
    g~                         d dl Z d dlZd dlmZ d dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d Zd Zd	 Zd
eddfdZdddZy)    N)cache)default_backend)load_pem_x509_certificate)get_adapter)OAuth2Errorc                     | j                  |      }|r3t        |j                  d      t                     j	                         }|S y)zu
    Looks up the key given keys data of the form:

        {"<kid>": "-----BEGIN CERTIFICATE-----
CERTIFICATE"}
    utf8N)getr   encoder   
public_key)	keys_datakidkeyr   s       b/var/www/django_project/virt/lib/python3.12/site-packages/allauth/socialaccount/internal/jwtkit.pylookup_kid_pem_x509_certificater      sG     --
C
.JJv 1

*, 	 	     c                     | d   D ]J  }|d   |k(  st         j                  j                  j                  t	        j
                  |            }|c S  y)a1  
    Looks up the key given keys data of the form:

        {
          "keys": [
            {
              "kty": "RSA",
              "kid": "W6WcOKB",
              "use": "sig",
              "alg": "RS256",
              "n": "2Zc5d0-zk....",
              "e": "AQAB"
            }]
        }
    keysr   N)jwt
algorithmsRSAAlgorithmfrom_jwkjsondumps)r   r   dr   s       r   lookup_kid_jwkr      sK      v U8s?44==djjmLJr   c                 
   t        j                  |       }|d   }|d   }t               j                         j	                  |      }|j                          |j                         } |||      }|st        d| d      ||fS )Nr   algzInvalid 'kid': '')r   get_unverified_headerr   get_requests_sessionr
   raise_for_statusr   r   )	
credentialkeys_urllookupheaderr   r   responser   r   s	            r   	fetch_keyr(   2   s    &&z2F
-C
-C}11377AHI
C
 C,SE3448Or   datareturnc                     | j                  d      }| j                  d      }| j                  d      }|||y|t        j                         z
  }d| d| }t        j                  |d|      st	        d	      y)
zE
    Put the JWT token on a blacklist to prevent replay attacks.
    issexpjtiNzjwt:iss=z,jti=T)r   valuetimeoutztoken already used)r
   timer   addr   )r)   r,   r-   r.   r0   r   s         r   
verify_jtir3   @   s~     ((5/C
((5/C
((5/C
{ckS[DIIKGSEse
$C99D':.// ;r   T)verify_signaturec           	          	 |rt        | ||      \  }}|g}nd}d }t        j                  | ||dddd|||      }	t        |	       |	S # t        j                  $ r}
t        d      |
d }
~
ww xY w)N T)r4   
verify_iss
verify_aud
verify_exp)r   optionsissueraudiencer   zInvalid id_token)r(   r   decoder3   
PyJWTErrorr   )r#   r$   r;   r<   
lookup_kidr4   r   r   r   r)   es              r   verify_and_decoderA   O   s    5 XzBHCJCJzz$4"""	 !
 	4>> 5,-145s   AA	 	A-A((A-)r   r1   django.core.cacher   r   cryptography.hazmat.backendsr   cryptography.x509r   allauth.socialaccount.adapterr   -allauth.socialaccount.providers.oauth2.clientr   r   r   r(   dictr3   rA    r   r   <module>rI      sK      # 
 8 7 5 E,0T 0d 0  MQ5r   