o
    ,&ßaÂ[  ã                   @   sü   d dl Z d dlmZ d dlmZmZmZmZmZ d dl	m
Z
mZmZmZmZ d dlmZ d dlmZ G dd„ deƒZG d	d
„ d
eƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZeeeeeeedœZdS )é    N)ÚBytesIO)Ú_host_from_urlÚ_get_body_as_dictÚ
BaseSignerÚSIGNED_HEADERS_BLACKLISTÚUNSIGNED_PAYLOAD)ÚawscrtÚHTTPHeadersÚparse_qsÚurlsplitÚ
urlunsplit)Úpercent_encode_sequence)ÚNoCredentialsErrorc                   @   ór   e Zd ZdZg d¢ZejjjZ	dZ
dZdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚCrtSigV4AuthT©ÚAuthorizationz
X-Amz-DateúX-Amz-Content-SHA256zX-Amz-Security-Tokenc                 C   ó   || _ || _|| _d | _d S ©N©ÚcredentialsÚ_service_nameÚ_region_nameÚ_expiration_in_seconds©Úselfr   Úservice_nameÚregion_name© r   ú3/usr/lib/python3/dist-packages/botocore/crt/auth.pyÚ__init__   ó   
zCrtSigV4Auth.__init__c           
      C   ó   | j d u rtƒ ‚tj ¡ jtjjd�}|  |¡}|  |¡ t	j
jj| j j| j j| j jd�}|  |¡r:|r7|}nd }nt}|  |¡rGt	j
jj}nt	j
jj}t	j
jt	j
jj| j|| j| j|| j| j| j||| jd�}|   |¡}t	j
 !||¡}	|	 "¡  |  #||¡ d S ©N)Útzinfo)Úaccess_key_idÚsecret_access_keyÚsession_token)Ú	algorithmÚsignature_typeÚcredentials_providerÚregionÚserviceÚdateÚshould_sign_headerÚuse_double_uri_encodeÚshould_normalize_uri_pathÚsigned_body_valueÚsigned_body_header_typeÚexpiration_in_seconds)$r   r   ÚdatetimeÚutcnowÚreplaceÚtimezoneÚutcÚ_get_existing_sha256Ú_modify_request_before_signingr   ÚauthÚAwsCredentialsProviderÚ
new_staticÚ
access_keyÚ
secret_keyÚtokenÚ_should_sha256_sign_payloadr   Ú!_should_add_content_sha256_headerÚAwsSignedBodyHeaderTypeÚX_AMZ_CONTENT_SHA_256ÚNONEÚAwsSigningConfigÚAwsSigningAlgorithmÚV4Ú_SIGNATURE_TYPEr   r   Ú_should_sign_headerÚ_USE_DOUBLE_URI_ENCODEÚ_SHOULD_NORMALIZE_URI_PATHr   Ú_crt_request_from_aws_requestÚaws_sign_requestÚresultÚ_apply_signing_changes©
r   ÚrequestÚdatetime_nowÚexisting_sha256r+   Úexplicit_payloadÚbody_headerÚsigning_configÚcrt_requestÚfuturer   r   r    Úadd_auth   óN   

ÿ

ý

ÿ
ô
zCrtSigV4Auth.add_authc           
      C   óÎ   t |jƒ}|jr|jnd}|jr3g }|j ¡ D ]\}}t|ƒ}| d||f ¡ q|d d |¡ }n
|jr=d||jf }t	j
 |j ¡ ¡}d }|jrZt|jdƒrU|j}nt|jƒ}t	j
j|j|||d�}	|	S ©Nú/z%s=%sú?ú&z%s?%sÚseek)ÚmethodÚpathÚheadersÚbody_stream©r   Úurlrd   ÚparamsÚitemsÚstrÚappendÚjoinÚqueryr   ÚhttpÚHttpHeadersre   ÚbodyÚhasattrr   ÚHttpRequestrc   ©
r   Úaws_requestÚ	url_partsÚcrt_pathÚarrayÚparamÚvalueÚcrt_headersÚcrt_body_streamrY   r   r   r    rN   S   ó.   

üz*CrtSigV4Auth._crt_request_from_aws_requestc                 C   ó   t  t|jƒ¡|_d S r   ©r	   Ú
from_pairsÚlistre   ©r   ru   Úsigned_crt_requestr   r   r    rQ   p   ó   
ÿz#CrtSigV4Auth._apply_signing_changesc                 K   ó   |  ¡ tvS r   ©Úlowerr   ©r   ÚnameÚkwargsr   r   r    rK   u   ó   z CrtSigV4Auth._should_sign_headerc                 C   ó@   | j D ]}||jv r|j|= qd|jvrt|jƒ|jd< d S d S ©NÚhost©Ú_PRESIGNED_HEADERS_BLOCKLISTre   r   rh   ©r   rS   Úhr   r   r    r;   x   ó   

€
ÿz+CrtSigV4Auth._modify_request_before_signingc                 C   ó   |j  d¡S ©Nr   ©re   Úget©r   rS   r   r   r    r:   ‚   r‹   z!CrtSigV4Auth._get_existing_sha256c                 C   ó   |j  d¡sdS |j dd¡S ©NÚhttpsTÚpayload_signing_enabled©rh   Ú
startswithÚcontextr—   r˜   r   r   r    rB   …   ó   z(CrtSigV4Auth._should_sha256_sign_payloadc                 C   ó   |d uS r   r   ©r   rV   r   r   r    rC   �   ó   z.CrtSigV4Auth._should_add_content_sha256_headerN©Ú__name__Ú
__module__Ú__qualname__ÚREQUIRES_REGIONr�   r   r<   ÚAwsSignatureTypeÚHTTP_REQUEST_HEADERSrJ   rL   rM   r!   r[   rN   rQ   rK   r;   r:   rB   rC   r   r   r   r    r      ó    
4

r   c                       ó4   e Zd ZdZdZdd„ Z‡ fdd„Zdd„ Z‡  ZS )ÚCrtS3SigV4AuthFc                 C   ó   d S r   r   r˜   r   r   r    r:   ™   ó   z#CrtS3SigV4Auth._get_existing_sha256c                    ót   |j  d¡}t|dd ƒ}|d u ri }| dd ¡}|d ur|S |j d¡r)d|jvr+dS |j  dd¡r4dS tƒ  |¡S ©	NÚclient_configÚs3rœ   r›   zContent-MD5TÚhas_streaming_inputF©rŸ   r—   Úgetattrrh   rž   re   ÚsuperrB   ©r   rS   r²   Ú	s3_configÚsign_payload©Ú	__class__r   r    rB   �   ó   
z*CrtS3SigV4Auth._should_sha256_sign_payloadc                 C   ó   dS ©NTr   r¢   r   r   r    rC   ¿   r¯   z0CrtS3SigV4Auth._should_add_content_sha256_header©	r¥   r¦   r§   rL   rM   r:   rB   rC   Ú__classcell__r   r   r»   r    r­   ”   ó    "r­   c                   @   r   )ÚCrtSigV4AsymAuthTr   c                 C   r   r   r   r   r   r   r    r!   Ð   r"   zCrtSigV4AsymAuth.__init__c           
      C   r#   r$   )$r   r   r5   r6   r7   r8   r9   r:   r;   r   r<   r=   r>   r?   r@   rA   rB   r   rC   rD   rE   rF   rG   rH   ÚV4_ASYMMETRICrJ   r   r   rK   rL   rM   r   rN   rO   rP   rQ   rR   r   r   r    r[   Ö   r\   zCrtSigV4AsymAuth.add_authc           
      C   r]   r^   rg   rt   r   r   r    rN   
  r}   z.CrtSigV4AsymAuth._crt_request_from_aws_requestc                 C   r~   r   r   r‚   r   r   r    rQ   '  r„   z'CrtSigV4AsymAuth._apply_signing_changesc                 K   r…   r   r†   rˆ   r   r   r    rK   ,  r‹   z$CrtSigV4AsymAuth._should_sign_headerc                 C   rŒ   r�   r�   r‘   r   r   r    r;   /  r“   z/CrtSigV4AsymAuth._modify_request_before_signingc                 C   r”   r•   r–   r˜   r   r   r    r:   9  r‹   z%CrtSigV4AsymAuth._get_existing_sha256c                 C   r™   rš   r�   r˜   r   r   r    rB   <  r    z,CrtSigV4AsymAuth._should_sha256_sign_payloadc                 C   r¡   r   r   r¢   r   r   r    rC   F  r£   z2CrtSigV4AsymAuth._should_add_content_sha256_headerNr¤   r   r   r   r    rÃ   Ä   r«   rÃ   c                       r¬   )ÚCrtS3SigV4AsymAuthFc                 C   r®   r   r   r˜   r   r   r    r:   P  r¯   z'CrtS3SigV4AsymAuth._get_existing_sha256c                    r°   r±   rµ   r¸   r»   r   r    rB   T  r½   z.CrtS3SigV4AsymAuth._should_sha256_sign_payloadc                 C   r¾   r¿   r   r¢   r   r   r    rC   v  r¯   z4CrtS3SigV4AsymAuth._should_add_content_sha256_headerrÀ   r   r   r»   r    rÅ   K  rÂ   rÅ   c                       óF   e Zd ZdZejjjZef‡ fdd„	Z	‡ fdd„Z
‡ fdd„Z‡  ZS )ÚCrtSigV4AsymQueryAuthé  c                    ó   t ƒ  |||¡ || _d S r   ©r·   r!   r   ©r   r   r   r   Úexpiresr»   r   r    r!     ó   
zCrtSigV4AsymQueryAuth.__init__c                    s¤   t ƒ  |¡ |j d¡}|dkr|jd= t|jƒ}tdd„ t|jdd� 	¡ D ƒƒ}|j
r6| t|ƒ¡ d|_
t|ƒ}|}|d |d	 |d
 ||d f}t|ƒ|_d S )Núcontent-typeú0application/x-www-form-urlencoded; charset=utf-8c                 S   ó   g | ]
\}}||d  f‘qS ©r   r   ©Ú.0ÚkÚvr   r   r    Ú
<listcomp>”  ó    zHCrtSigV4AsymQueryAuth._modify_request_before_signing.<locals>.<listcomp>T©Úkeep_blank_valuesÚ r   é   é   é   )r·   r;   re   r—   r   rh   Údictr
   rn   rj   ÚdataÚupdater   r   r   ©r   rS   Úcontent_typerv   Ú
query_dictÚnew_query_stringÚpÚnew_url_partsr»   r   r    r;   „  s"   
ÿÿ		z4CrtSigV4AsymQueryAuth._modify_request_before_signingc                    óL   t ƒ  ||¡ t|jƒj}t|jƒ}t|d |d |d ||d fƒ|_d S ©Nr   rÛ   rÜ   rÝ   ©r·   rQ   r   rd   rn   rh   r   ©r   ru   rƒ   Úsigned_queryrå   r»   r   r    rQ   ®  ó   
(	z,CrtSigV4AsymQueryAuth._apply_signing_changes©r¥   r¦   r§   ÚDEFAULT_EXPIRESr   r<   r©   ÚHTTP_REQUEST_QUERY_PARAMSrJ   r!   r;   rQ   rÁ   r   r   r»   r    rÇ   {  s    
ÿ*rÇ   c                   @   ó(   e Zd ZdZdZdZdd„ Zdd„ ZdS )ÚCrtS3SigV4AsymQueryAuthz¢S3 SigV4A auth using query parameters.
    This signer will sign a request using query parameters and signature
    version 4A, i.e a "presigned url" signer.
    Fc                 C   r¾   ©NFr   r˜   r   r   r    rB   É  ó   z3CrtS3SigV4AsymQueryAuth._should_sha256_sign_payloadc                 C   r¾   rò   r   r¢   r   r   r    rC   Ð  r¯   z9CrtS3SigV4AsymQueryAuth._should_add_content_sha256_headerN©r¥   r¦   r§   Ú__doc__rL   rM   rB   rC   r   r   r   r    rñ   ¿  s    rñ   c                       rÆ   )ÚCrtSigV4QueryAuthrÈ   c                    rÉ   r   rÊ   rË   r»   r   r    r!   Ù  rÍ   zCrtSigV4QueryAuth.__init__c                    s¼   t ƒ  |¡ |j d¡}|dkr|jd= t|jƒ}tdd„ t|jdd� 	¡ D ƒƒ}|j
r5| |j
¡ i |_
|jrB| t|ƒ¡ d|_t|ƒ}|}|d |d	 |d
 ||d f}t|ƒ|_d S )NrÎ   rÏ   c                 S   rÐ   rÑ   r   rÒ   r   r   r    rÖ   î  r×   zDCrtSigV4QueryAuth._modify_request_before_signing.<locals>.<listcomp>TrØ   rÚ   r   rÛ   rÜ   rÝ   )r·   r;   re   r—   r   rh   rÞ   r
   rn   rj   ri   rà   rß   r   r   r   rá   r»   r   r    r;   Þ  s(   
ÿÿ	z0CrtSigV4QueryAuth._modify_request_before_signingc                    rç   rè   ré   rê   r»   r   r    rQ     rì   z(CrtSigV4QueryAuth._apply_signing_changesrí   r   r   r»   r    rö   Õ  s    
ÿ-rö   c                   @   rð   )ÚCrtS3SigV4QueryAutha  S3 SigV4 auth using query parameters.
    This signer will sign a request using query parameters and signature
    version 4, i.e a "presigned url" signer.
    Based off of:
    http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
    Fc                 C   r¾   rò   r   r˜   r   r   r    rB   (  ró   z/CrtS3SigV4QueryAuth._should_sha256_sign_payloadc                 C   r¾   rò   r   r¢   r   r   r    rC   /  r¯   z5CrtS3SigV4QueryAuth._should_add_content_sha256_headerNrô   r   r   r   r    r÷     s    r÷   )Úv4zv4-queryÚv4aÚs3v4z
s3v4-queryÚs3v4azs3v4a-query)r5   Úior   Úbotocore.authr   r   r   r   r   Úbotocore.compatr   r	   r
   r   r   Úbotocore.utilsr   Úbotocore.exceptionsr   r   r­   rÃ   rÅ   rÇ   rñ   rö   r÷   ÚCRT_AUTH_TYPE_MAPSr   r   r   r    Ú<module>   s0     0 0DG
ù