ó
O'—^c           @@ sR  d  Z  d d l m Z m Z d d l m Z d d l Z d d l Z y d d l m Z Wn! e	 k
 r{ d d l
 m Z n Xd d l m Z m Z m Z d d l m Z d d	 l m Z d
 e f d „  ƒ  YZ d d d d d d d d „ Z d „  Z d d „ Z d d „ Z e d „ Z d „  Z d e f d „  ƒ  YZ d e f d „  ƒ  YZ d S(   uý   
oauthlib.oauth2.rfc6749.tokens
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module contains methods for adding two types of access tokens to requests.

- Bearer http://tools.ietf.org/html/rfc6750
- MAC http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
i    (   t   absolute_importt   unicode_literals(   t
   b2a_base64N(   t   urlparse(   t   add_params_to_urit   add_params_to_qst   unicode_type(   t   commoni   (   t   utilst   OAuth2Tokenc           B@ s}   e  Z d d  „ Z e d „  ƒ Z e d „  ƒ Z e d „  ƒ Z e d „  ƒ Z e d „  ƒ Z	 e d „  ƒ Z
 e d „  ƒ Z RS(	   c         C@ sŸ   t  t |  ƒ j | ƒ d  |  _ d | k rJ t t j | d ƒ ƒ |  _ n  | d  k	 r t t j | ƒ ƒ |  _ |  j d  k r› |  j |  _ q› n |  j |  _ d  S(   Nu   scope(	   t   superR	   t   __init__t   Nonet
   _new_scopet   setR   t   scope_to_listt
   _old_scope(   t   selft   paramst	   old_scope(    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR      s    	c         C@ s   |  j  |  j k S(   N(   R   R   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   scope_changed*   s    c         C@ s   t  j |  j ƒ S(   N(   R   t   list_to_scopeR   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR   .   s    c         C@ s   t  |  j ƒ S(   N(   t   listR   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt
   old_scopes2   s    c         C@ s   t  j |  j ƒ S(   N(   R   R   R   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   scope6   s    c         C@ s   t  |  j ƒ S(   N(   R   R   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   scopes:   s    c         C@ s   t  |  j |  j ƒ S(   N(   R   R   R   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   missing_scopes>   s    c         C@ s   t  |  j |  j ƒ S(   N(   R   R   R   (   R   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   additional_scopesB   s    N(   t   __name__t
   __module__R   R   t   propertyR   R   R   R   R   R   R   (    (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR	      s   u    u
   hmac-sha-1c         C@ s  | j  ƒ  } t j | ƒ \ } } | j ƒ  d k r? t j } n* | j ƒ  d k r] t j } n t d ƒ ‚ |
 d k rŸ | p™ d j t j	 |	 ƒ t
 j ƒ  ƒ } n t
 j ƒ  } t
 j ƒ  } t | ƒ \ } } } } } } | rì | d | } n | } | d k	 rA|
 d k rA| j d ƒ } t | | ƒ j ƒ  ƒ d  j d ƒ } n d	 } g  } |
 d k ri| j | ƒ n | j | ƒ | j | ƒ | j | j  ƒ  ƒ | j | ƒ | j | ƒ | j | ƒ |
 d k rÙ| j | ƒ n  | j | pèd	 ƒ d
 j | ƒ d
 } t | t ƒ r | j d ƒ } n  t j | | j d ƒ | ƒ } t | j ƒ  ƒ d  j d ƒ } g  } | j d |  ƒ |
 d k r”| j d | ƒ n  | j d | ƒ | r¿| j d | ƒ n  | rÙ| j d | ƒ n  | j d | ƒ | pói  } d j | ƒ | d <| S(   u  Add an `MAC Access Authentication`_ signature to headers.

    Unlike OAuth 1, this HMAC signature does not require inclusion of the
    request payload/body, neither does it use a combination of client_secret
    and token_secret but rather a mac_key provided together with the access
    token.

    Currently two algorithms are supported, "hmac-sha-1" and "hmac-sha-256",
    `extension algorithms`_ are not supported.

    Example MAC Authorization header, linebreaks added for clarity

    Authorization: MAC id="h480djs93hd8",
                       nonce="1336363200:dj83hs9s",
                       mac="bhCQXTVyfj5cmA9uKkPFx1zeOXM="

    .. _`MAC Access Authentication`: http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01
    .. _`extension algorithms`: http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-7.1

    :param uri: Request URI.
    :param headers: Request headers as a dictionary.
    :param http_method: HTTP Request method.
    :param key: MAC given provided by token endpoint.
    :param hash_algorithm: HMAC algorithm provided by token endpoint.
    :param issue_time: Time when the MAC credentials were issued (datetime).
    :param draft: MAC authentication specification version.
    :return: headers dictionary with the authorization field added.
    u
   hmac-sha-1u   hmac-sha-256u   unknown hash algorithmi    u   {0}:{1}u   ?u   utf-8iÿÿÿÿu    u   
u   MAC id="%s"u   ts="%s"u
   nonce="%s"u   bodyhash="%s"u   ext="%s"u   mac="%s"u   , u   AuthorizationN(   t   upperR   t   host_from_urit   lowert   hashlibt   sha1t   sha256t
   ValueErrort   formatt   generate_ageR   t   generate_noncet   generate_timestampR   R   t   encodeR   t   digestt   decodet   appendt   joint
   isinstanceR   t   hmact   new(   t   tokent   urit   keyt   http_methodt   noncet   headerst   bodyt   extt   hash_algorithmt
   issue_timet   draftt   hostt   portt   ht   tst   scht   nett   patht   part   queryt   frat   request_urit   bodyhasht   baset   base_stringt   signt   header(    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   prepare_mac_headerG   sd    $(c         C@ s   t  | d |  f g ƒ S(   uõ   Add a `Bearer Token`_ to the request URI.
    Not recommended, use only if client can't use authorization header or body.

    http://www.example.com/path?access_token=h480djs93hd8

    .. _`Bearer Token`: http://tools.ietf.org/html/rfc6750
    u   access_token(   R   (   R2   R3   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   prepare_bearer_uri°   s    c         C@ s   | p	 i  } d |  | d <| S(   uÃ   Add a `Bearer Token`_ to the request URI.
    Recommended method of passing bearer tokens.

    Authorization: Bearer h480djs93hd8

    .. _`Bearer Token`: http://tools.ietf.org/html/rfc6750
    u	   Bearer %su   Authorization(    (   R2   R7   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   prepare_bearer_headers»   s    c         C@ s   t  | d |  f g ƒ S(   uŠ   Add a `Bearer Token`_ to the request body.

    access_token=h480djs93hd8

    .. _`Bearer Token`: http://tools.ietf.org/html/rfc6750
    u   access_token(   R   (   R2   R8   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   prepare_bearer_bodyÈ   s    c         C@ s
   t  j ƒ  S(   N(   R   t   generate_token(   t   requestt   refresh_token(    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   random_token_generatorÒ   s    c         @ s   ‡  ‡ f d †  } | S(   Nc         @ s   ˆ  |  _  t j ˆ |  ƒ S(   N(   t   claimsR   t   generate_signed_token(   RR   (   t   kwargst   private_pem(    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   signed_token_generator×   s    	(    (   RX   RW   RY   (    (   RW   RX   s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyRY   Ö   s    t	   TokenBasec           B@ s&   e  Z e d  „ Z d „  Z d „  Z RS(   c         C@ s   t  d ƒ ‚ d  S(   Nu&   Subclasses must implement this method.(   t   NotImplementedError(   R   RR   RS   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   __call__à   s    c         C@ s   t  d ƒ ‚ d  S(   Nu&   Subclasses must implement this method.(   R[   (   R   RR   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   validate_requestã   s    c         C@ s   t  d ƒ ‚ d  S(   Nu&   Subclasses must implement this method.(   R[   (   R   RR   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   estimate_typeæ   s    (   R   R   t   FalseR\   R]   R^   (    (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyRZ   Þ   s   	t   BearerTokenc           B@ s;   e  Z d d d d d  „ Z e d „ Z d „  Z d „  Z RS(   c         C@ s=   | |  _  | p t |  _ | p$ |  j |  _ | p3 d |  _ d  S(   Ni  (   t   request_validatorRT   t   token_generatort   refresh_token_generatort
   expires_in(   R   Ra   Rb   Rd   Rc   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR   ì   s    	c         C@ s  t  |  j ƒ r! |  j | ƒ } n	 |  j } | | _ i |  j | ƒ d 6| d 6d d 6} | j d	 k	 r d j | j ƒ | d <n  | j d	 k	 rž | j | d <n  | ræ | j rÐ |  j j	 | ƒ rÐ | j | d <qæ |  j
 | ƒ | d <n  | j | j pø i  ƒ t | ƒ } |  j j | | ƒ | S(
   u7   Create a BearerToken, by default without refresh token.u   access_tokenu
   expires_inu   Beareru
   token_typeu    u   scopeu   stateu   refresh_tokenN(   t   callableRd   Rb   R   R   R.   t   stateRS   Ra   t   rotate_refresh_tokenRc   t   updatet   extra_credentialsR	   t   save_bearer_token(   R   RR   RS   Rd   R2   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   create_tokenõ   s*    		
	c         C@ sP   d  } d | j k r. | j j d ƒ d } n	 | j } |  j j | | j | ƒ S(   Nu   Authorizationi   (   R   R7   t   gett   access_tokenRa   t   validate_bearer_tokenR   (   R   RR   R2   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR]     s    		c         C@ s=   | j  j d d ƒ j d ƒ r" d S| j d  k	 r5 d Sd Sd  S(   Nu   Authorizationu    u   Beareri	   i   i    (   R7   Rl   t
   startswithRm   R   (   R   RR   (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR^      s
    N(   R   R   R   R   R_   Rk   R]   R^   (    (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyR`   ê   s
   "		(    t   __doc__t
   __future__R    R   t   binasciiR   R"   R0   R   t   ImportErrort   urllib.parset   oauthlib.commonR   R   R   t   oauthlibR   t    R   t   dictR	   R   RM   RN   RO   RP   R_   RT   RY   t   objectRZ   R`   (    (    (    s@   /tmp/pip-unpacked-wheel-eAx2J6/oauthlib/oauth2/rfc6749/tokens.pyt   <module>	   s4   .b	
	