B

��fa�@sldZd
dl
Z
d
dlmZ
d
dlZd
dlmZ
d
dlmZ
d
dlm	Z	
dg
Z
dZdZd	Z
Gd
d�dej�ZdS)z�Tools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
�N)
�_helpers)
�crypt)
�
exceptionsz#https://www.googleapis.com/auth/iamzZhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateAccessTokenzOhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlobzVhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:generateIdTokenc@s@eZ
dZd
Zdd�Zdd�Zedd��
Ze�	e
j�
dd	��
Zd
S)�Signera
Signs messages using the IAM `signBlob API`_.

    This is useful when you need to sign bytes but do not have access to the
    credential's private key file.

    .. _signBlob API:
        https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
        /signBlob
    cCs|
|_||_
||_d
S)a�
        Args:
            request (google.auth.transport.Request): The object used to make
                HTTP requests.
            credentials (google.auth.credentials.Credentials): The credentials
                that will be used to authenticate the request to the IAM API.
                The credentials must have of one the following scopes:

                - https://www.googleapis.com/auth/iam
                - https://www.googleapis.com/auth/cloud-platform
            service_account_email (str): The service account email identifying
                which service account to use to sign bytes. Often, this can
                be the same as the service account email in the given
                credentials.
        N)�_request�_credentials�_service_account_email)�self�request�credentialsZservice_account_email�r�@/opt/alt/python37/lib/python3.7/site-packages/google/auth/iam.py�__init__<s

zSigner.__init__cCs�t�
|
�
}
d
}t�|j�
}ddi
}t�dt�|
�
�	d�
i
�
�
d�
}|j�|j
|||�
|j
||||d�}|jtjkr�t�d�|j�
�
�
t�|j�	d�
�
S)z(Makes a request to the API signBlob API.�POSTzContent-Typezapplication/json�payloadzutf-8)�url�method�body�headersz&Error calling the IAM signBlob API: {})r�to_bytes�_IAM_SIGN_ENDPOINT�formatr�json�dumps�base64�	b64encode�decode�encoderZbefore_requestr�status�http_client�OKrZTransportError�data�loads)r	�messagerrrr�responserrr
�_make_signing_requestPs








zSigner._make_signing_requestc


Csd
S)z�Optional[str]: The key ID used to identify this private key.

        .. warning::
           This is always ``None``. The key ID used by IAM can not
           be reliably determined ahead of time.
        Nr)
r	rrr
�key_idesz
Signer.key_idcCs|�|
�
}t
�|d
�
S)NZ
signedBlob)r%r�	b64decode)r	r#r$rrr
�signos

zSigner.signN)
�__name__�
__module__�__qualname__�__doc__rr%�propertyr&rZcopy_docstringrrr(rrrr
r1s
	
r)r,r�http.client�clientrrZgoogle.authrrrZ
_IAM_SCOPEZ
_IAM_ENDPOINTrZ_IAM_IDTOKEN_ENDPOINTrrrrr
�<module>s