
    WwgW                         d dl mZ d dlmZmZ d dlmZ d dlmZ d dl	m
Z
mZmZ dededefd	Z ed
       G d de
             Zy)    )	dataclass)OptionalSet)x509)InvalidCertificateError)ConfigurableMixinprocess_bit_string_flagsprocess_oidsrequiredpresentneed_allc                 .    |r| |z
   S t        | |z        S N)bool)r   r   r   s      W/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko/sign/validation/settings.py_match_usagesr      s%    w&'' Hw&''    T)frozenc                        e Zd ZU dZdZeee      ed<   	 dZ	eee      ed<   	 dZ
eee      ed<   	 dZeed<   	 dZeed	<   	 d
ej                  fdZd Zd Ze fd       Z xZS )KeyUsageConstraintsa5  
    Convenience class to pass around key usage requirements and validate them.
    Intended to be flexible enough to handle both PKIX and ISO 32000 certificate
    seed value constraint semantics.

    .. versionchanged:: 0.6.0
        Bring extended key usage semantics in line with :rfc:`5280` (PKIX).
    N	key_usagekey_usage_forbiddenextd_key_usageT explicit_extd_key_usage_requiredFmatch_all_key_usagescertc                 p    | j                  |j                         | j                  |j                         y r   )_validate_key_usagekey_usage_value_validate_extd_key_usageextended_key_usage_value)selfr   s     r   validatezKeyUsageConstraints.validatef   s*      !5!56%%d&C&CDr   c                    | j                   sy | j                   xs
 t               }| j                  xs
 t               }|t        |j                        n	t               }||z  }|r+t	        d |      }t        ddj                  |       d      | j                  }t        |||      s2t	        d |      }t        d|rdnd d	dj                  |       d
      y )Nc                 &    | j                  dd      S N_ replacess    r   <lambda>z9KeyUsageConstraints._validate_key_usage.<locals>.<lambda>z       aiiS&9 r   zBThe active key usage policy explicitly bans certificates used for , .c                 &    | j                  dd      S r&   r)   r+   s    r   r-   z9KeyUsageConstraints._validate_key_usage.<locals>.<lambda>   r.   r   z%The active key usage policy requires  zat least one of zthe key usage extensions z to be present.)	r   setr   nativemapr   joinr   r   )r"   key_usage_extension_valuer   r   cert_kuforbidden_ku	rephrasedneed_all_kus           r   r   z'KeyUsageConstraints._validate_key_usagej   s    ~~NN+ce	"66?#%
 )4 )001 	 !449<HI) IIi014  //Y=99EI)7$2*<= >$$(IIi$8#9J  >r   c                 t   | j                   y |d u}|rt        |j                        n	t               }d|v r| j                  sy | j                   xs
 t               }|s| j                  rt	        d      y t        ||d      s5|r#t        d |      }ddj                  |       d}nd	}t	        d
|       y )Nany_extended_key_usagezEThe active key usage policy requires an extended key usage extension.F)r   c                 &    | j                  dd      S r&   r)   r+   s    r   r-   z>KeyUsageConstraints._validate_extd_key_usage.<locals>.<lambda>   s    !))C*= r   zRelevant key purposes are r/   r0   z,There are no acceptable extended key usages.zfThe extended key usages for which this certificate is valid do not match the active key usage policy. )r   r3   r4   r   r   r   r5   r6   )r"   eku_extension_valuehas_extd_key_usage_extcert_ekur   r:   ok_lists          r   r    z,KeyUsageConstraints._validate_extd_key_usage   s    &!4D!@/EC#**+35 	
 %099,,5%44-+  ^XF =~N	6tyy7K6LANH)==DIG  Gr   c                 B   t         |   |       dD ]N  }|j                  |d       }|t        t	        t
        j                  ||j                  dd                  ||<   P |j                  dd       }|(t        t        t
        j                  |d            |d<   y y )N)r   r   r'   -r   zextd-key-usage)
superprocess_entriesgetr3   r	   r   KeyUsager*   r
   KeyPurposeId)clsconfig_dictkey_usage_settaffected_flagsr   	__class__s        r   rF   z#KeyUsageConstraints.process_entries   s    , C 		N(__^TBN).1,&&..sC8/N+		 %)94@%,/%%~7G-K() &r   )__name__
__module____qualname____doc__r   r   r   str__annotations__r   r   r   r   r   r   Certificater#   r   r    classmethodrF   __classcell__)rN   s   @r   r   r      s     %)IxC!( /3#c(+2 *.NHSX&-< .2$d1	 "'$&ET-- E@!F  r   r   N)dataclassesr   typingr   r   
asn1cryptor   pyhanko_certvalidator.errorsr   pyhanko.config.apir   r	   r
   r3   r   r   r    r   r   <module>r^      sY    !    @ (C (# ( ( $m+ m mr   