U
    c                     @   s   d dl mZmZmZmZmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZmZ d dlmZ d dlmZmZmZ G d	d
 d
ZdS )    )DictIterableListOptionalSet)crlocspx509)	Authority)OCSPFetchError)Fetchers)
POEManagerdigest_for_poe)CertificateRegistry)CRLContainerOCSPContainersort_freshest_firstc                   @   s&  e Zd ZdZd$eeee ee e	e
 dddZeedddZeedd	d
ZeedddZeeej dddZeeej dddZeeej dddZedddZdd Ze	ej dddZee dddZeee dddZ e!e" dd d!Z#e!e" dd"d#Z$dS )%RevinfoManagera  
    .. versionadded:: 0.20.0

    Class to manage and potentially fetch revocation information.

    :param certificate_registry:
        The associated certificate registry.
    :param poe_manager:
        The proof-of-existence (POE) data manager.
    :param crls:
        CRL data.
    :param ocsps:
        OCSP response data.
    :param fetchers:
        Fetchers for collecting revocation information.
        If ``None``, no fetching will be performed.
    N)certificate_registrypoe_managercrlsocspsfetchersc                 C   sb   || _ || _i | _i | _g | _|r,t|| _g | _|rXt| | _}|D ]}| | qH|| _d S N)	_certificate_registry_poe_manager_revocation_certs_crl_issuer_map_crlsr   _ocsps_extract_ocsp_certs	_fetchers)selfr   r   r   r   r   ocsp_response r$   I/tmp/pip-unpacked-wheel-rwcmptg8/pyhanko_certvalidator/revinfo/manager.py__init__$   s    
zRevinfoManager.__init__)returnc                 C   s   | j S )z<
        The proof-of-existence (POE) data manager.
        )r   r"   r$   r$   r%   r   >   s    zRevinfoManager.poe_managerc                 C   s   | j S )z6
        The associated certificate registry.
        )r   r(   r$   r$   r%   r   E   s    z#RevinfoManager.certificate_registryc                 C   s
   | j dk	S )zA
        Boolean indicating whether fetching is allowed.
        N)r!   r(   r$   r$   r%   fetching_allowedL   s    zRevinfoManager.fetching_allowedc                 C   s.   dd | j D }| js|S t| jj | S )zK
        A list of all cached :class:`crl.CertificateList` objects
        c                 S   s   g | ]
}|j qS r$   )crl_data.0Zcontr$   r$   r%   
<listcomp>Y   s     z'RevinfoManager.crls.<locals>.<listcomp>)r   r!   listcrl_fetcherZfetched_crls)r"   Zraw_crlsr$   r$   r%   r   S   s    zRevinfoManager.crlsc                 C   s.   dd | j D }| js|S t| jj | S )zI
        A list of all cached :class:`ocsp.OCSPResponse` objects
        c                 S   s   g | ]
}|j qS r$   )ocsp_response_datar+   r$   r$   r%   r-   d   s     z(RevinfoManager.ocsps.<locals>.<listcomp>)r   r!   r.   ocsp_fetcherZfetched_responses)r"   Z	raw_ocspsr$   r$   r%   r   ^   s    zRevinfoManager.ocspsc                 C   s   t | j S )z
        A list of newly-fetched :class:`x509.Certificate` objects that were
        obtained from OCSP responses and CRLs
        )r.   r   valuesr(   r$   r$   r%   new_revocation_certsj   s    z#RevinfoManager.new_revocation_certs)r#   c                 C   sh   | j }||j }| j}| j}| }|dk	rd|d rd|d D ]&}||r<|||j< |j||d q<dS )z
        Extracts any certificates included with an OCSP response and adds them
        to the certificate registry

        :param ocsp_response:
            An asn1crypto.ocsp.OCSPResponse object to look for certs inside of
        Ncerts)dt)r   r0   r   r   Zextract_basic_ocsp_responseregisterZissuer_serial)r"   r#   Zpoe_manZocsp_poe_timeregistryZ
revo_certsbasicZ
other_certr$   r$   r%   r    s   s    	


z"RevinfoManager._extract_ocsp_certsc                 C   s   || j |j< dS )aU  
        Records the certificate that issued a certificate list. Used to reduce
        processing code when dealing with self-issued certificates and multiple
        CRLs.

        :param certificate_list:
            An ans1crypto.crl.CertificateList object

        :param cert:
            An ans1crypto.x509.Certificate object
        N)r   	signature)r"   certificate_listcertr$   r$   r%   record_crl_issuer   s    z RevinfoManager.record_crl_issuerc                 C   s   | j |jS )a3  
        Checks to see if the certificate that signed a certificate list has
        been found

        :param certificate_list:
            An ans1crypto.crl.CertificateList object

        :return:
            None if not found, or an asn1crypto.x509.Certificate object of the
            issuer
        )r   getr9   )r"   r:   r$   r$   r%   check_crl_issuer   s    zRevinfoManager.check_crl_issuerc                    sb   | j s| jS | j }z|j|}W n& tk
rH   |j|I dH }Y nX dd |D }|| j S )z
        .. versionadded:: 0.20.0

        :param cert:
            An asn1crypto.x509.Certificate object

        :return:
            A list of :class:`CRLContainer` objects
        Nc                 S   s   g | ]}t |qS r$   )r   )r,   r*   r$   r$   r%   r-      s     z6RevinfoManager.async_retrieve_crls.<locals>.<listcomp>)r!   r   r/   Zfetched_crls_for_certKeyErrorfetch)r"   r;   r   r   Zcontsr$   r$   r%   async_retrieve_crls   s    
z"RevinfoManager.async_retrieve_crls)	authorityr'   c              	      s   | j s| jS | j }dd |j|D }|s|j||I dH }t|}|D ]0}z| | W qN tk
r|   t	dY qNX qN|| j S )a
  
        .. versionadded:: 0.20.0

        :param cert:
            An asn1crypto.x509.Certificate object

        :param authority:
            The issuing authority for the certificate

        :return:
            A list of :class:`OCSPContainer` objects
        c                 S   s   g | ]}t |qS r$   )r   )r,   respr$   r$   r%   r-      s   z7RevinfoManager.async_retrieve_ocsps.<locals>.<listcomp>Nz9Failed to extract certificates from fetched OCSP response)
r!   r   r1   Zfetched_responses_for_certr@   r   Z
load_multir    
ValueErrorr   )r"   r;   rB   r   r   r0   rC   r$   r$   r%   async_retrieve_ocsps   s(    
 

z#RevinfoManager.async_retrieve_ocspshashes_to_evictc                    s(   t d fdd}tt|| j| _dS )z
        Internal API to eliminate local OCSP records from consideration.

        :param hashes_to_evict:
            A collection of OCSP response hashes; see :func:`.digest_for_poe`.
        	containerc                    s   t | j }| kS r   )r   r0   dumprI   digestrF   r$   r%   p   s    z%RevinfoManager.evict_ocsps.<locals>.pN)r   r.   filterr   r"   rG   rM   r$   rF   r%   evict_ocsps   s    zRevinfoManager.evict_ocspsc                    s(   t d fdd}tt|| j| _dS )z
        Internal API to eliminate local CRLs from consideration.

        :param hashes_to_evict:
            A collection of CRL hashes; see :func:`.digest_for_poe`.
        rH   c                    s   t | j }| kS r   )r   r*   rJ   rK   rF   r$   r%   rM      s    z$RevinfoManager.evict_crls.<locals>.pN)r   r.   rN   r   rO   r$   rF   r%   
evict_crls   s    zRevinfoManager.evict_crls)N)%__name__
__module____qualname____doc__r   r   r   r   r   r   r   r&   propertyr   r   boolr)   r   r   ZCertificateListr   r   ZOCSPResponser   r	   ZCertificater3   r    r<   r>   rA   r
   rE   r   bytesrP   rQ   r$   r$   r$   r%   r      s<    
,r   N)typingr   r   r   r   r   Z
asn1cryptor   r   r	   Zpyhanko_certvalidator.authorityr
   Zpyhanko_certvalidator.errorsr   Zpyhanko_certvalidator.fetchersr   Zpyhanko_certvalidator.ltv.poer   r   Zpyhanko_certvalidator.registryr   Z&pyhanko_certvalidator.revinfo.archivalr   r   r   r   r$   r$   r$   r%   <module>   s   