o j%@sddlmZddlmZddlZddlZddlZddl m Z ddl m Z ddl m Z ddl m Z ddlmZGd d d ZGd d d eZddddZGdddeZdddZGdddZdS) ) annotationsN)_base64_alphabet) base64_decode) base64_encode want_bytes) BadSignaturec@s$eZdZdZd ddZdd d Zd S)SigningAlgorithmzgSubclasses must implement :meth:`get_signature` to provide signature generation functionality. keybytesvaluereturncCst)z2Returns the signature for the given key and value.)NotImplementedErrorselfr r r/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/itsdangerous/signer.py get_signatureszSigningAlgorithm.get_signaturesigboolcCst||||S)zMVerifies the given signature matches the expected signature. )hmaccompare_digestr)rr r rrrrverify_signaturesz!SigningAlgorithm.verify_signatureNr r r r rr )r r r r rr rr)__name__ __module__ __qualname____doc__rrrrrrr s r c@seZdZdZd ddZdS) NoneAlgorithmz`Provides an algorithm that does not perform any signing and returns an empty signature. r r r rcCsdS)Nrrrrrr$szNoneAlgorithm.get_signatureNr)rrrrrrrrrrsrr stringr rt.AnycCs t|S)zDon't access ``hashlib.sha1`` until runtime. FIPS builds may not include SHA-1, in which case the import and use as a default would fail before the developer can configure something else. )hashlibsha1)r!rrr _lazy_sha1( r%c@s8eZdZUdZeeZded<ddddZdd d Z dS) HMACAlgorithmz*Provides signature generation using HMACs.r"default_digest_methodN digest_methodcCs|dur|j}||_dSN)r(r))rr)rrr__init__8s zHMACAlgorithm.__init__r r r rcCstj|||jd}|S)N)msg digestmod)rnewr)digest)rr r macrrrr>szHMACAlgorithm.get_signaturer*)r)r"r) rrrr staticmethodr%r(__annotations__r+rrrrrr'0s  r' secret_key7str | bytes | cabc.Iterable[str] | cabc.Iterable[bytes] list[bytes]cCs&t|ttfr t|gSdd|DS)NcSsg|]}t|qSrr).0srrr Isz#_make_keys_list..) isinstancestrr r)r3rrr_make_keys_listCs r;c@seZdZUdZeeZded<dZded<   d,d-ddZ e d.ddZ d/d0ddZ d1dd Z d1d!d"Zd2d%d&Zd3d(d)Zd4d*d+Zd S)5SigneraA signer securely signs bytes, then unsigns them to verify that the value hasn't been changed. The secret key should be a random string of ``bytes`` and should not be saved to code or version control. Different salts should be used to distinguish signing in different contexts. See :doc:`/concepts` for information about the security of the secret key and salt. :param secret_key: The secret key to sign and verify with. Can be a list of keys, oldest to newest, to support key rotation. :param salt: Extra key to combine with ``secret_key`` to distinguish signatures in different contexts. :param sep: Separator between the signature and value. :param key_derivation: How to derive the signing key from the secret key and salt. Possible values are ``concat``, ``django-concat``, or ``hmac``. Defaults to :attr:`default_key_derivation`, which defaults to ``django-concat``. :param digest_method: Hash function to use when generating the HMAC signature. Defaults to :attr:`default_digest_method`, which defaults to :func:`hashlib.sha1`. Note that the security of the hash alone doesn't apply when used intermediately in HMAC. :param algorithm: A :class:`SigningAlgorithm` instance to use instead of building a default :class:`HMACAlgorithm` with the ``digest_method``. .. versionchanged:: 2.0 Added support for key rotation by passing a list to ``secret_key``. .. versionchanged:: 0.18 ``algorithm`` was added as an argument to the class constructor. .. versionchanged:: 0.14 ``key_derivation`` and ``digest_method`` were added as arguments to the class constructor. r"r( django-concatr:default_key_derivationitsdangerous.Signer.Nr3r4saltstr | bytes | Nonesep str | byteskey_derivation str | Noner) t.Any | None algorithmSigningAlgorithm | NonecCst||_t||_|jtvrtd|durt|}nd}||_|dur(|j}||_|dur2|j }||_ |dur>t |j }||_ dS)NzThe given separator cannot be used because it may be contained in the signature itself. ASCII letters, digits, and '-_=' must not be used.r?) r; secret_keysrrCr ValueErrorrAr>rEr(r)r'rH)rr3rArCrEr)rHrrrr+s&      zSigner.__init__rr cCs |jdS)zThe newest (last) entry in the :attr:`secret_keys` list. This is for compatibility from before key rotation support was added. )rJ)rrrrr3r&zSigner.secret_keycCs|dur |jd}nt|}|jdkr!tt||j|S|jdkr6tt||jd|S|jdkrMt j ||jd}| |j|S|jdkrT|St d ) aThis method is called to derive the key. The default key derivation choices can be overridden here. Key derivation is not intended to be used as a security method to make a complex key out of a short password. Instead you should use large random secret keys. :param secret_key: A specific secret key to derive from. Defaults to the last item in :attr:`secret_keys`. .. versionchanged:: 2.0 Added the ``secret_key`` parameter. NrLconcatr=ssignerr)r-nonezUnknown key derivation method) rJrrEtcastr r)rAr/rr.update TypeError)rr3r0rrr derive_keys       zSigner.derive_keyr cCs&t|}|}|j||}t|S)z*Returns the signature for the given value.)rrSrHrr)rr r rrrrrszSigner.get_signaturecCst|}||j||S)zSigns the given string.)rrCr)rr rrrsignsz Signer.signrrcCs^zt|}Wn tyYdSwt|}t|jD]}||}|j|||r,dSqdS)z+Verifies the signature for the given value.FT)r ExceptionrreversedrJrSrHr)rr rr3r rrrrs   zSigner.verify_signature signed_valuecCsZt|}|j|vrtd|jd||jd\}}|||r#|Std|d|d)zUnsigns the given string.zNo z found in valuerz Signature z does not match)payload)rrCr rsplitr)rrWr rrrrunsigns  z Signer.unsigncCs&z||WdStyYdSw)znOnly validates the given signed value. Returns ``True`` if the signature exists and is valid. TF)rZr )rrWrrrvalidates   zSigner.validate)r?r@NNN) r3r4rArBrCrDrErFr)rGrHrI)rr r*)r3rBrr )r rDrr )r rDrrDrr)rWrDrr )rWrDrr)rrrrr1r%r(r2r>r+propertyr3rSrrTrrZr[rrrrr<Ls$ +  .   !   r<)r )r!r rr")r3r4rr5) __future__rcollections.abcabccabcr#rtypingrOencodingrrrrexcr r rr%r'r;r<rrrrs