;i(>dZddlZddlZddlZddlZddlmZddlmZddlm Z ddl m Z m Z m Z dZdZd Zd ZGd d ej ZGddeZGddeZGddeZdeeefDZdS)z" Challenges for reauthentication. N)_helpers) exceptions)webauthn_handler_factory)$AuthenticationExtensionsClientInputs GetRequestPublicKeyCredentialDescriptorzhttps://accounts.google.comzFPlease run `gcloud auth login` to complete reauthentication with SAML.ic*tj|S)zGet password from user. Override this function with a different logic if you are using this library outside a CLI. Args: text (str): message for the password prompt. Returns: str: password string. )getpass)texts LC:\PYTHON\MyICR_Workspace\venv\Lib\site-packages\google/oauth2/challenges.pyget_user_passwordr (s ?4  ceZdZdZeejdZeejdZejdZ dS)ReauthChallengez!Base class for reauth challenges.c td)z"Returns the name of the challenge.z!name property must be implementedNotImplementedErrorselfs r namezReauthChallenge.name:s""EFFFrc td)zAReturns true if a challenge is supported locally on this machine.z0is_locally_eligible property must be implementedrrs r is_locally_eligiblez#ReauthChallenge.is_locally_eligible@s""TUUUrc td)acPerforms logic required to obtain credentials and returns it. Args: metadata (Mapping): challenge metadata returned in the 'challenges' field in the initial reauth request. Includes the 'challengeType' field and other challenge-specific fields. Returns: response that will be send to the reauth service as the content of the 'proposalResponse' field in the request body. Usually a dict with the keys specific to the challenge. For example, ``{'credential': password}`` for password challenge. z1obtain_challenge_input method must be implementedrrmetadatas r obtain_challenge_inputz&ReauthChallenge.obtain_challenge_inputFs""UVVVrN) __name__ __module__ __qualname____doc__propertyabcabstractmethodrrrrr rr7s++ GGXGVVXV WWWWWrr) metaclasscpeZdZdZedZedZeje dZ dS)PasswordChallengez(Challenge that asks for user's password.cdS)NPASSWORDr$rs r rzPasswordChallenge.name[szrcdSNTr$rs r rz%PasswordChallenge.is_locally_eligible_trc0td}|sd}d|iS)NzPlease enter your password: credential)r )runused_metadatapasswds r rz(PasswordChallenge.obtain_challenge_inputcs("#@AA Ff%%rN) rrrr r!rrrcopy_docstringrrr$rr r'r'Xsw22 XXX_--&&.-&&&rr'c|eZdZdZedZedZeje dZ dZ dZ dS)SecurityKeyChallengez2Challenge that asks for user's security key touch.cdS)N SECURITY_KEYr$rs r rzSecurityKeyChallenge.namens~rcdSr+r$rs r rz(SecurityKeyChallenge.is_locally_eligiblerr,rc tj}|}|5tjd|||Sn#t$rYnwxYw ddl}ddl }ddl }n"#t$rtj dwxYw|d}|d}|d}|d}||kr||g} n|g} g} |D]} | dd } |jt#t%j| } | d d }t%j|}| | |d d}| D]} |d z }|jjt0}||| tjj }d|icS#|jj$r}|j|jjjkr>|t=| kr&tjdYd}~dSYd}~|j|jjjkr tjdn|Yd}~nd}~w|jj $r=}tjd!|Yd}~Ld}~w|jj"$r"tjdYnwxYwdSdS)Nz*Please insert and touch your security key rzpyu2f dependency is required to use Security key reauth feature. It can be installed via `pip install pyu2f` or `pip install google-auth[reauth]`. securityKey challenges applicationIdrelyingPartyId keyHandleascii challenge)keyr?)print_callbackzIneligible security key. z0Timed out while waiting for security key touch. zPlugin error: {}. zNo security key found. )#rWebauthnHandlerFactory get_handlersysstderrwrite _obtain_challenge_input_webauthn Exceptionpyu2f.convenience.authenticator pyu2f.errors pyu2f.model ImportErrorrReauthFailErrorencodemodel RegisteredKey bytearraybase64urlsafe_b64decodeappend convenience authenticatorCreateCompositeAuthenticator REAUTH_ORIGIN AuthenticateerrorsU2FErrorcodeDEVICE_INELIGIBLElenTIMEOUT PluginErrorformatNoDeviceFoundError)rrfactorywebauthn_handlerpyu2fskr:application_idrelying_party_idapplication_parameterschallenge_datackhr@r?triesapp_idapiresponsees r rz+SecurityKeyChallenge.obtain_challenge_inputvs .EGGG&2244 +   !NOOO<> >  !66yAA*/(     +// <> ? ? ?G  '/@!-!6!I)2<+%$%   x((sF55 G8?4G33G8ctj|}tj|dS)z\Converts standard b64 encoded string to url safe b64 encoded string with no padding.=)rSrTurlsafe_b64encodedecoderstrip)rsbs r rz0SecurityKeyChallenge._unpadded_urlsafe_b64recodes?  $Q ' ''**1133::3???rN) rrrr r!rrrr2rrrHrr$rr r4r4ks<< XXX_--II.-IV4)4)4)l@@@@@rr4cDeZdZdZedZedZdZdS) SamlChallengezChallenge that asks the users to browse to their ID Providers. Currently SAML challenge is not supported. When obtaining the challenge input, exception will be raised to instruct the users to run `gcloud auth login` for reauthentication. cdS)NSAMLr$rs r rzSamlChallenge.namesvrcdSr+r$rs r rz!SamlChallenge.is_locally_eligible r,rc4tjt)N)rReauthSamlChallengeFailErrorSAML_CHALLENGE_MESSAGErs r rz$SamlChallenge.obtain_challenge_inputs56LMMMrN)rrrr r!rrrr$rr rrshXXNNNNNrrci|] }|j| Sr$)r).0r?s r rs,NIr)r r"rSr rE google.authrr google.oauth2rgoogle.oauth2.webauthn_typesrrrrYrrr ABCMetarr'r4rAVAILABLE_CHALLENGESr$rr rs  """"""222222. L ! ! !WWWWW WWWWB&&&&&&&&&Q@Q@Q@Q@Q@?Q@Q@Q@hNNNNNONNN.**,,.?.?.A.A==??Sr