
    3                     z   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJ	r	  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  \	R&                  \	R(                  " \	R*                  R,                  \	R*                  R.                  \	R*                  R0                  5       " S S\	R2                  5      5       5       rg)zUpdate a key.    )absolute_import)division)unicode_literals)
exceptions)base)flags)maps)resource_args)labels_utilc                   F    \ rS rSrSr\S 5       rS rS rS r	S r
S rS	rg
)Update   a  Update a key.

1. Update the rotation schedule for the given key.

Updates the rotation schedule for the given key. The schedule
automatically creates a new primary version for the key
according to `next-rotation-time` and `rotation-period` flags.

Flag `next-rotation-time` must be in ISO 8601 or RFC3339 format,
and `rotation-period` must be in the form INTEGER[UNIT], where units
can be one of seconds (s), minutes (m), hours (h) or days (d).

Key rotations performed manually via `update-primary-version` and the
version `create` do not affect the stored `next-rotation-time`.

2. Remove the rotation schedule for the given key with
`remove-rotation-schedule` flag.

3. Update/Remove the labels for the given key with `update-labels` and/or
`remove-labels` flags.

4. Update the primary version for the given key with `primary-version` flag.

5. Update the Key Access Justifications policy for the given key with
`allowed-access-reasons` flag to allow specified reasons. The key must be
enrolled in Key Access Justifications to use this flag.

6. Remove the Key Access Justifications policy for the given key with
`remove-key-access-justifications-policy` flag. The key must be enrolled in
Key Access Justifications to use this flag.

7. Update the Key Access Justifications policy for the given key with
`allowed_access_reasons` flag to allow zero access reasons. This effectively
disables the key, because a policy is configured to reject all access reasons.
The key must be enrolled in Key Access Justifications to use this flag.

## EXAMPLES

The following command sets a 30 day rotation period for the key
named `frodo` within the keyring `fellowship` and location `global`
starting at the specified time:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --rotation-period=30d \
      --next-rotation-time=2017-10-12T12:34:56.1234Z

The following command removes the rotation schedule for the key
named `frodo` within the keyring `fellowship` and location `global`:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --remove-rotation-schedule

The following command updates the labels value for the key
named `frodo` within the keyring `fellowship` and location `global`. If the
label key does not exist at the time, it will be added:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --update-labels=k1=v1

The following command removes labels k1 and k2 from the key
named `frodo` within the keyring `fellowship` and location `global`:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --remove-labels=k1,k2

The following command updates the primary version for the key
named `frodo` within the keyring `fellowship` and location `global`:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --primary-version=1

The following command updates the default algorithm for the key named `frodo`
within the keyring `fellowship` and location `global`, assuming the key
originally has purpose 'asymmetric-encryption' and algorithm
'rsa-decrypt-oaep-2048-sha256':

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --default-algorithm=rsa-decrypt-oaep-4096-sha256

The following command updates the Key Access Justifications policy for the key
named `frodo` within the keyring ``fellowship'' and location ``global'' to
allow only ``customer-initiated-access'' and
``google-initiated-system-operation'':

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --allowed-access-reasons=customer-initiated-access,google-initiated-system-operation

The following command removes the Key Access Justifications policy for the key
named `frodo` within the keyring ``fellowship'' and location ``global'', which
results in all access reasons being allowed:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --remove-key-access-justifications-policy

The following command updates the Key Access Justifications policy for the key
named `frodo` within the keyring ``fellowship'' and location ``global'' to
allow only zero access reasons, effectively disabling the key:

  $ {command} frodo \
      --location=global \
      --keyring=fellowship \
      --allowed-access-reasons=
c                    [         R                  " U SS5        [        R                  " U 5        [        R                  " U 5        [        R
                  " U 5        [        R                  " U S5        [        R                  " U 5        [        R                  " U 5        [        R                  " U 5        [        R                  " U 5        g )NTkeyzto make primary)r
   AddKmsKeyResourceArgForKMSr   AddRotationPeriodFlagAddNextRotationTimeFlagAddRemoveRotationScheduleFlagAddCryptoKeyPrimaryVersionFlagr   AddUpdateLabelsFlagsAddDefaultAlgorithmFlagAddAllowedAccessReasonsFlag*AddRemoveKeyAccessJustificationsPolicyFlag)parsers    lib/surface/kms/keys/update.pyArgsUpdate.Args   s    ,,VT5A	'	!!&)	''/	((1BC$$V,	!!&)	%%f-	44V<    c                 X   / n[         R                  R                  U5      nUR                  5       (       a  UR	                  S5        UR
                  (       aZ  UR                  (       d  UR                  (       a  [        R                  " S5      eUR	                  S5        UR	                  S5        UR                  (       a  UR	                  S5        UR                  (       a  UR	                  S5        UR                  (       a  UR	                  S5        UR                  b'  UR                  (       a  [        R                  " S5      eUR                  c  UR                  (       a  UR	                  S5        UR                  (       d  U(       d  [        R                  " S5      eU$ )	Nlabelsz=You cannot set and remove rotation schedule at the same time.rotationPeriodnextRotationTimezversionTemplate.algorithmzNYou cannot set and remove a Key Access Justifications policy at the same time.keyAccessJustificationsPolicya  At least one of --primary-version or --update-labels or --remove-labels or --clear-labels or --rotation-period or --next-rotation-time or --remove-rotation-schedule or --default-algorithm or --allowed-access-reasons or --remove-key-access-justifications-policy must be specified.)r   DiffFromUpdateArgsMayHaveUpdatesappendremove_rotation_schedulerotation_periodnext_rotation_timekms_exceptionsArgumentErrordefault_algorithmallowed_access_reasons'remove_key_access_justifications_policyprimary_versionUpdateError)selfargsfields_to_updatelabels_diffs       r   ProcessFlagsUpdate.ProcessFlags   sU   ""11$7K!!##h'$$			!8!8**KM 	M./01./019:##/88(( 
 	##/77=> (8&&I  r   c                 x   [         R                  " 5       n[         R                  " 5       nUR                  R                  R                  5       nUR                  UR                  5       UR                  UR                  S9S9n UR                  R                  U5      nU$ ! [        R                   a     g f = f)N)cryptoKeyVersionId)name$updateCryptoKeyPrimaryVersionRequest)cloudkms_baseGetClientInstanceGetMessagesModuleCONCEPTSr   ParseFCloudkmsProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionRequestRelativeName$UpdateCryptoKeyPrimaryVersionRequestr0   &projects_locations_keyRings_cryptoKeysUpdatePrimaryVersionapitools_exceptions	HttpError)r2   r3   clientmessagescrypto_key_refreqresponses          r   rE   Update.UpdatePrimaryVersion   s    ,,.F..0H]]&&,,.N

Y
Y((*99#'#7#7 : 9 Z ;C>>SS
h
 O (( s   B" "B98B9c           	         [         R                  " 5       n[         R                  " 5       nUR                  R                  R                  5       n[        R                  R                  U5      R                  UR                  R                  UR                  5      nUR                  (       a  UR                  nOUR                  nUR                  UR                  5       UR                  US9S9n	SR!                  U5      U	l        [$        R&                  " XR(                  5        [$        R*                  " XR(                  5        UR,                  (       a  [.        R0                  UR2                     n
UR,                  U
;  aH  [4        R6                  " SR9                  UR,                  UR2                  SR!                  U
5      S95      eUR;                  [.        R<                  R?                  UR,                  5      S9U	R(                  l         URB                  (       d   [$        RD                  " XR(                  5         URF                  RI                  U	5      nU$ ! [J        RL                   a     g f = f)N)r    )r:   	cryptoKey,zzUpdate failed: Algorithm {algorithm} is not valid. Here are the valid algorithm(s) for purpose {purpose}: {all_algorithms}z, )	algorithmpurposeall_algorithms)rQ   )'r<   r=   r>   r?   r   r@   r   r$   r%   Apply	CryptoKeyLabelsValuer    needs_update7CloudkmsProjectsLocationsKeyRingsCryptoKeysPatchRequestrB   join
updateMaskr   SetNextRotationTimerO   SetRotationPeriodr-   r	   VALID_ALGORITHMS_MAPrR   r+   r1   formatCryptoKeyVersionTemplateALGORITHM_MAPPERGetEnumForChoiceversionTemplater/    SetKeyAccessJustificationsPolicyrD   PatchrF   rG   )r2   r3   
crypto_keyr4   rH   rI   rJ   labels_update
new_labelsrK   valid_algorithmsrL   s               r   UpdateOthersUpdate.UpdateOthers   s   ,,.F..0H]]&&,,.N$$33D9??&&
(9(9;M !! ''j$$j

J
J((*$$ %  K  C XX./CN	dMM2	D--022:3E3EF			'7	7((IIO00"**#yy)9: JP J<= 	= '/&G&G))::$$& 'H ''cmm# 77,,T==A>>DDSIh O (( s   I! !I87I8c                 "   SnU(       d  US-  nOUR                   (       a  US-  nU(       d$  USR                  SR                  U5      5      -  nO*U(       a#  USR                  SR                  U5      5      -  n[        R                  " U5      e)a  Handles various errors that may occur during any update stage.

Never returns without an exception.

Args:
  args: Input arguments.
  set_primary_version_succeeds: True if the primary verion is updated
    successfully.
  other_updates_succeed: True if all other updates (besides primary verions)
    is updated successfully.
  fields_to_update: A list of fields to be updated.

Raises:
  ToolException: An exception raised when there is error during any update
  stage.
zAn Error occurred:z) Failed to update field 'primaryVersion'.z$ Field 'primaryVersion' was updated.z  Failed to update field(s) '{}'.z', 'z Field(s) '{}' were updated.)r0   r^   rY   r+   r1   )r2   r3   set_primary_version_succeedsother_updates_succeedr4   errs         r   HandleErrorsUpdate.HandleErrors  s    $ C'	88c				33c 	/66
++&
') )c		+22
++&
') )c

$
$S
))r   c                     U R                  U5      n[        R                  " 5       n[        R                  " 5       nUR                  R
                  R                  5       nUR                  R                  UR                  UR                  5       S95      nSnUR                  (       a  U R                  U5      nU(       a  UnOSnSn	U(       a  U R                  XU5      nU(       a  UnOSn	U(       a  U	(       d  U R                  XX5        gU$ )z<Updates the relevant fields (of a CryptoKey) from the flags.)r:   TFN)r6   r<   r=   r>   r?   r   r@   rD   Get5CloudkmsProjectsLocationsKeyRingsCryptoKeysGetRequestrB   r0   rE   ri   ro   )
r2   r3   r4   rH   rI   rJ   re   rl   rL   rm   s
             r   Run
Update.Run/  s     ((. ,,.F..0H]]&&,,.N>>BBFF,,. 	G 	01J
 $( **40h	
',$ !""45EFh	
 %'/D
-A r    N)__name__
__module____qualname____firstlineno____doc__staticmethodr   r6   rE   ri   ro   rt   __static_attributes__rv   r   r   r   r      s8    
vp 	= 	=*X$(T*>$r   r   N)r{   
__future__r   r   r   apitools.base.pyr   rF   googlecloudsdk.api_lib.cloudkmsr   r<   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr+   r   r	   r
   $googlecloudsdk.command_lib.util.argsr   UniverseCompatibleReleaseTracksReleaseTrackALPHABETAGAUpdateCommandr   rv   r   r   <module>r      s     &  ' > A ( G 0 / 8 < T..33T5F5F5I5IpT p pr   