o
    ?HhX                     @   sd  d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
mZmZ d dlmZmZmZ d dlmZmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZ d dlm Z m!Z! d dl"m#Z# d dl$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ddl+m,Z,m-Z-m.Z.m/Z/m0Z0 ddl1m2Z2 da3dd Z4G dd de2Z5G dd de2Z6G dd de2Z7G dd de2Z8dS )    N)InvalidSignature
InvalidTag)default_backend)Binding)hasheshmacserialization)ecpaddingrsa)decode_dss_signatureencode_dss_signature)Cipheraead
algorithmsmodes)InvalidUnwrapaes_key_unwrapaes_key_wrap)PKCS7)load_pem_private_keyload_pem_public_key)int_to_bytes)load_pem_x509_certificate   )
ALGORITHMS)JWEErrorJWKError)base64_to_longbase64url_decodebase64url_encodeensure_binarylong_to_base64   )Keyc                 C   sD   t du rt a t jd| }t j||  t j|| dd }|S )aK  
    Get random bytes

    Currently, Cryptography returns OS random bytes. If you want OpenSSL
    generated random bytes, you'll have to switch the RAND engine after
    initializing the OpenSSL backend
    Args:
        num_bytes (int): Number of random bytes to generate and return
    Returns:
        bytes: Random bytes
    Nzchar[])_bindingr   ffinewlib
RAND_bytesbuffer)	num_bytesbuf
rand_bytes r.   b/home/air/sanwanet/gpt-api/venv/lib/python3.10/site-packages/jose/backends/cryptography_backend.pyget_random_bytes   s   r0   c                   @   sz   e Zd ZejZejZejZefddZdd Z	dd Z
dd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd ZdS )CryptographyECKeyc              
   C   s(  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _|| _t|ds-t|dr2|| _d S t|dr>| d}t|trK| || _d S t|trU|d}t|trzz	t||  }W n tyv   t|d |  d}Y nw W n ty } zt|d }~ww || _d S td| )N*hash_alg: %s is not a valid hash algorithmpublic_bytesprivate_bytesto_pemutf-8passwordbackendz%Unable to parse an ECKey from key: %s)r   ECr   ES256SHA256ES384SHA384ES512SHA512gethash_alg
_algorithmcryptography_backendhasattrprepared_keyr5   decode
isinstancedict_process_jwkstrencodebytesr   
ValueErrorr   	Exceptionselfkey	algorithmrD   er.   r.   r/   __init__5   sF   





zCryptographyECKey.__init__c                    s     ddkstd  d t fdddD stdt  d}t  d	}tjtjtjd
 d  }t||| }d v rZt  d}t	||}|
|  S ||  S )Nktyr:   z0Incorrect key type. Expected: 'EC', Received: %sc                 3       | ]}| v V  qd S Nr.   .0kjwk_dictr.   r/   	<genexpr>f       z1CryptographyECKey._process_jwk.<locals>.<genexpr>)xycrvz Mandatory parameters are missingr`   ra   )P-256P-384P-521rb   d)rA   r   allr   r	   	SECP256R1	SECP384R1	SECP521R1EllipticCurvePublicNumbersEllipticCurvePrivateNumbersprivate_keyrD   
public_key)rQ   r]   r`   ra   curvepublicrf   privater.   r\   r/   rJ   b   s$   zCryptographyECKey._process_jwkc                 C   s   t t| jjd S )zDetermine the correct serialization length for an encoded signature component.

        This is the number of bytes required to encode the maximum key value.
        g       @)intmathceilrF   key_sizerQ   r.   r.   r/   _sig_component_length{   s   z'CryptographyECKey._sig_component_lengthc                 C   s(   t |\}}|  }t||t|| S )z4Convert signature from DER encoding to RAW encoding.)r   rw   r   )rQ   der_signaturerscomponent_lengthr.   r.   r/   _der_to_raw   s   zCryptographyECKey._der_to_rawc                 C   s^   |   }t|td| krtd|d| }||d }t|d}t|d}t||S )z4Convert signature from RAW encoding to DER encoding.r   zInvalid signatureNbig)rw   lenrr   rN   
from_bytesr   )rQ   raw_signaturer{   r_bytess_bytesry   rz   r.   r.   r/   _raw_to_der   s   
zCryptographyECKey._raw_to_derc                 C   sV   | j jd | jjjkrtd| jjjd| j j f | j|t	|   }| 
|S )N   z1this curve (%s) is too short for your digest (%d))rB   digest_sizerF   ro   ru   	TypeErrornamesignr	   ECDSAr|   )rQ   msg	signaturer.   r.   r/   r      s   
zCryptographyECKey.signc                 C   s@   z|  |}| j||t|   W dS  ty   Y dS w )NTF)r   rF   verifyr	   r   rB   rO   )rQ   r   sigr   r.   r.   r/   r      s   
zCryptographyECKey.verifyc                 C      t | jdS Nr3   rE   rF   rv   r.   r.   r/   	is_public      zCryptographyECKey.is_publicc                 C       |   r| S | | j | jS rX   r   	__class__rF   rn   rC   rv   r.   r.   r/   rn         zCryptographyECKey.public_keyc                 C   sF   |   r| jjtjjtjjd}|S | jjtjjtj	j
t d}|S )Nencodingformatr   r   encryption_algorithm)r   rF   r3   r   EncodingPEMPublicFormatSubjectPublicKeyInfor4   PrivateFormatTraditionalOpenSSLNoEncryption)rQ   pemr.   r.   r/   r5      s   zCryptographyECKey.to_pemc                 C   s   |   s
| j }n| j}dddd| jjj }| jjjd d }| jd|t| j	|d
d	t| j|d
d	d
}|   sS| j j}t||d
d	|d< |S )Nrc   rd   re   )	secp256r1	secp384r1	secp521r1   r   r:   )sizeASCII)algrV   rb   r`   ra   rf   )r   rF   rn   ro   r   ru   rC   r"   public_numbersr`   rG   ra   private_numbersprivate_value)rQ   rn   rb   ru   datar   r.   r.   r/   to_dict   s(   	zCryptographyECKey.to_dictN)__name__
__module____qualname__r   r<   r>   r@   r   rU   rJ   rw   r|   r   r   r   r   rn   r5   r   r.   r.   r.   r/   r1   0   s    -	r1   c                   @   s   e Zd ZejZejZejZe Z	e
ee e dZe
ee e dZefddZdd Zdd Zdd	 Zd
d Zdd Zdd ZdddZdd Zdd Zdd ZdS )CryptographyRSAKeyNc              
   C   sL  |t jvrtd| t j| jt j| jt j| ji	|| _
|| _t j| jt j| jt j| ji	|| _|| _t|drDt|drD|| _d S t|trQ| || _d S t|tr[|d}t|trz/|drn| | W d S zt||  | _W W d S  ty   t|d |  d| _Y W d S w  ty } zt|d }~ww td| )Nr2   r3   r   r6      -----BEGIN CERTIFICATE-----r7   z'Unable to parse an RSA_JWK from key: %s)r   RSAr   RS256r<   RS384r>   RS512r@   rA   rB   rC   RSA1_5RSA_OAEPRSA_OAEP_256r
   rD   rE   rF   rH   rI   rJ   rK   rL   rM   
startswith_process_certr   rN   r   rO   rP   r.   r.   r/   rU      sR   






zCryptographyRSAKey.__init__c              	      sB    ddkstd  d t  dd}t  d}t||}d vr0||  S t  d}g d}t fd	d
|D rtt fdd
|D sUtdt d }t d }t d }	t d }
t d }nt	|||\}}t
||}	t||}
t||}t||||	|
||}||  S )NrV   r   z1Incorrect key type. Expected: 'RSA', Received: %srT      nrf   )pqdpdqqic                 3   rW   rX   r.   rY   r\   r.   r/   r^   "  r_   z2CryptographyRSAKey._process_jwk.<locals>.<genexpr>c                 3   rW   rX   r.   rY   r\   r.   r/   r^   $  r_   z2Precomputed private key parameters are incomplete.r   r   r   r   r   )rA   r   r   r   RSAPublicNumbersrn   rD   anyrg   rsa_recover_prime_factorsrsa_crt_dmp1rsa_crt_dmq1rsa_crt_iqmpRSAPrivateNumbersrm   )rQ   r]   rT   r   rp   rf   extra_paramsr   r   r   r   r   rq   r.   r\   r/   rJ     s.   zCryptographyRSAKey._process_jwkc                 C   s   t ||  }| | _d S rX   )r   rD   rn   rF   )rQ   rR   r.   r.   r/   r   ;  s   z CryptographyRSAKey._process_certc              
   C   s@   z| j |t |  }W |S  ty } zt|d }~ww rX   )rF   r   r
   PKCS1v15rB   rO   r   )rQ   r   r   rT   r.   r.   r/   r   ?  s   zCryptographyRSAKey.signc                 C   sL   |   s	td z|  j||t |   W dS  t	y%   Y dS w )NzKAttempting to verify a message with a private key. This is not recommended.TF)
r   warningswarnrn   rF   r   r
   r   rB   r   )rQ   r   r   r.   r.   r/   r   F  s   
zCryptographyRSAKey.verifyc                 C   r   r   r   rv   r.   r.   r/   r   P  r   zCryptographyRSAKey.is_publicc                 C   r   rX   r   rv   r.   r.   r/   rn   S  r   zCryptographyRSAKey.public_keyPKCS8c                 C   s   |   r(|dkrtjj}n|dkrtjj}ntd| | jjtjj	|d}|S |dkr1tj
j}n|dkr:tj
j}ntd| | jjtjj	|t dS )Nr   PKCS1zInvalid format specified: %rr   r   )r   r   r   r   r   rN   rF   r3   r   r   r   r   r   r4   r   )rQ   
pem_formatfmtr   r.   r.   r/   r5   X  s    



zCryptographyRSAKey.to_pemc              
   C   s   |   s
| j }n| j}| jdt| jdt| jdd}|   sk|	t| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdt| j
 jdd |S )Nr   r   )r   rV   r   rT   )rf   r   r   r   r   r   )r   rF   rn   rC   r"   r   r   rG   rT   updater   rf   r   r   dmp1dmq1iqmp)rQ   rn   r   r.   r.   r/   r   n  s&   zCryptographyRSAKey.to_dictc              
   C   s8   z| j || j}W |S  ty } zt|d }~ww rX   )rF   encryptr
   rO   r   )rQ   key_datawrapped_keyrT   r.   r.   r/   wrap_key  s   zCryptographyRSAKey.wrap_keyc              
   C   s8   z| j || j}|W S  ty } zt|d }~ww rX   )rF   decryptr
   rO   r   )rQ   r   unwrapped_keyrT   r.   r.   r/   
unwrap_key  s   zCryptographyRSAKey.unwrap_key)r   )r   r   r   r   r<   r>   r@   r
   r   r   OAEPMGF1SHA1r   r   r   rU   rJ   r   r   r   r   rn   r5   r   r   r   r.   r.   r.   r/   r      s$    /)

r   c                   @   s  e Zd ZejejejejfZej	ej
ejejfZejejejejejfZejfZejfZejejejfZejejej	ejejejejejejejejejejejejejejejejejej
ejejejejdejdejdiZdd Zdd ZdddZddd	Z d
d Z!dd Z"dS )CryptographyAESKeyNc                 C   s  |t jvrtd| |t jt jvrtd| || _| j| j| _	|| j
v r7t|dkr7td| || jv rIt|dkrItd| || jv r[t|dkr[td| || jv rmt|d	krmtd
| || jv rt|dkrtd| || _d S )Nz%s is not a valid AES algorithmz%s is not a supported algorithm   zKey must be 128 bit for alg    zKey must be 192 bit for alg     zKey must be 256 bit for alg 0   zKey must be 384 bit for alg @   zKey must be 512 bit for alg )r   AESr   	SUPPORTEDunion
AES_PSEUDOrC   MODESrA   _modeKEY_128r~   KEY_192KEY_256KEY_384KEY_512_key)rQ   rR   rS   r.   r.   r/   rU     s"   

zCryptographyAESKey.__init__c                 C   s   | j dt| jd}|S )Noctr   rV   r[   )rC   r    r   )rQ   r   r.   r.   r/   r     s   zCryptographyAESKey.to_dictc              
   C   s   t |}zdttjjd }| |}|jdkr5t| j	}|
|||}|d t|d  }|dd  }n.tt| j	|t d}| }	ttjj }
|
|}||
 7 }|	||	  }d }|||fW S  tyx } zt|d }~ww )Nr   GCMr   ir9   )r!   r0   r   r   
block_sizer   r   r   AESGCMr   r   r~   r   r   	encryptorr   padderr   finalizerO   r   )rQ   
plain_textaadivmodeciphercipher_text_and_tagcipher_textauth_tagr   r   padded_datarT   r.   r.   r/   r     s*   


zCryptographyAESKey.encryptc              
   C   s   t |}zht |}| |}|jdkr<|d u rtdt| j}|| }z||||}W |W S  ty;   t	dw t
t| j|t d}| }	|	|}
|
|	 7 }
ttjj }||
}|| 7 }|W S  ty| } zt	|d }~ww )Nr   ztag cannot be NonezInvalid JWE Auth Tagr   )r!   r   r   rN   r   r   r   r   r   r   r   r   r   r   	decryptorr   r   r   r   unpadderrO   )rQ   r  r   r   tagr   r  r  r   r  padded_plain_textr  rT   r.   r.   r/   r     s6   



zCryptographyAESKey.decryptc                 C   s   t |}t| j|t }|S rX   )r!   r   r   r   )rQ   r   r  r.   r.   r/   r     s   zCryptographyAESKey.wrap_keyc              
   C   s@   t |}zt| j|t }W |S  ty } zt|d }~ww rX   )r!   r   r   r   r   r   )rQ   r   r   causer.   r.   r/   r   
  s   zCryptographyAESKey.unwrap_keyrX   )NNN)#r   r   r   r   A128GCM	A128GCMKWA128KWA128CBCr   A192GCM	A192GCMKWA192KWA192CBCr   A256GCM	A256GCMKWA256KWA128CBC_HS256A256CBCr   A192CBC_HS384r   A256CBC_HS512r   AES_KW_ALGSr   r   CBCr   rU   r   r   r   r   r   r.   r.   r.   r/   r     sD    

r   c                   @   sZ   e Zd ZdZeje eje	 ej
e iZdd Zdd Zdd Zdd	 Zd
d ZdS )CryptographyHMACKeyzf
    Performs signing and verification operations using HMAC
    and the specified hash function.
    c                    s   |t jvrtd| || _| j|| _t tr"| 	 | _
d S t ts0t ts0tdt tr: d g d}t fdd|D rMtd | _
d S )Nr2   z+Expecting a string- or bytes-formatted key.r6   )s   -----BEGIN PUBLIC KEY-----s   -----BEGIN RSA PUBLIC KEY-----r   s   ssh-rsac                 3   rW   rX   r.   )rZ   string_valuerR   r.   r/   r^   2  r_   z/CryptographyHMACKey.__init__.<locals>.<genexpr>zdThe specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.)r   HMACr   rC   ALG_MAPrA   	_hash_algrH   rI   rJ   rF   rK   rM   rL   r   )rQ   rR   rS   invalid_stringsr.   r  r/   rU     s"   




zCryptographyHMACKey.__init__c                 C   sH   | ddkstd| d | d}|d}t|}t|}|S )NrV   r   z1Incorrect key type. Expected: 'oct', Received: %sr[   r6   )rA   r   rL   rM   r   )rQ   r]   r[   r.   r.   r/   rJ   :  s   

z CryptographyHMACKey._process_jwkc                 C   s   | j dt| jddS )Nr   r   r   )rC   r    rF   rG   rv   r.   r.   r/   r   E  s   zCryptographyHMACKey.to_dictc                 C   s4   t |}tj| j| jt d}|| | }|S )Nr   )r!   r   r  rF   r!  r   r   r   )rQ   r   hr   r.   r.   r/   r   L  s
   
zCryptographyHMACKey.signc                 C   s^   t |}t |}tj| j| jt d}|| z
|| d}W |S  ty.   d}Y |S w )Nr   TF)	r!   r   r  rF   r!  r   r   r   r   )rQ   r   r   r#  verifiedr.   r.   r/   r   S  s   

zCryptographyHMACKey.verifyN)r   r   r   __doc__r   HS256r   r<   HS384r>   HS512r@   r   rU   rJ   r   r   r   r.   r.   r.   r/   r    s    "r  )9rs   r   cryptography.exceptionsr   r   cryptography.hazmat.backendsr   ,cryptography.hazmat.bindings.openssl.bindingr   cryptography.hazmat.primitivesr   r   r   )cryptography.hazmat.primitives.asymmetricr	   r
   r   /cryptography.hazmat.primitives.asymmetric.utilsr   r   &cryptography.hazmat.primitives.ciphersr   r   r   r   &cryptography.hazmat.primitives.keywrapr   r   r   &cryptography.hazmat.primitives.paddingr   ,cryptography.hazmat.primitives.serializationr   r   cryptography.utilsr   cryptography.x509r   	constantsr   
exceptionsr   r   utilsr   r   r    r!   r"   baser$   r%   r0   r1   r   r   r  r.   r.   r.   r/   <module>   s4     + @z