
    r7                        S r SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSKJ	r	  SSK
Jr  SS	K
Jr  SS
KJr  SSKJr  SSKJr  S rS rS rS rS rS rS rS rS rS rS rS rS r S r!S r"S r#S r$S r%S r&S  r'S! r(S" r)S# r*g)$z!The python hooks for IAM surface.    )absolute_import)division)unicode_literalsN)util)apis)arg_parsers)
exceptions)iam_util)	arg_utils)logc                 &   A UR                  S5      (       ay  [        R                  " 5       u  p4UR                  UR                  R                  S5      UR                  R                  S5      UR                  R                  S5      S9nXRl        U$ )a  Python hook to add condition from --condition-from-file to request.

Args:
  ref: A resource ref to the parsed resource.
  args: Parsed args namespace.
  request: The apitools request message to be modified.

Returns:
  The modified apitools request message.
condition_from_filedescriptiontitle
expression)r   r   r   )IsSpecifiedr   GetClientAndMessagesExprr   get	condition)refargsrequest_messagescondition_messages         +lib/googlecloudsdk/command_lib/iam/hooks.py"UpdateRequestWithConditionFromFiler       s     
	+,,++-KA ,,00?&&**73++//= & 
 *	.    c                 J    [         R                  " SSR                  U S95      $ )Nzcondition-from-filez{filename} must be a path to a YAML or JSON file containing the condition. `expression` and `title` are required keys. `description` is optional.filename)gcloud_exceptionsInvalidArgumentExceptionformatr!   s    r   _ConditionFileFormatExceptionr&   7   s)    		3	3&(&+	
 r   c                 |    [         R                  " 5       " U 5      n[        R                  " U[	        U 5      5      nU$ )z&Read condition from YAML or JSON file.)r   FileContentsr
   ParseYamlOrJsonConditionr&   )r   r   condition_dicts      r   ParseConditionFromFiler+   @   s<     &&()<=)44./BC. 
r   c                     A UR                   [        UR                   5      S-
  S  / SQ:X  a9  [        R                  R	                  SR                  UR                  5      5        g g )N   )iamservice-accountsenablezEnabled service account [{}].command_pathlenr   statusPrintr%   service_accountresponser   s     r   EnableIamAccountConfirmationr9   J   s]    	s4,,-134 9 
 JJ'..t/C/CDr   c                     A UR                   [        UR                   5      S-
  S  / SQ:X  a9  [        R                  R	                  SR                  UR                  5      5        g g )Nr-   )r.   r/   disablezDisabled service account [{}].r1   r7   s     r   DisableIamAccountConfirmationr<   V   s]    	s4,,-134 9 
 JJ(//0D0DEr   c                     A [         R                  R                  SR                  UR                  UR
                  5      5        g )Nz,Enabled key [{0}] for service account [{1}].r   r4   r5   r%   iam_keyiam_accountr7   s     r   EnableIamKeyConfirmationrA   b   s4    **4;;
,,((r   c                     A [         R                  R                  SR                  UR                  UR
                  5      5        g )Nz-Disabled key [{0}] for service account [{1}].r>   r7   s     r   DisableIamKeyConfirmationrC   k   s4    **5<<
,,((r   c                 0    U R                  5       Ul        U$ )z)Add service account name to request name.)RelativeNamename)r   unused_argsr   s      r   SetServiceAccountResourcerH   t   s     !!#',	.r   c                 v    A AUR                   R                  (       d  SS/n[        R                  " US5      eU$ )z.Validate the field mask for an update request.z--display-namez--descriptionz%Specify at least one field to update.)patchServiceAccountRequest
updateMaskr#   OneOfArgumentsRequiredException)r   rG   r   update_fieldss       r   ValidateUpdateFieldMaskrN   {   sB     
;		+	+	6	6%7M

;
;>  
.r   c                    ^  U 4S jnU$ )zDSet requestedPolicyVersion to max supported in GetIamPolicy request.c                 X   > A A[         R                  " UT[        R                  5        U$ )N)r   SetFieldInMessager
   !MAX_LIBRARY_IAM_SUPPORTED_VERSION)r   r   r   	api_fields      r   Process-UseMaxRequestedPolicyVersion.<locals>.Process   s*    THFF Nr    )rS   rT   s   ` r   UseMaxRequestedPolicyVersionrW      s     
.r   c                    ^  U 4S jnU$ )z3Add ',version' to update_mask if it is not present.c                    > A A[         R                  " UT5      nSU;  a  Uc  SnOUS-  n[         R                  " UTU5        U$ )z+The implementation of Process for the hook.versionz,version)r   GetFieldValueFromMessagerQ   )r   r   r   update_maskupdate_mask_paths       r   rT   3AddVersionToUpdateMaskIfNotPresent.<locals>.Process   sP    T44W>NOK#		z!)9;GNr   rV   )r]   rT   s   ` r   "AddVersionToUpdateMaskIfNotPresentr_      s     
.r   c                 d    U R                  5       (       d  [        R                  " SS5      eSU -   $ )N
account_idzSAccount unique ID should be a number. Please double check your input and try again.zprojects/-/serviceAccounts/)isdigitr#   r$   )ra   s    r   "CreateFullServiceAccountNameFromIdrc      s9    					

4
4	 
 
'	33r   c                      [         R                  " 5       " U 5      R                  5       nUR                  S5      $ ! [         R                   a+  n[        R
                  " SSR                  U5      5      eSnAff = f)a+  Generate public key data from a path.

Args:
  path: (bytes) the public key file path given by the command.

Raises:
  InvalidArgumentException: if the public key file path provided does not
                            exist or is too large.
Returns:
  A public key encoded using the UTF-8 charset.
public_key_filez1{}. Please double check your input and try again.Nzutf-8)r   r(   stripArgumentTypeErrorr#   r$   r%   encode)pathpublic_key_dataes      r   GeneratePublicKeyDataFromFilerl      sr    !..06<<>O 
			(( 
	&	& 

4
4;BB1E s   )< A;&A66A;c                 f    A [         R                  " SS5      n[        X!U5        [        X!U5        U$ )zsAdd ExtraAttributesOAuth2Client and ExtendedAttributesOAuth2Client fields to create workforcePoolProvider requests.r.   v1)r   GetMessagesModule$SetExtraAttributesOauth2ClientFields'SetExtendedAttributesOauth2ClientFieldsr   r   r   r   s       r   2AddCreateExtraAndExtendedAttributesConfigToRequestrs      s2     
##E40(&wh?)'B	.r   c                     A [         R                  " SS5      nUR                  b+  UR                  (       a  [        R                  " USS5        U$ [        X!U5        U$ )PAdd ExtraAttributesOAuth2Client fields to update workforcePoolProvider requests.r.   rn   Nz1workforcePoolProvider.extraAttributesOauth2Client)r   ro   clear_extra_attributes_configr   rQ   rp   rr   s       r   *AddClearableExtraAttributesConfigToRequestrw      s[    	##E40(
((4

,
,; 
. )A	.r   c                     A [         R                  " SS5      nUR                  b+  UR                  (       a  [        R                  " USS5        U$ [        X!U5        U$ )ru   r.   rn   Nz4workforcePoolProvider.extendedAttributesOauth2Client)r   ro    clear_extended_attributes_configr   rQ   rq   rr   s       r   -AddClearableExtendedAttributesConfigToRequestrz      s[    	##E40(
++7

/
/> 
. ,G8D	.r   c                    UR                   b  UR                  R                  nSUR                   ;   a#  [        R                  " U SUR
                  5        OeSUR                   ;   a#  [        R                  " U SUR                  5        O2SUR                   ;   a"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b#  [        R                  " U S	UR                  5        gg)
z6Set ExtraAttributesOauth2Client fields in the request.Nzazure-ad-groups-mailz@workforcePoolProvider.extraAttributesOauth2Client.attributesTypeazure-ad-groups-idzazure-ad-groups-display-namez:workforcePoolProvider.extraAttributesOauth2Client.clientIdzNworkforcePoolProvider.extraAttributesOauth2Client.clientSecret.value.plainTextz;workforcePoolProvider.extraAttributesOauth2Client.issuerUrizHworkforcePoolProvider.extraAttributesOauth2Client.queryParameters.filter)extra_attributes_type@GoogleIamAdminV1WorkforcePoolProviderExtraAttributesOAuth2ClientAttributesTypeValueValuesEnumr   rQ   AZURE_AD_GROUPS_MAILAZURE_AD_GROUPS_IDAZURE_AD_GROUPS_DISPLAY_NAMEextra_attributes_client_id$extra_attributes_client_secret_valueextra_attributes_issuer_uriextra_attributes_filterr   r   r   response_types       r   rp   rp      sZ   	+QQoo  !;!;;!!

L

,
,
 
!;!;	;!!

L

*
*
 
(4+E+E	E!!

L

4
4
 
$$0D''
 
..:X11
 
%%1E((
 
!!-R$$ .r   c                 (   UR                   bH  UR                  R                  nSUR                   ;   a"  [        R                  " U SUR
                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b#  [        R                  " U SUR                  5        gg)z9Set ExtendedAttributesOauth2Client fields in the request.Nr|   zCworkforcePoolProvider.extendedAttributesOauth2Client.attributesTypez=workforcePoolProvider.extendedAttributesOauth2Client.clientIdzQworkforcePoolProvider.extendedAttributesOauth2Client.clientSecret.value.plainTextz>workforcePoolProvider.extendedAttributesOauth2Client.issuerUrizKworkforcePoolProvider.extendedAttributesOauth2Client.queryParameters.filter)
extended_attributes_typer~   r   r   rQ   r   extended_attributes_client_id'extended_attributes_client_secret_valueextended_attributes_issuer_uriextended_attributes_filterr   s       r   rq   rq   ,  s    	"".QQoo  t<<<!!

O

*
*
 
''3G**
 
11=[44
 
((4H++
 
$$0U'' 1r   c                 &   / nUR                   (       a  UR                   R                  S5      nUR                  b"  UR                  (       a  UR                  S5        UR                  b  UR                  S5        UR
                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        U(       a  SR                  U5      Ul         U$ )zhAdds ExtraAttributesOauth2Client specific fieldmask entries to the update workforcePoolProvider request.,extraAttributesOauth2Clientz*extraAttributesOauth2Client.attributesTypez$extraAttributesOauth2Client.clientIdz8extraAttributesOauth2Client.clientSecret.value.plainTextz%extraAttributesOauth2Client.issuerUriz2extraAttributesOauth2Client.queryParameters.filter)
rK   splitrv   appendr}   r   r   r   r   join
unused_refr   r   mask_fieldss       r   !AddExtraAttributesConfigFieldMaskr   R  s    +$$**3/K
((4

,
,45	+CD	$$0=>	..:B 
%%1>?	!!-KL+.G	.r   c                 &   / nUR                   (       a  UR                   R                  S5      nUR                  b"  UR                  (       a  UR                  S5        UR                  b  UR                  S5        UR
                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        U(       a  SR                  U5      Ul         U$ )zkAdds ExtendedAttributesOauth2Client specific fieldmask entries to the update workforcePoolProvider request.r   extendedAttributesOauth2Clientz-extendedAttributesOauth2Client.attributesTypez'extendedAttributesOauth2Client.clientIdz;extendedAttributesOauth2Client.clientSecret.value.plainTextz(extendedAttributesOauth2Client.issuerUriz5extendedAttributesOauth2Client.queryParameters.filter)
rK   r   ry   r   r   r   r   r   r   r   r   s       r   $AddExtendedAttributesConfigFieldMaskr   m  s    +$$**3/K
++7

/
/78	"".FG	''3@A	11=E 
((4AB	$$0NO+.G	.r   c                     A g)zClear the value for a flag.NrV   )r   s    r   	ClearFlagr     s    
	r   c                 Z    A UR                   (       d  [        R                  " USS5        U$ )z:Remove the flag from the request when it is not specified.
hardDeleteN)hard_deleter   rQ   )r   r   r   s      r   ModifyHardDeleteFlagInRequestr     s,    				
 
.r   c                 T    [         R                  " SSUR                  5      Ul        U$ )zHook to erase the project identifier from the request.

Args:
  unused_ref: The resource reference of the response.
  unused_args: The arguments of the command.
  request: The request of the command.

Returns:
  The modified apitools request message.
zprojects/[^/]+/zprojects/-/)resubrF   )r   rG   r   s      r   EraseProjectHookr     s"     )=',,G',	.r   )+__doc__
__future__r   r   r   r   googlecloudsdk.api_lib.iamr   googlecloudsdk.api_lib.utilr   googlecloudsdk.callioper   r	   r#   googlecloudsdk.command_lib.iamr
   $googlecloudsdk.command_lib.util.apisr   googlecloudsdk.corer   r   r&   r+   r9   r<   rA   rC   rH   rN   rW   r_   rc   rl   rs   rw   rz   rp   rq   r   r   r   r   r   rV   r   r   <module>r      s    ( &  ' 	 + , / C 3 : #.		
(4),&&/d#L66	r   