­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ,[M&@sdZddlmZmZddlZddlZddlmZddlm Z ddl m Z m Z m Z ddlmZydd lmZWn ek rdd lmZYnXGd d d eZdddZddZd ddZd!ddZd"ddZddZGdddeZGdddeZdS)#z oauthlib.oauth2.rfc6749.tokens ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module contains methods for adding two types of access tokens to requests. - Bearer https://tools.ietf.org/html/rfc6750 - MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 )absolute_importunicode_literalsN) b2a_base64)common)add_params_to_qsadd_params_to_uri unicode_type)utils)urlparsecsreZdZdfdd ZeddZeddZedd Zed d Zed d Z eddZ eddZ Z S) OAuth2TokenNcsrtt|j|d|_d|kr:|dr:ttj|d|_|dk rfttj||_|jdkrn|j|_n|j|_dS)Nscope)superr __init__ _new_scopesetr Z scope_to_list _old_scope)selfZparams old_scope) __class__/usr/lib/python3.6/tokens.pyrs  zOAuth2Token.__init__cCs |j|jkS)N)rr)rrrr scope_changed-szOAuth2Token.scope_changedcCs tj|jS)N)r list_to_scoper)rrrrr1szOAuth2Token.old_scopecCs t|jS)N)listr)rrrr old_scopes5szOAuth2Token.old_scopescCs tj|jS)N)r rr)rrrrr 9szOAuth2Token.scopecCs t|jS)N)rr)rrrrscopes=szOAuth2Token.scopescCst|j|jS)N)rrr)rrrrmissing_scopesAszOAuth2Token.missing_scopescCst|j|jS)N)rrr)rrrradditional_scopesEszOAuth2Token.additional_scopes)N) __name__ __module__ __qualname__rpropertyrrrr rrr __classcell__rr)rrr s      r hmac-sha-1c Cs:|j}tj|\} } |jdkr*tj} n|jdkr>tj} ntd| dkrj|pfdjtj | t j }nt j }t j }t |\}}}}}}|r|d|}n|}|dk r| dkr|jd}t| |jddjd}nd }g}| dkr|j|n|j||j||j|j|j||j| |j| | dkrN|j||j|pZd d j|d }t|tr|jd}tj||jd| }t|jddjd}g}|jd || dkr|jd ||jd||r|jd||r|jd||jd||p&i}dj||d<|S)aAdd an `MAC Access Authentication`_ signature to headers. Unlike OAuth 1, this HMAC signature does not require inclusion of the request payload/body, neither does it use a combination of client_secret and token_secret but rather a mac_key provided together with the access token. Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256", `extension algorithms`_ are not supported. Example MAC Authorization header, linebreaks added for clarity Authorization: MAC id="h480djs93hd8", nonce="1336363200:dj83hs9s", mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM=" .. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 .. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1 :param uri: Request URI. :param headers: Request headers as a dictionary. :param http_method: HTTP Request method. :param key: MAC given provided by token endpoint. :param hash_algorithm: HMAC algorithm provided by token endpoint. :param issue_time: Time when the MAC credentials were issued (datetime). :param draft: MAC authentication specification version. :return: headers dictionary with the authorization field added. z hmac-sha-1z hmac-sha-256zunknown hash algorithmrz{0}:{1}?Nzutf-8r r$ z MAC id="%s"zts="%s"z nonce="%s"z bodyhash="%s"zext="%s"zmac="%s"z, Authorizationr))upperr Z host_from_urilowerhashlibZsha1Zsha256 ValueErrorformatZ generate_agerZgenerate_nonceZgenerate_timestampr encoderZdigestdecodeappendjoin isinstancerhmacnew)tokenurikeyZ http_methodZnonceheadersbodyZextZhash_algorithmZ issue_timeZdrafthostZporthZtsZschZnetpathZparZqueryZfraZ request_uriZbodyhashbaseZ base_stringZsignheaderrrrprepare_mac_headerJsd$                 r@cCst|d|fgS)zAdd a `Bearer Token`_ to the request URI. Not recommended, use only if client can't use authorization header or body. http://www.example.com/path?access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 access_token)r)r6r7rrrprepare_bearer_urisrBcCs|pi}d||d<|S)zAdd a `Bearer Token`_ to the request URI. Recommended method of passing bearer tokens. Authorization: Bearer h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 z Bearer %sr(r)r6r9rrrprepare_bearer_headerss rCcCst|d|fgS)zAdd a `Bearer Token`_ to the request body. access_token=h480djs93hd8 .. _`Bearer Token`: https://tools.ietf.org/html/rfc6750 rA)r)r6r:rrrprepare_bearer_bodysrDFcCstjS)N)rZgenerate_token)request refresh_tokenrrrrandom_token_generatorsrGc sfdd}|S)Ncs|_tj|S)N)ZclaimsrZgenerate_signed_token)rE)kwargs private_pemrrsigned_token_generatorsz6signed_token_generator..signed_token_generatorr)rIrHrJr)rHrIrrJsrJc@s&eZdZd ddZddZddZdS) TokenBaseFcCs tddS)Nz&Subclasses must implement this method.)NotImplementedError)rrErFrrr__call__szTokenBase.__call__cCs tddS)Nz&Subclasses must implement this method.)rL)rrErrrvalidate_requestszTokenBase.validate_requestcCs tddS)Nz&Subclasses must implement this method.)rL)rrErrr estimate_typeszTokenBase.estimate_typeN)F)rr r!rMrNrOrrrrrKs rKc@s4eZdZdZdddZdd d Zd d ZddZdS) BearerTokenrequest_validatortoken_generatorrefresh_token_generator expires_inNcCs*||_|p t|_|p|j|_|p"d|_dS)Ni)rQrGrRrSrT)rrQrRrTrSrrrrs  zBearerToken.__init__FTcCst|jr|j|}n|j}||_|j||dd}|jdk rNdj|j|d<|jdk rb|j|d<|r|jr|jj| r|j|d<n|j ||d<|j |j pit |}|r|jj |||S)z7Create a BearerToken, by default without refresh token.Bearer)rArT token_typeN r staterF)callablerTrRrr2rXrFrQZrotate_refresh_tokenrSupdateZextra_credentialsr Zsave_bearer_token)rrErFZ save_tokenrTr6rrr create_tokens*      zBearerToken.create_tokencCs<d}d|jkr$|jjddd}n|j}|jj||j|S)Nr()r9getrArQZvalidate_bearer_tokenr)rrEr6rrrrN"s  zBearerToken.validate_requestcCs.|jjddjdrdS|jdk r&dSdSdS)Nr(r$rU r)r9r] startswithrA)rrErrrrO+s  zBearerToken.estimate_type)rQrRrSrT)NNNN)FT)rr r! __slots__rr[rNrOrrrrrPs  & rP)NNNr$r%Nr)N)r$)F)__doc__Z __future__rrr,r4ZbinasciirZoauthlibrZoauthlib.commonrrrr$r r ImportErrorZ urllib.parsedictr r@rBrCrDrGrJobjectrKrPrrrr s4   . b