U
    cA8                     @   s  d dl Z d dlZd dlmZ d dlmZ d dlmZmZmZm	Z	m
Z
 d dlmZmZmZ d dlmZ d dlmZmZ d dlmZmZ d	d
ddddddgZG dd	 d	ejZeddG dd
 d
ZG dd dee jZe	dedZee ee dddZdd Zee ee eeedddZ eej! dd d!Z"eddG d"d deZ#eddG d#d deZ$e
e%ej&e$f Z'e
e%ej(e#f Z)ee' ee$ d$d%dZ*ee) ee# d&d'dZ+dS )(    N)	dataclass)datetime)IterableListOptionalTypeVarUnion)algoscrlocsp)	type_name)IssuedItemContainerValidationTimingParams)CertRevTrustPolicyFreshnessReqTypeRevinfoUsabilityRatingRevinfoUsabilityRevinfoContainerOCSPContainerCRLContainersort_freshest_firstprocess_legacy_crl_inputprocess_legacy_ocsp_inputc                   @   sB   e Zd ZdZe Ze Ze Ze Z	e
edddZdS )r   zz
    Description of whether a piece of revocation information
    is considered usable in the circumstances provided.
    returnc                 C   s   | t jt jfkS )zs
        Boolean indicating whether the assigned rating corresponds to
        a "fresh" judgment in AdES.
        )r   OKTOO_NEWself r   J/tmp/pip-unpacked-wheel-rwcmptg8/pyhanko_certvalidator/revinfo/archival.pyusable_ades=   s    z"RevinfoUsabilityRating.usable_adesN)__name__
__module____qualname____doc__enumautor   STALEr   UNCLEARpropertyboolr!   r   r   r   r    r      s   T)frozenc                   @   s*   e Zd ZU dZeed< dZee ed< dS )r   z`
    Usability rating and cutoff date for a particular piece of
    revocation information.
    ZratingNlast_usable_at)	r"   r#   r$   r%   r   __annotations__r-   r   r   r   r   r   r    r   J   s   
c                   @   s:   e Zd ZdZeeedddZee	e
j dddZdS )	r   z<
    A container for a piece of revocation information.
    policytiming_paramsr   c                 C   s   t dS )af  
        Assess the usability of the revocation information given a
        revocation information trust policy and timing parameters.

        :param policy:
            The revocation information trust policy.
        :param timing_params:
            Timing-related information.
        :return:
            A :class:`.RevinfoUsability` judgment.
        NNotImplementedError)r   r0   r1   r   r   r    	usable_atb   s    zRevinfoContainer.usable_atr   c                 C   s   t dS )z
        Extract the signature mechanism used to guarantee the authenticity
        of the revocation information, if applicable.
        Nr2   r   r   r   r    revinfo_sig_mechanism_usedr   s    z+RevinfoContainer.revinfo_sig_mechanism_usedN)r"   r#   r$   r%   r   r   r   r4   r*   r   r	   SignedDigestAlgorithmr5   r   r   r   r    r   ]   s    RevInfoType)bound)lstr   c                 C   s   t ddd}t| |ddS )aV  
    Sort a list of revocation information containers in freshest-first order.

    Revocation information that does not have a well-defined issuance date
    will be grouped at the end.

    :param lst:
        A list of :class:`.RevinfoContainer` objects of the same type.
    :return:
        The same list sorted from fresh to stale.
    )	containerc                 S   s   | j }|d k	|fS N)issuance_date)r:   dtr   r   r    _key   s    z!sort_freshest_first.<locals>._keyT)keyreverse)r   sorted)r9   r>   r   r   r    r      s    
c                 C   s>   | j }|d kr&|d k	r&||kr&|| }|d k	r:t|| }|S r;   )Z	freshnessabs)r0   this_updatenext_updatetime_tolerancefreshness_deltar   r   r    _freshness_delta   s    rG   )rC   rD   r0   r1   r   c           	      C   sX  | d krt tjS |j| k r8|jr.|jtjkr8t tjS |j}|j	}|jtj
krt|| ||}|d krpt tjS |j}| | |k rt tj| | dS n|jtjkrt|| ||}|d krt tjS | || k rt tj| | dS nl|jtjkrJ|d krt tjS |j}|s(|| | k r(t tjS ||| krNt tj|| dS ntt tjS )N)r-   )r   r   r)   validation_timeZretroactive_revinfoZfreshness_req_typer   DEFAULTr   rE   ZTIME_AFTER_SIGNATURErG   Zbest_signature_timer(   ZMAX_DIFF_REVOCATION_VALIDATIONr3   r   )	rC   rD   r0   r1   rH   rE   rF   Zsignature_poe_timeZretroactiver   r   r    _judge_revinfo   sn    




   
   



rJ   r   c                 C   s:   | d j }|dkrd S | d }|d j dkr0d S |d jS )NZresponse_statusZ
successfulresponse_bytesZresponse_typebasic_ocsp_responseresponse)nativeparsed)ocsp_responsestatusrK   r   r   r    _extract_basic_ocsp_response   s    
rR   c                   @   s   e Zd ZU dZejed< dZeed< e	eje
d  dddZeee dd	d
ZeeedddZeej dddZeej dddZeeej dddZdS )r   z)
    Container for an OCSP response.
    ocsp_response_datar   index)rP   r   c                    s:   t  }|dkrg S |d } fddtt|d D S )a  
        Turn an OCSP response object into one or more :class:`.OCSPContainer`
        objects. If a :class:`.OCSPContainer` contains more than one
        ``SingleResponse``, then the same OCSP response will be duplicated
        into multiple containers, each with a different ``index`` value.

        :param ocsp_response:
            An OCSP response.
        :return:
            A list of :class:`.OCSPContainer` objects, one for each
            ``SingleResponse`` value.
        Ntbs_response_datac                    s   g | ]}t  |d qS ))rS   rT   )r   ).0ixrP   r   r    
<listcomp>0  s   z,OCSPContainer.load_multi.<locals>.<listcomp>	responses)rR   rangelen)clsrP   rL   tbs_responser   rX   r    
load_multi  s    
zOCSPContainer.load_multir   c                 C   s   |   }|d krd S |d jS )NrC   )extract_single_responserN   )r   cert_responser   r   r    r<   5  s    zOCSPContainer.issuance_dater/   c                 C   s>   |   }|d krttjS |d j}|d j}t||||dS )NrC   rD   r0   r1   )r`   r   r   r)   rN   rJ   )r   r0   r1   ra   rC   rD   r   r   r    r4   =  s    


zOCSPContainer.usable_atc                 C   s
   t | jS )z
        Extract the ``BasicOCSPResponse``, assuming there is one (i.e.
        the OCSP response is a standard, non-error response).
        )rR   rS   r   r   r   r    extract_basic_ocsp_responseN  s    z)OCSPContainer.extract_basic_ocsp_responsec                 C   s@   |   }|dkrdS |d }t|d | jkr2dS |d | j S )z^
        Extract the unique ``SingleResponse`` value identified by the
        index.
        NrU   rZ   )rc   r\   rT   )r   rL   r^   r   r   r    r`   V  s    z%OCSPContainer.extract_single_responsec                 C   s   |   }|d krd S |d S NZsignature_algorithm)rc   )r   Z
basic_respr   r   r    r5   e  s    z(OCSPContainer.revinfo_sig_mechanism_usedN)r"   r#   r$   r%   r   OCSPResponser.   rT   intclassmethodr   r_   r*   r   r   r<   r   r   r   r4   BasicOCSPResponserc   ZSingleResponser`   r	   r6   r5   r   r   r   r    r   	  s$   

 c                   @   sX   e Zd ZU dZejed< eee	dddZ
eee dddZeejdd	d
ZdS )r   z<
    Container for a certificate revocation list (CRL).
    crl_datar/   c                 C   s.   | j d }|d j}|d j}t||||dS )Ntbs_cert_listrC   rD   rb   )ri   rN   rJ   )r   r0   r1   rj   rC   rD   r   r   r    r4   x  s    


   zCRLContainer.usable_atr   c                 C   s   | j d }|d jS )Nrj   rC   )ri   rN   )r   rj   r   r   r    r<     s    
zCRLContainer.issuance_datec                 C   s
   | j d S rd   )ri   r   r   r   r    r5     s    z'CRLContainer.revinfo_sig_mechanism_usedN)r"   r#   r$   r%   r
   CertificateListr.   r   r   r   r4   r*   r   r   r<   r	   r6   r5   r   r   r   r    r   m  s   

 
)crlsr   c                 C   sd   g }| D ]V}t |tr"tj|}t |tjr6t|}t |trL|| qtdt| q|S )z
    Internal function to process legacy CRL data into one or more
    :class:`.CRLContainer`.

    :param crls:
        Legacy CRL input data.
    :return:
        A list of :class:`.CRLContainer` objects.
    zScrls must be a list of byte strings or asn1crypto.crl.CertificateList objects, not )	
isinstancebytesr
   rk   loadr   append	TypeErrorr   )rl   Znew_crlsZcrl_r   r   r    r     s    

)ocspsr   c                 C   sr   g }| D ]d}t |tr"tj|}t |tjrDt|}|| qt |trZ|| qt	dt
| q|S )z
    Internal function to process legacy OCSP data into one or more
    :class:`.OCSPContainer`.

    :param ocsps:
        Legacy OCSP input data.
    :return:
        A list of :class:`.OCSPContainer` objects.
    zRocsps must be a list of byte strings or asn1crypto.ocsp.OCSPResponse objects, not )rm   rn   r   re   ro   r   r_   extendrp   rq   r   )rr   Z	new_ocspsZocsp_Zextrr   r   r    r     s    


),abcr&   Zdataclassesr   r   typingr   r   r   r   r   Z
asn1cryptor	   r
   r   Zpyhanko_certvalidator._typesr   Zpyhanko_certvalidator.ltv.typesr   r   Z!pyhanko_certvalidator.policy_declr   r   __all__Enumr   r   ABCr   r7   r   rG   rJ   rh   rR   r   r   rn   rk   ZLegacyCompatCRLre   ZLegacyCompatOCSPr   r   r   r   r   r    <module>   sX   + Vc