
    *                     4   S r SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSK	J
r
  SSKJr  SSKJr  SS	KJr  SSKJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SS\ 4S jjr!S\"S\ 4S jr#S r$S\"S\"S\ 4S jr%S\"S\ 4S jr&S r'S r(S r)g)z&Helpers to validate config set values.    )absolute_import)division)unicode_literalsN)
exceptions)projects_api)base_classes)base)util)config)log)
properties)creds)store)universe_descriptorreturnc                 ,   SR                  U 5      nSR                  U 5      nU (       d   [        R                  " U(       a  UOU5        g[        R                  " [
        R                  R                  5      nUR                  nUR                  R                  SUR                  R                  [        R                  R                  R                   R#                  5       U S94/nUR                  R$                  SUR                  R'                  [        R                  R                  R                   R#                  5       U S94/n / nUR)                  U(       a  UOUU5        U(       a)  SUS   ;   a   [        R                  " U(       a  UOU5        gU(       d  g	 [        R                  " S
R                  U(       a  SOS5      5        g	! [*        R,                  [.        R0                  [2        R4                  [6        R8                  4 a     Nsf = f)zBWarn if setting 'compute/region' or 'compute/zone' to wrong value.zI{} is not a valid zone. Run `gcloud compute zones list` to get all zones.zN{} is not a valid region. Run `gcloud compute regions list`to get all regions.TGet)projectzone)r   regioni  r   Fz/Property validation for compute/{} was skipped.r   r   )formatr   warningr   ComputeApiHolderr	   ReleaseTrackGAclientapitools_clientzonesmessagesComputeZonesGetRequestr   VALUEScorer   	GetOrFailregionsComputeRegionsGetRequestMakeRequestscalliope_exceptionsToolExceptionapitools_exceptions	HttpErrorc_store NoCredentialsForAccountExceptionapi_lib_util_exceptionsHttpException)	valuezonal	zonal_msgregional_msgholderr   zone_requestregion_requesterrorss	            :lib/googlecloudsdk/command_lib/config/config_validators.py"WarnIfSettingNonExistentRegionZoner8   '   s   ve} 
"F5M  
KKU	5(():):)=)=>&==& ""oo,,##((00::<5 -  , $$oo..##((00::<U /  .	F
>6J#"	kku),7  ++7>>&x
 
 ''##..++	
 	 		s   	AG G AHHuniverse_domainc                    [         R                  " 5       n UR                  U 5      nU(       a  g g! [         R                   a9  n[        R
                  " SU 35        [        R
                  " S5         SnAgSnAff = f)zFWarn if setting 'core/universe_domain' with no cached descriptor data.Fz"Failed to update descriptor data: zkUsing gcloud without universe descriptor data outside the default universe may lead to unexpected behavior.NT)r   UniverseDescriptorr   UniverseDescriptorErrorr   r   )r9   universe_descriptor_datacached_descriptor_dataes       r7   /WarnIfSettingUniverseDomainWithNoDescriptorDatar@   ]   s{     1CCE
599/J  
 
	4	4 KK4QC89KK	5 s   2 A?/A::A?c           	          [         R                  R                  R                  R	                  5       nX ;  a!  [
        R                  " SU SU SU  S35        gg)zGWarn if setting 'api_endpoint_overrides/<api>' outside universe_domain.zThe value set for [z\] was found to be associated with a universe domain outside of the current config universe [z]. Please create a new gcloud configuration for each universe domain you make requests to using `gcloud config configurations create` with the `--universe-domain` flag or switch to a configuration associated with [].TFr   r!   r"   r9   r   r   r   )r/   propr9   s      r7   7WarnIfSettingApiEndpointOverrideOutsideOfConfigUniverserE   p   sb    %%**::>>@/!KK
dV $;;J:K L #G2	' 	    accountaccount_universe_domainc                     [         R                  R                  R                  R	                  5       nU(       a)  X:w  a$  [
        R                  " SU  SU SU SU S3	5        gg)a  Warn if setting an account belonging to a different universe_domain.

This warning should only be displayed if the user sets their active account
to an existing credentialed account which does not match the config
universe_domain. If the user sets their active account to an uncredentialed
account, there is no way to determine what universe the account belongs to so
we do not warn in that case.

Args:
  account: The account to set [core/account] property to.
  account_universe_domain: The respective account universe domain.

Returns:
 (Boolean) True if the account is outside of the configuration universe_domain
 and warning is logged. False otherwise.
zThis account [z] is from the universe domain [zD] which does not match the current [core/universe_domain] property [z]. Update them to match or create a new gcloud configuration for this universe domain using `gcloud config configurations create` with the `--universe-domain` flag or switch to a configuration associated with [rB   TFrC   )rG   rH   config_universe_domains      r7   +WarnIfSettingAccountOutsideOfConfigUniverserK      st    & &,,11AAEEG
!
;KK
	 "$% &--C,D E %%R	) 	rF   c                    [         R                  R                  R                  R	                  5       n[
        R                  " 5       n/ nU H0  nUR                  U:X  d  M  UR                  UR                  5        M2     U(       a:  X;  a5  SR                  U5      n[        R                  " SU SU SU  SU S3	5        gg)	a}  Warn if setting a universe domain mismatched to config account domain.

This warning should only be displayed if the user sets their universe domain
property to a universe domain not associated with the current credentialed
account. If the user has their config set to an uncredentialed account, there
is no way to determine what universe that account belongs to so we do not warn
in that case.

Args:
  universe_domain: The universe domain to set [core/universe_domain] property
    to.

Returns:
  (Boolean) True if the provided universe_domain is outside of the
  configuration universe_domain and warning is logged. False otherwise.
z, zThe config account [z5] is available in the following universe domain(s): [z], but it is not available in [a  ] which is specified by the [core/universe_domain] property. Update them to match or create a new gcloud configuration for this universe domain using `gcloud config configurations create` with the `--universe-domain` flag or switch to a configuration associated with [rB   TF)r   r!   r"   rG   r   r+   AllAccountsWithUniverseDomainsappendr9   joinr   r   )r9   config_accountall_cred_accountscred_universe_domainscred_accountcred_universe_domain_lists         r7   9WarnIfSettingUniverseDomainOutsideOfConfigAccountUniverserU      s    & $$))11557.<<>'l~-""<#?#?@ ( K $		*? @KK
~. /  9: ;() *
 ,,B	0	 	rF   c                 4   [         R                  R                  [        R                  " 5       5      (       d  g[
        R                  " 5       R                  [        R                  " 5       5      u  pUR                  U :X  a  g[        R                  " S5        g)a  Warn to update ADC if ADC file contains a different quota_project.

Args:
  project: a new project to compare with quota_project in the ADC file.

Returns:
  (Boolean) True if new project does not match the quota_project in the
  ADC file and warning is logged. False otherwise.
Fa  Your active project does not match the quota project in your local Application Default Credentials file. This might result in unexpected quota issues.

To update your Application Default Credentials quota project, use the `gcloud auth application-default set-quota-project` command.T)ospathisfiler   ADCFilePathc_credsGetGoogleAuthDefaultload_credentials_from_filequota_project_idr   r   )r   credentials_s      r7   !WarnIfSettingProjectWhenAdcExistsra      ss     
**,	-	-//1LL.+ !!W,++ 
rF   c                    U [         R                  R                  :X  a  [         R                  R                  R
                  R                  5       (       aa  [        R                  " U5      n [        R                  " 5          [        R                  " USS9n[        R                  " U5        SSS5        gg! , (       d  f       g= f! [        R                  [        R                   ["        R$                  4 aq  nSR'                  U5      n[)        U[        R                  5      (       a!  ["        R$                  " USS9nUR*                  n[,        R.                  " U5         SnAgSnAff = f)z>Warn if setting 'core/project' config to inaccessible project.T)disable_api_enablement_checkNzFYou do not appear to have access to project [{}] or it does not exist.z{message}{details?
{?}})error_formatF)r   ScopeUSERr!   r"   rG   r   projects_utilParseProjectr	   WithLegacyQuotar   -CheckAndPrintEnvironmentTagMessageWithProjectr)   r*   r+   r,   r-   r.   r   
isinstancemessager   r   )scoper   project_refr?   warning_msgwrapped_errors         r7    WarnIfSettingProjectWithNoAccessrq      s"    j###
(9(9(>(>(F(F(J(J(L(L,,W5K!""d
 	CC	
 "0 
1 "!0 
 	%%00-- F7O  
A*44	5	5/==6
 $++	kk+s7   -C	 ,B8.C	 8
CC	 C	 	3E-<A'E((E-c                 ^    U R                  5       S;   a  Sn[        R                  " U5        gg)z?Warn if setting context_aware/use_client_certificate to truthy.)1trueonyesya  Some services may not support client certificate authorization in this version of gcloud. When a command sends requests to such services, the requests will be executed without using a client certificate.

Please run $ gcloud topic client-certificate for more information.N)lowerr   r   )r/   mtls_not_supported_msgs     r7   "WarnIfActivateUseClientCertificaterz     s0    
[[]55	M  KK&' 6rF   )T)*__doc__
__future__r   r   r   rW   apitools.base.pyr   r)   +googlecloudsdk.api_lib.cloudresourcemanagerr   googlecloudsdk.api_lib.computer   googlecloudsdk.api_lib.utilr-   googlecloudsdk.callioper	   r'   #googlecloudsdk.command_lib.projectsr
   rg   googlecloudsdk.corer   r   r   googlecloudsdk.core.credentialsr   r[   r   r+   'googlecloudsdk.core.universe_descriptorr   boolr8   strr@   rE   rK   rU   ra   rq   rz    rF   r7   <module>r      s     - &  ' 	 > D 7 M ( E E & # * < < G3T 3l	& ""+."	"J((	(V6%P
(rF   