o MfX @s<dZddlmZddlZddlZddlZddlZddlZzddlZWne y3Z ze de dZ [ wwddl Zddl Zddl mZddlmZddlmZddlmZddlZdd lmZeeZd ZGd d d ejZGd ddeZGdddejZGdddej j!Z"Gdddej j!Z#Gdddej$Z%dS)zTransport adapter for Requests.)absolute_importNzmThe requests library is not installed from please install the requests package to use the requests transport.)create_urllib3_context)environment_vars) exceptions) transport)service_accountxc@s<eZdZdZddZeddZeddZedd Zd S) _ResponsezuRequests transport response adapter. Args: response (requests.Response): The raw Requests response. cCs ||_dSN) _response)selfresponser`/var/www/html/analyze/labelStudio/lib/python3.10/site-packages/google/auth/transport/requests.py__init__7s z_Response.__init__cC|jjSr )r status_coder rrrstatus:z_Response.statuscCrr )r headersrrrrr>rz_Response.headerscCrr )r contentrrrrdataBrz_Response.dataN) __name__ __module__ __qualname____doc__rpropertyrrrrrrrr 0s  r c@s0eZdZdZejjfddZddZddZ dS) TimeoutGuardaUA context manager raising an error if the suite execution took too long. Args: timeout (Union[None, Union[float, Tuple[float, float]]]): The maximum number of seconds a suite can run without the context manager raising a timeout exception on exit. If passed as a tuple, the smaller of the values is taken as a timeout. If ``None``, a timeout error is never raised. timeout_error_type (Optional[Exception]): The type of the error to raise on timeout. Defaults to :class:`requests.exceptions.Timeout`. cCs||_||_||_dSr )_timeoutremaining_timeout_timeout_error_type)r timeouttimeout_error_typerrrrUs zTimeoutGuard.__init__cCst|_|Sr )time_startrrrr __enter__Zs zTimeoutGuard.__enter__cs|rdS|jdur dSt|jd}t|jtjr'|j|_|jdk}ntfdd|jD|_t|jdk}|rA| dS)NFrc3s|]}|VqdSr r).0xelapsedrr lsz(TimeoutGuard.__exit__..) rr$r% isinstancenumbersNumberr tupleminr!)r exc_type exc_value traceback deadline_hitrr)r__exit__^s   zTimeoutGuard.__exit__N) rrrrrequestsrTimeoutrr&r5rrrrrGs   rc@s4eZdZdZd ddZddZdddefdd ZdS) RequestaRequests request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedSession` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.requests import requests request = google.auth.transport.requests.Request() credentials.refresh(request) Args: session (requests.Session): An instance :class:`requests.Session` used to make HTTP requests. If not specified, a session will be created. .. automethod:: __call__ NcCs|st}||_dSr )r6Sessionsession)r r:rrrrs zRequest.__init__cCsFzt|dr|jdur|jWdSWdSWdSty"YdSw)Nr:)hasattrr:close TypeErrorrrrr__del__s zRequest.__del__GETc Ksdztd|||jj||f|||d|}t|WStjjy1}zt|} | |d}~ww)aRMake an HTTP request using requests. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload or body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the requests default timeout will be used. kwargs: Additional arguments passed through to the underlying requests :meth:`~requests.Session.request` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. zMaking request: %s %srrr"N) _LOGGERdebugr:requestr r6rRequestExceptionTransportError) r urlmethodbodyrr"kwargsr caught_excnew_excrrr__call__s  zRequest.__call__r )rrrrrr>_DEFAULT_TIMEOUTrLrrrrr8ss  r8c8eZdZdZfddZfddZfddZZS)_MutualTlsAdaptera7 A TransportAdapter that enables mutual TLS. Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Raises: ImportError: if certifi or pyOpenSSL is not installed OpenSSL.crypto.Error: if client cert or key is invalid c sddl}ddlm}ddl}|jj||j|}| |j|}t }|j | d|j ||j |||_t } | j | d| j || j || |_tt|dS)Nr)cryptocafile)certifiOpenSSLrPurllib3.contrib.pyopensslcontrib pyopensslinject_into_urllib3load_privatekey FILETYPE_PEMload_certificaterload_verify_locationswhere_ctxuse_certificateuse_privatekey_ctx_poolmanager_ctx_proxymanagersuperrOr) r certkeyrSrPurllib3pkeyx509ctx_poolmanagerctx_proxymanager __class__rrrs"      z_MutualTlsAdapter.__init__c$|j|d<tt|j|i|dSN ssl_context)rarcrOinit_poolmanagerr argsrIrkrrrp z"_MutualTlsAdapter.init_poolmanagerc |j|d<tt|j|i|Srn)rbrcrOproxy_manager_forrqrkrrru z#_MutualTlsAdapter.proxy_manager_forrrrrrrpru __classcell__rrrkrrOs  rOcrN)_MutualTlsOffloadAdaptera A TransportAdapter that enables mutual TLS and offloads the client side signing operation to the signing library. Args: enterprise_cert_file_path (str): the path to a enterprise cert JSON file. The file should contain the following field: { "libs": { "signer_library": "...", "offload_library": "..." } } Raises: ImportError: if certifi or pyOpenSSL is not installed google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. csddl}ddl}ddlm}|jj|||_|j t }|j | d|j |||_t }|j | d|j |||_tt|dS)Nr)_custom_tls_signerrQ)rSrUgoogle.auth.transportrzrVrWrXCustomTlsSignersignerload_librariesrr\r]attach_to_ssl_contextrarbrcryr)r enterprise_cert_file_pathrSrfrz poolmanager proxymanagerrkrrrs      z!_MutualTlsOffloadAdapter.__init__crmrn)rarcryrprqrkrrrp"rsz)_MutualTlsOffloadAdapter.init_poolmanagercrtrn)rbrcryrurqrkrrru&rvz*_MutualTlsOffloadAdapter.proxy_manager_forrwrrrkrrys   rycsheZdZdZejejdddffdd Zd ddZddde ffdd Z e d d Z fd d Z ZS)AuthorizedSessiona"A Requests Session class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.requests import AuthorizedSession authed_session = AuthorizedSession(credentials) response = authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to ``true``, otherwise it does nothing. Assume the environment is set to ``true``, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to ``true``, then create an :class:`AuthorizedSession` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_session = AuthorizedSession(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: authed_session.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if authed_session.is_mtls: response = authed_session.request('GET', mtls_endpoint) else: response = authed_session.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: authed_session.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. refresh_timeout (Optional[int]): The timeout value in seconds for credential refresh HTTP requests. auth_request (google.auth.transport.requests.Request): (Optional) An instance of :class:`~google.auth.transport.requests.Request` used when refreshing credentials. If not passed, an instance of :class:`~google.auth.transport.requests.Request` is created. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. Ncstt|||_||_||_||_d|_||_|dur6t |_ t j j dd}|j d|t|j }nd|_ ||_t|jtjrT|j|jrOd|jnddSdS)NF) max_retrieshttps://z https://{}/)rcrr credentials_refresh_status_codes_max_refresh_attempts_refresh_timeout_is_mtls _default_hostr6r9_auth_request_sessionadapters HTTPAdaptermountr8 _auth_requestr,r Credentials_create_self_signed_jwtformat)r rrefresh_status_codesmax_refresh_attemptsrefresh_timeout auth_request default_host retry_adapterrkrrrs&   zAuthorizedSession.__init__c Csttjd}|dkrd|_dSzddl}Wnty*}zt|}||d}~wwz t j j j |\|_}}|jrIt||}|d|WdSWdStjt|jjfye}zt|}||d}~ww)aConfigure the client certificate and key for SSL connection. The function does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` is explicitly set to `true`. In this case if client certificate and key are successfully obtained (from the given client_cert_callback or from application default SSL credentials), a :class:`_MutualTlsAdapter` instance will be mounted to "https://" prefix. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. falsetrueFNrr)osgetenvr!GOOGLE_API_USE_CLIENT_CERTIFICATErrT ImportErrorrMutualTLSChannelErrorgoogleauthr _mtls_helperget_client_cert_and_keyrOrClientCertErrorrPError) r client_cert_callbackuse_client_certrTrJrKrdre mtls_adapterrrrconfigure_mtls_channelsD     z(AuthorizedSession.configure_mtls_channelc s|dd}|dur|ni} |dur|jntj|j|d} |} t| } |j| ||| Wdn1s9wY| j} t| } t t |j ||f|| |d|} Wdn1sawY| j} | j |j vr||jkrtd| j |d|j|dur|jntj|j|d} t| } |j| Wdn1swY| j} |j ||f||| ||dd|S| S) aImplementation of Requests' request. Args: timeout (Optional[Union[float, Tuple[float, float]]]): The amount of time in seconds to wait for the server response with each individual request. Can also be passed as a tuple ``(connect_timeout, read_timeout)``. See :meth:`requests.Session.request` documentation for details. max_allowed_time (Optional[float]): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timout error will be raised after such request completes. _credential_refresh_attemptrN)r"r@z;Refreshing credentials due to a %s response. Attempt %s/%s.)rrmax_allowed_timer"r)popcopyr functoolspartialrrbefore_requestr rcrrCrrrrAinforefresh)r rGrFrrrr"rIrrequest_headersrremaining_timeguardr rkrrrCsj &        zAuthorizedSession.requestcCs|jS)z3Indicates if the created SSL channel is mutual TLS.)rrrrris_mtlsSszAuthorizedSession.is_mtlscs&|jdur |jtt|dSr )rr<rcrrrkrrr<Xs  zAuthorizedSession.closer )rrrrrDEFAULT_REFRESH_STATUS_CODESDEFAULT_MAX_REFRESH_ATTEMPTSrrrMrCrrr<rxrrrkrr+s"Y +9q r)&r __future__rrloggingr-rr$r6rrJrequests.adaptersrequests.exceptions#requests.packages.urllib3.util.ssl_r google.authrrr"google.auth.transport._mtls_helperr google.oauth2r getLoggerrrArMResponser objectrr8rrrOryr9rrrrrsB        ,P.: