3
,[M& @ s d Z ddlmZmZ ddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
ddlmZ ydd lmZ W n ek
r dd lmZ Y nX G d
d d eZd ddZdd Zd ddZd!ddZd"ddZdd ZG dd d eZ G d d d e Z dS )#z
oauthlib.oauth2.rfc6749.tokens
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This module contains methods for adding two types of access tokens to requests.
- Bearer https://tools.ietf.org/html/rfc6750
- MAC https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
)absolute_importunicode_literalsN)
b2a_base64)common)add_params_to_qsadd_params_to_uri unicode_type )utils)urlparsec sr e Zd Zd fdd Zedd Zedd Zedd Zed
d Zed d
Z edd Z
edd Z Z S ) OAuth2TokenNc sr t t| j| d | _d|kr:|d r:ttj|d | _|d k rfttj|| _| jd krn| j| _n| j| _d S )Nscope)superr __init__
_new_scopesetr
Z
scope_to_list
_old_scope)selfZparams old_scope) __class__ /usr/lib/python3.6/tokens.pyr s
zOAuth2Token.__init__c C s | j | jkS )N)r r )r r r r
scope_changed- s zOAuth2Token.scope_changedc C s t j| jS )N)r
list_to_scoper )r r r r r 1 s zOAuth2Token.old_scopec C s
t | jS )N)listr )r r r r
old_scopes5 s zOAuth2Token.old_scopesc C s t j| jS )N)r
r r )r r r r r
9 s zOAuth2Token.scopec C s
t | jS )N)r r )r r r r scopes= s zOAuth2Token.scopesc C s t | j| j S )N)r r r )r r r r missing_scopesA s zOAuth2Token.missing_scopesc C s t | j| j S )N)r r r )r r r r additional_scopesE s z OAuth2Token.additional_scopes)N)
__name__
__module__ __qualname__r propertyr r r r
r r r
__classcell__r r )r r r s r
hmac-sha-1c C s: |j }tj|\} } |j dkr*tj}
n |j dkr>tj}
ntd|
dkrj|pfdjtj | t
j }nt
j }t
j }t
|\}}}}}}|r|d | }n|}|dk r|
dkr|jd}t|
|j dd jd}nd
}g }|
dkr|j| n|j| |j| |j|j |j| |j| |j| |
dkrN|j| |j|pZd
d j|d }t|tr|jd}tj||jd|
}t|j dd jd}g }|jd | |
dkr|jd
| |jd| |r|jd| |r|jd| |jd| |p&i }dj||d< |S )a Add an `MAC Access Authentication`_ signature to headers.
Unlike OAuth 1, this HMAC signature does not require inclusion of the
request payload/body, neither does it use a combination of client_secret
and token_secret but rather a mac_key provided together with the access
token.
Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
`extension algorithms`_ are not supported.
Example MAC Authorization header, linebreaks added for clarity
Authorization: MAC id="h480djs93hd8",
nonce="1336363200:dj83hs9s",
mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="
.. _`MAC Access Authentication`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
.. _`extension algorithms`: https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1
:param uri: Request URI.
:param headers: Request headers as a dictionary.
:param http_method: HTTP Request method.
:param key: MAC given provided by token endpoint.
:param hash_algorithm: HMAC algorithm provided by token endpoint.
:param issue_time: Time when the MAC credentials were issued (datetime).
:param draft: MAC authentication specification version.
:return: headers dictionary with the authorization field added.
z
hmac-sha-1z hmac-sha-256zunknown hash algorithmr z{0}:{1}?Nzutf-8r r$
z MAC id="%s"zts="%s"z
nonce="%s"z
bodyhash="%s"zext="%s"zmac="%s"z,
Authorizationr) )upperr
Z
host_from_urilowerhashlibZsha1Zsha256
ValueErrorformatZ generate_ager Zgenerate_nonceZgenerate_timestampr encoder Zdigestdecodeappendjoin
isinstancer hmacnew)tokenurikeyZ http_methodZnonceheadersbodyZextZhash_algorithmZ
issue_timeZdrafthostZporthZtsZschZnetpathZparZqueryZfraZ request_uriZbodyhashbaseZ base_stringZsignheaderr r r prepare_mac_headerJ sd $
r@ c C s t |d| fgS )zAdd a `Bearer Token`_ to the request URI.
Not recommended, use only if client can't use authorization header or body.
http://www.example.com/path?access_token=h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
access_token)r )r6 r7 r r r prepare_bearer_uri s rB c C s |pi }d| |d< |S )zAdd a `Bearer Token`_ to the request URI.
Recommended method of passing bearer tokens.
Authorization: Bearer h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
z Bearer %sr( r )r6 r9 r r r prepare_bearer_headers s rC c C s t |d| fgS )zAdd a `Bearer Token`_ to the request body.
access_token=h480djs93hd8
.. _`Bearer Token`: https://tools.ietf.org/html/rfc6750
rA )r )r6 r: r r r prepare_bearer_body s rD Fc C s t j S )N)r Zgenerate_token)request
refresh_tokenr r r random_token_generator s rG c s fdd}|S )Nc s | _ tj| S )N)Zclaimsr Zgenerate_signed_token)rE )kwargs private_pemr r signed_token_generator s z6signed_token_generator..signed_token_generatorr )rI rH rJ r )rH rI r rJ s rJ c @ s& e Zd Zd ddZdd Zdd ZdS )
TokenBaseFc C s t dd S )Nz&Subclasses must implement this method.)NotImplementedError)r rE rF r r r __call__ s zTokenBase.__call__c C s t dd S )Nz&Subclasses must implement this method.)rL )r rE r r r validate_request s zTokenBase.validate_requestc C s t dd S )Nz&Subclasses must implement this method.)rL )r rE r r r
estimate_type s zTokenBase.estimate_typeN)F)r r r! rM rN rO r r r r rK s
rK c @ s4 e Zd ZdZdddZdd
d Zd d
Zdd ZdS ) BearerTokenrequest_validatortoken_generatorrefresh_token_generator
expires_inNc C s* || _ |p t| _|p| j| _|p"d| _d S )Ni )rQ rG rR rS rT )r rQ rR rT rS r r r r s
zBearerToken.__init__FTc C s t | jr| j|}n| j}||_| j||dd}|jdk rNdj|j|d< |jdk rb|j|d< |r|jr| jj| r|j|d< n| j ||d< |j
|j pi t |}|r| jj
|| |S )z7Create a BearerToken, by default without refresh token.Bearer)rA rT
token_typeN r
staterF )callablerT rR r r2 rX rF rQ Zrotate_refresh_tokenrS updateZextra_credentialsr Zsave_bearer_token)r rE rF Z
save_tokenrT r6 r r r create_token s*
zBearerToken.create_tokenc C s< d }d|j kr$|j jddd }n|j}| jj||j|S )Nr( )r9 getrA rQ Zvalidate_bearer_tokenr )r rE r6 r r r rN " s
z BearerToken.validate_requestc C s. |j jddjdrdS |jd k r&dS dS d S )Nr( r$ rU r )r9 r]
startswithrA )r rE r r r rO + s
zBearerToken.estimate_type)rQ rR rS rT )NNNN)FT)r r r! __slots__r r[ rN rO r r r r rP s
& rP )NNNr$ r% Nr )N)r$ )F) __doc__Z
__future__r r r, r4 Zbinasciir Zoauthlibr Zoauthlib.commonr r r r$ r
r ImportErrorZ urllib.parsedictr r@ rB rC rD rG rJ objectrK rP r r r r s4 .
b