Ë
    q^ëih%  ã                   óR  — d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl	m
Z
mZ ddlmZ ddlmZ ddlmZ ddlmZ  ed	«      Zd
Z G d„ de«      Z G d„ de«      Zd„ Zd„ Zd„ Zd„ Zd d„Zd„ Zd!d„Z G d„ d«      Z dde dfd„Z!dde ddfd„Z" G d„ d«      Z# G d„ de#«      Z$y)"a_  
Functions for creating and restoring url-safe signed JSON objects.

The format used looks like this:

>>> signing.dumps("hello")
'ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk'

There are two components here, separated by a ':'. The first component is a
URLsafe base64 encoded JSON of the object passed to dumps(). The second
component is a base64 encoded hmac/SHA-256 hash of "$first_component:$secret"

signing.loads(s) checks the signature and returns the deserialized object.
If the signature fails, a BadSignature exception is raised.

>>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk")
'hello'
>>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified")
...
BadSignature: Signature "ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified" does not match

You can optionally compress the JSON prior to base64 encoding it to save
space, using the compress=True argument. This checks if compression actually
helps and only applies compression if the result is a shorter string:

>>> signing.dumps(list(range(1, 20)), compress=True)
'.eJwFwcERACAIwLCF-rCiILN47r-GyZVJsNgkxaFxoDgxcOHGxMKD_T7vhAml:1QaUaL:BA0thEZrp4FQVXIXuOvYJtLJSrQ'

The fact that the string is compressed is signalled by the prefixed '.' at the
start of the base64 JSON.

There are 65 url-safe characters: the 64 used by url-safe base64 and the ':'.
These functions make use of all of them.
é    N)Úsettings)Úconstant_time_compareÚsalted_hmac)ÚRemovedInDjango51Warning©Úforce_bytes)Úimport_string)Ú_lazy_re_compilez^[A-z0-9-_=]*$Ú>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzc                   ó   — e Zd ZdZy)ÚBadSignaturezSignature does not match.N©Ú__name__Ú
__module__Ú__qualname__Ú__doc__© ó    úD/var/www/eb/venv/lib/python3.12/site-packages/django/core/signing.pyr   r   6   s   „ Ù#àr   r   c                   ó   — e Zd ZdZy)ÚSignatureExpiredz3Signature timestamp is older than required max_age.Nr   r   r   r   r   r   <   s   „ Ù=àr   r   c                 ó�   — | dk(  ry| dk  rdnd}t        | «      } d}| dkD  r!t        | d«      \  } }t        |   |z   }| dkD  rŒ!||z   S )Nr   Ú0ú-Ú é>   )ÚabsÚdivmodÚBASE62_ALPHABET)ÚsÚsignÚencodedÚ	remainders       r   Ú
b62_encoder$   B   sa   € ØˆA‚vØØ�a’%‰3˜R€DÜˆA‹€AØ€GØ
ˆaŠ%Ü˜a “}‰ˆˆ9Ü! )Ñ,¨wÑ6ˆð ˆa‹%ð �'‰>Ðr   c                 ó‚   — | dk(  ryd}| d   dk(  r| dd  } d}d}| D ]  }|dz  t         j                  |«      z   }Œ ||z  S )Nr   r   é   r   éÿÿÿÿr   )r   Úindex)r    r!   ÚdecodedÚdigits       r   Ú
b62_decoder+   N   sc   € ØˆC‚xØØ€DØˆ�tˆs‚{ØˆaˆbˆEˆØˆØ€GØò >ˆØ˜B‘,¤×!6Ñ!6°uÓ!=Ñ=‰ð>à�'‰>Ðr   c                 óJ   — t        j                  | «      j                  d«      S )Nó   =)Úbase64Úurlsafe_b64encodeÚstrip)r    s    r   Ú
b64_encoder1   [   s   € Ü×#Ñ# AÓ&×,Ñ,¨TÓ2Ð2r   c                 óV   — dt        | «       dz  z  }t        j                  | |z   «      S )Nr-   é   )Úlenr.   Úurlsafe_b64decode)r    Úpads     r   Ú
b64_decoder7   _   s+   € Ø
”3�q“6�'˜A‘+Ñ
€CÜ×#Ñ# A¨¡GÓ,Ð,r   c                 ój   — t        t        | |||¬«      j                  «       «      j                  «       S )N©Ú	algorithm)r1   r   ÚdigestÚdecode)ÚsaltÚvalueÚkeyr:   s       r   Úbase64_hmacr@   d   s-   € ÜÜ�D˜% °	Ô:×AÑAÓCóç�fƒhðr   c                 ó   — dt        | «      z   S )Ns   django.http.cookiesr   )r?   s    r   Ú_cookie_signer_keyrB   j   s   € à!¤K°Ó$4Ñ4Ð4r   c                 ó°   — t        t        j                  «      } |t        t        j                  «      t        t        t        j                  «      | ¬«      S )N)r?   Úfallback_keysr=   )r	   r   ÚSIGNING_BACKENDrB   Ú
SECRET_KEYÚmapÚSECRET_KEY_FALLBACKS)r=   ÚSigners     r   Úget_cookie_signerrJ   o   sA   € Üœ8×3Ñ3Ó4€FÙÜœx×2Ñ2Ó3ÜÔ,¬h×.KÑ.KÓLØôð r   c                   ó   — e Zd ZdZd„ Zd„ Zy)ÚJSONSerializerzW
    Simple wrapper around json to be used in signing.dumps and
    signing.loads.
    c                 óN   — t        j                  |d¬«      j                  d«      S )N)ú,ú:)Ú
separatorsúlatin-1)ÚjsonÚdumpsÚencode)ÚselfÚobjs     r   rS   zJSONSerializer.dumps~   s   € Ü�z‰z˜#¨*Ô5×<Ñ<¸YÓGÐGr   c                 óJ   — t        j                  |j                  d«      «      S )NrQ   )rR   Úloadsr<   )rU   Údatas     r   rX   zJSONSerializer.loads�   s   € Ü�z‰z˜$Ÿ+™+ iÓ0Ó1Ð1r   N)r   r   r   r   rS   rX   r   r   r   rL   rL   x   s   „ ñò
Hó2r   rL   zdjango.core.signingFc                 ó@   — t        ||¬«      j                  | ||¬«      S )a½  
    Return URL-safe, hmac signed base64 compressed JSON string. If key is
    None, use settings.SECRET_KEY instead. The hmac algorithm is the default
    Signer algorithm.

    If compress is True (not the default), check if compressing using zlib can
    save some space. Prepend a '.' to signify compression. This is included
    in the signature, to protect against zip bombs.

    Salt can be used to namespace the hash, so that a signed string is
    only valid for a given namespace. Leaving this at the default
    value or re-using a salt value across different parts of your
    application without good cause is a security risk.

    The serializer is expected to return a bytestring.
    )r?   r=   )Ú
serializerÚcompress)ÚTimestampSignerÚsign_object)rV   r?   r=   r[   r\   s        r   rS   rS   …   s*   € ô& ˜s¨Ô.×:Ñ:Ø˜
¨Xð ;ó ð r   c                 óB   — t        |||¬«      j                  | ||¬«      S )z|
    Reverse of dumps(), raise BadSignature if signature fails.

    The serializer is expected to accept a bytestring.
    )r?   r=   rD   )r[   Úmax_age)r]   Úunsign_object)r    r?   r=   r[   r`   rD   s         r   rX   rX   �   s0   € ô Ø�d¨-ôç�mØ	ØØð ó ðr   c                   óJ   — e Zd Zddddddœd„Zdd„Zd„ Zd„ Zedfd	„Zefd
„Z	y)rI   NrO   ©r?   Úsepr=   r:   rD   c                ó  — |xs t         j                  | _        |�|nt         j                  | _        || _        |xs/ | j                  j                  ›d| j                  j                  ›�| _	        |xs d| _
        |r_t        j                  d| j                  j                  › d�t        d¬«       t        |g d¢«      D ]  \  }}|s|dk(  sŒt        | ||«       Œ t         j#                  | j
                  «      rt%        d	|z  «      ‚y )
Nú.Úsha256z Passing positional arguments to z is deprecated.é   )Ú
stacklevelrc   rd   zJUnsafe Signer separator: %r (cannot be empty or consist of only A-z0-9-_=))r   rF   r?   rH   rD   rd   Ú	__class__r   r   r=   r:   ÚwarningsÚwarnr   ÚzipÚsetattrÚ_SEP_UNSAFEÚmatchÚ
ValueError)	rU   r?   rd   r=   r:   rD   ÚargsÚargÚattrs	            r   Ú__init__zSigner.__init__¸   s  € ð Ò-œ(×-Ñ-ˆŒð Ð(ñ ä×.Ñ.ð 	Ôð
 ˆŒØò 
Ø�N‰N×%Ó%Ø�N‰N×#Ò#ð
ˆŒ	ð #Ò. hˆŒáÜ�M‰MØ2°4·>±>×3JÑ3JÐ2Kð Lð ä(Øõ	ô !ØÒJóò -‘	��Tñ ˜$ %›-Ü˜D $¨Õ,ð	-ô
 ×Ñ˜TŸX™XÔ&Üð"Ø$'ñ(óð ð 'r   c                 ón   — |xs | j                   }t        | j                  dz   ||| j                  ¬«      S )NÚsignerr9   )r?   r@   r=   r:   )rU   r>   r?   s      r   Ú	signaturezSigner.signatureà   s-   € ØŠo�T—X‘XˆÜ˜4Ÿ9™9 xÑ/°¸ÀtÇ~Á~ÔVÐVr   c                 óD   — |›| j                   ›| j                  |«      ›�S ©N)rd   rx   )rU   r>   s     r   r!   zSigner.signä   s   € Ù  $§(¢(¨D¯N©N¸5Ô,AÐBÐBr   c                 ó$  — | j                   |vrt        d| j                   z  «      ‚|j                  | j                   d«      \  }}| j                  g| j                  ¢D ]"  }t        || j                  ||«      «      sŒ |c S  t        d|z  «      ‚)NzNo "%s" found in valuer&   zSignature "%s" does not match)rd   r   Úrsplitr?   rD   r   rx   )rU   Úsigned_valuer>   Úsigr?   s        r   ÚunsignzSigner.unsignç   s‹   € Ø�8‰8˜<Ñ'ÜÐ7¸$¿(¹(ÑBÓCÐCØ!×(Ñ(¨¯©°1Ó5‰
ˆˆsØ—H‘HÐ2˜t×1Ñ1Ð2ò 	ˆCÜ$ S¨$¯.©.¸ÀÓ*DÕEØ’ð	ô Ð:¸SÑ@ÓAÐAr   Fc                 óþ   —  |«       j                  |«      }d}|r3t        j                  |«      }t        |«      t        |«      dz
  k  r|}d}t	        |«      j                  «       }|rd|z   }| j                  |«      S )ae  
        Return URL-safe, hmac signed base64 compressed JSON string.

        If compress is True (not the default), check if compressing using zlib
        can save some space. Prepend a '.' to signify compression. This is
        included in the signature, to protect against zip bombs.

        The serializer is expected to return a bytestring.
        Fr&   Trf   )rS   Úzlibr\   r4   r1   r<   r!   )rU   rV   r[   r\   rY   Úis_compressedÚ
compressedÚbase64ds           r   r^   zSigner.sign_objectð   sx   € ñ ‹|×!Ñ! #Ó&ˆàˆáäŸ™ tÓ,ˆJÜ�:‹¤# d£)¨a¡-Ò0Ø!�Ø $�Ü˜TÓ"×)Ñ)Ó+ˆÙØ˜G‘mˆGØ�y‰y˜Ó!Ð!r   c                 óÒ   —  | j                   |fi |¤Žj                  «       }|d d dk(  }|r|dd  }t        |«      }|rt        j                  |«      } |«       j                  |«      S )Nr&   ó   .)r   rT   r7   r�   Ú
decompressrX   )rU   Ú
signed_objr[   Úkwargsr„   r‡   rY   s          r   ra   zSigner.unsign_object	  sn   € ð �$—+‘+˜jÑ3¨FÑ3×:Ñ:Ó<ˆØ˜R˜a�[ DÑ(ˆ
Ùà˜a˜b�kˆGÜ˜'Ó"ˆÙÜ—?‘? 4Ó(ˆDÙ‹|×!Ñ! $Ó'Ð'r   rz   )
r   r   r   ru   rx   r!   r   rL   r^   ra   r   r   r   rI   rI   ³   sB   „ ð ØØØØô&óPWòCòBð +9À5ó "ð2 4Bô (r   rI   c                   ó0   ‡ — e Zd Zd„ Zˆ fd„Zdˆ fd„	Zˆ xZS )r]   c                 óN   — t        t        t        j                  «       «      «      S rz   )r$   ÚintÚtime)rU   s    r   Ú	timestampzTimestampSigner.timestamp  s   € Üœ#œdŸi™i›kÓ*Ó+Ð+r   c                 ób   •— |›| j                   ›| j                  «       ›�}t        ‰| �  |«      S rz   )rd   rŽ   Úsuperr!   )rU   r>   rj   s     €r   r!   zTimestampSigner.sign  s)   ø€ Ù! 4§8¢8¨T¯^©^Ô-=Ð>ˆÜ‰w‰|˜EÓ"Ð"r   c                 ó.  •— t         ‰| �  |«      }|j                  | j                  d«      \  }}t	        |«      }|�Xt        |t        j                  «      r|j                  «       }t        j                  «       |z
  }||kD  rt        d|›d|›d�«      ‚|S )zk
        Retrieve original value and check it wasn't signed more
        than max_age seconds ago.
        r&   zSignature age z > z seconds)r�   r   r|   rd   r+   Ú
isinstanceÚdatetimeÚ	timedeltaÚtotal_secondsr�   r   )rU   r>   r`   ÚresultrŽ   Úagerj   s         €r   r   zTimestampSigner.unsign  s†   ø€ ô
 ‘‘ Ó&ˆØ!Ÿ=™=¨¯©°1Ó5ÑˆˆyÜ˜yÓ)ˆ	ØÐÜ˜'¤8×#5Ñ#5Ô6Ø!×/Ñ/Ó1�ä—)‘)“+ 	Ñ)ˆCØ�WŠ}Ý&Ê#ÊwÐ'WÓXÐXØˆr   rz   )r   r   r   rŽ   r!   r   Ú__classcell__)rj   s   @r   r]   r]     s   ø„ ò,ô#÷ñ r   r]   )Úsha1)z%django.core.signing.get_cookie_signer)%r   r.   r“   rR   r�   rk   r�   Údjango.confr   Údjango.utils.cryptor   r   Údjango.utils.deprecationr   Údjango.utils.encodingr   Údjango.utils.module_loadingr	   Údjango.utils.regex_helperr
   ro   r   Ú	Exceptionr   r   r$   r+   r1   r7   r@   rB   rJ   rL   rS   rX   rI   r]   r   r   r   ú<module>r¡      sÇ   ðñ!óF Û Û Û Û Û å  ß BÝ =Ý -Ý 5Ý 6áÐ0Ó1€ØR€ô	�9ô 	ô	�|ô 	ò	ò
ò3ò-ó
ò5ó
÷
2ñ 
2ð Ð-¸.ÐSXóð4 	Ø	ØØØó÷,a(ñ a(ôH�fõ r   