
    	iD"                     d   d Z ddlZddlZddlZddlZddlZddlmZ ddlm	Z	m
Z
 ddlmZ ddlmZ ddlmZ  ed          Zd	Z G d
 de          Z G d de          Zd Zd Zd Zd Zd!dZd Zd"dZ G d d          ZddedfdZddeddfdZ G d d          Z  G d d e           Z!dS )#a_  
Functions for creating and restoring url-safe signed JSON objects.

The format used looks like this:

>>> signing.dumps("hello")
'ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk'

There are two components here, separated by a ':'. The first component is a
URLsafe base64 encoded JSON of the object passed to dumps(). The second
component is a base64 encoded hmac/SHA-256 hash of "$first_component:$secret"

signing.loads(s) checks the signature and returns the deserialized object.
If the signature fails, a BadSignature exception is raised.

>>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk")
'hello'
>>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified")
...
BadSignature: Signature "ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified" does not match

You can optionally compress the JSON prior to base64 encoding it to save
space, using the compress=True argument. This checks if compression actually
helps and only applies compression if the result is a shorter string:

>>> signing.dumps(list(range(1, 20)), compress=True)
'.eJwFwcERACAIwLCF-rCiILN47r-GyZVJsNgkxaFxoDgxcOHGxMKD_T7vhAml:1QaUaL:BA0thEZrp4FQVXIXuOvYJtLJSrQ'

The fact that the string is compressed is signalled by the prefixed '.' at the
start of the base64 JSON.

There are 65 url-safe characters: the 64 used by url-safe base64 and the ':'.
These functions make use of all of them.
    N)settings)constant_time_comparesalted_hmacforce_bytes)import_string)_lazy_re_compilez^[A-z0-9-_=]*$>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzc                       e Zd ZdZdS )BadSignaturezSignature does not match.N__name__
__module____qualname____doc__     K/srv/django_bis/venv311/lib/python3.11/site-packages/django/core/signing.pyr   r   4   s        ##Dr   r   c                       e Zd ZdZdS )SignatureExpiredz3Signature timestamp is older than required max_age.Nr   r   r   r   r   r   :   s        ==Dr   r   c                     | dk    rdS | dk     rdnd}t          |           } d}| dk    r)t          | d          \  } }t          |         |z   }| dk    )||z   S )Nr   0- >   )absdivmodBASE62_ALPHABET)ssignencoded	remainders       r   
b62_encoder#   @   sq    Avvsa%%33RDAAG
a%%a}}9!),w6 a%% '>r   c                     | dk    rdS d}| d         dk    r| dd          } d}d}| D ]"}|dz  t                               |          z   }#||z  S )Nr   r      r   r   )r   index)r   r    decodeddigits       r   
b62_decoder*   L   sp    CxxqDts{{abbEG > >B,!6!6u!=!=='>r   c                 P    t          j        |                               d          S )N   =)base64urlsafe_b64encodestrip)r   s    r   
b64_encoder0   Y   s!    #A&&,,T222r   c                 \    dt          |            dz  z  }t          j        | |z             S )Nr,      )lenr-   urlsafe_b64decode)r   pads     r   
b64_decoder6   ]   s-    
3q66'A+
C#AG,,,r   sha1c                     t          t          | |||                                                                                    S )N	algorithm)r0   r   digestdecode)saltvaluekeyr:   s       r   base64_hmacr@   b   s=    D%	:::AACC fhhr   c                 &    dt          |           z   S )Ns   django.http.cookiesr   )r?   s    r   _cookie_signer_keyrB   h   s    !K$4$444r   %django.core.signing.get_cookie_signerc                     t          t          j                  } |t          t          j                  t          t          t          j                  |           S )N)r?   fallback_keysr=   )r   r   SIGNING_BACKENDrB   
SECRET_KEYmapSECRET_KEY_FALLBACKS)r=   Signers     r   get_cookie_signerrK   m   sM    8344F6x233,h.KLL   r   c                       e Zd ZdZd Zd ZdS )JSONSerializerzW
    Simple wrapper around json to be used in signing.dumps and
    signing.loads.
    c                 T    t          j        |d                              d          S )N),:)
separatorslatin-1)jsondumpsencode)selfobjs     r   rT   zJSONSerializer.dumps|   s%    z#*555<<YGGGr   c                 P    t          j        |                    d                    S )NrR   )rS   loadsr<   )rV   datas     r   rY   zJSONSerializer.loads   s    z$++i00111r   N)r   r   r   r   rT   rY   r   r   r   rM   rM   v   s?         
H H H2 2 2 2 2r   rM   zdjango.core.signingFc                 P    t          ||                              | ||          S )a  
    Return URL-safe, hmac signed base64 compressed JSON string. If key is
    None, use settings.SECRET_KEY instead. The hmac algorithm is the default
    Signer algorithm.

    If compress is True (not the default), check if compressing using zlib can
    save some space. Prepend a '.' to signify compression. This is included
    in the signature, to protect against zip bombs.

    Salt can be used to namespace the hash, so that a signed string is
    only valid for a given namespace. Leaving this at the default
    value or re-using a salt value across different parts of your
    application without good cause is a security risk.

    The serializer is expected to return a bytestring.
    )r?   r=   )
serializercompress)TimestampSignersign_object)rW   r?   r=   r\   r]   s        r   rT   rT      s5    & s...::
X ;   r   c                 R    t          |||                              | ||          S )z|
    Reverse of dumps(), raise BadSignature if signature fails.

    The serializer is expected to accept a bytestring.
    )r?   r=   rE   )r\   max_age)r^   unsign_object)r   r?   r=   r\   ra   rE   s         r   rY   rY      s?     d-  m	   r   c                   L    e Zd ZdddddddZddZd Zd Zedfd	Zefd
Z	dS )rJ   NrP   )r?   sepr=   r:   rE   c                   |pt           j        | _        ||nt           j        | _        || _        |p| j        j        d| j        j        | _	        |pd| _
        t                              | j                  rt          d|z            d S )N.sha256zJUnsafe Signer separator: %r (cannot be empty or consist of only A-z0-9-_=))r   rG   r?   rI   rE   rd   	__class__r   r   r=   r:   _SEP_UNSAFEmatch
ValueError)rV   r?   rd   r=   r:   rE   s         r   __init__zSigner.__init__   s     -(- ( M. 	
  
N%%%N##
	 #.hTX&& 	"$'(  	 	r   c                 T    |p| j         }t          | j        dz   ||| j                  S )Nsignerr9   )r?   r@   r=   r:   )rV   r>   r?   s      r   	signaturezSigner.signature   s-    oTX49x/t~VVVVr   c                 B    || j         |                     |          S N)rd   ro   )rV   r>   s     r   r    zSigner.sign   s$     5$((DNN5,A,A,ABBr   c                    | j         |vrt          d| j         z            |                    | j         d          \  }}| j        g| j        D ]*}t          ||                     ||                    r|c S +t          d|z            )NzNo "%s" found in valuer%   zSignature "%s" does not match)rd   r   rsplitr?   rE   r   ro   )rV   signed_valuer>   sigr?   s        r   unsignzSigner.unsign   s    8<''7$(BCCC!((155
sH2t12 	 	C$S$..*D*DEE :S@AAAr   Fc                 4    |                                 |          }d}|r;t          j        |          }t          |          t          |          dz
  k     r|}d}t	          |                                          }|rd|z   }|                     |          S )ae  
        Return URL-safe, hmac signed base64 compressed JSON string.

        If compress is True (not the default), check if compressing using zlib
        can save some space. Prepend a '.' to signify compression. This is
        included in the signature, to protect against zip bombs.

        The serializer is expected to return a bytestring.
        Fr%   Trf   )rT   zlibr]   r3   r0   r<   r    )rV   rW   r\   r]   rZ   is_compressed
compressedbase64ds           r   r_   zSigner.sign_object   s     z||!!#&& 	%t,,J:#d))a-00! $T""))++ 	$GmGyy!!!r   c                      | j         |fi |                                }|d d         dk    }|r
|dd          }t          |          }|rt          j        |          } |                                |          S )Nr%      .)rv   rU   r6   rx   
decompressrY   )rV   
signed_objr\   kwargsr{   r~   rZ   s          r   rb   zSigner.unsign_object   s     $+j33F33::<<RaR[D(
 	"abbkG'"" 	)?4((Dz||!!$'''r   rq   )
r   r   r   rl   ro   r    rv   rM   r_   rb   r   r   r   rJ   rJ      s        sT    *W W W WC C CB B B +95 " " " "2 4B ( ( ( ( ( (r   rJ   c                   0     e Zd Zd Z fdZd fd	Z xZS )r^   c                 \    t          t          t          j                                        S rq   )r#   inttime)rV   s    r   	timestampzTimestampSigner.timestamp   s    #dikk**+++r   c                     || j         |                                 }t                                          |          S rq   )rd   r   superr    )rV   r>   rh   s     r   r    zTimestampSigner.sign  s8    !E488T^^-=-=-=>ww||E"""r   Nc                 h   t                                          |          }|                    | j        d          \  }}t	          |          }|`t          |t          j                  r|                                }t          j	                    |z
  }||k    rt          d|d|d          |S )zk
        Retrieve original value and check it wasn't signed more
        than max_age seconds ago.
        r%   NzSignature age z > z seconds)r   rv   rs   rd   r*   
isinstancedatetime	timedeltatotal_secondsr   r   )rV   r>   ra   resultr   agerh   s         r   rv   zTimestampSigner.unsign  s    
 &&!==155yy))	'8#566 2!//11)++	)CW}}&&###www'WXXXr   rq   )r   r   r   r   r    rv   __classcell__)rh   s   @r   r^   r^      se        , , ,# # # # #         r   r^   )r7   )rC   )"r   r-   r   rS   r   rx   django.confr   django.utils.cryptor   r   django.utils.encodingr   django.utils.module_loadingr   django.utils.regex_helperr	   ri   r   	Exceptionr   r   r#   r*   r0   r6   r@   rB   rK   rM   rT   rY   rJ   r^   r   r   r   <module>r      sO  ! !F                  B B B B B B B B - - - - - - 5 5 5 5 5 5 6 6 6 6 6 6011R	 	 	 	 	9 	 	 		 	 	 	 	| 	 	 		 	 	
 
 
3 3 3- - -
   5 5 5
   
2 
2 
2 
2 
2 
2 
2 
2 -.SX   4 		   ,J( J( J( J( J( J( J( J(Z    f     r   