o
    STh1                     @  s  d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ G d	d
 d
ejZG dd dejZejejejejejfZdddZG dd dejZG dd dZe	jZe	jZe	jZG dd dZG dd dZ e	j!Z!e	j"Z"dS )    )annotationsN)Iterable)utilsx509)ocsp)hashes) CertificateIssuerPrivateKeyTypes)_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   W/home/air/segue/gemini/back/venv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr
      s    r
   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR	TRY_LATERSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm*   s
   
r%   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   GOODREVOKEDUNKNOWNr   r   r   r   r&   1   s    r&   c                   @  s   e Zd ZdddZdS )_SingleResponseresp0tuple[x509.Certificate, x509.Certificate] | None	resp_hashtuple[bytes, bytes, int] | Noner   r   cert_statusr&   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s   t | t|tjstd|d urt|tjstd|| _|| _|| _|| _|| _t|t	s4td|t	j
urJ|d urAtd|d urItdnt|tjsTtd|d urbt|tjsbtd|| _|| _|| _d S )Nz%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectzCrevocation_reason must be an item from the ReasonFlags enum or None)r%   r"   datetime	TypeError_resp
_resp_hash
_algorithm_this_update_next_updater&   r(   r$   r   ReasonFlags_cert_status_revocation_time_revocation_reason)	selfr+   r-   r   r/   r0   r2   r4   r5   r   r   r   __init__8   sJ   




z_SingleResponse.__init__N)r+   r,   r-   r.   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   )r   r   r   rC   r   r   r   r   r*   7   s    r*   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None
extensions(list[x509.Extension[x509.ExtensionType]]r    r!   c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)rB   rE   rG   rI   r   r   r   rC   w   s   

zOCSPRequestBuilder.__init__certx509.Certificateissuerr   r   c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a request%cert and issuer must be a Certificate)
rL   rM   r$   r%   r"   r   Certificater8   rD   rN   )rB   rO   rQ   r   r   r   r   add_certificate   s   z"OCSPRequestBuilder.add_certificateissuer_name_hashbytesissuer_key_hashserial_numberintc                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )NrR    serial_number must be an integerrV   rX   `issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rL   rM   r$   r"   rZ   r8   r%   r   _check_bytesdigest_sizelenrD   rN   )rB   rV   rX   rY   r   r   r   r   add_certificate_by_hash   s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r"   r   ExtensionTyper8   	Extensionoidr	   rN   rD   rL   rM   rB   ra   rc   	extensionr   r   r   add_extension   s   z OCSPRequestBuilder.add_extensionOCSPRequestc                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)rL   rM   r$   r   create_ocsp_request)rB   r   r   r   build   s   
zOCSPRequestBuilder.build)rE   rF   rG   rH   rI   rJ   r    r!   )rO   rP   rQ   rP   r   r   r    rD   )
rV   rW   rX   rW   rY   rZ   r   r   r    rD   )ra   rb   rc   rd   r    rD   )r    rl   )r   r   r   rC   rU   r`   rk   rn   r   r   r   r   rD   v   s    


rD   c                   @  sj   e Zd Zdddg fd<d
dZd=ddZd>d"d#Zd?d'd(Zd@d*d+ZdAd0d1ZdBd6d7Z	e
dCd:d;ZdS )DOCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | NonerI   rJ   c                 C  s   || _ || _|| _|| _d S rK   )	_response_responder_id_certsrN   )rB   rp   rr   rt   rI   r   r   r   rC      s   
zOCSPResponseBuilder.__init__rO   rP   rQ   r   r   r/   r&   r0   r1   r2   r3   r4   r5   r6   r    c	           
   	   C  s`   | j d ur	tdt|tjrt|tjstdt||fd ||||||}	t|	| j| j	| j
S )N#Only one response per OCSPResponse.rS   )rv   r$   r"   r   rT   r8   r*   ro   rw   rx   rN   )
rB   rO   rQ   r   r/   r0   r2   r4   r5   
singlerespr   r   r   add_response   s,   

z OCSPResponseBuilder.add_responserV   rW   rX   rY   rZ   c
              	   C  s   | j d ur	tdt|tstdtd| td| t| |jt	|ks0|jt	|kr4tdt
d |||f||||||	}
t|
| j| j| jS )Nry   r[   rV   rX   r\   )rv   r$   r"   rZ   r8   r   r]   r%   r^   r_   r*   ro   rw   rx   rN   )rB   rV   rX   rY   r   r/   r0   r2   r4   r5   rz   r   r   r   add_response_by_hash   s<   


z(OCSPResponseBuilder.add_response_by_hashencodingr
   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rw   r$   r"   r   rT   r8   r
   ro   rv   rx   rN   )rB   r}   r~   r   r   r   rr   *  s   

z OCSPResponseBuilder.responder_idIterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S rK   )r"   r   rT   ).0xr   r   r   	<genexpr>E  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rx   r$   listr_   allr8   ro   rv   rw   rN   )rB   rt   r   r   r   certificates=  s   
z OCSPResponseBuilder.certificatesra   rb   rc   rd   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S re   )r"   r   rf   r8   rg   rh   r	   rN   ro   rv   rw   rx   ri   r   r   r   rk   N  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   hashes.HashAlgorithm | NoneOCSPResponsec                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)rv   r$   rw   r   create_ocsp_responser   r   )rB   r   r   r   r   r   sign^  s   


zOCSPResponseBuilder.signresponse_statusr   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r"   r   r8   r   r$   r   r   )clsr   r   r   r   build_unsuccessfull  s   

z&OCSPResponseBuilder.build_unsuccessful)rp   rq   rr   rs   rt   ru   rI   rJ   )rO   rP   rQ   rP   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   r    ro   )rV   rW   rX   rW   rY   rZ   r   r   r/   r&   r0   r1   r2   r3   r4   r3   r5   r6   r    ro   )r}   r
   r~   rP   r    ro   )rt   r   r    ro   )ra   rb   rc   rd   r    ro   )r   r   r   r   r    r   )r   r   r    r   )r   r   r   rC   r{   r|   rr   r   rk   r   classmethodr   r   r   r   r   ro      s    

$
.


ro   )r   r   r    r!   )#
__future__r   r7   collections.abcr   cryptographyr   r   "cryptography.hazmat.bindings._rustr   cryptography.hazmat.primitivesr   /cryptography.hazmat.primitives.asymmetric.typesr   cryptography.x509.baser	   Enumr
   r   SHA1SHA224SHA256SHA384SHA512r#   r%   r&   r*   rl   r   OCSPSingleResponserD   ro   load_der_ocsp_requestload_der_ocsp_responser   r   r   r   <module>   s6   

	:T 1
