
    Xi)                         S r  SSKJr  SSKrSSKrSSKrSSKJ	r	  SSKJ
r
  SSKJr   " S S\R                  5      rg! \ a	    SSKJr   NBf = f)	a  Identity Pool Credentials.

This module provides credentials to access Google Cloud resources from on-prem
or non-Google Cloud platforms which support external credentials (e.g. OIDC ID
tokens) retrieved from local file locations or local servers. This includes
Microsoft Azure and OIDC identity providers (e.g. K8s workloads registered with
Hub with Hub workload identity enabled).

These credentials are recommended over the use of service account credentials
in on-prem/non-Google Cloud platforms as they do not involve the management of
long-live service account private keys.

Identity Pool Credentials are initialized using external_account
arguments which are typically loaded from an external credentials file or
an external credentials URL. Unlike other Credentials that can be initialized
with a list of explicit arguments, secrets or credentials, external account
clients use the environment and hints/guidelines provided by the
external_account JSON file to retrieve credentials and exchange them for Google
access tokens.
    )MappingN)_helpers)
exceptions)external_accountc                      ^  \ rS rSrSrU 4S jr\R                  " \R                  5      S 5       r
S rS rS r SS jrU 4S	 jr\U 4S
 j5       r\U 4S j5       rSrU =r$ )Credentials2   z9External account credentials sourced from files and URLs.c                   > [         [        U ]
  " UUUUUS.UD6  [        U[        5      (       d  SU l        SU l        GOUR                  S5      U l        UR                  S5      U l        UR                  S5      U l        UR                  S0 5      nUR                  S5      =(       d    SU l	        S	U;   a  [        R                  " S
5      eU R                  S;  a/  [        R                  " SR                  U R                  5      5      eU R                  S:X  a:  UR                  S5      U l        U R                  c  [        R                  " S5      eOSU l        U R
                  (       a'  U R                  (       a  [        R                  " S5      eU R
                  (       d(  U R                  (       d  [        R                  " S5      egg)a  Instantiates an external account credentials object from a file/URL.

Args:
    audience (str): The STS audience field.
    subject_token_type (str): The subject token type.
    token_url (str): The STS endpoint URL.
    credential_source (Mapping): The credential source dictionary used to
        provide instructions on how to retrieve external credential to be
        exchanged for Google access tokens.

        Example credential_source for url-sourced credential::

            {
                "url": "http://www.example.com",
                "format": {
                    "type": "json",
                    "subject_token_field_name": "access_token",
                },
                "headers": {"foo": "bar"},
            }

        Example credential_source for file-sourced credential::

            {
                "file": "/path/to/token/file.txt"
            }
    args (List): Optional positional arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.
    kwargs (Mapping): Optional keyword arguments passed into the underlying :meth:`~external_account.Credentials.__init__` method.

Raises:
    google.auth.exceptions.RefreshError: If an error is encountered during
        access token retrieval logic.
    ValueError: For invalid parameters.

.. note:: Typically one of the helper constructors
    :meth:`from_file` or
    :meth:`from_info` are used instead of calling the constructor directly.
)audiencesubject_token_type	token_urlcredential_sourceNfileurlheadersformattypetextenvironment_idz>Invalid Identity Pool credential_source field 'environment_id')r   jsonz%Invalid credential_source format '{}'r   subject_token_field_namezBMissing subject_token_field_name for JSON credential_source formatzEAmbiguous credential_source. 'file' is mutually exclusive with 'url'.z>Missing credential_source. A 'file' or 'url' must be provided.)superr   __init__
isinstancer   _credential_source_file_credential_source_urlget_credential_source_headers_credential_source_format_typer   MalformedErrorr   _credential_source_field_name)	selfr   r   r   r   argskwargscredential_source_format	__class__s	           D/app/.venv/lib/python3.13/site-packages/google/auth/identity_pool.pyr   Credentials.__init__5   s   ` 	k4)
 	 1/		
 	
 +W55+/D(*.D'+<+@+@+HD(*;*?*?*FD'.?.C.CI.ND+'8'<'<Xr'J$ ),,V4> /
  #44 //T  22:JJ //;BB;;  22f<5M5Q5Q.62 55=$33\  >
 6:2''D,G,G++W  ++D4O4O++P  5P+    c                 n    U R                  U R                  U5      U R                  U R                  5      $ N)_parse_token_data_get_token_datar   r!   r"   requests     r'   retrieve_subject_token"Credentials.retrieve_subject_token   s5    %%  )//..
 	
r)   c                     U R                   (       a  U R                  U R                   5      $ U R                  XR                  U R                  5      $ r+   )r   _get_file_data_get_url_datar   r   r.   s     r'   r-   Credentials._get_token_data   sF    ''&&t'C'CDD%%44d6U6U r)   c                    [         R                  R                  U5      (       d%  [        R                  " SR                  U5      5      e[        R                  " USSS9 nUR                  5       U4sS S S 5        $ ! , (       d  f       g = f)NzFile '{}' was not found.rutf-8)encoding)	ospathexistsr   RefreshErrorr   ioopenread)r"   filenamefile_objs      r'   r3   Credentials._get_file_data   s^    ww~~h''))*D*K*KH*UVVWWXsW5==?H, 655s    A<<
B
c                     U" USUS9n[        UR                  S5      (       a  UR                  R                  S5      OUR                  nUR                  S:w  a  [        R
                  " SU5      eXR4$ )NGET)r   methodr   decoder8      z.Unable to retrieve Identity Pool subject token)hasattrdatarG   statusr   r=   )r"   r/   r   r   responseresponse_bodys         r'   r4   Credentials._get_url_data   st    s5'B
 x}}h// MM  ) 	 ??c!))@-  !!r)   c                    Uu  pEUS:X  a  UnO [         R                  " U5      nXs   nU(       d  [        R
                  " S5      eU$ ! [        [        4 a&    [        R
                  " SR                  XS5      5      ef = f)Nr   z@Unable to parse subject_token from JSON file '{}' using key '{}'z3Missing subject_token in the credential_source file)r   loadsKeyError
ValueErrorr   r=   r   )r"   token_contentformat_typer   contentrA   tokenresponse_datas           r'   r,   Credentials._parse_token_data   s     *& E
 $

7 3%? ))E   j)  --V]]  s   A 6A>c                    > [         [        U ]  5       n[        U R                  [
        5      (       a,  U R                  R                  S5      (       a  SUS'   U$ SUS'   U$ )Nr   sourcer   )r   r   _create_default_metrics_optionsr   _credential_sourcer   r   )r"   metrics_optionsr&   s     r'   r[   +Credentials._create_default_metrics_options   sb    TRT d--w77&&**622,2)  -2)r)   c                 .   > [         [        U ]
  " U40 UD6$ )a  Creates an Identity Pool Credentials instance from parsed external account info.

Args:
    info (Mapping[str, str]): The Identity Pool external account info in Google
        format.
    kwargs: Additional arguments to pass to the constructor.

Returns:
    google.auth.identity_pool.Credentials: The constructed
        credentials.

Raises:
    ValueError: For invalid parameters.
)r   r   	from_info)clsinfor$   r&   s      r'   r`   Credentials.from_info   s      [#0@@@r)   c                 .   > [         [        U ]
  " U40 UD6$ )a<  Creates an IdentityPool Credentials instance from an external account json file.

Args:
    filename (str): The path to the IdentityPool external account json file.
    kwargs: Additional arguments to pass to the constructor.

Returns:
    google.auth.identity_pool.Credentials: The constructed
        credentials.
)r   r   	from_file)ra   rA   r$   r&   s      r'   re   Credentials.from_file   s     [#0DVDDr)   )r!   r   r   r   r   )r   N)__name__
__module____qualname____firstlineno____doc__r   r   copy_docstringr   r   r0   r-   r3   r4   r,   r[   classmethodr`   re   __static_attributes____classcell__)r&   s   @r'   r   r   2   s    CdL -99:
 ;
-"$ KO0
 A A" E Er)   r   )rk   collections.abcr   ImportErrorcollectionsr>   r   r:   google.authr   r   r   r    r)   r'   <module>ru      sQ   *$' 
  	   " (SE".. SE  $#$s   > AA