
    u                        S r SSKJr  SSKrSSKrSSKrSSKrSSKrSSKrSSK	r	SSK
r
SSKrSSKrSSKJr  SSKJr  SSKrSSKJr  SSKJr  SSKJr  SS	KJr   SSKrS
r SSKJr   SSKJ r   S
r! SSK#r#\#RH                  r$/ SQr%\RL                  " 5       q'S r(/ r)S(S jr*    S)S jr+S(S jr,S r-S*S jr. " S S\R^                  5      r0 " S S\Rb                  Rd                  5      r3S(S jr4S(S jr5 " S  S!\65      r7S(S" jr8S# r9\*  S+S$ j5       r:\*S% 5       r;\*S& 5       r<\* S*S' j5       r=g! \ aW  r\R4                  R7                  SS5      r\R;                  S5      (       d  \R;                  S5      (       d  \eSr SrCGN'SrCff = f! \ a
    SSKJr   GN7f = f! \ a!    Sr! SSKJ"r"   GND! \ a    SSKJ"r"    GNTf = ff = f! \ a    Sr$ GNVf = f),z,Common credentials classes and constructors.    )print_functionN)service_account)tools)http_client)urllib)
exceptions)utilTSERVER_SOFTWARE DevelopmentzGoogle App EngineF)gce)multiprocess_file_storage)multistore_file)CredentialsFromFileGaeAssertionCredentialsGceAssertionCredentialsGetCredentialsGetUserinfo!ServiceAccountCredentialsFromFilec                     U q g N)cache_file_lock)locks    3lib/third_party/apitools/base/py/credentials_lib.pySetCredentialsCacheFileLockr   _   s    O    c                     Uc  [        [        5      nO[        U[        [        5      5      n[        R                  X5        U $ )a  Register a new method for fetching credentials.

This new method should be a function with signature:
  client_info, **kwds -> Credentials or None
This method can be used as a decorator, unless position needs to
be supplied.

Note that method must *always* accept arbitrary keyword arguments.

Args:
  method: New credential-fetching method.
  position: (default: None) Where in the list of methods to
    add this; if None, we append. In all but rare cases,
    this should be either 0 or None.
Returns:
  method, for use as a decorator.

)len_CREDENTIALS_METHODSmininsert)methodpositions     r   _RegisterCredentialsMethodr$   j   s:    & +,x%9!:;1Mr   c	                 X   [         R                  " U5      nUUSR                  [        U5      5      U=(       d    SU -  S.n
[         H  nU" U
40 U	D6nUc  M  Us  $    U=(       d    [
        R                  R                  S5      n[        XZUS9nUb  U$ [        R                  " S5      e)zDAttempt to get credentials, using an oauth dance as the last resort. z%s-generated/0.1)	client_idclient_secretscope
user_agentz~/.apitools.token)oauth2client_argsz"Could not create valid credentials)r	   NormalizeScopesjoinsortedr   ospath
expanduserr   r   CredentialsError)package_namescopesr'   r(   r*   credentials_filenameapi_keyclientr+   kwdsclient_infor"   credentialss                r   r   r      s     !!&)F&&.) E$6$E	K '[1D1" ' 0 2773E3E4%&:8IKK

%
%&J
KKr   c           	         [         R                  R                  U 5      n [        R                  S:  a+  [
        R                  R                  XS9nUb	  Ub  X#l        U$ [        U 5       n[        R                  " U5      nSSS5        WR                  S5      nU[        R                  R                  :w  a  [        R                   " SU < 35      e[
        R"                  " US   US   US   US	   XS
9nU$ ! , (       d  f       N}= f)z=Use the credentials in filename to create a token for scopes.1.5.2r4   Ntypez%Invalid service account credentials: r'   client_emailprivate_key_idprivate_key)service_account_idservice_account_emailr@   private_key_pkcs8_textr4   r*   )r/   r0   r1   oauth2client__version__r   ServiceAccountCredentialsfrom_json_keyfile_namer*   openjsonloadgetr7   SERVICE_ACCOUNTr   r2   _ServiceAccountCredentials)filenamer4   r*   r:   keyfileservice_account_infoaccount_types          r   r   r      s   ww!!(+H') 55LL M ) 	 "%)3& (^w#'99W#5  +//7<..>>>--=EGI I &@@3K@"6~"F/0@A#7#F2  ^s   *C88
Dc                    [         R                  R                  U5      n[        R                  " U5      n[
        R                  S:  a)  [        R                  R                  XUS9nUb  X4l
        U$ [        US5       n[
        R                  R                  XR                  5       UUS9sSSS5        $ ! , (       d  f       g= f)z4Create a new credential from the named .p12 keyfile.r<   r=   Nrbr*   )r/   r0   r1   r	   r,   rE   rF   r   rG   from_p12_keyfiler*   rI   r7   SignedJwtAssertionCredentialsread)service_account_nameprivate_key_filenamer4   r*   r:   key_files         r   $ServiceAccountCredentialsFromP12Filer\      s     77--.BC!!&)F') 55FF$6 G K 	 "%/" &-&&DD$mmov% E ' .--s   ?-B66
Cc                    U(       a!  [         R                  R                  SS5      nO [         R                  R                  SS5      nSU-   S-   U -   nSS0n[        R                  R                  X4S	9n[        R                  R                  [        R                  R                  0 5      5      n UR                  U5      nU$ ! [        R                  R                   a(  n[        R                  " S
UR                  -  5      eSnAff = f)z4Request the given url from the GCE metadata service.GCE_METADATA_IPz169.254.169.254GCE_METADATA_ROOTzmetadata.google.internalzhttp://z/computeMetadata/v1/zMetadata-FlavorGoogle)headersz$Could not reach metadata service: %sN)r/   environrL   r   requestRequestbuild_openerProxyHandlerrI   errorURLErrorr   CommunicationErrorreason)	relative_urluse_metadata_ipbase_urlurlra   rc   openerresponsees	            r   _GceMetadataRequestrr      s    ::>>"35FG::>>!;=
h
!7
7,
FC !(+Gnn$$S$:G^^(()D)DR)HIF?;;w' O <<   ?++2QXX=? 	??s   2C D##DDc                      ^  \ rS rSrSrSU 4S jjr\S 5       rS rS r	S r
S rS	 rS
 rS rU 4S jr\S 5       r\S 5       rSrU =r$ )r      z(Assertion credentials for GCE instances.c                   > [         R                  " USS9U l        SnUR                  S5      nU(       a  U R	                  XQ5      nU=(       d    U R                  U5      nU(       a  U(       d  U R                  XQ5        [        R                  " 5          [        R                  " S5        [        [        U ]2  " SSU0UD6  SSS5        g! , (       d  f       g= f)a	  Initializes the credentials instance.

Args:
  scopes: The scopes to get. If None, whatever scopes that are
      available to the instance are used.
  service_account_name: The service account to retrieve the scopes
      from.
  **kwds: Additional keyword args.

utf-8encodingNcache_filenameignorer)    )sixensure_text._GceAssertionCredentials__service_account_namerL   _CheckCacheFileForMatch_ScopesFromMetadataServer_WriteCacheFilewarningscatch_warningssimplefiltersuperr   __init__)selfr4   rY   r8   cached_scopesry   	__class__s         r   r    GceAssertionCredentials.__init__   s      '*oo '# "23 88(M H$"@"@"H-  8 $$&!!(+)49OO$O '&&s   -C
Cc                 H     U " U0 UD6$ ! [         R                   a     g f = fr   r   Errorclsargsr8   s      r   GetGceAssertionCredentials.Get  /    	%%% 		   
 !!c                 .   U(       a  [        [        U5      5      OSU R                  S.n[        U5      n UR	                  5       nU(       d  g[
        R                  " U5      nUS   US   :X  a  US   SUS   4;   a  US   $ gg! [         a    e    g= f)zChecks the cache file to see if it matches the given credentials.

Args:
  cache_filename: Cache filename to check.
  scopes: Scopes for the desired credentials.

Returns:
  List of scopes (if cache matches) or None.
Nr4   svc_acct_namer   r4   )r.   listr~   _MultiProcessCacheFile
LockedReadrJ   loadsKeyboardInterrupt)r   ry   r4   creds
cache_filecached_creds_strcached_credss          r   r   /GceAssertionCredentials._CheckCacheFileForMatch  s     /5fT&\*$!88
 ,N;
	)446#::&67L_%o)FF?t\(-C&DD'11 E G ! 		s   B 4B Bc                    [        U Vs/ s H  n[        R                  " U5      PM     sn5      nUU R                  S.n[        R
                  " U5      n[        U5      n UR                  U5        gs  snf ! [         a    e    g= f)a  Writes the credential metadata to the cache file.

This does not save the credentials themselves (CredentialStore class
optionally handles that after this class is initialized).

Args:
  cache_filename: Cache filename to check.
  scopes: Scopes for the desired credentials.
r   N)	r.   r|   r}   r~   rJ   dumpsr   LockedWriter   )r   ry   r4   r)   r   	creds_strr   s          r   r   'GceAssertionCredentials._WriteCacheFile8  s     VDVE/VDE!"&"="=?JJu%	+N;
	""9- E ! 		s    A4"A9 9Bc           	         [         R                  " 5       (       d  [        R                  " S5      eU R	                  U R
                  5      (       d#  [        R                  " SU R
                  -  5      eU(       a\  [         R                  " U5      nU R                  5       nX#:  a.  [        R                  " S[        [        X#-
  5      5      < 35      e U$ U R                  5       nU$ )z5Returns instance scopes based on GCE metadata server.0GCE credentials requested outside a GCE instancez@GCE credentials requested but service account %s does not exist.z'Instance did not have access to scopes )r	   	DetectGcer   ResourceUnavailableErrorGetServiceAccountr~   r,   GetInstanceScopesr2   r.   r   )r   r4   scope_lsinstance_scopess       r   r   1GceAssertionCredentials._ScopesFromMetadataServerP  s    ~~55BD D%%d&A&ABB55%'+'B'BCD D ++F3H"446O) 11tH$>?@CD D *  ++-Fr   c                     Sn[        U5      nUR                  5        Vs/ s H(  n[        R                  " U5      R	                  S5      PM*     nnX;   $ s  snf )Nzinstance/service-accountsz/
)rr   	readlinesr|   
ensure_strrstrip)r   accountrk   rp   lineresponse_liness         r   r   )GceAssertionCredentials.GetServiceAccountd  s\    2&|4&.&8&8&:<&:d ...55h?&: 	 <((<s   /Ac                     SR                  U R                  5      n[        U5      n[        R                  " S UR                  5        5       5      $ )Nz$instance/service-accounts/{0}/scopesc              3   j   #    U  H)  n[         R                  " U5      R                  5       v   M+     g 7fr   )r|   r   strip).0r)   s     r   	<genexpr><GceAssertionCredentials.GetInstanceScopes.<locals>.<genexpr>o  s-      $G1E %(NN5$9$?$?$A$A1Es   13)formatr~   rr   r	   r,   r   )r   rk   rp   s      r   r   )GceAssertionCredentials.GetInstanceScopesk  sR    =DD'')&|4## $G191C1C1E$G G 	Gr   c                 V    [         R                  R                  R                  X5        g)a  Refresh self.access_token.

This function replaces AppAssertionCredentials._refresh, which
does not use the credential store and is therefore poorly
suited for multi-threaded scenarios.

Args:
  do_request: A function matching httplib2.Http.request's signature.

N)rE   r7   OAuth2Credentials_refresh)r   
do_requests     r   r    GceAssertionCredentials._refreshs  s     	--66tHr   c                    SR                  U R                  5      n [        U5      n[        R                  " UR                  5       5      n [        R                  " U5      nUS   U l        SU;   ak  [!        US   5      n["        R$                  " US9["        R"                  R'                  ["        R(                  R*                  S9R-                  SS	9-   U l        OSU l        S
U l        U R                  (       a  U R                  R                  U 5        gg! [        R                   a5    SU l        U R                  (       a  U R                  R                  U 5        e f = f! [         a    [        R                  " SU-  5      ef = f)z|Refresh self.access_token by querying the metadata server.

If self.store is initialized, store acquired credentials there.
z#instance/service-accounts/{0}/tokenTz$Could not parse response as JSON: %saccess_token
expires_in)seconds)tzN)tzinfoF)r   r~   rr   r   ri   invalidstore
locked_putr|   r   rX   rJ   r   
ValueErrorr2   r   intdatetime	timedeltanowtimezoneutcreplacetoken_expiry)r   unused_http_requestrk   rp   contentcredential_infor   s          r   _do_refresh_request+GceAssertionCredentials._do_refresh_request  sa   
 =CC'')	*<8H ..1	B"jj1O
 ,N;?*_\:;J"":6!!%%):):)>)>%?GGtGTU  !%D::JJ!!$' + ,, 	DLzz

%%d+		  	B--6@B B	Bs   D E& A	E#&$F
c                 <   > [         [        R                  U ]  5       $ r   )r   r   AppAssertionCredentialsto_json)r   r   s    r   r   GceAssertionCredentials.to_json  s     S00$?AAr   c                 z   [         R                  " U5      n0 nSUR                  S/ 5      ;   a  US   S   US'   S nSU;   a  US   /n[        SSU0UD6nSU;   a
  US   Ul        SU;   a@  [
        R
                  R                  US   [        R                  R                  5      Ul
        SU;   a
  US   Ul        U$ )	Nry   kwargsr)   r4   r   r   r   r{   )rJ   r   rL   r   r   r   strptimerE   r7   EXPIRY_FORMATr   r   )r   	json_datadatar   
scope_listr:   s         r   	from_json!GceAssertionCredentials.from_json  s    zz)$txx"55'+H~6F'GF#$ 
d?w-J-JZJ6JT!'+N';K$T!'/'8'8'A'A^$l&9&9&G&G(IK$"&y/Kr   c                     [        S5      e)Nz6Cannot serialize credentials for GCE service accounts.NotImplementedErrorr   s    r   serialization_data*GceAssertionCredentials.serialization_data  s    !DF 	Fr   )__service_account_namer   r   r   )Ndefault)__name__
__module____qualname____firstlineno____doc__r   classmethodr   r   r   r   r   r   r   r   r   r   propertyr   __static_attributes____classcell__r   s   @r   r   r      sw    2$PL  :0()GI(BB  ( F Fr   r   c                   X   ^  \ rS rSrSrU 4S jr\S 5       r\S 5       rS r	S r
SrU =r$ )	r   i  z1Assertion credentials for Google App Engine apps.c                    > [         R                  " 5       (       d  [        R                  " S5      e[	        [         R
                  " U5      5      U l        [        [        U ]&  " S0 UD6  g )Nr   r   )
r	   	DetectGaer   r   r   r,   _scopesr   r   r   )r   r4   r8   r   s      r   r    GaeAssertionCredentials.__init__  sR    ~~55BD DD0089%t5CdCr   c                 H     U " U0 UD6$ ! [         R                   a     g f = fr   r   r   s      r   r   GaeAssertionCredentials.Get  r   r   c                 J    [         R                  " U5      n[        US   5      $ )Nr   )rJ   r   r   )r   r   r   s      r   r   !GaeAssertionCredentials.from_json  s    zz)$&tI77r   c                     SSK Jn   UR                  U R                  5      u  p1X0l        g! UR                   a$  n[
        R                  " [        U5      5      eSnAff = f)zhRefresh self.access_token.

Args:
  _: (ignored) A function matching httplib2.Http.request's signature.
r   )app_identityN)	google.appengine.apir  get_access_tokenr   r   r   r2   strr   )r   _r  tokenrq   s        r   r    GaeAssertionCredentials._refresh  sW     	6	6#44T\\BHE " !! 	6--c!f55	6s   , A AA c                     [        S5      e)a5  Cryptographically sign a blob (of bytes).

This method is provided to support a common interface, but
the actual key used for a Google Compute Engine service account
is not available, so it can't be used to sign content.

Args:
    blob: bytes, Message to be signed.

Raises:
    NotImplementedError, always.
z1Compute Engine service accounts cannot sign blobsr   )r   blobs     r   	sign_blob!GaeAssertionCredentials.sign_blob  s     "?A 	Ar   )r   r   )r   r   r   r   r   r   r   r   r   r   r  r   r   r   s   @r   r   r     sE    ;D   8 8"A Ar   r   c                 t   [         R                  " [        R                  /S9nUR	                  U S9u  p#[        [        S5      (       a  [        R                  Ul        [        [        S5      (       a  [        R                  Ul        [        [        S5      (       a  [        R                  (       + Ul
        U$ )z4Retrieves command line flags based on gflags module.)parentsr   auth_host_nameauth_host_portauth_local_webserver)argparseArgumentParserr   	argparserparse_known_argshasattrFLAGSr  r  r  noauth_local_webserver)r   parserflagsr	  s       r   _GetRunFlowFlagsr     s     $$eoo->?F&&D&1HE u&''$33u&''$33u,--,1,F,F(F$Lr   c                 F   US   nUS   n[        U[        R                  5      (       d  SR                  U5      nUS   U-   U-   n[        (       a  [
        R                  " X5      nO[        R                  " X5      n[        [        S5      (       a  S[        l        UR                  5       nUb  UR                  (       a_  [        S5        [        S	5       HE  n [         R"                  R$                  " S0 UD6n	['        US
9n
[(        R*                  " XU
5      n  U$    U$ ! [         R"                  R,                  [.        4 a  n[        SU< 35         SnAM  SnAf[0        R2                   a-  n[        SU< 35        [4        R6                  " SU-  5      eSnAff = f)zRead credentials from a file.r*   r)   :r'   r  FNz$Generating new OAuth credentials ...   r  zInvalid authorization: zCommunication error: z,Communication error creating credentials: %sr{   )
isinstancer|   string_typesr-   _NEW_FILESTOREr   MultiprocessFileStorager   (get_credential_storage_custom_string_keyr  r  r  rL   r   printrangerE   r7   OAuth2WebServerFlowr  r   run_flowFlowExchangeError
SystemExithttplib2HttpLib2Errorr   r2   )r0   r9   r+   r*   	scope_keystorage_keycredential_storer:   r	  flowr  rq   s               r   r   r     s|   \*JG$Ii!1!122HHY'	k*Z7)CK~4LL +SSu,--%*""&&(Kk1145rAH#**>>MM(.?@#nnTUK % $  !''99:F : Q899)) H167 11BQFH HHs%   A D##$F EF 3(FF c                       \ rS rSrSrSrSr\R                  " 5       r	S r
\R                  S 5       r\R                  S 5       rS rS	 rS
 rSrg)r   i>  a  Simple multithreading and multiprocessing safe cache file.

Notes on behavior:
* the fasteners.InterProcessLock object cannot reliably prevent threads
  from double-acquiring a lock. A threading lock is used in addition to
  the InterProcessLock. The threading lock is always acquired first and
  released last.
* The interprocess lock will not deadlock. If a process can not acquire
  the interprocess lock within `_lock_timeout` the call will return as
  a cache miss or unsuccessful cache write.
* App Engine environments cannot be process locked because (1) the runtime
  does not provide monotonic time and (2) different processes may or may
  not share the same machine. Because of this, process locks are disabled
  and locking is only guaranteed to protect against multithreaded access.
   rv   c                     S U l         Xl        [        (       a<  U R                  U l        [
        R                  " SR                  U5      5      U l        g U R                  U l        S U l        g )Nz{0}.lock)
_file	_filename_FASTENERS_AVAILABLE_ProcessLockAcquired_process_lock_getter	fastenersInterProcessLockr   _process_lock_DummyLockAcquired)r   rO   s     r   r   _MultiProcessCacheFile.__init__S  s[    
!(,(A(AD%!*!;!;!!(+"-D )-(?(?D%!%Dr   c              #      #     U R                   R                  U R                  S9nUv   U(       a  U R                   R                  5         gg! W(       a  U R                   R                  5         f f = f7f)z/Context manager for process locks with timeout.)timeoutN)r>  acquire_lock_timeoutrelease)r   	is_lockeds     r   r:  +_MultiProcessCacheFile._ProcessLockAcquired^  sb     	-**224;M;M2NIO""**, y""**, s   A5'A #A5$A22A5c              #      #    Sv   g7f)z<Lock context manager for environments without process locks.TNr{   r   s    r   r?  )_MultiProcessCacheFile._DummyLockAcquiredh  s      
s   c                    SnU R                      U R                  5       (       d
   SSS5        gU R                  5        nU(       d   SSS5        SSS5        g[        U R                  S5       nUR                  5       R                  U R                  S9nSSS5        SSS5        SSS5        U$ ! , (       d  f       N = f! , (       d  f       N)= f! , (       d  f       U$ = f)aG  Acquire an interprocess lock and dump cache contents.

This method safely acquires the locks then reads a string
from the cache file. If the file does not exist and cannot
be created, it will return None. If the locks cannot be
acquired, this will also return None.

Returns:
  cache data - string if present, None on failure.
NrT   rw   )_thread_lock_EnsureFileExistsr;  rI   r8  rX   decode	_encoding)r   file_contentsacquired_plockfs       r   r   !_MultiProcessCacheFile.LockedReadm  s     ))++  **,% -  $..$/1$%FFHOOT^^O$LM 0 -   0/ -,  sK   CC	CCC/(B1CC1
B?;C
C	C
C"c                    [        U[        R                  5      (       a  UR                  U R                  S9nU R
                     U R                  5       (       d
   SSS5        gU R                  5        nU(       d   SSS5        SSS5        g[        U R                  S5       nUR                  U5        SSS5         SSS5        SSS5        g! , (       d  f       N = f! , (       d  f       O= f SSS5        g! , (       d  f       g= f)aF  Acquire an interprocess lock and write a string.

This method safely acquires the locks then writes a string
to the cache file. If the string is written successfully
the function will return True, if the write fails for any
reason it will return False.

Args:
  cache_data: string or bytes to write.

Returns:
  bool: success
rw   NFwbT)r#  r|   	text_typeencoderN  rK  rL  r;  rI   r8  write)r   
cache_datarP  rQ  s       r   r   "_MultiProcessCacheFile.LockedWrite  s     j#--00#**DNN*CJ))++  **,%  -  $..$/1GGJ' 0 -  0/ -,, sN   C=%C=5	C">C=C"%C7	C" C=
CC""
C0	,C==
Dc                    [         R                  R                  U R                  5      (       dS  [         R                  " S5      n [        U R                  S5      R                  5          [         R                  " U5        gg! [         a     [         R                  " U5        gf = f! [         R                  " U5        f = f)z8Touches a file; returns False on error, True on success.   za+bFT)r/   r0   existsr8  umaskrI   closeOSError)r   	old_umasks     r   rL  (_MultiProcessCacheFile._EnsureFileExists  s    ww~~dnn--I$T^^U+113 #	  # #s$   $B 
B&B) %B&&B) )C)r7  r8  r>  r;  N)r   r   r   r   r   rD  rN  	threadingLockrK  r   
contextlibcontextmanagerr:  r?  r   r   rL  r   r{   r   r   r   r   >  sg      MI>>#L	& - -  ,6
r   r   c                 R   U=(       d    [         R                  " 5       n[        U 5      nUR                  U5      u  p4UR                  [
        R                  :X  a/  U R                  U5        [        U 5      nUR                  U5      u  p4[        R                  " U=(       d    S5      $ )a  Get the userinfo associated with the given credentials.

This is dependent on the token having either the userinfo.email or
userinfo.profile scope for the given token.

Args:
  credentials: (oauth2client.client.Credentials) incoming credentials
  http: (httplib2.Http, optional) http instance to use

Returns:
  The email address for this token, or None if the required scopes
  aren't available.
z{})
r.  Http_GetUserinfoUrlrc   statusr   BAD_REQUESTrefreshrJ   r   )r:   httprn   rp   r   s        r   r   r     s     "8==?D
+
&C S)H+111D!k* LL-::go&&r   c                     SnSU R                   0nSR                  U[        R                  R	                  U5      45      $ )Nz'https://oauth2.googleapis.com/tokeninfor   ?)r   r-   r   parse	urlencode)r:   url_root
query_argss      r   rh  rh    s:    8H +":":;J88Xv||55jABCCr   c                     U S   R                  5       nU S   nU(       a
  [        X5US9$ U(       a  U(       a  U(       a  U(       d  [        R                  " S5      eUb  [	        XXV5      $ g)z1Returns ServiceAccountCredentials from give file.r)   r*   rU   z:Service account name or keyfile provided without the otherN)splitr   r   r2   r\   )r9   rY   service_account_keyfileservice_account_json_keyfileunused_kwdsr4   r*   s          r   _GetServiceAccountCredentialsrx    s}    
 !'')F\*J#0(ZI 	I 
&=$-A))HJ 	J'3 6O 	O (r   c                 P    U S   R                  S5      n[        R                  US9$ Nr)   r&   r=   )rt  r   r   r9   rw  r4   s      r   _GetGaeServiceAccountr|    +    !'',F"&&f&55r   c                 P    U S   R                  S5      n[        R                  US9$ rz  )rt  r   r   r{  s      r   _GetGceServiceAccountr    r}  r   c                    U S   R                  5       nU(       a  g[        R                  R                  n[            UR                  5       n SSS5        SnWc  g[        XT5      (       a  Xc;   a  UR                  U5      $ g! [        R                  R                   a     SSS5        gf = f! , (       d  f       Ng= f)zReturns ADC with right scopes.r)   Nz.https://www.googleapis.com/auth/cloud-platform)	rt  rE   r7   GoogleCredentialsr    _implicit_credentials_from_files"ApplicationDefaultCredentialsErrorr#  create_scoped)r9   $skip_application_default_credentialsrw  r4   gcr:   cps          r   !_GetApplicationDefaultCredentialsr    s    
 !'')F+				.	.B		 ==?K 
 
:Bk&&",((00 ""EE 	 
	 
s(   B0BB-"B0,B--B00
B>r   )NNNN)F)NNN)>r   
__future__r   r  rd  r   rJ   r/   rb  r   r.  rE   oauth2client.clientr   r   r|   	six.movesr   r   apitools.base.pyr   r	   r<  r9  ImportErrorimport_errorrb   rL   
server_env
startswithoauth2client.contribr   r   r%  r   gflagsr  __all__rc  r   r   r   r$   r   r   r\   rr   r   r   r7   AssertionCredentialsr   r  r   objectr   r   rh  rx  r|  r  r  r{   r   r   <module>r     s(  " 3 %     	      (  
 !  ' !!!(1>NLLE
 .."  8 )-%)	L6@'**YFc99 YF@3Al11FF 3Al,%PjV j\'4D HL%)O O( 6 6
 6 6
 :?   ! 126J!!-00!!"566 !  !  !  1N188 1001	1  Esg   D/ !F (F" 1G /F5AFFFF"G	+F44G G	GG	GG