
    :                     F   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSKJ	r	  SS	K
Jr  SS
K
Jr  SSK
Jr  SSK
Jr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr   SSK!J"r"  SSK#J$r$  SSK%J&r&  SSK'J(r(  SSK'J)r)  SSK*J+r+  Sr,Sr-Sr.S r/S!r0S"r1\,\-Re                  S#5      -   \.Re                  S#5      -   S$-   r3S%S#Ri                  \/\0-   \1-   /5      -   r5\" \3\55      r6\" \-\05      r7\" \,\/5      r8\" \.\15      r9 " S& S'\5      r:g)(zFImplementation of default object acl command for Google Cloud Storage.    )absolute_import)print_function)division)unicode_literalsN)gcs_json_api)metrics)AccessDeniedException)BadRequestException)Preconditions)ServiceException)Command)SetAclExceptionHandler)SetAclFuncWrapper)CommandArgument)ApiSelector)CommandException)CreateHelpText)StorageUrlFromString)UrlsAreForSingleProvider)storage_v1_messages)
acl_helper)NO_MAX)Retry)GcloudStorageFlag)GcloudStorageMap)PRIVATE_DEFAULT_OBJ_ACLzJ
  gsutil defacl set (<file-path>|<predefined-acl>) gs://<bucket_name>...
z(
  gsutil defacl get gs://<bucket_name>
zF
  gsutil defacl ch [-f] -u|-g|-d|-p <grant>... gs://<bucket_name>...
a[  
<B>SET</B>
  The ``defacl set`` command sets default object ACLs for the specified
  buckets. If you specify a default object ACL for a certain bucket, Cloud
  Storage applies the default object ACL to all new objects uploaded to that
  bucket, unless an ACL for that object is separately specified during upload.

  Similar to the ``acl set`` command, the ``defacl set`` command specifies either
  a predefined ACL or the path to a file that contains ACL text. See "gsutil help
  acl" for examples of editing and setting ACLs via the acl command. See
  `Predefined ACLs
  <https://cloud.google.com/storage/docs/access-control/lists#predefined-acl>`_
  for a list of predefined ACLs.

  Setting a default object ACL on a bucket provides a convenient way to ensure
  newly uploaded objects have a specific ACL. If you don't set the bucket's
  default object ACL, it will default to project-private. If you then upload
  objects that need a different ACL, you will need to perform a separate ACL
  update operation for each object. Depending on how many objects require
  updates, this could be very time-consuming.
z{
<B>GET</B>
  Gets the default ACL text for a bucket, which you can save and edit
  for use with the "defacl set" command.
a  
<B>CH</B>
  The "defacl ch" (or "defacl change") command updates the default object
  access control list for a bucket. The syntax is shared with the "acl ch"
  command, so see the "CH" section of "gsutil help acl" for the full help
  description.

<B>CH EXAMPLES</B>
  Grant anyone on the internet READ access by default to any object created
  in the bucket example-bucket:

    gsutil defacl ch -u AllUsers:R gs://example-bucket

  NOTE: By default, publicly readable objects are served with a Cache-Control
  header allowing such objects to be cached for 3600 seconds. If you need to
  ensure that updates become visible immediately, you should set a
  Cache-Control header of "Cache-Control:private, max-age=0, no-transform" on
  such objects. For help doing this, see "gsutil help setmeta".

  Add the user john.doe@example.com to the default object ACL on bucket
  example-bucket with READ access:

    gsutil defacl ch -u john.doe@example.com:READ gs://example-bucket

  Add the group admins@example.com to the default object ACL on bucket
  example-bucket with OWNER access:

    gsutil defacl ch -g admins@example.com:O gs://example-bucket

  Remove the group admins@example.com from the default object ACL on bucket
  example-bucket:

    gsutil defacl ch -d admins@example.com gs://example-bucket

  Add the owners of project example-project-123 to the default object ACL on
  bucket example-bucket with READ access:

    gsutil defacl ch -p owners-example-project-123:R gs://example-bucket

  NOTE: You can replace 'owners' with 'viewers' or 'editors' to grant access
  to a project's viewers/editors respectively.

<B>CH OPTIONS</B>
  The "ch" sub-command has the following options

  -d          Remove all roles associated with the matching entity.

  -f          Normally gsutil stops at the first error. The -f option causes
              it to continue when it encounters errors. With this option the
              gsutil exit status will be 0 even if some ACLs couldn't be
              changed.

  -g          Add or modify a group entity's role.

  -p          Add or modify a project viewers/editors/owners role.

  -u          Add or modify a user entity's role.

z

z.
  The defacl command has three sub-commands:
c                     ^  \ rS rSrSr\R                  " S/ SQ\S\SSSS\	R                  \	R                  /\	R                  \R                  " 5       \R                  " 5       /\R                  " S5      /\R                  " 5       /S	.S
9r\R"                  " S/ SQSS\\\\S.S9rU 4S jrS rS rS rS r\" \SSS9S 5       rS rS r Sr!U =r"$ )DefAclCommand   z(Implementation of gsutil defacl command.defacl)	setdefacl	getdefaclchdefacl   z	fg:u:d:p:F   )setgetch)command_name_aliasesusage_synopsismin_argsmax_argssupported_sub_argsfile_url_okprovider_url_okurls_start_arggs_api_supportgs_default_apiargparse_arguments)zdefault aclr"   r#   r$   command_helpz*Get, set, or change default ACL on buckets)r(   r'   r)   )	help_namehelp_name_aliases	help_typehelp_one_line_summary	help_textsubcommand_help_textc           
        > U R                   R                  S5      nUS:X  a  [        / SQ0 S9nGOUS:X  a  U R                   R                  S5      n[        R                  R                  U5      (       a  [        SSSS	U-   /0 S9nOU[        R                  ;   a  [        R                  U   nOUn[        SSSS
U-   /0 S9nOzUS:X  at  U R                  5         [        R                  " U R                  5      U l        [        / SQ[        S5      [        S5      [        S5      [        S5      [        S5      S.S9n[        TU ]9  W5      $ )Nr   r(   )storagebucketsdescribez,--format=multi(defaultObjectAcl:format=json)z--raw)gcloud_commandflag_mapr'   r=   r>   updatez--default-object-acl-file=z --predefined-default-object-acl=r)   )r=   r>   rB   z--add-default-object-acl-grantz!--remove-default-object-acl-grantz--continue-on-error)-g-p-u-dz-f)argspopr   ospathisfiler   +FULL_PREDEFINED_ACL_XML_TO_JSON_TRANSLATIONParseSubOptsr   translate_sub_opts_for_shimsub_optsr   superget_gcloud_storage_args)selfsub_commandgcloud_storage_mapacl_file_or_predefined_aclpredefined_acl	__class__s        (platform/gsutil/gslib/commands/defacl.pyrQ   %DefAclCommand.get_gcloud_storage_args   s^   ))--"Ke+  
	#'99==#3 
''..3
4
4-9h,/II 
 &DDF FF,.  6.-9h2^C 
 
	
 <<T]]Kdm+9%&FG%&FG%&FG%&IJ%&;< 7*+=>>    c                     U R                   (       d  U R                  5         U R                   S   R                  5       S:X  d  U R                  S:X  a  gg)Nr   r'   r"   r&   )rG   $RaiseWrongNumberOfArgumentsExceptionlowercommand_alias_usedrR   s    rX   _CalculateUrlsStartArg$DefAclCommand._CalculateUrlsStartArg   sB    99
//1		!%;.rZ   c                     [        U R                  S   5      R                  5       (       d  [        SU R                  -  5      e U R                  [        [        5        g ! [         a    U R                  5         e f = f)N)URL must name a bucket for the %s command)
r   rG   IsBucketr   command_nameSetAclCommandHelperr   r   r	   _WarnServiceAccountsr_   s    rX   
_SetDefAclDefAclCommand._SetDefAcl  sq    		".7799H!../ 0 0
02HI  
!s   A   A<c                     [        U R                  S   5      R                  5       (       d  [        SU R                  -  5      eU R                  U R                  S   5        g )Nr   rd   )r   rG   re   r   rf   GetAndPrintAclr_   s    rX   
_GetDefAclDefAclCommand._GetDefAcl  sR    		!-6688H!../ 0 0		!%rZ   c                    SU l         / U l        U R                  (       Ga2  U R                   GH!  u  pUS:X  aF  U R                  R                  [        R
                  " U[        R                  R                  S95        US:X  aF  U R                  R                  [        R
                  " U[        R                  R                  S95        US:X  aF  U R                  R                  [        R
                  " U[        R                  R                  S95        US:X  d  M  U R                  R                  [        R                  " U5      5        GM$     U R                  (       d  [        S5      e[        U R                  5      (       a&  [        U R                  S   5      R                  S	:w  a$  [        S
R!                  U R"                  5      5      e[%        5       nU R                   H`  nU R'                  U5       HH  nUR(                  R+                  5       (       d  [        S5      eUR-                  UR(                  5        MJ     Mb     U H  nU R/                  U5        M     g)zDParses options and changes default object ACLs on specified buckets.TrC   )
scope_typerE   rD   rF   zFPlease specify at least one access change with the -g, -u, or -d flagsr   gsz2The "{0}" command can only be used with gs:// URLsz5The defacl ch command can only be applied to buckets.N)parse_versionschangesrO   appendr   	AclChange
ChangeTypeGROUPUSERPROJECTAclDelr   r   rG   r   schemeformatrf   r'   WildcardIteratorstorage_urlre   addApplyAclChanges)rR   oabucket_urlsurl_argresultr~   s          rX   	_ChDefAclDefAclCommand._ChDefAcl  s   DDL}}}--$!9
,,

""11F1F1L1LMO9
,,

""11F1F1K1KLN9
,,

""11F1F1N1NOQ9
,,

j//2
3   << < = = %TYY//TYYq\*11T9
>
E
E!" " %K99))'2&!!**,, EG G**+	 3  #
;' #rZ      )triestimeout_secsc                    U R                   R                  UR                  UR                  SS/S9nUR                  nU R                  X5      S:X  a  U R                  R                  SU5        gU(       d  UR                  [        5         [        UR                  S9n[        R                  " US9nU R                   R                  UR                  UUUR                  S	/S
9  U R                  R                  SU5        g! [         a  n[!        S[#        U5      -  5      eSnAf[$         a    U R'                  5         [!        SU-  5      ef = f)z8Applies the changes in self.changes to the provided URL.defaultObjectAclmetageneration)providerfieldsr   zNo changes to %sN)meta_gen_match)r   id)preconditionsr   r   zUpdated default ACL on %sz$Received bad request from server: %szTFailed to set acl for %s. Please ensure you have OWNER-role access to this resource.)
gsutil_api	GetBucketbucket_namer{   r   $_ApplyAclChangesAndReturnChangeCountloggerinfort   r   r   r   apitools_messagesBucketPatchBucketr
   r   strr	   rh   )rR   urlbucketcurrent_aclr   bucket_metadataes          rX   r   DefAclCommand.ApplyAclChanges=  sF    __&&"$45 ' 7F ))K00BaG
kk)3/ 01J#63H3HIm)00+No
oo!!#//"10=+.::*.	 " 1
 kk2C8 NCc!fLMM  J
! CEHI J JJs   A5D 
ED$$,Ec                 n    SnU R                    H"  nX4R                  XSU R                  5      -  nM$     U$ )Nr   r!   )rs   Executer   )rR   r~   defacl_messagemodification_countchanges        rX   r   2DefAclCommand._ApplyAclChangesAndReturnChangeCounte  s?    ,,NN;+3T[[B B  rZ   c                 p   U R                   R                  S5      nU R                  SS9  SU l        SU l        US:X  a  U R
                  nODUS:X  a  U R                  nO1US;   a  U R                  nO[        SU< S	U R                  < S
35      e[        R                  " U/U R                  S9  U" 5         g)z+Command entry point for the defacl command.r   T)
check_argsFr(   r'   )r)   r   zInvalid subcommand "z
" for the z# command.
See "gsutil help defacl".)subcommandsrO   )rG   rH   rM   def_aclcontinue_on_errorrm   ri   r   r   rf   r   LogCommandParamsrO   )rR   action_subcommandfuncs      rX   
RunCommandDefAclCommand.RunCommandl  s    		a(&DL"DE!__d	e	#__d	.	.^^d/1B1BD E E
 *;)<&*mm5FrZ   )rs   r   r   rr   rO   )#__name__
__module____qualname____firstlineno____doc__r   CreateCommandSpec	_SYNOPSISr   r   XMLJSONr   MakeFileURLOrCannedACLArgument%MakeZeroOrMoreCloudBucketURLsArgumentMakeNCloudBucketURLsArgumentcommand_specHelpSpec_DETAILED_HELP_TEXT_get_help_text_set_help_text_ch_help_text	help_specrQ   r`   ri   rm   r   r   r   r   r   r   __static_attributes____classcell__)rW   s   @rX   r   r      s   0 **A$!oo{'7'78 %% <<>CCE ">>qAB FFHI,, MH#)3?j&&(P 		3%J 4%JN rZ   r   );r   
__future__r   r   r   r   rI   gslibr   r   gslib.cloud_apir	   r
   r   r   gslib.commandr   r   r   gslib.command_argumentr   gslib.cs_api_mapr   gslib.exceptionr   gslib.help_providerr   gslib.storage_urlr   r   "gslib.third_party.storage_apitoolsr   r   gslib.utilsr   gslib.utils.constantsr   gslib.utils.retry_utilr   gslib.utils.shim_utilr   r   gslib.utils.translation_helperr   _SET_SYNOPSIS_GET_SYNOPSIS_CH_SYNOPSIS_SET_DESCRIPTION_GET_DESCRIPTION_CH_DESCRIPTIONlstripr   join_DESCRIPTIONr   r   r   r   r    rZ   rX   <module>r      s&   M & %  ' 	   1 / ) , ! 0 + 2 ( , . 2 6 W " ( ( 3 2 B , 9v ]11$77  &')/0	
ii!$44FGHI %Y= /?@/?@|_=aG arZ   