o l>j@sUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZddlmZmZddlmZddlmZmZmZmZmZddlmZdd lmZmZdd l m!Z!dd l"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,dd l-m.Z.e/e0Z1dZ2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:dZ;dZdZ?dZ@eAdBdZCdZDdZEddd ZFd!eGd"<d#ZHd$ZId%ZJd&ZKed'd(Gd)d*d*ZLGd+d,d,e#ZMed'd(Gd-d.d.ZNeGd/d0d0ZOed'd(Gd1d2d2ZPed'd(Gd3d4d4ZQed'd(Gd5d6d6ZRed'd(Gd7d8d8ZSed'd(Gd9d:d:ZTed'd(Gd;d<d<ZUed'd(Gd=d>d>ZVGd?d@d@eZWGdAdBdBeXZYGdCdDdDeZZddHdIZ[ddMdNZ\ddRdSZ]ddVdWZ^ddXdYZ_ddZd[Z`dd\d]Zadd_d`ZbddbdcZcddddeZdddfdgZeddhdiZfddjdkZgddodpZhddqdrZiddudvZjddydzZkdd{d|ZldddZmdddZndddZodddZpdddZqddddddZrdddZsdddZtdddZuGdddZvGdddZwdS)z=Internal helpers for Apple's HSA2 trusted-device bridge flow.) annotationsN)Error) dataclassfield) HTMLParser)AnyCallableMappingOptionalProtocol)urlparse)hashes serialization)ec) BaseModel ConfigDictField StrictInt StrictStrValidationErrorfield_validator)$PyiCloudTrustedDevicePromptException*PyiCloudTrustedDeviceVerificationException)TrustedDeviceBridgeProverz/bridge/step/0z/bridge/step/{step}z/bridge/code/validateiQ ssdoneasciiz$258EAFA5-E914-47DA-95CA-C5AB0DC85B11g>@zwebsocket.push.apple.comz websocket.sandbox.push.apple.com)prodsandboxdict[str, str]WEBSOCKET_ENVIRONMENT_HOSTSiiT)frozenc@s~eZdZUdZdZded<dZded<dZd ed <ee d Z d ed <ee d Z d ed<dZ ded<e dddZdddZdS)Hsa2BootContextzABridge-related HSA2 boot data parsed from Apple's HTML bootstrap.strauth_initial_routeFboolhas_trusted_devicestuple[str, ...] auth_factorsdefault_factorydict[str, Any]bridge_initiate_dataphone_number_verificationN Optional[str] source_app_id auth_optionsMapping[str, Any]return'Hsa2BootContext'cCs|d}t|ts i}|d}t|ts|d}t|ts"i}|d}t|ts.g}|d}|dur;t|}|t|dpCdt|dtd d |Dt|t||d S) zBBuild a normalized boot context from Apple's auth-options payload.bridgeInitiateDataphoneNumberVerification authFactors sourceAppIdNauthInitialRouter*hasTrustedDevicescs|] }t|tr|VqdSN isinstancer+.0factorr/r/I/home/thesage/.local/lib/python3.10/site-packages/pyicloud/hsa2_bridge.py j   z4Hsa2BootContext.from_auth_options..r,r.r1r5r6r8)getrFdictlistr+r-tuple)clsr9r5r6r1r8r/r/rJfrom_auth_optionsPs4         z!Hsa2BootContext.from_auth_optionscCsx|j|jt|jd}|jrt|j|d<|jr0t|j|d<|jd}t|tr0t||d<|j dur:|j |d<|S)z?Return parsed boot data in the shape expected by the auth flow.)rArBr?r=r>trustedPhoneNumberNr@) r,r.rPr1r5rOr6rNrFr8)self auth_datatrusted_phone_numberr/r/rJ as_auth_datars     zHsa2BootContext.as_auth_data)r9r:r;r<r;r4)__name__ __module__ __qualname____doc__r,__annotations__r.r1rrOr5r6r8 classmethodrSrXr/r/r/rJr)Es      !r)c@s.eZdZUdZeddddZedddZded <edd dZ ded <edd dZ d ed<edddZ ded<dZ ded<dZ ded<dZded<dZded<dZded<dZded<edddZded<edddZded<ed d ed'd d!Zedddddded'd"d#Zeded(d%d&ZdS))_BridgePushPayloadModelz7Strict validator for Apple's bridge push JSON envelope.allowT)extrapopulate_by_namearbitrary_types_allowedN sessionUUID)defaultaliaszOptional[StrictStr] session_uuidflowidflow_idnextStepzOptional[StrictStr | StrictInt] next_step ruiURLKeyr7 rui_url_keytxnidsaltmididmsdatarakdatadata encryptedCodeencrypted_coderzOptional[StrictInt] error_codevaluer;cC|dur |s td|S)z(Reject blank bridge session identifiers.Nz$sessionUUID/flowid must not be blankstrip ValueErrorrRrxr/r/rJ_validate_session_uuidsz._BridgePushPayloadModel._validate_session_uuidcCry)z7Reject present-but-blank optional bridge string fields.Nz(Bridge payload strings must not be blankrzr}r/r/rJ$_validate_optional_non_empty_stringss z<_BridgePushPayloadModel._validate_optional_non_empty_stringsOptional[str | int]cCst|tr |s td|S)z>Reject blank next-step markers while allowing ints or strings.znextStep must not be blank)rFr+r{r|r}r/r/rJ_validate_next_stepsz+_BridgePushPayloadModel._validate_next_step)rxr7r;r7)rxrr;r)rZr[r\r]r model_configrrhr^rjrlrnrorprqrrrsrtrvrwrr_r~rrr/r/r/rJr`sF       r`c@seZdZUdZded<ded<dZded<dZded <dZded <dZded <dZ ded <dZ ded <dZ ded<dZ ded<dZ ded<dZded<edddZdS)BridgePushPayloadzHDecoded bridge push metadata needed to bootstrap trusted-device prompts.r4payloadr+rhNr7rlrnrorprqrrrrsrtrv Optional[int]rwr;'BridgePushPayload'cCszt|}Wnty}ztd|d}~ww|jp|j}|s%td||||jdur2t|jnd|j|j |j |j |j |j |j|j|jd S)z7Validate and normalize one decoded bridge push payload.z-Malformed trusted-device bridge push payload.NzATrusted-device bridge push payload is missing sessionUUID/flowid.) rrhrlrnrorprqrrrsrtrvrw)r`model_validaterrrhrjrlr+rnrorprqrrrsrtrvrw)rRr validatedexcresolved_session_uuidr/r/rJ from_payloads: zBridgePushPayload.from_payload)rr4r;r)rZr[r\r]r^rlrnrorprqrrrsrtrvrwr_rr/r/r/rJrs           rc@seZdZUdZded<ded<ded<ded<ded<d ed <d Zd ed <d Zd ed<d Zd ed<ee dZ ded<d Z d ed<d Z d ed<d Z d ed<d Zd ed<d Zded<d Zd ed<d Zd ed<d Zded<d%d d!Zed&d#d$Zd S)'TrustedDeviceBridgeStatez&Ephemeral trusted-device bridge state.r+connection_path push_tokenrhzOptional[_WebSocketLike] websockettopicr$topics_by_hashNr7r8rlrnr2r4 push_payloadrorprqrrrrsrtrvrrwrr;NonecCsht|j|_|j|_|j|_|j|_|j|_|j|_|j|_|j |_ |j |_ |j |_ |j |_ |j |_ dS)zCPersist the latest bridge push metadata in the live bridge session.N)rOrrrhrlrnrorprqrrrsrtrvrw)rUrr/r/rJapply_push_payload s  z+TrustedDeviceBridgeState.apply_push_payloadr-cCst|jo |jdS)zIReturn whether Apple routed this bridge challenge to the legacy verifier._W)r-roendswithrUr/r/rJ#uses_legacy_trusted_device_verifierszsz7_BootArgsHTMLParser.handle_starttag..classr* boot_argsT)rrNsplitr)rUrrattr_mapclassesr/r/rJhandle_starttags z#_BootArgsHTMLParser.handle_starttagcCs |dkr |jrd|_dSdSdS)z3Stop collecting when the current script tag closes.rFN)r)rUrr/r/rJ handle_endtags z!_BootArgsHTMLParser.handle_endtagrtcCs|jr |j|dSdS)z9Append script contents while the boot_args tag is active.N)rrappend)rUrtr/r/rJ handle_datasz_BootArgsHTMLParser.handle_datarr;r+)rr+rrr;r)rr+r;r)rtr+r;r) rZr[r\r]rrrrrrrr/r/rrJrs   r html_textr+r;c Cs6t}||||j}|stdzt|}Wntjy.}ztd|d}~ww|d}t |t s=td|d}t |t sIi}|d}t |t sUi}|d}t |t sai}|d } t | t smg} |d } | durzt | } t t |d pd t|d tdd| Dt |t || dS)zEExtract HSA2 boot args from the HTML returned by GET /appleauth/auth.zMissing HSA2 boot args payload.z!Malformed HSA2 boot args payload.NdirectzMissing HSA2 direct boot data.twoSVr=r>r?r@rAr*rBcsrCrDrErGr/r/rJrKrLz'parse_boot_args_html..rM)rfeedrrrrloadsJSONDecodeErrorrNrFrOrPr+r)r-rQ) rparser payload_textrrrtwo_svr5r6r1r8r/r/rJparse_boot_args_htmlsX             rrxrrcCsP|dkrtdt} |d@}|dL}|r||dBn ||t|Sq )z#Encode an unsigned protobuf varint.rz#Negative varints are not supported.Tr )r| bytearrayrr)rxpartsto_writer/r/rJ_encode_varints rrtoffsettuple[int, int]cCsxd}d}|} |t|krtd||}|d7}||d@|>O}|d@s)||fS|d7}|dks7||d kr;td q) zHDecode one protobuf varint from a byte string and return the new offset.rTzTruncated protobuf varint.rrrr ?rzMalformed protobuf varint.)lenr)rtrrxshift start_offsetbyter/r/rJ _read_varints r field_number wire_typecCst|d>|B|S)z-Encode one protobuf field header and payload.r)r)rrrxr/r/rJ _encode_fieldrcCst|dtt||S)z)Encode a length-delimited protobuf field.r)rrrrrxr/r/rJ_encode_bytes_fieldrcCst||dS)z%Encode a UTF-8 string protobuf field.utf-8)rencoderr/r/rJ_encode_string_fieldrcCst|dt|S)z*Encode an unsigned integer protobuf field.r)rrrr/r/rJ_encode_uint32_field!rrdict[int, list[Any]]c Csd}i}|t|kr]t||\}}|d?}|d@}|dkr%t||\}}n)|dkrGt||\}}||}|t|kr>td|||}|}ntd|||g||t|ks |S)z@Decode a minimal subset of protobuf wire types into field lists.rrr rzTruncated protobuf field.z Unsupported protobuf wire type: )rrr setdefaultr) rtrfieldsrrrrxlength end_offsetr/r/rJ_decode_fields&s*    rmessagec Cst|}d}|dr(z |ddd}Wnty'}ztd|d}~wwt|ddgd}d}|drBt|dd}t|||d S) z1Decode the server's websocket bootstrap response.r*rrr!z0Malformed bridge connection response push token.Nrr)rrr)rrNdecodeUnicodeDecodeErrorrrr)rrrrrrr/r/rJ_decode_connection_responseCs,  r cCsXt|}t|ddgd}t|ddgd}t|ddgd}t|||dS)z9Decode one push-delivery frame from the bridge websocket.rrr)rrr)rrrNrr)rrrrrr/r/rJ_decode_push_messageYs rcCst|}g}|d}|r;tt|d}|dgD]}tt|}|ddgd}t|tr:||ddqtt|ddgdt|ddgdt|ddgdtd d |Dd S) z?Decode the server's response to the topic subscription message.rrr rignorerrr css|]}|r|VqdSrDr/rHrr/r/rJrKvsz8_decode_channel_subscription_response..)rrrr) rrNrrFrr rrrQ)rrrpayload_valuespayload_fieldsapp_response_valueapp_response_fields topic_valuer/r/rJ%_decode_channel_subscription_responsebs"   rcCsXt|}t|ddgd}t|ddgd}t|ddgd}t|||dS)z=Decode a push acknowledgment frame from the bridge websocket.rr rrr)rrr)rrrNrr)rrrrrr/r/rJ_decode_acknowledgement_messagezsrcCst|}d}|trtt|td}d}|tr&tt|td}d}|tr7tt|td}d}|t rHt t|t d}t ||||t t |dS)zDDecode all known top-level messages embedded in one websocket frame.Nr)rrrrr)rrN"SERVER_MESSAGE_CONNECTION_RESPONSEr rSERVER_MESSAGE_PUSHr,SERVER_MESSAGE_CHANNEL_SUBSCRIPTION_RESPONSErSERVER_MESSAGE_PUSH_ACKrrrQsorted)rrrrrrr/r/rJ_decode_server_messages4     r public_keynonce signaturec Cs>dtd|td|tdt|tdtdtg}td|S)z6Encode the initial bridge websocket bootstrap message.r rrr)rr_encode_bridge_signaturer!NEW_CONNECTION_EXPIRATION_SECONDS)rrr connection_messager/r/rJ_encode_connection_messages   r%cCs|tr|St|S)zEWrap the DER ECDSA signature using Apple's bridge signature envelope.) startswithBRIDGE_SIGNATURE_PREFIX)r r/r/rJr"s r"allowed_topics list[str]cCsddd|D}td|S)z@Encode the topic subscription message sent after bridge connect.r css|]}td|VqdS)rN)rrr/r/rJrKs  z-_encode_web_filter_message..r)rr)r(filter_payloadr/r/rJ_encode_web_filter_messages  r+rrcCs$dtd|td|g}td|S)z?Encode the acknowledgment frame for one delivered push message.r rr)rrr)rr ack_payloadr/r/rJ_encode_ack_messages  r-cCst|dS)z;Return Apple's websocket topic hash for a named APNS topic.r)hashlibsha1r hexdigest)rr/r/rJ _topic_hashrr1 topic_bytesrMapping[str, str]cCs|||ddS)z=Resolve a hashed topic payload back to a readable topic name.rr)rNhexr )r2rr/r/rJ _topic_namerr5rr4c Cs*z t|dWSttjfy|dd}Ynw|d}|dkrd}d}d}t||d|dD]O\}}|rN|r@d}n |dkrGd }n|d krMd}q5|d krUd }q5|dkr^|d 7}q5|d kr|d 8}|dkrzt|||d WStjyYnwq5|d|d }|dks%td )z)prefixemptyr7rUrVcCs*|s|St||kr |S|d|dS)zAShorten sensitive identifiers before logging them at debug level.Nz...)r)rxrUrVr/r/rJ_summarize_identifiers  rW boot_contextcCsv|j}|d}t|tr%|r%d|vrt|}|jr|jS|dddS|d}t|tr7|tvr7t|Std)z@Resolve the websocket host Apple expects for the bridge session. webSocketUrl:///rrapnsEnvironmentz:Missing HSA2 websocket host for the trusted-device bridge.) r5rNrFr+r hostnamerr%r)rX bridge_dataweb_socket_urlparsed environmentr/r/rJ_resolve_websocket_host$s  rbcCs&|jd}t|tr|r|Std)zDerive the websocket Origin header from the auth endpoint URL.z0Invalid auth endpoint for trusted-device bridge.rZ)r schemer]r)rer`r/r/rJ_derive_originCs  rgc@s`eZdZdZd"d d Zd#d dZd$ddZd%ddZd&ddZd'ddZ d(ddZ d)dd Z d!S)*_RawWebSocketClientz7Minimal websocket client for Apple's webcourier bridge.urlr+timeoutfloatorigin user_agentr;rcCs.||_||_||_||_t|_||_dS)z=Open a websocket connection and prepare buffered frame reads.N)_url_timeout_origin _user_agentr_buffer_open_socket)rUrirjrlrmr/r/rJrPs z_RawWebSocketClient.__init__ ssl.SSLSocketc Cst|j}|jdks |jstd|j|jpd}|jpd}|jr*|d|j}t |j|f|j }t }|j ||jd}||j ttdd}d |d d |jd d d|jd|jdd|dg }|d|d||} | d\} } } d| vrtd| i} | dD]}|rd|vrq|dd\}}|| |<qtt|t d!d}| "d|krtd|S)z=Perform the websocket HTTP upgrade and return the TLS socket.wsszUnsupported websocket URL: ir[?)server_hostnamer!zGET z HTTP/1.1zHost: zUpgrade: websocketzConnection: UpgradezOrigin: z User-Agent: zSec-WebSocket-Version: 13zSec-WebSocket-Key: z z 101 zWebsocket upgrade failed: rrzsec-websocket-acceptz3Invalid websocket accept header from bridge server.)#r rnrfr]rportpathquerysocketcreate_connectionrosslcreate_default_context wrap_socket settimeoutrFrJrRrSr rprqsendallrr_read_http_response partitionrr{lowerr.r/WEBSOCKET_GUIDdigestrN)rUr`rzresource raw_socketcontext secure_socket websocket_keyrequest_headersresponse status_line_ headers_textheaderslinerrxexpected_acceptr/r/rJrs_s^           z_RawWebSocketClient._opensockcCsnd|jvr|d}|std|j|d|jvs|jdd}t|jd|d}|jd|=|S)zARead the HTTP upgrade response headers from the websocket socket.s z*Unexpected EOF during websocket handshake.r Nz iso-8859-1)rrrecvrextendr;rr )rUrchunkmarkerrtr/r/rJrs     z'_RawWebSocketClient._read_http_responsesizerrcCsrt|j|kr(|jtd|t|j}|std|j|t|j|kst|jd|}|jd|=|S)z?Read exactly ``size`` buffered bytes from the websocket socket.rz-Unexpected EOF while reading websocket frame.N)rrrrtrmaxrrr)rUrrrtr/r/rJ _read_exacts  z_RawWebSocketClient._read_exactopcodercsd|B}tdt|}t|g}|dkr|d|Bn!|dkr1|d|td|n|d|td|tfd d t |D}|j t||d S) z9Send one masked websocket frame to Apple's bridge server.rr ~i!H!Qc3$|] \}}||dAVqdSr Nr/rHrArmask_keyr/rJrK z2_RawWebSocketClient._send_frame..N) rRrSrrrrstructpackrr<rtr)rUrr first_byterheadermasked_payloadr/rrJ _send_frames     z_RawWebSocketClient._send_framecCs|t|dS)z*Send one binary websocket message payload.N)r OPCODE_BINARYrr/r/rJrrz_RawWebSocketClient.send_binaryc s(g}d} |d\}}|d@}t|d@}t|d@}|d@}|dkr0td|dd }n|dkr?td |d d }|rF|d nd ||} |r\tfddt| D} |tkrdtd|tkro| t | q|t krtq|d krz|}| | |r|dt fvrtd|d |Sq)zDRead one complete websocket message, handling control frames inline.NTrrrrrrrrr r c3rrr/rrr/rJrKrz3_RawWebSocketClient.read_message..z3Bridge websocket closed before delivering a prompt.rzUnsupported websocket opcode: )rr-runpackrr< OPCODE_CLOSEr OPCODE_PINGr OPCODE_PONGrrr) rU fragmentsrr second_byte frame_opcodefinishedmaskedpayload_lengthrr/rrJrsJ        z _RawWebSocketClient.read_messagecCst|dddur dSz&z|tdWn tyYnwWz|jWdSty0YdSwz|jWwtyAYww)zCAttempt a clean websocket close and always close the socket object.rtNr )getattrrrOSErrorrtrrr/r/rJrs$   z_RawWebSocketClient.closeN) rir+rjrkrlr+rmr+r;r)r;ru)rrur;r+)rrr;r)rrrrr;rrrr) rZr[r\r]rrsrrrrrrr/r/r/rJrhMs   8    ,rhc@seZdZdZeddddLd d ZdMddZdNddZdOddZdPd!d"Z dQd%d&Z dRd*d+Z dSd/d0Z dTd2d3Z dTd4d5ZdTd6d7ZdUd9d:ZdVdBdCZdWdDdEZdXdHdIZdYdJdKZdS)ZTrustedDeviceBridgeBootstrapperzLBootstrap the trusted-device bridge flow captured in Apple's browser client.N)rjwebsocket_factoryprover_factoryrjrkr:Optional[Callable[[str, float, str, str], _WebSocketLike]]r1Optional[Callable[[], TrustedDeviceBridgeProver]]r;rcCs||_|pt|_|p t|_dS)z?Configure websocket and prover factories for bridge operations.N)rjrh_websocket_factoryr_prover_factory)rUrjrrr/r/rJr s z(TrustedDeviceBridgeBootstrapper.__init__sessionrrer+rr3rXr)rmrc Cst|}t|}t|}t||i} |j} |\} } td|||| d} d}tdD]I}t | p9t t d}| |t t}t| ||}|}d|d|}td|t||||j||}d}zz||}|}td t||t|gtd ||}t|}| r| |d <td t|t||j|||||d |||| }|jddur|j |krt!dtdt|j |j"|j#t$|||j ||t| | d}|%|d}|WW|s|&SSt'y}z|j(} |}td| WYd}~nRd}~wt)t*jt+j,fy@}z|}tjdddWYd}~W|s:|&n;d}~wt!yd}z|}tjdddWYd}~W|s^|&nd}~wwW|sm|&q,|sv|&wwt!d|)zOBootstrap Apple's trusted-device bridge until the first prompt payload arrives.zaBootstrapping trusted-device bridge: auth_endpoint=%s websocket_host=%s topic=%s source_app_id=%sNrzwss://z/v2/z@Opening trusted-device websocket: host=%s bootstrapPayloadLen=%dFz?Trusted-device bridge connected; received push token (%d bytes)z1Sent trusted-device webFilterMessage for topic=%sX-Apple-App-IdzCPosting trusted-device bridge step 0 with sessionUUID=%s ptknLen=%d)rrerrhrre9Trusted-device bridge returned a mismatched session UUID.zOReceived trusted-device bridge payload: sessionUUID=%s nextStep=%s ruiURLKey=%s)rrrhrrrr8TzOTrusted-device bridge received INVALID_NONCE; retrying with server timestamp %sz:Trusted-device websocket transport error during bootstrap.exc_infoz9Trusted-device bridge bootstrap failed before completion.z5Failed to bootstrap the trusted-device bridge prompt.)-rdrbrgr1r8_generate_keypairLOGGERdebugrangerTrtimesignrECDSAr SHA256r%r4rrrj_wait_for_push_tokenrr+_generate_session_uuidrOrW_post_bridge_step0_wait_for_bridge_pushrrNrhrrlrnrrrrrrr}rSSLError)rUrrerrXrmrwebsocket_hostrlrr8r private_keyrM last_errorrrr r$r websocket_urlrkeep_websocket_openrpush_token_hexrhbridge_headersr bridge_staterr/r/rJr7s             z%TrustedDeviceBridgeBootstrapper.start(tuple[bytes, ec.EllipticCurvePrivateKey]cCs0tt}|jtjjtjj d}||fS)zBGenerate the ephemeral P-256 keypair used for websocket bootstrap.)encodingformat) rgenerate_private_key SECP256R1r public_bytesrEncodingX962 PublicFormatUncompressedPoint)rUrrr/r/rJrs z1TrustedDeviceBridgeBootstrapper._generate_keypaircCstdttS)z6Generate the browser-style bridge session UUID string.-)uuiduuid4rrrr/r/rJrsz6TrustedDeviceBridgeBootstrapper._generate_session_uuidr"Optional[TrustedDeviceBridgeState]cCsV|durdS|j}d|_|durdSz|WdSty*tjdddYdSw)zHClose and detach the websocket associated with an active bridge session.Nz-Trusted-device bridge websocket close failed.Tr)rrrrr)rUrrr/r/rJrs  z%TrustedDeviceBridgeBootstrapper.closerr-c Csj|j}|dur td|jrtd|jdvrtd|js"td|}|||}zzWtdt |j |jt |j dd | |j|| } td t |j |j||||d t| |j|jd |||j|j} ||| |js|td z tj|jdddd} | dd\} } t| }t| }Wntttfy}ztd|d}~wwtdt |j z| |}Wnty}ztd|d}~wwz|!|Wntytdt |j YWW|"|dSwtdt |j |j||||dt||j|jd |||j|j}|#|||j$s&tdtdt |j z|%|j$}WntyI}ztd|d}~ww|j&|||||d}|j't(k}|jdvradnd}td |t |j |j'|j|||||t)|j|jd |WW|"|St*y}ztd!|d}~wt+t,j-t.j/fy}ztd"|d}~ww|"|w)#z=Run Apple's bridge-specific trusted-device verification flow.Nz,Trusted-device bridge session is not active.zELegacy trusted-device verification should bypass the bridge verifier.>2rz;Trusted-device bridge is not ready for step 2 verification.z9Trusted-device bridge payload is missing the step-2 salt.zUStarting trusted-device bridge code verification: sessionUUID=%s nextStep=%s txnid=%s rUz8Posting trusted-device bridge step 2 with sessionUUID=%sr)rrerrrlrtrrrsz6rzTPosting trusted-device bridge completion step %s with sessionUUID=%s verifyStatus=%szQTrusted-device bridge verification failed while waiting for the next bridge push.zMTrusted-device bridge verification failed due to a websocket transport error.)0rrrrlrpr_bridge_headersrrrWrhroinit_with_salt get_message1_post_bridge_steprLrrrsrrr_apply_expected_step4_pushrtrFrGrr rrIr|r rHprocess_message1process_message2r_apply_final_bridge_pushrvdecrypt_message_post_bridge_code_validate status_codeHTTP_STATUS_PRECONDITION_FAILEDBRIDGE_DONE_DATA_B64rrr}rjrr)rUrrerrrrproverrmessage1 step4_payload step4_databridge_message1_b64bridge_message2_b64bridge_message1_hexbridge_message2_hexrmessage2 final_payload derived_codeverify_responseverification_succeededcompletion_stepr/r/rJ validate_codes^         N    z-TrustedDeviceBridgeBootstrapper.validate_coderrrc Cst|j}t|krm|}t|}|j}|dur$td|jq|j t krL|j rLz t j |j dddWSttfyK}ztd|d}~ww|j tkr]|jdur]t|jdtd|j td |j d td ) zDWait for the bridge connection response that carries the push token.NzOIgnoring non-connection websocket frame while waiting for push token; fields=%sr!TrDzMalformed bridge push token.rzrrr rz;Trusted-device bridge returned an unexpected final payload.zQReceived trusted-device bridge final payload: sessionUUID=%s nextStep=%s txnid=%srrN) rrlrvrrrrWrhrorr/r/rJr s   z8TrustedDeviceBridgeBootstrapper._apply_final_bridge_pushr$cCst|}|jr |j|d<|S)z>Build the auth headers used for bridge-specific HTTP requests.r)rOr8)rUrrrr/r/rJr#s z/TrustedDeviceBridgeBootstrapper._bridge_headersrlrrtrrr7rsr4cCst|j||j|||dS)z0Build the JSON payload for one bridge step POST.)rhrtrrlrrrs)rrhrr)rUrrlrtrrrsr/r/rJ_bridge_step_json.s z1TrustedDeviceBridgeBootstrapper._bridge_step_jsonc Cs^|jd|tj|d|j|||||d|d} | jttthvr-td|d| jd| S)zAPOST one bridge step and enforce the small set of valid statuses.POST)step)rrlrtrrrsrrzTrusted-device bridge step z failed with status r) request_rawBRIDGE_STEP_PATH_TEMPLATErrrHTTP_STATUS_OKHTTP_STATUS_NO_CONTENTHTTP_STATUS_CONFLICTr) rUrrerrrlrtrrrsrr/r/rJrAs2  z1TrustedDeviceBridgeBootstrapper._post_bridge_steprhrcCsF|jd|t||d|d}|jttthvr!td|jd|S)z>POST bridge step 0 immediately after obtaining the push token.r)rerrz0Trusted-device bridge step 0 failed with status r)r BRIDGE_STEP_PATHrr"r#r$r)rUrrerrhrrr/r/rJres&   z2TrustedDeviceBridgeBootstrapper._post_bridge_step0cCsP|jd|tt|j|d|d}|jtttt hvr&t d|jd|S)zDPOST the decrypted bridge code to Apple's final validation endpoint.rrrz9Trusted-device bridge code validation failed with status r) r BRIDGE_CODE_VALIDATE_PATHrrhrrr"r#r$rr)rUrrerrrrr/r/rJrs,   z:TrustedDeviceBridgeBootstrapper._post_bridge_code_validate)rjrkrrrrr;r) rrrer+rr3rXr)rmr+r;r)r;rr)rrr;r) rrrer+rr3rrrr+r;r-)rrr;r)rrrr+rr3r;r)rrrrr;r)rr3rrr;r$) rrrlrrtr+rrr7rsrr;r4)rrrer+rr3rrrlrrtr+rrr7rsrr;r) rrrer+rr3rhr+rr+r;r) rrrer+rr3rrrr+r;r)rZr[r\r]WEBSOCKET_TIMEOUT_SECONDSrr7rrrrrrrrrrrrrrr/r/r/rJrs.    2 0 >     $r)rr+r;r))rxrr;r)rtrrrr;r)rrrrrxrr;r)rrrxrr;r)rrrxr+r;r)rrrxrr;r)rtrr;r)rrr;r)rrr;r)rrr;r)rrr;r)rrr;r)rrrrr rr;r)r rr;r)r(r)r;r)rrrrr;r)rr+r;r+)r2rrr3r;r+)rrr;r4)rxr+r;r+)rMrr;r)rxr7rUrrVr+r;r+)rXr)r;r+)rer+r;r+)xr] __future__rrFr.rloggingrRr}rrrrbinasciirrH dataclassesrr html.parserrtypingrrr r r urllib.parser cryptography.hazmat.primitivesr r)cryptography.hazmat.primitives.asymmetricrpydanticrrrrrrrpyicloud.exceptionsrrpyicloud.hsa2_bridge_proverr getLoggerrZrr%r!r&r#rrrrrrrrrrr'rJr rrr'r%r^r"r#r$rr)r`rrrrrrrrrr Exceptionrrrrrrrrrrr rrrrr%r"r+r-r1r5rCrIrLrTrWrbrdrgrhrr/r/r/rJs     $  B93-    $ 5          #      '     <