a Bg<@sdZddlZddlZddlZddlmZmZmZmZm Z m Z m Z m Z m Z ddlmZddlZddlmZmZmZmZddlmZddlmZGdd d ZGd d d ejZGd d d ejZGdddejZGdddZedkree dS)zJSON Web Signature.N) AnyDict FrozenSetListMappingOptionalTupleTypecast)crypto)b64errors json_utiljwa)jwk)utilc@s<eZdZdZdZeeedddZeeedddZdS) MediaTypez MediaType field encoder/decoder.z application/valuereturncCs(d|vr$d|vrtd|j|S|S)zDecoder./;zUnexpected semi-colon)r DeserializationErrorPREFIXclsrr./usr/lib/python3.9/site-packages/josepy/jws.pydecodes   zMediaType.decodecCsd|vr|t|jdS|S)zEncoder.rN)lenrrrrrencode)szMediaType.encodeN) __name__ __module__ __qualname____doc__r classmethodstrrr rrrrrs  rc@seZdZUdZejdejjddZ e eje d<ejdddZ e e e d<ejdejjddZe eje d<ejdddZe ee d<ejd ddZe e e d <ejd dd d Zeejd fe d <ejdejddZe e e d<ejdejddZe e e d<ejdejejddZe ee d<ejdejejddZe ee d<ejddd d Z ee!d fe d<e"eej#fe d<e"eej#fdddZ$e!ddddZ%e&jdddZ'e j(e!e!ddd Z ej)d!d"Zej(d#d"Zd$S)%Headera6JOSE Header. .. warning:: This class supports **only** Registered Header Parameter Names (as defined in section 4.1 of the protocol). If you need Public Header Parameter Names (4.2) or Private Header Parameter Names (4.3), you must subclass and override :meth:`from_json` and :meth:`to_partial_json` appropriately. .. warning:: This class does not support any extensions through the "crit" (Critical) Header Parameter (4.1.11) and as a conforming implementation, :meth:`from_json` treats its occurrence as an error. Please subclass if you seek for a different behaviour. :ivar x5tS256: "x5t#S256" :ivar str typ: MIME Media Type, inc. :const:`MediaType.PREFIX`. :ivar str cty: Content-Type, inc. :const:`MediaType.PREFIX`. algT)decoder omitemptyjku)r*rkidx5ux5crr*default.x5tzx5t#S256x5tS256typ)encoderr)r*ctycrit_fieldsrcsfddjDS)z4Fields that would not be omitted in the JSON object.cs,i|]$\}}|t|s|t|qSr)Zomitgetattr).0namefieldselfrr bsz&Header.not_omitted..)r7itemsr=rr=r not_omitted`s zHeader.not_omitted)otherrcCsbt|t|s tdt||}|}t||rFtd||t|fi|S)NzHeader cannot be added to: {0}z+Addition of overlapping headers not defined) isinstancetype TypeErrorformatrAset intersectionupdate)r>rBZnot_omitted_selfZnot_omitted_otherrrr__add__hs zHeader.__add__cCs|jdurtd|jS)zFind key based on header. .. todo:: Supports only "jwk" header parameter lookup. :returns: (Public) key found in the header. :rtype: .JWK :raises josepy.errors.Error: if key could not be found Nz No key found)rr Errorr=rrrfind_keyus  zHeader.find_key) unused_valuercCstddS)Nz("crit" is not supported, please subclass)r r)rMrrrr6sz Header.critcCsdd|DS)NcSs"g|]}tttj|jqSr)base64 b64encoder Zdump_certificate FILETYPE_ASN1wrappedr:Zcertrrr szHeader.x5c..rrrrrr.sz Header.x5cc CsJztdd|DWStjyD}zt|WYd}~n d}~00dS)Nc ss(|] }tttjt|VqdSN)rComparableX509r Zload_certificaterPrN b64decoderRrrr szHeader.x5c..)tupler rKr r)rerrorrrrr.s  N)*r!r"r#r$rr<r JWASignature from_jsonr(r__annotations__r+bytesjwk_modJWKrr,r&r-r.rrrVdecode_b64joser1r2rr rr3r5r6rrZFieldrArJjosepyrLr)r4rrrrr'3s@   "     r'c speZdZUdZeZeed<dZej ddddZ e ed<ej ddeej d Z eed<ej d ejejd Zeed <e je e d d dZ e je e d ddZ eddfdd Zeeee efdddZee eedddZd%eeejedddZedefeejej ee!eddddZ"ee efdfd d! Z#ee$e efee efd"fd#d$ Z%Z&S)& SignatureaJWS Signature. :ivar combined: Combined Header (protected and unprotected, :class:`Header`). :ivar unicode protected: JWS protected header (Jose Base-64 decoded). :ivar header: JWS Unprotected Header (:class:`Header`). :ivar str signature: The signature. combined)rd protectedTr/header)r*r0r) signature)r)r4rcCst|dSNutf-8)rencode_b64joser rTrrrreszSignature.protectedcCst|dSri)rrarrTrrrresN)kwargsrc s(d|vr||}tjfi|dS)Nrd)_with_combinedsuper__init__)r>rl __class__rrros zSignature.__init__cCsN|d|jdj}|d|jdj}|r>||j|}n|}||d<|S)Nrgrerd)getr7r0 header_cls json_loads)rrlrgrerdrrrrmszSignature._with_combined)repayloadrcCst|ddt|S)Nrj.)r rOr )rrerurrr_msgszSignature._msg)rukeyrcCsJ|dur|jn|}|jjs(td|jjj|j|j||j |dS)zvVerify. :param bytes payload: Payload to verify. :param JWK key: Key used for verification. Nz Not signature algorithm defined.)rxsigmsg) rdrLr(rbrKverifyrxrhrwre)r>rurxZ actual_keyrrrr{s  zSignature.verify)rurxr( include_jwkprotectrlrc Ks|}||d<|r||d<i}|D]} | |vr$|| || <q$|rZ|jfi|} nd} |jfi|} ||j|| |} || | | dS)aDSign. :param bytes payload: Payload to sign. :param JWK key: Key for signature. :param JWASignature alg: Signature algorithm to use to sign. :param bool include_jwk: If True, insert the JWK inside the signature headers. :param FrozenSet protect: List of headers to protect. r(rrf)rergrh) public_keypoprsZ json_dumpssignrxrw) rrurxr(r|r}rlZ header_paramsZprotected_paramsrgrerhrrrrs zSignature.signr8cs t}|ds|d=|S)Nrg)rnfields_to_partial_jsonrA)r>fieldsrprrrs  z Signature.fields_to_partial_jsonjobjrcs4t|}||}d|dvr0td|S)Nr(rdzalg not present)rnfields_from_jsonrmrAr r)rrrZfields_with_combinedrprrrs    zSignature.fields_from_json)N)'r!r"r#r$r'rsr] __slots__rr<rer&r\rgrarkrhr^r4r)rror%rrmrwrrbr`boolr{ frozensetr[rrrrr __classcell__rrrprrcsH     *rcc@seZdZUdZdZeed<eeed<eZ de e j e dddZeeedd d d Zeed d dZed ddZeeddddZde eeefdddZeeeefddddZdS)JWSzgJSON Web Signature. :ivar str payload: JWS Payload. :ivar str signature: JWS Signatures. ru signaturesrurN)rxrcstfddjDS)Verify.c3s|]}|jVqdSrU)r{rur:ryrxr>rrrX.zJWS.verify..)allr)r>rxrrrr{,sz JWS.verify)rurlrcKs |||jjfd|i|fdS)Sign.rur) signature_clsr)rrurlrrrr0szJWS.signr8cCs |jdS)zPGet a singleton signature. :rtype: :class:`JWS.signature_cls` r)rr=rrrrh5sz JWS.signaturecCs6t|jjddt|jdt|jjS)z7Compact serialization. :rtype: bytes rjrv)r rOrhrer rur=rrr to_compact?s   zJWS.to_compact)compactrcCsfz|d\}}}Wnty0tdYn0|jt|dt|d}|t||fdS)zACompact deserialization. :param bytes compact: rvzOCompact JWS serialization should comprise of exactly 3 dot-separated componentsrj)rerhr)split ValueErrorr rrr rWr)rrrerurhryrrr from_compactRs  zJWS.from_compactT)flatrcCsHt|j}|r8t|jdkr8|jd}||d<|S||jdSdS)Nrrur)rrkrurrto_partial_json)r>rruretrrrres zJWS.to_partial_jsonrcsd|vrd|vrtdnfd|vrVdd|D}t|dj|fdSt|dtfdd |dDdSdS) NrhrzFlat mixed with non-flatcSsi|]\}}|dkr||qS)rur)r:rxrrrrr?xrz!JWS.from_json..rurc3s|]}j|VqdSrU)rr\rrrrrXrz JWS.from_json..)r rr@rrarr\rY)rrZfilteredrrrr\ss    z JWS.from_json)N)T)r!r"r#r$rr^r]rrcrrrbr`rr{r%rrpropertyrhrrrr&rrr\rrrrrs   rc@seZdZdZeejddddZeejedddZ ee e j dd d Z ee e dd d Zee eejdd dZedeeeeedddZdS)CLIzJWS CLI.N)argsrcCs|jj|j}|j|jdur.g|_|jr@|jdt j t j  ||jt|jd}|jr~t|dn t|dS)rNr()rurxr(r}rj)r(ktyloadrxreadcloser}rappendrrsysstdinr rGprintrrZjson_dumps_pretty)rrrxryrrrrs   zCLI.signc Cs|jrttj}nLzttttj}Wn0t j yf}zt |WYd}~dSd}~00|j dur|j |j }|j nd}tj|j|j|d S)rNF)rx)rrrrrrr r rtr rKrrxrrr~rstdoutwriterurr{)rrryrZrxrrrr{s  z CLI.verify)argrcCs tj|SrU)rr[r\rrrrr _alg_typesz CLI._alg_typecCs|SrUrrrrr _header_typeszCLI._header_typecCs tjj|SrU)r_r`ZTYPESrrrr _kty_typesz CLI._kty_typecCs|durtjdd}t}|jddd|}|d}|j|jd|jdd t d d d |jd d|j t j d|jddd|j d|d}|j|jd|jdd t d dd |jd|jdd ||}||S)z Parse arguments and sign/verify.Nrz --compact store_true)actionr)funcz-kz--keyrbT)rDrequiredz-az--alg)rDr0z-pz --protectr)rrDr{Fz--kty)rargvargparseArgumentParser add_argumentadd_subparsers add_parser set_defaultsrFileTyperrZRS256rr{r parse_argsr)rrparserZ subparsersZ parser_signZ parser_verifyparsedrrrruns    zCLI.run)N)r!r"r#r$r%r Namespacerrr{rrr[rrr r_r`rrrr&rrrrrrsr__main__)!r$rrNrtypingrrrrrrrr r ZOpenSSLr rbr r rrrr_rrZJSONObjectWithFieldsr'rcrrr!exitrrrrrs",   kfR