k7iKwSSKJr SSKJr SSKJr SSKJr SSKJr SSKJr SSK J r SSK J r SS K J r SS K J r SS K Jr SS K Jr SS K Jr SSK Jr SSK Jr SSKJr SSKJr SSKJr SSKJr SSKJr SSKJr "SS5rSrg)) OrderedDict)deepcopy)json_b64encode)to_bytes) to_unicode)urlsafe_b64encode) DecodeError))InvalidAlgorithmForMultipleRecipientsMode)InvalidHeaderParameterNameError)KeyMismatchError)MissingAlgorithmError)MissingEncryptionAlgorithmError)UnsupportedAlgorithmError)$UnsupportedCompressionAlgorithmError)#UnsupportedEncryptionAlgorithmError)$JWEAlgorithmWithTagAwareKeyAgreement) JWEHeader)JWESharedHeader ensure_dict)extract_header)extract_segmentc\rSrSr\"/SQ5r0r0r0rSSjr \ S5r SSjr SSjr SSjrSS jrSS jrSS jr\S 5rS rSrSrSrSrSrg)JsonWebEncryption) algenczipjkujwkkidx5ux5cx5tzx5t#S256typctycritNcXlX lgN _algorithms_private_headers)self algorithmsprivate_headerss R/home/james-whalen/.local/lib/python3.13/site-packages/authlib/jose/rfc7516/jwe.py__init__JsonWebEncryption.__init__1s% /cFU(aURS:wa[SU<35eURS:XaXRUR'gURS:XaXR UR'gURS:XaXR UR'gg)z?Register an algorithm for ``alg`` or ``enc`` or ``zip`` of JWE.JWEzInvalid algorithm for JWE, rrrN)algorithm_type ValueErroralgorithm_location ALG_REGISTRYname ENC_REGISTRY ZIP_REGISTRY)cls algorithms r0register_algorithm$JsonWebEncryption.register_algorithm5sI44=:9-HI I  ' '5 0/8  Y^^ ,  ) )U 2/8  Y^^ ,  ) )U 2/8  Y^^ ,3r3c URU5nURU5nURU5nURXE5 UR X5 [ XQU5nUbUR U5n[ U[5(a>URb1URXcU5nUSn USn URUS5 O^[ U[5(aURXaX45n OURXaU5n U Sn U Sn SU ;aURU S5 UR5n [U5n[US5nU(aUR[U55nO [U5nUR!UXU 5unn[ U[5(a'URbUR#XaX4W U U5n U Sn SR%U['W 5['U 5['U5['U5/5$)a^Generate a JWE Compact Serialization. The JWE Compact Serialization represents encrypted content as a compact, URL-safe string. This string is:: BASE64URL(UTF8(JWE Protected Header)) || '.' || BASE64URL(JWE Encrypted Key) || '.' || BASE64URL(JWE Initialization Vector) || '.' || BASE64URL(JWE Ciphertext) || '.' || BASE64URL(JWE Authentication Tag) Only one recipient is supported by the JWE Compact Serialization and it provides no syntax to represent JWE Shared Unprotected Header, JWE Per-Recipient Unprotected Header, or JWE AAD values. :param protected: A dict of protected header :param payload: Payload (bytes or a value convertible to bytes) :param key: Public key used to encrypt payload :param sender_key: Sender's private key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: JWE compact serialization as bytes epkcekheaderekascii.)get_header_algget_header_encget_header_zip_validate_sender_key_validate_private_headers prepare_key isinstancerkey_size!generate_keys_and_prepare_headersupdatewrap generate_ivrrcompressencryptagree_upon_key_and_wrap_cekjoinr)r- protectedpayloadkey sender_keyrrzip_algpreprBrCwrappedrEivprotected_segmentaadmsg ciphertexttags r0serialize_compact#JsonWebEncryption.serialize_compactBs0!!),!!),%%i0 !!*2 &&y6##.  !4J s@ A A ( 88:NDu+Cu+C   T(^ ,#CDD((33C((337%.CB7"  !23__ +95('2 ""8G#45C7#C++c3C8 C s@ A A ( 55c3GByy!!"%!"%!*-!#&    r3c  [U[5(dU/nU(d [S5e[U5n[R "U5nUR S5nUcUVs/sHn0PM nn[[U55HnXhc0Xh'SXh;dM0XhS'M UR S5n [U5[U5:wa#[S[U5S[U535eURU5n URU5n URU5n URXJ5 URXZ5 UHn URU SU 5 M [[U55Hn[XUSX85X8'M UbU RU5nU RXS5nS U;aUS nOSn[U5S :aUc[!U R"5eSU;aUR%US5 [U [&5(auU R(bh/n[[U55HMnU R+XUXN5nUcUS nUR-US 5 XhSR/US5 MO O[[U55Hvn[U [&5(aU R1XX8XN5nOU R1XX8U5nUcUS nUS XhS 'SU;dM]XhSR/US5 Mx U R35nUR4(a[7UR45OSnU bUS[9U 5-- n[;US5nU (aU R=[;U55nO [;U5nU R?UUUU5unn[U [&5(aMU R(b@[[U55H(nU RAXX8UWUUU5nUS XhS 'M* [C5nUR4(a![E[7UR455US'URF(aURFUS'UHUn U S(dU S [E[9U S 55U S '[IU RK55HnUS;dM U U M MW UUS'U b[E[9U 55US'[E[9U55US'[E[9U55US'[E[9U55US'U$s snf)aGenerate a JWE JSON Serialization (in fully general syntax). The JWE JSON Serialization represents encrypted content as a JSON object. This representation is neither optimized for compactness nor URL safe. The following members are defined for use in top-level JSON objects used for the fully general JWE JSON Serialization syntax: protected The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWE Protected Header)) when the JWE Protected Header value is non-empty; otherwise, it MUST be absent. These Header Parameter values are integrity protected. unprotected The "unprotected" member MUST be present and contain the value JWE Shared Unprotected Header when the JWE Shared Unprotected Header value is non-empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. iv The "iv" member MUST be present and contain the value BASE64URL(JWE Initialization Vector) when the JWE Initialization Vector value is non-empty; otherwise, it MUST be absent. aad The "aad" member MUST be present and contain the value BASE64URL(JWE AAD)) when the JWE AAD value is non-empty; otherwise, it MUST be absent. A JWE AAD value can be included to supply a base64url-encoded value to be integrity protected but not encrypted. ciphertext The "ciphertext" member MUST be present and contain the value BASE64URL(JWE Ciphertext). tag The "tag" member MUST be present and contain the value BASE64URL(JWE Authentication Tag) when the JWE Authentication Tag value is non-empty; otherwise, it MUST be absent. recipients The "recipients" member value MUST be an array of JSON objects. Each object contains information specific to a single recipient. This member MUST be present with exactly one array element per recipient, even if some or all of the array element values are the empty JSON object "{}" (which can happen when all Header Parameter values are shared between all recipients and when no encrypted key is used, such as when doing Direct Encryption). The following members are defined for use in the JSON objects that are elements of the "recipients" array: header The "header" member MUST be present and contain the value JWE Per- Recipient Unprotected Header when the JWE Per-Recipient Unprotected Header value is non-empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. encrypted_key The "encrypted_key" member MUST be present and contain the value BASE64URL(JWE Encrypted Key) when the JWE Encrypted Key value is non-empty; otherwise, it MUST be absent. This implementation assumes that "alg" and "enc" header fields are contained in the protected or shared unprotected header. :param header_obj: A dict of headers (in addition optionally contains JWE AAD) :param payload: Payload (bytes or a value convertible to bytes) :param keys: Public keys (or a single public key) used to encrypt payload :param sender_key: Sender's private key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: JWE JSON serialization (in fully general syntax) as dict Example of `header_obj`:: { "protected": { "alg": "ECDH-1PU+A128KW", "enc": "A256CBC-HS512", "apu": "QWxpY2U", "apv": "Qm9iIGFuZCBDaGFybGll", }, "unprotected": {"jku": "https://alice.example.com/keys.jwks"}, "recipients": [ {"header": {"kid": "bob-key-2"}}, {"header": {"kid": "2021-05-06"}}, ], "aad": b"Authenticate me too.", } zNo keys have been provided recipientsNrDrazCount of recipient keys z' does not equal to count of recipients rrCrBrE encrypted_keyr3rGrFrX unprotected>rDrjr_rcrd)&rNlistr7rr from_dictgetrangelenrHrIrJrKrLrMgenerate_presetr r:update_protectedrrOrPappendrQrRrSrXrrrrTrUrVrrrksetkeys)r- header_objrYrur[ shared_headerrh_ijwe_aadrrr\ recipientpresetrCepksr]r^r_rarbrcrdobjmembers r0serialize_json JsonWebEncryption.serialize_jsons@$%%6D9: :j) '11*= ^^L1  &*+d"dJ+s:'A}$ " z},*, h' ( ..' t9J '*3t9+5\]`ak]l\mn  !!-0!!-0%%m4 !!*2 &&}:#I  * *9X+> D$s4y!A!#!}X'>HDG"  !4J$$Sq'2 F?-CC t9q=S[;CHHE E v   * *6(+; < s@ A A ( D3t9%<<a*;u+C DK( h'..tH~>&3t9%c#GHH!hhs47JWG!hhs47FKG;!%.C18 o.w&M(+22783DE&__ 8E7N7NN=22 3TW    4+G44 4CsG$ ""8G#45C7#C++c3C8 C s@ A A ( 3t9%99T!Wc329 o. &m  " ").9P9P*QRC   $ $!.!:!:C #IX&h')3!)O"<=*Io &inn./!<<!&)0 $'L  #$5g$>?CJ045D &'8'DEL 1# 67E  a,s$ UcnSU;d SU;dSU;aURXX45$URXX45$)abGenerate a JWE Serialization. It will automatically generate a compact or JSON serialization depending on `header` argument. If `header` is a dict with "protected", "unprotected" and/or "recipients" keys, it will call `serialize_json`, otherwise it will call `serialize_compact`. :param header: A dict of header(s) :param payload: Payload (bytes or a value convertible to bytes) :param key: Public key(s) used to encrypt payload :param sender_key: Sender's private key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: JWE compact serialization as bytes or JWE JSON serialization as dict rXrkrh)rre)r-rDrYrZr[s r0 serializeJsonWebEncryption.serializes@ & MV$;|v?U&&vH H%%fsGGr3c[U5nURS5upVpxn [ U[5n [ U[S5n [ U[S5n [ U[S5n[ U [S5nUR U 5nURU 5nURU 5nURUU5 URU U5 [U[5(a[U5S:XaUS n[UX5nUbURU5n[U[5(a6UR bUR#UXX$U5nO'UR#UXX$5nOUR#UXU5n[US 5nUR%UUXU5nU(aUR'[U55nOUnU(aU"U5nU US .$![an [S5U eSn A ff=f) aExtract JWE Compact Serialization. :param s: JWE Compact Serialization as bytes :param key: Private key used to decrypt payload (optionally can be a tuple of kid and essentially key) :param decode: Function to decode payload data :param sender_key: Sender's public key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: dict with `header` and `payload` keys where `header` value is a dict containing protected header fields rGzNot enough segmentsNzencryption keyinitialization vectorrcauthentication tagrirFrDrY)rrsplitr7r rrrHrIrJrKrLrNtuplerprMrrOunwrapdecrypt decompress)r-srZdecoder[ protected_sek_siv_s ciphertext_stag_sexcrXrEr_rcrdrrr\rCrarbrYs r0deserialize_compact%JsonWebEncryption.deserialize_compacts > A;<88D> 8Kt5#; < T;0@ A T;0G H$\; M e[2FG!!),!!),%%i0 !!*c2 &&y#6 c5 ! !c#h!ma&C#y.  !4J c? @ @||'jjbScJjjbSE**S"5C{G,kk*c2C8 ((#7GG WoG#88c >34# = >s G G' G""G'c^^^^^^^^^[US5n[U5nSU;a[[US5[5mOSmUR S5mUSmTH.nSU;a0US'[ [US5[S5US'M0 S U;a[ [US 5[S 5nOSn[ [US 5[S 5n[ [US 5[S 5n[ [US5[S5m[TT5n URU 5mURU 5mURU 5n URTT5 URU T5 THnURUST5 M Sm[T[5(a[T5S:Xa TSmTSmTR!T5mTc TR"mTbTR!T5mUUUUU4Sjn UUUU4Sjn UUU4Sjn UUUU4Sjn[T[$5(aTR&b U"U 5nOU"U 5nOU"U 5n[UR SS55nS U;aUS[US 5-- n[US5nTR)UUUTU5nU (aU R+[U55nOUnU(aU"U5nTH;nUS(dUS [-UR/55HnUS:wdM UU M M= 0nT(aTUS'T(aTUS'TUS'UbUUS 'UUS.$)aExtract JWE JSON Serialization. :param obj: JWE JSON Serialization as dict or str :param key: Private key used to decrypt payload (optionally can be a tuple of kid and essentially key) :param decode: Function to decode payload data :param sender_key: Sender's public key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: dict with `header` and `payload` keys where `header` value is a dict containing `protected`, `unprotected`, `recipients` and/or `aad` keys r5rXNrkrhrDrjz encrypted keyrazJWE AADr_rrcrdrrrric.>TRTXTTT5$r)r)rErDrrrZr[rds r0_unwrap_with_sender_key_and_tagKJsonWebEncryption.deserialize_json.._unwrap_with_sender_key_and_tagGs::c2sJD Dr3c,>TRTXTT5$r)r)rErDrrrZr[s r0'_unwrap_with_sender_key_and_without_tagSJsonWebEncryption.deserialize_json.._unwrap_with_sender_key_and_without_tagJs::c2sJ? ?r3c*>TRTXT5$r)r)rErDrrrZs r0"_unwrap_without_sender_key_and_tagNJsonWebEncryption.deserialize_json.._unwrap_without_sender_key_and_tagMs::c2s3 3r3c*>Tb?TH9nUSRS5T:XdM[TTUS5nU"USU5s $ SnTH n[TTUS5nU"USU5s $ Uc [5eUe![a nUnSnAMESnAff=f)NrDr!rj)rnr Exceptionr ) unwrap_funcr{rDerrorer!rXrhrks r0_unwrap_for_matching_recipientJJsonWebEncryption.deserialize_json.._unwrap_for_matching_recipientPs!+I *..u5 D$ c5 ! !c#h!ma&Ca&Cooc" ;''C  !4J E E @ @ 4  * c? @ @||'55TU5; 11STCsww{B/0 C< 4(3u:.. .CsG$kk*c2sC8 ((#7GG WoG#IX&h'inn./X%!&)0$ "+F;  $/F= !)|  #F5M W55r3c[U[5(aURXX45$[U5nUR S5(a(UR S5(aURXX45$UR XX45$)aExtract a JWE Serialization. It supports both compact and JSON serialization. :param obj: JWE compact serialization as bytes or JWE JSON serialization as dict or str :param key: Private key used to decrypt payload (optionally can be a tuple of kid and essentially key) :param decode: Function to decode payload data :param sender_key: Sender's public key in case JWEAlgorithmWithTagAwareKeyAgreement is used :return: dict with `header` and `payload` keys {})rNdictrr startswithendswithr)r-r~rZrr[s r0 deserializeJsonWebEncryption.deserializesp c4 ((6F Fsm >>$  CLL$6$6((6F F''&EEr3c[US5$)zParse JWE JSON Serialization. :param obj: JWE JSON Serialization as str or dict :return: Parsed JWE JSON Serialization as dict if `obj` is an str, or `obj` as is if `obj` is already a dict r5r)r~s r0 parse_jsonJsonWebEncryption.parse_jsons3&&r3cSU;a [5eUSnURbX R;a [5eX R;a [5eURU$)Nr)r r+rr9)r-rDrs r0rH JsonWebEncryption.get_header_algsb  ') )Um    'C7G7G,G+- - '' '+- -  %%r3cSU;a [5eUSnURbX R;a [5eX R;a [5eURU$)Nr)rr+rr;)r-rDrs r0rI JsonWebEncryption.get_header_encsb  13 3Um    'C7G7G,G57 7 '' '57 7  %%r3cSU;aSUSnURbX R;a [5eX R;a [5eURU$g)Nr)r+rr<)r-rDzs r0rJ JsonWebEncryption.get_header_zips] F?u A+9I9I0I:<<))):<<$$Q' ' r3c[U[5(aUc[URS35egUb[URS35eg)NzB algorithm requires sender_key but passed sender_key value is NonezJ algorithm does not use sender_key but passed sender_key value is not None)rNrr7r:)r-r[rs r0rK&JsonWebEncryption._validate_sender_keys` c? @ @! xxj bc" % xxj jk&r3cURcgURR5nURUR5nUR(aURUR5nUHnXC;dM [ U5e gr))r,!REGISTERED_HEADER_PARAMETER_NAMEScopyunion EXTRA_HEADERSr )r-rDrnamesks r0rL+JsonWebEncryption._validate_private_headerssr  ( 66;;= D112   KK 1 12EA~5a88r3r*)NNr))__name__ __module__ __qualname____firstlineno__ frozensetrr9r;r<r1 classmethodr?rerrrrr staticmethodrrHrIrJrKrL__static_attributes__r3r0rrs(1 )%$LLL0 9 9h T||H*@9DS6jF.'' &&( 9r3rct[U5(a U"US5nOUc SU;aUSnURU5$)Nr )callablerM)rrDrZs r0rMrMs:}}&$ &Um ??3 r3N) collectionsrrrauthlib.common.encodingrrrrauthlib.jose.errorsr r r r r rrrrauthlib.jose.rfc7516.modelsrrrauthlib.jose.utilrrrrrMrr3r0rsV#2,.5+I?05?9DCL17),-V 9V 9r r3