials._revokecCstd��dS)z�Cryptographically sign a blob (of bytes).

        Args:
            blob: bytes, Message to be signed.

        Returns:
            tuple, A pair of the private key ID used to sign the blob and
            the signed contents.
        zThis method is abstract.Nr;)r&Zblobrrr�	sign_blob�s
zAssertionCredentials.sign_blob)rrrrrr�r�r1rr$r�r:r�r;r+rrr)rr7�s
�
r7cCststd��dS)z�Ensure we have a crypto library, or throw CryptoUnavailableError.

    The oauth2client.crypt module requires either PyCrypto or PyOpenSSL
    to be available in order to function, but these are optional
    dependencies.
    zNo crypto library availableN)�
HAS_CRYPTOr3rrrr�_require_crypto_or_die�sr=r
cCsdt�|dkrt��}t�||�\}}|jtjkrPt�t	�
|��}t�|||�St
d�|j���dS)a�Verifies a signed JWT id_token.

    This function requires PyOpenSSL and because of that it does not work on
    App Engine.

    Args:
        id_token: string, A Signed JWT.
        audience: string, The audience 'aud' that the token should be for.
        http: httplib2.Http, instance to use to make the HTTP request. Callers
              should supply an instance that has caching enabled.
        cert_uri: string, URI of the certificates in JSON format to
                  verify the JWT against.

    Returns:
        The deserialized JSON in the JWT.

    Raises:
        oauth2client.crypt.AppIdentityError: if the JWT fails to verify.
        CryptoUnavailableError: if no crypto library is available.
    NzStatus code: {0})r=rZget_cached_httpr�r"rr�rRrarr`rZverify_signed_jwt_with_certsr/r�)r�Zaudiencer>Zcert_urir�r��certsrrr�verify_id_token�sr?cCsVt|�tkr|�d�}n
|�d�}t|�dkr<td�|���t�t�	t�
|d���S)z�Extract the JSON payload from a JWT.

    Does the extraction w/o checking the signature.

    Args:
        id_token: string or bytestring, OAuth 2.0 id_token.

    Returns:
        object, The deserialized JSON payload.
    �.r]rz&Wrong number of segments in token: {0}�)r�rNre�lenr/r�rRrarr`Z_urlsafe_b64decode)r��segmentsrrrr�s
��r�cCsZi}t�|�}zt�|�}Wntk
r:t�|�}YnX|rVd|krV|�d�|d<|S)aMParses response of an exchange token request.

    Most providers return JSON but some (e.g. Facebook) return a
    url-encoded string.

    Args:
        content: The body of a response

    Returns:
        Content as a dictionary object. Note that the dict could be empty,
        i.e. {}. That basically indicates a failure.
    �expiresr)rr`rRra�	ExceptionZparse_unique_urlencoded�pop)r�r�rrr�_parse_exchange_token_response4s

rG��postmessagecCs2t||||||||	|
|||
d�}|j||d�}|S)aExchanges an authorization code for an OAuth2Credentials object.

    Args:
        client_id: string, client identifier.
        client_secret: string, client secret.
        scope: string or iterable of strings, scope(s) to request.
        code: string, An authorization code, most likely passed down from
              the client
        redirect_uri: string, this is generally set to 'postmessage' to match
                      the redirect_uri that the client specified
        http: httplib2.Http, optional http instance to use to do the fetch
        token_uri: string, URI for token endpoint. For convenience defaults
                   to Google's endpoints but any OAuth 2.0 provider can be
                   used.
        auth_uri: string, URI for authorization endpoint. For convenience
                  defaults to Google's endpoints but any OAuth 2.0 provider
                  can be used.
        revoke_uri: string, URI for revoke endpoint. For convenience
                    defaults to Google's endpoints but any OAuth 2.0 provider
                    can be used.
        device_uri: string, URI for device authorization endpoint. For
                    convenience defaults to Google's endpoints but any OAuth
                    2.0 provider can be used.
        pkce: boolean, default: False, Generate and include a "Proof Key
              for Code Exchange" (PKCE) with your authorization and token
              requests. This adds security for installed applications that
              cannot protect a client_secret. See RFC 7636 for details.
        code_verifier: bytestring or None, default: None, parameter passed
                       as part of the code exchange when pkce=True. If
                       None, a code_verifier will automatically be
                       generated as part of step1_get_authorize_url(). See
                       RFC 7636 for details.

    Returns:
        An OAuth2Credentials object.

    Raises:
        FlowExchangeError if the authorization code cannot be exchanged for an
        access token
    )	�redirect_urir��auth_urir�r��
device_urir��pkce�
code_verifier�r>)�OAuth2WebServerFlow�step2_exchange)r�r�r��coderJr>r�r�rKr�rLr�rMrN�flowr{rrr�credentials_from_codeQs3�rTc
Cs&t||||||d�}|j||d�}	|	S)a	Returns OAuth2Credentials from a clientsecrets file and an auth code.

    Will create the right kind of Flow based on the contents of the
    clientsecrets file or will raise InvalidClientSecretsError for unknown
    types of Flows.

    Args:
        filename: string, File name of clientsecrets.
        scope: string or iterable of strings, scope(s) to request.
        code: string, An authorization code, most likely passed down from
              the client
        message: string, A friendly string to display to the user if the
                 clientsecrets file is missing or invalid. If message is
                 provided then sys.exit will be called in the case of an error.
                 If message in not provided then
                 clientsecrets.InvalidClientSecretsError will be raised.
        redirect_uri: string, this is generally set to 'postmessage' to match
                      the redirect_uri that the client specified
        http: httplib2.Http, optional http instance to use to do the fetch
        cache: An optional cache service client that implements get() and set()
               methods. See clientsecrets.loadfile() for details.
        device_uri: string, OAuth 2.0 device authorization endpoint
        pkce: boolean, default: False, Generate and include a "Proof Key
              for Code Exchange" (PKCE) with your authorization and token
              requests. This adds security for installed applications that
              cannot protect a client_secret. See RFC 7636 for details.
        code_verifier: bytestring or None, default: None, parameter passed
                       as part of the code exchange when pkce=True. If
                       None, a code_verifier will automatically be
                       generated as part of step1_get_authorize_url(). See
                       RFC 7636 for details.

    Returns:
        An OAuth2Credentials object.

    Raises:
        FlowExchangeError: if the authorization code cannot be exchanged for an
                           access token
        UnknownClientSecretsFlowError: if the file describes an unknown kind
                                       of Flow.
        clientsecrets.InvalidClientSecretsError: if the clientsecrets file is
                                                 invalid.
    )�message�cacherJrLrO)�flow_from_clientsecretsrQ)
rr�rRrUrJr>rVrLrSr{rrr�'credentials_from_clientsecrets_and_code�s2�rXc@seZdZdZedd��ZdS)�DeviceFlowInfoz5Intermediate information the OAuth2 for devices flow.cCs�|d|dd�}|�d|�d��}|dkr4td��||d<|�|�d�dd	��d
|krxt�tjt|d
�d�|d<|f|�S)
z�Create a DeviceFlowInfo from a server response.

        The response should be a dict containing entries as described here:

        http://tools.ietf.org/html/draft-ietf-oauth-v2-05#section-3.7.1
        �device_code�	user_code)rZr[�verification_urlZverification_uriNz/No verification_url provided in server response�interval)r]�user_code_expiryrr�r^)r%r2r�r�r5r�r�)rhr�r(r\rrr�FromResponse�s,
������zDeviceFlowInfo.FromResponseN)rrrrror_rrrrrY�srY)rZr[r]r\r^cCsTddd�}|�|�|�d�}|dk	rPt�d�|dkrPt�d�d	|d
<|d=|S)z;Configures redirect URI parameters for OAuth2WebServerFlow.ZofflinerR)Zaccess_typeZ
response_type�approval_promptNzmThe approval_prompt parameter for OAuth2WebServerFlow is deprecated. Please use the prompt parameter instead.�forcez=approval_prompt="force" has been adjusted to prompt="consent"Zconsent�prompt)r�r%r��warning)r(�paramsr`rrr�_oauth2_web_server_flow_params�s �

��rec@s�eZdZdZe�d�ddddejejej	dej
ejdddf
dd��Ze�d�ddd	��Z
e�d�dd
d��Ze�d�dd
d��ZdS)rPzrDoes the Web Server Flow for OAuth 2.0.

    OAuth2WebServerFlow objects may be safely pickled and unpickled.
    rHNFcKsx|dkrtd��||_||_t�|�|_||_|	|_||_||_	||_
||_|
|_||_
||_|
|_||_t|�|_dS)a~Constructor for OAuth2WebServerFlow.

        The kwargs argument is used to set extra query parameters on the
        auth_uri. For example, the access_type and prompt
        query parameters can be set via kwargs.

        Args:
            client_id: string, client identifier.
            client_secret: string client secret.
            scope: string or iterable of strings, scope(s) of the credentials
                   being requested.
            redirect_uri: string, Either the string 'urn:ietf:wg:oauth:2.0:oob'
                          for a non-web-based application, or a URI that
                          handles the callback from the authorization server.
            user_agent: string, HTTP User-Agent to provide for this
                        application.
            auth_uri: string, URI for authorization endpoint. For convenience
                      defaults to Google's endpoints but any OAuth 2.0 provider
                      can be used.
            token_uri: string, URI for token endpoint. For convenience
                       defaults to Google's endpoints but any OAuth 2.0
                       provider can be used.
            revoke_uri: string, URI for revoke endpoint. For convenience
                        defaults to Google's endpoints but any OAuth 2.0
                        provider can be used.
            login_hint: string, Either an email address or domain. Passing this
                        hint will either pre-fill the email box on the sign-in
                        form or select the proper multi-login session, thereby
                        simplifying the login flow.
            device_uri: string, URI for device authorization endpoint. For
                        convenience defaults to Google's endpoints but any
                        OAuth 2.0 provider can be used.
            authorization_header: string, For use with OAuth 2.0 providers that
                                  require a client to authenticate using a
                                  header value instead of passing client_secret
                                  in the POST body.
            pkce: boolean, default: False, Generate and include a "Proof Key
                  for Code Exchange" (PKCE) with your authorization and token
                  requests. This adds security for installed applications that
                  cannot protect a client_secret. See RFC 7636 for details.
            code_verifier: bytestring or None, default: None, parameter passed
                           as part of the code exchange when pkce=True. If
                           None, a code_verifier will automatically be
                           generated as part of step1_get_authorize_url(). See
                           RFC 7636 for details.
            **kwargs: dict, The keyword arguments are all optional and required
                      parameters for the OAuth calls.
        Nz#The value of scope must not be None)r�r�r�rZscopes_to_stringr�rJ�
login_hintr�rKr�r�rLr��authorization_headerrrNrerd)r&r�r�r�rJr�rKr�r�rfrLr�rgrMrNr(rrrr$s"BzOAuth2WebServerFlow.__init__rAcCs�|dk	rt�d�||_|jdkr*td��|j|j|jd�}|dk	rL||d<|jdk	r`|j|d<|jr�|jsvt��|_t�	|j�}||d<d|d	<|�
|j�t�
|j|�S)
a�Returns a URI to redirect to the provider.

        Args:
            redirect_uri: string, Either the string 'urn:ietf:wg:oauth:2.0:oob'
                          for a non-web-based application, or a URI that
                          handles the callback from the authorization server.
                          This parameter is deprecated, please move to passing
                          the redirect_uri in via the constructor.
            state: string, Opaque state string which is passed through the
                   OAuth2 flow and returned to the client as a query parameter
                   in the callback.

        Returns:
            A URI as a string to redirect the user to begin the authorization
            flow.
        Nz�The redirect_uri parameter for OAuth2WebServerFlow.step1_get_authorize_url is deprecated. Please move to passing the redirect_uri in via the constructor.z+The value of redirect_uri must not be None.)r�rJr�r�rf�code_challengeZS256Zcode_challenge_method)r�rcrJr�r�r�rfrrNrhr�rdrr�rK)r&rJr�r��	challengerrr�step1_get_authorize_urlgs.�
�


z+OAuth2WebServerFlow.step1_get_authorize_urlc

Cs*|jdkrtd��tj�|j|jd��}ddi}|jdk	rD|j|d<|dkrTt�	�}tj
||jd||d�\}}t�|�}|j
tjkr�zt�|�}Wn2tk
r�}ztd	�||���W5d}~XYnXt�|�Sd
�|j
�}z*t�|�}	d|	k�r|d�|	d�7}Wntk
�rYnXt|��dS)
z�Returns a user code and the verification URL where to enter it

        Returns:
            A user code as a string for the user to authorize the application
            An URL as a string where the user has to enter the code
        Nz)The value of device_uri must not be None.)r�r�r�r�r�r�r�z<Could not parse server response as JSON: "{0}", error: "{1}"r�r�z Error: {0})rLr�rr�r�r�r�r�rr�r�rr`r"rr�rRrar2r�rYr_)
r&r>r�rFr�r�Z	flow_info�excr�Z
error_dictrrr�step1_get_device_and_user_codes�sP
��

�

��


z3OAuth2WebServerFlow.step1_get_device_and_user_codesr
cCsT|dkr|dkrtd��|dk	r0|dk	r0td��|dkr@|j}n2t|tjtjf�srd|krjt|�dd���|d}|j||j	d�}|j
dk	r�|j
|d<|jr�|j|d	<|dk	r�d
|d<nd|d<|j
|d
<tj�|�}ddi}|jdk	r�|j|d<|jdk	�r|j|d<|dk�rt��}tj||jd||d�\}}t|�}	|jtjk�rd|	k�r|	d}
|	�dd�}|�sxt�d�d}d|	k�r�tjt|	d�d�}
|
t �}d}d}d|	k�r�t!|	d�}|	d}t�d�t"|
|j|j
|||j|j|j#|||	|j	|j$d�
St�d|�d|	k�r8t%|	d�t%|	�dd��}nd�&t%|j��}t|��dS) a�Exchanges a code for OAuth2Credentials.

        Args:
            code: string, a dict-like object, or None. For a non-device
                  flow, this is either the response code as a string, or a
                  dictionary of query parameters to the redirect_uri. For a
                  device flow, this should be None.
            http: httplib2.Http, optional http instance to use when fetching
                  credentials.
            device_flow_info: DeviceFlowInfo, return value from step1 in the
                              case of a device flow.

        Returns:
            An OAuth2Credentials object that can be used to authorize requests.

        Raises:
            FlowExchangeError: if a problem occurred exchanging the code for a
                               refresh_token.
            ValueError: if code and device_flow_info are both provided or both
                        missing.
        Nz%No code or device_flow_info provided.z.Cannot provide both code and device_flow_info.rRr�z-No code was supplied in the query parameters.)r�rRr�r�rNz&http://oauth.net/grant_type/device/1.0r�Zauthorization_coderJr�r�r�r�r�r�r
r�z_Received token response with no refresh_token. Consider reauthenticating with prompt='consent'.rr�r�z#Successfully retrieved access tokenr�r�r�r\zInvalid response: {0}.)'r�rZr4�six�string_types�binary_typerr%r�r�r�rrNrJrr�r�rgr�rr�r�r�rGr"rr�r�r�r5r�r�r�r�r�r�r�r3r�)r&rRr>Zdevice_flow_infoZ	post_datar�rFr�r�r�r
r�rHr�Zextracted_id_tokenr�r�rrrrQ�s���




�



�
�



�

�z"OAuth2WebServerFlow.step2_exchange)NN)N)NNN)rrrrrr�r��GOOGLE_AUTH_URIr1r�GOOGLE_DEVICE_URI�GOOGLE_TOKEN_INFO_URIr$rjrlrQrrrrrP
s,�S//rPc

Cs�z�tj||d�\}
}|
tjtjfkr�||d|d|d�}|�d�}
d}|D] }t�|dk	rLt�|||<qLt|d|d	|f|�WSWnLtjk
r�}z,|dk	r�|jr�d
�	||�}t
�|�n�W5d}~XYnXtd�	|
���dS)a*Create a Flow from a clientsecrets file.

    Will create the right kind of Flow based on the contents of the
    clientsecrets file or will raise InvalidClientSecretsError for unknown
    types of Flows.

    Args:
        filename: string, File name of client secrets.
        scope: string or iterable of strings, scope(s) to request.
        redirect_uri: string, Either the string 'urn:ietf:wg:oauth:2.0:oob' for
                      a non-web-based application, or a URI that handles the
                      callback from the authorization server.
        message: string, A friendly string to display to the user if the
                 clientsecrets file is missing or invalid. If message is
                 provided then sys.exit will be called in the case of an error.
                 If message in not provided then
                 clientsecrets.InvalidClientSecretsError will be raised.
        cache: An optional cache service client that implements get() and set()
               methods. See clientsecrets.loadfile() for details.
        login_hint: string, Either an email address or domain. Passing this
                    hint will either pre-fill the email box on the sign-in form
                    or select the proper multi-login session, thereby
                    simplifying the login flow.
        device_uri: string, URI for device authorization endpoint. For
                    convenience defaults to Google's endpoints but any
                    OAuth 2.0 provider can be used.

    Returns:
        A Flow object.

    Raises:
        UnknownClientSecretsFlowError: if the file describes an unknown kind of
                                       Flow.
        clientsecrets.InvalidClientSecretsError: if the clientsecrets file is
                                                 invalid.
    )rVrKr�)rJrKr�rfr�)r�rLrMrNrbNr�r�z)The client secrets were invalid: 
{0}
{1}z)This OAuth 2.0 flow is unsupported: {0!r})
rZloadfileZTYPE_WEBZTYPE_INSTALLEDr%�localsrPZInvalidClientSecretsErrorr'r��sys�exitr-)rr�rJrUrVrfrLrMrNrbZclient_typeZclient_infoZconstructor_kwargsr��optional�param�errrrW,sH)�
��
��
��rW)N)NrINNN)NNNNNNNN)mr�collectionsrKr5rR�loggingr�rr�rtrrmZ	six.movesrrr�rrrrZHAS_OPENSSLr<rZOpenSSLVerifierrc�	getLoggerrr�r7ZID_TOKEN_VERIFICATION_CERTSZID_TOKEN_VERIFICATON_CERTSZOOB_CALLBACK_URNr,r-rr&r#rr)�
namedtuplerr�r"rr�rr�r�r�r�r�r��utcnowr�Z
clean_headersZMemoryCacheZREFRESH_STATUS_CODES�objectrrErrr r!r,r-r.r/r0r1r2r<r3r8r9rprqr�r�r�r�r�r�rrr�r�r�r0r�r�r�r7r=r�r?r�rGr1rprrqrrrTrXrYrerPrWrrrr�<module>s
���	�
iSN
%J�"�A�8&!�

F1le Man4ger