
    kCiA                     <   S r SSKrSSKJr  SSKrSSKrSSKrSSKJ	r	  SSK
r
SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  \R*                  " \5      rSrSr\\/r\R6                  " \R8                  S5      r\(       d  \R6                  " \R<                  \5      rS rS\ 4S jr!S\ 4S jr"Sr#Sr$\#\$0r% \&" \R6                  " SS5      5      r'Sr)Sr*S r+S r,S!S"S jjr-\'S4S jr.SSSSSS\'4S jr/S r0S r1S#S jr2S$S  jr3g! \( a    Sr' N?f = f)%zProvides helper methods for talking to the Compute Engine metadata server.

See https://cloud.google.com/compute/docs/metadata for more details.
    N)urljoin)_helpers)environment_vars)
exceptions)metrics)	transport)ExponentialBackoff)_mtlsz169.254.169.254zmetadata.google.internalc                      [         R                  " 5       n U [         R                  R                  :X  a%  [        [
        ;  a  [        R                  " S5      egg)a  Validates the GCE metadata server environment configuration for mTLS.

mTLS is only supported when connecting to the default metadata server hosts.
If we are in strict mode (which requires mTLS), ensure that the metadata host
has not been overridden to a custom value (which means mTLS will fail).

Raises:
    google.auth.exceptions.MutualTLSChannelError: if the environment
        configuration is invalid for mTLS.
zMutual TLS is required, but the metadata host has been overridden. mTLS is only supported when connecting to the default metadata host.N)r
   _parse_mds_modeMdsMtlsModeSTRICT_GCE_METADATA_HOST_GCE_DEFAULT_MDS_HOSTSr   MutualTLSChannelError)modes    `/var/www/html/land-ocr/venv/lib/python3.13/site-packages/google/auth/compute_engine/_metadata.py(_validate_gce_mds_configured_environmentr   7   sT       "Du  ''' %;;22W  <	 (    use_mtlsc                 D    U (       a  SOSnSR                  U[        5      $ )z%Returns the metadata server root URL.httpshttpz{}://{}/computeMetadata/v1/)formatr   r   schemes     r   _get_metadata_rootr   N   s!     !WfF(//8JKKr   c                     U (       a  SOSnSR                  U[        R                  " [        R                  [
        5      5      $ )z(Returns the metadata server IP root URL.r   r   z{}://{})r   osgetenvr   GCE_METADATA_IP_GCE_DEFAULT_MDS_IPr   s     r   _get_metadata_ip_rootr#   U   s6     WfF		*::<OP r   zmetadata-flavorGoogleGCE_METADATA_TIMEOUT   z/sys/class/dmi/id/product_namec                 b    [        U 5      (       a  g[        R                  S:X  a  g[        5       $ )zChecks to see if the code runs on Google Compute Engine

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.

Returns:
    bool: True if the code runs on Google Compute Engine, False otherwise.
TntF)pingr   namedetect_gce_residency_linuxrequests    r   	is_on_gcer.   m   s)     G}}	ww$ &''r   c                       [        [        S5       n U R                  5       R                  5       nSSS5        WR                  [        5      $ ! , (       d  f       N#= f! [         a     gf = f)zDetect Google Compute Engine residency by smbios check on Linux

Returns:
    bool: True if the GCE product name file is detected, False otherwise.
rNF)open_GCE_PRODUCT_NAME_FILEreadstrip	Exception
startswith_GOOGLE)file_objcontents     r   r+   r+      s\    (#.(mmo++-G / g&& /.  s-   A AA 
AA A 
A,+A,Fc                     U(       an  U R                   (       d  [        R                  " 5       U l         [        R                  " 5       n[
         H#  nU R                   R                  SU S3U5        M%     gg)a  Prepares a request for the metadata server.

This will check if mTLS should be used and mount the mTLS adapter if needed.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    use_mtls (bool): Whether to use mTLS for the request.

Returns:
    google.auth.transport.Request: A request object to use.
        If mTLS is enabled, the request will have the mTLS adapter mounted.
        Otherwise, the original request will be returned unchanged.
zhttps:///N)sessionrequestsSessionr
   MdsMtlsAdapterr   mount)r-   r   adapterhosts       r   _prepare_request_for_mdsrC      sX      &..0GO&&(*DOO!!HTF!"4g> + r   c                 
   [         R                  " 5       n[        XS9  [        R	                  5       n[
        R                  " 5       U[
        R                  '   [        US9nU Hb  n U " [        U5      SUUS9nUR                  R                  [        5      nUR                  [        R                  :H  =(       a	    U[         :H  s  $    g! ["        R$                   a#  n	[&        R)                  SUUU	5         Sn	A	M  Sn	A	ff = f)a  Checks to see if the metadata server is available.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    timeout (int): How long to wait for the metadata server to respond.
    retry_count (int): How many times to attempt connecting to metadata
        server using above timeout.

Returns:
    bool: True if the metadata server is reachable, False otherwise.
r   total_attemptsGETurlmethodheaderstimeoutJCompute Engine Metadata server unavailable on attempt %s of %s. Reason: %sNF)r
   should_use_mds_mtlsrC   _METADATA_HEADERScopyr   mds_pingAPI_CLIENT_HEADERr	   r#   rL   get_METADATA_FLAVOR_HEADERstatushttp_clientOK_METADATA_FLAVOR_VALUEr   TransportError_LOGGERwarning)
r-   rM   retry_countr   rL   backoffattemptresponsemetadata_flavores
             r   r)   r)      s     ((*HW8  $$&G)0)9)9);GG%%& <G	)(3	H '..223JKO;>>1 >#'== 0  (( 	OO/ 	s   (ACDC==D   c	                 h   [         R                  " 5       n	[        X	S9  Uc  [        U	5      n[	        5         [        X!5      n
Uc  0 OUn[        R                  5       nU(       a  UR                  U5        U(       a  SUS'   [        R                  " X5      n[        US9nSnU H  n U " USXS9nUR                  [        R                  ;   af  [        R!                  SUUUR                  5        [#        UR$                  S	5      (       a  UR$                  R'                  S
5      OUR$                  nM    O'   [(        R*                  " SR-                  X5      5      e[        R.                  " UR$                  5      nUR                  [0        R2                  :X  a  U(       a  gUR                  [0        R4                  :X  a@  [        R6                  " UR8                  S   5      S:X  a   [:        R<                  " U5      $ U$ [(        R*                  " SR-                  UUR                  UR$                  5      U5      e! [(        R*                   a&  n[        R!                  SUUU5        Un SnAGM  SnAff = f! [>         a-  n[(        R*                  " SR-                  U5      5      nUUeSnAff = f)a  Fetch a resource from the metadata server.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    path (str): The resource to retrieve. For example,
        ``'instance/service-accounts/default'``.
    root (Optional[str]): The full path to the metadata server root. If not
        provided, the default root will be used.
    params (Optional[Mapping[str, str]]): A mapping of query parameter
        keys to values.
    recursive (bool): Whether to do a recursive query of metadata. See
        https://cloud.google.com/compute/docs/metadata#aggcontents for more
        details.
    retry_count (int): How many times to attempt connecting to metadata
        server using above timeout.
    headers (Optional[Mapping[str, str]]): Headers for the request.
    return_none_for_not_found_error (Optional[bool]): If True, returns None
        for 404 error instead of throwing an exception.
    timeout (int): How long to wait, in seconds for the metadata server to respond.

Returns:
    Union[Mapping, str]: If the metadata server returns JSON, a mapping of
        the decoded JSON is returned. Otherwise, the response content is
        returned as a string.

Raises:
    google.auth.exceptions.TransportError: if an error occurred while
        retrieving metadata.
    google.auth.exceptions.MutualTLSChannelError: if using mtls and the environment
        configuration is invalid for mTLS (for example, the metadata host
        has been overridden in strict mTLS mode).

rE   Ntrue	recursiverF   rH   rI   zSCompute Engine Metadata server unavailable on attempt %s of %s. Response status: %sdecodezutf-8rN   z{Failed to retrieve {} from the Google Compute Engine metadata service. Compute Engine Metadata server unavailable due to {}zcontent-typezapplication/jsonzMReceived invalid JSON from the Google Compute Engine metadata service: {:.20}z^Failed to retrieve {} from the Google Compute Engine metadata service. Status: {} Response:
{}) r
   rO   rC   r   r   r   rP   rQ   updater   update_queryr	   rV   r   DEFAULT_RETRYABLE_STATUS_CODESr[   r\   hasattrdatarg   r   rZ   r   
from_bytesrW   	NOT_FOUNDrX   parse_content_typerL   jsonloads
ValueError)r-   pathrootparamsrf   r]   rL   return_none_for_not_found_errorrM   r   base_urlquery_paramsheaders_to_userJ   r^   failure_reasonr_   r`   rb   r9   
caught_excnew_excs                         r   rT   rT      so   Z ((*H W8|!(+
 -.t"H2VL&++-Ng&$*[!



7C <GN	~H )"J"JJ<OO x}}h77 MM((1! 
 ) @ ''UU[U[V
 	
 !!(--0G+///4S+..(''(8(8(HI!".zz'** N

#
#	55;V(--6
 	 M (( 	OO/ N	:  .$33//5vg :-.s1   (B
H=)I: =I7I22I7:
J1(J,,J1c                     [        U S5      $ )a+  Get the Google Cloud Project ID from the metadata server.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.

Returns:
    str: The project ID

Raises:
    google.auth.exceptions.TransportError: if an error occurred while
        retrieving metadata.
zproject/project-idrT   r,   s    r   get_project_idr   o  s     w,--r   c                 ,    [        U SSS9nU(       d  gU$ )a  Get the universe domain value from the metadata server.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.

Returns:
    str: The universe domain value. If the universe domain endpoint is not
    not found, return the default value, which is googleapis.com

Raises:
    google.auth.exceptions.TransportError: if an error other than
        404 occurs while retrieving metadata.
zuniverse/universe-domainT)rv   zgoogleapis.comr~   )r-   universe_domains     r   get_universe_domainr     s$     +TO r   c                 <    SR                  U5      n[        XSS0S9$ )a  Get information about a service account from the metadata server.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    service_account (str): The string 'default' or a service account email
        address. The determines which service account for which to acquire
        information.

Returns:
    Mapping: The service account's information, for example::

        {
            'email': '...',
            'scopes': ['scope', ...],
            'aliases': ['default', '...']
        }

Raises:
    google.auth.exceptions.TransportError: if an error occurred while
        retrieving metadata.
zinstance/service-accounts/{0}/rf   re   )ru   )r   rT   )r-   service_accountrs   s      r   get_service_account_infor     s(    . ,22?CD wk6%:;;r   c                    SSK Jn  0 nU(       a*  [        U[        5      (       d  SR	                  U5      nX$S'   UR                  5       nU(       a+  UR                  U5      (       a  UR                  U5      nXdS'   [        R                  [        R                  " 5       0nSR                  U5      n[        XXGS9n	[        R                  " 5       [        R                   " U	S   S	9-   n
U	S
   U
4$ )ag  Get the OAuth 2.0 access token for a service account.

Args:
    request (google.auth.transport.Request): A callable used to make
        HTTP requests.
    service_account (str): The string 'default' or a service account email
        address. The determines which service account for which to acquire
        an access token.
    scopes (Optional[Union[str, List[str]]]): Optional string or list of
        strings with auth scopes.
Returns:
    Tuple[str, datetime]: The access token and its expiration.

Raises:
    google.auth.exceptions.TransportError: if an error occurred while
        retrieving metadata.
r   )_agent_identity_utils,scopesbindCertificateFingerprintz#instance/service-accounts/{0}/token)ru   rL   
expires_in)secondsaccess_token)google.authr   
isinstancestrjoin(get_and_parse_agent_identity_certificateshould_request_bound_token!calculate_certificate_fingerprintr   rS   token_request_access_token_mdsr   rT   r   utcnowdatetime	timedelta)r-   r   r   r   ru   certfingerprintmetrics_headerrs   
token_jsontoken_expirys              r   get_service_account_tokenr     s    $ 2F&#&&XXf%F!x IIKD ;;DAA/QQRVWK3>/0 	!!7#I#I#KN 177HDW6JJ??$x'9'9<(( L n%|33r   )F)returnN)default)r   N)4__doc__r   http.clientclientrW   rp   loggingr   urllib.parser   r=   r   r   r   r   r   r    google.auth._exponential_backoffr	   google.auth.compute_enginer
   	getLogger__name__r[   r"   _GCE_DEFAULT_HOSTr   r    GCE_METADATA_HOSTr   GCE_METADATA_ROOTr   boolr   r#   rU   rY   rP   int_METADATA_DEFAULT_TIMEOUTrr   r7   r2   r.   r+   rC   r)   rT   r   r   r   r    r   r   <module>r      s`  
  !   	      ( "  ! ? , 

H
%' . +-@A  YY/AA4H **,=
.L LD  , ! ,.DE " #BII.Da$H I
 9 (*' ?6 4 2p 
$)%JZ.".<:)4_
  " !"s   D DD