# Path: jose/jwk.py
# def get_key(algorithm):
# def register_key(algorithm, key_class):
# def construct(key_data, algorithm=None):
# 
# Path: jose/backends/base.py
# class Key:
#     """
#     A simple interface for implementing JWK keys.
#     """
# 
#     def __init__(self, key, algorithm):
#         pass
# 
#     def sign(self, msg):
#         raise NotImplementedError()
# 
#     def verify(self, msg, sig):
#         raise NotImplementedError()
# 
#     def public_key(self):
#         raise NotImplementedError()
# 
#     def to_pem(self):
#         raise NotImplementedError()
# 
#     def to_dict(self):
#         raise NotImplementedError()
# 
#     def encrypt(self, plain_text, aad=None):
#         """
#         Encrypt the plain text and generate an auth tag if appropriate
# 
#         Args:
#             plain_text (bytes): Data to encrypt
#             aad (bytes, optional): Authenticated Additional Data if key's algorithm supports auth mode
# 
#         Returns:
#             (bytes, bytes, bytes): IV, cipher text, and auth tag
#         """
#         raise NotImplementedError()
# 
#     def decrypt(self, cipher_text, iv=None, aad=None, tag=None):
#         """
#         Decrypt the cipher text and validate the auth tag if present
#         Args:
#             cipher_text (bytes): Cipher text to decrypt
#             iv (bytes): IV if block mode
#             aad (bytes): Additional Authenticated Data to verify if auth mode
#             tag (bytes): Authentication tag if auth mode
# 
#         Returns:
#             bytes: Decrypted value
#         """
#         raise NotImplementedError()
# 
#     def wrap_key(self, key_data):
#         """
#         Wrap the the plain text key data
# 
#         Args:
#             key_data (bytes): Key data to wrap
# 
#         Returns:
#             bytes: Wrapped key
#         """
#         raise NotImplementedError()
# 
#     def unwrap_key(self, wrapped_key):
#         """
#         Unwrap the the wrapped key data
# 
#         Args:
#             wrapped_key (bytes): Wrapped key data to unwrap
# 
#         Returns:
#             bytes: Unwrapped key
#         """
#         raise NotImplementedError()
# 
# Path: jose/constants.py
# ALGORITHMS = Algorithms()
# 
# Path: jose/exceptions.py
# class JWSError(JOSEError):
#     pass
# 
# class JWSSignatureError(JWSError):
#     pass
# 
# Path: jose/utils.py
# def base64url_decode(input):
#     """Helper method to base64url_decode a string.
# 
#     Args:
#         input (str): A base64url_encoded string to decode.
# 
#     """
#     rem = len(input) % 4
# 
#     if rem > 0:
#         input += b"=" * (4 - rem)
# 
#     return base64.urlsafe_b64decode(input)
# 
# def base64url_encode(input):
#     """Helper method to base64url_encode a string.
# 
#     Args:
#         input (str): A base64url_encoded string to encode.
# 
#     """
#     return base64.urlsafe_b64encode(input).replace(b"=", b"")


import binascii
import json
from collections.abc import Iterable, Mapping
from jose import jwk
from jose.backends.base import Key
from jose.constants import ALGORITHMS
from jose.exceptions import JWSError, JWSSignatureError
from jose.utils import base64url_decode, base64url_encode
        else:
            # Some other mapping. Firebase uses just dict of kid, cert pairs
            values = key.values()
            if values:
                return values
            return (key,)

    # Iterable but not text or mapping => list- or tuple-like
    elif isinstance(key, Iterable) and not (isinstance(key, str) or isinstance(key, bytes)):
        return key

    # Scalar value, wrap in tuple.
    else:
        return (key,)


def _verify_signature(signing_input, header, signature, key="", algorithms=None):

    alg = header.get("alg")
    if not alg:
        raise JWSError("No algorithm was specified in the JWS header.")

    if algorithms is not None and alg not in algorithms:
        raise JWSError("The specified alg value is not allowed")

    keys = _get_keys(key)
    try:
        if not _sig_matches_keys(keys, signing_input, signature, alg):
            raise JWSSignatureError()
    except JWSSignatureError:

# Path: jose/jwk.py
# def get_key(algorithm):
# def register_key(algorithm, key_class):
# def construct(key_data, algorithm=None):
# 
# Path: jose/backends/base.py
# class Key:
#     """
#     A simple interface for implementing JWK keys.
#     """
# 
#     def __init__(self, key, algorithm):
#         pass
# 
#     def sign(self, msg):
#         raise NotImplementedError()
# 
#     def verify(self, msg, sig):
#         raise NotImplementedError()
# 
#     def public_key(self):
#         raise NotImplementedError()
# 
#     def to_pem(self):
#         raise NotImplementedError()
# 
#     def to_dict(self):
#         raise NotImplementedError()
# 
#     def encrypt(self, plain_text, aad=None):
#         """
#         Encrypt the plain text and generate an auth tag if appropriate
# 
#         Args:
#             plain_text (bytes): Data to encrypt
#             aad (bytes, optional): Authenticated Additional Data if key's algorithm supports auth mode
# 
#         Returns:
#             (bytes, bytes, bytes): IV, cipher text, and auth tag
#         """
#         raise NotImplementedError()
# 
#     def decrypt(self, cipher_text, iv=None, aad=None, tag=None):
#         """
#         Decrypt the cipher text and validate the auth tag if present
#         Args:
#             cipher_text (bytes): Cipher text to decrypt
#             iv (bytes): IV if block mode
#             aad (bytes): Additional Authenticated Data to verify if auth mode
#             tag (bytes): Authentication tag if auth mode
# 
#         Returns:
#             bytes: Decrypted value
#         """
#         raise NotImplementedError()
# 
#     def wrap_key(self, key_data):
#         """
#         Wrap the the plain text key data
# 
#         Args:
#             key_data (bytes): Key data to wrap
# 
#         Returns:
#             bytes: Wrapped key
#         """
#         raise NotImplementedError()
# 
#     def unwrap_key(self, wrapped_key):
#         """
#         Unwrap the the wrapped key data
# 
#         Args:
#             wrapped_key (bytes): Wrapped key data to unwrap
# 
#         Returns:
#             bytes: Unwrapped key
#         """
#         raise NotImplementedError()
# 
# Path: jose/constants.py
# ALGORITHMS = Algorithms()
# 
# Path: jose/exceptions.py
# class JWSError(JOSEError):
#     pass
# 
# class JWSSignatureError(JWSError):
#     pass
# 
# Path: jose/utils.py
# def base64url_decode(input):
#     """Helper method to base64url_decode a string.
# 
#     Args:
#         input (str): A base64url_encoded string to decode.
# 
#     """
#     rem = len(input) % 4
# 
#     if rem > 0:
#         input += b"=" * (4 - rem)
# 
#     return base64.urlsafe_b64decode(input)
# 
# def base64url_encode(input):
#     """Helper method to base64url_encode a string.
# 
#     Args:
#         input (str): A base64url_encoded string to encode.
# 
#     """
#     return base64.urlsafe_b64encode(input).replace(b"=", b"")


# Path: jose/jws.py
import binascii
import json
from collections.abc import Iterable, Mapping
from jose import jwk
from jose.backends.base import Key
from jose.constants import ALGORITHMS
from jose.exceptions import JWSError, JWSSignatureError
from jose.utils import base64url_decode, base64url_encode

        else:
            # Some other mapping. Firebase uses just dict of kid, cert pairs
            values = key.values()
            if values:
                return values
            return (key,)

    # Iterable but not text or mapping => list- or tuple-like
    elif isinstance(key, Iterable) and not (isinstance(key, str) or isinstance(key, bytes)):
        return key

    # Scalar value, wrap in tuple.
    else:
        return (key,)


def _verify_signature(signing_input, header, signature, key="", algorithms=None):

    alg = header.get("alg")
    if not alg:
        raise JWSError("No algorithm was specified in the JWS header.")

    if algorithms is not None and alg not in algorithms:
        raise JWSError("The specified alg value is not allowed")

    keys = _get_keys(key)
    try:
        if not _sig_matches_keys(keys, signing_input, signature, alg):
            raise JWSSignatureError()
    except JWSSignatureError:

        raise JWSError("Signature verification failed.")