import base64

import http.client as http_client

import json

import os

from google.auth import _exponential_backoff

from google.auth import _helpers

from google.auth import credentials

from google.auth import crypt

from google.auth import exceptions

from google.auth.transport import mtls

IAM_RETRY_CODES = {

http_client.INTERNAL_SERVER_ERROR,

_IAM_SCOPE = ["https://www.googleapis.com/auth/iam"]

_IAM_ENDPOINT = (

"https://iamcredentials.googleapis.com/v1/projects/-"

+ "/serviceAccounts/{}:generateAccessToken"

)

_IAM_SIGN_ENDPOINT = (

"https://iamcredentials.googleapis.com/v1/projects/-"

+ "/serviceAccounts/{}:signBlob"

)

_IAM_SIGNJWT_ENDPOINT = (

"https://iamcredentials.googleapis.com/v1/projects/-"

+ "/serviceAccounts/{}:signJwt"

)

_IAM_IDTOKEN_ENDPOINT = (

"https://iamcredentials.googleapis.com/v1/"

+ "projects/-/serviceAccounts/{}:generateIdToken"

)

# 1. Determine if we should use mTLS.

# Note: We only support automatic mTLS on the default googleapis.com universe.

if hasattr(mtls, "should_use_client_cert"):

use_client_cert = mtls.should_use_client_cert()

else: # pragma: NO COVER

# if unsupported, fallback to reading from env var

use_client_cert = (

os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() == "true"

)

# 2. Construct the template domain using the library's DEFAULT_UNIVERSE_DOMAIN constant.

# This ensures that the .replace() calls in the classes will work correctly.

if use_client_cert:

# We use the .mtls. prefix only for the default universe template

_IAM_DOMAIN = f"iamcredentials.mtls.{credentials.DEFAULT_UNIVERSE_DOMAIN}"

else:

_IAM_DOMAIN = f"iamcredentials.{credentials.DEFAULT_UNIVERSE_DOMAIN}"

# 3. Create the common base URL template

# We use double brackets {{}} so .format() can be called later for the email.

_IAM_BASE_URL = f"https://{_IAM_DOMAIN}/v1/projects/-/serviceAccounts/{{}}"

# 4. Define the endpoints as templates

_IAM_ENDPOINT = _IAM_BASE_URL + ":generateAccessToken"

_IAM_SIGN_ENDPOINT = _IAM_BASE_URL + ":signBlob"

_IAM_SIGNJWT_ENDPOINT = _IAM_BASE_URL + ":signJwt"

_IAM_IDTOKEN_ENDPOINT = _IAM_BASE_URL + ":generateIdToken"

class Signer(crypt.Signer):