a
Bg< @ s d Z ddlZddlZddlZddlmZmZmZmZm Z m
Z
m Z m Z m
Z
ddlmZ ddlZddlmZmZmZmZ ddlmZ ddlmZ G dd d ZG d
d d ejZG d d
d
ejZG dd dejZ G dd dZ e dkre e dS )zJSON Web Signature. N) AnyDict FrozenSetListMappingOptionalTupleTypecast)crypto)b64errors json_utiljwa)jwk)utilc @ s< e Zd ZdZdZeeedddZeeedddZdS ) MediaTypez MediaType field encoder/decoder.z application/valuereturnc C s( d|vr$d|v rt d| j| S |S )zDecoder./;zUnexpected semi-colon)r
DeserializationErrorPREFIXclsr r ./usr/lib/python3.9/site-packages/josepy/jws.pydecode s
zMediaType.decodec C s. d|vr*| | jsJ |t| jd S |S )zEncoder.r N)
startswithr lenr r r r encode) s zMediaType.encodeN) __name__
__module__ __qualname____doc__r classmethodstrr r! r r r r r s r c @ s e Zd ZU dZejdejjddZ e
ej e d< ejdddZ e
e
e d< ejdejjddZe
ej e d< ejdddZe
e e d< ejd ddZe
e
e d < ejd
dd d Zeejd
f e d
< ejdejddZe
e
e d< ejdejddZe
e
e d< ejdej ej ddZ e
e e d< ejdej ej ddZ e
e e d< ejddd d Z ee!d
f e d< e"eej#f e d< e"eej#f dddZ$e!d dddZ%e&jdd d Z'e j(e!e!d d d Z ej)d!d" Zej(d#d" Zd$S )%Headera6 JOSE Header.
.. warning:: This class supports **only** Registered Header
Parameter Names (as defined in section 4.1 of the
protocol). If you need Public Header Parameter Names (4.2)
or Private Header Parameter Names (4.3), you must subclass
and override :meth:`from_json` and :meth:`to_partial_json`
appropriately.
.. warning:: This class does not support any extensions through
the "crit" (Critical) Header Parameter (4.1.11) and as a
conforming implementation, :meth:`from_json` treats its
occurrence as an error. Please subclass if you seek for
a different behaviour.
:ivar x5tS256: "x5t#S256"
:ivar str typ: MIME Media Type, inc. :const:`MediaType.PREFIX`.
:ivar str cty: Content-Type, inc. :const:`MediaType.PREFIX`.
algT)decoder omitemptyjku)r+ r kidx5ux5cr r+ default.x5tzx5t#S256x5tS256typ)encoderr* r+ ctycrit_fieldsr c s fdd j D S )z4Fields that would not be omitted in the JSON object.c s, i | ]$\}}| t |s|t |qS r )Zomitgetattr).0namefieldselfr r
b s z&Header.not_omitted..)r8 itemsr> r r> r not_omitted` s
zHeader.not_omitted)otherr c C sb t |t| s tdt|| }| }t||rFtd|| t| f i |S )Nz Header cannot be added to: {0}z+Addition of overlapping headers not defined)
isinstancetype TypeErrorformatrB set intersectionupdate)r? rC Znot_omitted_selfZnot_omitted_otherr r r __add__h s
zHeader.__add__c C s | j du rtd| j S )zFind key based on header.
.. todo:: Supports only "jwk" header parameter lookup.
:returns: (Public) key found in the header.
:rtype: .JWK
:raises josepy.errors.Error: if key could not be found
Nz No key found)r r
Errorr> r r r find_keyu s
zHeader.find_key) unused_valuer c C s t dd S )Nz("crit" is not supported, please subclass)r
r )rN r r r r7 s z Header.critc C s dd | D S )Nc S s" g | ]}t ttj|jqS r )base64 b64encoder Zdump_certificate
FILETYPE_ASN1wrappedr; Zcertr r r
s z Header.x5c..r r r r r r/ s z
Header.x5cc
C sJ zt dd | D W S tjyD } zt|W Y d }~n
d }~0 0 d S )Nc s s( | ] }t ttjt|V qd S N)r ComparableX509r Zload_certificaterQ rO b64decoderS r r r s z Header.x5c..)tupler rL r
r )r errorr r r r/ s
N)*r" r# r$ r% r r= r JWASignature from_jsonr) r __annotations__r, bytesjwk_modJWKr r- r' r. r/ r r rW decode_b64joser2 r3 r r! r r4 r6 r7 r r ZFieldrB rK josepyrM r* r5 r r r r r( 3 s@
"
r( c
sp e Zd ZU dZeZeed< dZej ddddZ
e ed< ej dde ej d Z
eed< ej d
ejejd Zeed
< e
je e d d
dZ
e
je e d ddZ
edd fdd Zeeee ef dddZee eedddZd%eeej e dddZ ede feej ej e e!ed d d d Z"ee ef d fd d! Z#ee$e ef ee ef d" fd#d$ Z% Z&S )& Signaturea JWS Signature.
:ivar combined: Combined Header (protected and unprotected,
:class:`Header`).
:ivar unicode protected: JWS protected header (Jose Base-64 decoded).
:ivar header: JWS Unprotected Header (:class:`Header`).
:ivar str signature: The signature.
combined)re protectedT r0 header)r+ r1 r* signature)r* r5 r c C s t | dS Nutf-8)r encode_b64joser! rU r r r rf s zSignature.protectedc C s t | dS rj )r rb r rU r r r rf s N)kwargsr c s8 d|vr| |}t jf i | | jjd us4J d S )Nre )_with_combinedsuper__init__re r) )r? rm __class__r r rp s
zSignature.__init__c C sZ d|vs J | d| jd j}| d| jd j}|rJ|| j| }n|}||d< |S )Nre rh rf )getr8 r1
header_cls
json_loads)r rm rh rf re r r r rn s zSignature._with_combined)rf payloadr c C s t |dd t | S )Nrk .)r rP r! )r rf rv r r r _msg s zSignature._msg)rv keyr c C sJ |du r| j n|}| j js(td| j jj|j| j| | j |dS )zvVerify.
:param bytes payload: Payload to verify.
:param JWK key: Key used for verification.
Nz Not signature algorithm defined.)ry sigmsg)
re rM r) rc rL verifyry ri rx rf )r? rv ry Z
actual_keyr r r r| s
zSignature.verify)rv ry r) include_jwkprotectrm r c K s t ||jsJ |}||d< |r,| |d< t|| jjsBJ || jjsTJ i }|D ]} | |v r\|| || < q\|r| jf i | }
nd}
| jf i |} | |j
| |
|} | |
| | dS )aD Sign.
:param bytes payload: Payload to sign.
:param JWK key: Key for signature.
:param JWASignature alg: Signature algorithm to use to sign.
:param bool include_jwk: If True, insert the JWK inside the signature headers.
:param FrozenSet protect: List of headers to protect.
r) r rg )rf rh ri ) rD kty
public_keyrH issubsetrt r8 popZ
json_dumpssignry rx ) r rv ry r) r} r~ rm Z
header_paramsZprotected_paramsrh rf ri r r r r s" zSignature.signr9 c s t }|d s |d= |S )Nrh )ro fields_to_partial_jsonrB )r? fieldsrq r r r s
z Signature.fields_to_partial_jsonjobjr c s4 t |}| |}d|d vr0td|S )Nr) re zalg not present)ro fields_from_jsonrn rB r
r )r r r Zfields_with_combinedrq r r r s
zSignature.fields_from_json)N)'r" r# r$ r% r( rt r^ __slots__r r= rf r' r] rh rb rl ri r_ r5 r* r rp r& r rn rx r rc ra boolr| frozensetr\ r r r r r
__classcell__r r rq r rd sH
*rd c @ s e Zd ZU dZdZeed< ee ed< eZ de
e j e
dddZeeed d d
d Zeed d
dZed ddZeed dddZd e
eeef dddZeeeef d dddZdS ) JWSzgJSON Web Signature.
:ivar str payload: JWS Payload.
:ivar str signature: JWS Signatures.
rv
signaturesrv r N)ry r c s t fddjD S )Verify.c 3 s | ]}| j V qd S rV )r| rv r; rz ry r? r r rY . z JWS.verify..)allr )r? ry r r r r| , s z
JWS.verify)rv rm r c K s | || j jf d|i|fdS )Sign.rv r )
signature_clsr )r rv rm r r r r 0 s zJWS.signr9 c C s t | jdksJ | jd S )zPGet a singleton signature.
:rtype: :class:`JWS.signature_cls`
r )r r r> r r r ri 5 s z
JWS.signaturec C s\ t | jdksJ d| jj vs&J t| jjdd t| j d t| jj S )z7Compact serialization.
:rtype: bytes
r r) rk rw )
r r ri rh rB r rP rf r! rv r> r r r
to_compact? s
zJWS.to_compact)compactr c C sf z| d\}}}W n ty0 tdY n0 | jt|dt|d}| t||fdS )zACompact deserialization.
:param bytes compact:
rw zOCompact JWS serialization should comprise of exactly 3 dot-separated componentsrk )rf ri r )split
ValueErrorr
r r r rX r )r r rf rv ri rz r r r from_compactR s
zJWS.from_compactT)flatr c C sR | j s
J t| j}|rBt| j dkrB| j d }||d< |S || j dS d S )Nr r rv r )r r rl rv r to_partial_json)r? r rv retr r r r e s
zJWS.to_partial_jsonr c s d|v r d|v r t dnfd|v rVdd | D } t|d j|fdS t|d t fdd |d D dS d S )
Nri r zFlat mixed with non-flatc S s i | ]\}}|d kr||qS )rv r )r; ry r r r r r@ x r z!JWS.from_json..rv r c 3 s | ]} j |V qd S rV )r r] r r r r rY r z JWS.from_json..)r
r rA r rb r r] rZ )r r Zfilteredr r r r] s s z
JWS.from_json)N)T)r" r# r$ r% r r_ r^ r rd r r rc ra r r| r& r r propertyri r r r r' r r r] r r r r r s
r c @ s e Zd ZdZeejddddZeejedddZ ee
e j dd d
Z
ee
e
dd d Zee
eej dd
dZedeee ee dddZdS )CLIzJWS CLI.N)argsr c C s |j j|j }|j |jdu r.g |_|jr@|jd t j
t j
||j t|jd}|jr~t| d n t| dS )r Nr) )rv ry r) r~ rk )r) r loadry readcloser~ r appendr r sysstdinr! rH printr r Zjson_dumps_pretty)r r ry rz r r r r s
zCLI.signc
C s |j r ttj }nLzttttj }W n0 t j
yf } zt | W Y d}~dS d}~0 0 |j dur|j
dusJ |j
|j }|j nd}tj|j |j|d S )r NF)ry )r r r r r r r! r
ru r
rL r ry r r r r stdoutwriterv r r| )r r rz r[ ry r r r r| s
z
CLI.verify)argr c C s t j|S rV )r r\ r] r r r r r _alg_type s z
CLI._alg_typec C s |t jjv sJ |S rV )rd rt r8 r r r r _header_type s zCLI._header_typec C s |t jjv sJ t jj| S rV )r` ra ZTYPESr r r r _kty_type s z
CLI._kty_typec C s |du rt jdd }t }|jddd | }|d}|j| jd |jdd t d
d d |jd
d| j
t j d |jddd| j
d |d}|j| jd |jdd t d
dd |jd| jdd ||}||S )z Parse arguments and sign/verify.Nr z --compact
store_true)actionr )funcz-kz--keyrbT)rE requiredz-az--alg)rE r1 z-pz --protectr )r rE r| Fz--kty)r argvargparseArgumentParser add_argumentadd_subparsers
add_parser set_defaultsr FileTyper r ZRS256r r| r
parse_argsr )r r parserZ
subparsersZ parser_signZ
parser_verifyparsedr r r run s
zCLI.run)N)r" r# r$ r% r& r Namespacer r r| r r r\ r r r r` ra r r r r' r r r r r r s r __main__)!r% r rO r typingr r r r r r r r r
ZOpenSSLr rc r r
r r r r` r r ZJSONObjectWithFieldsr( rd r r r" exitr r r r r s" , k fR