
    i1                     L   S r SSKrSSKrSSKrSSKrSSKrSSKJrJrJ	r	  SSK
Jr  SSK
Jr  SSKJr  SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr  SSKJr  SS	KJr  \R@                  r \	\RB                  \\RD                  RF                  4   r$\	\$\RJ                  RL                  RN                  4   r( " S
 S\)5      r* " S S\*5      r+ " S S\+5      r, " S S\,5      r- " S S\+5      r. " S S\*5      r/  SS jr0S\(4S jr1    SS jr2g)z4Credential-related classes and functions for bq cli.    N)ListOptionalUnion)app)flags)Oauth2WithReauthCredentials)utils)bq_error)bq_error_utilsc                   4    \ rS rSrSrS\4S jrS\4S jrSrg)CredentialLoader0   z!Base class for credential loader.returnc                 Z    U R                  5       n[        R                  " 5       Ul        U$ )zLoads credential.)_Loadbq_auth_utilsget_client_user_agent_user_agent)selfcreds      platform/bq/credential_loader.pyLoadCredentialLoader.Load3   s#    ::<D$::<DK    c                     [        5       eN)NotImplementedErrorr   s    r   r   CredentialLoader._Load9   s    

r    N)	__name__
__module____qualname____firstlineno____doc__WrappedCredentialsUnionTyper   r   __static_attributes__r    r   r   r   r   0   s    )/  0  r   r   c                      ^  \ rS rSrSr SS\S\SS4S jjr\  SS j5       r	S\
4U 4S	 jjrS\S
   4S jrSS jrSrU =r$ )CachedCredentialLoader=   a  Base class to add cache capability to credential loader.

It will attempt to load credential from local cache file first before calling
derived class to load credential from source. Once credential is retrieved, it
will save to local cache file for future use.
credential_cache_fileread_cache_firstr   Nc                 ~   [         R                  " S5        Xl        X l        SR	                  [        [        R                  " 5       5      5      U l         [        R                  R                  R                  XR                  5      U l        g! [         a#  n[        R                   " SU< SU< 35      eSnAff = f)a  Creates CachedCredentialLoader instance.

Args:
  credential_cache_file: path to a local file to cache credential.
  read_cache_first: whether to load credential from cache first.

Raises:
  BigqueryError: if cache file cannot be created to store credential.
z3Loading credentials with the CachedCredentialLoader,zCannot create credential file z: N)logginginfor+   _read_cache_firstjoinsortedbq_utilsGetClientScopesFromFlags_scopes_keyoauth2client_4_0contribmultiprocess_file_storageMultiprocessFileStorage_storageOSErrorr
   BigqueryError)r   r+   r,   es       r   __init__CachedCredentialLoader.__init__E   s     LLFG!6- xxx'H'H'J KLD&..HH``
!1!1dm  ""4I1
M s   8B 
B<B77B<c                     U R                   $ r   )r;   r   s    r   storageCachedCredentialLoader.storage`   s     ==r   c                    > U R                   (       a  U R                  5       OS nU(       a  U$ [        [        U ]  5       nU(       d  g U R
                  R                  U5        UR                  U R
                  5        U$ r   )r1   _LoadFromCachesuperr)   r   r;   put	set_store)r   r   	__class__s     r   r   CachedCredentialLoader.Loadf   sb    $($:$:4 Dk'35D 	MMdNN4==!Kr   z&wrapped_credentials.WrappedCredentialsc                    [         R                  R                  U R                  5      (       d  g U R                  R                  5       nU(       d[  [        R                  R                  U R                  5      nUR                  5       nU(       a  U R                  R                  U5        W(       d  g[        U[        R                  5      (       a  [        R                   " 5       nO[        R"                  " 5       nUR%                  U5      (       d  gU$ ! [         a  nU R                  U5         SnANSnAff = f)z!Loads credential from cache file.N)ospathexistsr+   r;   getr7   fileStoragerG   BaseException_RaiseCredentialsCorrupt
isinstancewrapped_credentialsWrappedCredentialsr4   GetClientScopesFor3pir5   
has_scopes)r   credslegacy_storager>   scopess        r   rE   %CachedCredentialLoader._LoadFromCacheu   s     77>>$4455'mm!e)..66&&
 ""$
--

E
"
 %,??@@--/f002fF##L  '
##A&&'s   A<D 
D="D88D=c                 \    [         R                  " USSS9  [        R                  " S5        g )NGetCredentialsFromFlagszCredentials appear corrupt. Please delete the credential file and try your command again. You can delete your credential file using "bq init --delete_credentials".

If that does not work, you may have encountered a bug in the BigQuery CLI.)namemessage_prefix   )r   process_errorsysexitr   r>   s     r   rS   /CachedCredentialLoader._RaiseCredentialsCorrupt   s)      	&L		 HHQKr   )r1   r6   r;   r+   )T)r   zJoauth2client_4_0.contrib.multiprocess_file_storage.MultiprocessFileStorage)r>   rR   r   N)r!   r"   r#   r$   r%   strboolr?   propertyrB   r&   r   r   rE   rS   r'   __classcell__rI   s   @r   r)   r)   =   ss     BF#&:>6 S 
/  89 D r   r)   c                   4   ^  \ rS rSrSrS\4U 4S jjrSrU =r$ )ServiceAccountPrivateKeyLoader   z7Base class for loading credential from service account.r   c                    > [         R                  R                  (       d  [        R                  " S5      e[
        [        U ]  5       $ )NzBigQuery requires OpenSSL to be installed in order to use service account credentials. Please install OpenSSL and the Python OpenSSL package.)r7   clientHAS_OPENSSLr   
UsageErrorrF   rm   r   )r   rI   s    r   r   #ServiceAccountPrivateKeyLoader.Load   s;    ""..NN, 
 /;==r   r    )	r!   r"   r#   r$   r%   r&   r   r'   rj   rk   s   @r   rm   rm      s    ?>/ > >r   rm   c                   N   ^  \ rS rSrSrS\S\S\SS4U 4S jjrS\4S	 jrS
r	U =r
$ )"ServiceAccountPrivateKeyFileLoader   z3Credential loader for private key stored in a file.service_account	file_pathpasswordr   Nc                 R   > [         [        U ]
  " U0 UD6  Xl        X l        X0l        g)aj  Creates ServiceAccountPrivateKeyFileLoader instance.

Args:
  service_account: service account the private key is for.
  file_path: path to the file containing private key (in P12 format).
  password: password to uncrypt the private key file.
  *args: additional arguments to apply to base class.
  **kwargs: additional keyword arguments to apply to base class.
N)rF   ru   r?   _service_account
_file_path	_password)r   rw   rx   ry   argskwargsrI   s         r   r?   +ServiceAccountPrivateKeyFileLoader.__init__   s*     

,d<dMfM+ONr   c           	      j    [         R                  R                  R                  U R                  U R
                  [        R                  " 5       U R                  [         R                  [         R                  S9$ ! [         a-  n[        R                  " SU R
                  < SU< 35      eS nAff = f)N)service_account_emailfilenamer[   private_key_password	token_uri
revoke_uriz4Service account specified, but private key in file "z" cannot be read:
)r7   rw   ServiceAccountCredentialsfrom_p12_keyfiler{   r|   r4   r5   r}   GOOGLE_TOKEN_URIGOOGLE_REVOKE_URIIOErrorr   rr   re   s     r   r   (ServiceAccountPrivateKeyFileLoader._Load   s    --GGXX $ 5 5??224#~~$55%77 Y    NN#'??A7 s   A8A; ;
B2(B--B2)r|   r}   r{   r!   r"   r#   r$   r%   rg   r?   r&   r   r'   rj   rk   s   @r   ru   ru      s=    ; -0<?"0  r   ru   c                   F   ^  \ rS rSrSrS\SS4U 4S jjrS\4S jrSr	U =r
$ )	&ApplicationDefaultCredentialFileLoader   z:Credential loader for application default credential file.credential_filer   Nc                 :   > [         [        U ]
  " U0 UD6  Xl        g)zCreates ApplicationDefaultCredentialFileLoader instance.

Args:
  credential_file: path to credential file in json format.
  *args: additional arguments to apply to base class.
  **kwargs: additional keyword arguments to apply to base class.
N)rF   r   r?   _credential_file)r   r   r~   r   rI   s       r   r?   /ApplicationDefaultCredentialFileLoader.__init__   s(     

0$@	 ,r   c                    [        U R                  5       n[        R                  " U5      nSSS5        [        R
                  " 5       nWS   [        R                  R                  :X  a:  [        SUS   US   US   S[        R                  [        R                  " 5       US9$ US   S:X  a)  [        R                  R                  U R                  5      $ US   S:X  a)  [        R                  R!                  U R                  5      $ [        R                  R"                  US'   [        R$                  R&                  R)                  X#S	9n[        R                  " 5       Ul        U$ ! , (       d  f       GNC= f)
zALoads credentials from given application default credential file.Ntype	client_idclient_secretrefresh_token)access_tokenr   r   r   token_expiryr   
user_agentr[   external_account external_account_authorized_user)keyfile_dictr[   )openr   jsonloadr4   r5   r7   rp   AUTHORIZED_USERr   r   r   r   rU   rV   for_external_account$for_external_account_authorized_userSERVICE_ACCOUNTrw   r   from_json_keyfile_dictr   )r   file_objcredentialsclient_scopeservice_account_credentialss        r   r   ,ApplicationDefaultCredentialFileLoader._Load   sW   	d##	$IIh'k 
% 446L6.55EEE(,#O4#O4$55"88:	 	 
V	 2	2 33HH


  
V	 B	B 33XX


  -33CCk&$4$D$D$^$^$u$u" %v %! 1>0S0S0U!-((; 
%	$s   E))
E8)r   r   rk   s   @r   r   r      s+    B,c ,t ,)0 ) )r   r   c                   F   ^  \ rS rSrSrS\SS4U 4S jjrS\4S jrSr	U =r
$ )	AccessTokenCredentialLoaderi  z)Credential loader for OAuth access token.r   r   Nc                 :   > [         [        U ]
  " U0 UD6  Xl        g)zCreates ApplicationDefaultCredentialFileLoader instance.

Args:
  access_token: OAuth access token.
  *args: additional arguments to apply to base class.
  **kwargs: additional keyword arguments to apply to base class.
N)rF   r   r?   _access_token)r   r   r~   r   rI   s       r   r?   $AccessTokenCredentialLoader.__init__  s      

%t5tFvF%r   c                 |    [         R                  R                  U R                  [        R
                  " 5       5      $ r   )r7   rp   AccessTokenCredentialsr   r   r   r   s    r   r   !AccessTokenCredentialLoader._Load  s/    ""99M??A r   )r   r   rk   s   @r   r   r     s+    1	&3 	&D 	&0  r   r   r   c                     [         R                  (       a-  [        R                  " S5        [	        [         R                  S9$ [         R
                  (       a  [        R                  " S[         R
                  15        [         R                  (       d  [        R                  " S5      e[         R                  (       a[  [        R                  " S5        [        [         R                  S[         R
                  [         R                  [         R                  S9$ [        R                  " S5      e[         R                  (       ah  [        R                  " S	5        [         R                  (       d  [        R                  " S
5      e[        [         R                  S[         R                  S9$ [        R                  " S5      e)z9Returns a CredentialsLoader based on user-supplied flags.z,Loading credentials using oauth_access_token)r   z-Loading credentials using service_account: %szZThe flag --service_account_credential_file must be specified if --service_account is used.z:Loading credentials using service_account_private_key_fileT)r+   r,   rw   rx   ry   zYService account authorization requires --service_account_private_key_file flag to be set.z=Loading credentials using application_default_credential_filez^The flag --credential_file must be specified if --application_default_credential_file is used.)r+   r,   r   z4bq.py should not be invoked. Use bq command instead.)FLAGSoauth_access_tokenr/   r0   r   rw   service_account_credential_filer   rr    service_account_private_key_fileru   $service_account_private_key_password#application_default_credential_filer   r   r    r   r   _GetCredentialsLoaderFromFlagsr     sH   
 LL?@&E4L4LMM
LL7%:O:O9P 00NN*  --llOP/ % E E//::==  ..	= 
 ..LLG   NN;  2#33AA 
 	<	> >r   c                  D   [         R                  (       a>  [        R                  " S5        [        R
                  R                  R                  5       $ [        5       n U R                  5       n[        U5      [        R                  R                  :X  a  [        U5      nU$ )z1Returns credentials based on user-supplied flags.z1Loading credentials using use_gce_service_account)r   use_gce_service_accountr/   r0   r7   r8   gceAppAssertionCredentialsr   r   r   rp   OAuth2Credentials_GetReauthCredentials)loaderr   s     r   r^   r^   P  sx     ""LLDE ##''??AA *+&+ 
+*11CCC'4K	r   c                 T    [         R                  " U 5      nU R                  Ul        U$ r   )r   from_OAuth2Credentialsstore)oauth2_credsreauth_credss     r   r   r   e  s-     -CC, $)),	r   )r   z4CachedCredentialLoader | AccessTokenCredentialLoader)r   z)oauth2client_4_0.client.OAuth2Credentialsr   r   )3r%   argparser   r/   rL   rc   typingr   r   r   abslr   r   google_reauth.reauth_credsr   httplib2r7   oauth2client_4_0.contriboauth2client_4_0.contrib.gce2oauth2client_4_0.contrib.multiprocess_file_storageoauth2client_4_0.file oauth2client_4_0.service_accountoauth2client_4_0.toolsrequestsbq_auth_flagsr4   rU   authr	   r   r
   r   r   rV   rp   r   r&   r8   r   r   CredentialsFromFlagsUnionTypeobjectr   r)   rm   ru   r   r   r   r^   r   r    r   r   <module>r      s7   :    	 
 ( (   B    # 9  '      '    	 $**224  !&  88:! 
 v 
 e- eP
>%; 
>")G "N/)-C /)d"2 (.>:.>b!> *="r   