
    !<iT7                         d Z ddlZddlZddlZddlmZ ddlmZ ddlmZ ddl	m
Z
 ddl	mZ d	Zd
ZdZdZdZdZddZddZd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd ZdS )zauthlib.oauth1.rfc5849.signature.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module represents a direct implementation of `section 3.4`_ of the spec.

.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
    N)to_bytes)
to_unicode)urlparse   escape)unescapez	HMAC-SHA1zRSA-SHA1	PLAINTEXTHEADERQUERYBODYc                 v   t          ||          }g }|D ]E\  }}|dv r
|                    d          rt          |          }|                    ||f           Ft	          |          }d                    t          |                                           t          |          t          |          g          S )aX  Generate signature base string from request, per `Section 3.4.1`_.

    For example, the HTTP request::

        POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
        Host: example.com
        Content-Type: application/x-www-form-urlencoded
        Authorization: OAuth realm="Example",
            oauth_consumer_key="9djdj82h48djs9d2",
            oauth_token="kkk9d7dh3k39sjv7",
            oauth_signature_method="HMAC-SHA1",
            oauth_timestamp="137131201",
            oauth_nonce="7d8f3e4a",
            oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D"

        c2&a3=2+q

    is represented by the following signature base string (line breaks
    are for display purposes only)::

        POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q
        %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_
        key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m
        ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk
        9d7dh3k39sjv7

    .. _`Section 3.4.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1
    )oauth_signaturerealmoauth_&)normalize_base_string_uri
startswithr	   appendnormalize_parametersjoinr   upper)	methoduriparamshostbase_string_uriunescaped_paramskvnormalized_paramss	            /Users/kimhansen/Desktop/03 Workspace/ceo-agents/chl-effectiveness/mcp-servers/whoop/.venv/lib/python3.11/site-packages/authlib/oauth1/rfc5849/signature.pyconstruct_base_stringr#      s    < 0T::O  ( (1,,, <<!! 	AA'''' --=>> 886<<>>""?##$%%	
      c                    t          |           } t          j        |           \  }}}}}}|r|st          d          |sd}|                                }|                                }||                                }d}d|v r!|                    dd          \  }}	||	f|v r|}t          j        ||||ddf          S )a7  Normalize Base String URI per `Section 3.4.1.2`_.

    For example, the HTTP request::

        GET /r%20v/X?id=123 HTTP/1.1
        Host: EXAMPLE.COM:80

    is represented by the base string URI: "http://example.com/r%20v/X".

    In another example, the HTTPS request::

        GET /?q=1 HTTP/1.1
        Host: www.example.net:8080

    is represented by the base string URI: "https://www.example.net:8080/".

    .. _`Section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2

    The host argument overrides the netloc part of the uri argument.
    z$uri must include a scheme and netloc/N))http80)https443:r    )r   r   
ValueErrorlowersplit
urlunparse)
r   r   schemenetlocpathr   queryfragmentdefault_portsports
             r"   r   r   V   s    * S//C4<4Ec4J4J1FFD&%  A A?@@@   \\^^F\\^^F M f}}\\#q))
dD>]**Ffb"EFFFr$   c                     d | D             }|                                  d |D             }d                    |          S )a
  Normalize parameters per `Section 3.4.1.3.2`_.

    For example, the list of parameters from the previous section would
    be normalized as follows:

    Encoded::

    +------------------------+------------------+
    |          Name          |       Value      |
    +------------------------+------------------+
    |           b5           |     %3D%253D     |
    |           a3           |         a        |
    |          c%40          |                  |
    |           a2           |       r%20b      |
    |   oauth_consumer_key   | 9djdj82h48djs9d2 |
    |       oauth_token      | kkk9d7dh3k39sjv7 |
    | oauth_signature_method |     HMAC-SHA1    |
    |     oauth_timestamp    |     137131201    |
    |       oauth_nonce      |     7d8f3e4a     |
    |           c2           |                  |
    |           a3           |       2%20q      |
    +------------------------+------------------+

    Sorted::

    +------------------------+------------------+
    |          Name          |       Value      |
    +------------------------+------------------+
    |           a2           |       r%20b      |
    |           a3           |       2%20q      |
    |           a3           |         a        |
    |           b5           |     %3D%253D     |
    |          c%40          |                  |
    |           c2           |                  |
    |   oauth_consumer_key   | 9djdj82h48djs9d2 |
    |       oauth_nonce      |     7d8f3e4a     |
    | oauth_signature_method |     HMAC-SHA1    |
    |     oauth_timestamp    |     137131201    |
    |       oauth_token      | kkk9d7dh3k39sjv7 |
    +------------------------+------------------+

    Concatenated Pairs::

    +-------------------------------------+
    |              Name=Value             |
    +-------------------------------------+
    |               a2=r%20b              |
    |               a3=2%20q              |
    |                 a3=a                |
    |             b5=%3D%253D             |
    |                c%40=                |
    |                 c2=                 |
    | oauth_consumer_key=9djdj82h48djs9d2 |
    |         oauth_nonce=7d8f3e4a        |
    |   oauth_signature_method=HMAC-SHA1  |
    |      oauth_timestamp=137131201      |
    |     oauth_token=kkk9d7dh3k39sjv7    |
    +-------------------------------------+

    and concatenated together into a single string (line breaks are for
    display purposes only)::

        a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj
        dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1
        &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7

    .. _`Section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
    c                 P    g | ]#\  }}t          |          t          |          f$S  r   .0r   r    s      r"   
<listcomp>z(normalize_parameters.<locals>.<listcomp>   s-    <<<TQ6!99fQii(<<<r$   c                 "    g | ]\  }}| d | S )=r:   r;   s      r"   r=   z(normalize_parameters.<locals>.<listcomp>   s&    999da!zzazz999r$   r   )sortr   )r   
key_valuesparameter_partss      r"   r   r      sS    R =<V<<<J
 OO
 :9j999O
 88O$$$r$   c                 z    | j                             dd          }t          | j        | j        | j        |          S )z,Generate signature base string from request.HostN)headersgetr#   r   r   r   )requestr   s     r"   generate_signature_base_stringrH      s3    ?vt,,D gndSSSr$   c                 H   | }t          |pd          }|dz  }|t          |pd          z  }t          j        t          |          t          |          t          j                  }t          j        |                                          dd         }t          |          S )a[  Generate signature via HMAC-SHA1 method, per `Section 3.4.2`_.

    The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature
    algorithm as defined in `RFC2104`_::

        digest = HMAC - SHA1(key, text)

    .. _`RFC2104`: https://tools.ietf.org/html/rfc2104
    .. _`Section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
    r,   r   N)
r   hmacnewr   hashlibsha1binascii
b2a_base64digestr   )base_stringclient_secrettoken_secrettextkey	signaturesigs          r"   hmac_sha1_signaturerY      s    " D $"
%
%C 3JC
 6,$"%%%C#EEI 
i..00
1
1#2#
6Cc??r$   c                     ddl m} t          |           }  |t          |           |          }t          j        |          dd         }t          |          S )ar  Generate signature via RSA-SHA1 method, per `Section 3.4.3`_.

    The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature
    algorithm as defined in `RFC3447, Section 8.2`_ (also known as
    PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5.  To
    use this method, the client MUST have established client credentials
    with the server that included its RSA public key (in a manner that is
    beyond the scope of this specification).

    .. _`Section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
    .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2
    r   )	sign_sha1NrJ   )rsar[   r   rO   rP   r   )rR   rsa_private_keyr[   srX   s        r"   rsa_sha1_signaturer_   +  sa     ;''K	(;''99A

a
 
 "
%Cc??r$   c                 Z    t          | pd          }|dz  }|t          |pd          z  }|S )a  Generate signature via PLAINTEXT method, per `Section 3.4.4`_.

    The "PLAINTEXT" method does not employ a signature algorithm.  It
    MUST be used with a transport-layer mechanism such as TLS or SSL (or
    sent over a secure channel with equivalent protections).  It does not
    utilize the signature base string or the "oauth_timestamp" and
    "oauth_nonce" parameters.

    .. _`Section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4
    r,   r   r   )rS   rT   rW   s      r"   plaintext_signaturera   @  sA    " }*++I I
 *+++Ir$   c                 V    t          |          }t          || j        | j                  S )zSign a HMAC-SHA1 signature.)rH   rY   rS   rT   clientrG   rR   s      r"   sign_hmac_sha1re   _  s'    099K{F,@&BUVVVr$   c                 J    t          |          }t          || j                  S )z4Sign a RSASSA-PKCS #1 v1.5 base64 encoded signature.)rH   r_   rsa_keyrc   s      r"   sign_rsa_sha1rh   e  s!    099Kk6>:::r$   c                 6    t          | j        | j                  S )zSign a PLAINTEXT signature.)ra   rS   rT   )rd   rG   s     r"   sign_plaintextrj   k  s    v3V5HIIIr$   c                     t          |           }t          || j        | j                  }t	          j        || j                  S )zVerify a HMAC-SHA1 signature.)rH   rY   rS   rT   rK   compare_digestrW   )rG   rR   rX   s      r"   verify_hmac_sha1rm   p  s<    099K
k7+@'BV
W
WCsG$5666r$   c                     ddl m} t          |           }t          j        t          | j                            } ||t          |          | j                  S )z6Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature.r   )verify_sha1)r\   ro   rH   rO   
a2b_base64r   rW   rsa_public_key)rG   ro   rR   rX   s       r"   verify_rsa_sha1rr   w  s[          099K

hw'899
:
:C;sH[1173IJJJr$   c                 j    t          | j        | j                  }t          j        || j                  S )zVerify a PLAINTEXT signature.)ra   rS   rT   rK   rl   rW   )rG   rX   s     r"   verify_plaintextrt     s-    
g3W5I
J
JCsG$5666r$   )N)__doc__rO   rM   rK   authlib.common.encodingr   r   authlib.common.urlsr   utilr   r	   SIGNATURE_HMAC_SHA1SIGNATURE_RSA_SHA1SIGNATURE_PLAINTEXTSIGNATURE_TYPE_HEADERSIGNATURE_TYPE_QUERYSIGNATURE_TYPE_BODYr#   r   r   rH   rY   r_   ra   re   rh   rj   rm   rr   rt   r:   r$   r"   <module>r      s       , , , , , , . . . . . . ( ( ( ( ( (            !  !     6 6 6 6rDG DG DG DGNX% X% X%vT T T* * *Z  *  >W W W; ; ;J J J
7 7 7K K K7 7 7 7 7r$   