VSf3d ddlZddlZddlZddlZddlZddlZddlZddlZddlZ ddl m Z ddl m Z ddlmZddlmZddlmZejj&ZdZdZd Zd Zeejej4fZd Zd Zej<d gdZdZ ddZ!dZ"dZ#e#dddddddddddf dZ$dZ%dZ&dZ'dZ(y)N) exceptions)requests)_helpers)_NOW)_UTCz[https://googleapis.dev/python/google-api-core/latest/auth.html#setting-up-a-service-accountct|tjjjs(t dj t|ty)aiRaise AttributeError if the credentials are unsigned. :type credentials: :class:`google.auth.credentials.Signing` :param credentials: The credentials used to create a private key for signing text. :raises: :exc:`AttributeError` if credentials is not an instance of :class:`google.auth.credentials.Signing`. zyou need a private key to sign credentials.the credentials you are currently using {} just contains a token. see {} for more details.N) isinstancegoogleauth credentialsSigningAttributeErrorformattypeSERVICE_ACCOUNT_URL)r s \C:\Users\user\Documents\project_loop\venv\Lib\site-packages\google/cloud/storage/_signing.pyensure_signed_credentialsr-sJ k6;;#:#:#B#B C vd;/1DE    Dct||j|jd}tj|}|j }|||dS)aGets query parameters for creating a signed URL. :type credentials: :class:`google.auth.credentials.Signing` :param credentials: The credentials used to create a private key for signing text. :type expiration: int or long :param expiration: When the signed URL should expire. :type string_to_sign: str :param string_to_sign: The string to be signed by the credentials. :raises: :exc:`AttributeError` if credentials is not an instance of :class:`google.auth.credentials.Signing`. :rtype: dict :returns: Query parameters matching the signing credentials with a signed payload. asciiGoogleAccessIdExpires Signature)r sign_bytesencodebase64 b64encode signer_email)r expirationstring_to_signsignature_bytes signatureservice_account_names rget_signed_query_params_v2r%@sV(k*!,,^-B-B7-KLO  1I&33. rct|tjrtt}||z}t|tjrt j |}|dz}t|tstdt|z|S)a Convert 'expiration' to a number of seconds in the future. :type expiration: Union[Integer, datetime.datetime, datetime.timedelta] :param expiration: Point in time when the signed URL should expire. If a ``datetime`` instance is passed without an explicit ``tzinfo`` set, it will be assumed to be ``UTC``. :raises: :exc:`TypeError` when expiration is not a valid type. :rtype: int :returns: a timestamp as an absolute number of seconds since epoch. i@B=Expected an integer timestamp, datetime, or timedelta. Got %s) r datetime timedeltarrr_microseconds_from_datetimeint TypeErrorr)r nowmicross rget_expiration_seconds_v2r/_s*h0014j:% *h//055jAu_ j# & "&z"2 3   rct|tstdt|zt t }t|t r|}t|tjr1|j |jtj}||z }t|tjrt |j}tkDrtdt|S)aVConvert 'expiration' to a number of seconds offset from the current time. :type expiration: Union[Integer, datetime.datetime, datetime.timedelta] :param expiration: Point in time when the signed URL should expire. If a ``datetime`` instance is passed without an explicit ``tzinfo`` set, it will be assumed to be ``UTC``. :raises: :exc:`TypeError` when expiration is not a valid type. :raises: :exc:`ValueError` when expiration is too large. :rtype: Integer :returns: seconds in the future when the signed URL will expire r'tzinfoz.Max allowed expiration interval is seven days )r _EXPIRATION_TYPESr,rrrr+r(r2replacerUTCr) total_seconds SEVEN_DAYS ValueError)r r-secondss rget_expiration_seconds_v4r:s j"3 4 "&z"2 3  t*C*c"*h//0    $#++8<<+@J#% *h001j..01I*VWW Nrc|g}n)t|trt|j}|sggfSt j t}|D]V\}}|j j}dj|j}||j|Xtd|jD}|Dcgc]}dj|}}||fScc}w)amCanonicalize headers for signing. See: https://cloud.google.com/storage/docs/access-control/signed-urls#about-canonical-extension-headers :type headers: Union[dict|List(Tuple(str,str))] :param headers: (Optional) Additional HTTP headers to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers Requests using the signed URL *must* pass the specified header (name and value) with each request for the URL. :rtype: str :returns: List of headers, normalized / sortted per the URL refernced above.  c3HK|]\}}|dj|fyw),N)join).0keyvals r z(get_canonical_headers..s!Uhc3c388C=1Us "z{}:{}) r dictlistitems collections defaultdictlowerstripr?splitappendsortedr)headers normalizedrArBordered_headersitemcanonical_headerss rget_canonical_headersrSs" GT "w}}' 2v ((.J$Siik!hhsyy{#3s#$ U*BRBRBTUUO;JK4.KK o --Ls C) _Canonical)methodresourcequery_parametersrNct|\}}|dk(rd}|jd|t||g|Std|j D}t j j|}|d|}t||||S)ahCanonicalize method, resource per the V2 spec. :type method: str :param method: The HTTP verb that will be used when requesting the URL. Defaults to ``'GET'``. If method is ``'RESUMABLE'`` then the signature will additionally contain the `x-goog-resumable` header, and the method changed to POST. See the signed URL docs regarding this flow: https://cloud.google.com/storage/docs/access-control/signed-urls :type resource: str :param resource: A pointer to a specific resource (typically, ``/bucket-name/path/to/blob.txt``). :type query_parameters: dict :param query_parameters: (Optional) Additional query parameters to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers#query :type headers: Union[dict|List(Tuple(str,str))] :param headers: (Optional) Additional HTTP headers to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers Requests using the signed URL *must* pass the specified header (name and value) with each request for the URL. :rtype: :class:_Canonical :returns: Canonical method, resource, query_parameters, and headers. RESUMABLEPOSTzx-goog-resumable:startc3rK|]/\}}|j|xr|jxsdf1yw)N)rIrJ)r@rAvalues rrCz"canonicalize_v2..s7 C e- 34s57?)rSrLrTrMrFurllibparse urlencode)rUrVrWrN_ normalized_qp encoded_qpcanonical_resources rcanonicalize_v2rfs@'w/JGQ /0&(B88*002M'' 6J$:Qzl3 f0- IIrGETcBt|}t||| | }|j|xsd|xsdt|g}|j |j |j |jdj|}| r| rt|| | }| ||d}n t|||}|||d<|||d<| | |d<|j|jt|j}dj||t j"j%|S) aGenerate a V2 signed URL to provide query-string auth'n to a resource. .. note:: Assumes ``credentials`` implements the :class:`google.auth.credentials.Signing` interface. Also assumes ``credentials`` has a ``signer_email`` property which identifies the credentials. .. note:: If you are on Google Compute Engine, you can't generate a signed URL. If you'd like to be able to generate a signed URL from GCE, you can use a standard service account from a JSON file rather than a GCE service account. See headers [reference](https://cloud.google.com/storage/docs/reference-headers) for more details on optional arguments. :type credentials: :class:`google.auth.credentials.Signing` :param credentials: Credentials object with an associated private key to sign text. :type resource: str :param resource: A pointer to a specific resource (typically, ``/bucket-name/path/to/blob.txt``). Caller should have already URL-encoded the value. :type expiration: Union[Integer, datetime.datetime, datetime.timedelta] :param expiration: Point in time when the signed URL should expire. If a ``datetime`` instance is passed without an explicit ``tzinfo`` set, it will be assumed to be ``UTC``. :type api_access_endpoint: str :param api_access_endpoint: (Optional) URI base. Defaults to empty string. :type method: str :param method: The HTTP verb that will be used when requesting the URL. Defaults to ``'GET'``. If method is ``'RESUMABLE'`` then the signature will additionally contain the `x-goog-resumable` header, and the method changed to POST. See the signed URL docs regarding this flow: https://cloud.google.com/storage/docs/access-control/signed-urls :type content_md5: str :param content_md5: (Optional) The MD5 hash of the object referenced by ``resource``. :type content_type: str :param content_type: (Optional) The content type of the object referenced by ``resource``. :type response_type: str :param response_type: (Optional) Content type of responses to requests for the signed URL. Ignored if content_type is set on object/blob metadata. :type response_disposition: str :param response_disposition: (Optional) Content disposition of responses to requests for the signed URL. :type generation: str :param generation: (Optional) A value that indicates which generation of the resource to fetch. :type headers: Union[dict|List(Tuple(str,str))] :param headers: (Optional) Additional HTTP headers to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers Requests using the signed URL *must* pass the specified header (name and value) with each request for the URL. :type service_account_email: str :param service_account_email: (Optional) E-mail address of the service account. :type access_token: str :param access_token: (Optional) Access token for a service account. :type query_parameters: dict :param query_parameters: (Optional) Additional query parameters to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers#query :raises: :exc:`TypeError` when expiration is not a valid type. :raises: :exc:`AttributeError` if credentials is not an instance of :class:`google.auth.credentials.Signing`. :rtype: str :returns: A signed URL you can use to access the resource until expiration. r\ rresponse-content-typeresponse-content-disposition generationz"{endpoint}{resource}?{querystring})endpointrV querystring)r/rfrUstrextendrNrLrVr? _sign_messager%updaterWrMrFrr_r`ra)r rVr api_access_endpointrU content_md5 content_type response_typeresponse_dispositionrlrNrWservice_account_email access_tokenexpiration_stamp canonicalelements_to_signr!r#signed_query_paramssorted_signed_query_paramss rgenerate_signed_url_v2rsVZ1<2BGLI r   I--.I../YY/0N -!.,@UV 3'"  9 )>  7D34'>R:;,6L)y99:!'(;(A(A(C!D 0 6 6$LL**+EF 7 ri: zhttps://storage.googleapis.comc:t|}|t\}}n|}|dd}| }| r| st||j}|d}|d|}| i} ||| d<||| d<| Dcgc]}|j }}d|vr,t j j|j| d<|jd k(rd }d | d <t| \}}d j|d z}dj|Dcgc]\}}| c}}}| i} n'| jDcic] \}}||xsd} }}d| d<|| d<|| d<|| d<|| d<||| d<||| d<| | | d<t| }t|}d|vr|d}nd}||||||g} d j| }!tj |!j#dj%}"d|||"g}#d j|#}$| rI| rGt'|$| | }%t)j*|%}&t-j.|&j1d}%nD|j3|$j#d}&t-j.|&j1d}%dj5||||%Scc}wcc}}wcc}}w)a/Generate a V4 signed URL to provide query-string auth'n to a resource. .. note:: Assumes ``credentials`` implements the :class:`google.auth.credentials.Signing` interface. Also assumes ``credentials`` has a ``signer_email`` property which identifies the credentials. .. note:: If you are on Google Compute Engine, you can't generate a signed URL. If you'd like to be able to generate a signed URL from GCE,you can use a standard service account from a JSON file rather than a GCE service account. See headers [reference](https://cloud.google.com/storage/docs/reference-headers) for more details on optional arguments. :type credentials: :class:`google.auth.credentials.Signing` :param credentials: Credentials object with an associated private key to sign text. That credentials must provide signer_email only if service_account_email and access_token are not passed. :type resource: str :param resource: A pointer to a specific resource (typically, ``/bucket-name/path/to/blob.txt``). Caller should have already URL-encoded the value. :type expiration: Union[Integer, datetime.datetime, datetime.timedelta] :param expiration: Point in time when the signed URL should expire. If a ``datetime`` instance is passed without an explicit ``tzinfo`` set, it will be assumed to be ``UTC``. :type api_access_endpoint: str :param api_access_endpoint: URI base. Defaults to "https://storage.googleapis.com/" :type method: str :param method: The HTTP verb that will be used when requesting the URL. Defaults to ``'GET'``. If method is ``'RESUMABLE'`` then the signature will additionally contain the `x-goog-resumable` header, and the method changed to POST. See the signed URL docs regarding this flow: https://cloud.google.com/storage/docs/access-control/signed-urls :type content_md5: str :param content_md5: (Optional) The MD5 hash of the object referenced by ``resource``. :type content_type: str :param content_type: (Optional) The content type of the object referenced by ``resource``. :type response_type: str :param response_type: (Optional) Content type of responses to requests for the signed URL. Ignored if content_type is set on object/blob metadata. :type response_disposition: str :param response_disposition: (Optional) Content disposition of responses to requests for the signed URL. :type generation: str :param generation: (Optional) A value that indicates which generation of the resource to fetch. :type headers: dict :param headers: (Optional) Additional HTTP headers to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers Requests using the signed URL *must* pass the specified header (name and value) with each request for the URL. :type query_parameters: dict :param query_parameters: (Optional) Additional query parameters to be included as part of the signed URLs. See: https://cloud.google.com/storage/docs/xml-api/reference-headers#query :type service_account_email: str :param service_account_email: (Optional) E-mail address of the service account. :type access_token: str :param access_token: (Optional) Access token for a service account. :raises: :exc:`TypeError` when expiration is not a valid type. :raises: :exc:`AttributeError` if credentials is not an instance of :class:`google.auth.credentials.Signing`. :rtype: str :returns: A signed URL you can use to access the resource until expiration. Nz/auto/storage/goog4_request/z Content-Typez Content-MD5hostHostrYrZstartzx-goog-resumableri;r\zGOOG4-RSA-SHA256zX-Goog-AlgorithmzX-Goog-Credentialz X-Goog-DatezX-Goog-ExpireszX-Goog-SignedHeadersrjrkrlzx-goog-content-sha256zUNSIGNED-PAYLOADrz{}{}?{}&X-Goog-Signature={})r:get_v4_now_dtstampsrrrIr_r`urlparsenetlocupperrSr?rF _url_encoderDhashlibsha256r hexdigestrqr b64decodebinasciihexlifydecoderr)'r rVr rsrUrtrurvrwrlrNrWrxry_request_timestampexpiration_secondsrequest_timestamp datestamp client_emailcredential_scope credentialrA header_namesrRrPcanonical_header_stringrbsigned_headersr]canonical_query_stringlowercased_headerspayloadcanonical_elementscanonical_requestcanonical_request_hashstring_elementsr!r#r"s' rgenerate_signed_url_v4rs8b3:>!':'<$9.&r* )L 4!+."// #$?@ >#3"45J".!, +23CCIIK3L3 \! ,,//0CDKK ||~$&-"#)>w)G& #$t+XXAvsAsABN?O?U?U?WXeC",XX+='(,6()&7]#);%&/=+, 4A01';O78)3&()9:o."44$%<=$   "45$^^  )ik  O YY/N-!.,@UV  **95$$_5<rs  "*!.. -  &>>(++X-?-?@#L".J$[ # #G /Jl  Zz 3)  Wt  (V$" /r