o
    Vh~,                     @  s  d dl mZ d dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZ G dd	 d	ejZG d
d dejZe
je
je
je
je
jfZdddZG dd dejZG dd dZejZejZejZG dd dZ G dd dZ!ej"Z"ej#Z#dS )    )annotationsN)utilsx509)ocsp)hashes) CertificateIssuerPrivateKeyTypes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc                   @  s   e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module____qualname__HASHNAME r   r   j/var/www/html/construction_image-detection-poc/venv/lib/python3.10/site-packages/cryptography/x509/ocsp.pyr      s    r   c                   @  s$   e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr                  N)	r   r   r   
SUCCESSFULMALFORMED_REQUESTINTERNAL_ERROR	TRY_LATERSIG_REQUIREDUNAUTHORIZEDr   r   r   r   r      s    r   	algorithmhashes.HashAlgorithmreturnNonec                 C  s   t | ts	tdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError)r   r   r   r   _verify_algorithm.   s
   
r&   c                   @  s   e Zd ZdZdZdZdS )OCSPCertStatusr   r   r   N)r   r   r   GOODREVOKEDUNKNOWNr   r   r   r   r'   5   s    r'   c                   @  s   e Zd ZdddZdS )_SingleResponsecertx509.Certificateissuerr   r    cert_statusr'   this_updatedatetime.datetimenext_updatedatetime.datetime | Nonerevocation_timerevocation_reasonx509.ReasonFlags | Nonec	           	      C  s  t |tjrt |tjstdt| t |tjstd|d ur,t |tjs,td|| _|| _|| _|| _	|| _
t |tsDtd|tjurZ|d urQtd|d urYtdn$t |tjsdtdt|}|tk rptd|d ur~t |tjs~td	|| _|| _|| _d S )
N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r#   r   Certificate	TypeErrorr&   datetime_cert_issuer
_algorithm_this_update_next_updater'   r)   r%   r	   r   ReasonFlags_cert_status_revocation_time_revocation_reason)	selfr,   r.   r   r/   r0   r2   r4   r5   r   r   r   __init__<   s\   




z_SingleResponse.__init__N)r,   r-   r.   r-   r   r    r/   r'   r0   r1   r2   r3   r4   r3   r5   r6   )r   r   r   rE   r   r   r   r   r+   ;   s    r+   c                   @  sF   e Zd Zddg fd#d
dZd$ddZd%ddZd&ddZd'd!d"ZdS )(OCSPRequestBuilderNrequestFtuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | Nonerequest_hash5tuple[bytes, bytes, int, hashes.HashAlgorithm] | None
extensions(list[x509.Extension[x509.ExtensionType]]r!   r"   c                 C  s   || _ || _|| _d S N)_request_request_hash_extensions)rD   rG   rI   rK   r   r   r   rE      s   

zOCSPRequestBuilder.__init__r,   r-   r.   r   r    c                 C  sZ   | j d us
| jd urtdt| t|tjrt|tjs"tdt|||f| j| j	S )N.Only one certificate can be added to a requestr7   )
rN   rO   r%   r&   r#   r   r8   r9   rF   rP   )rD   r,   r.   r   r   r   r   add_certificate   s   z"OCSPRequestBuilder.add_certificateissuer_name_hashbytesissuer_key_hashserial_numberintc                 C  s   | j d us
| jd urtdt|tstdt| td| td| |j	t
|ks5|j	t
|kr9tdt| j ||||f| jS )NrQ   z serial_number must be an integerrS   rU   z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm)rN   rO   r%   r#   rW   r9   r&   r   _check_bytesdigest_sizelenrF   rP   )rD   rS   rU   rV   r   r   r   r   add_certificate_by_hash   s&   

z*OCSPRequestBuilder.add_certificate_by_hashextvalx509.ExtensionTypecriticalboolc                 C  sJ   t |tjs
tdt|j||}t|| j t| j	| j
g | j|S Nz"extension must be an ExtensionType)r#   r   ExtensionTyper9   	Extensionoidr
   rP   rF   rN   rO   rD   r\   r^   	extensionr   r   r   add_extension   s   z OCSPRequestBuilder.add_extensionOCSPRequestc                 C  s&   | j d u r| jd u rtdt| S )Nz*You must add a certificate before building)rN   rO   r%   r   create_ocsp_request)rD   r   r   r   build   s   
zOCSPRequestBuilder.build)rG   rH   rI   rJ   rK   rL   r!   r"   )r,   r-   r.   r-   r   r    r!   rF   )
rS   rT   rU   rT   rV   rW   r   r    r!   rF   )r\   r]   r^   r_   r!   rF   )r!   rg   )r   r   r   rE   rR   r[   rf   ri   r   r   r   r   rF      s    


rF   c                   @  s`   e Zd Zdddg fd5d
dZd6ddZd7d d!Zd8d#d$Zd9d)d*Zd:d/d0Ze	d;d3d4Z
dS )<OCSPResponseBuilderNresponse_SingleResponse | Noneresponder_id5tuple[x509.Certificate, OCSPResponderEncoding] | Nonecertslist[x509.Certificate] | NonerK   rL   c                 C  s   || _ || _|| _|| _d S rM   )	_response_responder_id_certsrP   )rD   rk   rm   ro   rK   r   r   r   rE      s   
zOCSPResponseBuilder.__init__r,   r-   r.   r   r    r/   r'   r0   r1   r2   r3   r4   r5   r6   r!   c	           
   	   C  s<   | j d ur	tdt||||||||}	t|	| j| j| jS )Nz#Only one response per OCSPResponse.)rq   r%   r+   rj   rr   rs   rP   )
rD   r,   r.   r   r/   r0   r2   r4   r5   
singlerespr   r   r   add_response   s$   

z OCSPResponseBuilder.add_responseencodingr   responder_certc                 C  sP   | j d ur	tdt|tjstdt|tstdt| j||f| j	| j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding)rr   r%   r#   r   r8   r9   r   rj   rq   rs   rP   )rD   rv   rw   r   r   r   rm     s   

z OCSPResponseBuilder.responder_id!typing.Iterable[x509.Certificate]c                 C  s\   | j d ur	tdt|}t|dkrtdtdd |D s$tdt| j| j|| j	S )Nz!certificates may only be set oncer   zcerts must not be an empty listc                 s  s    | ]	}t |tjV  qd S rM   )r#   r   r8   ).0xr   r   r   	<genexpr>"  s    z3OCSPResponseBuilder.certificates.<locals>.<genexpr>z$certs must be a list of Certificates)
rs   r%   listrZ   allr9   rj   rq   rr   rP   )rD   ro   r   r   r   certificates  s   
z OCSPResponseBuilder.certificatesr\   r]   r^   r_   c                 C  sN   t |tjs
tdt|j||}t|| j t| j	| j
| jg | j|S r`   )r#   r   ra   r9   rb   rc   r
   rP   rj   rq   rr   rs   rd   r   r   r   rf   +  s   z!OCSPResponseBuilder.add_extensionprivate_keyr   hashes.HashAlgorithm | NoneOCSPResponsec                 C  s6   | j d u r	td| jd u rtdttj| ||S )Nz&You must add a response before signingz*You must add a responder_id before signing)rq   r%   rr   r   create_ocsp_responser   r   )rD   r   r   r   r   r   sign;  s   


zOCSPResponseBuilder.signresponse_statusr   c                 C  s4   t |ts	td|tju rtdt|d d d S )Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r#   r   r9   r   r%   r   r   )clsr   r   r   r   build_unsuccessfulI  s   

z&OCSPResponseBuilder.build_unsuccessful)rk   rl   rm   rn   ro   rp   rK   rL   )r,   r-   r.   r-   r   r    r/   r'   r0   r1   r2   r3   r4   r3   r5   r6   r!   rj   )rv   r   rw   r-   r!   rj   )ro   rx   r!   rj   )r\   r]   r^   r_   r!   rj   )r   r   r   r   r!   r   )r   r   r!   r   )r   r   r   rE   ru   rm   r~   rf   r   classmethodr   r   r   r   r   rj      s    




rj   )r   r    r!   r"   )$
__future__r   r:   typingcryptographyr   r   "cryptography.hazmat.bindings._rustr   cryptography.hazmat.primitivesr   /cryptography.hazmat.primitives.asymmetric.typesr   cryptography.x509.baser   r	   r
   Enumr   r   SHA1SHA224SHA256SHA384SHA512r$   r&   r'   r+   rg   r   OCSPSingleResponserF   rj   load_der_ocsp_requestload_der_ocsp_responser   r   r   r   <module>   s4   

	FT}
