
    U                     V   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSKJ
r
  SS	KJr  \R                  \R                  " \R                  R                   \R                  R"                  \R                  R$                  5       " S
 S\R&                  5      5       5       rg)z<Implements the command for generating Cloud CDN Signed URLs.    )absolute_import)division)unicode_literals)arg_parsers)base)sign_url_utils)signed_url_flags)filesc                   F    \ rS rSrSr\R                  r\S 5       r	S r
Srg)SignUrl   a7  Sign specified URL for use with Cloud CDN Signed URLs.

*{command}* generates a signed URL for the specified URL and
optionally validates the response by sending a request to the signed URL.

Cloud CDN Signed URLs give you a way to serve responses from the
globally distributed CDN cache, even if the request needs to be
authorized.

Signed URLs are a mechanism to temporarily give a client access to a
private resource without requiring additional authorization. To achieve
this, the full request URL that should be allowed is hashed
and cryptographically signed. By using the signed URL you give it, that
one request will be considered authorized to receive the requested
content.

Generally, a signed URL can be used by anyone who has it. However, it
is usually only intended to be used by the client that was directly
given the URL. To mitigate this, they expire at a time chosen by the
issuer. To minimize the risk of a signed URL being shared, it is recommended
that the signed URL be set to expire as soon as possible.

A 128-bit secret key is used for signing the URLs.

The URLs to sign have the following restrictions:

- The URL scheme must be either HTTP or HTTPS.
- The URLs must not contain the query parameters: `Expires`, `KeyName` or
  `Signature`, since they are used for signing.
- The URL must not have a fragment.
c                     [         R                  " U SS9  [         R                  " U SS9  U R                  S[        R
                  " 5       SSS9  U R                  SSSS	9  U R                  S
SS9  g)zPSet up arguments for this command.

Args:
  parser: An argparse.ArgumentParser.
T)requiredz--expires-inz      The duration for which the signed URL will be valid. For example,
      specifying `12h` will cause the signed URL to be valid up to 12 hours.
      See $ gcloud topic datetimes for information on duration formats.
      )typer   helpz
--validate
store_truea        If provided, validates the generated signed URL by sending a HEAD request
      and prints out the HTTP response code.

      If the signed URL is valid, the result should be the same as the response
      code sent by the backend. If it isn't, recheck the key name and the
      contents of the key file, and ensure that expires-in is set to at least
      several seconds and that the clock on the computer running this command
      is accurate.

      If not provided, the generated signed URL is not verified.
      )actionr   urlzThe URL to sign.)r   N)r	   AddCdnSignedUrlKeyNameAddCdnSignedUrlKeyFileadd_argumentr   Duration)parsers    lib/surface/compute/sign_url.pyArgsSignUrl.ArgsB   s     ++FTB++FTB
!!#
	   
   $67    c                 T   [         R                  " UR                  5      R                  5       SR	                  5       -   n0 n[
        R                  " UR                  UR                  X!R                  5      US'   UR                  (       a  [
        R                  " US   5      US'   U$ )aX  Signs the specified URL and optionally also validates it.

Args:
  args: The arguments passed to this command.

Returns:
  Returns a dictionary. The 'signedUrl' key in the dictionary maps to the
  Signed URL. The 'validationResponseCode' key in the dictionary maps to
  the response code obtained for the HEAD request issued to the Signed URL.
z===	signedUrlvalidationResponseCode)r
   ReadBinaryFileContentskey_filerstripencoder   r   r   key_name
expires_invalidateValidateSignedUrl)selfargs	key_valueresults       r   RunSignUrl.Rune   s     	$$T]]3::<u||~M  F(004==1:OOMF; }})7)I)I

*f%& Mr    N)__name__
__module____qualname____firstlineno____doc__r   TOOLS_CATEGORYcategorystaticmethodr   r-   __static_attributes__r/   r   r   r   r      s-    @   ( 8  8Dr   r   N)r4   
__future__r   r   r   googlecloudsdk.callioper   r   "googlecloudsdk.command_lib.computer   r	   googlecloudsdk.core.utilr
   UniverseCompatibleReleaseTracksReleaseTrackGABETAALPHACommandr   r/   r   r   <module>rD      s    C &  ' / ( = ? * D%%(($*;*;*@*@%%++-_dll _- _r   