o ÿÑÐbO7ã@sÐdZddlZddlZddlZddlmZddlmZmZddl m Z m Z dZ dZ d Zd Zd Zd Zd'd d„Zd'dd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd „Zd!d"„Zd#d$„Zd%d&„ZdS)(zå authlib.oauth1.rfc5849.signature ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module represents a direct implementation of `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 éN)Úurlparse)Ú to_unicodeÚto_bytesé)ÚescapeÚunescapez HMAC-SHA1zRSA-SHA1Z PLAINTEXTÚHEADERZQUERYZBODYc Csnt||ƒ}g}|D]\}}|dvrq | d¡rt|ƒ}| ||f¡q t|ƒ}d t| ¡ƒt|ƒt|ƒg¡S)aXGenerate signature base string from request, per `Section 3.4.1`_. For example, the HTTP request:: POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Authorization: OAuth realm="Example", oauth_consumer_key="9djdj82h48djs9d2", oauth_token="kkk9d7dh3k39sjv7", oauth_signature_method="HMAC-SHA1", oauth_timestamp="137131201", oauth_nonce="7d8f3e4a", oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D" c2&a3=2+q is represented by the following signature base string (line breaks are for display purposes only):: POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_ key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk 9d7dh3k39sjv7 .. _`Section 3.4.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1 )Zoauth_signatureÚrealmZoauth_ú&)Únormalize_base_string_uriÚ startswithrÚappendÚnormalize_parametersÚjoinrÚupper) ÚmethodÚuriÚparamsÚhostZbase_string_uriZunescaped_paramsÚkÚvZnormalized_params©rú_/var/www/secure340b-portal/env/lib/python3.10/site-packages/authlib/oauth1/rfc5849/signature.pyÚconstruct_base_strings    ýrc Cs˜t|ƒ}t |¡\}}}}}}|r|stdƒ‚|sd}| ¡}| ¡}|dur+| ¡}d}d|vrA| dd¡\}} || f|vrA|}t ||||ddf¡S)a7Normalize Base String URI per `Section 3.4.1.2`_. For example, the HTTP request:: GET /r%20v/X?id=123 HTTP/1.1 Host: EXAMPLE.COM:80 is represented by the base string URI: "http://example.com/r%20v/X". In another example, the HTTPS request:: GET /?q=1 HTTP/1.1 Host: www.example.net:8080 is represented by the base string URI: "https://www.example.net:8080/". .. _`Section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 The host argument overrides the netloc part of the uri argument. z$uri must include a scheme and netlocú/N))ÚhttpÚ80)ÚhttpsÚ443ú:rÚ)rrÚ ValueErrorÚlowerÚsplitÚ urlunparse) rrÚschemeÚnetlocÚpathrÚqueryÚfragmentZ default_portsÚportrrrr Rs   r cCs.dd„|Dƒ}| ¡dd„|Dƒ}d |¡S)a× Normalize parameters per `Section 3.4.1.3.2`_. For example, the list of parameters from the previous section would be normalized as follows: Encoded:: +------------------------+------------------+ | Name | Value | +------------------------+------------------+ | b5 | %3D%253D | | a3 | a | | c%40 | | | a2 | r%20b | | oauth_consumer_key | 9djdj82h48djs9d2 | | oauth_token | kkk9d7dh3k39sjv7 | | oauth_signature_method | HMAC-SHA1 | | oauth_timestamp | 137131201 | | oauth_nonce | 7d8f3e4a | | c2 | | | a3 | 2%20q | +------------------------+------------------+ Sorted:: +------------------------+------------------+ | Name | Value | +------------------------+------------------+ | a2 | r%20b | | a3 | 2%20q | | a3 | a | | b5 | %3D%253D | | c%40 | | | c2 | | | oauth_consumer_key | 9djdj82h48djs9d2 | | oauth_nonce | 7d8f3e4a | | oauth_signature_method | HMAC-SHA1 | | oauth_timestamp | 137131201 | | oauth_token | kkk9d7dh3k39sjv7 | +------------------------+------------------+ Concatenated Pairs:: +-------------------------------------+ | Name=Value | +-------------------------------------+ | a2=r%20b | | a3=2%20q | | a3=a | | b5=%3D%253D | | c%40= | | c2= | | oauth_consumer_key=9djdj82h48djs9d2 | | oauth_nonce=7d8f3e4a | | oauth_signature_method=HMAC-SHA1 | | oauth_timestamp=137131201 | | oauth_token=kkk9d7dh3k39sjv7 | +-------------------------------------+ and concatenated together into a single string (line breaks are for display purposes only):: a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1 &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7 .. _`Section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 cSs g|] \}}t|ƒt|ƒf‘qSr©r©Ú.0rrrrrÚ ãs z(normalize_parameters..cSsg|] \}}d ||¡‘qS)z{0}={1})Úformatr,rrrr.ísr )Úsortr)rÚ key_valuesZparameter_partsrrrr™sJ rcCs"|j dd¡}t|j|j|j|ƒS)z,Generate signature base string from request.ÚHostN)ÚheadersÚgetrrrr)ÚrequestrrrrÚgenerate_signature_base_stringõsÿr6cCs^|}t|pdƒ}|d7}|t|pdƒ7}t t|ƒt|ƒtj¡}t | ¡¡dd…}t |ƒS)aZGenerate signature via HMAC-SHA1 method, per `Section 3.4.2`_. The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature algorithm as defined in `RFC2104`_:: digest = HMAC-SHA1 (key, text) .. _`RFC2104`: https://tools.ietf.org/html/rfc2104 .. _`Section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 r r Néÿÿÿÿ) rÚhmacÚnewrÚhashlibÚsha1ÚbinasciiÚ b2a_base64Údigestr)Ú base_stringÚ client_secretÚ token_secretÚtextÚkeyÚ signatureÚsigrrrÚhmac_sha1_signatureüs rFcCs<ddlm}t|ƒ}|t|ƒ|ƒ}t |¡dd…}t|ƒS)arGenerate signature via RSA-SHA1 method, per `Section 3.4.3`_. The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in `RFC3447, Section 8.2`_ (also known as PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`Section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 r)Ú sign_sha1Nr7)ÚrsarGrr<r=r)r?Zrsa_private_keyrGÚsrErrrÚrsa_sha1_signature*s rJcCs(t|pdƒ}|d7}|t|pdƒ7}|S)aÊGenerate signature via PLAINTEXT method, per `Section 3.4.4`_. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`Section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 r r r+)r@rArDrrrÚplaintext_signature>s rKcCst|ƒ}t||j|jƒS)zSign a HMAC-SHA1 signature.)r6rFr@rA©Úclientr5r?rrrÚsign_hmac_sha1^s ÿrNcCst|ƒ}t||jƒS)z4Sign a RSASSA-PKCS #1 v1.5 base64 encoded signature.)r6rJZrsa_keyrLrrrÚ sign_rsa_sha1es rOcCst|j|jƒS)zSign a PLAINTEXT signature.)rKr@rA)rMr5rrrÚsign_plaintextksrPcCs&t|ƒ}t||j|jƒ}t ||j¡S)zVerify a HMAC-SHA1 signature.)r6rFr@rAr8Úcompare_digestrD)r5r?rErrrÚverify_hmac_sha1ps  ÿrRcCs6ddlm}t|ƒ}t t|jƒ¡}||t|ƒ|jƒS)z6Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature.r)Ú verify_sha1)rHrSr6r<Ú a2b_base64rrDZrsa_public_key)r5rSr?rErrrÚverify_rsa_sha1xs rUcCst|j|jƒ}t ||j¡S)zVerify a PLAINTEXT signature.)rKr@rAr8rQrD)r5rErrrÚverify_plaintext€srV)N)Ú__doc__r<r:r8Zauthlib.common.urlsrZauthlib.common.encodingrrÚutilrrZSIGNATURE_HMAC_SHA1ZSIGNATURE_RSA_SHA1ZSIGNATURE_PLAINTEXTZSIGNATURE_TYPE_HEADERZSIGNATURE_TYPE_QUERYZSIGNATURE_TYPE_BODYrr rr6rFrJrKrNrOrPrRrUrVrrrrÚs4   8G\.