
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SSKJr  S	/rS
/rS/rS rSS jrS rg)z$Helpers for testing IAM permissions.    )absolute_import)division)unicode_literals)iam)projects_api)base)
exceptionsz cloudkms.cryptoKeys.setIamPolicyz'privateca.certificateAuthorities.createzprivateca.certificates.createc                 h    [        U5      [        U 5      -
  nU(       a  [        R                  " X#S9eg)zDRaises an exception if the expected permissions are not all present.)resourcemissing_permissionsN)setr	   InsufficientPermissionException)actual_permissionsexpected_permissionsr   diffs       /lib/googlecloudsdk/command_lib/privateca/iam.py_CheckAllPermissionsr   (   s8     
!	"S);%<	<$	

4
45 5 
    Nc                     [        [        R                  " U [        5      R                  [        S5        U(       a5  [        [
        R                  " U[        5      R                  [        S5        gg)a!  Ensures that the current user has the required permissions to create a CA.

Args:
  project_ref: The project where the new CA will be created.
  kms_key_ref: optional, The KMS key that will be used by the CA.

Raises:
  InsufficientPermissionException: If the user is missing permissions.
projectzKMS keyN)r   r   TestIamPermissions!_CA_CREATE_PERMISSIONS_ON_PROJECTpermissionskms_iamTestCryptoKeyIamPermissions_CA_CREATE_PERMISSIONS_ON_KEY)project_refkms_key_refs     r   *CheckCreateCertificateAuthorityPermissionsr   1   sZ     %%
8::E+'4 ++6	88C%y2 r   c           	         [         R                  " SS9n[         R                  " SS9nUR                  R	                  UR                  U R                  5       UR                  [        S9S95      n[        UR                  [        S5        g)zEnsures that the current user can issue a certificate from the given Pool.

Args:
  issuing_ca_pool_ref: The CA pool that will create the certificate.

Raises:
  InsufficientPermissionException: If the user is missing permissions.
v1)api_version)r   )r   testIamPermissionsRequestz
issuing CAN)privateca_baseGetClientInstanceGetMessagesModuleprojects_locations_caPoolsr   :PrivatecaProjectsLocationsCaPoolsTestIamPermissionsRequestRelativeNameTestIamPermissionsRequest*_CERTIFICATE_CREATE_PERMISSIONS_ON_CA_POOLr   r   )issuing_ca_pool_refclientmessagestest_responses       r   !CheckCreateCertificatePermissionsr0   F   s     ++=&--$?(33FFII&335$,$F$FD %G %F J GH-
 }00A<Qr   )N)__doc__
__future__r   r   r   googlecloudsdk.api_lib.cloudkmsr   r   +googlecloudsdk.api_lib.cloudresourcemanagerr    googlecloudsdk.api_lib.privatecar   r$   $googlecloudsdk.command_lib.privatecar	   r   r   r+   r   r   r0    r   r   <module>r8      sU    + &  ' : D C ; '!  .% !
 /N-N *52*Qr   