+
    ‡åºi®5  ã                   óè   € R t ^ RIHt ^ RIt^ RIHt ^ RIHt ^ RIH	t	  ^ RI
t
]P                  ! ]4      t ! R R]
P                   4      tRR	 lt ! R
 R4      tR#   ] d   t]! R4      ]hRtAii ; i)zAuthorization support for gRPC.)Úabsolute_importN)Ú
exceptions)Ú_mtls_helper)Úservice_accountzWgRPC is not installed from please install the grpcio package to use the gRPC transport.c                   óF   a a€ ] tR t^#t oRtRV 3R lltR tR tRtVt	V ;t
# )ÚAuthMetadataPlugina>  A `gRPC AuthMetadataPlugin`_ that inserts the credentials into each
request.

.. _gRPC AuthMetadataPlugin:
    http://www.grpc.io/grpc/python/grpc.html#grpc.AuthMetadataPlugin

Args:
    credentials (google.auth.credentials.Credentials): The credentials to
        add to requests.
    request (google.auth.transport.Request): A HTTP transport request
        object used to refresh credentials as needed.
    default_host (Optional[str]): A host like "pubsub.googleapis.com".
        This is used when a self-signed JWT is created from service
        account credentials.
c                óP   <€ \         \        V `  4        Wn        W n        W0n        R # ©N)Úsuperr   Ú__init__Ú_credentialsÚ_requestÚ_default_host)ÚselfÚcredentialsÚrequestÚdefault_hostÚ	__class__s   &&&&€Úm/Users/igloo/.openclaw/workspace/scratch/fb_ad_env/lib/python3.14/site-packages/google/auth/transport/grpc.pyr   ÚAuthMetadataPlugin.__init__4   s$   ø€ ô 	Ô  $Ñ0Ô2Ø'ÔØŒØ)Öó    c                ó”  € / p\        V P                  \        P                  4      '       dI   V P                  P	                  V P
                  '       d   RP                  V P
                  4      MR4       V P                  P                  V P                  VP                  VP                  V4       \        VP                  4       4      # )zGets the authorization headers for a request.

Returns:
    Sequence[Tuple[str, str]]: A list of request headers (key, value)
        to add to the request.
zhttps://{}/N)Ú
isinstancer   r   ÚCredentialsÚ_create_self_signed_jwtr   ÚformatÚbefore_requestr   Úmethod_nameÚservice_urlÚlistÚitems)r   ÚcontextÚheaderss   && r   Ú_get_authorization_headersÚ-AuthMetadataPlugin._get_authorization_headers=   sœ   € ð ˆô d×'Ñ'¬×)DÑ)D×EÒEØ×Ñ×5Ñ5Ø<@×<N×<NÐ<N×$Ñ$ T×%7Ñ%7Ô8ÐTXôð 	×Ñ×(Ñ(ØM‰M˜7×.Ñ.°×0CÑ0CÀWô	
ô G—M‘M“OÓ$Ð$r   c                ó6   € V! V P                  V4      R4       R# )zøPasses authorization metadata into the given callback.

Args:
    context (grpc.AuthMetadataContext): The RPC context.
    callback (grpc.AuthMetadataPluginCallback): The callback that will
        be invoked to pass in the authorization metadata.
N)r#   )r   r!   Úcallbacks   &&&r   Ú__call__ÚAuthMetadataPlugin.__call__U   s   € ñ 	×0Ñ0°Ó9¸4Ö@r   )r   r   r   r	   )Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r   r#   r'   Ú__static_attributes__Ú__classdictcell__Ú__classcell__)r   Ú__classdict__s   @@r   r   r   #   s    ù‡ € ñ÷ *ò%÷0Aò Ar   r   c                óî  € \        W4      p\        P                  ! V4      pV'       d   V'       d   \        P                  ! R4      hV'       g{   \
        P                  ! 4       pV'       d*   V'       d"   V! 4       w  rš\        P                  ! WšR7      pM4V'       d   \        4       pVP                  pM\        P                  ! 4       p\        P                  ! W74      p\        P                  ! W,3/ VB # )a½  Creates a secure authorized gRPC channel.

This creates a channel with SSL and :class:`AuthMetadataPlugin`. This
channel can be used to create a stub that can make authorized requests.
Users can configure client certificate or rely on device certificates to
establish a mutual TLS channel, if the `GOOGLE_API_USE_CLIENT_CERTIFICATE`
variable is explicitly set to `true`.

Example::

    import google.auth
    import google.auth.transport.grpc
    import google.auth.transport.requests
    from google.cloud.speech.v1 import cloud_speech_pb2

    # Get credentials.
    credentials, _ = google.auth.default()

    # Get an HTTP request function to refresh credentials.
    request = google.auth.transport.requests.Request()

    # Create a channel.
    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, regular_endpoint, request,
        ssl_credentials=grpc.ssl_channel_credentials())

    # Use the channel to create a stub.
    cloud_speech.create_Speech_stub(channel)

Usage:

There are actually a couple of options to create a channel, depending on if
you want to create a regular or mutual TLS channel.

First let's list the endpoints (regular vs mutual TLS) to choose from::

    regular_endpoint = 'speech.googleapis.com:443'
    mtls_endpoint = 'speech.mtls.googleapis.com:443'

Option 1: create a regular (non-mutual) TLS channel by explicitly setting
the ssl_credentials::

    regular_ssl_credentials = grpc.ssl_channel_credentials()

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, request, regular_endpoint,
        ssl_credentials=regular_ssl_credentials)

Option 2: create a mutual TLS channel by calling a callback which returns
the client side certificate and the key (Note that
`GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly
set to `true`)::

    def my_client_cert_callback():
        code_to_load_client_cert_and_key()
        if loaded:
            return (pem_cert_bytes, pem_key_bytes)
        raise MyClientCertFailureException()

    try:
        channel = google.auth.transport.grpc.secure_authorized_channel(
            credentials, request, mtls_endpoint,
            client_cert_callback=my_client_cert_callback)
    except MyClientCertFailureException:
        # handle the exception

Option 3: use application default SSL credentials. It searches and uses
the command in a context aware metadata file, which is available on devices
with endpoint verification support (Note that
`GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly
set to `true`).
See https://cloud.google.com/endpoint-verification/docs/overview::

    try:
        default_ssl_credentials = SslCredentials()
    except:
        # Exception can be raised if the context aware metadata is malformed.
        # See :class:`SslCredentials` for the possible exceptions.

    # Choose the endpoint based on the SSL credentials type.
    if default_ssl_credentials.is_mtls:
        endpoint_to_use = mtls_endpoint
    else:
        endpoint_to_use = regular_endpoint
    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, request, endpoint_to_use,
        ssl_credentials=default_ssl_credentials)

Option 4: not setting ssl_credentials and client_cert_callback. For devices
without endpoint verification support or `GOOGLE_API_USE_CLIENT_CERTIFICATE`
environment variable is not `true`, a regular TLS channel is created;
otherwise, a mutual TLS channel is created, however, the call should be
wrapped in a try/except block in case of malformed context aware metadata.

The following code uses regular_endpoint, it works the same no matter the
created channle is regular or mutual TLS. Regular endpoint ignores client
certificate and key::

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, request, regular_endpoint)

The following code uses mtls_endpoint, if the created channle is regular,
and API mtls_endpoint is confgured to require client SSL credentials, API
calls using this channel will be rejected::

    channel = google.auth.transport.grpc.secure_authorized_channel(
        credentials, request, mtls_endpoint)

Args:
    credentials (google.auth.credentials.Credentials): The credentials to
        add to requests.
    request (google.auth.transport.Request): A HTTP transport request
        object used to refresh credentials as needed. Even though gRPC
        is a separate transport, there's no way to refresh the credentials
        without using a standard http transport.
    target (str): The host and port of the service.
    ssl_credentials (grpc.ChannelCredentials): Optional SSL channel
        credentials. This can be used to specify different certificates.
        This argument is mutually exclusive with client_cert_callback;
        providing both will raise an exception.
        If ssl_credentials and client_cert_callback are None, application
        default SSL credentials are used if `GOOGLE_API_USE_CLIENT_CERTIFICATE`
        environment variable is explicitly set to `true`, otherwise one way TLS
        SSL credentials are used.
    client_cert_callback (Callable[[], (bytes, bytes)]): Optional
        callback function to obtain client certicate and key for mutual TLS
        connection. This argument is mutually exclusive with
        ssl_credentials; providing both will raise an exception.
        This argument does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE`
        environment variable is explicitly set to `true`.
    kwargs: Additional arguments to pass to :func:`grpc.secure_channel`.

Returns:
    grpc.Channel: The created gRPC channel.

Raises:
    google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
        creation failed for any reason.
zUReceived both ssl_credentials and client_cert_callback; these are mutually exclusive.©Úcertificate_chainÚprivate_key)r   ÚgrpcÚmetadata_call_credentialsr   ÚMalformedErrorr   Úcheck_use_client_certÚssl_channel_credentialsÚSslCredentialsÚssl_credentialsÚcomposite_channel_credentialsÚsecure_channel)r   r   Útargetr<   Úclient_cert_callbackÚkwargsÚmetadata_pluginÚgoogle_auth_credentialsÚuse_client_certÚcertÚkeyÚadc_ssl_credentilsÚcomposite_credentialss   &&&&&,       r   Úsecure_authorized_channelrI   `   sË   € ôh )¨Ó>€Oô #×<Ò<¸_ÓMÐç×/Ü×'Ò'ð,ó
ð 	
÷ Ü&×<Ò<Ó>ˆß×3á,Ó.‰IˆDÜ"×:Ò:Ø"&ô‰O÷ ä!/Ó!1ÐØ0×@Ñ@‰Oä"×:Ò:Ó<ˆOô !×>Ò>ØóÐô ×Ò˜vÑGÀÑGÐGr   c                   óJ   a € ] tR tRt o RtR t]R 4       t]R 4       tRt	V t
R# )r;   i  a"  Class for application default SSL credentials.

The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment
variable whose default value is `false`. Client certificate will not be used
unless the environment variable is explicitly set to `true`. See
https://google.aip.dev/auth/4114

If the environment variable is `true`, then for devices with endpoint verification
support, a device certificate will be automatically loaded and mutual TLS will
be established.
See https://cloud.google.com/endpoint-verification/docs/overview.
c                ó¬   € \         P                  ! 4       pV'       g
   R V n        R# \         P                  ! \         P                  4      pVRJV n        R# )FN)r   r9   Ú_is_mtlsÚ_check_config_pathÚCONTEXT_AWARE_METADATA_PATH)r   rD   Úmetadata_paths   &  r   r   ÚSslCredentials.__init__%  sC   € Ü&×<Ò<Ó>ˆßØ!ˆDŽMô )×;Ò;Ü×8Ñ8óˆMð *°Ð5ˆDŽMr   c                ó^  € V P                   '       dB    \        P                  ! 4       w  rr1\        P                  ! W#R7      V n        V P
                  # \        P                  ! 4       V n        V P
                  #   \        P                   d   p\        P                  ! T4      pYThRp?ii ; i)aÏ  Get the created SSL channel credentials.

For devices with endpoint verification support, if the device certificate
loading has any problems, corresponding exceptions will be raised. For
a device without endpoint verification support, no exceptions will be
raised.

Returns:
    grpc.ChannelCredentials: The created grpc channel credentials.

Raises:
    google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
        creation failed for any reason.
r3   N)	rL   r   Úget_client_ssl_credentialsr6   r:   Ú_ssl_credentialsr   ÚClientCertErrorÚMutualTLSChannelError)r   Ú_rE   rF   Ú
caught_excÚnew_excs   &     r   r<   ÚSslCredentials.ssl_credentials0  s•   € ð  ==ˆ=ð.Ü".×"IÒ"IÓ"K‘˜Ü(,×(DÒ(DØ&*ô)Ô%ð ×$Ñ$Ð$ô %)×$@Ò$@Ó$BˆDÔ!à×$Ñ$Ð$øô ×-Ñ-ô .Ü$×:Ò:¸:ÓFØÐ-ûð.ús   ”4A: Á:B,ÂB'Â'B,c                ó   € V P                   # )z?Indicates if the created SSL channel credentials is mutual TLS.)rL   )r   s   &r   Úis_mtlsÚSslCredentials.is_mtlsN  s   € ð }‰}Ðr   )rL   rS   N)r)   r*   r+   r,   r-   r   Úpropertyr<   r[   r.   r/   )r1   s   @r   r;   r;     s7   ø‡ € ñò	6ð ñ%ó ð%ð: ñó ör   r;   )NN)r-   Ú
__future__r   ÚloggingÚgoogle.authr   Úgoogle.auth.transportr   Úgoogle.oauth2r   r6   ÚImportErrorrW   Ú	getLoggerr)   Ú_LOGGERr   rI   r;   © r   r   Ú<module>rg      s€   ðñ &å &ã å "Ý .Ý )ðÛð ×
Ò
˜HÓ
%€ô:A˜×0Ñ0ô :AôztH÷n:ó :øðy ô Ù
Øaóàðûðús    A ÁA1Á#	A,Á,A1