5i\{,dZddlZddlmZddlZddlmZmZddlm Z m Z ddl m Z ddl Z ddlmZddlmZmZmZGd d eZGd d eZGd deZGddeZGddeZGddZGddeZGddeZdZy)zM AWS client-side authentication: standard credentials providers and signing. N)NativeResource) HttpRequestHttpProxyOptions)ClientBootstrapClientTlsContext)Future)IntEnum)OptionalSequenceTupleceZdZdZdZdZd fd ZefdZe dZ e dZ e dZ e d Z d ZxZS) AwsCredentialsa& AwsCredentials are the public/private data needed to sign an authenticated AWS request. AwsCredentials are immutable. Args: access_key_id (str): Access key ID secret_access_key (str): Secret access key session_token (Optional[str]): Optional security token associated with the credentials. expiration (Optional[datetime.datetime]): Optional expiration datetime, that the credentials will no longer be valid past. Converted to UTC timezone and rounded down to nearest second. If not set, then credentials do not expire. Attributes: access_key_id (str): Access key ID secret_access_key (str): Secret access key session_token (Optional[str]): Security token associated with the credentials. None if not set. expiration (Optional[datetime.datetime]): Expiration datetime, that the credentials will no longer be valid past. None if credentials do not expire. Timezone is always UTC. lcZt|tsJt|tsJt|ts|J| |j}n8t|j }|dks||jk\r t dt |tj|||||_ y)Nrz expiration datetime out of range) isinstancestr_NONEXPIRING_TIMESTAMPint timestamp OverflowErrorsuper__init___awscrtcredentials_new_binding)self access_key_idsecret_access_key session_token expirationexpiration_timestamp __class__s m/home/marpiech/ifpan-abm-pgxpred/analysis/marpiech-gwas-test/venv/lib/python3.12/site-packages/awscrt/auth.pyrzAwsCredentials.__init__2s----+S111--1FFF  #'#>#> #&z';';'=#> #a'+?4C^C^+^#$FGG //    " cT|j|}t|| ||_|S)z+Construct from a pre-existing native object)__new__rrr)clsbinding credentialsr"s r# _from_bindingzAwsCredentials._from_bindingFs.kk#&  c;(*& r$c@tj|jSN)rcredentials_access_key_idrrs r#rzAwsCredentials.access_key_idN00??r$c@tj|jSr,)rcredentials_secret_access_keyrr.s r#rz AwsCredentials.secret_access_keyRs44T]]CCr$c@tj|jSr,)rcredentials_session_tokenrr.s r#rzAwsCredentials.session_tokenVr/r$ctj|j}||jk(rytjj |tj jS)N)tz)r(credentials_expiration_timestamp_secondsrrdatetime fromtimestamptimezoneutc)rrs r#r zAwsCredentials.expirationZsODDT]]S 33 3$$229ARARAVAV2W Wr$c|Sr,r)rmemos r# __deepcopy__zAwsCredentials.__deepcopy__cs r$)NN)__name__ __module__ __qualname____doc__ __slots__rr classmethodr*propertyrrrr r= __classcell__r"s@r#rrs2I0"(@@DD@@XXr$rc eZdZy)AwsCredentialsProviderBaseN)r>r?r@rr$r#rHrHhs r$rHceZdZdZdZfdZeddZeddZe ddZ eddZ ed Z ed Z ed Z eddddd d ededej j"deeeeefdeedeedeefdZedddd edededej j"deedeef dZdZxZS)AwsCredentialsProvidera Credentials providers source the AwsCredentials needed to sign an authenticated AWS request. This class provides `new_X()` functions for several built-in provider types. To define a custom provider, use the :meth:`new_delegate()` function. rc0t|||_yr,)rrr)rr(r"s r#rzAwsCredentialsProvider.__init__|s  r$Nct|ts|J|tj}tj|}||S)a Create the default provider chain used by most AWS SDKs. Generally: 1. Environment 2. Profile 3. (conditional, off by default) ECS 4. (conditional, on by default) EC2 Instance Metadata Args: client_bootstrap (Optional[ClientBootstrap]): Client bootstrap to use when initiating socket connection. If not set, uses the default static ClientBootstrap instead. Returns: AwsCredentialsProvider: )rrget_or_create_static_defaultr&credentials_provider_new_chain_default)r'client_bootstrapr(s r#new_default_chainz(AwsCredentialsProvider.new_default_chainsK&*O<@P@XXX  #.KKM @@AQR7|r$ct|tsJt|tsJt|ts|Jtj|||}||S)aE Create a simple provider that just returns a fixed set of credentials. Args: access_key_id (str): Access key ID secret_access_key (str): Secret access key session_token (Optional[str]): Optional session token Returns: AwsCredentialsProvider: )rrrcredentials_provider_new_static)r'rrrr(s r# new_staticz!AwsCredentialsProvider.new_staticsZ----+S111--1FFF99-IZ\ij7|r$ct|ts|Jt|ts|Jt|ts|Jt|ts|J|tj}t j ||||}||S)a0 Creates a provider that sources credentials from key-value profiles loaded from the aws credentials file. Args: client_bootstrap (Optional[ClientBootstrap]): Client bootstrap to use when initiating socket connection. If not set, uses the static default ClientBootstrap instead. profile_name (Optional[str]): Name of profile to use. If not set, uses value from AWS_PROFILE environment variable. If that is not set, uses value of "default" config_filepath (Optional[str]): Path to profile config file. If not set, uses value from AWS_CONFIG_FILE environment variable. If that is not set, uses value of "~/.aws/config" credentials_filepath (Optional[str]): Path to profile credentials file. If not set, uses value from AWS_SHARED_CREDENTIALS_FILE environment variable. If that is not set, uses value of "~/.aws/credentials" Returns: AwsCredentialsProvider: )rrrrMr credentials_provider_new_profile)r'rO profile_nameconfig_filepathcredentials_filepathr(s r# new_profilez"AwsCredentialsProvider.new_profiles<*O<@P@XXX,, 0DDD/3/?3JJJ.48L8TTT  #.KKM :: lO=QS7|r$c<tj|}||S)a Creates a provider that sources credentials from running an external command or process. The command to run is sourced from a profile in the AWS config file, using the standard profile selection rules. The profile key the command is read from is "credential_process." Example:: [default] credential_process=/opt/amazon/bin/my-credential-fetcher --argsA=abc On successfully running the command, the output should be a json data with the following format:: { "Version": 1, "AccessKeyId": "accesskey", "SecretAccessKey": "secretAccessKey" "SessionToken": "....", "Expiration": "2019-05-29T00:21:43Z" } Version here identifies the command output format version. This provider is not part of the default provider chain. Args: profile_to_use (Optional[str]): Name of profile in which to look for credential_process. If not set, uses value from AWS_PROFILE environment variable. If that is not set, uses value of "default" Returns: AwsCredentialsProvider: )r credentials_provider_new_process)r'profile_to_user(s r# new_processz"AwsCredentialsProvider.new_processsF::>J7|r$c:tj}||S)z Creates a provider that returns credentials sourced from environment variables. * AWS_ACCESS_KEY_ID * AWS_SECRET_ACCESS_KEY * AWS_SESSION_TOKEN Returns: AwsCredentialsProvider: )r$credentials_provider_new_environment)r'r(s r#new_environmentz&AwsCredentialsProvider.new_environments>>@7|r$c<tj|}||S)a Creates a provider that sources credentials from an ordered sequence of providers. This provider uses the first set of credentials successfully queried. Providers are queried one at a time; a provider is not queried until the preceding provider has failed to source credentials. Args: providers (List[AwsCredentialsProvider]): List of credentials providers. Returns: AwsCredentialsProvider: )rcredentials_provider_new_chain)r' providersr(s r# new_chainz AwsCredentialsProvider.new_chains 88C7|r$cVt|sJtj|}||S)a" Creates a provider that sources credentials from a custom synchronous callback. Args: get_credentials: Callable which takes no arguments and returns :class:`AwsCredentials`. Returns: AwsCredentialsProvider: )callabler!credentials_provider_new_delegate)r'get_credentialsr(s r# new_delegatez#AwsCredentialsProvider.new_delegate"s,(((;;OL7|r$)loginscustom_role_arnrOhttp_proxy_optionsendpointidentitytls_ctxrjrkrOrlc Tt|tsJt|tsJt|tsJt|ts|Jt|ts|J|t j }t|tsJt j|||||||}||S)a Creates a provider that sources credentials from the AWS Cognito Identity service. Args: endpoint (str): Cognito Identity service regional endpoint to source credentials from. identity (str): Cognito identity to fetch credentials relative to. tls_ctx (ClientTlsContext): Client TLS context to use when querying cognito credentials by HTTP. logins (Optional[Sequence[tuple[str, str]]]): Sequence of tuples specifying pairs of identity provider name and token values, representing established login contexts for identity authentication purposes. custom_role_arn (Optional[str]): ARN of the role to be assumed when multiple roles were received in the token from the identity provider. client_bootstrap (Optional[ClientBootstrap]): Client bootstrap to use when initiating a socket connection. If not set, uses the static default ClientBootstrap instead. http_proxy_options (Optional[HttpProxyOptions]): Optional HTTP proxy options. If None is provided then an HTTP proxy is not used. Returns: AwsCredentialsProvider: )rrrrrrMr credentials_provider_new_cognito) r'rmrnrorjrkrOrlr(s r# new_cognitoz"AwsCredentialsProvider.new_cognito6sJ(C((((C((('#3444/3/?3JJJ,.>?CUC]]]  #.KKM *O<<<::        7|r$)rOrl thing_name role_aliascNt|tsJt|tsJt|tsJt|tsJt|ts|J|t j }t|tsJt j||||||}||S)a[ Creates a provider that sources credentials from IoT's X509 credentials service. Args: endpoint (str): X509 service regional endpoint to source credentials from. This is a per-account value that can be determined via the CLI: `aws iot describe-endpoint --endpoint-type iot:CredentialProvider` thing_name (str): The name of the IoT thing to use to fetch credentials. role_alias (str): The name of the role alias to fetch credentials through. tls_ctx (ClientTlsContext): The client TLS context to use when establishing the http connection to IoT's X509 credentials service. client_bootstrap (Optional[ClientBootstrap]): Client bootstrap to use when initiating a socket connection. If not set, uses the static default ClientBootstrap instead. http_proxy_options (Optional[HttpProxyOptions]): Optional HTTP proxy options. If None is provided then an HTTP proxy is not used. Returns: AwsCredentialsProvider: )rrrrrrMrcredentials_provider_new_x509)r'rmrsrtrorOrlr(s r#new_x509zAwsCredentialsProvider.new_x509osD(C(((*c****c***'#3444,.>?CUC]]]  #.KKM *O<<<77        7|r$ctfd} tj|j|S#t$r}j |Yd}~Sd}~wwxYw)a Asynchronously fetch AwsCredentials. Returns: concurrent.futures.Future: A Future which will contain :class:`AwsCredentials` (or an exception) when the operation completes. The operation may complete on a different thread. c |r/jtjj|ytj |}j |y#t$r}j|Yd}~yd}~wwxYwr,) set_exceptionawscrt exceptions from_coderr* set_result Exception) error_coder(r)efutures r# _on_completez._on_completesi ((():):)D)DZ)PQ"0">">w"GK%%k2 ($$Q'' (s0A&A A?$A::A?N)rr$credentials_provider_get_credentialsrrrz)rrrrs @r#rhz&AwsCredentialsProvider.get_credentialssY ( $  8 8 U  $   # #  $s 4 AAAr,)NNNN)r>r?r@rArBrrCrPrSrYr]r`rdrirr{iorr r r rrrrrwrhrErFs@r#rJrJss I 4&" !% ''R##J  $&;?-1:>=A66 6 YY// 6 XeCHo67 6&c]6'76!))9 :66p;?=A11 1  1 YY// 1'71!))9 :11fr$rJc eZdZdZdZ dZ dZy)AwsSigningAlgorithmz"AWS signing algorithm enumeration.rN)r>r?r@rAV4 V4_ASYMMETRIC V4_S3EXPRESSrr$r#rrs, BM*L*r$rceZdZdZdZ dZy)AwsSignatureTypez=Which sort of signature should be computed from the signable.rrN)r>r?r@rAHTTP_REQUEST_HEADERSHTTP_REQUEST_QUERY_PARAMSrr$r#rrsG !"r$rc&eZdZdZdZ dZ dZ dZy)AwsSignedBodyValuez Values for use with :attr:`AwsSigningConfig.signed_body_value`. Some services use special values (e.g. "UNSIGNED-PAYLOAD") when the body is not being signed in the usual way. @e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855zUNSIGNED-PAYLOADz"STREAMING-AWS4-HMAC-SHA256-PAYLOADz!STREAMING-AWS4-HMAC-SHA256-EVENTSN)r>r?r@rA EMPTY_SHA256UNSIGNED_PAYLOAD"STREAMING_AWS4_HMAC_SHA256_PAYLOAD!STREAMING_AWS4_HMAC_SHA256_EVENTSrr$r#rrs-VL*)@)M&J(K%Br$rceZdZdZdZ dZy)AwsSignedBodyHeaderTypez Controls if signing adds a header containing the canonical request's signed body value. See :attr:`AwsSigningConfig.signed_body_value`. rrN)r>r?r@rANONEX_AMZ_CONTENT_SHA_256rr$r#rrs D^r$rc XeZdZdZdZdZejejdddddddde jddf fd Z d Z ed Zed Zed Zed ZedZedZedZedZedZedZedZedZedZxZS)AwsSigningConfiga Configuration for use in AWS-related signing. AwsSigningConfig is immutable. It is good practice to use a new config for each signature, or the date might get too old. Args: algorithm (AwsSigningAlgorithm): Which signing algorithm to use. signature_type (AwsSignatureType): Which sort of signature should be computed from the signable. credentials_provider (AwsCredentialsProvider): Credentials provider to fetch signing credentials with. If the algorithm is :attr:`AwsSigningAlgorithm.V4_ASYMMETRIC`, ECC-based credentials will be derived from the fetched credentials. region (str): If the algorithm is :attr:`AwsSigningAlgorithm.V4`, the region to sign against. If the algorithm is :attr:`AwsSigningAlgorithm.V4_ASYMMETRIC`, the value of the "X-amzn-region-set" header (added in signing). service (str): Name of service to sign a request for. date (Optional[datetime.datetime]): Date and time to use during the signing process. If None is provided then `datetime.datetime.now(datetime.timezone.utc)` is used. Naive dates (lacking timezone info) are assumed to be in local time. should_sign_header (Optional[Callable[[str], bool]]): Optional function to control which headers are a part of the canonical request. Skipping auth-required headers will result in an unusable signature. Headers injected by the signing process are not skippable. This function does not override the internal check function (x-amzn-trace-id, user-agent), but rather supplements it. In particular, a header will get signed if and only if it returns true to both the internal check (skips x-amzn-trace-id, user-agent) and this function (if defined). use_double_uri_encode (bool): Whether to double-encode the resource path when constructing the canonical request (assuming the path is already encoded). Default is True. All services except S3 use double encoding. should_normalize_uri_path (bool): Whether the resource paths are normalized when building the canonical request. Default is True. signed_body_value (Optional[str]): If set, this value is used as the canonical request's body value. Typically, this is the SHA-256 of the payload, written as lowercase hex. If this has been precalculated, it can be set here. Special values used by certain services can also be set (see :class:`AwsSignedBodyValue`). If `None` is passed (the default), the typical value will be calculated from the payload during signing. signed_body_header_type (AwsSignedBodyHeaderType): Controls if signing adds a header containing the canonical request's signed body value. Default is to not add a header. expiration_in_seconds (Optional[int]): If set, and signature_type is :attr:`AwsSignatureType.HTTP_REQUEST_QUERY_PARAMS`, then signing will add "X-Amz-Expires" to the query string, equal to the value specified here. omit_session_token (bool): If set True, the "X-Amz-Security-Token" query param is omitted from the canonical request. The default False should be used for most services. _priv_should_sign_cb) algorithmsignature_typecredentials_providerregionservicedateshould_sign_headeruse_double_uri_encodeshould_normalize_uri_pathsigned_body_valuesigned_body_header_typeexpiration_in_secondsomit_session_tokenNTFc~t|tsJt|tsJt|ts|Jt|tsJt|tsJt sJ| t| trt | dkDsJt| tsJ| | dkDsJt|%|7tjjtjj}|j}|_fd}nd}| d} t!j"|||||||||| | | | | |_y)Nrc|S)N)namer)rrs r#should_sign_header_wrapperz=AwsSigningConfig.__init__..should_sign_header_wrapper|s)t44r$)rrrrJrrflenrrrr7nowr9r:rrrsigning_config_newr)rrrrrrrrrrrrrrrrr"s ` r#rzAwsSigningConfig.__init__Xs` )%8999.*:;;;.0FGK_Kggg&#&&&'3'''*+/A/III (Z8I3-OTWXiTjmnTnoo13JKKK$,0E0III  <$$(():):)>)>?DNN$ $6!  ) 5*. & ($% !22       & ! %  # !   r$c tjDcic]}||j|t||!}}tdi|Scc}w)z Return an AwsSigningConfig with the same attributes, except for those attributes given new values by whichever keyword arguments are specified. r)r _attributesgetgetattr)rkwargsxargss r#replacezAwsSigningConfig.replacesI =M>t}}MMr$c@tj|jS)z str: If signing algorithm is :attr:`AwsSigningAlgorithm.V4`, the region to sign against. If the algorithm is :attr:`AwsSigningAlgorithm.V4_ASYMMETRIC`, the value of the "X-amzn-region-set header" (added in signing). )rsigning_config_get_regionrr.s r#rzAwsSigningConfig.regions00??r$c@tj|jS)z*str: Name of service to sign a request for)rsigning_config_get_servicerr.s r#rzAwsSigningConfig.services11$--@@r$c@tj|jS)a; datetime.datetime: Date and time to use during the signing process. If None is provided, then `datetime.datetime.now(datetime.timezone.utc)` at time of object construction is used. It is good practice to use a new config for each signature, or the date might get too old. )rsigning_config_get_daterr.s r#rzAwsSigningConfig.dates..t}}==r$c|jS)aW Optional[Callable[[str], bool]]: Optional function to control which headers are a part of the canonical request. Skipping auth-required headers will result in an unusable signature. Headers injected by the signing process are not skippable. This function does not override the internal check function (x-amzn-trace-id, user-agent), but rather supplements it. In particular, a header will get signed if and only if it returns true to both the internal check (skips x-amzn-trace-id, user-agent) and this function (if defined). )rr.s r#rz#AwsSigningConfig.should_sign_headers(((r$c@tj|jS)z bool: Whether to double-encode the resource path when constructing the canonical request (assuming the path is already encoded). By default, all services except S3 use double encoding. )r(signing_config_get_use_double_uri_encoderr.s r#rz&AwsSigningConfig.use_double_uri_encodes?? NNr$c@tj|jS)zn bool: Whether the resource paths are normalized when building the canonical request. )r,signing_config_get_should_normalize_uri_pathrr.s r#rz*AwsSigningConfig.should_normalize_uri_paths CCDMMRRr$c@tj|jS)a Optional[str]: What to use as the canonical request's body value. If `None` is set (the default), a value will be calculated from the payload during signing. Typically, this is the SHA-256 of the payload, written as lowercase hex. If this has been precalculated, it can be set here. Special values used by certain services can also be set (see :class:`AwsSignedBodyValue`). )r$signing_config_get_signed_body_valuerr.s r#rz"AwsSigningConfig.signed_body_values;;DMMJJr$cRttj|jS)z AwsSignedBodyHeaderType: Controls if signing adds a header containing the canonical request's signed body value. )rr*signing_config_get_signed_body_header_typerr.s r#rz(AwsSigningConfig.signed_body_header_types! 'w'Y'YZ^ZgZg'hiir$cRtj|j}|dk(rdS|S)a Optional[int]: If set, and signature_type is :attr:`AwsSignatureType.HTTP_REQUEST_QUERY_PARAMS`, then signing will add "X-Amz-Expires" to the query string, equal to the value specified here. Otherwise, this is None has no effect. rN)r(signing_config_get_expiration_in_secondsr)rr s r#rz&AwsSigningConfig.expiration_in_secondss)EEdmmT !Qt6J6r$c@tj|jS)z bool: Whether the "X-Amz-Security-Token" query param is omitted from the canonical request. This should be False for most services. )r%signing_config_get_omit_session_tokenrr.s r#rz#AwsSigningConfig.omit_session_token s <r?r@rArBrrrrrrrrrrDrrrrrrrrrrrrrrErFs@r#rrsvCH(IK"/11 0 E E&*$('++/#')@)E)E'+$); z(XXZZNN@@AA > > ) )OOSS K Kjj77LLr$rcttsJt|tsJtfd}t j ||S)a$ Perform AWS HTTP request signing. The :class:`awscrt.http.HttpRequest` is transformed asynchronously, according to the :class:`AwsSigningConfig`. When signing: 1. It is good practice to use a new config for each signature, or the date might get too old. 2. Do not add the following headers to requests before signing, they may be added by the signer: x-amz-content-sha256, X-Amz-Date, Authorization 3. Do not add the following query params to requests before signing, they may be added by the signer: X-Amz-Signature, X-Amz-Date, X-Amz-Credential, X-Amz-Algorithm, X-Amz-SignedHeaders Args: http_request (awscrt.http.HttpRequest): The HTTP request to sign. signing_config (AwsSigningConfig): Configuration for signing. Returns: concurrent.futures.Future: A Future whose result will be the signed :class:`awscrt.http.HttpRequest`. The future will contain an exception if the signing process fails. c |r/jtjj|yj y#t $r}j|Yd}~yd}~wwxYwr,)rzr{r|r}r~r)rrr http_requests r#rz&aws_sign_request.._on_complete:sY $$$V%6%6%@%@%LM!!,/ $   # # $s0AA A*A%%A*)rrrrrsign_request_aws)rsigning_configrrs` @r#aws_sign_requestrsLD lK 00 0 n&6 77 7 XF$ \><H Mr$)rArr{rawscrt.exceptions awscrt.httprr awscrt.iorrconcurrent.futuresrr7enumr typingr r r rrHrJrrrrrrrr$r#rs!57%,,R^Rj  K7K\ +' + w  CC* _g _OL~OLd1r$