
                         h   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSKrSSKrSSK	r	SSK
r
SSKrSSKrSSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK J!r!  SSK J"r"  SSK#J$r$  SSK%J&r&  SSK'J(r(  SSK'J)r)  SSK*J+r+  SSK,J-r-  SSK,J.r.  SSK,J/r/  SSK,J0r0  SSK1J2r3  SSK4J5r5  SSK6J7r7  SS K8J9r9  SS!K8J:r:  SS"K4J;r;  SS#K<J=r=  SS$K<J>r>  SS%K<J?r?  SS&K<J@r@  SS'K<JArA  SS(K<JBrB  SS)KCJDrD  SS*KEJFrF  SS+KEJGrG  S,rHS-rIS.rJS/rKS0rLS1rM\H\IR                  S25      -   \JR                  S25      -   S3-   rOS4S2R                  \K\L\M/5      -   rQ\$" \O\Q5      rR\$" \I\K5      rS\$" \H\L5      rT\$" \J\M5      rU\	R                  " S55      rWS6rXS7 rYS8 rZS9 r[S: r\S; r] " S< S=\5      r^g)>z8Implementation of IAM policy management command for GCS.    )absolute_import)print_function)division)unicode_literalsN)zip)	protojson)DecodeError)config)ArgumentException)PreconditionException)ServiceException)Command)GetFailureCount)CommandArgument)ApiSelector)CommandException)&IamChOnResourceWithConditionsException)CreateHelpText)LogCommandParams)NameExpansionIterator)SeekAheadNameExpansionIterator)PluralityCheckableIterator)GetSchemeFromUrlString)IsKnownUrlScheme)StorageUrlFromString)UrlsAreMixOfBucketsAndObjects)storage_v1_messages)	shim_util)GetCloudApiInstance)IAM_POLICY_VERSION)NO_MAX)
iam_helper)BindingStringToTuple)BindingsTuple)DeserializeBindingsTuple)IsEqualBindings)PatchBindings)SerializeBindingsTuple)Retry)GcloudStorageMap)GcloudStorageFlagz3
  gsutil iam set [-afRr] [-e <etag>] file url ...
z
  gsutil iam get url
a  
  gsutil iam ch [-fRr] binding ... url

  where each binding is of the form:

      [-d] ("user"|"serviceAccount"|"domain"|"group"):id:role[,...]
      [-d] ("allUsers"|"allAuthenticatedUsers"):role[,...]
      -d ("user"|"serviceAccount"|"domain"|"group"):id
      -d ("allUsers"|"allAuthenticatedUsers")

  NOTE: The "iam ch" command does not support changing Cloud IAM policies with
  bindings that contain conditions. As such, "iam ch" cannot be used to add
  conditions to a policy or to change the policy of a resource that already
  contains conditions. See additional details below.

  NOTE: The "gsutil iam" command does not allow you to add convenience values
  (projectOwner, projectEditor, projectViewer), but you can remove existing
  ones.

a  
<B>GET</B>
  The ``iam get`` command gets the Cloud IAM policy for a bucket or object, which you
  can save and edit for use with the ``iam set`` command.

  The following examples save the bucket or object's Cloud IAM policy to a text file:

    gsutil iam get gs://example > bucket_iam.txt
    gsutil iam get gs://example/important.txt > object_iam.txt

  The Cloud IAM policy returned by ``iam get`` includes an etag. The etag is used in the
  precondition check for ``iam set`` unless you override it using
  ``iam set -e``.
a  
<B>SET</B>
  The ``iam set`` command sets a Cloud IAM policy on one or more buckets or objects,
  replacing the existing policy on those buckets or objects. For an example of the correct
  formatting for a Cloud IAM policy, see the output of the ``iam get`` command.

  You can use the ``iam ch`` command to edit an existing policy, even in the
  presence of concurrent updates. You can also edit the policy concurrently using
  the ``-e`` flag to override the Cloud IAM policy's etag. Specifying ``-e`` with an
  empty string (i.e. ``gsutil iam set -e '' ...``) instructs gsutil to skip the precondition
  check when setting the Cloud IAM policy.

  When you set a Cloud IAM policy on a large number of objects, you should use the
  gsutil ``-m`` option for concurrent processing. The following command
  applies ``iam.txt`` to all objects in the ``dogs`` bucket:

    gsutil -m iam set -r iam.txt gs://dogs

  Note that only object-level operations are parallelized; setting a Cloud IAM policy
  on a large number of buckets with the ``-m`` flag does not improve performance.

<B>SET OPTIONS</B>
  The ``set`` sub-command has the following options:

  -R, -r      Performs ``iam set`` recursively on all objects under the
              specified bucket.

              This flag can only be set if the policy exclusively uses
              ``roles/storage.legacyObjectReader`` or ``roles/storage.legacyObjectOwner``.
              This flag cannot be used if the bucket is configured
              for uniform bucket-level access.

  -a          Performs ``iam set`` on all object versions.

  -e <etag>   Performs the precondition check on each object with the
              specified etag before setting the policy. You can retrieve the policy's
              etag using ``iam get``.

  -f          The default gsutil error-handling mode is fail-fast. This flag
              changes the request to fail-silent mode. This option is implicitly
              set when you use the gsutil ``-m`` option.
av
  
<B>CH</B>
  The ``iam ch`` command incrementally updates Cloud IAM policies. You can specify
  multiple access grants or removals in a single command. The access changes are
  applied as a batch to each url in the order in which they appear in the command
  line arguments. Each access change specifies a principal and a role that
  is either granted or revoked.

  You can use gsutil ``-m`` to handle object-level operations in parallel.

  NOTE: The ``iam ch`` command cannot be used to change the Cloud IAM policy of a
  resource that contains conditions in its policy bindings. Attempts to do so
  result in an error. To change the Cloud IAM policy of such a resource, you can
  perform a read-modify-write operation by saving the policy to a file using
  ``iam get``, editing the file, and setting the updated policy using
  ``iam set``.

<B>CH EXAMPLES</B>
  Examples for the ``ch`` sub-command:

  To grant a single role to a single principal for some targets:

    gsutil iam ch user:john.doe@example.com:objectCreator gs://ex-bucket

  To make a bucket's objects publicly readable:

    gsutil iam ch allUsers:objectViewer gs://ex-bucket

  To grant multiple bindings to a bucket:

    gsutil iam ch user:john.doe@example.com:objectCreator \
                  domain:www.my-domain.org:objectViewer gs://ex-bucket

  To specify more than one role for a particular principal:

    gsutil iam ch user:john.doe@example.com:objectCreator,objectViewer \
                  gs://ex-bucket

  To specify a custom role for a particular principal:

    gsutil iam ch user:john.doe@example.com:roles/customRoleName gs://ex-bucket

  To apply a grant and simultaneously remove a binding to a bucket:

    gsutil iam ch -d group:readers@example.com:legacyBucketReader \
                  group:viewers@example.com:objectViewer gs://ex-bucket

  To remove a user from all roles on a bucket:

    gsutil iam ch -d user:john.doe@example.com gs://ex-bucket

<B>CH OPTIONS</B>
  The ``ch`` sub-command has the following options:

  -d          Removes roles granted to the specified principal.

  -R, -r      Performs ``iam ch`` recursively to all objects under the
              specified bucket.

              This flag can only be set if the policy exclusively uses
              ``roles/storage.legacyObjectReader`` or ``roles/storage.legacyObjectOwner``.
              This flag cannot be used if the bucket is configured
              for uniform bucket-level access.

  -f          The default gsutil error-handling mode is fail-fast. This flag
              changes the request to fail-silent mode. This is implicitly
              set when you invoke the gsutil ``-m`` option.

z

a7  
  Cloud Identity and Access Management (Cloud IAM) allows you to control who has
  access to the resources in your Google Cloud project. For more information,
  see `Cloud Identity and Access Management
  <https://cloud.google.com/storage/docs/access-control/iam>`_.

  The iam command has three sub-commands:
z[a-z]+://.+zTo change the IAM policy of a resource that has bindings containing conditions, perform a read-modify-write operation using "iam get" and "iam set".c                 J    [        U 5      (       a  U(       d  [        S5      eg g )Nz/Cannot operate on a mix of buckets and objects.)r   r   )urlsrecursion_requesteds     %platform/gsutil/gslib/commands/iam.py*_RaiseErrorIfUrlsAreMixOfBucketsAndObjectsr1      s%    "4((1D
L
MM 2E(    c           	      ~    Uu  p4U R                  UR                  U Vs/ s H  n[        U5      PM     snUS9$ s  snf Nthread_state)PatchIamHelperexpanded_storage_urlr%   )clsiter_resultr6   serialized_bindings_tuplesexpansion_resultts         r0   _PatchIamWrapperr>     sO    3>0			++,FG,Fq",FG	 
 
! ! Hs   :
c                     Uu  p4U R                  UR                  [        R                  " [        R
                  U5      US9$ r4   )SetIamHelperr8   r   decode_messageapitools_messagesPolicy)r9   r:   r6   serialized_policyr<   s        r0   _SetIamWrapperrE     sG    *5'			++0779JK	 
 
! !r2   c                 L    U R                   R                  [        U5      5        g Nloggererrorstrr9   es     r0   _SetIamExceptionHandlerrN         **3q6r2   c                 L    U R                   R                  [        U5      5        g rG   rH   rL   s     r0   _PatchIamExceptionHandlerrQ     rO   r2   c                     ^  \ rS rSrSr\R                  " S\S\SSSS\	R                  /\	R                  \R                  " S5      /\R                  " S5      \R                  " 5       /\R                  " 5       \R                  " 5       /S	.S
9r\R"                  " S/ SS\\\\S	.S9rS rU 4S jrS rS rS!S jrU 4S jrS!S jrS!S jrS!S jrS!S jr S!S jr!\"" \#SSS9 S!S j5       r$S r%S r&S r'S r(U =r)$ )"
IamCommandi  z%Implementation of gsutil iam command.iam   zafRrd:e:TF   )getsetch)
usage_synopsismin_argsmax_argssupported_sub_argsfile_url_okprovider_url_okurls_start_arggs_api_supportgs_default_apiargparse_argumentscommand_helpz9Get, set, or change bucket and/or object IAM permissions.)	help_namehelp_name_aliases	help_typehelp_one_line_summary	help_textsubcommand_help_textc                 X    U R                   (       d  US   R                  5       (       a  gg)Nr   objectsbuckets)r/   IsObject)selfurl_patternss     r0   _get_resource_typeIamCommand._get_resource_typeD  s#    <?#;#;#=#=r2   c                 f  > U R                   R                  S5      U l        U R                  S:X  a@  [        U R                   S   5      R	                  5       (       a  SnOSn[        SUSS/0 S9nGOU R                  S	:X  Ga-  [        / S
Q[        S5      [        S5      [        S5      [        S5      [        S5      [        S5      S.S9nU R                  5         U R                   SS  n[        [        [        U5      5      nSn[        U R                  5       H1  u  nu  pxUS;   a  SnM  US:X  d  M  US:X  d  M"  SU R                  U'   M3     [        XE5        U(       d  US   R	                  5       (       a  SUR                  S'   OSUR                  S'   X0R                   S S -   U l         OtU R                  S:X  ad  [        R                  " [         R"                  " SSS5      5      [        R                  R$                  L a  U R&                  R)                  S5        / $ [*        T	U ]Y  W5      $ )Nr   rW   rl   rm   storageget-iam-policy--format=json)gcloud_commandflag_maprX   )rt   Nset-iam-policyrv   z--all-versionsz--etagz--etag=z--continue-on-errorz--recursive)-a-e_empty_etag-f-R-rrV   Fr   r~   Tr{    )r|   r   rY   GSUtilhidden_shim_modenonez|The shim maps iam ch commands to several gcloud storage commands, which cannot be determined without running gcloud storage.)argspopsub_commandr   rn   r*   r+   ParseSubOptslistmap	enumeratesub_optsr1   rw   r   HIDDEN_SHIM_MODEr
   rW   DRY_RUNrI   warningsuperget_gcloud_storage_args)
ro   command_groupgcloud_storage_mapurl_stringsurl_objectsrecurseiflag_key
flag_value	__class__s
            r0   r   "IamCommand.get_gcloud_storage_argsJ  s   yy}}Q'D5 	diil	+	4	4	6	6!!+
]$4o< 689 
		U	"+M%&67%h/.y9%&;<%m4%m4
 IIabMk1;?@kg'0'?
#!#h|#'*"20$--
 (@ 1F	KN++--/8))!,/8))!,		"1-di			T	!		#	#
**X1
!*!;!;!C!C
D 	J	K i7*+=>>r2   c                     UR                  5       (       aQ  SUR                  -  n[        UR                  5      R                  [        S5      5      (       a  US-  n[	        U5      eg )NzInvalid Cloud URL "%s".z-Rrfzz This resource handle looks like a flag, which must appear before all bindings. See "gsutil help iam ch" for more details.)	IsFileUrlobject_namerX   issubsetr   )ro   url	error_msgs      r0   _RaiseIfInvalidUrlIamCommand._RaiseIfInvalidUrl  s\    
}}+coo=i	S__		&	&s6{	3	3O	P	 Y'' r2   c           	      :   SU l         SU l        / nU R                  (       aV  U R                   HF  u  p#US;   a	  SU l        M  US:X  a	  SU l         M#  US:X  d  M+  UR                  [	        SU5      5        MH     / n[        U R                  5      nU H  n[        R                  U5      (       a,  [        [        U5      5      (       a  UR                  U5          OLUS:X  a'   UR                  [	        S[        U5      5      5        Mv  UR                  [	        SU5      5        M     U(       d  [        S5      eU H  nUR                  U5        M     [        [        [         U5      5      n[#        UU R                  5        X4$ ! [         a    [        S5      ef = f)NFr   Tr}   z-dz?A -d flag is missing an argument specifying bindings to remove.z"Must specify at least one binding.)continue_on_errorr/   r   appendr#   iterr   STORAGE_URI_REGEXmatchr   r   nextStopIterationr   r   r   r   r1   )ro   patch_bindings_tuplesoaurl_pattern_stringsittokenr   s           r0   _GetSettingsAndDiffsIamCommand._GetSettingsAndDiffs  s   "D$D}}--$!%)$
"$Y#'$
 $Y

&
&';E1'E
F    
diiB

!
!%
(
(
1%8
9
9""5)	$	Q

&
&';E48'L
M
 	$$%9$%FG  !ABB   '  s/1DEFK.{/3/G/GI !--!  	Q OQ Q	Qs   !$FFc           	      l   U R                  U5      u  p4[        R                  " UU R                  5       U[        R                  [        R                  SS9nUR
                  S:w  aM  U R                  (       a'  U R                  R                  UR                  5        U$ [        UR                  5      eU$ )NT)envinputstderrstdouttextr   )._get_full_gcloud_storage_execution_information
subprocessrun'_get_shim_command_environment_variablesPIPE
returncoder   rI   rJ   r   r   )ro   r   stdin_commandprocesss         r0   _run_ch_subprocessIamCommand._run_ch_subprocess  s    DDTJJAnn88:G Q			'..) N w~~..Nr2   c                   > U R                   S:w  a  [        TU ]	  5       $ U R                  5         U R	                  5       u  pU R                  U5      n/ nU R                  (       a  UR                  S5        SnU GH  nU R                  U5        US:X  ay  U R                  / SQU-   [        U5      /-   5      nUR                  (       a  SnMS  [        R                  " UR                  5      nU V	s/ s H  n	U	S   S:X  d  M  U	S	   PM     n
n	O[        U5      /n
U
 GH"  nU R                  S
USUS/5      nUR                  (       a  SnM/  [        R                  " UR                  5      n[        R                   " US   5      nU H)  u  nn[        R                   " U5      n[#        UUU5      nM+     [%        [&        R(                  " U5      5       VVs/ s H  u  nnU[%        [+        U5      5      S.PM     snnUS'   U R                  S
USUS/[        R,                  " USS9S9nUR                  (       d  GM   SnGM%     GM     U$ s  sn	f s  snnf )NrY   r   r   rl   )rt   lsz--jsonrV   typecloud_objectr   rt   ru   rv   bindingsrolemembersry   -T)	sort_keys)r   )r   r   run_gcloud_storager   r   rq   r/   r   r   r   rK   r   jsonloadsr   r"   BindingsDictToUpdateDictr'   sortedsix	iteritemsr   dumps)ro   bindings_tuplespatternsresource_typelist_settingsreturn_codeurl_pattern
ls_process	ls_outputresourcer.   r   get_processpolicyr   is_grantdiff	diff_dictrmset_processr   s                        r0   r   IamCommand.run_gcloud_storage  s[   4W')) $ 9 9 ;O++H5MM4 K
k*	)	#,,-H-:.;>A+>N=O.P Q
  +
JJz001	 &
%>1 HUO% 	 
 K !#--'7oNP!!+
K../66vj7IJ /Xt 99$?)"8YA( !0 S]]8457 6da d1g
 67z
 --'7cB**Vt4 . 6 !!!+- '  V A
*7s   2I	I$I
c                    [        XS9nUR                  5       (       a)  UR                  UR                  UR                  SS/S9nU$ UR                  UR                  UR                  UR                  UR                  SS/S9nU$ )a  Gets an IAM policy for a single, resolved bucket / object URL.

Args:
  storage_url: A CloudUrl instance with no wildcards, pointing to a
               specific bucket or object.
  thread_state: CloudApiDelegator instance which is passed from
                command.WorkerThread.__init__() if the global -m flag is
                specified. Will use self.gsutil_api if thread_state is set
                to None.

Returns:
  Policy instance.
r5   r   etag)providerfields)
generationr   r   )r   IsBucketGetBucketIamPolicybucket_nameschemeGetObjectIamPolicyr   r   )ro   storage_urlr6   
gsutil_apir   s        r0   GetIamHelperIamCommand.GetIamHelper  s     %TEJ,,

!
!%%f% - f M ,,

!
!

!
! ++%%f% - f Mr2   c                    U R                   S   n[        U R                  U5      R                  S/S95      nUR	                  5       (       a  [        SU-  5      eUR                  5       (       a  [        U< SU R                  < S35      e[        [        U5      S   R                  5      nU R                  XAS9n[        R                  " [        R                  " U5      5      n[        R                   " USS	S
S9n[#        U5        g)z,Gets IAM policy for single bucket or object.r   name)bucket_listing_fieldsz%s matched no URLsz8 matched more than one URL, which is not allowed by the z commandr5   T),z: rU   )r   
separatorsindentN)r   r   WildcardIteratorIterAllIsEmptyr   HasPluralitycommand_namer   r   
url_stringr   r   r   r   encode_messager   print)ro   r6   patternmatchesr   r   policy_json
policy_strs           r0   _GetIamIamCommand._GetIam)  s     iilG(g&..fX.NPG1G;<< 1 134 4 'tG}Q'7'B'BCK{FF**Y55f=>K	J 
*r2   c                    [        XS9nUR                  5       (       a&  UR                  UR                  UUR                  S9  gUR                  UR                  UR                  UUR                  UR                  S9  g)a$  Sets IAM policy for a single, resolved bucket / object URL.

Args:
  storage_url: A CloudUrl instance with no wildcards, pointing to a
               specific bucket or object.
  policy: A Policy object to set on the bucket / object.
  thread_state: CloudApiDelegator instance which is passed from
                command.WorkerThread.__init__() if the -m flag is
                specified. Will use self.gsutil_api if thread_state is set
                to None.

Raises:
  ServiceException passed from the API call if an HTTP error was returned.
r5   )r   )r   r   N)r   r   SetBucketIamPolicyr   r   SetObjectIamPolicyr   r   )ro   r   r   r6   r   s        r0   _SetIamHelperInternal IamCommand._SetIamHelperInternalB  s    ( %TEJ##K$;$;$*-8-?-? $ A ##K$;$;$/$;$;$*/:/E/E-8-?-?	 $ Ar2   c                 x     U R                  XUS9  g! [         a    U R                  (       a	  SU l         ge f = f)zDHandles the potential exception raised by the internal set function.r5   FN)r  r   r   everything_set_okay)ro   r   r   r6   s       r0   r@   IamCommand.SetIamHelperc  s=    
  < P 			#( 	s    "99c                 P    U R                  UUUS9  g! [         a    U R                  (       a	  SU l         ge [         ac  nU R                  (       a8  SU l        SU l        U R                  R                  UR                  5         SnAg[        UR                  5      eSnAff = f)a  Patches an IAM policy for a single, resolved bucket / object URL.

The patch is applied by altering the policy from an IAM get request, and
setting the new IAM with the specified etag. Because concurrent IAM set
requests may alter the etag, we may need to retry this operation several
times before success.

Args:
  storage_url: A CloudUrl instance with no wildcards, pointing to a
               specific bucket or object.
  bindings_tuples: A list of BindingsTuple instances.
  thread_state: CloudApiDelegator instance which is passed from
                command.WorkerThread.__init__() if the -m flag is
                specified. Will use self.gsutil_api if thread_state is set
                to None.
r5   FTN)
_PatchIamHelperInternalr   r   r  r   $tried_ch_on_resource_with_conditionsrI   debugmessager   )ro   r   r   r6   rM   s        r0   r7   IamCommand.PatchIamHelperm  s    "*
"";#20< # >  			#( 1 *			#( 481!))$$qyy))*s!    "B%
B%AB B  B%   g      ?)triestimeout_secsc                    U R                  XS9nUR                  UR                  peU HX  nUR                  (       d  M  SU-  nUS-  nUSR	                  [
        R                  " S[        -  5      5      -  n[        U5      e   [        U5      n	U H  u  p[        R                  " U5      n[        R                  " U5      n[        XU
5      n[        R                  " U5       VVs/ s H-  u  nn[        R                   R#                  U[        U5      S9PM/     nnnM     [%        Xi5      (       a  U R&                  R)                  SU5        g [        R                   " XeS9nU R+                  XUS9  g s  snnf )Nr5   z"Could not patch IAM policy for %s.r,   zfThe resource had conditions present in its IAM policy bindings, which is not supported by "iam ch". %sr   zNo changes made to %s)r   r   )r   r   r   	conditionjointextwrapwrap IAM_CH_CONDITIONS_WORKAROUND_MSGr   r   r"   BindingsMessageToUpdateDictr'   r   r   rB   rC   BindingsValueListEntryr&   rI   infor  )ro   r   r   r6   r   r   r   bindingr  orig_bindingsr   r   bindings_dictr   new_bindings_dictr   r   s                    r0   r  "IamCommand._PatchIamHelperInternal  st    {FFV__8
 				6D4499MM90123 	3
 5W==  NM+ <<XFm88>i'(K &78 9fq! 
"
"
9
9qBFq' : K8  h	 , x//
kk.<%%xCF
 	{Ns   (4E5c                    U R                  5       u  p/ nU H]  u  pE/ nU H8  n[        R                  R                  US   US   S9nUR	                  U5        M:     UR	                  [        XFS95        M_     SU l        SU l        / n	U H|  n
 U
R                  5       (       aH  U R                  (       a$  SU
l
        U	R	                  U
R                  5        MN  U R                  X5        Ma  U	R	                  U
R                  5        M~     U	(       Ga3  [        U R                   U R"                  U R$                  U R&                  U	U R                  U R(                  U R*                  =(       d    U R,                  S/S	9	n[/        U R                   U R"                  U R1                  5       U	U R                  U R(                  S
9n[2        R4                  " U Vs/ s H  n[7        U5      PM     sn5      nU R9                  [:        [=        X5      [>        U R*                  (       + US9  U =R                  [A        5       S:  + -  sl        U R                  (       dR  SnU R                  (       a4  US-  nUSRC                  [D        RF                  " S[H        -  5      5      -  n[K        U5      eg ! [         a    U R                  U
5         GM>  f = fs  snf )Nr   r   )r   r   )r   r   TF*r   all_versionsr   r   r.  fail_on_errorseek_ahead_iteratorr   z'Some IAM policies could not be patched.r,   zjSome resources had conditions present in their IAM policy bindings, which is not supported by "iam ch". %s)&r   rB   rC   r$  r   r$   r  r  r   r/   objectr  r7   AttributeErrorr   r   r  r  rI   r   r.  r   parallel_operationsr   GetSeekAheadGsutilApi	itertoolsrepeatr(   Applyr>   r   rQ   r   r  r   r!  r"  r   )ro   raw_bindings_tuplesrp   r   r   r   bindings_messagesr&  bindings_messagethreaded_wildcardssurlname_expansion_iteratorr2  r=   serialized_bindings_tuples_itmsgs                   r0   	_PatchIamIamCommand._PatchIam  s   (,(A(A(C%1',33JJI&WV_ K >  !12  ""

FH 2  $D05D-
&==??%%DK%%doo6<

#
#DOO
4   5



**
++
//


"
"(( 22Nd6N6N!'	!* ;



**

$
$
&


"
"((* '0&6&6.C
D.C!!$.C
D'F#
jj!2L*#'#9#99%8	  : o&7!";; ##5c		2	2ttyyMMC1345 	5
 S!! $E  &%%&0 Es%   AJ)J)+J)K)K	K	c                     SU l         SU l        SU l        SnSnU R                  (       ag  U R                   HW  u  p4US;   a	  SU l        M  US:X  a	  SU l         M#  US:X  a	  SU l        M2  US:X  a  [	        U5      nSnMG  U R                  5         MY     U R                  S   nU R                  S	S
 n [        US5       n[        R                  " UR                  5       5      nS
S
S
5        WR!                  S/ 5      n
U(       d  UR!                  SS5      n[        R"                  " U
U[$        S.5      n [&        R(                  " [*        R,                  U5      nSU l        / n[3        [5        [6        U5      5      n[9        XR                  5        U H  n[;        UR<                  5        UR?                  5       (       aH  U R                  (       a$  SUl         URC                  UR<                  5        Mb  U RE                  X5        Mu  URC                  UR<                  5        M     U(       Ga.  [G        U RH                  U R                  U R                  U RJ                  UU R                  U R                  U R                   =(       d    U RL                  S/S9	n[O        U RH                  U R                  U RQ                  5       UU R                  U R                  S9n[R        RT                  " [&        RV                  " U5      5      nU RY                  [Z        []        UU5      [^        U R                   (       + US9  U =R0                  [a        5       S:  + -  sl        U R0                  (       d  [c        S5      eg
! , (       d  f       GN= f! [         a    [        SU-  5      e[         a/  n	U R                  R                  SU	5        [        SU-  5      eS
n	A	ff = f! [.         a    [        SU< SU< S35      ef = f)z7Set IAM policy for given wildcards on the command line.Fr   r   Tr}   rz   r{   r   rV   Nr   z.Specified IAM policy file "%s" does not exist.z'Invalid IAM policy file, ValueError:
%szInvalid IAM policy file "%s".r   r   )r   r   versionzInvalid IAM policy file "z" or etag "z".r,  r   r-  r/  r0  z#Some IAM policies could not be set.)2r   r/   r.  r   rK   RaiseInvalidArgumentExceptionr   openr   r   readIOErrorr   
ValueErrorrI   r  rW   r   r    r   rA   rB   rC   r	   r  r   r   r   r1   r  r  r   r   r   r@   r   r  r   r5  r   r6  r7  r8  r  r9  rE   r   rN   r   r   )ro   
force_etagr   r   argfile_urlr   fpr   rM   r   r  r=  surlsr>  r?  r2  	policy_its                     r0   _SetIamIamCommand._SetIam  sp    #D$DDJD}}MM&!%)$
"$Y#'$
 $Y"$
$YS$*

,
,
. " yy|Hyy}HJ#"BGGI&  zz*b)HZZ#d**% K
0''(9(@(@+Nf
  $D )845E.u6N6NODOO	## $


#
#DOO
4


D
)!!$//2 "  5



**
++
//


"
"(( 22Nd6N6N!'	!* ;



**

$
$
&


"
"((* ""9#;#;F#CDi
jjY 78(#'#9#99%8	  : o&7!";; ##BCC $_  (N&' ( ( J
kkBAF=HIIJ  0'/ 0 00sB   1N =%M9"N 4%O 9
NN N !O,*OOO=c                    U R                   R                  S5      nU R                  SS9  [        U R                  S9  SU l        US:X  a  [        U/S9  U R                  5         gUS:X  a  [        U/S9  U R                  5         gUS	:X  a  [        U/S9  U R                  5         g[        S
U< SU R                  < S35      e)z(Command entry point for the acl command.r   T)
check_args)r   FrW   )subcommandsrX   rY   zInvalid subcommand "z
" for the z  command.
See "gsutil help iam".)r   r   r   r   r   def_aclr
  rQ  rB  r   r  )ro   action_subcommands     r0   
RunCommandIamCommand.RunCommandv  s    		a(& dmm,DLE!$5#67
lln  
e	#$5#67
lln  
d	"$5#67
nn 	 /1B1BD E Er2   )r.  r   r   rV  r  r/   r   r  rG   )*__name__
__module____qualname____firstlineno____doc__r   CreateCommandSpec	_SYNOPSISr!   r   JSONr   MakeNCloudURLsArgumentMakeNFileURLsArgumentMakeZeroOrMoreCloudURLsArgumentMakeOneOrMoreBindingsArgumentcommand_specHelpSpec_DETAILED_HELP_TEXT_get_help_text_set_help_text_ch_help_text	help_specrq   r   r   r   r   r   r   r
  r  r@   r7   r)   r   r  rB  rQ  rX  __static_attributes____classcell__)r   s   @r0   rS   rS     sC   -**#!&&' %%!88;=33A6==?
 ;;===?
,0 
E#)6?p(/.b$8tB2AB *D 		ac: ,0-O ;-O^E"RlD\ r2   rS   )_r^  
__future__r   r   r   r   r7  r   osrer   r   r   	six.movesr   apitools.base.protorpcliter   #apitools.base.protorpclite.messagesr	   botor
   gslib.cloud_apir   r   r   gslib.commandr   r   gslib.command_argumentr   gslib.cs_api_mapr   gslib.exceptionr   r   gslib.help_providerr   gslib.metricsr   gslib.name_expansionr   r   "gslib.plurality_checkable_iteratorr   gslib.storage_urlr   r   r   r   "gslib.third_party.storage_apitoolsr   rB   gslib.utilsr   gslib.utils.cloud_api_helperr   gslib.utils.constantsr    r!   r"   gslib.utils.iam_helperr#   r$   r%   r&   r'   r(   gslib.utils.retry_utilr)   gslib.utils.shim_utilr*   r+   _SET_SYNOPSIS_GET_SYNOPSIS_CH_SYNOPSIS_GET_DESCRIPTION_SET_DESCRIPTION_CH_DESCRIPTIONlstripr`  r  _DESCRIPTIONrh  ri  rj  rk  compiler   r"  r1   r>   rE   rN   rQ   rS    r2   r0   <module>r     s   ? & %  '   	 	   
  0 ;  - 1 , ! ) 2 ( , B . * 6 ? I 4 . 2 ; W ! < 4 ( " 7 0 ; 2 0 9 ( 2 3* ) VCJ ]11$77  &')/0	 ii!#3_EFG %Y= /?@/?@|_=JJ~.  !N
!!p	 p	r2   