Module Expr Str Import alias TryExcept body Import alias handlers ExceptHandler type NameLoad body Import alias identifier Import alias Import alias Import alias Import alias Import alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias TryExcept body ImportFrom alias ImportFrom alias Assign NameStore NameLoad handlers ExceptHandler type NameLoad body Assign NameStore NameLoad Assign NameStore ListLoad Str Assign NameStore Num Assign NameStore Num Assign NameStore Str Assign NameStore Str Assign NameStore Str Assign NameStore Str Assign NameStore Str Assign NameStore Str ClassDef bases NameLoad body Pass decorator_list FunctionDef arguments args defaults body Expr Str If UnaryOpNot Call NameLoad body Expr Call AttributeLoad NameLoad attr Str Return NameLoad If CompareIn NameLoad AttributeLoad NameLoad attr body Return Call AttributeLoad NameLoad attr SubscriptLoad AttributeLoad NameLoad attr Index NameLoad If BoolOpAnd CompareIn NameLoad AttributeLoad NameLoad attr CompareIn NameLoad AttributeLoad NameLoad attr body If UnaryOpNot SubscriptLoad AttributeLoad NameLoad attr Index NameLoad body Return NameLoad Return Call AttributeLoad NameLoad attr SubscriptLoad AttributeLoad NameLoad attr Index NameLoad BoolOpOr SubscriptLoad AttributeLoad NameLoad attr Index NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args defaults body Expr Str Return BoolOpOr BoolOpAnd CompareIn NameLoad AttributeLoad NameLoad attr CompareIn NameLoad AttributeLoad NameLoad attr CompareIn NameLoad AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call NameLoad body Return Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad Str Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad Str TryExcept body Assign NameStore BoolOpOr NameLoad AttributeLoad AttributeLoad NameLoad attr attr handlers ExceptHandler type NameLoad body Expr Call AttributeLoad NameLoad attr Str AttributeLoad NameLoad attr Assign NameStore AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore AttributeLoad AttributeLoad NameLoad attr attr orelse Assign NameStore IfExp CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr Assign NameStore IfExp CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr Assign NameStore IfExp CompareIsNot AttributeLoad AttributeLoad NameLoad attr attr NameLoad AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr If BoolOpAnd UnaryOpNot NameLoad UnaryOpNot NameLoad UnaryOpNot NameLoad body Return Assign NameStore Call NameLoad NameLoad If UnaryOpNot NameLoad body Return NameLoad If BoolOpAnd BoolOpOr CompareEq NameLoad ListLoad NameLoad CompareEq NameLoad TupleLoad NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr Assign NameStore Call NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad If NameLoad body Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad Call AttributeLoad NameLoad attr Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad Call AttributeLoad NameLoad attr Return If NameLoad body Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad NameLoad Call AttributeLoad NameLoad attr Dict Str NameLoad If CompareEq AttributeLoad NameLoad attr Num body Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Expr Call NameLoad NameLoad NameLoad NameLoad NameLoad Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Str If NameLoad body Assign NameStore TupleLoad Str Str For NameStore NameLoad body If Call AttributeLoad NameLoad attr NameLoad body Return SubscriptLoad NameLoad Slice BinOpAdd Call NameLoad NameLoad Num Return NameLoad If NameLoad body For NameStore TupleLoad Str Str body Assign TupleStore NameStore NameStore Call AttributeLoad NameLoad attr NameLoad If NameLoad body Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam defaults body Expr Str TryExcept body Assign NameStore Call NameLoad NameLoad NameLoad NameLoad handlers ExceptHandler type NameLoad name NameStore body Expr Call AttributeLoad NameLoad attr Str NameLoad Return NameLoad ExceptHandler body Expr Call AttributeLoad NameLoad attr Str Return NameLoad If Call NameLoad NameLoad NameLoad NameLoad body Assign NameStore SubscriptLoad NameLoad Index Str Return Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam defaults body Expr Str If CompareNotIn Str NameLoad body Expr Call AttributeLoad NameLoad attr Str Return If UnaryOpNot Call AttributeLoad NameLoad attr Str body Expr Call AttributeLoad NameLoad attr Str Return If BoolOpOr NameLoad NameLoad body If CompareNotIn Str NameLoad body Expr Call AttributeLoad NameLoad attr Str Return If CompareIn SubscriptLoad NameLoad Index Str NameLoad body Pass orelse If BoolOpAnd CompareEq SubscriptLoad NameLoad Index Str Call AttributeLoad NameLoad attr Str CompareIsNot NameLoad NameLoad CompareIn SubscriptLoad NameLoad Index Str NameLoad body Pass orelse Expr Call AttributeLoad NameLoad attr Str Return Assign NameStore Call AttributeLoad Call AttributeLoad NameLoad attr Str Str attr Str If UnaryOpNot Call NameLoad GeneratorExp CompareIn NameLoad NameLoad comprehension NameStore NameLoad body Expr Call AttributeLoad NameLoad attr Str Return If NameLoad body Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad SubscriptLoad NameLoad Index Str Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad Str Return For NameStore NameLoad body TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore NameLoad Break handlers ExceptHandler type AttributeLoad NameLoad attr body Pass orelse Expr Call AttributeLoad NameLoad attr Str Return NameLoad If CompareEq Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str body Assign SubscriptStore AttributeLoad NameLoad attr Index NameLoad NameLoad Return Expr Call AttributeLoad NameLoad attr Str Return NameLoad decorator_list FunctionDef arguments args defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr Str Str attr Str decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body If CompareNotEq Call AttributeLoad NameLoad attr Str Str body Expr Call AttributeLoad NameLoad attr Str Call AttributeLoad NameLoad attr Str Return NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str If UnaryOpNot NameLoad body Expr Call AttributeLoad NameLoad attr Str Return NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str If BoolOpAnd CompareNotEq NameLoad NameLoad CompareNotIn NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str NameLoad Return NameLoad If UnaryOpNot NameLoad body Expr Call AttributeLoad NameLoad attr Str Return NameLoad orelse If BoolOpOr UnaryOpNot NameLoad CompareNotIn NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str NameLoad Return NameLoad If CompareNotIn Str NameLoad body Return NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Call AttributeLoad NameLoad attr Str Assign NameStore BinOpAdd NameLoad BinOpMult Str BinOpMod BinOpSub Num Call NameLoad NameLoad Num Return Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore Call AttributeLoad NameLoad attr NameLoad keyword Str If CompareIs NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type NameLoad body Return NameLoad If CompareEq AttributeLoad NameLoad attr Num body Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr NameLoad NameLoad keyword BinOpMult BinOpMult Num Num Num keyword Str orelse Expr Call AttributeLoad NameLoad attr Str AttributeLoad NameLoad attr Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Call AttributeLoad NameLoad attr Str AugAssignAdd NameStore BinOpMult Str BinOpMod BinOpSub Num Call NameLoad NameLoad Num Assign NameStore Call AttributeLoad NameLoad attr NameLoad Return Call NameLoad Call AttributeLoad NameLoad attr Str Num decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad body Expr Str Assign NameStore Call AttributeLoad NameLoad attr Str If CompareNotEq Call NameLoad NameLoad Num body Raise Call NameLoad BinOpMod Str NameLoad Assign NameStore BinOpMod Str TupleLoad SubscriptLoad NameLoad Index Num SubscriptLoad NameLoad Index Num Assign NameStore Call NameLoad SubscriptLoad NameLoad Index Num Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr Str Num Assign NameStore Call NameLoad SubscriptLoad NameLoad Index Num TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler body Raise Call NameLoad BinOpMod Str NameLoad If CompareNotEq Call AttributeLoad NameLoad attr Str Str body Raise Call NameLoad BinOpMod Str Call AttributeLoad NameLoad attr Str Assign NameStore Call NameLoad SubscriptLoad NameLoad Index Num TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler body Raise Call NameLoad BinOpMod Str NameLoad Assign NameStore Call NameLoad NameLoad NameLoad If CompareIs NameLoad NameLoad body Raise Call NameLoad BinOpMod Str NameLoad If UnaryOpNot NameLoad body Raise Call NameLoad Str Assign NameStore NameLoad For NameStore SubscriptLoad NameLoad Index Str body Assign NameStore Call NameLoad SubscriptLoad NameLoad Index Str Assign NameStore Call NameLoad SubscriptLoad NameLoad Index Str Assign NameStore Call AttributeLoad NameLoad attr TupleLoad NameLoad NameLoad Assign NameStore Call AttributeLoad Call AttributeLoad NameLoad attr NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr Num Assign NameStore BinOpMod Str SubscriptLoad Call AttributeLoad NameLoad attr NameLoad Str Index Num Assign NameStore CompareEq SubscriptLoad NameLoad Slice Num NameLoad If NameLoad body Break If UnaryOpNot NameLoad body Raise Call NameLoad BinOpMod Str NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str If CompareIs NameLoad NameLoad body Raise Call NameLoad BinOpMod Str NameLoad Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str If CompareIs NameLoad NameLoad body Raise Call NameLoad BinOpMod Str NameLoad If CompareGtE NameLoad BinOpAdd NameLoad NameLoad body Raise Call NameLoad BinOpMod Str NameLoad Assign NameStore BinOpAdd NameLoad NameLoad If CompareLt NameLoad NameLoad body Raise Call NameLoad BinOpMod Str TupleLoad NameLoad NameLoad NameLoad If CompareGt NameLoad NameLoad body Raise Call NameLoad BinOpMod Str TupleLoad NameLoad NameLoad NameLoad Return NameLoad decorator_list
N/A N/A Utility library for reading user information from an id_token.

This is an experimental library that can temporarily be used to extract
a user from an id_token.  The functionality provided by this library
will be provided elsewhere in the future.
 N/A base64 N/A N/A N/A json N/A N/A N/A ImportError N/A N/A simplejson json N/A logging N/A os N/A time N/A urllib N/A google google.appengine.api memcache google.appengine.api oauth google.appengine.api urlfetch google.appengine.api users N/A N/A Crypto.Hash SHA256 Crypto.PublicKey RSA N/A _CRYPTO_LOADED True N/A N/A N/A ImportError N/A N/A _CRYPTO_LOADED False N/A __all__ N/A get_current_user N/A _CLOCK_SKEW_SECS 300 N/A _MAX_TOKEN_LIFETIME_SECS 86400 N/A _DEFAULT_CERT_URI https://www.googleapis.com/service_accounts/v1/metadata/raw/federated-signon@system.gserviceaccount.com N/A _ENV_USE_OAUTH_SCOPE ENDPOINTS_USE_OAUTH_SCOPE N/A _ENV_AUTH_EMAIL ENDPOINTS_AUTH_EMAIL N/A _ENV_AUTH_DOMAIN ENDPOINTS_AUTH_DOMAIN N/A _EMAIL_SCOPE https://www.googleapis.com/auth/userinfo.email N/A _TOKENINFO_URL https://www.googleapis.com/oauth2/v1/tokeninfo _AppIdentityError N/A Exception N/A N/A N/A get_current_user N/A N/A N/A N/A N/A Get user information from the id_token or oauth token in the request.

  This should only be called from within an Endpoints request handler,
  decorated with an @endpoints.method decorator.  The decorator should include
  the https://www.googleapis.com/auth/userinfo.email scope.

  If the current request uses an id_token, this validates and parses the token
  against the info in the current request handler and returns the user.
  Or, for an Oauth token, this call validates the token against the tokeninfo
  endpoint and oauth.get_current_user with the scopes provided in the method's
  decorator.

  Returns:
    None if there is no token or it's invalid.  If the token was valid, this
      returns a User.  Only the user's email field is guaranteed to be set.
      Other fields may be empty.
   N/A N/A N/A _is_auth_info_available N/A N/A N/A N/A logging error endpoints.get_current_user() called outside a request. N/A None N/A N/A _ENV_USE_OAUTH_SCOPE N/A os environ N/A N/A N/A N/A oauth get_current_user N/A N/A os environ N/A _ENV_USE_OAUTH_SCOPE N/A N/A N/A _ENV_AUTH_EMAIL N/A os environ N/A _ENV_AUTH_DOMAIN N/A os environ N/A N/A N/A N/A N/A os environ N/A _ENV_AUTH_EMAIL N/A N/A None N/A N/A N/A users User N/A N/A os environ N/A _ENV_AUTH_EMAIL N/A N/A N/A os environ N/A _ENV_AUTH_DOMAIN None N/A None N/A _is_auth_info_available N/A N/A N/A N/A N/A Check if user auth info has been set in environment variables. N/A N/A N/A N/A _ENV_AUTH_EMAIL N/A os environ N/A _ENV_AUTH_DOMAIN N/A os environ N/A _ENV_USE_OAUTH_SCOPE N/A os environ N/A _maybe_set_current_user_vars N/A N/A method api_info request N/A None None N/A N/A Get user information from the id_token or oauth token in the request.

  Used internally by Endpoints to set up environment variables for user
  authentication.

  Args:
    method: The class method that's handling this request.  This method
      should be annotated with @endpoints.method.
    api_info: An api_config._ApiInfo instance. Optional. If None, will attempt
      to parse api_info from the implicit instance of the method.
    request: The current request, or None.
   N/A N/A _is_auth_info_available N/A N/A N/A N/A N/A os environ N/A _ENV_AUTH_EMAIL N/A N/A N/A os environ N/A _ENV_AUTH_DOMAIN N/A N/A N/A api_info N/A api_info N/A N/A method im_self api_info N/A N/A N/A AttributeError N/A N/A N/A N/A logging warning AttributeError when accessing %s.im_self.  An unbound method was probably passed as an endpoints handler. N/A method __name__ N/A scopes N/A N/A method method_info scopes N/A audiences N/A N/A method method_info audiences N/A allowed_client_ids N/A N/A method method_info allowed_client_ids N/A N/A scopes N/A N/A N/A N/A method method_info scopes None N/A N/A method method_info scopes N/A api_info scopes N/A audiences N/A N/A N/A N/A method method_info audiences None N/A N/A method method_info audiences N/A api_info audiences N/A allowed_client_ids N/A N/A N/A N/A method method_info allowed_client_ids None N/A N/A method method_info allowed_client_ids N/A api_info allowed_client_ids N/A N/A N/A scopes N/A audiences N/A allowed_client_ids N/A N/A N/A token N/A _get_token request N/A N/A token N/A N/A None N/A N/A N/A N/A scopes N/A _EMAIL_SCOPE N/A scopes N/A _EMAIL_SCOPE allowed_client_ids N/A N/A N/A N/A logging info Checking for id_token. N/A time_now N/A long N/A N/A time time N/A user N/A _get_id_token_user token audiences allowed_client_ids time_now memcache N/A user N/A N/A N/A N/A os environ N/A _ENV_AUTH_EMAIL N/A N/A user email N/A N/A N/A os environ N/A _ENV_AUTH_DOMAIN N/A N/A user auth_domain N/A N/A scopes N/A N/A N/A N/A logging info Checking for oauth token. N/A result N/A N/A urlfetch fetch N/A %s?%s N/A _TOKENINFO_URL N/A N/A urllib urlencode N/A access_token token N/A N/A N/A result status_code 200 N/A N/A token_info N/A N/A json loads N/A result content N/A N/A _set_oauth_user_vars token_info audiences allowed_client_ids scopes N/A _is_local_dev N/A _get_token N/A N/A request N/A N/A N/A Get the auth token for this request.

  Auth token may be specified in either the Authorization header or
  as a query param (either access_token or bearer_token).  We'll check in
  this order:
    1. Authorization header.
    2. bearer_token query param.
    3. access_token query param.

  Args:
    request: The current request, or None.

  Returns:
    The token in the request or None.
   N/A auth_header N/A N/A N/A os environ get HTTP_AUTHORIZATION N/A auth_header N/A N/A allowed_auth_schemes N/A OAuth Bearer N/A auth_scheme allowed_auth_schemes N/A N/A N/A N/A auth_header startswith auth_scheme N/A N/A N/A auth_header N/A N/A N/A len auth_scheme 1 N/A None N/A request N/A N/A key N/A bearer_token access_token N/A N/A N/A token _ N/A N/A request get_unrecognized_field_info key N/A token N/A N/A token N/A _get_id_token_user N/A N/A token audiences allowed_client_ids time_now cache N/A N/A N/A Get a User for the given id token, if the token is valid.

  Args:
    token: The id_token to check.
    audiences: List of audiences that are acceptable.
    allowed_client_ids: List of client IDs that are acceptable.
    time_now: The current time as a long (eg. long(time.time())).
    cache: Cache to use (eg. the memcache module).

  Returns:
    A User if the token is valid, None otherwise.
   N/A N/A N/A parsed_token N/A _verify_signed_jwt_with_certs token time_now cache N/A N/A N/A _AppIdentityError N/A e N/A N/A N/A N/A logging warning id_token verification failed: %s e N/A None N/A N/A N/A N/A N/A logging warning id_token verification failed. N/A None N/A N/A _verify_parsed_token parsed_token audiences allowed_client_ids N/A N/A email N/A parsed_token N/A email N/A N/A N/A users User email N/A _set_oauth_user_vars N/A N/A token_info audiences allowed_client_ids scopes local_dev N/A N/A N/A Validate the oauth token and set endpoints auth user variables.

  If the oauth token is valid, this sets either the ENDPOINTS_AUTH_EMAIL and
  ENDPOINTS_AUTH_DOMAIN environment variables (in local development) or
  the ENDPOINTS_USE_OAUTH_SCOPE one.  These provide enough information
  that our endpoints.get_current_user() function can get the user.

  Args:
    token_info: Info returned about the oauth token from the tokeninfo endpoint.
    audiences: List of audiences that are acceptable, or None for first-party.
    allowed_client_ids: List of client IDs that are acceptable.
    scopes: List of acceptable scopes.
    local_dev: True if we're running a local dev server, false if we're in prod.
   N/A N/A email token_info N/A N/A N/A N/A logging warning Oauth token doesn't include an email address. N/A N/A N/A N/A N/A token_info get verified_email N/A N/A N/A N/A logging warning Oauth token email isn't verified. N/A N/A N/A audiences allowed_client_ids N/A N/A N/A audience token_info N/A N/A N/A N/A logging warning Audience is required and isn't specified in token. N/A N/A N/A N/A token_info N/A audience audiences N/A N/A N/A N/A N/A N/A N/A token_info N/A audience N/A N/A token_info get issued_to N/A allowed_client_ids None N/A N/A token_info N/A audience allowed_client_ids N/A N/A N/A N/A N/A N/A logging warning Oauth token audience isn't permitted. N/A N/A token_scopes N/A N/A N/A N/A token_info get scope split N/A N/A N/A any N/A N/A scope scopes N/A scope token_scopes N/A N/A N/A N/A logging warning Oauth token scopes don't match any acceptable scopes. N/A N/A local_dev N/A N/A N/A N/A os environ N/A _ENV_AUTH_EMAIL N/A token_info N/A email N/A N/A N/A os environ N/A _ENV_AUTH_DOMAIN N/A N/A scope scopes N/A N/A N/A N/A oauth_user N/A N/A oauth get_current_user scope N/A oauth_scope scope N/A N/A N/A N/A N/A oauth Error N/A N/A N/A N/A N/A N/A logging warning Oauth framework couldn't find a user. N/A None N/A N/A N/A N/A oauth_user email N/A token_info N/A email N/A N/A N/A N/A os environ N/A _ENV_USE_OAUTH_SCOPE oauth_scope N/A N/A N/A N/A logging warning Oauth framework user didn't match oauth token user. N/A None N/A _is_local_dev N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A os environ get SERVER_SOFTWARE startswith Development N/A _verify_parsed_token N/A N/A parsed_token audiences allowed_client_ids N/A N/A N/A N/A N/A N/A parsed_token get iss accounts.google.com N/A N/A N/A N/A logging warning Issuer was not valid: %s N/A N/A parsed_token get iss N/A False N/A aud N/A N/A parsed_token get aud N/A N/A aud N/A N/A N/A N/A logging warning No aud field in token N/A False N/A cid N/A N/A parsed_token get azp N/A N/A N/A aud cid N/A aud audiences N/A N/A N/A N/A logging warning Audience not allowed: %s aud N/A False N/A N/A allowed_client_ids N/A N/A N/A N/A logging warning No allowed client IDs specified.  Id_token cannot be verified. N/A False N/A N/A N/A N/A cid N/A cid allowed_client_ids N/A N/A N/A N/A logging warning Client ID is not allowed: %s cid N/A False N/A N/A email parsed_token N/A N/A False N/A True N/A _urlsafe_b64decode N/A N/A b64string N/A N/A N/A b64string N/A N/A b64string encode ascii N/A padded N/A b64string N/A = N/A N/A 4 N/A len b64string 4 N/A N/A N/A base64 urlsafe_b64decode padded N/A _get_cached_certs N/A N/A cert_uri cache N/A N/A N/A certs N/A N/A cache get cert_uri namespace verify_jwt N/A N/A certs None N/A N/A N/A N/A logging info Cert cache miss N/A N/A N/A result N/A N/A urlfetch fetch cert_uri N/A N/A N/A AssertionError N/A N/A None N/A N/A N/A result status_code 200 N/A N/A certs N/A N/A json loads N/A result content N/A N/A N/A cache set cert_uri certs time N/A N/A 24 60 60 namespace verify_jwt N/A N/A N/A N/A logging error Certs not available, HTTP request returned %d N/A result status_code N/A certs N/A _b64_to_long N/A N/A b N/A N/A N/A b N/A N/A b encode ascii N/A b N/A = N/A N/A 4 N/A len b 4 N/A b N/A N/A base64 b64decode b N/A N/A long N/A N/A b encode hex 16 N/A _verify_signed_jwt_with_certs N/A N/A jwt time_now cache cert_uri N/A _DEFAULT_CERT_URI N/A N/A Verify a JWT against public certs.

  See http://self-issued.info/docs/draft-jones-json-web-token.html.

  The PyCrypto library included with Google App Engine is severely limited and
  so you have to use it very carefully to verify JWT signatures. The first
  issue is that the library can't read X.509 files, so we make a call to a
  special URI that has the public cert in modulus/exponent form in JSON.

  The second issue is that the RSA.verify method doesn't work, at least for
  how the JWT tokens are signed, so we have to manually verify the signature
  of the JWT, which means hashing the signed part of the JWT and comparing
  that to the signature that's been encrypted with the public key.

  Args:
    jwt: string, A JWT.
    time_now: The current time, as a long (eg. long(time.time())).
    cache: Cache to use (eg. the memcache module).
    cert_uri: string, URI to get cert modulus and exponent in JSON format.

  Returns:
    dict, The deserialized JSON payload in the JWT.

  Raises:
    _AppIdentityError: if any checks are failed.
   N/A segments N/A N/A jwt split . N/A N/A N/A len segments 3 N/A N/A N/A _AppIdentityError N/A Wrong number of segments in token: %s jwt N/A signed N/A %s.%s N/A N/A segments N/A 0 N/A segments N/A 1 N/A signature N/A _urlsafe_b64decode N/A segments N/A 2 N/A lsignature N/A long N/A N/A signature encode hex 16 N/A header_body N/A _urlsafe_b64decode N/A segments N/A 0 N/A N/A N/A header N/A N/A json loads header_body N/A N/A N/A N/A N/A _AppIdentityError N/A Can't parse header: %s header_body N/A N/A N/A N/A header get alg RS256 N/A N/A N/A _AppIdentityError N/A Unexpected encryption algorithm: %s N/A N/A header get alg N/A json_body N/A _urlsafe_b64decode N/A segments N/A 1 N/A N/A N/A parsed N/A N/A json loads json_body N/A N/A N/A N/A N/A _AppIdentityError N/A Can't parse token: %s json_body N/A certs N/A _get_cached_certs cert_uri cache N/A N/A certs None N/A N/A N/A _AppIdentityError N/A Unable to retrieve certs needed to verify the signed JWT: %s jwt N/A N/A _CRYPTO_LOADED N/A N/A N/A _AppIdentityError Unable to load pycrypto library.  Can't verify id_token signature.  See http://www.pycrypto.org for more information on pycrypto. N/A verified False N/A keyvalue N/A certs N/A keyvalues N/A N/A modulus N/A _b64_to_long N/A keyvalue N/A modulus N/A exponent N/A _b64_to_long N/A keyvalue N/A exponent N/A key N/A N/A RSA construct N/A modulus exponent N/A local_hash N/A N/A N/A N/A SHA256 new signed hexdigest N/A local_hash N/A N/A local_hash zfill 64 N/A hexsig N/A %064x N/A N/A N/A key encrypt lsignature N/A 0 N/A verified N/A N/A hexsig N/A -64 local_hash N/A verified N/A N/A N/A N/A verified N/A N/A N/A _AppIdentityError N/A Invalid token signature: %s jwt N/A iat N/A N/A parsed get iat N/A N/A iat None N/A N/A N/A _AppIdentityError N/A No iat field in token: %s json_body N/A earliest N/A iat _CLOCK_SKEW_SECS N/A exp N/A N/A parsed get exp N/A N/A exp None N/A N/A N/A _AppIdentityError N/A No exp field in token: %s json_body N/A N/A exp N/A time_now _MAX_TOKEN_LIFETIME_SECS N/A N/A N/A _AppIdentityError N/A exp field too far in future: %s json_body N/A latest N/A exp _CLOCK_SKEW_SECS N/A N/A time_now earliest N/A N/A N/A _AppIdentityError N/A Token used too early, %d < %d: %s N/A time_now earliest json_body N/A N/A time_now latest N/A N/A N/A _AppIdentityError N/A Token used too late, %d > %d: %s N/A time_now latest json_body N/A parsed N/A