@wj) bdZddlZddlZddlmZddlZddlmZddlm Z ddlm Z ddl m Z ejeZGdd ej Zdd Zd Zd Zd Z ddej,dededeeddf dZdej,defdZdeej,fdZ ddeedefdZy)zUtilites for mutual TLS.N)getenv)Optional)environment_vars) exceptions) _mtls_helperceZdZdZdZdZy)UseMtlsEndpointModealwaysneverautoN)__name__ __module__ __qualname__ALWAYSNEVERAUTOX/root/dashboard-youtube/.venv/lib/python3.12/site-packages/google/auth/transport/mtls.pyr r s F E Drr ctj|}|y|r%tjtj yy)a2Check if default client SSL credentials exists on the device. Args: include_context_aware (bool): include_context_aware indicates if context_aware path location will be checked or should it be skipped. Returns: bool: indicating if the default client cert source exists. include_context_awareTF)r_get_cert_config_path_check_config_pathCONTEXT_AWARE_METADATA_PATH)r cert_paths rhas_default_client_cert_sourcer$sI223I  + +L,T,T U  rcNtdstjdd}|S)aGet a callback which returns the default client SSL credentials. Returns: Callable[[], [bytes, bytes]]: A callback which returns the default client certificate bytes and private key bytes, both in PEM format. Raises: google.auth.exceptions.MutualTLSChannelError: If the default client SSL credentials don't exist or are malformed. Trz(Default client cert source doesn't existc tj\}}}||fS#tttf$r}t j |}||d}~wwxYwN)rget_client_cert_and_keyOSError RuntimeError ValueErrorrMutualTLSChannelError)_ cert_bytes key_bytes caught_excnew_excs rcallbackz,default_client_cert_source..callbackMsZ *'3'K'K'M $Az9 9$$ z2 * 66zBGz ) *sAA  Arrr%)r+s rdefault_client_cert_sourcer-=s. * E.. 6  % OrcXtdstjdfd}|S)amGet a callback which returns the default encrpyted client SSL credentials. Args: cert_path (str): The cert file path. The default client certificate will be written to this file when the returned callback is called. key_path (str): The key file path. The default encrypted client key will be written to this file when the returned callback is called. Returns: Callable[[], [str, str, bytes]]: A callback which generates the default client certificate, encrpyted private key and passphrase. It writes the certificate and private key into the cert_path and key_path, and returns the cert_path, key_path and passphrase bytes. Raises: google.auth.exceptions.MutualTLSChannelError: If any problem occurs when loading or saving the client certificate and key. Trz2Default client encrypted cert source doesn't existc tjd\}}}}td5}|j|dddt d5}|j|ddd |fS#1swY4xYw#1swYxYw#tj t f$r}t j|}||d}~wwxYw)NT)generate_encrypted_keywb)rget_client_ssl_credentialsopenwriterClientCertErrorr"r%) r&r'r(passphrase_bytes cert_filekey_filer)r*rkey_paths rr+z6default_client_encrypted_cert_source..callbackqs * 77tT   i& ,) + ,h% *y) * ($444 , , * ***G4 * 66zBGz ) *sE'BA/BA;"B/A84B;BBB= B88B=r,)rr9r+s`` r$default_client_encrypted_cert_sourcer:Ys/& * E.. @  5$ Orc*tjS)aReturns boolean for whether the client certificate should be used for mTLS. This is a wrapper around _mtls_helper.check_use_client_cert(). If GOOGLE_API_USE_CLIENT_CERTIFICATE is set to true or false, a corresponding bool value will be returned If GOOGLE_API_USE_CLIENT_CERTIFICATE is unset, the value will be inferred by reading a file pointed at by GOOGLE_API_CERTIFICATE_CONFIG or CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH, or the default path like ~/.config/gcloud/certificate_config.json, and verifying it contains a "workload" section. If so, the function will return True, otherwise False. Returns: bool: indicating whether the client certificate should be used for mTLS. )rcheck_use_client_certrrrshould_use_client_certr=s  - - //rctxr'r( passphrasereturnct|tjstjd t j |||5\}}}||tjd|j|||dddy#1swYyxYw#tjttttf$r}tj|}||d}~wwxYw)aLoad a client certificate and key into an SSL context. Args: ctx (ssl.SSLContext): The SSL context to load the certificate and key into. cert_bytes (bytes): The client certificate bytes in PEM format. key_bytes (bytes): The client private key bytes in PEM format. passphrase (Optional[bytes]): The passphrase for the client private key. Raises: google.auth.exceptions.MutualTLSChannelError: If the SSL context is invalid, or if loading the certificate and key fails. zFailed to load client certificate and key for mTLS. The provided context object is invalid or does not support loading certificate chains.)r?NzKFailed to generate temporary file paths for the client certificate and key.)certfilekeyfilepassword) isinstancessl SSLContextrr%rsecure_cert_key_pathsload_cert_chainSSLErrorr"r$r# TypeError) r>r'r(r?rr9passphrase_valr)r*s r_load_client_cert_into_contextrMs$ c3>> *.. P  &  / /  j     H$4 66a   "H~        &22:>:%&s5B 2B;BB  B B(C8CCc tr tsy tj\}}}}|syt ||||y#t j tttf$r}t j|}||d}~wwxYw)aLoad the default client certificate and key into an SSL context if configured. If client certificates are enabled and a default client certificate source is found, the certificate and key are loaded into the SSL context. Args: ctx (ssl.SSLContext): The SSL context to load the default client certificate and key into. Returns: bool: True if client certificates are enabled and the default client certificate was successfully loaded. False if client certificates are disabled or if no default certificate source is configured. Raises: google.auth.exceptions.MutualTLSChannelError: If the default client certificate or key is malformed. FTN) r=rrr2rMrr5r"r#r$r%)r>has_certr'r(r?r)r*s rload_default_client_certrPs& " #+I+K  3 3 5     &sJ :N ""  & 22:>:%&sA#B%A==Bctr tsytjtjj }t |r|SdS)aGet a default SSL context loaded with the default client certificate. Returns: ssl.SSLContext: An SSL context loaded with the default client certificate, or None if client certificates are not configured or available. Raises: google.auth.exceptions.MutualTLSChannelError: If the default client certificate or key is malformed. N)r=rrFcreate_default_contextPurpose SERVER_AUTHrP)r>s rget_default_ssl_contextrUs? " #+I+K $ $S[[%<%< =C*3/39T9rclient_cert_availablec| t}ttj}|xsdj j } t |}|t jk(ry|t jk(ry|t jk(r|Sy#t$r+tjdtjd|dwxYw)aTDetermine whether to use an mTLS endpoint. This relies on the GOOGLE_API_USE_MTLS_ENDPOINT environment variable. If set to "always", returns True. If set to "never", returns False. If set to "auto" or unset, returns whether a client certificate is available. Args: client_cert_available (Optional[bool]): indicating if a client certificate is available. If None, this is determined by checking if client certificates are enabled using :func:`should_use_client_cert`. Returns: bool: indicating if an mTLS endpoint should be used. Nr z Unsupported z value 'z('. Accepted values: never, auto, always.TF) r=rrGOOGLE_API_USE_MTLS_ENDPOINTstriplowerr r$rr%rrr)rVuse_mtls_endpointmodes rshould_use_mtls_endpointr] s"$ 6 8/LLM*4f;;=CCE "#45 "))) "((( "'''$$(  ..+HHIJ!""J L   s B4C)Tr )__doc__enumloggingosrrFtypingr google.authrrgoogle.auth.transportr getLoggerr _LOGGEREnumr rr-r:r=rGbytesrMboolrPrUr]rrrrjs  (". '  H %$)) 28*Z0.#' /& /&/&/& /&  /&d(#..(T(V:#..!9:(-1#%#D>#% #%r