+ IiULa0t$^RIHt^RIt^RIt^RIt^RIHt^RIH t H t H t ^RI H t H t Ht^RIHtHtHtHt^RIHtHtHt^RIHtHtHtHtHtHtHtH t H!t!^R IH"t"]'g ]#!]PH!R R 44'd_^RI%t%]%PLR8d^R IH't'M^R I(H't'^R I)H*t*H+t+^RI,H-t-^RI.H/t/H0t0H1t1]]*]-]2]33,t4R]5R&]]+]-]2]33,t6R]5R&!RR4t7]7!4t8]]8n9]8Ptt:]8Pvt;]8Pxt`_). Instead, either hard-code a fixed value for ``algorithms``, or configure it in the same place you configure the ``key``. Make sure not to mix symmetric and asymmetric algorithms that interpret the ``key`` in different ways (e.g. HS\* and RS\*). :type algorithms: typing.Sequence[str] or None :param jwt.types.Options options: extended decoding and validation options Refer to :py:class:`jwt.types.Options` for more information. :param audience: optional, the value for ``verify_aud`` check :type audience: str or typing.Iterable[str] or None :param issuer: optional, the value for ``verify_iss`` check :type issuer: str or typing.Container[str] or None :param leeway: a time margin in seconds for the expiration check :type leeway: float or datetime.timedelta :rtype: dict[str, typing.Any] :returns: Decoded JWT with the JOSE Header on the key ``header``, the JWS Payload on the key ``payload``, and the JWS Signature on the key ``signature``. zypassing additional kwargs to decode_complete() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs:  stacklevelTr@zThe `verify` argument to `decode` does nothing in PyJWT 2.0 and newer. The equivalent is setting `verify_signature` to False in the `options` dictionary. This invocation has a mismatch between the kwarg and the option entry.)categoryr)rWr}r+r)rrrrrU) warningswarntuplekeysrrODeprecationWarningr7r9decode_complete_decode_payload_validate_claims)r;r{rWr}r+rrrrrrrr@merged_options sig_optionsdecodedrUs&&&&&&&&&&&, r1rPyJWT.decode_completesr  MM'',V[[]';&<>'   ?# &{{+=tD   &"< MMY,  ,,W5  0# ))++ !- , &&w/     % r4c V^8dQhRRRR/#)r*rrVr-r/)r0s"r1r2r3s~.r4c \P!VR,4p\ T\ 4'g \R4hT# \dp\RT 24ThRp?ii;i)z Decode the payload from a JWS dictionary (payload, signature, header). This method is intended to be overridden by subclasses that need to decode the payload in a different way, e.g. decompress compressed payloads. rUzInvalid payload string: Nz-Invalid payload string: must be a json object)rwloads ValueErrorrrfrg)r;rrUes&& r1rPyJWT._decode_payloadsd E&*jj1C&DG'4((MN N  E 8<=1 D EsA A! AA!cHV^8dQhRRRRRRRRR R R R R RRRRRRRRRRR/ #)r*r{r|rWz'AllowedPublicKeys | PyJWK | str | bytesr}r~r+r,rrrrrrrrYrrrrrr r-rVr/)r0s"r1r2r3,sM8M8 M85M8) M8  M8M8'M8-M8M8,M8"M8"#M8$ %M8r4c V 'd8\P!R\V P44 2\^R7VP VVVVVVVVV V R7 p \ \\\3,V R,4#)uVerify the ``jwt`` token signature and return the token claims. :param jwt: the token to be decoded :type jwt: str or bytes :param key: the key suitable for the allowed algorithm :type key: str or bytes or PyJWK or :py:class:`jwt.algorithms.AllowedPublicKeys` :param algorithms: allowed algorithms, e.g. ``["ES256"]`` If ``key`` is a :class:`PyJWK` object, allowed algorithms will default to the key algorithm. .. warning:: Do **not** compute the ``algorithms`` parameter based on the ``alg`` from the token itself, or on any other data that an attacker may be able to influence, as that might expose you to various vulnerabilities (see `RFC 8725 §2.1 `_). Instead, either hard-code a fixed value for ``algorithms``, or configure it in the same place you configure the ``key``. Make sure not to mix symmetric and asymmetric algorithms that interpret the ``key`` in different ways (e.g. HS\* and RS\*). :type algorithms: typing.Sequence[str] or None :param jwt.types.Options options: extended decoding and validation options Refer to :py:class:`jwt.types.Options` for more information. :param audience: optional, the value for ``verify_aud`` check :type audience: str or typing.Iterable[str] or None :param subject: optional, the value for ``verify_sub`` check :type subject: str or None :param issuer: optional, the value for ``verify_iss`` check :type issuer: str or typing.Container[str] or None :param leeway: a time margin in seconds for the expiration check :type leeway: float or datetime.timedelta :rtype: dict[str, typing.Any] :returns: the JWT claims zppassing additional kwargs to decode() is deprecated and will be removed in pyjwt version 3. Unsupported kwargs: r)rrrrrrrU) rrrrrrrrgr`r ) r;r{rWr}r+rrrrrrrrs &&&&&&&&&&&, r1decode PyJWT.decode,sr  MM'',V[[]';&<>'  &&    -'  DcNGI$677r4c4V^8dQhRRRRRRRRR R R R R R/#)r*rUrVr+r"rzIterable[str] | str | NonerContainer[str] | str | NonerrYrrr-r.r/)r0s"r1r2r3{sP((((((((- (( , ((  (("(( ((r4c V\V\4'dVP4pVe(\V\\34'g \ R4hVP WR,4\P!\PR7P4pRV9d"VR,'dVPWV4RV9d"VR,'dVPWV4RV9d"VR ,'dVPWV4VR ,'dVPW4VR ,'d$VP!WVP#R R 4R7VR,'dVP%W4VR,'dVP'V4R#R#)Nz+audience must be a string, iterable or NonerH)tzrdrCrerBrcrArErDrIF)strictrFrG)rfr total_secondsr`rrh_validate_required_claimsrnowr utc timestamp _validate_iat _validate_nbf _validate_exp _validate_iss _validate_audrO _validate_sub _validate_jti)r;rUr+rrrrrs&&&&&&& r1rPyJWT._validate_claims{sU fi ( ())+F   8c8_(M(MIJ J &&w 0BCllhll+557 G  5 5   wV 4 G  5 5   wV 4 G  5 5   wV 4 <   w / <   '++lE*J   <   w 0 <   w ' !r4c$V^8dQhRRRRRR/#)r*rUrVclaimsz Iterable[str]r-r.r/)r0s"r1r2r3s(7777  7r4c TVF!pVPV4eK\V4h R#N)rOr)r;rUrclaims&&& r1rPyJWT._validate_required_claimss( E{{5!)/66r4c$V^8dQhRRRRRR/#)r*rUrVrrYr-r.r/)r0s"r1r2r3s$==%=0:= =r4c RV9dR#\VR,\4'g \R4hVe$VPR4V8wd \R4hR#R#)z Checks whether "sub" if in the payload is valid or not. This is an Optional claim :param payload(dict): The payload which needs to be validated :param subject(str): The subject of the token subNzSubject must be a stringzInvalid subject)rfr`rrO)r;rUrs&&&r1rPyJWT._validate_subsY   '%.#..%&@A A  {{5!W,)*;<<- r4c V^8dQhRRRR/#)r*rUrVr-r.r/)r0s"r1r2r3s = =^ = =r4c xRV9dR#\VPR4\4'g \R4hR#)z Checks whether "jti" if in the payload is valid or not This is an Optional claim :param payload(dict): The payload which needs to be validated jtiNzJWT ID must be a string)rfrOr`r)r;rUs&&r1rPyJWT._validate_jtis6   '++e,c22!";< <3r4c(V^8dQhRRRRRRRR/#r*rUrVrfloatrr-r.r/)r0s"r1r2r3s8 M M M M M  Mr4c \VR,4pYBT,8d \R4hR# \d\R4Rhi;i)rdz)Issued At claim (iat) must be an integer.Nz The token is not yet valid (iat))intrrr)r;rUrrrds&&&& r1rPyJWT._validate_iatsV  gen%C , ()KL L  &;   .Ac(V^8dQhRRRRRRRR/#rr/)r0s"r1r2r3s8 M M M M M  Mr4c \VR,4pYBT,8d \R4hR# \d\R4Rhi;i)rez*Not Before claim (nbf) must be an integer.Nz The token is not yet valid (nbf))rrrr)r;rUrrres&&&& r1rPyJWT._validate_nbfsU  Vgen%C , ()KL L  VJKQU U Vrc(V^8dQhRRRRRRRR/#rr/)r0s"r1r2r3s8AAAA A  Ar4c \VR,4pYBT, 8:d \R4hR# \d\R4Rhi;i)rcz/Expiration Time claim (exp) must be an integer.NzSignature has expired)rrrr)r;rUrrrcs&&&& r1rPyJWT._validate_expsV  gen%C < '(?@ @ !  A  rrFc(V^8dQhRRRRRRRR/#) r*rUrVrrrr_r-r.r/)r0s"r1r2r3s80A0A0A-0A  0A  0Ar4c ,aVf$RV9gVR,'gR#\R4hRV9gVR,'g \R4hVR,oV'dW\V\4'g \R4h\S\4'g \R4hVS8wd \R4hR#\S\4'dS.o\S\4'g \R4h\ ;QJdRS4F 'gK RM R M !RS44'd \R4h\V\4'dV.p\ ;QJdV3R lV4F 'dK R M RM!V3R lV44'd \R 4hR#) NaudzInvalid audiencezInvalid audience (strict)z&Invalid claim format in token (strict)zAudience doesn't match (strict)zInvalid claim format in tokenc3L"TFp\V\4'*xK R#5ir)rfr`).0cs& r1 &PyJWT._validate_aud..'s?!:a%%%s"$TFc3,<"TF qS9xK R#5irr/)rraudience_claimss& r1rr-s>Xc/)XszAudience doesn't match)rrrfr`listanyall)r;rUrrrs&&&$@r1rPyJWT._validate_audsC  G#75>>''9: :  wu~~,E2 2!%. h,,*+FGGos33*+STT?**+LMM  os + +./O/400&'FG G 3??333?? ? ?&'FG G h $ $ zH 3>X>333>X> > >&'?@ @ ?r4c$V^8dQhRRRRRR/#)r*rUrVrrr-r.r/)r0s"r1r2r30s$%/J r4c 6VfR#RV9d \R4hVR,p\V\4'g \R4h\V\4'dW28wd \R4hR#W29d \R4hR# \d\R4Rhi;i)Nrbz%Payload Issuer (iss) must be a stringzInvalid issuerz.Issuer param must be "str" or "Container[str]")rrfr`rrh)r;rUrrbs&&& r1rPyJWT._validate_iss0s >   +E2 2en#s##$%LM M fc " "}()9:: $,-=>>% (D s -BB)r9r+r)NN) rNNNNNNNr)NNNr)__name__ __module__ __qualname____firstlineno__r< staticmethodr6r8r7rrlrkrrrrrrrrrrrr__static_attributes__r/r4r1r(r(*s;      +&!1)-6:!@ D$l\ M8^((T7=* = M MA 0A  0Adr4r() )=__conditional_annotations__ __future__rrwosrcalendarrcollections.abcrrrrr r typingr r r rapi_jwsrrr exceptionsrrrrrrrrrrr_getenvsys version_infortyping_extensionsr}rr api_jwkr!typesr"r#r$r`rqr%__annotations__r&r(_jwt_global_objr9rlrr)rs@r1rs"" 992222==   -D>2677 7"$ 0A77(-.@%e.S(TIT',->sE-Q'R9R]]@'&   !11   r4