͗j_3 ddlmZddlZddlZddlZddlZddlZddlZ ddl m Z ddl m Z ddlmZddlmZmZddlmZdd lmZmZdd lmZdd lmZmZdd lmZGd de j@jBZ"GddZ#y)) annotationsN) lru_cache) SSLContext)Any) HTTPErrorURLError)urlparse)PyJWKPyJWKSet)decode_complete)PyJWKClientConnectionErrorPyJWKClientError) JWKSetCachec0eZdZ ddZy)_NoRedirectHandlercy)N)selfreqfpcodemsgheadersnewurls TC:\Users\pivot\Documents\cueki\casual-preloader\Lib\site-packages\jwt/jwks_client.pyredirect_requestz#_NoRedirectHandler.redirect_requestsN)rzurllib.request.Requestrrrintrstrrrrr returnzurllib.request.Request | None)__name__ __module__ __qualname__rrrrrrsK  #          ' rrceZdZ d d dZd dZdddZeddZdddZeddZ ddZ dd Z edd Z y) PyJWKClientNc $|i}t|jj} | dvrtd| d||_d|_||_||_||_| dkrtd| dtj| std| d| |_ d|_ tj|_|r%|dkrtd |dt!||_nd|_|r$t#| |j$} | |_yy) u$ A client for retrieving signing keys from a JWKS endpoint. ``PyJWKClient`` uses a two-tier caching system to avoid unnecessary network requests: **Tier 1 — JWK Set cache** (enabled by default): Caches the entire JSON Web Key Set response from the endpoint. Controlled by: - ``cache_jwk_set``: Set to ``True`` (the default) to enable this cache. When enabled, the JWK Set is fetched from the network only when the cache is empty or expired. - ``lifespan``: Time in seconds before the cached JWK Set expires. Defaults to ``300`` (5 minutes). Must be greater than 0. Unknown key IDs can trigger one forced refresh after the cooldown period configured by ``cooldown_duration``. Every successful fetch starts this cooldown, including the initial fetch and cache-expiry fetches. A newly rotated key may therefore wait for the cooldown period before it is fetched; set ``cooldown_duration`` to ``0`` to disable this behavior. The cooldown is bypassed when ``cache_jwk_set`` is ``False``. **Tier 2 — Signing key cache** (disabled by default): Caches individual signing keys (looked up by ``kid``) using an LRU cache with **no time-based expiration**. Keys are evicted only when the cache reaches its maximum size. Controlled by: - ``cache_keys``: Set to ``True`` to enable this cache. Defaults to ``False``. - ``max_cached_keys``: Maximum number of signing keys to keep in the LRU cache. Defaults to ``16``. :param uri: The URL of the JWKS endpoint. :type uri: str :param cache_keys: Enable the per-key LRU cache (Tier 2). :type cache_keys: bool :param max_cached_keys: Max entries in the signing key LRU cache. :type max_cached_keys: int :param cache_jwk_set: Enable the JWK Set response cache (Tier 1). :type cache_jwk_set: bool :param lifespan: TTL in seconds for the JWK Set cache. :type lifespan: float :param headers: Optional HTTP headers to include in requests. :type headers: dict or None :param timeout: HTTP request timeout in seconds. :type timeout: float :param ssl_context: Optional SSL context for the request. :type ssl_context: ssl.SSLContext or None :param cooldown_duration: Minimum time in seconds between forced refreshes after an unknown key ID. Defaults to ``30``. :type cooldown_duration: float N)httphttpszInvalid JWKS URI scheme z(: only 'http' and 'https' are supported.rzDCooldown duration must be greater than or equal to 0, the input is ""z0Cooldown duration must be finite, the input is "z/Lifespan must be greater than 0, the input is ")maxsize)r schemelowerruri jwk_set_cachertimeout ssl_contextmathisfinitecooldown_duration_last_successful_fetch threadingRLock _client_lockrrget_signing_key) rr. cache_keysmax_cached_keys cache_jwk_setlifespanrr0r1r4r,r9s r__init__zPyJWKClient.__init__#sMB ?G #%%++- * *"*6*5!" 15  & q "!!2 316 }}./"BCTBUUVW "348#%OO- 1}&EhZqQ"-X!6D !%D  @i@AUAUVO#2D rc: tjj|j|j}t g}|j 9|jtjj|j tjj|}|j||j5}tj|}ddd|j/}|j0|j0j3|t5j6|_|S#1swY\xYw#ttt j"j$f$r5}t'|t(r|j+t-d|d|d}~wwxYw)a7Fetch the JWK Set from the JWKS endpoint. Makes an HTTP request to the configured ``uri`` and returns the parsed JSON response. If the JWK Set cache is enabled, the response is stored in the cache. :returns: The parsed JWK Set as a dictionary. :raises PyJWKClientConnectionError: If the HTTP request fails. :raises PyJWKClientError: If the endpoint does not return a JSON object. :raises PyJWKSetError: If the JWK Set cache is enabled and the response contains no usable keys. )urlrN)context)r0z'Fail to fetch data from the url, err: "r*)urllibrequestRequestr.rrr1append HTTPSHandler build_openeropenr0jsonloadr TimeoutErrorr(client HTTPException isinstancercloser_as_jwk_set_payloadr/puttime monotonicr5)rrhandlersopenerresponsejwk_setes r fetch_datazPyJWKClient.fetch_datas@ &&488T\\&JA#5#7"8H+ ; ;DDTDT ; UV^^00(;FQ 5))H-6**73    )    " "7 +&*nn&6#+65, (A(AB !Y' ,9!A>  s0B>D=D1D=1D:6D==(F%0FFcFd}d}|j|s|jj}||j}d}t|tr|}n$t j |j |}|r'|j|jj||S)aNReturn the JWK Set, using the cache when available. :param refresh: Force a fresh fetch from the endpoint, bypassing the cache. :type refresh: bool :returns: The JWK Set. :rtype: PyJWKSet :raises PyJWKClientError: If the endpoint does not return a JSON object. NFT)r/getrZrNr from_dictrPrQ)rrefreshdatafetchedrXs r get_jwk_setzPyJWKClient.get_jwk_sets    )'%%))+D <??$DG dH %G(()A)A$)GHG t))5    " "7 +rc<t|ts td|S)Nz.The JWKS endpoint did not return a JSON object)rNdictr)r_s rrPzPyJWKClient._as_jwk_set_payloads$%"#ST T rcF|j|}|j|S)aReturn all signing keys from the JWK Set. Filters the JWK Set to keys whose ``use`` is ``"sig"`` (or unspecified) and that have a ``kid``. :param refresh: Force a fresh fetch from the endpoint, bypassing the cache. :type refresh: bool :returns: A list of signing keys. :rtype: list[PyJWK] :raises PyJWKClientError: If no signing keys are found. )ra_get_signing_keys_from_jwk_set)rr^rXs rget_signing_keyszPyJWKClient.get_signing_keyss%""7+227;;rc|jDcgc]}|jdvr|jr| }}|s td|Scc}w)N)sigNz2The JWKS endpoint did not contain any signing keys)keyspublic_key_usekey_idr)rX jwk_set_key signing_keyss rrez*PyJWKClient._get_signing_keys_from_jwk_setsZ '|| + ))]:{?Q?Q +  "#WX X s#Ac|j5|j}|j||}|s|jduxr>|jduxr.t j |jz |jk}|s=|jd}t j |_|j||}|std|d|cdddS#1swYyxYw)aReturn the signing key matching the given ``kid``. If no match is found in the current JWK Set, the set is refreshed from the endpoint and the lookup is retried once when the refresh cooldown permits it. :param kid: The key ID to look up. :type kid: str :returns: The matching signing key. :rtype: PyJWK :raises PyJWKClientError: If no matching key is found after refreshing. NT)r^z,Unable to find a signing key that matches: "r*) r8rf match_kidr/r5rRrSr4r)rkidrm signing_key cooling_downs rr9zPyJWKClient.get_signing_keys  002L..s;K&&d2-334?-(4+F+FF,,- $#'#8#8#8#FL26..2BD/"&..s"CK"*Fse1M+  s CCC$cjt|ddi}|d}|j|jdS)aGReturn the signing key for a JWT by reading its ``kid`` header. Extracts the ``kid`` from the token's unverified header and delegates to :meth:`get_signing_key`. :param token: The encoded JWT. :type token: str or bytes :returns: The matching signing key. :rtype: PyJWK verify_signatureF)optionsheaderrp) decode_tokenr9r\)rtoken unverifiedrvs rget_signing_key_from_jwtz$PyJWKClient.get_signing_key_from_jwt,s:"%2De1LM H%##FJJu$566rc@d}|D]}|j|k(s|}|S|S)a7Find a key in *signing_keys* that matches *kid*. :param signing_keys: The list of keys to search. :type signing_keys: list[PyJWK] :param kid: The key ID to match. :type kid: str :returns: The matching key, or ``None`` if not found. :rtype: PyJWK or None N)rk)rmrprqkeys rrozPyJWKClient.match_kid;s5 CzzS !   r)FTi,NNr~)r.r r:boolr;rr<rr=floatrzdict[str, Any] | Noner0rr1zSSLContext | Noner4r)r!r)F)r^rr!r )r_rr!zdict[str, Any])r^rr! list[PyJWK])rXr r!r)rpr r!r )rxz str | bytesr!r )rmrrpr r!z PyJWK | None) r"r#r$r>rZra staticmethodrPrfrer9rzrorrrr&r&"s!!")-)-#%n3 n3n3 n3  n3  n3'n3n3'n3!n3`)V#J <   #J 7rr&)$ __future__r http.clientr(rIr2r6rRurllib.requestrB functoolsrsslrtypingr urllib.errorrr urllib.parser api_jwkr r api_jwtr rw exceptionsrrr/rrCHTTPRedirectHandlerrr&rrrrsW"  ,!$4D& ;; kkr