o
    h~                     @   s   d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ dd Zd	d
 Zdd ZdeddfddZddddZdS )    N)cache)default_backend)load_pem_x509_certificate)get_adapter)OAuth2Errorc                 C   s,   |  |}|rt|dt  }|S dS )zu
    Looks up the key given keys data of the form:

        {"<kid>": "-----BEGIN CERTIFICATE-----
CERTIFICATE"}
    utf8N)getr   encoder   
public_key)	keys_datakidkeyr
    r   \/var/www/html/pos/venv/lib/python3.10/site-packages/allauth/socialaccount/internal/jwtkit.pylookup_kid_pem_x509_certificate   s   
r   c                 C   s:   | d D ]}|d |krt jjt|}|  S qdS )a1  
    Looks up the key given keys data of the form:

        {
          "keys": [
            {
              "kty": "RSA",
              "kid": "W6WcOKB",
              "use": "sig",
              "alg": "RS256",
              "n": "2Zc5d0-zk....",
              "e": "AQAB"
            }]
        }
    keysr   N)jwt
algorithmsRSAAlgorithmfrom_jwkjsondumps)r   r   dr
   r   r   r   lookup_kid_jwk   s   r   c           	      C   s`   t | }|d }|d }t  |}|  | }|||}|s,td| d||fS )Nr   algzInvalid 'kid': '')r   get_unverified_headerr   get_requests_sessionr   raise_for_statusr   r   )	
credentialkeys_urllookupheaderr   r   responser   r   r   r   r   	fetch_key2   s   

r$   datareturnc                 C   sr   |  d}|  d}|  d}|du s|du s|du rdS |t  }d| d| }tj|d|ds7td	dS )
zE
    Put the JWT token on a blacklist to prevent replay attacks.
    issexpjtiNzjwt:iss=z,jti=T)r   valuetimeoutztoken already used)r   timer   addr   )r%   r'   r(   r)   r+   r   r   r   r   
verify_jti@   s   


r.   T)verify_signaturec              
   C   sx   z)|rt | ||\}}|g}nd}d }tj| ||dddd|||d}	t|	 |	W S  tjy; }
 ztd|
d }
~
ww )N T)r/   
verify_iss
verify_aud
verify_exp)r   optionsissueraudiencer   zInvalid id_token)r$   r   decoder.   
PyJWTErrorr   )r   r    r5   r6   
lookup_kidr/   r   r   r   r%   er   r   r   verify_and_decodeO   s0   
r;   )r   r,   django.core.cacher   r   cryptography.hazmat.backendsr   cryptography.x509r   allauth.socialaccount.adapterr   -allauth.socialaccount.providers.oauth2.clientr   r   r   r$   dictr.   r;   r   r   r   r   <module>   s    