
    s                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSKrSSKJr  SSKJ	r	  SS	KJ
r
  SSKrSSKrSSKrSSKrSSKrSS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJ r   SSK!J"r"  SSK!J#r#  SSK$J%r%  SSK&J'r'  SSK(J)r)J*r*  SSK+J,r,J-r-J.r.   SSK/J0r0  SSK/J1r1  SSK/J2r2  SSK/J3r3  Sr4 SSK6J7r7  SS K8J9r9  SS!K:J;r;  SS"K<J=r=  SS#K>J?r?  Sr@S%rB\	" S&S'9rC\	" S(S)9rDS*rES+\E-   S,-   rFS- rGS. rH    S4S/ jrIS0 rJS5S1 jrK " S2 S3\5      rLg! \5 a    Sr1Sr2Sr4Sr0 Nlf = f! \5 a    Sr@S$rA N[f = f)6zpImplementation of URL Signing workflow.

see: https://cloud.google.com/storage/docs/access-control#Signed-URLs)
    )absolute_import)print_function)division)unicode_literalsN)datetime)	timedelta)timezone)urllib)	HttpError)MakeRequest)Request)config)Command)CommandArgument)ApiSelector)CommandException)ContainsWildcard)StorageUrlFromString)	constants)
GetNewHttp)GcloudStorageMapGcloudStorageFlag)CreatePayloadGetFinalUrlto_bytes)FILETYPE_PEM)load_privatekey)sign)PKeyTF)hashes)padding)RSAPrivateKey)pkcs12)NameOIDzapyca/cryptography is not available. Either install it, or please consider using the .json keyfileauto   days   hoursz
  gsutil signurl [-c <content_type>] [-d <duration>] [-m <http_method>] \
      [-p <password>] [-r <region>] [-b <project>]  (-u | <private-key-file>) \
      (gs://<bucket_name> | gs://<bucket_name>/<object_name>)...
z
<B>SYNOPSIS</B>
aG  


<B>DESCRIPTION</B>
  The signurl command will generate a signed URL that embeds authentication data
  so the URL can be used by someone who does not have a Google account. Please
  see the `Signed URLs documentation
  <https://cloud.google.com/storage/docs/access-control/signed-urls>`_ for
  background about signed URLs.

  Multiple gs:// URLs may be provided and may contain wildcards. A signed URL
  will be produced for each provided URL, authorized
  for the specified HTTP method and valid for the given duration.

  NOTE: Unlike the gsutil ls command, the signurl command does not support
  operations on sub-directories. For example, unless you have an object named
  ``some-directory/`` stored inside the bucket ``some-bucket``, the following
  command returns an error: ``gsutil signurl <private-key-file> gs://some-bucket/some-directory/``

  The signurl command uses the private key for a service account (the
  '<private-key-file>' argument) to generate the cryptographic
  signature for the generated URL. The private key file must be in PKCS12
  or JSON format. If the private key is encrypted the signed URL command will
  prompt for the passphrase used to protect the private key file
  (default 'notasecret'). For more information regarding generating a private
  key for use with the signurl command please see the `Authentication
  documentation.
  <https://cloud.google.com/storage/docs/authentication#generating-a-private-key>`_

  If you used `service account credentials
  <https://cloud.google.com/storage/docs/gsutil/addlhelp/CredentialTypesSupportingVariousUseCases#supported-credential-types_1>`_
  for authentication, you can replace the  <private-key-file> argument with
  the -u or --use-service-account option to use the system-managed private key
  directly. This avoids the need to store a private key file locally, but
  prior to using this flag you must `configure
  <https://cloud.google.com/sdk/gcloud/reference/auth/activate-service-account>`_
  ``gcloud`` to use your service account credentials.

<B>OPTIONS</B>
  -b <project>  Allows you to specify a user project that will be billed for
                requests that use the signed URL. This is useful for generating
                presigned links for buckets that use requester pays.

                Note that it's not valid to specify both the ``-b`` and
                ``--use-service-account`` options together.

  -c            Specifies the content type for which the signed URL is
                valid for.

  -d            Specifies the duration that the signed URL should be valid
                for, default duration is 1 hour.

                Times may be specified with no suffix (default hours), or
                with s = seconds, m = minutes, h = hours, d = days.

                This option may be specified multiple times, in which case
                the duration the link remains valid is the sum of all the
                duration options.

                The max duration allowed is 7 days when ``private-key-file``
                is used.

                The max duration allowed is 12 hours when -u option is used.
                This limitation exists because the system-managed key used to
                sign the URL may not remain valid after 12 hours.

  -m            Specifies the HTTP method to be authorized for use
                with the signed URL, default is GET. You may also specify
                RESUMABLE to create a signed resumable upload start URL. When
                using a signed URL to start a resumable upload session, you will
                need to specify the 'x-goog-resumable:start' header in the
                request or else signature validation will fail.

  -p            Specify the private key password instead of prompting.

  -r <region>   Specifies the `region
                <https://cloud.google.com/storage/docs/locations>`_ in
                which the resources for which you are creating signed URLs are
                stored.

                Default value is 'auto' which will cause gsutil to fetch the
                region for the resource. When auto-detecting the region, the
                current gsutil user's credentials, not the credentials from the
                private-key-file, are used to fetch the bucket's metadata.

                This option must be specified and not 'auto' when generating a
                signed URL to create a bucket.

  -u            Use service account credentials instead of a private key file
                to sign the URL.

                You can also use the ``--use-service-account`` option,
                which is equivalent to ``-u``.
                Note that both options have a maximum allowed duration of
                12 hours for a valid link.



<B>USAGE</B>
  Create a signed URL for downloading an object valid for 10 minutes:

    gsutil signurl -d 10m <private-key-file> gs://<bucket>/<object>

  Create a signed URL, valid for one hour, for uploading a plain text
  file via HTTP PUT:

    gsutil signurl -m PUT -d 1h -c text/plain <private-key-file> \
        gs://<bucket>/<obj>

  To construct a signed URL that allows anyone in possession of
  the URL to PUT to the specified bucket for one day, creating
  an object of Content-Type image/jpg, run:

    gsutil signurl -m PUT -d 1d -c image/jpg <private-key-file> \
        gs://<bucket>/<obj>

  To construct a signed URL that allows anyone in possession of
  the URL to POST a resumable upload to the specified bucket for one day,
  creating an object of Content-Type image/jpg, run:

    gsutil signurl -m RESUMABLE -d 1d -c image/jpg <private-key-file> \
        gs://bucket/<obj>
c                  `    [         R                  " [        R                  S9R	                  SS9$ )z2Returns the current utc time as a datetime object.tzNtzinfo)r   nowr	   utcreplace     )platform/gsutil/gslib/commands/signurl.py_NowUTCr7      s#    		&	.	.d	.	;;r5   c                 8   [         R                  " SU 5      nU(       d  [        S5      eUR                  S5      u  p[	        U 5      n UR                  5       nUS:X  a  [        U S9nU$ US:X  a  [        U S9nU$ US:X  a  [        U S9nU$ US	:X  a	  [        U S
9nW$ )z>Parses the given duration and returns an equivalent timedelta.z^(\d+)([dDhHmMsS])?$zUnable to parse duration stringhdr'   r*   m)minutessseconds)rematchr   groupsintlowerr   )durationrA   modifierrets       r6   _DurationToTimeDeltarH      s     ((*H
5%	
<
==||C((](^^(_

"C 
* 3
(
#C 
* 3
H
%C 
* 3
H
%C	*r5   c                 T   [         R                  " SSS5      nSU0nUS:X  a  SnSUS'   U
(       d  UR                  S	5        U
(       a  XS
'   U(       a  UR                  UUUUUUU	UUS9	nU$ [        R
                  (       a  SnOSn[        UUUUUUU	UUUS9
u  nn[        U [        5      (       a  [        U UU5      nO\[        (       d  [        [        5      eU R                  [        U5      [        R                  " 5       [         R"                  " 5       5      n[%        UXU5      nU$ )a  Construct a string to sign with the provided key.

Args:
  key: The private key to use for signing the URL.
  api: The CloudApiDelegator instance
  use_service_account: If True, use the service account credentials
      instead of using the key file to sign the URL
  provider: Cloud storage provider to connect to.  If not present,
      class-wide default is used.
  client_id: Client ID signing this URL.
  method: The HTTP method to be used with the signed URL.
  duration: timedelta for which the constructed signed URL should be valid.
  gcs_path: String path to the bucket of object for signing, in the form
      'bucket' or 'bucket/object'.
  logger: logging.Logger for warning and debug output.
  region: Geographic region in which the requested resource resides.
  content_type: Optional Content-Type for the signed URL. HTTP requests using
      the URL must match this Content-Type.
  billing_project: Specify a user project to be billed for the request.
  string_to_sign_debug: If true AND logger is enabled for debug level,
      print string to sign to debug. Used to differentiate user's
      signed URL from the probing permissions-check signed URL.
  generation: If not None, specifies a version of an object for signing.

Returns:
  The complete URL (string).
Credentialsgs_hostzstorage.googleapis.comhost	RESUMABLEPOSTstartzx-goog-resumablezWarning: no Content-Type header was specified with the -c flag, so uploads to the resulting Signed URL must not specify a Content-Type.zcontent-type)	providermethodrE   path
generationloggerregionsigned_headersstring_to_sign_debugs
   RSA-SHA256z
RSA-SHA256)
	client_idrQ   rE   rR   rS   rT   rU   rV   billing_projectrW   )r   getwarnSignUrlsixPY2r   
isinstancer   r   HAVE_CRYPTOr   _CRYPTO_IMPORT_ERRORr   r!   PKCS1v15r    SHA256r   )keyapiuse_service_accountrP   rX   rQ   rE   gcs_pathrT   rU   content_typerY   rW   rS   rK   rV   	final_urldigeststring_to_signcanonical_query_stringraw_signatures                        r6   _GenSignedUrlrn      sC   R JJ}i1IJ'G$.{F)0N%&kk , - %1>"X#)%-!)'1#)#)+91E  GIF 
3 wwf f-:%'1
.3*N* #t37m[344hhx79I9I9KV]]_]mM724I	r5   c                 (   [        U 5      n [        U5      n[        (       d  [        [        5      e [        R
                  " X5      u  p#nUR                  R                  [        R                  5      S   R                  nX%4$ !   [        S5      e= f)Nr   z<Unable to load the keyfile, Invalid password or PKCS12 data.)r   r`   r   ra   r#   load_key_and_certificatessubjectget_attributes_for_oidr$   COMMON_NAMEvalue)
key_stringpasswdrd   certaddclient_emails         r6   _ReadKeystorerz   R  s    
#*F&	122[55jINCs<<66w7J7JKANTTL[
Y
ZZs   AB Bc                     [         R                  " [        R                  " U 5      5      nSU;  d  SU;  a  [	        S5      eUS   nU(       a  [        [        US   U5      nXC4$ [        [        US   5      nXC4$ )a  Read the client email and private key from a JSON keystore.

Assumes this keystore was downloaded from the Cloud Platform Console.
By default, JSON keystore private keys from the Cloud Platform Console
aren't encrypted so the passwd is optional as load_privatekey will
prompt for the PEM passphrase if the key is encrypted.

Arguments:
  ks_contents: JSON formatted string representing the keystore contents. Must
               be a valid JSON string and contain the fields 'private_key'
               and 'client_email'.
  passwd: Passphrase for encrypted private keys.

Returns:
  key: Parsed private key from the keystore.
  client_email: The email address for the service account.

Raises:
  ValueError: If unable to parse ks_contents or keystore is missing
              required fields.
ry   private_keyz-JSON keystore doesn't contain required fields)jsonloadsr]   
ensure_str
ValueErrorr   r   )ks_contentsrv   ksry   rd   s        r6   _ReadJSONKeystorer   _  s}    0 zz#..-."2b!8
E
FFN#,
,=(96
BC 
	 ,=(9
:C		r5   c                   D  ^  \ rS rSrSr\R                  " SSS/\S\R                  SS/S	S	S\
R                  \
R                  /\
R                  \R                  " 5       \R                  " 5       /S
9r\R"                  " SSS/SS\0 S9rU 4S jrS rS rS rS rSrU =r$ )UrlSignCommandi  z*Implementation of gsutil url_sign command.signurl	signedurl	queryauth   zm:d:b:c:p:r:uzuse-service-accountF)command_name_aliasesusage_synopsismin_argsmax_argssupported_sub_argssupported_private_argsfile_url_okprovider_url_okurls_start_arggs_api_supportgs_default_apiargparse_argumentscommand_helpzCreate a signed URL)	help_namehelp_name_aliases	help_typehelp_one_line_summary	help_textsubcommand_help_textc                   > [         R                  " U R                  5      n[         R                  " U R                  5      nSSSSU R                  S   -   /nU R                  SS  U l        S nS nS nS n[	        U R                  5       H0  u  nu  pU	S:X  a  UnM  U	S:X  a  UnM  U	S	:X  a  UnM&  U	S
:X  d  M.  UnM2     UbO  [        [        [        U R                  U   S   5      R                  5       5      5      S-   nSU4U R                  U'   Ub+  U R                  U   S   S:X  a  SU R                  U'   US/-  nUb&  U R                  U   S   nS	SU-   4U R                  U'   Ub&  U R                  U   S   nS
SU-   4U R                  U'   [        TU ])  [        U[        S5      [        S5      [        S5      [        S5      [        S5      [        S5      S.S95      nXl        X l        U$ )Nstoragezsign-urlz--format=csv[separator="\t"](resource:label="URL", http_verb:label="HTTP Method", expiration:label="Expiration", signed_url:label="Signed URL")z--private-key-file=r   r   -d-m-c-br=   rM   )r   rN   z --headers=x-goog-resumable=startzcontent-type=zuserProject=z--http-verbz
--durationz--query-paramsz	--headersz--regionz--private-key-password)r   r   r   r   -r-p)gcloud_commandflag_map)copydeepcopyargssub_opts	enumeratestrrC   rH   total_secondssuperget_gcloud_storage_argsr   r   )selforiginal_argsoriginal_sub_optsr   duration_arg_idxhttp_verb_arg_idxcontent_type_arg_idxbilling_project_arg_idxiflag_r?   content_type_valueproject_valuefully_translated_command	__class__s                  r6   r   &UrlSignCommand.get_gcloud_storage_args  s8    MM$)),Mdmm4:	* ,A499Q<+ON 		!"DI"!$--09D	4<4< 4<"# 1 #
"-- 01!466CmoGH KNNg *.wdmm$%$	(	)!	,	;+9'(=>>'==)=>qA-1?-?4@ -Admm() *mm$;<Q?m040>0N0Pdmm+,  %w>#4]#C#4\#B#45E#F#4[#A#4Z#@#45M#N#		  I%M##r5   c                 8   S nSnSnS n[         nSnS nU R                   H  u  p[        R                  (       a@  U	R	                  [
        R                  R                  =(       d    [        R                  5      n	US:X  a   Ub  U[        U	5      -  nMs  [        U	5      nM  US:X  a  U	nM  US:X  a  U	nM  US:X  a  U	nM  US:X  a  U	nM  US	:X  d  US
:X  a  SnM  US:X  a  U	nM  U R                  5         M     Uc
  [        SS9nO?U(       a  U[        :  a  [        S[        -  5      eU[        :  a  [        S[        -  5      eUS;  a  [        S5      eU(       d$  [!        U R"                  5      S:  a  [        S5      eU(       a  U(       a  [        S5      eX!X4XVU4$ )NGET Fr   r   r   r   r   z-uz--use-service-accountTr   r   r*   zMax valid duration allowed is %s when -u flag is used. For longer duration, consider using the private-key-file instead of the -u option.z Max valid duration allowed is %s)r   PUTDELETEHEADrM   z9HTTP method must be one of[GET|HEAD|PUT|DELETE|RESUMABLE]   zThe command requires a key file argument and one or more URL arguments if the --use-service-account flag is missing. Run `gsutil help signurl` for more infozLSpecifying both the -b and --use-service-account options together isinvalid.)_AUTO_DETECT_REGIONr   r]   r^   decodesysstdinencodingr   UTF8rH   RaiseInvalidArgumentExceptionr   !_MAX_EXPIRATION_TIME_WITH_MINUS_Ur   _MAX_EXPIRATION_TIMElenr   )
r   deltarQ   rh   rv   rU   rf   rY   ovs
             r6   _ParseAndCheckSubOpts$UrlSignCommand._ParseAndCheckSubOpts  s   EFLF FO	HHSYY''99>>:	
d
'*
*%&q)%9999944"9**,- 0 }a e	)J!J :;< 	< ''  $&: ; < 	< BB ? @ @ 3tyy>A#545 5
   ,_\\r5   c
                    [        UU R                  UUUS[        SS9UUUUU	SS9n
 [        5       n[	        U
S5      n[        X5      nUR                  S;  a  [        R                  " U5      eUR                  $ ! [         aj  nUR                  S5      (       a?  UR                  nSUR                  -  nUR                  (       a  US	UR                  -  -  nOS
U-  n[        U5      eSnAff = f)zFPerforms a head request against a signed URL to check for read access.r   <   r>   T)rd   re   rf   rP   rX   rQ   rE   rg   rS   rT   rU   rY   rW   )       responsezbUnexpected HTTP response code %s while querying object readability. Is your system clock accurate?z Content: %szbExpected an HTTP response code of 200 while querying object readability, but received an error: %sN)rn   
gsutil_apir   r   r   r   status_coder   FromResponsehas_attrr   contentr   )r   rd   rf   rP   ry   rg   rS   rT   rU   rY   
signed_urlr9   reqr   
http_errorerror_responseerror_strings                    r6   _ProbeObjectAccessWithClient+UrlSignCommand._ProbeObjectAccessWithClient1  s	    3#'??3F(0)5&,(1"(=(0*4&,&,/>48:J+
,aJ'cQ$h			_	4$$X..!!! +			Z	(	(#,,M&223 !!
.>+A+AA
A,')34 \**+s   AA; ;
C/A%C**C/c                     / nU Hi  n[        U5      (       a<  UR                  U R                  U5       Vs/ s H  oDR                  PM     sn5        MO  UR	                  [        U5      5        Mk     U$ s  snf N)r   extendWildcardIteratorstorage_urlappendr   )r   in_urlsrG   url_strblrs        r6   _EnumerateStorageUrls$UrlSignCommand._EnumerateStorageUrls]  se    
C	'	"	"

t/D/DW/MN/MOO/MNO

'01	  J	 Os   A4
c                 	   [         (       d  [        S5      eU R                  5       u  pp4pVnU(       a  SOSnU R                  U R                  US 5      n	0 n
SnU(       d5   [        [        U R                  S   S5      R                  5       U5      u  pOU R                  R                  SS	9n[        S
5        U	 GH\  nUR                  S:w  a  [        S5      eUR!                  5       (       a3  U["        :X  a  [        S5      eUR$                  nUS:X  a  [        S5      eO_SR                  UR$                  [&        R(                  R+                  UR,                  R/                  [0        R2                  5      SS95      nU["        :X  av  UR$                  U
;   a  XR$                     nOY U R5                  SR                  UR$                  5      S/S9u  nnUR<                  R?                  5       nXUR$                  '   OUn[A        UU R                  UUR                  UUUUURB                  U RD                  UUUSS9n[F        RH                  " [J        RL                  " [N        RP                  S9RS                  SS9U-   RU                  5       5      n[J        RV                  " U5      nURY                  S5      n[Z        R\                  (       a  UR_                  [0        R2                  5      nSR                  UR`                  UUU5      n[Z        R\                  (       a  UR/                  [0        R2                  5      n[        U5        U Rc                  XUR                  XURB                  U RD                  X5	      nUS:X  aa  UR!                  5       (       a   US:w  a  [        SR                  U5      5      eUS:w  a#  US:w  a  [        SR                  U5      5      eGM*  GM-  US :X  d  GM6  U RD                  Re                  S!U=(       d    S"U5        GM_     g! [         a    U(       d  [        R                  " S5      n [        [        U R                  S   S5      R                  5       U5      u  p GN! [         a(    [        SR                  U R                  S   5      5      ef = ff = f! [6         a>  n[        SR                  UR8                  R:                  UR$                  5      5      eSnAff = f)#z(Command entry point for signurl command.zhThe signurl command requires the pyopenssl library (try pip install pyopenssl or easy_install pyopenssl)r   r   NrbzKeystore password:z$Unable to parse private key from {0}gs)rP   z%URL	HTTP Method	Expiration	Signed URLz+Can only create signed urls from gs:// urlszGenerating signed URLs for creating buckets requires a region be specified via the -r option. Run `gsutil help signurl` for more information about the '-r' option.rM   z-Resumable signed URLs require an object name.z{0}/{1}s   /~)safezgs://{}location)bucket_fieldsz{}: Failed to auto-detect location for bucket '{}'. Please ensure you have storage.buckets.get permission on the bucket or specify the bucket's location using the '-r' option.T)rd   re   rf   rP   rX   rQ   rE   rg   rS   rT   rU   rh   rY   rW   r-   r/   z%Y-%m-%d %H:%M:%Sz{0}	{1}	{2}	{3}r   r   zkBucket {0} does not exist. Please create a bucket with that name before a creating signed URL to access it.zsObject {0} does not exist. Please create/upload an object with that name before a creating signed URL to access it.r   z%s does not have permissions on %s, using this link will likely result in a 403 error until at least READ permissions are grantedzThe account)3HAVE_OPENSSLr   r   r   r   r   openreadr   getpassrz   formatr   GetServiceAccountIdprintschemeIsBucketr   bucket_namer
   parsequoteobject_nameencoder   r   GetSingleBucketUrlFromArg	Exceptionr   __name__r   rD   rn   rS   rT   calendartimegmr   r1   r	   r2   r3   utctimetuplefromtimestampstrftimer]   r^   r   
url_stringr   r[   )r   rQ   r   rh   rv   rU   rf   rY   arg_start_indexstorage_urlsregion_cacherd   ry   urlrg   bucket_regionr   bucketeri   
expirationexpiration_dttime_strurl_info_strresponse_codes                            r6   
RunCommandUrlSignCommand.RunCommandh  s   <9: :
 	""$ VF<o.aAO--dii8H.IJLL
C-1t$))+V5\ __88$8Gl	
45	t	LMM	((  "H I I ??[   ") * * ! ##OOLLs55innE$)  +,
 
&	&??l*&7-?66  1* 7 OIAv !////1-*7s
'C$(OO4G),*6'-).)1+.>>'+{{'4-90?59;i ??HLLHLL$A$I$IQU$I$VY^$^#l#l#noj,,Z8m''(;<h	??9>>2)00199Fl 
#**9>>:L77
CJJ
..$++}Gm 
#	<<>>fo EEKVF 
 u_;!6"Ls  "7_
 CP)M3	0o x U  	??#78&	+499Q<&++-v7
#| 	 !G!N!Niil"  		T  ?"M q{{++S__=	? ??s6   !3P +-R4'R13Q;;2R--R14
S<>9S77S<)r   r   )r  
__module____qualname____firstlineno____doc__r   CreateCommandSpec	_SYNOPSISr   NO_MAXr   XMLJSONr   MakeZeroOrMoreFileURLsArgumentMakeZeroOrMoreCloudURLsArgumentcommand_specHelpSpec_DETAILED_HELP_TEXT	help_specr   r   r   r   r  __static_attributes____classcell__)r   s   @r6   r   r     s    2 **'5(34!oo{'7'78 %%

8
8
:

9
9
;,& 

 1#
)E$N@]D*+X	| |r5   r   )NNFNr   )Mr   
__future__r   r   r   r   r	  r   r   r   r	   r   r}   r@   r   r]   	six.movesr
   apitools.base.py.exceptionsr   apitools.base.py.http_wrapperr   r   botor   gslib.commandr   gslib.command_argumentr   gslib.cs_api_mapr   gslib.exceptionr   gslib.storage_urlr   r   gslib.utilsr   gslib.utils.boto_utilr   gslib.utils.shim_utilr   r   gslib.utils.signurl_helperr   r   r   OpenSSL.cryptor   r   r   r   r   ImportErrorcryptography.hazmat.primitivesr    )cryptography.hazmat.primitives.asymmetricr!   -cryptography.hazmat.primitives.asymmetric.rsar"   ,cryptography.hazmat.primitives.serializationr#   cryptography.hazmat._oidr$   r`   ra   r   r   r   r"  r*  r7   rH   rn   rz   r   r   r4   r5   r6   <module>rC     sW  
 ' %  '        	 
 
  1 5 1  ! 2 ( , . 2 ! , E K K *,!!,	}3?IA.+
   a( $-B$7 !	z| ~<
B  $"&',![|[#L_W _O
  /	$,,	  }+|}s$   *D   D4  D10D14
E E