
    ]                     >   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SSKJr  SS	KJr  SSKJr  SS
KJr  SSKJr  SSS.r\R*                  " \R,                  R.                  5      \R0                   " S S\R2                  5      5       5       r\\l        g)z*Set-policy command for the Org Policy CLI.    )absolute_import)division)unicode_literals)
exceptions)
completers)service)base)	arguments)utils)logz      Sets an organization policy from a JSON or YAML file. The policy will be
      created if it does not exist, or updated if it already exists.
      a        Organization policy list constraint YAML file example:

        name: projects/PROJECT_ID/policies/CONSTRAINT_NAME
        spec:
          rules:
          - values:
            denied_values:
            - VALUE_A

      Organization policy list constraint JSON file example:

        {
          "name": "projects/PROJECT_ID/policies/CONSTRAINT_NAME",
          "spec": {
            "rules": [
              {
                "values": {
                    "deniedValues": ["VALUE_A"]
                }
              }
            ]
          }
        }

      To set the policy from the file on the path './sample_path', run:

        $ {command} ./sample_path
      )DESCRIPTIONEXAMPLESc                   .    \ rS rSrSr\S 5       rS rSrg)	SetPolicyE   z4Set an organization policy from a JSON or YAML file.c                 p    [         R                  " U 5        U R                  SS[        R                  SS9  g )Npolicy_filePOLICY_FILEz@Path to JSON or YAML file that contains the organization policy.)metavar	completerhelp)r
   AddUpdateMaskArgToParseradd_argumentr   FilesCompleter)parsers    &lib/surface/org_policies/set_policy.pyArgsSetPolicy.ArgsJ   s6    &&v.
++O	  Q    c                    [         R                  " U R                  5       5      n[        R                  " UR
                  U R                  5       5      n[        R                  " U5      nUR                  (       d  [        R                  " S5      eUR                  R                  S5      nUS   nUS   S-   US   -   nSU;  a  SU;  a{  UR                  U5      R                  nU HZ  n	U	R                  US-   U-   :X  d  M  U	R                  (       d  M.  [        R                  " S	U-   S
-   U	R                  -   S-   5        M\      UR!                  UR                  5      n
X:X  a  U
$ UR+                  X45      n[        R,                  " UR                  S5        U$ ! ["        R$                   aT    U(       a  [        R                  " S5        UR'                  U5      n[        R(                  " UR                  S5        Us $ f = f)a  Creates or updates a policy from a JSON or YAML file.

This first converts the contents of the specified file into a policy object.
It then fetches the current policy using GetPolicy. If it does not exist,
the policy is created using CreatePolicy. If it does, the retrieved policy
is checked to see if it needs to be updated. If so, the policy is updated
using UpdatePolicy.

If canned constraint is being chosen even though matching Managed Constraint
is available, a warning is logged.

Args:
  args: argparse.Namespace, An object that contains the values for the
    arguments specified in the Args method.

Returns:
  The created or updated policy.
z2Name field not present in the organization policy./r      custommanagedz/constraints/z7Operation not recommended by org policy: ["constraints/zU"]: "A newer version of this constraint exists that supports dry run and simulation, z{, learn more here https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints#managed-constraints.zA policy for the input constraint does not exist on the resource and so the flag `--update-mask` will be ignored. The policy will be set as per input policy file.policy)org_policy_serviceOrgPolicyApiReleaseTrackr   GetMessageFromFiler   GetUpdateMaskFromArgsnamer   InvalidInputErrorsplitListConstraintsconstraintsequivalentConstraintr   warning	GetPolicyapi_exceptionsHttpNotFoundErrorCreatePolicyCreatedResourceUpdatePolicyUpdatedResource)selfargsorg_policy_apiinput_policyupdate_maskpolicy_partsconstraint_nameparentr0   
constraintr&   create_responseupdate_responses                r   RunSetPolicy.RunS   s   & (44T5F5F5HIN++D,<,<,0,=,=,?AL--d3K((
>@ @  $$**3/L"2&O!_s"\!_4F&9O+K"226:FFk#*OO 8? JK///
++G ** //	0
{{ $''(9(9:f m$11,LO))84! ++ 		?	

 '33LAo	,++X6	s   F A%HH N)	__name__
__module____qualname____firstlineno____doc__staticmethodr   rE   __static_attributes__rG   r   r   r   r   E   s!     =Q QBr   r   N)rL   
__future__r   r   r   apitools.base.pyr   r4   argcompleter    googlecloudsdk.api_lib.orgpolicyr   r'   googlecloudsdk.callioper	   'googlecloudsdk.command_lib.org_policiesr
   r   googlecloudsdk.corer   DETAILED_HELPReleaseTracksr)   GAUniverseCompatibleCommandr   detailed_helprG   r   r   <module>r\      s    1 &  ' 9 " J ( = > 9 #	

	
$N D%%(()N N  *Nb (	 r   