@wj6dZddlZddlZddlZddlZddlZddlZddlmZm Z ddl Z ddl m Z m Z dZgdZdZdZd Zd Zd Zeeeezz ez ZegezegezzZd Zd ZdZdZdZdZdZdZdZ dZ!y)z'Helpers for Agent Identity credentials.N)quoteurlparse)environment_vars exceptionszThe cryptography library is required for certificate-based authentication.Please install it with `pip install google-auth[cryptography]`.)z+^agents\.global\.org-\d+\.system\.id\.goog$z,^agents\.global\.proj-\d+\.system\.id\.goog$z3^agents-nonprod\.global\.org-\d+\.system\.id\.goog$z4^agents-nonprod\.global\.proj-\d+\.system\.id\.goog$z=/var/run/secrets/workload-spiffe-credentials/certificates.pem2g?g?c|sy tj|}tj|jxr|jdkDS#t $rt $rYywxYw)z=Checks if a file exists, is a regular file, and is not empty.Fr)osstatS_ISREGst_modest_sizePermissionErrorOSError)pathsts _/root/dashboard-youtube/.venv/lib/python3.12/site-packages/google/auth/_agent_identity_utils.py_is_certificate_file_readyr;sY  WWT]||BJJ':BJJN:  sAA AActjjtj}|sytj j t} tj j|}tj j|}tj j||g|k(}t||S#t$rd}YwxYw)a\Gets the agent certificate path from the certificate config file. The path to the certificate config file is read from the GOOGLE_API_CERTIFICATE_CONFIG environment variable. This function can optionally trigger polling to handle cases where the environment variable is set before the files are available on the filesystem. Returns: Optional[str]: The path to the agent's certificate file, or None if unavailable. Raises: google.auth.exceptions.RefreshError: If the certificate config file or the certificate file cannot be found after retries. NF) r environgetrGOOGLE_API_CERTIFICATE_CONFIGrdirname_WELL_KNOWN_CERT_PATHabspath commonpath ValueError$_get_cert_path_with_optional_polling)cert_config_pathwell_known_dir abs_cert_pathabs_well_known_dir should_polls r#get_agent_identity_certificate_pathr$Lszz~~&6&T&TU WW__%:;N(89 WW__^< GG   2MB C! "  00@+ NN  sA"C CCc d}d}tD]^} t|}|yt|r|cS|sy|s"tjd|dt dd}tj |`t#j$d tj&d #t $r$}tjd|dYd}~yd}~wtttf$rl}tjj|rYd}~y|sYd}~y|s3tjd |d tjd t dd}Yd}~d}~wwxYw)aiGets the certificate path, optionally polling until it is ready. Args: cert_config_path (str): The path to the certificate configuration file. should_poll (bool): If True, the function will poll for the file and certificate to be ready. If False, it will check only once and return early if they are not immediately available. Returns: str: The path to the certificate file, or None if unavailable. Raises: google.auth.exceptions.RefreshError: If the certificate config file or the certificate file cannot be found after retries. FNzCertificate file not ready at z(. Retrying until startup timeout (up to z seconds total)...TzIPermission denied when accessing certificate config or certificate file: M. Token binding protection cannot be enabled. Falling back to unbound tokens.z1Certificate config file not found or incomplete: z (from z> environment variable). Retrying until startup timeout (up to zCertificate config or certificate file not found after multiple retries. Token binding protection is failing. You can turn off this protection by setting z) to false to fall back to unbound tokens.)_POLLING_INTERVALS_parse_cert_path_from_configrwarningswarn_TOTAL_TIMEOUTrIOErrorrKeyErrorr rexistsrrtimesleepr RefreshError7GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES)rr#has_logged_config_warninghas_logged_cert_warninginterval cert_pathes rrrssk !&#&.* 145EFI ))4  * 4YK?ghvgwxJK+/'6 8].`  ! ! \  S S TU* * 7  MM[\][^_^^ X. 1ww~~./, Gs''EEFG==K B BB$B D>B;;D>D97D9?5D99D>c2ddl}t|dd5}|j|}dddttr|j dnd}t|tr|j dnd}t|trd|vry|dS#1swYixYw) a Reads the cert config file and returns the cert_path. Args: cert_config_path (str): The path to the certificate configuration file. Returns: Optional[str]: The path to the certificate file, or None if not found in the config. Raises: IOError: If the certificate config file cannot be read. ValueError: If the certificate config file contains invalid JSON. KeyError: If the certificate config file does not contain the expected structure. rNrutf-8)encoding cert_configsworkloadr6)jsonopenload isinstancedictr)rr>f cert_configr<workload_configs rr(r(s  g 6#!iil #,6k4+H 'd)3<(F $D ot , ?0R ; ''##s B  Bctjjtjdj dk(}|ryddlm}|j}|duryt}|sy t|d5}|j}dddtS#1swYxYw#t$r&}tjd|d |d Yd}~yd}~wwxYw) a1Gets and parses the agent identity certificate if not opted out. Checks if the user has opted out of certificate-bound tokens. If not, it gets the certificate path, reads the file, and parses it. Returns: The parsed certificate object if found and not opted out, otherwise None. truefalseNr _mtls_helperFrbz2Failed to read agent identity certificate file at z: r&)r rrrr2lowergoogle.auth.transportrJ_check_use_client_cert_envr$r?readrr)r*parse_certificate) is_opted_outrJ env_overrider6 cert_file cert_bytesr7s r(get_and_parse_agent_identity_certificaterUs   T T   %'   3::?s 727c ddlm}ddlm} |jj |j }|jj|j}|D]M}t|}|jdk(s|j}tD]}tj ||syOy#|j$rYywxYw#t"$r} t#t$| d} ~ wwxYw)aChecks if a certificate is an Agent Identity certificate. This is determined by checking the Subject Alternative Name (SAN) for a SPIFFE ID with a trust domain matching Agent Identity patterns. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: bool: True if the certificate is an Agent Identity certificate, False otherwise. rrW) ExtensionOIDFspiffeTN)rYrXcryptography.x509.oidr^ extensionsget_extension_for_oidSUBJECT_ALTERNATIVE_NAMEExtensionNotFoundvalueget_values_for_typeUniformResourceIdentifierrschemenetloc,_AGENT_IDENTITY_SPIFFE_TRUST_DOMAIN_PATTERNSrematchr[r\) certrXr^exturisuri parsed_uri trust_domainpatternr7s r_is_agent_identity_certificaterts?%6 //7755C yy,,T-K-KL $C!#J  H,)00 K$Gxx6#$  $%%   ?67Q>?sL C%B,AC9+C%C(C,B>;C=B>>C C CCcb ddlm}|j|jj}t j |j}tj|jd}|jd}t|S#t$r}tt|d}~wwxYw)aCalculates the URL-encoded, unpadded, base64-encoded SHA256 hash of a DER-encoded certificate. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: str: The URL-encoded, unpadded, base64-encoded SHA256 fingerprint. r) serializationr:=N)cryptography.hazmat.primitivesrv public_bytesEncodingDERhashlibsha256digestbase64 b64encodedecoderstriprr[r\)rmrvder_cert fingerprintbase64_fingerprintunpadded_base64_fingerprintr7s r!calculate_certificate_fingerprintrCs?@$$]%;%;%?%?@nnX.557 $--k:AA'J&8&?&?&D#011 ?67Q>?sB B B.B))B.ct|}tjjtj dj dk(}|r|syddlm}|j}|duryy)aDetermines if a bound token should be requested. This is based on the GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES environment variable and whether the certificate is an agent identity cert. Args: cert (cryptography.x509.Certificate): The parsed certificate object. Returns: bool: True if a bound token should be requested, False otherwise. rGFrrIT) rtr rrrr2rLrMrJrN)rm is_agent_cert is_opted_inrJrRs rshould_request_bound_tokenr^sk348M   T T   %'    k3::>r)"__doc__rr|r rkr r/ urllib.parserrr) google.authrrr\rjr_FAST_POLL_CYCLES_FAST_POLL_INTERVAL_SLOW_POLL_INTERVALr+int_SLOW_POLL_CYCLESr'rr$rr(rUrPrtrrrrrrs.  (4F 0,X(+>>?CVV++.??-- "$ONHV(D*)Z?""?J?6B#r