File: //lib/python3.9/site-packages/jwcrypto/__pycache__/jwe.cpython-39.pyc
a
���e_ � @ sT d dl Z d dlmZ d dlmZmZ d dlmZmZ d dlmZm Z d dlm
Z
m Z d dl m
Z
d dlmZ d Zed
d d d�ed
d d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�edd d d�d�
Zg d�ZG dd � d e�ZejZejZejZejZG d d � d �ZdS ) � N)�common)� JWException�
JWKeyNotFound)�JWSEHeaderParameter�JWSEHeaderRegistry)�base64url_decode�base64url_encode)� json_decode� json_encode)�JWA)�JWKSeti Z AlgorithmFTzEncryption AlgorithmzCompression Algorithmz JWK Set URLz JSON Web KeyzKey IDz X.509 URLzX.509 Certificate Chainz"X.509 Certificate SHA-1 Thumbprintz$X.509 Certificate SHA-256 Thumbprint�Typez Content TypeZCritical)
�alg�enc�zipZjkuZjwk�kidZx5uZx5cZx5tzx5t#S256�typZcty�crit)zRSA-OAEPz RSA-OAEP-256ZA128KWZA192KWZA256KW�dirzECDH-ESzECDH-ES+A128KWzECDH-ES+A192KWzECDH-ES+A256KWZ A128GCMKWZ A192GCMKWZ A256GCMKWzPBES2-HS256+A128KWzPBES2-HS384+A192KWzPBES2-HS512+A256KWz
A128CBC-HS256z
A192CBC-HS384z
A256CBC-HS512ZA128GCMZA192GCMZA256GCMc s" e Zd ZdZd� fdd� Z� ZS )�InvalidJWEDatazvInvalid JWE Object.
This exception is raised when the JWE Object is invalid and/or
improperly formatted.
Nc s: d }|r|}nd}|r&|dt |� 7 }tt| ��|� d S )Nz!Unknown Data Verification Failurez {%s})�str�superr �__init__)�self�message� exception�msg�� __class__� �0/usr/lib/python3.9/site-packages/jwcrypto/jwe.pyr ; s zInvalidJWEData.__init__)NN)�__name__�
__module__� __qualname__�__doc__r �
__classcell__r r r r r 4 s r c @ s� e Zd ZdZd/dd�Zdd� Zdd� Zed d
� �Zej d d
� �Zd d
� Z
d0dd�Z dd� Z dd� Z
d1dd�Zd2dd�Zdd� Zdd � Zd d � Zd d � Zd3d!d"�Zed#d$� �Zed%d&� �Zed'd(� �Zd)d*� Zd+d,� Zd-d.� ZdS )4�JWEzGJSON Web Encryption object
This object represent a JWE token.
Nc C s� d| _ i | _d| _tt�| _|r,| j�|� |durRt|t�rF|| _n |� d�| _d| _
d| _ |rl|| jd< |r�t|t �r�t
|�}nt|� || jd< |r�t|t �r�t
|�}nt|� || jd< |r�|| _ |r�| j||d� n |r�td��dS )aB Creates a JWE token.
:param plaintext(bytes): An arbitrary plaintext to be encrypted.
:param protected: A JSON string with the protected header.
:param unprotected: A JSON string with the shared unprotected header.
:param aad(bytes): Arbitrary additional authenticated data
:param algs: An optional list of allowed algorithms
:param recipient: An optional, default recipient key
:param header: An optional header for the default recipient
:param header_registry: Optional additions to the header registry
N�utf-8�aad� protected� unprotected)�headerz-Header is allowed only with default recipient)�
_allowed_algs�objects� plaintextr �JWEHeaderRegistry�header_registry�update�
isinstance�bytes�encode�cek�
decryptlog�dictr
r �
add_recipient�
ValueError) r r. r) r* r( �algsZ recipientr+ r0 r r r r S s<
z JWE.__init__c C s$ | j pt}||vrtd��t�|�S �NzAlgorithm not allowed)r, �default_allowed_algs�InvalidJWEOperationr Z keymgmt_alg�r �name�allowedr r r � _jwa_keymgmt� s
zJWE._jwa_keymgmtc C s$ | j pt}||vrtd��t�|�S r; )r, r< r= r Zencryption_algr> r r r �_jwa_enc� s
z JWE._jwa_encc C s | j r | j S tS dS )z�Allowed algorithms.
The list of allowed algorithms.
Can be changed by setting a list of algorithm names.
N)r, r< �r r r r � allowed_algs� s zJWE.allowed_algsc C s t |t�std��|| _d S )NzAllowed Algs must be a list)r2 �list� TypeErrorr, )r r: r r r rD � s
c C s4 t |�� �D ]}||v r td| ��q |�|� |S )NzDuplicate header: "%s")rE �keysr r1 )r Zh1Zh2�kr r r �_merge_headers� s
zJWE._merge_headersc C sh i }d| j v r(t| j d �}| �||�}d| j v rLt| j d �}| �||�}|rdt|�}| �||�}|S )Nr) r* )r- r rI )r r+ �jh�phZuhZrhr r r �_get_jose_header� s
zJWE._get_jose_headerc C sT |� dd �}|d u r td��| �|�}|� dd �}|d u rBtd��| �|�}||fS )Nr zMissing "alg" from headersr zMissing "enc" from headers)�getr rA rB )r rJ Zalgnamer Zencnamer r r r �_get_alg_enc_from_headers� s
z JWE._get_alg_enc_from_headersc
C s� t | j�dd��}d| jv r2|dt | jd � 7 }|�d�}|�dd �}|dkrft�| j�dd � }n|d u rv| j}ntd
��|�| j ||�\}}} || jd < || jd < | | jd
< d S )Nr) � r( �.r' r �DEF� ����Unknown compression�iv�
ciphertext�tag)
r r- rM r4 �zlib�compressr. r9 Zencryptr5 )
r r r rJ r( rY �datarU rV rW r r r �_encrypt� s
z JWE._encryptc C s� | j du rtd��t| j t�s&td��t|t�r8t|�}| �|�}| �|�\}}i }|r`||d< |�||j | j
|�}|d | _
d|v r�|d |d< d|v r�t |� dd��}| �
||d �} t| �|d< d | jvr�| �|||� d
| jv r�| jd
�|� n�d| jv �sd| jv �rzg | jd
< i }
d| jv �r<| j�d�|
d< d| jv �rX| j�d�|
d< | jd
�|
� | jd
�|� n | j�|� dS ) a Encrypt the plaintext with the given key.
:param key: A JWK key or password of appropriate type for the 'alg'
provided in the JOSE Headers.
:param header: A JSON string representing the per-recipient header.
:raises ValueError: if the plaintext is missing or not of type bytes.
:raises ValueError: if the compression type is unknown.
:raises InvalidJWAAlgorithm: if the 'alg' provided in the JOSE
headers is missing or unknown, or otherwise not implemented.
NzMissing plaintextzPlaintext must be 'bytes'r+ r5 Zek�
encrypted_keyz{}rV �
recipients)r. r9 r2 r3 r7 r
rL rN �wrap�
wrap_key_sizer5 r rM rI r- r[ �append�popr1 ) r �keyr+ rJ r r �rec�wrapped�hZnh�nr r r r8 � sB
zJWE.add_recipientFc
C s� d| j vrtd��|�rbdD ]}|| j v r td| ��q d| j vrLtd��n,t| j d �}dD ]}||vr^td| ��q^d | j v r�t| j d �d
kr�td ��| j d d }n| j }d
|v �rt|d
�}t| j d �}| �||�}t|�| j d< | �� }| �|�\} }
| �| |
|� |d
= d� t
| j d �t
|� dd��t
| j d �t
| j d �t
| j d �g�S | j } t
| d �t
| d �t
| j d �d�}
d| v �r�t
| d �|
d< d| v �r�t| d �|
d< d| v �r�t
| d �|
d< d | v �rFg |
d < | d D ]L}i } d|v �rt
|d �| d< d
|v �r2t|d
�| d
< |
d � | � �q�n4d| v �r`t
| d �|
d< d
| v �rzt| d
�|
d
< t|
�S dS )a� Serializes the object into a JWE token.
:param compact(boolean): if True generates the compact
representation, otherwise generates a standard JSON format.
:raises InvalidJWEOperation: if the object cannot be serialized
with the compact representation and `compact` is True.
:raises InvalidJWEOperation: if no recipients have been added
to the object.
:return: A json formatted string or a compact representation string
:rtype: `str`
rV �No available ciphertext)r( r* z9Can't use compact encoding when the '%s' parameter is setr) z4Can't use compact encoding without protected headers)r r z@Can't use compact encoding, '%s' must be in the protected headerr] � z Invalid number of recipientsr r+ rP r\ rO rU rW )rV rU rW r* r( N)
r- r= r �lenrI r
rL rN r[ �joinr rM r` )
r ZcompactZinvalidrK �requiredrc re ZnphrJ r r �obj�er r r � serialize s�
��
���
�
�
�
�
z
JWE.serializec C s> |D ]4}|| j vr td| ��q| j | jstd| ��qd S )Nz Unknown critical header: "%s"z!Unsupported critical header: "%s")r0 r Z supported)r r rH r r r � _check_critd s
�zJWE._check_critc
C s: |� ||j||�}
|�|
|||| �} | j�d� |
| _| S )N�Success)�unwrapr_ �decryptr6 r` r5 ) r r r rb Zenckeyr+ r( rU rV rW r5 rZ r r r �_unwrap_decryptm s
zJWE._unwrap_decryptc
C sN | � |�dd ��}| �|�di �� |D ]$}|| jv r(| j�|| �s(td��q(| �|�dd ��}| �|�dd ��}t| j �dd��}d| j v r�|d t| j d � 7 }|�
d
�}t |t ��r�|}d | j
v r�|�| j
d �} | s�td �| j
d ���| }|D ]�}
zL| �|||
|�d
d�||| j d | j d | j d � } | j�d� W �q�W q� t�y� } z4|
�d |
�� �}
| j�d�|
t| ��� W Y d } ~ q�d } ~ 0 0 q�d| jv�r�td��n4| �||||�d
d�||| j d | j d | j d � } |�dd �}|dk�r0t| �tk�r tddt� d� ��t�| tj �| _ n|d u �rB| | _ nt d��d S )Nr+ r zFailed header checkr r r) rO r( rP r' r zKey ID {} not in key setr\ � rU rV rW rp zKey [{}] failed: [{}]z No working key found in key setr rQ z+Compressed data exceeds maximum allowedsizez (�)rT ) rL rM ro r0 Z check_headerr rA rB r r- r4 r2 r � jose_headerZget_keysr �formatrs r6 r` � ExceptionZ
thumbprint�reprri �default_max_compressed_sizerX �
decompress� MAX_WBITSr. r9 )r rb ZpperJ Zhdrr r r( rG Zkid_keysrH rZ rm ZkeyidrY r r r �_decryptv sp
�
�
�
�
��
z JWE._decryptc C s d| j vrtd��g | _d}d| j v r�| j d D ]\}z| �||� W q0 ty� } z.t|t�rbd}| j�dt|� � W Y d}~q0d}~0 0 q0nZz| �|| j � W nF ty� } z.t|t�r�d}| j�dt|� � W Y d}~n
d}~0 0 | j �s|r�td��t
d t| j� ��dS )
a@ Decrypt a JWE token.
:param key: The (:class:`jwcrypto.jwk.JWK`) decryption key.
:param key: A (:class:`jwcrypto.jwk.JWK`) decryption key,
or a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed
by the 'kid' header or (deprecated) a string containing a password.
:raises InvalidJWEOperation: if the key is not a JWK object.
:raises InvalidJWEData: if the ciphertext can't be decrypted or
the object is otherwise malformed.
:raises JWKeyNotFound: if key is a JWKSet and the key is not found.
rV rg Fr] Tz Failed: [%s]NzKey Not found in JWKSetz%No recipient matched the provided key) r- r= r6 r} rx r2 r r` ry r. r )r rb Z
missingkeyrc rm r r r rr � s0
.
*�z JWE.decryptc
C sN i | _ d| _d| _i }�z�z&t|�}t|d �|d< t|d �|d< t|d �|d< d|v rxt|d �}|�d�|d< d|v r�t|d �|d< d|v r�t|d �|d< d |v �r g |d < |d D ]F}i }d
|v r�t|d
�|d
< d |v r�t|d �|d < |d �|� q�n4d
|v �r&t|d
�|d
< d |v �r@t|d �|d < W n� t�y� } z�|� d �}t
|�d
k�rtt � |�t|d �}|�d�|d< t|d �} | dk�r�t|d �|d
< t|d �|d< t|d �|d< t|d �|d< W Y d}~n
d}~0 0 || _ W n6 t �y8 } z t dt
|��|�W Y d}~n
d}~0 0 |�rJ| �|� dS )a� Deserialize a JWE token.
NOTE: Destroys any current status and tries to import the raw
JWE provided.
If a key is provided a decryption step will be attempted after
the object is successfully deserialized.
:param raw_jwe: a 'raw' JWE token (JSON Encoded or Compact
notation) string.
:param key: A (:class:`jwcrypto.jwk.JWK`) decryption key,
or a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed
by the 'kid' header or (deprecated) a string containing a password
(optional).
:raises InvalidJWEData: if the raw object is an invalid JWE token.
:raises InvalidJWEOperation: if the decryption fails.
NrU rV rW r) r' r* r( r] r\ r+ rP � r rh rt rR � � zInvalid format)r- r. r5 r r �decoder
r` r9 �splitri r rx ry rr )
r Zraw_jwerb �oZdjwe�prc rm rZ Zekeyr r r � deserialize� sb
�
�
&
&zJWE.deserializec C s | j std��| j S )NzPlaintext not available)r. r= rC r r r �payload+ s z JWE.payloadc C s* | � | j�d��}t|�dkr&td��|S )Nr+ r zJOSE Header not available)rL r- rM ri r= )r rJ r r r rv 1 s zJWE.jose_headerc C s | � }|� |� |S )a Creates a JWE object from a serialized JWE token.
:param token: A string with the json or compat representation
of the token.
:raises InvalidJWEData: if the raw object is an invalid JWE token.
:return: A JWE token
:rtype: JWE
)r� )�cls�tokenrl r r r �from_jose_token8 s
zJWE.from_jose_tokenc C sl t |t�sdS z| �� |�� kW S tyf d| ji}|�| j� d|ji}|�|j� ||k Y S 0 d S )NFr. )r2 r& rn rx r. r1 r- )r �otherZdata1Zdata2r r r �__eq__I s
z
JWE.__eq__c C s* z
| � � W S ty$ | �� Y S 0 d S )N)rn rx �__repr__rC r r r �__str__U s
z JWE.__str__c C s� zd| � � � d�W S ty� t| j�}| j�d�}| j�d�}| j�d�}| j}d|� d�d|� d� d |� d� d
|� d |� d � Y S 0 d S )
NzJWE.from_json_token("z")r) r* r( zJWE(plaintext=z, z
protected=z unprotected=zaad=z, algs=ru )rn rx ry r. r- rM r, )r r. r) r* r( r: r r r r� [ s
�
��z JWE.__repr__)NNNNNNNN)N)N)F)N) r! r" r# r$ r rA rB �propertyrD �setterrI rL rN r[ r8 rn ro rs r} rr r� r� rv � classmethodr� r� r� r� r r r r r& M s> �
1
7
X @)
L
r& )rX Zjwcryptor Zjwcrypto.commonr r r r r r r r
Z jwcrypto.jwar Z jwcrypto.jwkr rz r/ r< r ZInvalidCEKeyLengthZInvalidJWEKeyLengthZInvalidJWEKeyTyper= r& r r r r �<module> sB �� �