+
    i                        R t ^ RIt^ RIHt ^ RIt^ RIHt ^ RIHt ^ RIH	t	 ^ RIH
t
 ^ RIHt ^ RIHt ]P                  ]P                  ]P                   ]P"                  0tR.t]! ]R	4      '       d(   ]P*                  ! 4       '       d   R
]	P,                   2tMR]	P,                   2tR] R2t]R,           t]R,           t]R,           t]R,           t ! R R]
P:                  4      tR# )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)_mtls_helperz#https://www.googleapis.com/auth/iamcheck_use_client_certziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                      a  ] tR t^?t o RtR tR t]R 4       t]	P                  ! ]P                  4      R 4       tRtV tR# )Signera  Signs messages using the IAM `signBlob API`_.

This is useful when you need to sign bytes but do not have access to the
credential's private key file.

.. _signBlob API:
    https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
    /signBlob
c                *    Wn         W n        W0n        R# )au  
Args:
    request (google.auth.transport.Request): The object used to make
        HTTP requests.
    credentials (google.auth.credentials.Credentials): The credentials
        that will be used to authenticate the request to the IAM API.
        The credentials must have of one the following scopes:

        - https://www.googleapis.com/auth/iam
        - https://www.googleapis.com/auth/cloud-platform
    service_account_email (str): The service account email identifying
        which service account to use to sign bytes. Often, this can
        be the same as the service account email in the given
        credentials.
N)_request_credentials_service_account_email)selfrequestr   service_account_emails   &&&&b/Users/igloo/.openclaw/workspace/scratch/fb_ad_env/lib/python3.14/site-packages/google/auth/iam.py__init__Signer.__init__J   s       '&;#    c                t   \         P                  ! V4      pRp\        P                  \        P
                  V P                  P                  4      P                  V P                  4      pRR/p\        P                  ! R\        P                  ! V4      P                  R4      /4      P                  R4      p\         P"                  ! 4       pV F  pV P                  P%                  V P&                  W#V4       V P'                  W2WTR7      pVP(                  \*        9   d   KT  VP(                  \,        P.                  8w  d0   \0        P2                  ! RP                  VP4                  4      4      h\        P6                  ! VP4                  P                  R4      4      u # 	  \0        P2                  ! R4      h)	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	   &&       r   _make_signing_requestSigner._make_signing_request^   sV   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99;A,,T]]FQ}}$}XH/1+..0 //<CCHMMR  ::hmm227;<<  ''(MNNr   c                    R# )zOptional[str]: The key ID used to identify this private key.

.. warning::
   This is always ``None``. The key ID used by IAM can not
   be reliably determined ahead of time.
N )r   s   &r   key_idSigner.key_id|   s     r   c                ^    V P                  V4      p\        P                  ! VR ,          4      # )
signedBlob)r6   r%   	b64decode)r   r2   r5   s   && r   signSigner.sign   s(    --g6 677r   )r   r   r   N)__name__
__module____qualname____firstlineno____doc__r   r6   propertyr:   r   copy_docstringr   r
   r?   __static_attributes____classdictcell__)__classdict__s   @r   r
   r
   ?   sL     <(O<   U\\*8 +8r   r
   )rE   r%   http.clientclientr-   r#   google.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr,   
_IAM_SCOPEhasattrr   r    _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr
   r9   r   r   <module>rZ      s     !  ,   #  " . %%##	 44
 L122**,, ))L)L(MNK#K$G$G#HIK ;-'JK  66"[0 %
2 %(:: J8U\\ J8r   