
    i                        S r SSKrSSKJr  SSKrSSKJr  SSKJr  SSKJ	r	  SSKJ
r
  SSKJr  SSKJr  \R                  \R                  \R                   \R"                  1rS	/r\" \S
5      (       a&  \R*                  " 5       (       a  S\	R,                   3rOS\	R,                   3rS\ S3r\S-   r\S-   r\S-   r\S-   r " S S\
R:                  5      rg)zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
    N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)_mtls_helperz#https://www.googleapis.com/auth/iamcheck_use_client_certziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                   x    \ rS rSrSrS rS r\S 5       r\	R                  " \R                  5      S 5       rSrg)	Signer?   a  Signs messages using the IAM `signBlob API`_.

This is useful when you need to sign bytes but do not have access to the
credential's private key file.

.. _signBlob API:
    https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
    /signBlob
c                 (    Xl         X l        X0l        g)au  
Args:
    request (google.auth.transport.Request): The object used to make
        HTTP requests.
    credentials (google.auth.credentials.Credentials): The credentials
        that will be used to authenticate the request to the IAM API.
        The credentials must have of one the following scopes:

        - https://www.googleapis.com/auth/iam
        - https://www.googleapis.com/auth/cloud-platform
    service_account_email (str): The service account email identifying
        which service account to use to sign bytes. Often, this can
        be the same as the service account email in the given
        credentials.
N)_request_credentials_service_account_email)selfrequestr   service_account_emails       :/app/.venv/lib/python3.13/site-packages/google/auth/iam.py__init__Signer.__init__J   s       '&;#    c                 j   [         R                  " U5      nSn[        R                  [        R
                  U R                  R                  5      R                  U R                  5      nSS0n[        R                  " S[        R                  " U5      R                  S5      05      R                  S5      n[         R"                  " 5       nU H  nU R                  R%                  U R&                  X#U5        U R'                  X2XTS9nUR(                  [*        ;   a  MP  UR(                  [,        R.                  :w  a/  [0        R2                  " SR                  UR4                  5      5      e[        R6                  " UR4                  R                  S5      5      s  $    [0        R2                  " S5      e)	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	            r   _make_signing_requestSigner._make_signing_request^   sV   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99;A,,T]]FQ}}$}XH/1+..0 //<CCHMMR  ::hmm227;<<  ''(MNNr   c                     g)zOptional[str]: The key ID used to identify this private key.

.. warning::
   This is always ``None``. The key ID used by IAM can not
   be reliably determined ahead of time.
N )r   s    r   key_idSigner.key_id|   s     r   c                 V    U R                  U5      n[        R                  " US   5      $ )N
signedBlob)r8   r'   	b64decode)r   r4   r7   s      r   signSigner.sign   s(    --g6 677r   )r   r   r   N)__name__
__module____qualname____firstlineno____doc__r   r8   propertyr<   r   copy_docstringr   r   rA   __static_attributes__r;   r   r   r   r   ?   sI    <(O<   U\\*8 +8r   r   )rG   r'   http.clientclientr/   r%   google.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr.   
_IAM_SCOPEhasattrr	   r"   _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr    _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr   r;   r   r   <module>rZ      s     !  ,   #  " . %%##	 44
 L122**,, ))L)L(MNK#K$G$G#HIK ;-'JK  66"[0 %
2 %(:: J8U\\ J8r   