
    +3                     X   S r SSKJr  SSKJr  SSKJr  SSKrSSKrSSKJr	  SSKJ
r
  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  Sr " S S\R*                  5      r " S S\5      r " S S\5      rS rSS jrS r " S S\5      r " S S\R:                  5      rg)z%Utilities for the iamcredentials API.    )absolute_import)division)unicode_literalsN
exceptions)http_wrapper)apis_internal)
properties)	resources)	transport)clientz&https://iamcredentials.googleapis.com/c                       \ rS rSrSrSrg)Error'   z*Exception that are defined by this module. N__name__
__module____qualname____firstlineno____doc____static_attributes__r       1lib/googlecloudsdk/api_lib/iamcredentials/util.pyr   r   '   s    2r   r   c                       \ rS rSrSrSrg)InvalidImpersonationAccount+   z1Exception when the service account id is invalid.r   Nr   r   r   r   r   r   +   s    9r   r   c                       \ rS rSrSrSrg)&ImpersonatedCredGoogleAuthRefreshError/   zAException for google auth impersonated credentials refresh error.r   Nr   r   r   r   r   r   /   s    Ir   r   c           	      ^   SSK Jn  [        R                  R	                  U SSU S.S9nUR                  S[        R                  SS9n[        R                  " S	S
US9n UR                  R                  UR                  R                  UR                  5       UR                  R                  US9S95      nU$ ! [         R"                   a2  n[$        R&                  " USR)                  UR*                  U S9S9eSnAf[         R,                   a  n[$        R&                  " U5      eSnAff = f)z8Generates an access token for the given service account.r   
transportsiamcredentials.serviceAccounts-
projectsIdserviceAccountsId
collectionparamsFenable_resource_quotaresponse_encodingallow_account_impersonationiamcredentialsv1http_client)scope)namegenerateAccessTokenRequestzError {code} (Forbidden) - failed to impersonate [{service_acc}]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.)codeservice_accerror_formatN)googlecloudsdk.core.credentialsr#   r   REGISTRYParseGetApitoolsTransportr   ENCODINGr	   _GetClientInstanceprojects_serviceAccountsGenerateAccessTokenMESSAGES_MODULE?IamcredentialsProjectsServiceAccountsGenerateAccessTokenRequestRelativeNameGenerateAccessTokenRequestapitools_exceptionsHttpForbiddenErrorr   HttpExceptionformatstatus_code	HttpError)service_account_idscopesr#   service_account_refr3   
iam_clientresponsees           r   rB   rB   3   sC    9!**00%E6HI 1 K //!!**"' 0 )+
 //+7*&22FF""	H	H$113'1'A'A''f'5 
I 

H O		/	/ N

"
"	 $Vmm9K $ MN N 
	&	& &

"
"1
%%&s%   AB9 9D,-C::D,D''D,c           
         SSK Jn  [        R                  R	                  U SSU S.S9nUR                  S[        R                  SS9n[        R                  " S	S
US9nUR                  R                  UR                  R                  UR                  5       UR                  R                  XS9S95      nUR                   $ )z4Generates an id token for the given service account.r   r"   r$   r%   r&   r)   Fr,   r0   r1   r2   )audienceincludeEmail)r5   generateIdTokenRequest)r;   r#   r   r<   r=   r>   r   r?   r	   r@   rA   GenerateIdTokenrC   ;IamcredentialsProjectsServiceAccountsGenerateIdTokenRequestrE   GenerateIdTokenRequesttoken)rM   rT   include_emailr#   rO   r3   rP   rQ   s           r   rW   rW   [   s     9!**00%E6HI 1 K //!!**"' 0 )+
 //+7* 00@@  BB"//1!+!;!;!!8!P C ( 
r   c                     [         R                  R                  R                  R	                  5       (       a2  [         R                  R                  R                  R                  5       $ [         R                  R                  R                  n U R                  5       U R                  :w  a$  [        R                  SU R                  5       5      $ [        $ )aq  Returns the effective IAM endpoint.

(1) If the [api_endpoint_overrides/iamcredentials] property is explicitly set,
return the property value.
(2) Otherwise if [core/universe_domain] value is not default, return
"https://iamcredentials.{universe_domain_value}/".
(3) Otherise return "https://iamcredentials.googleapis.com/"

Returns:
  str: The effective IAM endpoint.
zgoogleapis.com)r
   VALUESapi_endpoint_overridesr0   IsExplicitlySetGetcoreuniverse_domaindefaultIAM_ENDPOINT_GDUreplace)universe_domain_propertys    r   GetEffectiveIamEndpointrg   w   s     --<<LLNN33BBFFHH'..33CC!!#'?'G'GG##2668  
r   c                   P    \ rS rSrSrS rS rS rS r\	S 5       r
\	S 5       rS	rg
) ImpersonationAccessTokenProvider   zvA token provider for service account elevation.

This supports the interface required by the core/credentials module.
c                 |    SU;   a  [        S5      e[        X5      n[        XR                  UR                  U5      $ )N,zMore than one service accounts were specified, which is not supported. If being set, please unset the auth/disable_load_google_auth property and retry.)r   rB   ImpersonationCredentialsaccessToken
expireTime)selfrM   rN   rQ   s       r   GetElevationAccessToken8ImpersonationAccessTokenProvider.GetElevationAccessToken   sL    
  '>? ? ##5>H#00(2E2EvO Or   c                     [        XU5      $ N)rW   )rp   rM   rT   r[   s       r   GetElevationIdToken4ImpersonationAccessTokenProvider.GetElevationIdToken   s    -GGr   c                    SSK Jn  SSK Jn  SSKJn  UR                  5       nUR                  U5        UR                  UUUUS9n	U R                  5          U	R                  U5        U	$ ! UR                   a  n
SR                  US9nSn [        R                  " U
R                  S	   5      nUS
-   US   S   -   US   S'   [        R                  " SUS   S   0[        R                   " U5      SS9n["        R$                  R'                  U5      nO! [(         a     Of = fU(       a  [        R*                  " USS9e[-        U5      eSn
A
ff = f)zCCreates a fresh impersonation credential using google-auth library.r   r   impersonated_credentialsrequests)source_credentialstarget_principaltarget_scopes	delegateszFailed to impersonate [{service_acc}]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.)r8   N    errormessagestatusr7   )infocontentrequest_urlz{message} {details?
{?}}r9   )google.authr   ry   googlecloudsdk.corer{   GoogleAuthRequestrefreshCredentialsPerformIamEndpointsOverrideRefreshErrorrJ   jsonloadsargsr   ResponsedumpsrG   rL   FromResponse	ExceptionrI   r   )rp   r|   r}   r   rN   google_auth_exceptions$google_auth_impersonated_credentialscore_requestsrequest_clientcredrR   original_message
http_errorr   http_responses                  r   !GetElevationAccessTokenGoogleAuthBImpersonationAccessTokenProvider.GetElevationAccessTokenGoogleAuth   s    A\= #446N ~./;;-)	 < D 	$$&-E
ll>"\ K[ ".. +EBBH&* CI C  j **QVVAY' s"WW%5i%@@ 	#
 %--GG,V45JJw'

 )22??N
  
&&%@
 	

 33CDDW+Es=   A* *E:EBDE
D"E!D""*EEc                     SSK Jn  SSKJn  UR	                  UUUS9nUR                  5       nU R                  5         UR                  U5        U$ )z=Creates an ID token credentials for impersonated credentials.r   rx   rz   )target_audiencer[   )r   ry   r   r{   IDTokenCredentialsr   r   r   )rp   %google_auth_impersonation_credentialsrT   r[   r   r   r   r   s           r   GetElevationIdTokenGoogleAuth>ImpersonationAccessTokenProvider.GetElevationIdTokenGoogleAuth   sW     ]=/BB- # C D
 #446N$$&LL Kr   c                 f    SSK Jn  [        U[        5      =(       d    [        XR                  5      $ )Nr   rx   )r   ry   
isinstancerm   r   )clsr   r   s      r   IsImpersonationCredential:ImpersonationAccessTokenProvider.IsImpersonationCredential   s-     ]d45 >>: r   c                    SSK Jn  [        5       nUR                  R	                  [
        U5      Ul        UR                  R	                  [
        U5      Ul        UR                  R	                  [
        U5      Ul        g)a
  Perform IAM endpoint override if needed.

We will override IAM generateAccessToken, signBlob, and generateIdToken
endpoint under the following conditions.
(1) If the [api_endpoint_overrides/iamcredentials] property is explicitly
set, we replace "https://iamcredentials.googleapis.com/" with the given
property value in these endpoints.
(2) If the property above is not set, and the [core/universe_domain] value
is not default, we replace "googleapis.com" with the [core/universe_domain]
property value in these endpoints.
r   )iamN)r   r   rg   _IAM_ENDPOINTre   rd   _IAM_SIGN_ENDPOINT_IAM_IDTOKEN_ENDPOINT)r   google_auth_iameffective_iam_endpoints      r   r   <ImpersonationAccessTokenProvider.PerformIamEndpointsOverride  s|     3 56%%--"	
 ! 	**22"	
 & 	--55"	
 )r   r   N)r   r   r   r   r   rq   ru   r   r   classmethodr   r   r   r   r   r   ri   ri      sG    
OHGR"   " "r   ri   c                   <   ^  \ rS rSrSrSrU 4S jrS rS rSr	U =r
$ )rm   i*  zNImplementation of a credential that refreshes using the iamcredentials API.
  z%Y-%m-%dT%H:%M:%SZc                 d   > Xl         U R                  U5      n[        [        U ]  US S S US S US9  g )N)rN   )_service_account_id_ConvertExpiryTimesuperrm   __init__)rp   rM   access_tokentoken_expiryrN   	__class__s        r   r   !ImpersonationCredentials.__init__/  s@    1**<8L	
"D2dD$dD 3 Qr   c                     [        U R                  [        U R                  5      5      nUR                  U l        U R                  UR                  5      U l        g rt   )	rB   r   listrN   rn   r   r   ro   r   )rp   httprQ   s      r   _refresh!ImpersonationCredentials._refresh5  sF     #4#;#;T$++=NOH ,,D//0C0CDDr   c                 ^    [         R                   R                  U[        R                  5      $ rt   )datetimestrptimerm   _EXPIRY_FORMAT)rp   values     r   r   +ImpersonationCredentials._ConvertExpiryTime<  s(    %%e&>&M&MO Or   )r   r   r   )r   r   r   r   r   r   r   r   r   r   __classcell__)r   s   @r   rm   rm   *  s%    '.QEO Or   rm   )F)r   
__future__r   r   r   r   r   apitools.base.pyr   rG   r   googlecloudsdk.api_lib.utilr	   r   core_exceptionsr
   r   r   oauth2clientr   rd   r   r   r   rB   rW   rg   objectri   OAuth2Credentialsrm   r   r   r   <module>r      s     , &  '   > ) 5 2 = * ) )  < 3O!! 3:% :JU J%&P8.Yv YxOv77 Or   