<s> """<STR_LIT>""" <EOL> import os <EOL> import time <EOL> from google . appengine . api import apiproxy_stub_map <EOL> from google . appengine . api import memcache <EOL> from google . appengine . api . app_identity import app_identity_service_pb <EOL> from google . appengine . runtime import apiproxy_errors <EOL> __all__ = [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> ] <EOL> _APP_IDENTITY_SERVICE_NAME = '<STR_LIT>' <EOL> _SIGN_FOR_APP_METHOD_NAME = '<STR_LIT>' <EOL> _GET_CERTS_METHOD_NAME = '<STR_LIT>' <EOL> _GET_SERVICE_ACCOUNT_NAME_METHOD_NAME = '<STR_LIT>' <EOL> _GET_DEFAULT_GCS_BUCKET_NAME_METHOD_NAME = '<STR_LIT>' <EOL> _GET_ACCESS_TOKEN_METHOD_NAME = '<STR_LIT>' <EOL> _PARTITION_SEPARATOR = '<STR_LIT>' <EOL> _DOMAIN_SEPARATOR = '<STR_LIT::>' <EOL> _MEMCACHE_KEY_PREFIX = '<STR_LIT>' <EOL> _MEMCACHE_NAMESPACE = '<STR_LIT>' <EOL> _TOKEN_EXPIRY_SAFETY_MARGIN = <NUM_LIT> <EOL> _MAX_TOKEN_CACHE_SIZE = <NUM_LIT:100> <EOL> _MAX_RANDOM_EXPIRY_DELTA = <NUM_LIT> <EOL> _access_token_cache = { } <EOL> _random_cache_expiry_delta = ( <EOL> hash ( time . time ( ) ) % ( _MAX_RANDOM_EXPIRY_DELTA * <NUM_LIT:1000> ) / <NUM_LIT> ) <EOL> class Error ( Exception ) : <EOL> """<STR_LIT>""" <EOL> class BackendDeadlineExceeded ( Error ) : <EOL> """<STR_LIT>""" <EOL> class BlobSizeTooLarge ( Error ) : <EOL> """<STR_LIT>""" <EOL> class InternalError ( Error ) : <EOL> """<STR_LIT>""" <EOL> class InvalidScope ( Error ) : <EOL> """<STR_LIT>""" <EOL> class NotAllowed ( Error ) : <EOL> """<STR_LIT>""" <EOL> class OperationNotImplemented ( Error ) : <EOL> """<STR_LIT>""" <EOL> def _to_app_identity_error ( error ) : <EOL> """<STR_LIT>""" <EOL> error_map = { <EOL> app_identity_service_pb . AppIdentityServiceError . NOT_A_VALID_APP : <EOL> InternalError , <EOL> app_identity_service_pb . AppIdentityServiceError . DEADLINE_EXCEEDED : <EOL> BackendDeadlineExceeded , <EOL> app_identity_service_pb . AppIdentityServiceError . BLOB_TOO_LARGE : <EOL> BlobSizeTooLarge , <EOL> app_identity_service_pb . AppIdentityServiceError . UNKNOWN_ERROR : <EOL> InternalError , <EOL> app_identity_service_pb . AppIdentityServiceError . UNKNOWN_SCOPE : <EOL> InvalidScope , <EOL> app_identity_service_pb . AppIdentityServiceError . NOT_ALLOWED : <EOL> NotAllowed , <EOL> app_identity_service_pb . AppIdentityServiceError . NOT_IMPLEMENTED : <EOL> OperationNotImplemented , <EOL> } <EOL> if error . application_error in error_map : <EOL> return error_map [ error . application_error ] ( error . error_detail ) <EOL> else : <EOL> return InternalError ( '<STR_LIT>' % <EOL> ( error . application_error , error . error_detail ) ) <EOL> class PublicCertificate ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , key_name , x509_certificate_pem ) : <EOL> self . key_name = key_name <EOL> self . x509_certificate_pem = x509_certificate_pem <EOL> def create_rpc ( deadline = None , callback = None ) : <EOL> """<STR_LIT>""" <EOL> return apiproxy_stub_map . UserRPC ( _APP_IDENTITY_SERVICE_NAME , <EOL> deadline , callback ) <EOL> def make_sign_blob_call ( rpc , bytes_to_sign ) : <EOL> """<STR_LIT>""" <EOL> if not isinstance ( bytes_to_sign , str ) : <EOL> raise TypeError ( '<STR_LIT>' <EOL> % bytes_to_sign ) <EOL> request = app_identity_service_pb . SignForAppRequest ( ) <EOL> request . set_bytes_to_sign ( bytes_to_sign ) <EOL> response = app_identity_service_pb . SignForAppResponse ( ) <EOL> def signing_for_app_result ( rpc ) : <EOL> """<STR_LIT>""" <EOL> assert rpc . service == _APP_IDENTITY_SERVICE_NAME , repr ( rpc . service ) <EOL> assert rpc . method == _SIGN_FOR_APP_METHOD_NAME , repr ( rpc . method ) <EOL> try : <EOL> rpc . check_success ( ) <EOL> except apiproxy_errors . ApplicationError , err : <EOL> raise _to_app_identity_error ( err ) <EOL> return ( response . key_name ( ) , response . signature_bytes ( ) ) <EOL> rpc . make_call ( _SIGN_FOR_APP_METHOD_NAME , request , <EOL> response , signing_for_app_result ) <EOL> def make_get_public_certificates_call ( rpc ) : <EOL> """<STR_LIT>""" <EOL> request = app_identity_service_pb . GetPublicCertificateForAppRequest ( ) <EOL> response = app_identity_service_pb . GetPublicCertificateForAppResponse ( ) <EOL> def get_certs_result ( rpc ) : <EOL> """<STR_LIT>""" <EOL> assert rpc . service == _APP_IDENTITY_SERVICE_NAME , repr ( rpc . service ) <EOL> assert rpc . method == _GET_CERTS_METHOD_NAME , repr ( rpc . method ) <EOL> try : <EOL> rpc . check_success ( ) <EOL> except apiproxy_errors . ApplicationError , err : <EOL> raise _to_app_identity_error ( err ) <EOL> result = [ ] <EOL> for cert in response . public_certificate_list_list ( ) : <EOL> result . append ( PublicCertificate ( <EOL> cert . key_name ( ) , cert . x509_certificate_pem ( ) ) ) <EOL> return result <EOL> rpc . make_call ( _GET_CERTS_METHOD_NAME , request , response , get_certs_result ) <EOL> def make_get_service_account_name_call ( rpc ) : <EOL> """<STR_LIT>""" <EOL> request = app_identity_service_pb . GetServiceAccountNameRequest ( ) <EOL> response = app_identity_service_pb . GetServiceAccountNameResponse ( ) <EOL> if rpc . deadline is not None : <EOL> request . set_deadline ( rpc . deadline ) <EOL> def get_service_account_name_result ( rpc ) : <EOL> """<STR_LIT>""" <EOL> assert rpc . service == _APP_IDENTITY_SERVICE_NAME , repr ( rpc . service ) <EOL> assert rpc . method == _GET_SERVICE_ACCOUNT_NAME_METHOD_NAME , repr ( rpc . method ) <EOL> try : <EOL> rpc . check_success ( ) <EOL> except apiproxy_errors . ApplicationError , err : <EOL> raise _to_app_identity_error ( err ) <EOL> return response . service_account_name ( ) <EOL> rpc . make_call ( _GET_SERVICE_ACCOUNT_NAME_METHOD_NAME , request , <EOL> response , get_service_account_name_result ) <EOL> def make_get_default_gcs_bucket_name_call ( rpc ) : <EOL> """<STR_LIT>""" <EOL> request = app_identity_service_pb . GetDefaultGcsBucketNameRequest ( ) <EOL> response = app_identity_service_pb . GetDefaultGcsBucketNameResponse ( ) <EOL> if rpc . deadline is not None : <EOL> request . set_deadline ( rpc . deadline ) <EOL> def get_default_gcs_bucket_name_result ( rpc ) : <EOL> """<STR_LIT>""" <EOL> assert rpc . service == _APP_IDENTITY_SERVICE_NAME , repr ( rpc . service ) <EOL> assert rpc . method == _GET_DEFAULT_GCS_BUCKET_NAME_METHOD_NAME , ( <EOL> repr ( rpc . method ) ) <EOL> try : <EOL> rpc . check_success ( ) <EOL> except apiproxy_errors . ApplicationError , err : <EOL> raise _to_app_identity_error ( err ) <EOL> return response . default_gcs_bucket_name ( ) or None <EOL> rpc . make_call ( _GET_DEFAULT_GCS_BUCKET_NAME_METHOD_NAME , request , <EOL> response , get_default_gcs_bucket_name_result ) <EOL> def sign_blob ( bytes_to_sign , deadline = None ) : <EOL> """<STR_LIT>""" <EOL> rpc = create_rpc ( deadline ) <EOL> make_sign_blob_call ( rpc , bytes_to_sign ) <EOL> rpc . wait ( ) <EOL> return rpc . get_result ( ) <EOL> def get_public_certificates ( deadline = None ) : <EOL> """<STR_LIT>""" <EOL> rpc = create_rpc ( deadline ) <EOL> make_get_public_certificates_call ( rpc ) <EOL> rpc . wait ( ) <EOL> return rpc . get_result ( ) <EOL> def get_service_account_name ( deadline = None ) : <EOL> """<STR_LIT>""" <EOL> rpc = create_rpc ( deadline ) <EOL> make_get_service_account_name_call ( rpc ) <EOL> rpc . wait ( ) <EOL> return rpc . get_result ( ) <EOL> def get_default_gcs_bucket_name ( deadline = None ) : <EOL> """<STR_LIT>""" <EOL> rpc = create_rpc ( deadline ) <EOL> make_get_default_gcs_bucket_name_call ( rpc ) <EOL> rpc . wait ( ) <EOL> return rpc . get_result ( ) <EOL> def _ParseFullAppId ( app_id ) : <EOL> """<STR_LIT>""" <EOL> partition = '<STR_LIT>' <EOL> psep = app_id . find ( _PARTITION_SEPARATOR ) <EOL> if psep > <NUM_LIT:0> : <EOL> partition = app_id [ : psep ] <EOL> app_id = app_id [ psep + <NUM_LIT:1> : ] <EOL> domain_name = '<STR_LIT>' <EOL> dsep = app_id . find ( _DOMAIN_SEPARATOR ) <EOL> if dsep > <NUM_LIT:0> : <EOL> domain_name = app_id [ : dsep ] <EOL> app_id = app_id [ dsep + <NUM_LIT:1> : ] <EOL> return partition , domain_name , app_id <EOL> def get_application_id ( ) : <EOL> """<STR_LIT>""" <EOL> full_app_id = os . getenv ( '<STR_LIT>' ) <EOL> _ , domain_name , display_app_id = _ParseFullAppId ( full_app_id ) <EOL> if domain_name : <EOL> return '<STR_LIT>' % ( domain_name , _DOMAIN_SEPARATOR , display_app_id ) <EOL> return display_app_id <EOL> def get_default_version_hostname ( ) : <EOL> """<STR_LIT>""" <EOL> return os . getenv ( '<STR_LIT>' ) <EOL> def make_get_access_token_call ( rpc , scopes , service_account_id = None ) : <EOL> """<STR_LIT>""" <EOL> request = app_identity_service_pb . GetAccessTokenRequest ( ) <EOL> if not scopes : <EOL> raise InvalidScope ( '<STR_LIT>' ) <EOL> if isinstance ( scopes , basestring ) : <EOL> request . add_scope ( scopes ) <EOL> else : <EOL> for scope in scopes : <EOL> request . add_scope ( scope ) <EOL> if service_account_id : <EOL> if isinstance ( service_account_id , ( int , long ) ) : <EOL> request . set_service_account_id ( service_account_id ) <EOL> elif isinstance ( service_account_id , basestring ) : <EOL> request . set_service_account_name ( service_account_id ) <EOL> else : <EOL> raise TypeError ( ) <EOL> response = app_identity_service_pb . GetAccessTokenResponse ( ) <EOL> def get_access_token_result ( rpc ) : <EOL> """<STR_LIT>""" <EOL> assert rpc . service == _APP_IDENTITY_SERVICE_NAME , repr ( rpc . service ) <EOL> assert rpc . method == _GET_ACCESS_TOKEN_METHOD_NAME , repr ( rpc . method ) <EOL> try : <EOL> rpc . check_success ( ) <EOL> except apiproxy_errors . ApplicationError , err : <EOL> raise _to_app_identity_error ( err ) <EOL> return response . access_token ( ) , response . expiration_time ( ) <EOL> rpc . make_call ( _GET_ACCESS_TOKEN_METHOD_NAME , request , <EOL> response , get_access_token_result ) <EOL> def get_access_token_uncached ( scopes , deadline = None , service_account_id = None ) : <EOL> """<STR_LIT>""" <EOL> rpc = create_rpc ( deadline ) <EOL> make_get_access_token_call ( rpc , scopes , service_account_id = service_account_id ) <EOL> rpc . wait ( ) <EOL> return rpc . get_result ( ) <EOL> def get_access_token ( scopes , service_account_id = None ) : <EOL> """<STR_LIT>""" <EOL> cache_key = _MEMCACHE_KEY_PREFIX + str ( scopes ) <EOL> if service_account_id : <EOL> cache_key += '<STR_LIT>' % service_account_id <EOL> cached = _access_token_cache . get ( cache_key ) <EOL> if cached is not None : <EOL> access_token , expires_at = cached <EOL> safe_expiry = ( expires_at - _TOKEN_EXPIRY_SAFETY_MARGIN - <EOL> _random_cache_expiry_delta ) <EOL> if time . time ( ) < safe_expiry : <EOL> return access_token , expires_at <EOL> memcache_value = memcache . get ( cache_key , namespace = _MEMCACHE_NAMESPACE ) <EOL> if memcache_value : <EOL> access_token , expires_at = memcache_value <EOL> else : <EOL> access_token , expires_at = get_access_token_uncached ( <EOL> scopes , service_account_id = service_account_id ) <EOL> memcache_expiry = expires_at - _TOKEN_EXPIRY_SAFETY_MARGIN <EOL> memcache_expiry -= _MAX_RANDOM_EXPIRY_DELTA <EOL> memcache_expiry -= <NUM_LIT:10> <EOL> memcache . add ( cache_key , ( access_token , expires_at ) , <EOL> memcache_expiry , <EOL> namespace = _MEMCACHE_NAMESPACE ) <EOL> if len ( _access_token_cache ) >= _MAX_TOKEN_CACHE_SIZE : <EOL> _access_token_cache . clear ( ) <EOL> _access_token_cache [ cache_key ] = ( access_token , expires_at ) <EOL> return access_token , expires_at </s>
