
    T                     |    S r SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSK	J
r
  SSKJr  SS	KJr  S
 rS rS rS rg)zUtilities necessary to augment images statuses with org policy.

AugmentImagesStatus function in this module call OrgPolicy and augment images
status if the policy requires it.
    )absolute_import)division)unicode_literalsN)
exceptions)org_policies)log)	resourcesc              #     #    [         R                  " [        U5      5      n/ n[        X5      nUbV  U HO  nUS   S:w  a  Uv   M  [	        U U R                  US   5      R                  XC5      (       a  Uv   MF  SUS'   Uv   MQ     OU H  nUv   M	     U=(       d    /  H  n[        R                  " U5        M     g7f)a  Sets images status to 'BLOCKED_BY_POLICY' as specified by OrgPolicy.

Get OrgPolicy for the project and set images status to BLOCKED_BY_POLICY
if the policy exists and blocks the image. If no policy exists, all images are
allowed.

NOTE: This function sends requests to OrgPolicy API.

Args:
  resource_registry: resources.Registry, Resource registry
  project_id: str, Project in which image will be used
  images: Iterable[Dict], The images (in dict form) to set the status on

Yields:
  Images (in dict form) with status set to BLOCKED_BY_POLICY as specified by
  OrgPolicy.

Raises:
  exceptions.GetPolicyError if OrgPolicy call failed or returned malformed
  data.
NstatusREADYselfLinkBLOCKED_BY_POLICY)	copydeepcopylist_GetPolicyNoThrow
_IsAllowedParseprojectr   info)resource_registry
project_idimageserrors_collectedpolicyimageerrors          7lib/googlecloudsdk/command_lib/compute/images/policy.pyAugmentImagesStatusr   !   s     4 ==f&& Z:& 	xG	#''--eJ.?@HH0 0 -h  k   %2%eHHUO &s   B<B>c                    [         R                  " 5       nUR                  U UR                  [         R                  " S5      S9S9n[         R
                  " 5       nUR                  R                  U5      nUR                  $ )z*Get effective org policy of given project.zcompute.trustedImageProjects)
constraint)
projectsIdgetEffectiveOrgPolicyRequest)	r   OrgPoliciesMessages8CloudresourcemanagerProjectsGetEffectiveOrgPolicyRequestGetEffectiveOrgPolicyRequestFormatConstraintOrgPoliciesClientprojectsGetEffectiveOrgPolicy
listPolicy)r   messagesrequestclientresponses        r   
_GetPolicyr0   _   s    --/(MM#+#H#H!22,. $I $/ N 0'
 ))+&__227;( 
		    c                 ~     [        U 5      $ ! [        R                   a  nUR                  U5         SnAgSnAff = f)z7Call GetPolicy and handle possible errors from backend.N)r0   apitools_exceptions	HttpErrorappend)r   errors_to_propagatees      r   r   r   o   s;    j!!		&	&  q!s   
 <7<c                     UR                   UR                  R                  L a  gUR                   UR                  R                  L a  gSnUR                  (       d  Sn UR                   H  nU R                  US5        M     U R                  USS9R                  5       UR                  ;   a  SnSn UR                   H  nU R                  US5        M     U R                  USS9R                  5       UR                  ;   a  SnU=(       a    U(       + $ ! [        R                   a  nUR                  U5        Sn SnANSnAff = f! [        R                   a  nSnUR                  U5         SnANpSnAff = f)z,Decides if project is allowed within policy.TFzcompute.projects)
collectionN)	allValuesAllValuesValueValuesEnumALLOWDENYallowedValuesParseRelativeNamer   RelativeNamer	   InvalidResourceExceptionr5   deniedValues)r   r   r   r6   
is_allowedproject_recordr7   	is_denieds           r   r   r   |   sw    88>>>6::???*			J ..)).:LM / 	% 	  	''3|~9M9M	N j)
 --)).:LM . 	% 	  	''3|~9L9L	M i		%I%1 
	+	+  q!J	 
	+	+ "Iq!!"s0   %D 5%E E	,EE	E= E88E=)__doc__
__future__r   r   r   r   apitools.base.pyr   r3   'googlecloudsdk.api_lib.resource_managerr   googlecloudsdk.corer   r	   r   r0   r   r    r1   r   <module>rL      s9    '  '  > @ # );| 
)&r1   