Source

ytmanager / gdata / auth.py

Full commit
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
#!/usr/bin/python
#
# Copyright (C) 2007 - 2009 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


import cgi
import math
import random
import re
import time
import types
import urllib
import atom.http_interface
import atom.token_store
import atom.url
import gdata.oauth as oauth
import gdata.oauth.rsa as oauth_rsa
import gdata.tlslite.utils.keyfactory as keyfactory
import gdata.tlslite.utils.cryptomath as cryptomath

import gdata.gauth

__author__ = 'api.jscudder (Jeff Scudder)'


PROGRAMMATIC_AUTH_LABEL = 'GoogleLogin auth='
AUTHSUB_AUTH_LABEL = 'AuthSub token='


"""This module provides functions and objects used with Google authentication.

Details on Google authorization mechanisms used with the Google Data APIs can
be found here: 
http://code.google.com/apis/gdata/auth.html
http://code.google.com/apis/accounts/

The essential functions are the following.
Related to ClientLogin:
  generate_client_login_request_body: Constructs the body of an HTTP request to
                                      obtain a ClientLogin token for a specific
                                      service. 
  extract_client_login_token: Creates a ClientLoginToken with the token from a
                              success response to a ClientLogin request.
  get_captcha_challenge: If the server responded to the ClientLogin request
                         with a CAPTCHA challenge, this method extracts the
                         CAPTCHA URL and identifying CAPTCHA token.

Related to AuthSub:
  generate_auth_sub_url: Constructs a full URL for a AuthSub request. The 
                         user's browser must be sent to this Google Accounts
                         URL and redirected back to the app to obtain the
                         AuthSub token.
  extract_auth_sub_token_from_url: Once the user's browser has been 
                                   redirected back to the web app, use this
                                   function to create an AuthSubToken with
                                   the correct authorization token and scope.
  token_from_http_body: Extracts the AuthSubToken value string from the 
                        server's response to an AuthSub session token upgrade
                        request.
"""

def generate_client_login_request_body(email, password, service, source, 
    account_type='HOSTED_OR_GOOGLE', captcha_token=None, 
    captcha_response=None):
  """Creates the body of the autentication request

  See http://code.google.com/apis/accounts/AuthForInstalledApps.html#Request
  for more details.

  Args:
    email: str
    password: str
    service: str
    source: str
    account_type: str (optional) Defaul is 'HOSTED_OR_GOOGLE', other valid
        values are 'GOOGLE' and 'HOSTED'
    captcha_token: str (optional)
    captcha_response: str (optional)

  Returns:
    The HTTP body to send in a request for a client login token.
  """
  return gdata.gauth.generate_client_login_request_body(email, password,
      service, source, account_type, captcha_token, captcha_response)


GenerateClientLoginRequestBody = generate_client_login_request_body


def GenerateClientLoginAuthToken(http_body):
  """Returns the token value to use in Authorization headers.

  Reads the token from the server's response to a Client Login request and
  creates header value to use in requests.

  Args:
    http_body: str The body of the server's HTTP response to a Client Login
        request
 
  Returns:
    The value half of an Authorization header.
  """
  token = get_client_login_token(http_body)
  if token:
    return 'GoogleLogin auth=%s' % token
  return None


def get_client_login_token(http_body):
  """Returns the token value for a ClientLoginToken.

  Reads the token from the server's response to a Client Login request and
  creates the token value string to use in requests.

  Args:
    http_body: str The body of the server's HTTP response to a Client Login
        request
 
  Returns:
    The token value string for a ClientLoginToken.
  """
  return gdata.gauth.get_client_login_token_string(http_body)


def extract_client_login_token(http_body, scopes):
  """Parses the server's response and returns a ClientLoginToken.
  
  Args:
    http_body: str The body of the server's HTTP response to a Client Login
               request. It is assumed that the login request was successful.
    scopes: list containing atom.url.Urls or strs. The scopes list contains
            all of the partial URLs under which the client login token is
            valid. For example, if scopes contains ['http://example.com/foo']
            then the client login token would be valid for 
            http://example.com/foo/bar/baz

  Returns:
    A ClientLoginToken which is valid for the specified scopes.
  """
  token_string = get_client_login_token(http_body)
  token = ClientLoginToken(scopes=scopes)
  token.set_token_string(token_string)
  return token


def get_captcha_challenge(http_body, 
    captcha_base_url='http://www.google.com/accounts/'):
  """Returns the URL and token for a CAPTCHA challenge issued by the server.

  Args:
    http_body: str The body of the HTTP response from the server which 
        contains the CAPTCHA challenge.
    captcha_base_url: str This function returns a full URL for viewing the 
        challenge image which is built from the server's response. This
        base_url is used as the beginning of the URL because the server
        only provides the end of the URL. For example the server provides
        'Captcha?ctoken=Hi...N' and the URL for the image is
        'http://www.google.com/accounts/Captcha?ctoken=Hi...N'

  Returns:
    A dictionary containing the information needed to repond to the CAPTCHA
    challenge, the image URL and the ID token of the challenge. The 
    dictionary is in the form:
    {'token': string identifying the CAPTCHA image,
     'url': string containing the URL of the image}
    Returns None if there was no CAPTCHA challenge in the response.
  """
  return gdata.gauth.get_captcha_challenge(http_body, captcha_base_url)


GetCaptchaChallenge = get_captcha_challenge


def GenerateOAuthRequestTokenUrl(
    oauth_input_params, scopes,
    request_token_url='https://www.google.com/accounts/OAuthGetRequestToken',
    extra_parameters=None):
  """Generate a URL at which a request for OAuth request token is to be sent.
  
  Args:
    oauth_input_params: OAuthInputParams OAuth input parameters.
    scopes: list of strings The URLs of the services to be accessed.
    request_token_url: string The beginning of the request token URL. This is
        normally 'https://www.google.com/accounts/OAuthGetRequestToken' or
        '/accounts/OAuthGetRequestToken'
    extra_parameters: dict (optional) key-value pairs as any additional
        parameters to be included in the URL and signature while making a
        request for fetching an OAuth request token. All the OAuth parameters
        are added by default. But if provided through this argument, any
        default parameters will be overwritten. For e.g. a default parameter
        oauth_version 1.0 can be overwritten if
        extra_parameters = {'oauth_version': '2.0'}
  
  Returns:
    atom.url.Url OAuth request token URL.
  """
  scopes_string = ' '.join([str(scope) for scope in scopes])
  parameters = {'scope': scopes_string}
  if extra_parameters:
    parameters.update(extra_parameters)
  oauth_request = oauth.OAuthRequest.from_consumer_and_token(
      oauth_input_params.GetConsumer(), http_url=request_token_url,
      parameters=parameters)
  oauth_request.sign_request(oauth_input_params.GetSignatureMethod(),
                             oauth_input_params.GetConsumer(), None)
  return atom.url.parse_url(oauth_request.to_url())


def GenerateOAuthAuthorizationUrl(
    request_token,
    authorization_url='https://www.google.com/accounts/OAuthAuthorizeToken',
    callback_url=None, extra_params=None,
    include_scopes_in_callback=False, scopes_param_prefix='oauth_token_scope'):
  """Generates URL at which user will login to authorize the request token.
  
  Args:
    request_token: gdata.auth.OAuthToken OAuth request token.
    authorization_url: string The beginning of the authorization URL. This is
        normally 'https://www.google.com/accounts/OAuthAuthorizeToken' or
        '/accounts/OAuthAuthorizeToken'
    callback_url: string (optional) The URL user will be sent to after
        logging in and granting access.
    extra_params: dict (optional) Additional parameters to be sent.
    include_scopes_in_callback: Boolean (default=False) if set to True, and
        if 'callback_url' is present, the 'callback_url' will be modified to
        include the scope(s) from the request token as a URL parameter. The
        key for the 'callback' URL's scope parameter will be
        OAUTH_SCOPE_URL_PARAM_NAME. The benefit of including the scope URL as
        a parameter to the 'callback' URL, is that the page which receives
        the OAuth token will be able to tell which URLs the token grants
        access to.
    scopes_param_prefix: string (default='oauth_token_scope') The URL
        parameter key which maps to the list of valid scopes for the token.
        This URL parameter will be included in the callback URL along with
        the scopes of the token as value if include_scopes_in_callback=True.

  Returns:
    atom.url.Url OAuth authorization URL.
  """
  scopes = request_token.scopes
  if isinstance(scopes, list):
    scopes = ' '.join(scopes)  
  if include_scopes_in_callback and callback_url:
    if callback_url.find('?') > -1:
      callback_url += '&'
    else:
      callback_url += '?'
    callback_url += urllib.urlencode({scopes_param_prefix:scopes})  
  oauth_token = oauth.OAuthToken(request_token.key, request_token.secret)
  oauth_request = oauth.OAuthRequest.from_token_and_callback(
      token=oauth_token, callback=callback_url,
      http_url=authorization_url, parameters=extra_params)
  return atom.url.parse_url(oauth_request.to_url())


def GenerateOAuthAccessTokenUrl(
    authorized_request_token,
    oauth_input_params,
    access_token_url='https://www.google.com/accounts/OAuthGetAccessToken',
    oauth_version='1.0',
    oauth_verifier=None):
  """Generates URL at which user will login to authorize the request token.
  
  Args:
    authorized_request_token: gdata.auth.OAuthToken OAuth authorized request
        token.
    oauth_input_params: OAuthInputParams OAuth input parameters.    
    access_token_url: string The beginning of the authorization URL. This is
        normally 'https://www.google.com/accounts/OAuthGetAccessToken' or
        '/accounts/OAuthGetAccessToken'
    oauth_version: str (default='1.0') oauth_version parameter.
    oauth_verifier: str (optional) If present, it is assumed that the client
        will use the OAuth v1.0a protocol which includes passing the
        oauth_verifier (as returned by the SP) in the access token step.

  Returns:
    atom.url.Url OAuth access token URL.
  """
  oauth_token = oauth.OAuthToken(authorized_request_token.key,
                                 authorized_request_token.secret)
  parameters = {'oauth_version': oauth_version}
  if oauth_verifier is not None:
    parameters['oauth_verifier'] = oauth_verifier
  oauth_request = oauth.OAuthRequest.from_consumer_and_token(
      oauth_input_params.GetConsumer(), token=oauth_token,
      http_url=access_token_url, parameters=parameters)
  oauth_request.sign_request(oauth_input_params.GetSignatureMethod(),
                             oauth_input_params.GetConsumer(), oauth_token)
  return atom.url.parse_url(oauth_request.to_url())


def GenerateAuthSubUrl(next, scope, secure=False, session=True, 
    request_url='https://www.google.com/accounts/AuthSubRequest',
    domain='default'):
  """Generate a URL at which the user will login and be redirected back.

  Users enter their credentials on a Google login page and a token is sent
  to the URL specified in next. See documentation for AuthSub login at:
  http://code.google.com/apis/accounts/AuthForWebApps.html

  Args:
    request_url: str The beginning of the request URL. This is normally
        'http://www.google.com/accounts/AuthSubRequest' or 
        '/accounts/AuthSubRequest'
    next: string The URL user will be sent to after logging in.
    scope: string The URL of the service to be accessed.
    secure: boolean (optional) Determines whether or not the issued token
            is a secure token.
    session: boolean (optional) Determines whether or not the issued token
             can be upgraded to a session token.
    domain: str (optional) The Google Apps domain for this account. If this
            is not a Google Apps account, use 'default' which is the default
            value.
  """
  # Translate True/False values for parameters into numeric values acceoted
  # by the AuthSub service.
  if secure:
    secure = 1
  else:
    secure = 0

  if session:
    session = 1
  else:
    session = 0

  request_params = urllib.urlencode({'next': next, 'scope': scope,
                                     'secure': secure, 'session': session, 
                                     'hd': domain})
  if request_url.find('?') == -1:
    return '%s?%s' % (request_url, request_params)
  else:
    # The request URL already contained url parameters so we should add
    # the parameters using the & seperator
    return '%s&%s' % (request_url, request_params)


def generate_auth_sub_url(next, scopes, secure=False, session=True,
    request_url='https://www.google.com/accounts/AuthSubRequest', 
    domain='default', scopes_param_prefix='auth_sub_scopes'):
  """Constructs a URL string for requesting a multiscope AuthSub token.

  The generated token will contain a URL parameter to pass along the 
  requested scopes to the next URL. When the Google Accounts page 
  redirects the broswser to the 'next' URL, it appends the single use
  AuthSub token value to the URL as a URL parameter with the key 'token'.
  However, the information about which scopes were requested is not
  included by Google Accounts. This method adds the scopes to the next
  URL before making the request so that the redirect will be sent to 
  a page, and both the token value and the list of scopes can be 
  extracted from the request URL. 

  Args:
    next: atom.url.URL or string The URL user will be sent to after
          authorizing this web application to access their data.
    scopes: list containint strings The URLs of the services to be accessed.
    secure: boolean (optional) Determines whether or not the issued token
            is a secure token.
    session: boolean (optional) Determines whether or not the issued token
             can be upgraded to a session token.
    request_url: atom.url.Url or str The beginning of the request URL. This
        is normally 'http://www.google.com/accounts/AuthSubRequest' or 
        '/accounts/AuthSubRequest'
    domain: The domain which the account is part of. This is used for Google
        Apps accounts, the default value is 'default' which means that the
        requested account is a Google Account (@gmail.com for example)
    scopes_param_prefix: str (optional) The requested scopes are added as a 
        URL parameter to the next URL so that the page at the 'next' URL can
        extract the token value and the valid scopes from the URL. The key
        for the URL parameter defaults to 'auth_sub_scopes'

  Returns:
    An atom.url.Url which the user's browser should be directed to in order
    to authorize this application to access their information.
  """
  if isinstance(next, (str, unicode)):
    next = atom.url.parse_url(next)
  scopes_string = ' '.join([str(scope) for scope in scopes])
  next.params[scopes_param_prefix] = scopes_string

  if isinstance(request_url, (str, unicode)):
    request_url = atom.url.parse_url(request_url)
  request_url.params['next'] = str(next)
  request_url.params['scope'] = scopes_string
  if session:
    request_url.params['session'] = 1
  else:
    request_url.params['session'] = 0
  if secure:
    request_url.params['secure'] = 1
  else:
    request_url.params['secure'] = 0
  request_url.params['hd'] = domain
  return request_url


def AuthSubTokenFromUrl(url):
  """Extracts the AuthSub token from the URL. 

  Used after the AuthSub redirect has sent the user to the 'next' page and
  appended the token to the URL. This function returns the value to be used
  in the Authorization header. 

  Args:
    url: str The URL of the current page which contains the AuthSub token as
        a URL parameter.
  """
  token = TokenFromUrl(url)
  if token:
    return 'AuthSub token=%s' % token
  return None


def TokenFromUrl(url):
  """Extracts the AuthSub token from the URL.

  Returns the raw token value.

  Args:
    url: str The URL or the query portion of the URL string (after the ?) of
        the current page which contains the AuthSub token as a URL parameter.
  """
  if url.find('?') > -1:
    query_params = url.split('?')[1]
  else:
    query_params = url
  for pair in query_params.split('&'):
    if pair.startswith('token='):
      return pair[6:]
  return None


def extract_auth_sub_token_from_url(url, 
    scopes_param_prefix='auth_sub_scopes', rsa_key=None):
  """Creates an AuthSubToken and sets the token value and scopes from the URL.
  
  After the Google Accounts AuthSub pages redirect the user's broswer back to 
  the web application (using the 'next' URL from the request) the web app must
  extract the token from the current page's URL. The token is provided as a 
  URL parameter named 'token' and if generate_auth_sub_url was used to create
  the request, the token's valid scopes are included in a URL parameter whose
  name is specified in scopes_param_prefix.

  Args:
    url: atom.url.Url or str representing the current URL. The token value
         and valid scopes should be included as URL parameters.
    scopes_param_prefix: str (optional) The URL parameter key which maps to
                         the list of valid scopes for the token.

  Returns:
    An AuthSubToken with the token value from the URL and set to be valid for
    the scopes passed in on the URL. If no scopes were included in the URL,
    the AuthSubToken defaults to being valid for no scopes. If there was no
    'token' parameter in the URL, this function returns None.
  """
  if isinstance(url, (str, unicode)):
    url = atom.url.parse_url(url)
  if 'token' not in url.params:
    return None
  scopes = []
  if scopes_param_prefix in url.params:
    scopes = url.params[scopes_param_prefix].split(' ')
  token_value = url.params['token']
  if rsa_key:
    token = SecureAuthSubToken(rsa_key, scopes=scopes)
  else:
    token = AuthSubToken(scopes=scopes)
  token.set_token_string(token_value)
  return token


def AuthSubTokenFromHttpBody(http_body):
  """Extracts the AuthSub token from an HTTP body string.

  Used to find the new session token after making a request to upgrade a
  single use AuthSub token.

  Args:
    http_body: str The repsonse from the server which contains the AuthSub
        key. For example, this function would find the new session token
        from the server's response to an upgrade token request.

  Returns:
    The header value to use for Authorization which contains the AuthSub
    token.
  """
  token_value = token_from_http_body(http_body)
  if token_value:
    return '%s%s' % (AUTHSUB_AUTH_LABEL, token_value)
  return None


def token_from_http_body(http_body):
  """Extracts the AuthSub token from an HTTP body string.

  Used to find the new session token after making a request to upgrade a 
  single use AuthSub token.

  Args:
    http_body: str The repsonse from the server which contains the AuthSub 
        key. For example, this function would find the new session token
        from the server's response to an upgrade token request.

  Returns:
    The raw token value to use in an AuthSubToken object.
  """
  for response_line in http_body.splitlines():
    if response_line.startswith('Token='):
      # Strip off Token= and return the token value string.
      return response_line[6:]
  return None


TokenFromHttpBody = token_from_http_body


def OAuthTokenFromUrl(url, scopes_param_prefix='oauth_token_scope'):
  """Creates an OAuthToken and sets token key and scopes (if present) from URL.
  
  After the Google Accounts OAuth pages redirect the user's broswer back to 
  the web application (using the 'callback' URL from the request) the web app
  can extract the token from the current page's URL. The token is same as the
  request token, but it is either authorized (if user grants access) or
  unauthorized (if user denies access). The token is provided as a 
  URL parameter named 'oauth_token' and if it was chosen to use
  GenerateOAuthAuthorizationUrl with include_scopes_in_param=True, the token's
  valid scopes are included in a URL parameter whose name is specified in
  scopes_param_prefix.

  Args:
    url: atom.url.Url or str representing the current URL. The token value
        and valid scopes should be included as URL parameters.
    scopes_param_prefix: str (optional) The URL parameter key which maps to
        the list of valid scopes for the token.

  Returns:
    An OAuthToken with the token key from the URL and set to be valid for
    the scopes passed in on the URL. If no scopes were included in the URL,
    the OAuthToken defaults to being valid for no scopes. If there was no
    'oauth_token' parameter in the URL, this function returns None.
  """
  if isinstance(url, (str, unicode)):
    url = atom.url.parse_url(url)
  if 'oauth_token' not in url.params:
    return None
  scopes = []
  if scopes_param_prefix in url.params:
    scopes = url.params[scopes_param_prefix].split(' ')
  token_key = url.params['oauth_token']
  token = OAuthToken(key=token_key, scopes=scopes)
  return token


def OAuthTokenFromHttpBody(http_body):
  """Parses the HTTP response body and returns an OAuth token.
  
  The returned OAuth token will just have key and secret parameters set.
  It won't have any knowledge about the scopes or oauth_input_params. It is
  your responsibility to make it aware of the remaining parameters.
  
  Returns:
    OAuthToken OAuth token.
  """
  token = oauth.OAuthToken.from_string(http_body)
  oauth_token = OAuthToken(key=token.key, secret=token.secret)
  return oauth_token
  

class OAuthSignatureMethod(object):
  """Holds valid OAuth signature methods.
  
  RSA_SHA1: Class to build signature according to RSA-SHA1 algorithm.
  HMAC_SHA1: Class to build signature according to HMAC-SHA1 algorithm.
  """
  
  HMAC_SHA1 = oauth.OAuthSignatureMethod_HMAC_SHA1  
  
  class RSA_SHA1(oauth_rsa.OAuthSignatureMethod_RSA_SHA1):
    """Provides implementation for abstract methods to return RSA certs."""

    def __init__(self, private_key, public_cert):
      self.private_key = private_key
      self.public_cert = public_cert
  
    def _fetch_public_cert(self, unused_oauth_request):
      return self.public_cert
  
    def _fetch_private_cert(self, unused_oauth_request):
      return self.private_key
  

class OAuthInputParams(object):
  """Stores OAuth input parameters.
  
  This class is a store for OAuth input parameters viz. consumer key and secret,
  signature method and RSA key.
  """
  
  def __init__(self, signature_method, consumer_key, consumer_secret=None,
               rsa_key=None, requestor_id=None):
    """Initializes object with parameters required for using OAuth mechanism.
    
    NOTE: Though consumer_secret and rsa_key are optional, either of the two
    is required depending on the value of the signature_method.
    
    Args:
      signature_method: class which provides implementation for strategy class
          oauth.oauth.OAuthSignatureMethod. Signature method to be used for
          signing each request. Valid implementations are provided as the
          constants defined by gdata.auth.OAuthSignatureMethod. Currently
          they are gdata.auth.OAuthSignatureMethod.RSA_SHA1 and
          gdata.auth.OAuthSignatureMethod.HMAC_SHA1. Instead of passing in
          the strategy class, you may pass in a string for 'RSA_SHA1' or 
          'HMAC_SHA1'. If you plan to use OAuth on App Engine (or another
          WSGI environment) I recommend specifying signature method using a
          string (the only options are 'RSA_SHA1' and 'HMAC_SHA1'). In these
          environments there are sometimes issues with pickling an object in 
          which a member references a class or function. Storing a string to
          refer to the signature method mitigates complications when
          pickling.
      consumer_key: string Domain identifying third_party web application.
      consumer_secret: string (optional) Secret generated during registration.
          Required only for HMAC_SHA1 signature method.
      rsa_key: string (optional) Private key required for RSA_SHA1 signature
          method.
      requestor_id: string (optional) User email adress to make requests on
          their behalf.  This parameter should only be set when performing
          2 legged OAuth requests.
    """
    if (signature_method == OAuthSignatureMethod.RSA_SHA1
        or signature_method == 'RSA_SHA1'):
      self.__signature_strategy = 'RSA_SHA1'
    elif (signature_method == OAuthSignatureMethod.HMAC_SHA1
        or signature_method == 'HMAC_SHA1'):
      self.__signature_strategy = 'HMAC_SHA1'
    else:
      self.__signature_strategy = signature_method
    self.rsa_key = rsa_key
    self._consumer = oauth.OAuthConsumer(consumer_key, consumer_secret)
    self.requestor_id = requestor_id

  def __get_signature_method(self):
    if self.__signature_strategy == 'RSA_SHA1':
      return OAuthSignatureMethod.RSA_SHA1(self.rsa_key, None)
    elif self.__signature_strategy == 'HMAC_SHA1':
      return OAuthSignatureMethod.HMAC_SHA1()
    else:
      return self.__signature_strategy()

  def __set_signature_method(self, signature_method):
    if (signature_method == OAuthSignatureMethod.RSA_SHA1
        or signature_method == 'RSA_SHA1'):
      self.__signature_strategy = 'RSA_SHA1'
    elif (signature_method == OAuthSignatureMethod.HMAC_SHA1
        or signature_method == 'HMAC_SHA1'):
      self.__signature_strategy = 'HMAC_SHA1'
    else:
      self.__signature_strategy = signature_method

  _signature_method = property(__get_signature_method, __set_signature_method,
      doc="""Returns object capable of signing the request using RSA of HMAC.
      
      Replaces the _signature_method member to avoid pickle errors.""")

  def GetSignatureMethod(self):
    """Gets the OAuth signature method.

    Returns:
      object of supertype <oauth.oauth.OAuthSignatureMethod>
    """
    return self._signature_method

  def GetConsumer(self):
    """Gets the OAuth consumer.

    Returns:
      object of type <oauth.oauth.Consumer>
    """
    return self._consumer


class ClientLoginToken(atom.http_interface.GenericToken):
  """Stores the Authorization header in auth_header and adds to requests.

  This token will add it's Authorization header to an HTTP request
  as it is made. Ths token class is simple but
  some Token classes must calculate portions of the Authorization header
  based on the request being made, which is why the token is responsible
  for making requests via an http_client parameter.

  Args:
    auth_header: str The value for the Authorization header.
    scopes: list of str or atom.url.Url specifying the beginnings of URLs
        for which this token can be used. For example, if scopes contains
        'http://example.com/foo', then this token can be used for a request to
        'http://example.com/foo/bar' but it cannot be used for a request to
        'http://example.com/baz'
  """
  def __init__(self, auth_header=None, scopes=None):
    self.auth_header = auth_header
    self.scopes = scopes or []

  def __str__(self):
    return self.auth_header

  def perform_request(self, http_client, operation, url, data=None,
                      headers=None):
    """Sets the Authorization header and makes the HTTP request."""
    if headers is None:
      headers = {'Authorization':self.auth_header}
    else:
      headers['Authorization'] = self.auth_header
    return http_client.request(operation, url, data=data, headers=headers)

  def get_token_string(self):
    """Removes PROGRAMMATIC_AUTH_LABEL to give just the token value."""
    return self.auth_header[len(PROGRAMMATIC_AUTH_LABEL):]

  def set_token_string(self, token_string):
    self.auth_header = '%s%s' % (PROGRAMMATIC_AUTH_LABEL, token_string)
  
  def valid_for_scope(self, url):
    """Tells the caller if the token authorizes access to the desired URL.
    """
    if isinstance(url, (str, unicode)):
      url = atom.url.parse_url(url)
    for scope in self.scopes:
      if scope == atom.token_store.SCOPE_ALL:
        return True
      if isinstance(scope, (str, unicode)):
        scope = atom.url.parse_url(scope)
      if scope == url:
        return True
      # Check the host and the path, but ignore the port and protocol.
      elif scope.host == url.host and not scope.path:
        return True
      elif scope.host == url.host and scope.path and not url.path:
        continue
      elif scope.host == url.host and url.path.startswith(scope.path):
        return True
    return False


class AuthSubToken(ClientLoginToken):
  def get_token_string(self):
    """Removes AUTHSUB_AUTH_LABEL to give just the token value."""
    return self.auth_header[len(AUTHSUB_AUTH_LABEL):]

  def set_token_string(self, token_string):
    self.auth_header = '%s%s' % (AUTHSUB_AUTH_LABEL, token_string)


class OAuthToken(atom.http_interface.GenericToken):
  """Stores the token key, token secret and scopes for which token is valid.
  
  This token adds the authorization header to each request made. It
  re-calculates authorization header for every request since the OAuth
  signature to be added to the authorization header is dependent on the
  request parameters.
  
  Attributes:
    key: str The value for the OAuth token i.e. token key.
    secret: str The value for the OAuth token secret.
    scopes: list of str or atom.url.Url specifying the beginnings of URLs
        for which this token can be used. For example, if scopes contains
        'http://example.com/foo', then this token can be used for a request to
        'http://example.com/foo/bar' but it cannot be used for a request to
        'http://example.com/baz'
    oauth_input_params: OAuthInputParams OAuth input parameters.      
  """
  
  def __init__(self, key=None, secret=None, scopes=None,
               oauth_input_params=None):
    self.key = key
    self.secret = secret
    self.scopes = scopes or []
    self.oauth_input_params = oauth_input_params
  
  def __str__(self):
    return self.get_token_string()

  def get_token_string(self):
    """Returns the token string.
    
    The token string returned is of format
    oauth_token=[0]&oauth_token_secret=[1], where [0] and [1] are some strings.
    
    Returns:
      A token string of format oauth_token=[0]&oauth_token_secret=[1],
      where [0] and [1] are some strings. If self.secret is absent, it just
      returns oauth_token=[0]. If self.key is absent, it just returns
      oauth_token_secret=[1]. If both are absent, it returns None.
    """
    if self.key and self.secret:
      return urllib.urlencode({'oauth_token': self.key,
                               'oauth_token_secret': self.secret})
    elif self.key:
      return 'oauth_token=%s' % self.key
    elif self.secret:
      return 'oauth_token_secret=%s' % self.secret
    else:
      return None

  def set_token_string(self, token_string):
    """Sets the token key and secret from the token string.
    
    Args:
      token_string: str Token string of form
          oauth_token=[0]&oauth_token_secret=[1]. If oauth_token is not present,
          self.key will be None. If oauth_token_secret is not present,
          self.secret will be None.
    """
    token_params = cgi.parse_qs(token_string, keep_blank_values=False)
    if 'oauth_token' in token_params:
      self.key = token_params['oauth_token'][0]
    if 'oauth_token_secret' in token_params:
      self.secret = token_params['oauth_token_secret'][0]
    
  def GetAuthHeader(self, http_method, http_url, realm=''):
    """Get the authentication header.

    Args:
      http_method: string HTTP method i.e. operation e.g. GET, POST, PUT, etc.
      http_url: string or atom.url.Url HTTP URL to which request is made.
      realm: string (default='') realm parameter to be included in the
          authorization header.

    Returns:
      dict Header to be sent with every subsequent request after
      authentication.
    """
    if isinstance(http_url, types.StringTypes):
      http_url = atom.url.parse_url(http_url)
    header = None
    token = None
    if self.key or self.secret:
      token = oauth.OAuthToken(self.key, self.secret)
    oauth_request = oauth.OAuthRequest.from_consumer_and_token(
        self.oauth_input_params.GetConsumer(), token=token,
        http_url=str(http_url), http_method=http_method,
        parameters=http_url.params)
    oauth_request.sign_request(self.oauth_input_params.GetSignatureMethod(),
                               self.oauth_input_params.GetConsumer(), token)
    header = oauth_request.to_header(realm=realm)
    header['Authorization'] = header['Authorization'].replace('+', '%2B')
    return header
  
  def perform_request(self, http_client, operation, url, data=None,
                      headers=None):
    """Sets the Authorization header and makes the HTTP request."""
    if not headers:
      headers = {}
    if self.oauth_input_params.requestor_id:
      url.params['xoauth_requestor_id'] = self.oauth_input_params.requestor_id
    headers.update(self.GetAuthHeader(operation, url))
    return http_client.request(operation, url, data=data, headers=headers)
    
  def valid_for_scope(self, url):
    if isinstance(url, (str, unicode)):
      url = atom.url.parse_url(url)
    for scope in self.scopes:
      if scope == atom.token_store.SCOPE_ALL:
        return True
      if isinstance(scope, (str, unicode)):
        scope = atom.url.parse_url(scope)
      if scope == url:
        return True
      # Check the host and the path, but ignore the port and protocol.
      elif scope.host == url.host and not scope.path:
        return True
      elif scope.host == url.host and scope.path and not url.path:
        continue
      elif scope.host == url.host and url.path.startswith(scope.path):
        return True
    return False    
    

class SecureAuthSubToken(AuthSubToken):
  """Stores the rsa private key, token, and scopes for the secure AuthSub token.
  
  This token adds the authorization header to each request made. It
  re-calculates authorization header for every request since the secure AuthSub
  signature to be added to the authorization header is dependent on the
  request parameters.
  
  Attributes:
    rsa_key: string The RSA private key in PEM format that the token will
             use to sign requests
    token_string: string (optional) The value for the AuthSub token.
    scopes: list of str or atom.url.Url specifying the beginnings of URLs
        for which this token can be used. For example, if scopes contains
        'http://example.com/foo', then this token can be used for a request to
        'http://example.com/foo/bar' but it cannot be used for a request to
        'http://example.com/baz'     
  """
  
  def __init__(self, rsa_key, token_string=None, scopes=None):
    self.rsa_key = keyfactory.parsePEMKey(rsa_key)
    self.token_string = token_string or ''
    self.scopes = scopes or [] 
   
  def __str__(self):
    return self.get_token_string()

  def get_token_string(self):
    return str(self.token_string)

  def set_token_string(self, token_string):
    self.token_string = token_string
    
  def GetAuthHeader(self, http_method, http_url):
    """Generates the Authorization header.

    The form of the secure AuthSub Authorization header is
    Authorization: AuthSub token="token" sigalg="sigalg" data="data" sig="sig"
    and  data represents a string in the form
    data = http_method http_url timestamp nonce

    Args:
      http_method: string HTTP method i.e. operation e.g. GET, POST, PUT, etc.
      http_url: string or atom.url.Url HTTP URL to which request is made.
      
    Returns:
      dict Header to be sent with every subsequent request after authentication.
    """
    timestamp = int(math.floor(time.time()))
    nonce = '%lu' % random.randrange(1, 2**64)
    data = '%s %s %d %s' % (http_method, str(http_url), timestamp, nonce)
    sig = cryptomath.bytesToBase64(self.rsa_key.hashAndSign(data))
    header = {'Authorization': '%s"%s" data="%s" sig="%s" sigalg="rsa-sha1"' %
              (AUTHSUB_AUTH_LABEL, self.token_string, data, sig)}
    return header
  
  def perform_request(self, http_client, operation, url, data=None, 
                      headers=None):
    """Sets the Authorization header and makes the HTTP request."""
    if not headers:
      headers = {}
    headers.update(self.GetAuthHeader(operation, url))
    return http_client.request(operation, url, data=data, headers=headers)