
    $                     L   S r SSKJr  SSKJr  SSKJr  SSKrSSKrSSKJr  SSK	J
r
  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  \" / SQ5      r\" SS/5      r\" S/5      rSrS r S r!S r"\RF                   " S S\RH                  5      5       r%g)z+Command to authorize accounts for transfer.    )absolute_import)division)unicode_literalsN)projects_api)apis)base)util)log)
properties)creds)store)universe_descriptor)files)zroles/ownerzroles/storagetransfer.adminz#roles/storagetransfer.transferAgentzroles/storage.objectAdminzroles/pubsub.editorzroles/storage.adminz"roles/storagetransfer.serviceAgentzroles/pubsub.publisherzDserviceAccount:service-{project_number}@{service_account_url_suffix}c                 :    U(       a  SOSnSR                  X 5      $ )z=Returns an email format useful for interacting with IAM APIs.serviceAccountuserz{}:{})format)email_stringis_service_account
iam_prefixs      !lib/surface/transfer/authorize.py_get_iam_prefixed_emailr   4   s    #56*	
	11    c                    [         R                  " 5       R                  [        R                  R
                  R                  R                  5       5      R                  nU(       a  SU S3nOSn[        R                  U US9$ )zReturns a GCS SA email.zgs-project-accounts.z.iam.gserviceaccount.comz+gs-project-accounts.iam.gserviceaccount.com)project_numberservice_account_url_suffix)
r   UniverseDescriptorGetr   VALUEScoreuniverse_domainproject_prefixSERVICE_ACCOUNT_URL_FORMATr   )r   r"   r   s      r   _get_iam_prefiexed_gcs_sa_emailr$   :   s~     ,,.
s:!!115578~ 
 
~..FG  "O	#	*	*#!; 
+ 
 r   c                    [        5       nU R                   H_  n[        UR                   Vs/ s H  oUU:H  PM	     sn5      (       d  M2  UR                  U;   d  MD  UR                  UR                  5        Ma     U$ s  snf )zEReturns roles in IAM policy from roles_set assigned to account email.)setbindingsanymembersroleadd)project_iam_policyprefixed_account_email	roles_setrolesbindingms         r   (_get_existing_transfer_roles_for_accountr2   M   sh     %%
 $,,g'//B/Q((/BCC	!ii - 
, Cs   A<
c                   8    \ rS rSrSrSSS.r\S 5       rS rSr	g	)
	Authorize]   z7Authorize an account for all Transfer Service features.a         Authorize a Google account for all Transfer Service features.

      This command provides admin and owner rights for simplicity. If that's
      too much authority for your use case, see custom setups here:
      https://cloud.google.com/storage-transfer/docs/on-prem-set-up
      aS        To see what Transfer Service IAM roles the account logged into gcloud may
      be missing, run:

        $ {command}

      To add the missing IAM roles, run:

        $ {command} --add-missing

      To check a custom service account for missing roles, run:

        $ {command} --creds-file=path/to/service-account-key.json
      )DESCRIPTIONEXAMPLESc                 F    U R                  SSS9  U R                  SSSS9  g )Nz--creds-fileaJ  The path to the creds file for an account to authorize. The file should be in JSON format and contain a "type" and "client_email", which are automatically generated for most creds files downloaded from Google (e.g. service account tokens). If this flag is not present, the command authorizes the user currently logged into gcloud.)helpz--add-missing
store_truezAdd IAM roles necessary to use all Transfer Service features to the specified account. By default, this command just prints missing roles.)actionr9   )add_argument)parsers    r   ArgsAuthorize.Args|   s=    
)  * !  "r   c                 Z   [         R                  " SS5      n[         R                  " SS5      nUR                  (       a  [        R
                  R                  [        R
                  R                  UR                  5      5      n[        R                  " U5       n [        R                  " U5      nUS   nUS   S:H  n[!        Xx5      n
S S S 5        Og["        R$                  R&                  R(                  R+                  5       n[,        R.                  " [0        R2                  " 5       5      n[!        UU5      n
["        R$                  R&                  R4                  R+                  5       n[6        R8                  " U5      n[:        R<                  " U5      n[?        UW
[@        5      n[        RB                  RE                  SRG                  W[I        U5      5      5        [@        U-
  n[        RB                  RE                  SRG                  [I        U5      5      5        U Vs/ s H  nU
U4PM	     nn[        RB                  RE                  S	5        URJ                  R+                  URM                  US
95      RN                  n[!        USS9n[?        UU[P        5      n[        RB                  RE                  SRG                  U[I        U5      5      5        [P        U-
  n[        RB                  RE                  SRG                  [I        U5      5      5        UU Vs/ s H  nUU4PM	     sn-  nU RS                  5       [T        RR                  RV                  L a  [6        RX                  " U5      n[[        U5      n[?        UU[\        5      n[        RB                  RE                  S	5        [        RB                  RE                  SRG                  U[I        U5      5      5        [\        U-
  n[        RB                  RE                  SRG                  [I        U5      5      5        UU Vs/ s H  nUU4PM	     sn-  nUR^                  (       d  U(       a  [        RB                  RE                  S	5        UR^                  (       a  U(       a  [        RB                  RE                  SRG                  U5      5        [:        R`                  " UU5        [        RB                  RE                  S	5        [        RB                  RE                  S5        g [        RB                  RE                  S5        g [        RB                  RE                  S5        g g ! [        [        4 a&  n	[        R                  " U	5        [        S5      eS n	A	ff = f! , (       d  f       GN_= fs  snf s  snf s  snf )Nstoragetransferv1client_emailtypeservice_accountzKInvalid creds file format. Run command with "--help" flag for more details.zUser {} has roles:
{}zMissing roles:
{}z***)	projectIdT)r   z0Google-managed transfer account {} has roles:
{}z/Google-managed service account {} has roles:
{}zAdding roles:
{}zkDone. Permissions typically take seconds to propagate, but, in some cases, it can take up to seven minutes.zNo missing roles to add.z.Rerun with --add-missing to add missing roles.)1r   GetClientInstanceGetMessagesModule
creds_fileospathabspath
expanduserr   
FileReaderjsonload
ValueErrorKeyErrorr
   errorr   r   r   r    accountr   r   IsServiceAccountCredentialscreds_storeLoadprojectprojects_utilParseProjectr   GetIamPolicyr2   EXPECTED_USER_ROLESstatusPrintr   listgoogleServiceAccounts.StoragetransferGoogleServiceAccountsGetRequestaccountEmailEXPECTED_P4SA_ROLESReleaseTrackr   ALPHAGetProjectNumberr$   EXPECTED_GCS_SA_ROLESadd_missingAddIamPolicyBindings)selfargsclientmessagesexpanded_file_pathfile_readerparsed_creds_fileaccount_emailr   er-   
project_idparsed_project_idr,   existing_user_rolesmissing_user_rolesr*   all_missing_role_tuplestransfer_p4sa_emailprefixed_transfer_p4sa_emailexisting_p4sa_rolesmissing_p4sa_rolesr   prefixed_gcs_sa_emailexisting_gcs_sa_rolesmissing_gcs_sa_roless                             r   RunAuthorize.Run   s   ##$5t<F%%&7>H77??277+=+=doo+NO./;	P"ii4
+N;-08<MM

 "9"/ 0/ !'',,4488:m <<[=M=M=OP6}7I K ""''//335J%22:>%223DEB24GIJJ-44]59:M5NP Q,/BBJJ)006H1IJK 4F3E4	&3E   JJU 66::??  	@ 	"##/<  $;$6  C8:MOJJHOOT"568 9,/BBJJ)006H1IJK9K 9K	%t,9K   d//555$55jAn=nMF
35JL	jju	jj
<
C
C#T*?%@
 35JJ	jj+2248L3MNO4H"4HD $
'4H"  2	jju			"
**

.556MN
O

+
+,=,CE
**

5
! **

AB **

5
6

IJ! 3 H% 	P
))A, O P P	P 0/8& ""sB   V#UV'V V#,V(V	#!VV		V
V N)
__name__
__module____qualname____firstlineno____doc__detailed_helpstaticmethodr>   r   __static_attributes__r   r   r   r4   r4   ]   s1    ?


-4 " " ZKr   r4   )&r   
__future__r   r   r   rO   rJ   +googlecloudsdk.api_lib.cloudresourcemanagerr   googlecloudsdk.api_lib.utilr   googlecloudsdk.callioper   #googlecloudsdk.command_lib.projectsr	   rY   googlecloudsdk.corer
   r   googlecloudsdk.core.credentialsr   r   rV   'googlecloudsdk.core.universe_descriptorr   googlecloudsdk.core.utilr   	frozensetr\   rc   rg   r#   r   r$   r2   UniverseCompatibleCommandr4   r   r   r   <module>r      s    2 &  '  	 D , ( E # * 1 @ G * !    (!   "#;"<= J 
2&  IK IK IKr   