;i-2dZddlZddlmZddlmZddlmZddlmZdZdZ d Z d Z d Z d Z d ZdZdZdZ ddZdZdZdZ ddZ ddZdS)aA module that provides functions for handling rapt authentication. Reauth is a process of obtaining additional authentication (such as password, security token, etc.) while refreshing OAuth 2.0 credentials for a user. Credentials that use the Reauth flow must have the reauth scope, ``https://www.googleapis.com/auth/accounts.reauth``. This module provides a high-level function for executing the Reauth process, :func:`refresh_grant`, and lower-level helpers for doing the individual steps of the reauth process. Those steps are: 1. Obtaining a list of challenges from the reauth server. 2. Running through each challenge and sending the result back to the reauth server. 3. Refreshing the access token using the returned rapt token. N) exceptions)metrics)_client) challengesz/https://www.googleapis.com/auth/accounts.reauthz)https://reauth.googleapis.com/v2/sessions invalid_grant invalid_rapt rapt_required AUTHENTICATEDCHALLENGE_REQUIREDCHALLENGE_PENDINGc>tjS)aCheck if we are in an interractive environment. Override this function with a different logic if you are using this library outside a CLI. If the rapt token needs refreshing, the user needs to answer the challenges. If the user is not in an interractive environment, the challenges can not be answered and we just wait for timeout for no reason. Returns: bool: True if is interactive environment, False otherwise. )sysstdinisattyHC:\PYTHON\MyICR_Workspace\venv\Lib\site-packages\google/oauth2/reauth.pyis_interactiver<s 9    rcd|i}|r||d<tjtji}tj|t dz||d|S)aDoes initial request to reauth API to get the challenges. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. supported_challenge_types (Sequence[str]): list of challenge names supported by the manager. access_token (str): Access token with reauth scopes. requested_scopes (Optional(Sequence[str])): Authorized scopes for the credentials. Returns: dict: The response from the reauth API. supportedChallengeTypes oauthScopesForDomainPolicyLookupz:startT access_tokenuse_jsonheaders)rAPI_CLIENT_HEADER reauth_startr_token_endpoint_request _REAUTH_API)requestsupported_challenge_typesrrequested_scopesbodymetrics_headers r_get_challengesr&Msj &'@ ADD3C /0/1E1G1GHN  *h !    rc||d|d}tjtji}tj|t d|z||d|S)aYAttempt to refresh access token by sending next challenge result. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. session_id (str): session id returned by the initial reauth call. challenge_id (str): challenge id returned by the initial reauth call. client_input: dict with a challenge-specific client input. For example: ``{'credential': password}`` for password challenge. access_token (str): Access token with reauth scopes. Returns: dict: The response from the reauth API. RESPOND) sessionId challengeIdactionproposalResponsez /{}:continueTr)rrreauth_continuerrr format)r! session_id challenge_id client_inputrr$r%s r_send_challenge_resultr2lss$ #(   D /1H1J1JKN  *n++J777 !    rc 8|dD]}|ddkrtj|dd}|sjtjd|ddttj|j s-tjd|d| |}|sdSt||d |d ||cSdS) agGet the next challenge from msg and run it. Args: msg (dict): Reauth API response body (either from the initial request to https://reauth.googleapis.com/v2/sessions:start or from sending the previous challenge response to https://reauth.googleapis.com/v2/sessions/id:continue) request (google.auth.transport.Request): A callable used to make HTTP requests. access_token (str): reauth access token Returns: dict: The response from the reauth API. Raises: google.auth.exceptions.ReauthError: if reauth failed. rstatusREADY challengeTypeNz4Unsupported challenge type {0}. Supported types: {1},z%Challenge {0} is not locally eligibler)r*) rAVAILABLE_CHALLENGESgetrReauthFailErrorr.joinlistkeysis_locally_eligibleobtain_challenge_inputr2)msgr!r challengecr1s r_run_next_challengerCsC$&  X ' ) )   + / / /0JD Q Q ,FMMo.HHT*"A"F"F"H"HIIJJ  $ ,7>>o.  // ::  44%    m $         4rcht|ttj||}|dt kr|dSt dtD]}|dtks>|dtks-tj d |dtstj dt|||}|stj d|dt kr |dcStj d)aGiven an http request method and reauth access token, get rapt token. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. access_token (str): reauth access token requested_scopes (Sequence[str]): scopes required by the client application Returns: str: The rapt token. Raises: google.auth.exceptions.ReauthError: if reauth failed r4encodedProofOfReauthTokenrz6Reauthentication challenge failed due to API error: {}z_Reauthentication challenge could not be answered because you are not in an interactive session.zFailed to obtain rapt token.)r&r<rr8r=_AUTHENTICATEDrangeRUN_CHALLENGE_RETRY_LIMIT_CHALLENGE_REQUIRED_CHALLENGE_PENDINGrr:r.rrC)r!rr#r@_s r _obtain_raptrLsM  Z , 1 1 3 344   C 8}&&.// 1/ 0 044 M0 0 0CMEW4W4W,HOOM   ,.  "#w == M,-KLL L x=N * *23 3 3 3 +  $%C D DDrctjdtj|||||t g\}}}}t |||}tjd|S)a{Given an http request method and refresh_token, get rapt token. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. client_id (str): client id to get access token for reauth scope. client_secret (str): client secret for the client_id refresh_token (str): refresh token to refresh access token token_uri (str): uri to refresh access token scopes (Optional(Sequence[str])): scopes required by the client application Returns: str: The rapt token. Raises: google.auth.exceptions.RefreshError: If reauth failed. zReauthentication required. )r! client_id client_secret refresh_token token_uriscopes)r#zReauthentication successful. )rstderrwriter refresh_grant _REAUTH_SCOPErL) r!rNrOrPrQrRrrK rapt_tokens rget_rapt_tokenrXs&J3444$1## L!Qg|fMMMJJ5666 rFctj|||d}|rd||d<|r||d<tjtji} tj|||| \} } } | s+t| trtj | d| s| dtkr| d tks| d tkrL|stj d t|||||| }||d<tj|||| \} } } | stj| | tj| ||fzS) aUImplements the reauthentication flow. Args: request (google.auth.transport.Request): A callable used to make HTTP requests. token_uri (str): The OAuth 2.0 authorizations server's token endpoint URI. refresh_token (str): The refresh token to use to get a new access token. client_id (str): The OAuth 2.0 application's client ID. client_secret (str): The Oauth 2.0 appliaction's client secret. scopes (Optional(Sequence[str])): Scopes to request. If present, all scopes must be authorized for the refresh token. Useful if refresh token has a wild card scope (e.g. 'https://www.googleapis.com/auth/any-api'). rapt_token (Optional(str)): The rapt token for reauth. enable_reauth_refresh (Optional[bool]): Whether reauth refresh flow should be used. The default value is False. This option is for gcloud only, other users should use the default value. Returns: Tuple[str, Optional[str], Optional[datetime], Mapping[str, str], str]: The access token, new refresh token, expiration, the additional data returned by the token endpoint, and the rapt token. Raises: google.auth.exceptions.RefreshError: If the token endpoint returned an error. ) grant_typerNrOrP scoperapt)rF) retryableerror error_subtypezaReauthentication is needed. Please run `gcloud auth application-default login` to reauthenticate.)rR)r_REFRESH_GRANT_TYPEr;rrtoken_request_user _token_endpoint_request_no_throw isinstancestrr RefreshErrorr9_REAUTH_NEEDED_ERROR!_REAUTH_NEEDED_ERROR_INVALID_RAPT"_REAUTH_NEEDED_ERROR_RAPT_REQUIREDrX_handle_error_response_handle_refresh_grant_response) r!rQrPrNrOrRrWenable_reauth_refreshr$r%response_status_ok response_dataretryable_errors rrUrUsP1&&   D )((W "!V /1K1M1MNN9@9aD.:::6  F*]C"@"@F%muEEEE    g & &*> > >   o . .2S S S  115WWW% )s $ Y }iPV   "V  4 Yn       G&}oFFF  1- O OS r)N)NNF)__doc__r google.authrr google.oauth2rrrVr rgrhrirFrIrJrHrr&r2rCrLrXrUrrrrssB( """"""!!!!!!$$$$$$B 9 &$2!%4" *( $HL>   F...b1E1E1EjIM####X WWWWWWr