
    Oj:B                         S r SSKrSSKJr  SSKrSSKrSSKJr  SSKJ	r	  SSKJ
r
  SSKJr  SSKJr   SS jr SS	 jrSS
 jrSS jr   SS jrSS jr SS jr SS jrg)a  OAuth 2.0 async client.

This is a client for interacting with an OAuth 2.0 authorization server's
token endpoint.

For more information about the token endpoint, see
`Section 3.1 of rfc6749`_

.. _Section 3.1 of rfc6749: https://tools.ietf.org/html/rfc6749#section-3.2
    N)_exponential_backoff)_helpers)
exceptions)jwt)_clientc                 ,  #    U(       a8  S[         R                  0n[        R                  " U5      R	                  S5      nO@S[         R
                  0n[        R                  R                  U5      R	                  S5      nU(       a  SR                  U5      US'   0 nSn[        R                  " 5       n	U	 H  n
U " SXUS9I Sh  vN nUR                  5       I Sh  vN n[        US	5      (       a  UR                  S5      OUn [        R                  " U5      nUR"                  [$        R&                  :X  a  S
US4s  $ [         R(                  " UR"                  US9nU(       a	  U(       a  M  SXx4s  $    SXx4$  N N! [          a    Un Nrf = f7f)a  Makes a request to the OAuth 2.0 authorization server's token endpoint.
This function doesn't throw on response errors.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    token_uri (str): The OAuth 2.0 authorizations server's token endpoint
        URI.
    body (Mapping[str, str]): The parameters to send in the request body.
    access_token (Optional(str)): The access token needed to make the request.
    use_json (Optional(bool)): Use urlencoded format or json format for the
        content type. The default value is False.
    can_retry (bool): Enable or disable request retry behavior.

Returns:
    Tuple(bool, Mapping[str, str], Optional[bool]): A boolean indicating
      if the request is successful, a mapping for the JSON-decoded response
      data and in the case of an error a boolean indicating if the error
      is retryable.
zContent-Typeutf-8z	Bearer {}AuthorizationFPOST)methodurlheadersbodyNdecodeTstatus_coderesponse_data)client_JSON_CONTENT_TYPEjsondumpsencode_URLENCODED_CONTENT_TYPEurllibparse	urlencodeformatr   ExponentialBackoffcontenthasattrr   loads
ValueErrorstatushttp_clientOK
_can_retry)request	token_urir   access_tokenuse_json	can_retryr   r   retryable_errorretries_responseresponse_body1response_bodys                 ]/var/www/html/leaf-doctor-v1/venv/lib/python3.13/site-packages/google/oauth2/_client_async.py _token_endpoint_request_no_throwr3   &   sw    . !6#<#<=zz$&&w/!6#B#BC||%%d+227;#.#5#5l#C MO"557G y
 

  (//11 ~x00 !!'* 		* JJ}5M ??knn,,, ++ }
 -887 : -009

 2  	*)M	*sO   CFE>FF (FFAF2F FFFFFc           	         #    [        U UUUUUS9I Sh  vN u  nnnU(       d  [        R                  " Xx5        U$  N'7f)a  Makes a request to the OAuth 2.0 authorization server's token endpoint.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    token_uri (str): The OAuth 2.0 authorizations server's token endpoint
        URI.
    body (Mapping[str, str]): The parameters to send in the request body.
    access_token (Optional(str)): The access token needed to make the request.
    use_json (Optional(bool)): Use urlencoded format or json format for the
        content type. The default value is False.
    can_retry (bool): Enable or disable request retry behavior.

Returns:
    Mapping[str, str]: The JSON-decoded response data.

Raises:
    google.auth.exceptions.RefreshError: If the token endpoint returned
        an error.
)r)   r*   r+   N)r3   r   _handle_error_response)	r'   r(   r   r)   r*   r+   response_status_okr   r,   s	            r2   _token_endpoint_requestr7   k   sR     8 /! 		 %%mE	s   ><(>c                    #    U[         R                  S.n[        XXCS9I Sh  vN n US   n[         R                  " U5      n	XiU4$  N$! [         a  n[        R
                  " SUSS9nXeSnAff = f7f)a  Implements the JWT Profile for OAuth 2.0 Authorization Grants.

For more details, see `rfc7523 section 4`_.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    token_uri (str): The OAuth 2.0 authorizations server's token endpoint
        URI.
    assertion (str): The OAuth 2.0 assertion.
    can_retry (bool): Enable or disable request retry behavior.

Returns:
    Tuple[str, Optional[datetime], Mapping[str, str]]: The access token,
        expiration, and additional data returned by the token endpoint.

Raises:
    google.auth.exceptions.RefreshError: If the token endpoint returned
        an error.

.. _rfc7523 section 4: https://tools.ietf.org/html/rfc7523#section-4
	assertion
grant_typer+   Nr)   zNo access token in response.F	retryable)r   _JWT_GRANT_TYPEr7   KeyErrorr   RefreshError_parse_expiry)
r'   r(   r:   r+   r   r   r)   
caught_excnew_excexpirys
             r2   	jwt_grantrF      s     . #&2H2HID1D M&$^4 !!-0F..  &))*MU
 %	&s1   !A4AA4A
 A4

A1A,,A11A4c                   #    U[         R                  S.n[        XXCS9I Sh  vN n US   n[        R                  " USS9n	[        R                  " U	S	   5      n
XjU4$  N<! [         a  n[        R
                  " SUSS9nXeSnAff = f7f)
a  Implements the JWT Profile for OAuth 2.0 Authorization Grants, but
requests an OpenID Connect ID Token instead of an access token.

This is a variant on the standard JWT Profile that is currently unique
to Google. This was added for the benefit of authenticating to services
that require ID Tokens instead of access tokens or JWT bearer tokens.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    token_uri (str): The OAuth 2.0 authorization server's token endpoint
        URI.
    assertion (str): JWT token signed by a service account. The token's
        payload must include a ``target_audience`` claim.
    can_retry (bool): Enable or disable request retry behavior.

Returns:
    Tuple[str, Optional[datetime], Mapping[str, str]]:
        The (encoded) Open ID Connect ID Token, expiration, and additional
        data returned by the endpoint.

Raises:
    google.auth.exceptions.RefreshError: If the token endpoint returned
        an error.
r9   r<   Nid_tokenzNo ID token in response.Fr=   )verifyexp)
r   r?   r7   r@   r   rA   r   r   r   utcfromtimestamp)r'   r(   r:   r+   r   r   rH   rC   rD   payloadrE   s              r2   id_token_jwt_grantrM      s     4 #&2H2HID1D M& , jj%0G&&wu~6F]**  &))&
 %	&s1   !BA BA" 3B"
B	,BB		Bc                    #    [         R                  UUUS.nU(       a  SR                  U5      US'   U(       a  XhS'   [        XXS9I Sh  vN n	[         R                  " X5      $  N7f)a  Implements the OAuth 2.0 refresh token grant.

For more details, see `rfc678 section 6`_.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    token_uri (str): The OAuth 2.0 authorizations server's token endpoint
        URI.
    refresh_token (str): The refresh token to use to get a new access
        token.
    client_id (str): The OAuth 2.0 application's client ID.
    client_secret (str): The Oauth 2.0 appliaction's client secret.
    scopes (Optional(Sequence[str])): Scopes to request. If present, all
        scopes must be authorized for the refresh token. Useful if refresh
        token has a wild card scope (e.g.
        'https://www.googleapis.com/auth/any-api').
    rapt_token (Optional(str)): The reauth Proof Token.
    can_retry (bool): Enable or disable request retry behavior.

Returns:
    Tuple[str, Optional[str], Optional[datetime], Mapping[str, str]]: The
        access token, new or current refresh token, expiration, and additional data
        returned by the token endpoint.

Raises:
    google.auth.exceptions.RefreshError: If the token endpoint returned
        an error.

.. _rfc6748 section 6: https://tools.ietf.org/html/rfc6749#section-6
)r;   	client_idclient_secretrefresh_token scoperaptr<   N)r   _REFRESH_GRANT_TYPEjoinr7   _handle_refresh_grant_response)
r'   r(   rQ   rO   rP   scopes
rapt_tokenr+   r   r   s
             r2   refresh_grantrZ      sn     T 00&&	D (W!V1D M 00NNs   A	A(A&A(c                    #    [        XX#S9I Sh  vN nUc  g[        U[        5      (       a  SU;  a!  [        R                  R                  SU5        gU$  NF7f)ay  Implements the global lookup of a credential Regional Access Boundary.
For the lookup, we send a request to the global lookup endpoint and then
parse the response. Service account credentials, workload identity
pools and workforce pools implementation may have Regional Access Boundaries configured.
Args:
    request (google.auth.aio.transport.Request): A callable used to make
        HTTP requests. The returned response must support `await response.read()`
        (standard async transport) or `await response.content()` (legacy/custom transport).
    url (str): The Regional Access Boundary lookup url.
    headers (Optional[Mapping[str, str]]): The headers for the request.
    fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries).
Returns:
    Optional[Mapping[str,list|str]]: A dictionary containing
        "locations" as a list of allowed locations as strings and
        "encodedLocations" as a hex string.
        e.g:
        {
            "locations": [
                "us-central1", "us-east1", "europe-west1", "asia-east1"
            ],
            "encodedLocations": "0xA30"
        }
)r   	fail_fastNencodedLocationszQRegional Access Boundary response malformed: missing 'encodedLocations' key in %s)(_lookup_regional_access_boundary_request
isinstancedictr   _LOGGERerror)r'   r   r   r\   r   s        r2    _lookup_regional_access_boundaryrc   &  sd     0 Cg M mT**.@.U_	
 s   AAAAc                    #    [        XX#US9I Sh  vN u  nnnU(       d"  [        R                  R                  SUU5        gU$  N37f)a  Makes a request to the Regional Access Boundary lookup endpoint.

Args:
    request (google.auth.aio.transport.Request): A callable used to make
        HTTP requests. The returned response must support `await response.read()`
        (standard async transport) or `await response.content()` (legacy/custom transport).
    url (str): The Regional Access Boundary lookup url.
    can_retry (bool): Enable or disable request retry behavior. Defaults to true.
    headers (Optional[Mapping[str, str]]): The headers for the request.
    fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries).

Returns:
    Optional[Mapping[str, str]]: The JSON-decoded response data on success, or None on failure.
)r+   r   r\   Nz`Regional Access Boundary HTTP request failed after retries: response_data=%s, retryable_error=%s)1_lookup_regional_access_boundary_request_no_throwr   ra   debug)r'   r   r+   r   r\   r6   r   r,   s           r2   r^   r^   N  sZ     * @	i 		 n	

 	s   AA4Ac           
        #    0 nSnU(       a  [         R                  OSnU(       a  SOSn[        R                  " US9n	U	  Sh  vN n
 U(       a$  [        R
                  " U " SXUS9US9I Sh  vN nOU " SXS	9I Sh  vN n[        US
5      (       a  UR                  5       I Sh  vN nOUR                  5       I Sh  vN n  [        US5      (       a  UR                  S5      OUn[        R                  " U5      n[        US5      (       a  UR$                  OUR&                  nU[(        R*                  :X  a  SUS4s  $ [         R,                  " XS9nU[(        R.                  :X  a  SnU(       a
  U(       a  GMA  SXV4s  $  GNC GN GN N N! [        R                  [        R                  4 a    SnU(       d	  S0 U4s s  $  GM  [         a
    S0 S4s s  $ f = f! [         ["        4 a    0 n Nf = f
 SXV4$ 7f)a  Makes a request to the Regional Access Boundary lookup endpoint. This
    function doesn't throw on response errors.

Args:
    request (google.auth.aio.transport.Request): A callable used to make
        HTTP requests. The returned response must support `await response.read()`
        (standard async transport) or `await response.content()` (legacy/custom transport).
    url (str): The Regional Access Boundary lookup url.
    can_retry (bool): Enable or disable request retry behavior. Defaults to true.
    headers (Optional[Mapping[str, str]]): The headers for the request.
    fail_fast (bool): Whether the lookup should fail fast (uses a short timeout and no retries).

Returns:
    Tuple(bool, Mapping[str, str], Optional[bool]): A boolean indicating
      if the request is successful, a mapping for the JSON-decoded response
      data and in the case of an error a boolean indicating if the error
      is retryable.
FN      )total_attemptsGET)r   r   r   timeout)rl   )r   r   r   readTr   r	   r   r   )r   1_BLOCKING_REGIONAL_ACCESS_BOUNDARY_LOOKUP_TIMEOUTr   AsyncExponentialBackoffasynciowait_forr    rm   r   TimeoutErrorr   TransportError	Exceptionr   r   r!   UnicodeDecodeErrorr"   r   r#   r$   r%   r&   BAD_GATEWAY)r'   r   r+   r   r\   r   r,   rl   rj   r-   r.   r/   response_bytesr1   r   s                  r2   re   re   p  s    , MO EN@@SW  $QN"::%G  39a	$!(!1!15cGT#" 
 ")3!PP x(('/}}!6'/'7'7'9!9		 >844 %%g.# 
 !JJ}5M x//    	 +..(,, ++#
 +111"O-88g39
 Q "7!9$$j&?&?@ 	"Ob/11 	$"e##	$ #J/ 	M	? j -00s   ?HG=FG=	H%F0F1F F(F)F*F.H/FFFH	:G%A:HHG=FFFF2G"HG"H!G""H%G:7H9G::H)NFT)T)NNT)NF)TNF)__doc__rp   http.clientr   r$   r   r   google.authr   r   r   r   google.oauth2r   r3   r7   rF   rM   rZ   rc   r^   re        r2   <module>r~      s~   	  !   ,   "  + LPB1L LP&R'/T++h 7Ot%R ;@F ;@V1r}   