o
    ~j6h(                     @   s   d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZmZ dZdZd	Zd
d ZG dd dejdZG dd deZG dd deZG dd deZdd e e e fD ZdS )z" Challenges for reauthentication.
    N)_helpers)
exceptions)webauthn_handler_factory)$AuthenticationExtensionsClientInputs
GetRequestPublicKeyCredentialDescriptorzhttps://accounts.google.comzFPlease run `gcloud auth login` to complete reauthentication with SAML.i c                 C   s
   t  | S )zGet password from user.

    Override this function with a different logic if you are using this library
    outside a CLI.

    Args:
        text (str): message for the password prompt.

    Returns:
        str: password string.
    )getpass)text r
   g/var/www/html/chefvision.cloud.itp360.com/venv/lib/python3.10/site-packages/google/oauth2/challenges.pyget_user_password(   s   
r   c                   @   sB   e Zd ZdZeejdd Zeejdd Zejdd Z	dS )	ReauthChallengez!Base class for reauth challenges.c                 C      t d)z"Returns the name of the challenge.z!name property must be implementedNotImplementedErrorselfr
   r
   r   name:      zReauthChallenge.namec                 C   r   )zAReturns true if a challenge is supported locally on this machine.z0is_locally_eligible property must be implementedr   r   r
   r
   r   is_locally_eligible@   r   z#ReauthChallenge.is_locally_eligiblec                 C   r   )ac  Performs logic required to obtain credentials and returns it.

        Args:
            metadata (Mapping): challenge metadata returned in the 'challenges' field in
                the initial reauth request. Includes the 'challengeType' field
                and other challenge-specific fields.

        Returns:
            response that will be send to the reauth service as the content of
            the 'proposalResponse' field in the request body. Usually a dict
            with the keys specific to the challenge. For example,
            ``{'credential': password}`` for password challenge.
        z1obtain_challenge_input method must be implementedr   r   metadatar
   r
   r   obtain_challenge_inputF   s   z&ReauthChallenge.obtain_challenge_inputN)
__name__
__module____qualname____doc__propertyabcabstractmethodr   r   r   r
   r
   r
   r   r   7   s    r   )	metaclassc                   @   s:   e Zd ZdZedd Zedd Zee	dd Z
dS )	PasswordChallengez(Challenge that asks for user's password.c                 C      dS )NPASSWORDr
   r   r
   r
   r   r   [      zPasswordChallenge.namec                 C   r"   NTr
   r   r
   r
   r   r   _   r$   z%PasswordChallenge.is_locally_eligiblec                 C   s   t d}|sd}d|iS )NzPlease enter your password: 
credential)r   )r   unused_metadatapasswdr
   r
   r   r   c   s   z(PasswordChallenge.obtain_challenge_inputN)r   r   r   r   r   r   r   r   copy_docstringr   r   r
   r
   r
   r   r!   X   s    

r!   c                   @   sJ   e Zd ZdZedd Zedd Zee	dd Z
dd	 Zd
d ZdS )SecurityKeyChallengez2Challenge that asks for user's security key touch.c                 C   r"   )NSECURITY_KEYr
   r   r
   r
   r   r   n   r$   zSecurityKeyChallenge.namec                 C   r"   r%   r
   r   r
   r
   r   r   r   r$   z(SecurityKeyChallenge.is_locally_eligiblec                 C   sN  zt  }| }|d urtjd | ||W S W n	 ty$   Y nw zdd l}dd l	}dd l
}W n ty?   tdw |d }|d }|d }|d }||krY||g}	n|g}	g }
|D ](}|d d	}|jtt|}|d
 d	}t|}|
||d q`d}|	D ]}z|d7 }|jjt}|j||
tjjd}d|iW   S  |jjy } z;|j|jjjkr|t|	krtjd W Y d }~ d S W Y d }~q|j|jjjkrtjd n|W Y d }~ d S d }~w |jj y } ztjd!| W Y d }~qd }~w |jj"y$   tjd Y  d S w d S )Nz*Please insert and touch your security key
r   zpyu2f dependency is required to use Security key reauth feature. It can be installed via `pip install pyu2f` or `pip install google-auth[reauth]`.securityKey
challengesapplicationIdrelyingPartyId	keyHandleascii	challenge)keyr3      )print_callbackzIneligible security key.
z0Timed out while waiting for security key touch.
zPlugin error: {}.
zNo security key found.
)#r   WebauthnHandlerFactoryget_handlersysstderrwrite _obtain_challenge_input_webauthn	Exceptionpyu2f.convenience.authenticatorpyu2f.errorspyu2f.modelImportErrorr   ReauthFailErrorencodemodelRegisteredKey	bytearraybase64urlsafe_b64decodeappendconvenienceauthenticatorCreateCompositeAuthenticatorREAUTH_ORIGINAuthenticateerrorsU2FErrorcodeDEVICE_INELIGIBLElenTIMEOUTPluginErrorformatNoDeviceFoundError)r   r   factorywebauthn_handlerpyu2fskr.   application_idrelying_party_idapplication_parameterschallenge_datackhr4   r3   triesapp_idapiresponseer
   r
   r   r   v   s   




z+SecurityKeyChallenge.obtain_challenge_inputc              
   C   sl  | d}|d u rtd| d}| d}| d}|d u s't|dk r,td|d u r5td|d u r>td	g }|D ]}| d
}	|	d u rRtd| |	}
|t|
d qBt|d}|d  d}|d u rutdtt	|| |t
|d|d}z| |}W n ty } ztjd| |d }~ww |jj|jj|jj||jdd}d|iS )Nr-   zsecurityKey is Noner.   r/   r0   r5   zchallenges is None or emptyzapplication_id is Nonezrelying_party_id is Noner1   zkeyHandle is None)id)appidr   r3   zchallenge is Nonerequired)originrpidr3   
timeout_msallow_credentialsuser_verification
extensionszWebauthn Error: {}.
   )
clientDataauthenticatorDatasignatureDatar/   r1   securityKeyReplyType)getr   InvalidValuerS   _unpadded_urlsafe_b64recoderI   r   r   r   rM   WEBAUTHN_TIMEOUT_MSr=   r9   r:   r;   rV   re   client_data_jsonauthenticator_data	signaturerg   )r   r   rY   r[   r.   r\   r]   rm   r3   ra   
key_handle	extensionget_requestget_responserf   re   r
   r
   r   r<      s^   













z5SecurityKeyChallenge._obtain_challenge_input_webauthnc                 C   s   t |}t | dS )z\Converts standard b64 encoded string to url safe b64 encoded string
        with no padding.=)rG   rH   urlsafe_b64encodedecoderstrip)r   sbr
   r
   r   rw      s   
z0SecurityKeyChallenge._unpadded_urlsafe_b64recodeN)r   r   r   r   r   r   r   r   r*   r   r   r<   rw   r
   r
   r
   r   r+   k   s    


K6r+   c                   @   s0   e Zd ZdZedd Zedd Zdd ZdS )	SamlChallengezChallenge that asks the users to browse to their ID Providers.

    Currently SAML challenge is not supported. When obtaining the challenge
    input, exception will be raised to instruct the users to run
    `gcloud auth login` for reauthentication.
    c                 C   r"   )NSAMLr
   r   r
   r
   r   r     r$   zSamlChallenge.namec                 C   r"   r%   r
   r   r
   r
   r   r     r$   z!SamlChallenge.is_locally_eligiblec                 C   s
   t t)N)r   ReauthSamlChallengeFailErrorSAML_CHALLENGE_MESSAGEr   r
   r
   r   r     s   
z$SamlChallenge.obtain_challenge_inputN)r   r   r   r   r   r   r   r   r
   r
   r
   r   r      s    

r   c                 C   s   i | ]}|j |qS r
   )r   ).0r3   r
   r
   r   
<dictcomp>  s    r   )r   r   rG   r   r9   google.authr   r   google.oauth2r   google.oauth2.webauthn_typesr   r   r   rM   r   rx   r   ABCMetar   r!   r+   r   AVAILABLE_CHALLENGESr
   r
   r
   r   <module>   s,   ! 
