U
    cX                     @   sJ  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	m
Z
mZmZmZmZmZ d dlZd dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z&m'Z' G dd dej(Z)eddG dd dZ*eG dd dZ+dddddZ,e-dddZ.ej/Z0d7ee1e2f dddZ3e
ee2 e*f dd d!Z4eddG d"d# d#ej5Z6eddG d$d% d%ej5Z7eddG d&d' d'ej5Z8G d(d) d)ej(Z9eddG d*d+ d+ej5Z:ee2e1f d,d-d.Z;d/ Z<Z=d0Z>e&e'd1Z?e+dd2d3Z@e-e-d4d5d6ZAdS )8    N)	dataclass)	timedelta)AnyDictIterableListOptionalSetUnion)x509)ValidationContext)config_utils)ConfigurationErrorcheck_config_keys)get_and_apply)SimpleSignerload_certs_from_pemder)load_cert_from_pemder)DEFAULT_SIGNING_STAMP_STYLE)KeyUsageConstraints)QRStampStyleTextStampStylec                   @   s   e Zd Ze Ze ZdS )StdLogOutputN)__name__
__module____qualname__enumautoSTDERRSTDOUT r    r    2/tmp/pip-unpacked-wheel-0kb_yl26/pyhanko/config.pyr      s   r   T)frozenc                   @   sH   e Zd ZU eeef ed< eeef ed< eeeef dddZ	dS )	LogConfigleveloutputreturnc                 C   s>   t | tstd|  }|dkr(tjS |dkr6tjS | S d S )Nz)Log output must be specified as a string.stderrstdout)
isinstancestrr   lowerr   r   r   )specZspec_lr    r    r!   parse_output_spec(   s    
zLogConfig.parse_output_specN)
r   r   r   r
   intr+   __annotations__r   staticmethodr.   r    r    r    r!   r#      s   
r#   c                   @   s   e Zd ZU eeef ed< eeef ed< eed< eed< eed< eed< ee	e e
f ed< eeef ed< eeef ed	< eeef ed
< e	e ed< dddZdddZdedddZd edddZdd Zdd Zdd ZdS )!	CLIConfigvalidation_contextsstamp_stylesdefault_validation_contextdefault_stamp_styletime_toleranceretroactive_revinfo
log_configpemder_setupspkcs12_setupspkcs11_setupsbeid_module_pathNc                 C   s@   |p| j }z| j| W S  tk
r:   td| dY nX d S )Nz&There is no validation context named ''.)r5   r3   KeyErrorr   )selfnamer    r    r!   _get_validation_settings_rawG   s    

z&CLIConfig._get_validation_settings_rawFc                 C   s,   |  |}t|| j| j}|r"|S tf |S N)rB   parse_trust_configr7   r8   r   )r@   rA   Zas_dict	vc_config	vc_kwargsr    r    r!   get_validation_contextP   s    
  z CLIConfig.get_validation_contextr&   c                 C   s   |  |}zt|d }W n tk
r2   i }Y nX z|d }|d| W n tk
r`   Y nX z|d }|d| W n tk
r   Y nX t|S )Nsigner-key-usage-policysigner-key-usagez	key-usagesigner-extd-key-usagezextd-key-usage)rB   dictr?   
setdefaultr   from_config)r@   rA   rE   Zpolicy_settingsZkey_usage_stringsr    r    r!   get_signer_key_usagesW   s     

zCLIConfig.get_signer_key_usagesc              
   C   s   |p| j }zt| j| }W nL tk
r@   td| dY n* tk
rh } zt|W 5 d }~X Y nX t|dd }||S )NzThere is no stamp style named 'r>   typetext)	r6   rK   r4   r?   r   	TypeErrorSTAMP_STYLE_TYPESpoprM   )r@   rA   Zstyle_configeclsr    r    r!   get_stamp_styleq   s    

zCLIConfig.get_stamp_stylec                 C   s>   z| j | }W n$ tk
r2   td| dY nX t|S )Nz There's no PKCS#11 setup named '')r<   r?   r   PKCS11SignatureConfigrM   r@   rA   setupr    r    r!   get_pkcs11_config~   s
    zCLIConfig.get_pkcs11_configc                 C   s>   z| j | }W n$ tk
r2   td| dY nX t|S )Nz There's no PKCS#12 setup named 'rW   )r;   r?   r   PKCS12SignatureConfigrM   rY   r    r    r!   get_pkcs12_config   s
    zCLIConfig.get_pkcs12_configc                 C   s>   z| j | }W n$ tk
r2   td| dY nX t|S )Nz There's no PEM/DER setup named 'rW   )r:   r?   r   PemDerSignatureConfigrM   rY   r    r    r!   get_pemder_config   s
    zCLIConfig.get_pemder_config)N)NF)N)N)r   r   r   r   r+   rK   r0   r   boolr   r#   rB   rG   r   rN   r   rV   r[   r]   r_   r    r    r    r!   r2   7   s$   

	
r2   F)r8   r7   c                 C   s   t |ts<|d krttd}nt |tr4t|d}ntdd|i}|rPd|d< | rt | trd| f} tt| }|r~||d< n||d< |rt |tr|f}tt||d< |S )	Nseconds5time-tolerance parameter must be specified in secondsr7   Tr8   Ztrust_rootsZextra_trust_rootsother_certs)r*   r   DEFAULT_TIME_TOLERANCEr/   r   r+   listr   )trusttrust_replacerd   r8   r7   rF   Ztrust_certsr    r    r!   init_validation_context_kwargs   s.    




ri   r&   c              	   C   sB   t dd|  t| d| dd| d| d|| d|d	S )
Nr   )rg   trust-replaceother-certstime-toleranceretroactive-revinforI   rJ   rH   rg   rj   Frk   rl   rm   )rg   rh   rd   r7   r8   )r   ri   get)Ztrust_configr7   r8   r    r    r!   rD      s    

 rD   c                 C   sf   z| | }W n4 t k
r@   |d k	r,| Y S td| dY nX t|ttfsbtdt| |S )NzLogging config for 'z' does not define a log level.z#Log levels must be int or str, not )r?   r   r*   r/   r+   rO   )Zsettings_dictkeydefault
level_specr    r    r!   _retrieve_log_level   s    

rr   c           	      C   s   t | tstdt| dtd}t| dtjtj	d}d t||i}| 
di }t |ts`td| D ]H\}}t |tstdt|d}t|d	tjtj	d}t||d
||< qh|S )Nz%logging config should be a dictionaryz
root-levelrp   zroot-outputz	by-modulez"logging.by-module should be a dictz+Keys in logging.by-module should be stringsr$   r%   )r$   r%   )r*   rK   r   rr   DEFAULT_ROOT_LOGGER_LEVELr   r#   r.   r   r   rn   itemsr+   )	log_config_specZroot_logger_levelZroot_logger_outputr9   Zlogging_by_modulemoduleZmodule_logging_settingsrq   Zoutput_specr    r    r!   parse_logging_config   s>    
    


  rx   c                       sz   e Zd ZU dZeed< dZeej	 ed< dZ
eed< dZeed< dZeed	< e fd
dZdee edddZ  ZS )r\   zf
    Configuration for a signature using key material on disk, contained
    in a PKCS#12 bundle.
    pfx_fileNrd   pfx_passphraseTprompt_passphraseF
prefer_pssc                    st   t  | |dd}t|tr(|f}tt||d< z"|d }|d k	rX|d|d< W n tk
rn   Y nX d S )Nrd   r    rz   utf8	superprocess_entriesrn   r*   r+   rf   r   encoder?   rU   config_dictrd   
passphrase	__class__r    r!   r     s    
z%PKCS12SignatureConfig.process_entries)provided_pfx_passphraser'   c                 C   s6   | j p|}tj| j|| j| jd}|d kr2td|S )N)ry   r   rd   r|    Error while loading key material)rz   r   Zload_pkcs12ry   rd   r|   r   )r@   r   r   resultr    r    r!   instantiate.  s    
  z!PKCS12SignatureConfig.instantiate)N)r   r   r   __doc__r+   r0   rd   r   r   Certificaterz   bytesr{   r`   r|   classmethodr   r   r   r   __classcell__r    r    r   r!   r\     s   
r\   c                       s   e Zd ZU dZeed< eed< dZeej	 ed< dZ
eed< dZeed< d	Zeed
< e fddZdee edddZ  ZS )r^   zV
    Configuration for a signature using PEM or DER-encoded key material on disk.
    key_file	cert_fileNrd   key_passphraseTr{   Fr|   c                    st   t  | |dd}t|tr(|f}tt||d< z"|d }|d k	rX|d|d< W n tk
rn   Y nX d S )Nrd   r    r   r}   r~   r   r   r    r!   r   Y  s    
z%PemDerSignatureConfig.process_entries)provided_key_passphraser'   c                 C   s:   | j p|}tj| j| j| j| j|d}|d kr6td|S )N)r   r   rd   r|   r   r   )r   r   loadr   r   rd   r|   r   )r@   r   r   r   r    r    r!   r   i  s    
  z!PemDerSignatureConfig.instantiate)N)r   r   r   r   r+   r0   rd   r   r   r   r   r   r{   r`   r|   r   r   r   r   r   r   r    r    r   r!   r^   :  s   
r^   c                   @   s>   e Zd ZU dZdZee ed< dZee	 ed< e
dd ZdS )TokenCriteriazL
    .. versionadded:: 0.14.0

    Search criteria for a PKCS#11 token.
    Nlabelserialc              
   C   sZ   zt |d |d< W n> tk
r*   Y n, tk
rT } ztd|W 5 d }~X Y nX d S )Nr   z<Failed to parse PKCS #11 token serial number as a hex string)binascii	unhexlifyr?   
ValueErrorr   )rU   r   rT   r    r    r!   r     s    zTokenCriteria.process_entries)r   r   r   r   r   r   r+   r0   r   r   r   r   r    r    r    r!   r   v  s
   
r   c                   @   s<   e Zd ZdZe Ze Ze Ze	e
d dddZdS )PKCS11PinEntryModezT
    Pin entry behaviour if the user PIN is not supplied as part of the config.
    )valuer'   c                 C   sl   t | trXztj|   W S  tk
rT   td| dddd tD  dY qhX n| rbtjS tj	S d S )NzInvalid PIN entry mode z; must be one of z, c                 s   s   | ]}t |jV  qd S rC   )reprrA   ).0xr    r    r!   	<genexpr>  s     z8PKCS11PinEntryMode.parse_mode_setting.<locals>.<genexpr>.)
r*   r+   r   __members__upperr?   r   joinPROMPTSKIP)r   r    r    r!   parse_mode_setting  s    
 
z%PKCS11PinEntryMode.parse_mode_settingN)r   r   r   r   r   r   r   ZDEFERr   r1   r   r   r    r    r    r!   r     s   
	r   c                       s&  e Zd ZU dZeed< dZee ed< dZee	 ed< dZ
eej ed< dZee ed< dZeeej  ed< dZee ed	< dZee	 ed
< dZee ed< dZee ed< ejZeed< dZeee  ed< dZeed< dZeed< dZeed< ee e d fddZ!e fddZ"  Z#S )rX   z
    Configuration for a PKCS#11 signature.

    This class is used to load PKCS#11 setup information from YAML
    configuration.
    module_pathN
cert_labelcert_idsigning_certificatetoken_criteriard   	key_labelkey_idslot_nouser_pin
prompt_pinr    other_certs_to_pullT
bulk_fetchFr|   raw_mechanism)keys_suppliedc                    s   t  dd |D  d S )Nc                 S   s   h | ]}|d kr|qS ))token_labelztoken-labelr    )r   kr    r    r!   	<setcomp>-  s   z:PKCS11SignatureConfig.check_config_keys.<locals>.<setcomp>)r   r   )rU   r   r   r    r!   r   )  s    z'PKCS11SignatureConfig.check_config_keysc                    s   t  | |dd}t|tr(|f}tt||d< |dd }|d k	rXt||d< d|krrt|d |d< nd|krd|krt	dd|krt|d |d< nd|krd|krt	d	t
|d
tjtjd|d
< d|krtdt |d}d|krd|i|d< n|d d| d S )Nrd   r    r   r   r   r   zNEither 'key_id', 'key_label' or 'cert_label' must be provided in PKCS#11 setupr   zYEither 'cert_id', 'cert_label' or 'signing_certificate' must be provided in PKCS#11 setupr   rs   r   z?'token_label' is deprecated, use 'token_criteria.label' insteadr   r   )r   r   rn   r*   r+   rf   r   r   _process_pkcs11_id_valuer   r   r   r   r   warningswarnDeprecationWarningrS   rL   )rU   r   rd   r   Zlblr   r    r!   r   2  sP    


  



z%PKCS11SignatureConfig.process_entries)$r   r   r   r   r+   r0   r   r   r   r   r   r   r   r   r   rd   r   r   r   r   r/   r   r   r   r   r   r   r   r`   r|   r   r   r	   r   r   r   r    r    r   r!   rX     s(   
	rX   r   c                 C   s"   t | trt| gS t| S d S rC   )r*   r/   r   r   r   r   r    r    r!   r   d  s    

r   rp   
   )ZqrrP   c                 C   s   t | pi }tf t|S rC   )yamlZ	safe_loadr2   process_config_dict)Zyaml_strr   r    r    r!   parse_cli_configs  s    r   )r   r'   c                 C   s"  t i i}z| d }|| W n tk
r2   Y nX ttjddi}z| d }|| W n tk
rn   Y nX | di }t|}| di }| di }| di }	| d	d }
| d
t }| dt}| dt}t	|t
stdt|d}t| dd}t||||||||||	|
dS )Nzvalidation-contextsZ	__stamp__)z
stamp-textZ
backgroundzstamp-stylesloggingzpkcs11-setupszpkcs12-setupszpemder-setupszbeid-module-pathzdefault-validation-contextzdefault-stamp-stylerl   rc   ra   rm   F)r3   r5   r7   r8   r4   r6   r9   r<   r;   r:   r=   )DEFAULT_VALIDATION_CONTEXTupdater?   DEFAULT_STAMP_STYLEr   Z
stamp_textrn   rx   re   r*   r/   r   r   r`   rK   )r   vcsZvc_specsZstamp_configsZstamp_specsrv   r9   r<   r;   r:   r=   Z
default_vcr6   Ztime_tolerance_secondsr7   r8   r    r    r!   r   x  sj       

     r   )N)Br   r   r   r   Zdataclassesr   datetimer   typingr   r   r   r   r   r	   r
   r   Z
asn1cryptor   Zpyhanko_certvalidatorr   Zpyhanko.pdf_utilsr   Zpyhanko.pdf_utils.config_utilsr   r   Zpyhanko.pdf_utils.miscr   Zpyhanko.signr   r   Zpyhanko.sign.generalr   Zpyhanko.sign.signersr   Z pyhanko.sign.validation.settingsr   Zpyhanko.stampr   r   Enumr   r#   r2   ri   rK   rD   INFOrt   r/   r+   rr   rx   ZConfigurableMixinr\   r^   r   r   rX   r   r   r   re   rR   r   r   r    r    r    r!   <module>   s`   $]$"8;0  