
    3                     .   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJr  SSKJr  SSKJ	r	  SS	KJr  SS
KJr  SS	KJr  S/rSr " S S\R*                  5      r       SS jr " S S\R.                  \R0                  \	R2                  5      rg)z@A module to get a credentialed http object for making API calls.    )absolute_import)division)unicode_literals)external_account)requests)base)
exceptions)	transport)storei     c                       \ rS rSrSrSrg)Error#   zExceptions for this module. N)__name__
__module____qualname____firstlineno____doc____static_attributes__r       /lib/googlecloudsdk/core/credentials/requests.pyr   r   #   s    #r   r   Nc                     [         R                  " U UUUUS9n[        5       n[        R                  " 5       n[
        R                  " X85      n	UR                  UUUSU	S9nUR                  XCU	S9nU$ )a  Get requests.Session object for working with the Google API.

Args:
  timeout: double, The timeout in seconds to pass to httplib2.  This is the
      socket level timeout.  If timeout is None, timeout is infinite.  If
      default argument 'unset' is given, a sensible default is selected.
  ca_certs: str, absolute filename of a ca_certs file that overrides the
      default
  enable_resource_quota: bool, By default, we are going to tell APIs to use
      the quota of the project being operated on. For some APIs we want to use
      gcloud's quota, so you can explicitly disable that behavior by passing
      False here.
  allow_account_impersonation: bool, True to allow use of impersonated service
      account credentials for calls made with this client. If False, the
      active user credentials will always be used.
  session: requests.Session instance. Otherwise, a new requests.Session will
      be initialized.
  streaming_response_body: bool, True indicates that the response body will
      be a streaming body.
  redact_request_body_reason: str, the reason why the request body must be
      redacted if --log-http is used. If None, the body is not redacted.

Returns:
  1. A regular requests.Session object if no credentials are available;
  2. Or an authorized requests.Session object authorized by google-auth
     credentials.

Raises:
  creds_exceptions.Error: If an error loading the credentials occurs.
)timeoutca_certssessionstreaming_response_bodyredact_request_body_reasonTcredentials)	r   
GetSessionRequestWrapperr   UseGoogleAuthr   LoadIfEnabled	WrapQuotaWrapCredentials)
r   r   enable_resource_quotaallow_account_impersonationr   r   r   request_wrapperuse_google_authr    s
             r   r!   r!   '   s    J 5!;' #$/&&(/##!+ %%!
 & ' ++ , ' 
.r   c                   *    \ rS rSrSrS r SS jrSrg)r"   f   z-Class for wrapping requests.Session requests.c                    ^^^^^ TR                   mSS0m[        R                  " T5      mSUUUUU4S jjnUTl         T$ )z=Returns an http_client authorized with the given credentials.attemptr   c                   > T
R                   nTT
l         T	R                  TXU5        UT
l         T" X4X#=(       d    0 S.UD6nUR                  [        ;   a  [	        T	[
        R                  5      (       a  T	R                  (       dR  TS   [        :  aE  TS==   S-  ss'   T	R                  [        R                  " 5       5        T" X4X#=(       d    0 S.UD6nU$ )N)dataheadersr.   r   )requestbefore_requeststatus_codeREFRESH_STATUS_CODES
isinstancegoogle_auth_external_accountCredentialsvalidMAX_REFRESH_ATTEMPTSrefreshr   GoogleAuthRequest)methodurlr0   r1   kwargswrapped_requestresponseauth_requestcredential_refresh_statecredshttp_clientorig_requests          r   WrappedRequest6RequestWrapper.AuthorizeClient.<locals>.WrappedRequests   s    #++o(k<g>+k
C -RC;ACh 

"6
6%!=!I!IJJ{{
"9
-0D
D +q0+h0023E"MrE=CE or   )NN)r2   google_auth_requestsRequest)selfrE   rD   rG   rB   rC   rF   s    `` @@@r   AuthorizeClientRequestWrapper.AuthorizeClientm   sB    &&L )1~'//<L * )Kr   Nc                    ^^	 U R                  UUUUS9nU(       d  U$ UR                  mU R                  X5      m	UU	4S jn[        R                  " 5       (       a  Xql        U$ T	Ul        U$ )z3Returns an http_client with quota project handling.r   c                    > T" U 0 UD6nUR                   S:w  a  U$ UR                  nUR                  =(       d    [        R                  Ul         UR	                  5       S   S   n X2l        U Hl  nUR                  S5      S:X  d  M  UR                  S5      [        R                  :X  d  M?  UR                  S5      [        R                  :X  d  Md  T" U 0 UD6s  $    U$ ! [
        [        4 a    Us X2l        $ f = f! X2l        f = f)a  Retries the request after removing the quota project header.

Try the request with the X-Goog-User-Project header. If the account does
not have the permission to expense the quota of the user project in the
header, remove the header and retry.

Args:
  *args: *args to send to requests.Session.request method.
  **kwargs: **kwargs to send to requests.Session.request method.

Returns:
  Response from requests.Session.request.
i  errordetailsz@typez(type.googleapis.com/google.rpc.ErrorInforeasondomain)r4   encodingcore_transportENCODINGjsonKeyError
ValueErrorgetr
   USER_PROJECT_ERROR_REASONUSER_PROJECT_ERROR_DOMAIN)argsr?   rA   old_encodingerr_details
err_detailrF   r@   s         r   RequestWithRetry2RequestWrapper.WrapQuota.<locals>.RequestWithRetry   s     !$1&1h				$&&l"++F~/F/Fh)mmog.y9 )#*NN7#9:NN8$	(K(KKNN8$	(K(KKt.v.
. $ o 
# ( )s$   C" "C=4D  <C==D   D)QuotaProjectr2   QuotaWrappedRequestr   #UserProjectQuotaWithFallbackEnabled)
rK   rE   r'   r(   r*   r    quota_projectra   rF   r@   s
           @@r   r%   RequestWrapper.WrapQuota   s     %%#	 & M &&L..{JOB //11,  ,kr   r   )N)r   r   r   r   r   rL   r%   r   r   r   r   r"   r"   f   s    
 6H 9r   r"   )unsetNTTNFN)r   
__future__r   r   r   google.authr   r7   google.auth.transportr   rI   googlecloudsdk.callioper   googlecloudsdk.corer	   r
   rU   googlecloudsdk.core.credentialsr   r5   r:   r   r!   CredentialWrappingMixinQuotaHandlerMixinr"   r   r   r   <module>rq      s     G &  ' H B ( * ( ; 1 5u  $J $ %)+/',*.<~^%%^r   