
    j                       S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSK	r	SSK
r
SSKJr  SS	KJr  SS
KJr  SSKJs  Jr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK J!r!  SSK"J#r#  SSK$J%r%  SSK$J&r&  SSK$J'r(  SSK$J)r)  SSK$J*r*  SSK$J+r+  SSK,J-r-  SSK.J/r/J0r0  \/" \0" SSS5      5        SSK1J2r2  \Rf                  Rh                  r5Sr6S \6-  r7S!r8S"r9S#r:S$r;S%r<S4S& jr=S' r> " S( S)\R~                  5      r@\" S*5      \" S+5       " S, S-\R                  5      5       5       rB\" S*5      \" S+5       " S. S/\@5      5       5       rC\" S*5      \" S+5       " S0 S1\@5      5       5       rD " S2 S3\R                  5      rFg)5z&Integration tests for the iam command.    )absolute_import)print_function)division)unicode_literals)defaultdictN)iam)CommandException)PopulateProjectId)	SkipForS3)
SkipForXML)GenerationFromURI)SetBotoConfigForTest)SetEnvironmentForTest)unittest)storage_v1_messages)	shim_util)UTF8)BindingsMessageToUpdateDict)BindingsDictToUpdateDict)BindingStringToTuple)DiffBindings)IsEqualBindings)PatchBindings)Retry)add_moveMovedModulemockzunittest.mock)r   legacyBucketReaderzroles/storage.%sz roles/storage.legacyObjectReaderzroles/storage.objectViewerz#Description for our test condition.z.resource.type == "google.cloud.storage.Object"zTest Condition Titlec                 4    Uc  S/OUU S.nU(       a  X#S'   U/$ )a4  Generate the "bindings" portion of an IAM Policy dictionary.

Generates list of dicts which each represent a
storage_v1_messages.Policy.BindingsValueListEntry object. The list will
contain a single dict which has attributes corresponding to arguments passed
to this method.

Args:
  role: (str) An IAM policy role (e.g. "roles/storage.objectViewer"). Fully
      specified in BindingsValueListEntry.
  members: (List[str]) A list of members (e.g. ["user:foo@bar.com"]). If None,
      bind to ["allUsers"]. Fully specified in BindingsValueListEntry.
  condition: (Dict) A dictionary representing the JSON used to define a
      binding condition, containing the keys "description", "expression", and
      "title".

Returns:
  (List[Dict[str, Any]]) A Python representation of the "bindings" portion of
  an IAM Policy.
allUsersmembersrole	condition )r#   r"   r$   bindings       'platform/gsutil/gslib/tests/test_iam.pygen_bindingr(   D   s.    , ")*g' $K
    c                     U R                  S/ 5       Vs/ s H  o3R                  SS5      U:w  d  M  UPM     nnUR                  U5        [        U 5      n X@S'   U $ s  snf )a  Returns a patched Python object representation of a Policy.

Given replaces the original role:members binding in policy with new_policy.

Args:
  policy: Python dict representation of a Policy instance.
  role: An IAM policy role (e.g. "roles/storage.objectViewer"). Fully
        specified in BindingsValueListEntry.
  new_policy: A Python dict representation of a Policy instance, with a
              single BindingsValueListEntry entry.

Returns:
  A Python dict representation of the patched IAM Policy object.
bindingsr#    )getextenddict)policyr#   
new_policybr+   s        r'   patch_bindingr3   b   se      J++AuuVR/@D/Ha+   //*<&	-s
   AAc                       \ rS rSrSrS rSrg)TestIamIntegrationz   z*Superclass for iam integration test cases.c                 (   [         R                  " U5      S    Vs/ s H  n[        US   US   S9PM     nn[         R                  " U5      S    Vs/ s H  n[        US   US   S9PM     nnU R                  [	        XE5      5        gs  snf s  snf )z1Asserts two serialized policy bindings are equal.r+   r"   r#   r!   N)jsonloadsbvle
assertTruer   )selfar2   binding_dictexpectedresults         r'   assertEqualsPoliciesString-TestIamIntegration.assertEqualsPoliciesString}   s     !JJqM*55L 	\),<3GH5   !JJqM*55L 	\),<3GH5   	OOOH56s   B
Br%   N)__name__
__module____qualname____firstlineno____doc__rA   __static_attributes__r%   r)   r'   r5   r5   z   s
    2
7r)   r5   zTests use GS IAM model.z!XML IAM control is not supported.c                       \ rS rSrSrS rS rS rS rS r	S r
S	 rS
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS r S r!S  r"S!r#g")#TestIamHelpers   z"Unit tests for iam command helper.c           	          U R                  [        / 5      [        [        5      5        [        [        S[        S/5      05      nU R                  [        [	        SS/S9/5      U5        gzATests that Policy.bindings lists are converted to dicts properly.xyr#   r"   N)assertEqualr   r   setr:   r<   r?   s     r'   test_convert_bindings_simple+TestIamHelpers.test_convert_bindings_simple   sY    04k#6FG3c3%j 12H#TsSE%B$CDhPr)   c                    [        [        S[        SS/5      05      n[        SS/S9[        SS/S9/n[        SSS/S9[        SS/S9/nU R                  [	        U5      U5        U R                  [	        U5      U5        gz>Test that role and member duplication are converted correctly.rN   rO   zrP   N)r   rR   r:   rQ   r   r<   r?   duplicate_rolesduplicate_memberss       r'    test_convert_bindings_duplicates/TestIamHelpers.test_convert_bindings_duplicates   s    3c3*o 67H#u%#u%O
 	#Sz*#u% 	0A8L01BCXNr)   c                     U R                  [        / 5      [        [        5      5        [        [        S[        S/5      05      nU R                  [        SS/S./5      U5        grM   )rQ   r   r   rR   rS   s     r'   !test_convert_bindings_dict_simple0TestIamHelpers.test_convert_bindings_dict_simple   sa    -b1;s3CD3c3%j 12H u#
 " 	 	r)   c                     [        [        S[        SS/5      05      nSS/S.SS/S./nSSS/S.SS/S./nU R                  [        U5      U5        U R                  [        U5      U5        grW   )r   rR   rQ   r   rY   s       r'   %test_convert_bindings_dict_duplicates4TestIamHelpers.test_convert_bindings_dict_duplicates   s    3c3*o 67H5 5O : 5 	-o>I-.?@(Kr)   c                     [        SS/S9/nU R                  [        / / 5      5        U R                  [        X5      5        g)z)Tests an easy case of identical bindings.rN   rO   rP   Nr:   r;   r   )r<   r+   s     r'   test_equality_bindings_literal-TestIamHelpers.test_equality_bindings_literal   s7    #u-.HOOOB+,OOOH78r)   c                     [        SSS/S9/nUS-  n[        SS/S9[        SS/S9/nU R                  [        X5      5        U R                  [        X5      5        g)z7Tests bindings equality when duplicate roles are added.rN   rO   rP      Nre   )r<   r+   	bindings2	bindings3s       r'   "test_equality_bindings_extra_roles1TestIamHelpers.test_equality_bindings_extra_roles   sa    #Sz23H1I#u%#u%I 	OOOH89OOOH89r)   c                     [        SS/S9/n[        / U5      u  p#U R                  UR                  U5        U R                  UR                  / 5        g)z4Tests simple grant behavior of Policy.bindings diff.rN   rO   rP   Nr:   r   rQ   r+   r<   r?   grantedremoveds       r'   test_diff_bindings_add_role*TestIamHelpers.test_diff_bindings_add_role   sN    #u-.H%b(3WW%%x0W%%r*r)   c                     [        SS/S9/n[        U/ 5      u  p#U R                  UR                  / 5        U R                  UR                  U5        g)z5Tests simple remove behavior of Policy.bindings diff.rN   rO   rP   Nro   rp   s       r'   test_diff_bindings_drop_role+TestIamHelpers.test_diff_bindings_drop_role   sN    #u-.H%h3WW%%r*W%%x0r)   c                     [        SS/S9/n[        SS/S9/n[        X5      u  p4U R                  UR                  U5        U R                  UR                  U5        g)z,Tests expected behavior of switching a role.rN   rO   rP   r=   r2   Nro   r<   oldnewrq   rr   s        r'   test_diff_bindings_swap_role+TestIamHelpers.test_diff_bindings_swap_role   ]    S3%(
)CS3%(
)C%c/WW%%s+W%%s+r)   c                     [        SS/S9/n[        SSS/S9/n[        SS/S9/n[        X5      u  pEU R                  UR                  U5        U R                  UR                  / 5        g)z5Tests expected behavior of adding a member to a role.rN   rO   rP   rX   Nro   r<   rz   r{   r?   rq   rr   s         r'   test_diff_bindings_add_member,TestIamHelpers.test_diff_bindings_add_member   sp    S3%(
)CS3*-
.C#u-.H%c/WW%%x0W%%r*r)   c                     [        SSS/S9/n[        SS/S9/n[        SS/S9/n[        X5      u  pEU R                  UR                  / 5        U R                  UR                  U5        g)z9Tests expected behavior of dropping a member from a role.rN   rX   rO   rP   Nro   r   s         r'   test_diff_bindings_drop_member-TestIamHelpers.test_diff_bindings_drop_member   sp    S3*-
.CS3%(
)C#u-.H%c/WW%%r*W%%x0r)   c                     [        SS/S9/n[        SS/S9/n[        X5      u  p4U R                  UR                  U5        U R                  UR                  U5        g)z8Tests expected behavior of switching a member in a role.rN   rX   rP   rO   Nro   ry   s        r'   test_diff_bindings_swap_member-TestIamHelpers.test_diff_bindings_swap_member   r~   r)   c                     [        SS/S9[        SS/S9[        SS/S9/n[        U5      n[        SS/S9/n[        U5      n[        X-   5      n[        X$S5      nU R                  Xe5        g)	zTests patching a grant binding.r=   user:foo@bar.comrP   r2   cdTNr:   r   r   rQ   )r<   	base_listbase	diff_listdiffr?   ress          r'   test_patch_bindings_grant(TestIamHelpers.test_patch_bindings_grant  s     	# 234# 234# 234I
 'y1D# 234I 'y1D*9+@AH
D
)CS#r)   c           	          [        [        S/SS9[        S/SS9[        S/SS9/5      n[        [        S/SS9/5      n[        [        S/SS9[        S/SS9/5      n[        XS5      nU R                  XC5        g)z Tests patching a remove binding.r   r=   r!   r2   r   FNr   r:   r   rQ   r<   r   r   r?   r   s        r'   test_patch_bindings_remove)TestIamHelpers.test_patch_bindings_remove  s    &()4()4()4( D
 '()4( D +()4()4, H
 E
*CS#r)   c           	      J   [        [        S/SS9[        S/SS9[        S/SS9/5      n[        [        S/SS9/5      n[        XS5      nU R                  U0 5        [        [        S/SS9[        S/SS9[        S/SS9/5      n[        XS5      nU R                  U0 5        g)	z'Tests removing all roles from a member.r   r=   r!   r2   r   r,   FNr   )r<   r   r   r   s       r'   test_patch_bindings_remove_all-TestIamHelpers.test_patch_bindings_remove_all%  s    &()4()4()4( D
 '()3( D E
*CS"&()4()4()4( D E
*CS"r)   c           	         [        [        S/SS9/5      n[        [        S/SS9[        SS/SS9[        S/SS9/5      n[        [        S/SS9[        S/SS9[        S/SS9/5      n[        X#S5      nU R                  XA5        g)	z2Tests expected behavior when multiple users exist.zuser:fii@bar.comr2   r!   r   r=   r   FNr   )r<   r?   r   r   r   s        r'   "test_patch_bindings_multiple_users1TestIamHelpers.test_patch_bindings_multiple_users;  s    *()4, H '()4(*<=CH()4( D
 '()4()4()4( D
 E
*CS#r)   c           	         [        [        SS/S9[        SS/S9[        SS/S9/5      n[        [        SS/S9/5      n[        [        SSS/S9[        SS/S9[        SS/S9/5      n[        XS5      nU R                  XC5        g)	zTests a public member grant.r=   r   rP   r2   r   r    TNr   r   s        r'   #test_patch_bindings_grant_all_users2TestIamHelpers.test_patch_bindings_grant_all_usersM  s    &# 234# 234# 234( D
 '#
|,( D +#
,>?@# 234# 234, H D
)CS#r)   c                     [        SS/S9/n[        U5      n[        SS/S9/n[        U5      n[        X$S5      nU R                  U[        X-   5      5        g)z2Tests public member vs. public member interaction.r=   r    rP   allAuthenticatedUsersTNr   )r<   r   r   r   r   r   s         r'   +test_patch_bindings_public_member_overwrite:TestIamHelpers.test_patch_bindings_public_member_overwrite`  si     	#
|,I 'y1D# 789I 'y1D
D
)CS5i6KLMr)   c                     [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        g)z-Tests parsing single role (case insensitive).Tzallusers:admin   r    roles/storage.adminr!   NbsttrQ   lenassertInr<   _r+   s      r'   $test_valid_public_member_single_role3TestIamHelpers.test_valid_public_member_single_rolen  sC    /0MQS]A&MM<% r)   c                    U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        g! , (       d  f       N= f! , (       d  f       Nt= f! , (       d  f       N[= f! , (       d  f       g= f)zDTests that an error is raised when no role is specified for a grant.Tr    Nr   zuser:foo@bar.com:z"deleted:user:foo@bar.com?uid=1234:assertRaisesr	   r   r<   s    r'   test_grant_no_role_error'TestIamHelpers.test_grant_no_role_errorw  s    			+	,
4 
-			+	,
4#$ 
-			+	,
4$% 
-			+	,
456 
-	, 
-	,	,	,	,	,	,	,s/   B* B;*CC*
B8;
C	
C
C+c                    [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        U R                  X4[        SS5      5        [        SS5      u  p2U R                  [        U5      S5        g)	z;Tests parsing a -d allUsers or -d user:foo@bar.com request.Fr    r   r,   r!   z	allUsers:r   Nr   )r<   is_grantr+   r   s       r'   test_remove_all_roles$TestIamHelpers.test_remove_all_roles  s{      z2XS]A&MMzlB7Bh)4{+CD  23MQS]A&r)   c                    [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        U R                  S/SS.U5        U R                  S/SS.U5        U R                  S/S	S.U5        g
)z2Tests parsing of multiple roles bound to one user.TzallUsers:a,b,c,roles/custom   r    roles/storage.ar!   zroles/storage.bzroles/storage.czroles/customNr   r   s      r'   test_valid_multiple_roles(TestIamHelpers.test_valid_multiple_roles  s    <=MQS]A&MM<!  	MM<!  	MM<!  	MMzlNCXNr)   c                     [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        U R                  S/SS.U5        g)	z0Tests parsing of custom roles bound to one user.Tz,user:foo@bar.com:roles/custom1,roles/custom2ri   r   zroles/custom1r!   zroles/custom2Nr   r   s      r'   test_valid_custom_roles&TestIamHelpers.test_valid_custom_roles  se    MNMQS]A&MM&'  	MM&' r)   c                     [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        g)z(Tests member parsing (case insensitive).TzUser:foo@bar.com:adminr   r   r   r!   Nr   r   s      r'   test_valid_member TestIamHelpers.test_valid_member  sD    78MQS]A&MM*+)	
 	r)   c                    [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        [        SS5      u  pU R                  [        U5      S5        U R                  S/S	S.U5        [        SS
5      u  pU R                  [        U5      S5        U R                  S/S	S.U5        U R                  S/SS.U5        g)z0Tests deleted member parsing (case insensitive).Fz Deleted:User:foo@bar.com?uid=123r   z deleted:user:foo@bar.com?uid=123r,   r!   Tz&deleted:User:foo@bar.com?uid=123:adminr   zAdeleted:user:foo@bar.com?query=param,uid=123?uid=456:admin,admin2ri   z4deleted:user:foo@bar.com?query=param,uid=123?uid=456zroles/storage.admin2Nr   r   s      r'   test_valid_deleted_member(TestIamHelpers.test_valid_deleted_member  s     BCMQS]A&MM67  GHMQS]A&MM:;)	
 	 KMMQ 	S]A&MMNO)	
 	
 	MMNO*	
 	r)   c                     [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        g)z'Tests that duplicate roles are ignored.TzallUsers:a,ar   r    r   r!   Nr   r   s      r'   test_duplicate_roles#TestIamHelpers.test_duplicate_roles  sB    ~.MQS]A&MM<! r)   c                     [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        [        SS5      u  pU R                  [        U5      S5        U R                  S/SS.U5        g)	z4Tests that project convenience roles can be removed.FprojectViewer:123424:adminr   zprojectViewer:123424r   r!   r,   Nr   r   s      r'   (test_removing_project_convenience_groups7TestIamHelpers.test_removing_project_convenience_groups  s     <=MQS]A&MM./)	
 	
  67MQS]A&MM56CXNr)   c                 z    U R                  [        5         [        SS5        SSS5        g! , (       d  f       g= f)z5Tests that project convenience roles cannot be added.Tr   Nr   r   s    r'   &test_adding_project_convenience_groups5TestIamHelpers.test_adding_project_convenience_groups  s(    			+	,
4-. 
-	,	,s   ,
:c                    U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        g! , (       d  f       N= f! , (       d  f       N= f! , (       d  f       N= f! , (       d  f       N= f! , (       d  f       N}= f! , (       d  f       g= f)	zTests invalid input handling.Tznon_valid_public_member:roleNznon_valid_type:id:rolezuser:rzdeleted:userzdeleted:not_a_typezdeleted:user:foo@no_uid_suffixr   r   s    r'   test_invalid_input!TestIamHelpers.test_invalid_input  s    			+	,
4/0 
-			+	,
4)* 
-			+	,
4 
-			+	,
4  
-			+	,
4%& 
-			+	,
412 
-	, 
-	,	,	,	,	,	,	,	,	,	,	,sG   C> D*D D1>E(E>
D
D 
D.1
D?
E
E!c                 f   U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        U R                  [        5         [        SS5        SSS5        g! , (       d  f       Nc= f! , (       d  f       NJ= f! , (       d  f       g= f)z+Tests invalid input due to too many colons.TzallUsers:some_id:some_roleNzuser:foo@bar.com:r:nonsensez,deleted:user:foo@bar.com?uid=1234:r:nonsenser   r   s    r'   test_invalid_n_args"TestIamHelpers.test_invalid_n_args   sy    			+	,
4-. 
-			+	,
4./ 
-			+	,
4?@ 
-	,	 
-	,	,	,	,	,s#   B  B*B" 
B
B"
B0r%   N)$rC   rD   rE   rF   rG   rT   r\   r_   rb   rf   rl   rs   rv   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rH   r%   r)   r'   rJ   rJ      s     +POL(9	:+1,+1,$ $$,$$$&N	7
'O$>O/
3Ar)   rJ   c                      ^  \ rS rSrSrU 4S jrS rS rS rS r	S r
S	 rS
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rSrU =r$ )	TestIamChi
  z%Integration tests for iam ch command.c                   > [         [        U ]  5         U R                  5       U l        U R                  5       U l        U R                  U R                  SS9U l        U R                  U R                  SS9U l        U R                  SSU R                  R                  /SS9U l        U R                  SSU R                  R                  /SS9U l        U R                  SSU R                  R                  /SS9U l        SU l        S	U l        g )
N   foo
bucket_uricontents   barr   r-   Treturn_stdoutr   zuser:bar@foo.com)superr   setUpCreateBucketbucketbucket2CreateObjectobjectobject2	RunGsUtiluribucket_iam_stringobject_iam_stringobject2_iam_stringuseruser2r<   	__class__s    r'   r   TestIamCh.setUp  s    	)T "##%DK$$&DL##t{{V#LDK$$f$MDL!^^UE4;;??,K:> , @D!^^UE4;;??,K:> , @D"nneUDLL<L<L-M;? - AD #DI#DJr)   c                 x    U R                  SSU R                  R                  /SSS9nU R                  SU5        g)1Tests expected failure if no bindings are listed.r   chTr   return_stderrexpected_statusr	   Nr   r   r   r   r<   stderrs     r'   test_patch_no_roleTestIamCh.test_patch_no_role   s=    ^^UD$++//:*.,-  /F 	MM$f-r)   c                 |    U R                  SSU R                  < S[        < 3S/SSS9nU R                  SU5        g	)
r   r   r   :-dTr   r   z?A -d flag is missing an argument specifying bindings to remove.Nr   r   IAM_BUCKET_READ_ROLE_ABBREVr   r   s     r'   5test_raises_error_message_for_d_flag_missing_argument?TestIamCh.test_raises_error_message_for_d_flag_missing_argument'  sI    ^^	II:	;T	C	  F
 	MMIr)   c                     U R                  SSU R                  < S[        < 3U R                  R                  U R
                  R                  /SSS9nU R                  SU5        g)	z@Tests expected failure if both buckets and objects are provided.r   r   r  Tr   r   r	   N)r   r   r  r   r   r   r   r   s     r'   $test_path_mix_of_buckets_and_objects.TestIamCh.test_path_mix_of_buckets_and_objects2  sZ    ^^t999:DKKOO
 +/,-  /F 	MM$f-r)   c                 |    U R                  SSU R                  < S[        < 3S/SSS9nU R                  SU5        g	)
z=Tests expected failure is caught when a file url is provided.r   r   r  file://somefileTr   r   AttributeErrorNr  r   s     r'   test_path_file_urlTestIamCh.test_path_file_url=  sH    ^^t999:<M +/,-  /F 	MM"F+r)   c                 d   U R                  U R                  U R                  [        5        U R	                  SSU R                  < S[
        < 3U R                  R                  /5        U R	                  SSU R                  R                  /SS9nU R                  XR                  [        5        g)zTests granting single role.r   r   r  r-   Tr   N)	assertHasNor   r   IAM_BUCKET_READ_ROLEr   r  r   r   	assertHasr<   r   s     r'   %test_patch_single_grant_single_bucket/TestIamCh.test_patch_single_grant_single_bucketG  s    T++TYY8LMNNt999:DKKOO 
 udkkoo'F59 ' ;NN$ii1EFr)   c                    U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  XR                  [        5        g)z@Granting multiple times for the same member will have no effect.r   r   r  r-   Tr   Nr   r   r  r   r   r  r  r  s     r'   test_patch_repeated_grant#TestIamCh.test_patch_repeated_grantS  s    NNt999:DKKOO  	NNt999:DKKOO 
 udkkoo'F59 ' ;NN$ii1EFr)   c                    U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSSU R                  < S[        < 3U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  XR                  [        5        g)	zTests removing a single role.r   r   r  r  r-   Tr   Nr   r   r  r   r   r  r  r  s     r'   &test_patch_single_remove_single_bucket0TestIamCh.test_patch_single_remove_single_bucketb  s    NNt999:DKKOO  	NNtT999:DKKOO 
 udkkoo'F59 ' ;&		3GHr)   c                 F   U R                  SSSU R                  < S[        < 3U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  XR                  [        5        U R                  XR                  5        g)	z4Removing a non-existent binding will have no effect.r   r   r  r  r-   Tr   N)	r   r   r  r   r   r  r  rA   r   r  s     r'   test_patch_null_remove TestIamCh.test_patch_null_removeq  s    NNtT999:DKKOO 
 udkkoo'F59 ' ;&		3GH##$57M7MNr)   c           	         U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSU R
                  < S[        < 3SU R                  < S[        < 3U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  XR
                  [        5        U R                  XR                  [        5        g)	z9Tests that mixing grant and remove requests will succeed.r   r   r  r  r-   Tr   N)	r   r   r  r   r   r   r  r  r  r  s     r'   +test_patch_mixed_grant_remove_single_bucket5TestIamCh.test_patch_mixed_grant_remove_single_bucket}  s    NNt:::;T[[__  	NNt999:D:::;T[[__  udkkoo'F59 ' ;NN$ii1EF&

4HIr)   c                    U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSS[        -  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  US[        5        U R                  XR                  [        5        g	)
zCTest public grant request interacts properly with existing members.r   r   r  zallUsers:%sr-   Tr   r    Nr  r  s     r'   %test_patch_public_grant_single_bucket/TestIamCh.test_patch_public_grant_single_bucket  s    NNt999:DKKOO  	NNt33T[[__ 
 udkkoo'F59 ' ;NN$j2FGNN$ii1EFr)   c                 v   U R                  SSU R                  < S[        < 3U R                  R                  /5        U R                  SSSU R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  XR                  [        5        g)	zDRemove with no roles specified will remove member from all bindings.r   r   r  r  r-   Tr   Nr  r  s     r'   test_patch_remove_all_roles%TestIamCh.test_patch_remove_all_roles  s    NNt999:DKKOO  	NNE4tyy$++//BCudkkoo'F59 ' ;&		3GHr)   c                 T   U R                  U R                  U R                  [        5        U R	                  SSSU R                  -  U R
                  R                  /5        U R	                  SSU R
                  R                  /SS9nU R                  XR                  [        5        g)z Tests object IAM patch behavior.r   r   %s:legacyObjectReaderr-   Tr   Nr  r   r   IAM_OBJECT_READ_ROLEr   r   r   r  r<   r   s     r'   test_patch_single_object"TestIamCh.test_patch_single_object  s    T++TYY8LMNN		 499	,dkkoo	?@ udkkoo'F59 ' ;NN$ii1EFr)   c                 V   U R                  U R                  U R                  [        5        U R	                  SSSSU R                  -  U R
                  R                  /5        U R	                  SSU R
                  R                  /SS9nU R                  XR                  [        5        g)	z8Tests the edge-case behavior of multithreaded execution.-mr   r   r,  r-   Tr   Nr-  r/  s     r'   &test_patch_multithreaded_single_object0TestIamCh.test_patch_multithreaded_single_object  s    T++TYY8LMNNeT$))+T[[__ 
 udkkoo'F59 ' ;NN$ii1EFr)   c           	         U R                  SSU R                  < S[        < 3U R                  R                  U R
                  < S[        < 3/SSS9nU R                  SU5        U R                  SSU R                  R                  /SS	9nU R                  X R                  [        5        U R                  X R
                  [        5        g
)z?Tests that listing bindings after a bucket will throw an error.r   r   r  Tr   r   r	   r-   r   N)
r   r   r  r   r   r   r   r  r  r  )r<   r   r   s      r'   test_patch_invalid_input"TestIamCh.test_patch_invalid_input  s    ^^t999:DKKOO:::;
 +/,-  /F 	MM$f-udkkoo'F59 ' ;NN$ii1EF&

4HIr)   c                 z    U R                  SSSU R                  R                  /SSS9nU R                  SU5        g)	zBTests that we disallow certain binding types with appropriate err.r   r   zprojectOwner:my-project:adminTr   r   znot supportedNr   r   s     r'   "test_patch_disallowed_binding_type,TestIamCh.test_patch_disallowed_binding_type  s@    ^^	5t{{G  F 	MM/6*r)   c                    S[        5       -  nU R                  [        R                  " [	        [        R
                  " U R                  5      [        [        [        U/S95      5      R                  [        5      S9nU R                  SSX R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  X1[        5        U R                  SS	S
XR                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  X1[        5        g)z4Tests that we can remove project convenience values.projectViewer:%s)r"   r   r   rR   r-   Tr   r   r  N)r
   CreateTempFiler8   dumpsr3   r9   r   r.  r(   encoder   r   r   r   r  r  )r<   disallowed_memberpolicy_file_path
iam_strings       r'   )test_patch_remove_disallowed_binding_type3TestIamCh.test_patch_remove_disallowed_binding_type  s    +->-@@**DJJJJt--.0D,7H 78 9	:5; <B6$<	 + I
 	NNE5"2KKOODEt{{ ?.2   4JNN:2FGNNE4'8++//JKt{{ ?.2   4JZ4HIr)   c                    U R                  SSSSU R                  -  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  SSU R
                  R                  /SS9nU R                  XR                  [        5        U R                  X R                  [        5        g)	z)Tests IAM patch against multiple objects.r   r   -rr,  r-   Tr   Nr   r   r   r   r   r   r  r.  r<   r   r   s      r'   test_patch_multiple_objects%TestIamCh.test_patch_multiple_objects  s    NNtT$))+T[[__ 
 udkkoo'F59 ' ;t||7G7G(H6: ( <NN$ii1EFNN%yy2FGr)   c                    U R                  SSSSSU R                  -  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  SSU R
                  R                  /SS9nU R                  XR                  [        5        U R                  X R                  [        5        g	)
z6Tests multithreaded behavior against multiple objects.r3  r   r   rH  r,  r-   Tr   NrI  rJ  s      r'   )test_patch_multithreaded_multiple_objects3TestIamCh.test_patch_multithreaded_multiple_objects  s    NNeT4$))+T[[__ 
 udkkoo'F59 ' ;t||7G7G(H6: ( <NN$ii1EFNN%yy2FGr)   c                 D   U R                  SSU R                  < S[        < 3U R                  R                  SU R
                  -  U R                  R                  /SSS9nU R                  (       a  U R                  SU5        OU R                  S	U5        U R                  SS
U R                  R                  /SS9nU R                  SS
U R                  R                  /SS9nU R                  X R                  [        5        U R                  X0R                  5        g)zSee TestIamSet.test_set_error.r   r   r  gs://%sTr   r   not found: 404.BucketNotFoundExceptionr-   r   N)r   r   r  r   r   nonexistent_bucket_namer   _use_gcloud_storager   r  r  rA   r   r<   r   r   bucket2_iam_strings       r'   test_patch_errorTestIamCh.test_patch_error
  s    ^^t999:DKKOOD000$,,2B2B
 +/,-  /F 
mm%v.
mm-v6udkkoo'F59 ' ;t||7G7G(H6: ( < 	NN$ii1EF##$68N8NOr)   c           	      P   U R                  SSSU R                  < S[        < 3U R                  R                  SU R
                  -  U R                  R                  /SSS9nU R                  (       a  U R                  S	U5        OU R                  S
U5        U R                  SSU R                  R                  /SS9nU R                  SSU R                  R                  /SS9nU R                  X R                  [        5        U R                  X0R                  [        5        g)z$See TestIamSet.test_set_force_error.r   r   -fr  rQ  Tr   r   rR  r	   r-   r   N)r   r   r  r   r   rT  r   rU  r   r  r  rV  s       r'   test_patch_force_error TestIamCh.test_patch_force_error   s    ^^tT999:DKKOOD000$,,2B2B
 +/,-  /F 
mm%v.
mm&/udkkoo'F59 ' ;t||7G7G(H6: ( < 	NN$ii1EFNN%yy2FGr)   c                    ^  [        [        SSS9U 4S j5       n[        [        SSS9U 4S j5       nU" 5         U" 5         g)z,See TestIamSet.test_set_multithreaded_error.   r   triestimeout_secsc            	         > TR                  SSSSSTR                  -  STR                  -  TR                  R                  /SSS	9n TR
                  (       a  TR                  S
U 5        g TR                  SU 5        g )Nr3  r   r   rH  r,  rQ  Tr   r   rR  rS  )r   r   rT  r   r   rU  r   )r   r<   s    r'   _Check19TestIamCh.test_patch_multithreaded_error.<locals>._Check19  sy    ~~
tT
!DII
-
d22
2DKKOO
 -1./  1f 
	!	!'0/8r)   c                    > TR                  SSTR                  R                  /SS9n TR                  SSTR                  R                  /SS9nTR	                  TR
                  U 5        TR	                  TR
                  U5        g )Nr   r-   Tr   )r   r   r   r   rA   r   )r   r   r<   s     r'   _Check29TestIamCh.test_patch_multithreaded_error.<locals>._Check2H  s    ..%)H7; ) =>>5%9I9I*J8< * > %%d&<&<>OP
%%d&<&<&8:r)   Nr   AssertionErrorr<   rd  rg  s   `  r'   test_patch_multithreaded_error(TestIamCh.test_patch_multithreaded_error6  sI     >39 49 >3: 4: IIr)   c                 r   SS/SS.SS/[         S./0nU R                  [        R                  " U5      SS5        U R                  [        R                  " U5      S[         5        U R	                  [        R                  " U5      S[         5        U R	                  [        R                  " U5      SS5        g )Nr+   r    r   r!   r   zserviceAccount:bar@foo.com)r  r  r8   r@  r  )r<   test_policys     r'   test_assert_hasTestIamCh.test_assert_hasV  s    "|)
 +,HI(
K 	NN4::k*J8MNNN4::k*,>')TZZ,j:NOTZZ,.@*,r)   c                     [         R                  " U5      n[        S UR                  S/ 5       5       5      nX4;   a  X$U   S   ;   a  g[	        SU< SU< SU< 35      e)a8  Asserts a member has permission for role.

Given an IAM policy, check if the specified member is bound to the
specified role. Does not check group inheritence -- that is, if checking
against the [{'member': ['allUsers'], 'role': X}] policy, this function
will still raise an exception when testing for any member other than
'allUsers' against role X.

This function does not invoke the TestIamPolicy endpoints to smartly check
IAM policy resolution. This function is simply to assert the expected IAM
policy is returned, not whether or not the IAM policy is being invoked as
expected.

Args:
  policy: Policy object as formatted by IamCommand._GetIam()
  member: A member string (e.g. 'user:foo@bar.com').
  role: A fully specified role (e.g. 'roles/storage.admin')

Raises:
  AssertionError if member is not bound to role.
c              3   .   #    U  H  oS    U4v   M     g7f)r#   Nr%   ).0ps     r'   	<genexpr>&TestIamCh.assertHas.<locals>.<genexpr>  s     G,FqvYN,Fs   r+   r"   NMember 'z' does not have permission '' in policy )r8   r9   r/   r-   rj  )r<   r0   memberr#   r+   s        r'   r  TestIamCh.assertHash  s^    . ZZFGFJJz2,FGGH	D>),	,
(.f> ? ?r)   c                 v     U R                  XU5        [        SU< SU< SU< 35      e! [         a     gf = f)z9Functions as logical compliment of TestIamCh.assertHas().rx  z' has permission 'ry  N)r  rj  )r<   r0   rz  r#   s       r'   r  TestIamCh.assertHasNo  sH    A
nnVT* *0$@ A A  
s   + 
88)	r   r   r   r   r   r   r   r   r   ) rC   rD   rE   rF   rG   r   r   r  r	  r  r  r  r  r   r#  r&  r)  r0  r4  r7  r:  rE  rK  rN  rX  r\  rl  rp  r  r  rH   __classcell__r   s   @r'   r   r   
  s     .$".		.,
GGI
OJ"G 
I	G
GJ +J*HHP,H,@,$?>A Ar)   r   c                     ^  \ rS rSrSrU 4S jrS rS rS rS r	S r
S	 r\R                  " S
5      S 5       r\R                  " S
5      S 5       rS rS rS rS rS rS rS rS rS rS rS rS rS rS rSrU =r$ )
TestIamSeti  z&Integration tests for iam set command.c                   > [         [        U ]  5         [        [        5      U l        [        [        5      U l        [        [        S[        5       -  /[        [        [        S.S9U l        U R                  5       U l        U R!                  5       U l        U R%                  SSU R                  R&                  /SS9U l        U R+                  U R(                  R-                  [.        5      S9U l        [3        [4        R6                  " U R(                  5      [        U R
                  5      U l        U R+                  [4        R:                  " U R8                  5      R-                  [.        5      S9U l        [4        R6                  " U R(                  5      U l        U R>                  S	   RA                  U R                  S
   5        U R+                  [4        R:                  " U R>                  5      S9U l!        U RE                  SS9U l#        U R%                  SSU RF                  R&                  /SS9U l$        U R+                  U RH                  R-                  [.        5      S9U l%        [3        [4        R6                  " U RH                  5      [        U R                  5      U l&        U R+                  [4        R:                  " U RL                  5      R-                  [.        5      S9U l'        g )Nr=  )titledescription
expression)r"   r$   r   r-   Tr   r>  r+   r   foobar)(r   r  r   r(   r  public_bucket_read_bindingr.  public_object_read_bindingIAM_OBJECT_VIEWER_ROLEr
   TEST_CONDITION_TITLETEST_CONDITION_DESCRIPTION&TEST_CONDITION_EXPR_RESOURCE_IS_OBJECT-project_viewer_objectviewer_with_cond_bindingr   r   CreateVersionedBucketversioned_bucketr   r   r   r?  rA  r   old_bucket_iam_pathr3   r8   r9   new_bucket_iam_policyr@  new_bucket_iam_path(new_bucket_policy_with_conditions_policyappend&new_bucket_policy_with_conditions_pathr   r   r   old_object_iam_pathnew_object_iam_policynew_object_iam_pathr   s    r'   r   TestIamSet.setUp  s~   	*d!#&12F&GD#&12F&GD#9D $&7&99:)5@

:D6 ##%DK 668D "^^UE4;;??,K:> , @D#22''..t4  3  6D "/

4))*,@''")D  $22D667>>tD  3  FD
 59JJ5 D111*=DD::1=?262E2EDIIJ 3F 3LD/ ##X#6DK!^^UE4;;??,K:> , @D#22''..t4  3  6D "/

4))*,@''")D  $22D667>>tD  3  FDr)   c                     U R                  U R                  SS9n[        SS/5         U R                  SSSU R                  UR
                  /SS	9nU R                  S
U5        SSS5        g! , (       d  f       g= f)zEEnsures that the seek-ahead iterator is being used with iam commands.   foobarr   )GSUtiltask_estimation_threshold1)r  task_estimation_forceTruer3  r   rR   T)r   z,Estimated work for this command: objects: 1
N)r   r   r   r   r  r   r   )r<   gsutil_objectr   s      r'   test_seek_ahead_iamTestIamSet.test_seek_ahead_iam  s     %%/8 & :M 
KJL 
M~~t779J9J
K  f mmCVL
M 
M 
Ms   <A--
A;c                     U R                  SSU R                  U R                  R                  U R                  R                  /SSS9nU R                  SU5        g)zCTests that failure is thrown when buckets and objects are provided.r   rR   Tr   r   r	   N)r   r  r   r   r   r   r   s     r'   #test_set_mix_of_buckets_and_objects.TestIamSet.test_set_mix_of_buckets_and_objects  sV     ^^ud.. +/,-	  /F
 	MM$f-r)   c                 f    U R                  SSU R                  S/SSS9nU R                  SU5        g)	z9Tests that failure is thrown when a file url is provided.r   rR   r  Tr   r   r  N)r   r  r   r   s     r'   test_set_file_urlTestIamSet.test_set_file_url  s?    ^^	t//1BC  F 	MM"F+r)   c                    ^  [        [        SSS9U 4S j5       n[        [        SSS9U 4S j5       nU" 5         U" 5         g)z5Ensures invalid content returns error on input check.r_  r   r`  c                     > TR                  SS9n TR                  SSU TR                  R                  /SSS9nTR                  (       a  SOS	nTR                  X!5        g )
Ns   badIamr>  r   rR   Tr   r   zFound invalid JSON/YAMLArgumentException)r?  r   r   r   rU  r   )inpathr   error_messager<   s      r'   rd  7TestIamSet.test_set_invalid_iam_bucket.<locals>._Check1  sf    ""I"6f~~ueVT[[__E,0./  1f 22 18K 
mmM*r)   c                     > TR                  SSSTR                  R                  /SSS9n TR                  (       a  SOSnTR	                  X5        g )	Nr   rR   znonexistent/pathTr   r   zNo such file or directoryr  )r   r   r   rU  r   r   r  r<   s     r'   rg  7TestIamSet.test_set_invalid_iam_bucket.<locals>._Check2  sW     ~~%+T[[__
=  f
 22 38K 
mmM*r)   Nri  rk  s   `  r'   test_set_invalid_iam_bucket&TestIamSet.test_set_invalid_iam_bucket  sI     >3+ 4+ >3+ 4+ IIr)   c                 Z  ^  T R                  SST R                  /SSS9nT R                  (       a  SOSnT R                  X!5        T R                  SSST R                  -  /SSS9nT R                  (       a  S	OS
nT R                  X!5        [	        [
        SSS9U 4S j5       nU" 5         g)z3Ensures that invalid bucket names returns an error.r   r-   Tr   r   r  r	   rQ  	not foundrS  r_  r`  c                  x   > TR                  / SQSSS9n TR                  (       a  SOSnTR                  X5        g )N)r   r-   zgs://*Tr   r   z"must match a single cloud resourcer	   )r   rU  r   r  s     r'   _Check2TestIamSet.test_get_invalid_bucket.<locals>._Check%  sE     ~~6,0./  1f 22 <8J 
mmM*r)   N)r   rT  rU  r   r   rj  )r<   r   r  r  s   `   r'   test_get_invalid_bucket"TestIamSet.test_get_invalid_bucket  s    ^^UE4+G+GH*.,-  /F 00 &6H MM-(^^	y4#?#??@  F
 00 !6O MM-(
 >3+ 4+ Hr)   c                    U R                  SSSSU R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  SSSSU R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  U R                  U5        U R                  U R                  S   [        R                  " U5      S	   5        g
)z&Tests setting a valid IAM on a bucket.r   rR   -er,   r-   Tr   r   r+   N)r   r  r   r   r  rA   r   r   r  r8   r9   r<   set_iam_stringreset_iam_strings      r'   test_set_valid_iam_bucket$TestIamSet.test_set_valid_iam_bucket2  s    NN	tR!9!94;;??KM^^UE4;;??$C26 $ 8NNN	tR!9!94;;??KM~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   z7Disabled until all projects whitelisted for conditions.c                 `   U R                  SSSSU R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R	                  [
        U5        U R	                  [        UR                  SS5      5        U R	                  [        U5        g	)
zDTests setting and getting an IAM policy with conditions on a bucket.r   rR   r  r,   r-   Tr   \N)	r   r  r   r   r   r  r  replacer  )r<   get_iam_strings     r'   4test_set_and_get_valid_bucket_policy_with_conditions?TestIamSet.test_set_and_get_valid_bucket_policy_with_conditionsA  s     	NNudB K K  ^^UE4;;??$C26 $ 8NMM,n=MM8 ((r24MM&7r)   c                    [        5         U R                  SSSSU R                  U R                  R                  /5        U R                  SSSU R                  R                  /SSS	9nU R                  S
U5        U R                  SU5        U R                  SSSSU R                  R                  /SSS	9nU R                  SU5        U R                  SU5        g)zETests that if we "set" a policy with conditions, "ch" won't patch it.r   rR   r  r,   r   zallUsers:objectViewerTr   r   z0CommandException: Could not patch IAM policy forz#The resource had conditions presentr[  z8CommandException: Some IAM policies could not be patchedzSome resources had conditionsN)printr   r  r   r   r   r   s     r'   &test_ch_fails_after_setting_conditions1TestIamSet.test_ch_fails_after_setting_conditionsQ  s     
GNNudB K K  ^^	-t{{?  F 	MMDfMMM7@ ^^	d3T[[__E  F 	MML 	MM16:r)   c                 F   U R                  SSSSU R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  SSS[        R
                  " U5      S   U R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  U R                  U5        U R                  U R                  S	   [        R
                  " U5      S
   5        g)z/Tests setting blank etag behaves appropriately.r   rR   r  r,   r-   Tr   etagr   r+   N)r   r  r   r   r8   r9   r  rA   r   r   r  r  s      r'   test_set_blank_etagTestIamSet.test_set_blank_etagn  s   NN	tR!9!94;;??KM ^^UE4;;??$C26 $ 8N 	NNud

>"6*D,D,D  ~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    U R                  SSU R                  R                  /SS9nU R                  SSS[        R                  " U5      S   U R
                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  SSS[        R                  " U5      S   U R                  U R                  R                  /5        U R                  SSU R                  R                  /SS9nU R                  U R                  U5        U R                  U R                  S   [        R                  " U5      S	   5        g
)z+Tests setting valid etag behaves correctly.r   r-   Tr   rR   r  r  r   r+   N)r   r   r   r8   r9   r  r  rA   r   r   r  )r<   r  r  r  s       r'   test_set_valid_etagTestIamSet.test_set_valid_etag  s7   ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D  ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D  ~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    U R                  SSU R                  R                  /SS9  U R                  SSSSU R                  U R                  R                  /SSS	9nU R                  (       a  S
OSnU R                  X!5        g)z5Tests setting an invalid etag format raises an error.r   r-   Tr   rR   r  zsome invalid etagr   r   DecodeErrorr  N)r   r   r   r  rU  r   )r<   r   r  s      r'   test_set_invalid_etag TestIamSet.test_set_invalid_etag  s    NNE5$++//2$NG^^ud/1I1I +/,-  /F 00 #6I MM-(r)   c                    U R                  SSU R                  R                  /SS9nU R                  SSS[        R                  " U5      S   U R
                  U R                  R                  /5        U R                  SSS[        R                  " U5      S   U R
                  U R                  R                  /SSS	9nU R                  (       a  S
OSnU R                  X25        g)z.Tests setting mismatched etag raises an error.r   r-   Tr   rR   r  r  r   r   z)pre-conditions you specified did not holdPreconditionExceptionN)r   r   r   r8   r9   r  rU  r   )r<   r  r   r  s       r'   test_set_mismatched_etag#TestIamSet.test_set_mismatched_etag  s    ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D 
 ^^ud

>"6*D,D,D
 +/,-  /F 00 A6M MM-(r)   c                 0   U R                  U R                  SS9nU R                  U R                  SS9nU R                  U R                  UR                  S[        U5      S9nU R                  U R                  UR                  S[        U5      S9nXUU4$ )zCreates two versioned objects and return references to all versions.

Returns:
  A four-tuple (a, b, a*, b*) of storage_uri.BucketStorageUri instances.
r   r   r   s   new_foo)r   object_namer   gs_idempotent_generations   new_bar)r   r  r  urigen)r<   old_gsutil_objectold_gsutil_object2r  gsutil_object2s        r'   _create_multiple_objects#TestIamSet._create_multiple_objects  s     ))T5J5J39 * ;**d6K6K4: + <%%((%11!'(9!:	 & <M
 &&((&22!'(:!;	 ' =N
 = r)   c                 d   U R                  5       u  pnnU R                  SSSU R                  U R                  R                  /5        U R                  SSUR                  /SS9nU R                  SSUR                  /SS9nU R                  XV5        U R                  U R                  S   [        R                  " U5      S   5        U R                  SSUR                  /SS9nU R                  SSUR                  /SS9nU R                  Xx5        U R                  U R                  U5        g	)
.Tests setting a valid IAM on multiple objects.r   rR   rH  r-   Tr   r   r+   Nr  r   r  r  r   rA   r   r  r8   r9   version_specific_urir   	r<   r  r  r  r  r  set_iam_string2iam_string_oldiam_string_old2s	            r'   #test_set_valid_iam_multiple_objects.TestIamSet.test_set_valid_iam_multiple_objects  sI    446M 	NNudD44d6K6K6O6O  ^^UE=3D3D$E26 $ 8NnneUN4F4F%G37 % 9O##NDMM$11!4**^,Z8: ^^	(==> $ N nn	)>>? % O 	##ND##D$:$:NKr)   c                 f   U R                  5       u  pnnU R                  SSSSU R                  U R                  R                  /5        U R                  SSUR                  /SS9nU R                  SSUR                  /SS9nU R                  XV5        U R                  U R                  S   [        R                  " U5      S	   5        U R                  SSUR                  /SS9nU R                  SSUR                  /SS9nU R                  Xx5        U R                  U R                  U5        g
)r  r3  r   rR   rH  r-   Tr   r   r+   Nr  r  s	            r'   1test_set_valid_iam_multithreaded_multiple_objects<TestIamSet.test_set_valid_iam_multithreaded_multiple_objects  sL    446M 	NNeUD$":":!!  ^^UE=3D3D$E26 $ 8NnneUN4F4F%G37 % 9O##NDMM$11!4**^,Z8: ^^	(==> $ N nn	)>>? % O 	##ND##D$:$:NKr)   c                 N   U R                  5       u  pnnU R                  SSSU R                  U R                  R                  /5        U R                  SSUR
                  /SS9nU R                  SSUR
                  /SS9nU R                  SSUR
                  /SS9nU R                  SSUR
                  /SS9nU R                  XV5        U R                  XW5        U R                  XX5        U R                  U R                  S   [        R                  " U5      S   5        g	)
z4Tests set IAM policy on all versions of all objects.r   rR   z-rar-   Tr   r   r+   N)r  r   r  r  r   r  rA   r   r  r8   r9   )	r<   r  r  r  r  r  r  set_iam_string_oldset_iam_string_old2s	            r'   0test_set_valid_iam_multiple_objects_all_versions;TestIamSet.test_set_valid_iam_multiple_objects_all_versions  sA    446MNNueT55t7L7L7P7P  ^^	}99:$ $ PNnn	~::;4 % QO	(==> (  ..	)>>? )  	##ND##NG##NHMM$11!4**^,Z8:r)   c           
      0   U R                  5       nU R                  5       nU R                  SSSSU R                  UR                  SU R                  -  UR                  /SSS9nU R
                  (       a  S	OS
nU R                  XC5        U R                  SSUR                  /SS9nU R                  SSUR                  /SS9nU R                  U R                  S   [        R                  " U5      S   5        U R                  U R                  U5        g)a  Tests fail-fast behavior of iam set.

We initialize two buckets (bucket, bucket2) and attempt to set both along
with a third, non-existent bucket in between, self.nonexistent_bucket_name.

We want to ensure
  1.) Bucket "bucket" IAM policy has been set appropriately,
  2.) Bucket self.nonexistent_bucket_name has caused an error, and
  3.) gsutil has exited and "bucket2"'s IAM policy is unaltered.
r   rR   r  r,   rQ  Tr   r   r  rS  r-   r   r   r+   N)r   r   r  r   rT  rU  r   r  r8   r9   rA   r   r<   r   r   r   r  r  r  s          r'   test_set_errorTestIamSet.test_set_error$  s     F!G^^udB 8 8&**D000'++ +/,-  /F 00 !6O MM-(^^UE6::$>26 $ 8NnneUGKK%@37 % 9O 	MM$11!4**^,Z8: 	##D$:$:OLr)   c           	         U R                  5       nU R                  5       nU R                  SSSU R                  UR                  SU R                  -  UR                  /SSS9nU R
                  (       a  SOS	nU R                  XC5        U R                  SS
UR                  /SS9nU R                  SS
UR                  /SS9nU R                  U R                  S   [        R                  " U5      S   5        U R                  XV5        g)a=  Tests ignoring failure behavior of iam set.

Similar to TestIamSet.test_set_error, except here we want to ensure
  1.) Bucket "bucket" IAM policy has been set appropriately,
  2.) Bucket self.nonexistent_bucket_name has caused an error, BUT
  3.) gsutil has continued and "bucket2"'s IAM policy has been set as well.
r   rR   r[  rQ  Tr   r   r  r	   r-   r   r   r+   N)r   r   r  r   rT  rU  r   r  r8   r9   rA   r  s          r'   test_set_force_errorTestIamSet.test_set_force_errorJ  s     F!G^^udD44fjjD000'++ +/,-  /F 00 !6H MM-(^^UE6::$>26 $ 8NnneUGKK%@37 % 9O 	MM$11!4**^,Z8: 	##NDr)   c                    ^  [        [        SSS9U 4S j5       n[        [        SSS9U 4S j5       nU" 5         U" 5         g)a  Tests fail-fast behavior of multithreaded iam set.

This is testing gsutil iam set with the -m and -r flags present in
invocation.

N.B.: Currently, (-m, -r) behaves identically to (-m, -fr) and (-fr,).
However, (-m, -fr) and (-fr,) behavior is not as expected due to
name_expansion.NameExpansionIterator.next raising problematic e.g. 404
or 403 errors. More details on this issue can be found in comments in
commands.iam.IamCommand._SetIam.

Thus, the following command
  gsutil -m iam set -fr <object_policy> gs://bad_bucket gs://good_bucket

will NOT set policies on objects in gs://good_bucket due to an error when
iterating over gs://bad_bucket.
r_  r   r`  c            	         > TR                  SSSSTR                  STR                  -  TR                  R                  /SSS9n TR
                  (       a  S	OS
nTR                  X5        g )Nr3  r   rR   rH  rQ  Tr   r   r  rS  )r   r  rT  r   r   rU  r   r  s     r'   rd  8TestIamSet.test_set_multithreaded_error.<locals>._Check1  sm    ~~
udD$<$<
d22
2DKKOO -1./  1f '+&>&>{0 
mmM*r)   c                  <  > TR                  TR                  SS9n TR                  TR                  SS9nTR                  SSU R                  /SS9nTR                  SSUR                  /SS9nTR	                  X#5        TR	                  TR
                  U5        g )Nr  r   r   r-   Tr   )r   r   r   r   rA   r   )r  r  r  r  r<   s       r'   rg  8TestIamSet.test_set_multithreaded_error.<locals>._Check2  s    ''4;;1: ( <m((DKK2; ) =n~~ue]5F5F&G48 & :nun6H6H'I59 ' ;o
%%nF
%%d&<&<nMr)   Nri  rk  s   `  r'   test_set_multithreaded_error'TestIamSet.test_set_multithreaded_errorm  sK    ( >3	+ 4	+ >3
N 4
N IIr)   c                    U R                  U R                  SS9nUR                  nU R                  SSU R                  U/5        U R                  SSU/SS9nU R                  SSS[
        R                  " U5      S	   U R                  U/5        U R                  SSU/SS9nU R                  U R                  U5        U R                  U R                  S
   [
        R                  " U5      S   5        g)z'Tests setting a valid IAM on an object.r  r   r   rR   r-   Tr   r  r  r   r+   N)r   r   r   r   r  r8   r9   r  rA   r   r   r  r<   r  
lookup_urir  r  s        r'   ,test_set_valid_iam_single_unversioned_object7TestIamSet.test_set_valid_iam_single_unversioned_object  s    %%/8 & :M ""JNNE5$":":JGH^^UE:$>26 $ 8NNNud

>"6*D,D,Dj  ~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    U R                  U R                  SS9nUR                  nU R                  SSU R                  U/5        U R                  SSU/SS9nU R                  SSS[
        R                  " U5      S	   U R                  U/5        U R                  SSU/SS9nU R                  U R                  U5        U R                  U R                  S
   [
        R                  " U5      S   5        g)z0Tests setting a valid IAM on a versioned object.r  r   r   rR   r-   Tr   r  r  r   r+   N)r   r   r  r   r  r8   r9   r  rA   r   r   r  r  s        r'   *test_set_valid_iam_single_versioned_object5TestIamSet.test_set_valid_iam_single_versioned_object  s    %%/8 & :M 33JNNE5$":":JGH^^UE:$>26 $ 8NNNud

>"6*D,D,Dj  ~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c           	      r   U R                  U R                  SS9nUR                  nU R                  SSSSSU R                  U/5        U R                  SSU/S	S
9nU R                  SSSSSU R
                  U/5        U R                  SSU/S	S
9nU R                  U R                  U5        U R                  U R                  S   [        R                  " U5      S   5        SU R                  R                  -  nU R                  SSSSSU R                  U/5        U R                  SSU/S	S
9nU R                  SSSSSU R
                  U/5        U R                  SSU/S	S
9nU R                  U R                  U5        U R                  U R                  S   [        R                  " U5      S   5        g)zATests setting a valid IAM on a single object with multithreading.r  r   r3  r   rR   r  r,   r-   Tr   r   r+   z%s*N)r   r   r  r   r  r  rA   r   r   r  r8   r9   r   r  s        r'   .test_set_valid_iam_multithreaded_single_object9TestIamSet.test_set_valid_iam_multithreaded_single_object  s   %%/8 & :M 33JNN	ueT2t'?'?LN^^UE:$>26 $ 8NNN	ueT2t'?'?LN~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8: (JNN	ueT2t'?'?LN^^UE:$>26 $ 8NNN	ueT2t'?'?LN~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   )r   r   r  r  r  r  r  r  r   r   r  r  r  r  r  r  ) rC   rD   rE   rF   rG   r   r  r  r  r  r  r  r   skipr  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  rH   r~  r  s   @r'   r  r    s     /:FxM.,8B: ==JK8 L8 ==JK; L;8:*:2))(0L6L8:0$ML!EF/b:(:( :  :r)   r  c                   &   \ rS rSr\R
                  " / SSS9r\R                  " \	R                  " S5      SSS/S	S	S
S9r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R                  R                  \R                  S\R                   " 5       S9S 5       r\R4                  S\R6                  \R6                  S4S jrS rS rS rS r S r!S r"S  r#S! r$S" r%S# r&S$r'g)%TestIamShimi  r   fake_account@gmail.comargs
returncodestdoutfake_dirconfigr-   accountzutf-8)r   r  encoding
RunCommand)r{   c           	      n   [        SS/5         [        SSS.5         U R                  SSS/S	S
9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  use_gcloud_storager  r  hidden_shim_modedry_runr  r  (CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTILCLOUDSDK_ROOT_DIRr   r-   zgs://bucket/objectTreturn_log_handler
infozZGcloud Storage Command: {} storage objects get-iam-policy --format=json gs://bucket/object	r   r   r  joinmessagesr   formatr   _get_gcloud_binary_pathr<   mock_log_handler
info_liness      r'   #test_shim_translates_iam_get_object/TestIamShim.test_shim_translates_iam_get_object  s    	GHJ 
K 6<)" 	  ??55:N2O>B + DYY/88@A
128&22:>3@AK	M	
K 
K	 	
K 
K#   B&A'BB&
B#	B&&
B4c           	      n   [        SS/5         [        SSS.5         U R                  SSS/S	S
9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   r-   zgs://bucketTr'  r)  r*  zSGcloud Storage Command: {} storage buckets get-iam-policy --format=json gs://bucketr+  r0  s      r'   #test_shim_translates_iam_get_bucket/TestIamShim.test_shim_translates_iam_get_bucket  s    	GHJ 
K 6<)" 	  ??55-2H>B + DYY/88@A
*+1622:>,@AK	M	
K 
K	 	
K 
Kr5  c           	      n   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )rR   policy-file	gs://b/o1	gs://b/o2Tr'  r)  r*  zgGcloud Storage Command: {} storage objects set-iam-policy --format=json gs://b/o1 gs://b/o2 policy-filer+  r0  s      r'   #test_shim_translates_iam_set_object/TestIamShim.test_shim_translates_iam_set_object  s    	GHJ 
K 6<)" 	  ??C# + % YY/88@A
>?Ev22:>@@AK	M	
K 
K	 	
K 
Kr5  c           	      n   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )rR   r:  gs://b1gs://b2Tr'  r)  r*  zcGcloud Storage Command: {} storage buckets set-iam-policy --format=json gs://b1 gs://b2 policy-filer+  r0  s      r'   #test_shim_translates_iam_set_bucket/TestIamShim.test_shim_translates_iam_set_bucket'  s    	GHJ 
K 6<)" 	  ???# + % YY/88@A
:;A622:><@AK	M	
K 
K	 	
K 
Kr5  c           	      n   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )rR   rH  r:  r@  z	gs://b2/oTr'  r)  r*  zqGcloud Storage Command: {} storage objects set-iam-policy --format=json --recursive gs://b1 gs://b2/o policy-filer+  r0  s      r'   Ctest_shim_translates_iam_set_mix_of_bucket_and_objects_if_recursiveOTestIamShim.test_shim_translates_iam_set_mix_of_bucket_and_objects_if_recursive8  s    	GHJ 
K 6<)" 	  ??G# + % YY/88@A
HIO22:>J@AK	M	
K 
K	 	
K 
Kr5  c                 *   [        SS/5         [        SSS.5         U R                  [        S5         U R	                  S/ SQ5        S S S 5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       N(= f! , (       d  f       g = f)	Nr  r!  r  r  r$  z/Cannot operate on a mix of buckets and objects.r   )rR   r:  gs://bgs://b/o)r   r   assertRaisesRegexr	   r  r   s    r'   6test_shim_raises_for_iam_set_mix_of_bucket_and_objectsBTestIamShim.test_shim_raises_for_iam_set_mix_of_bucket_and_objectsI  s    	GHJ 
K 6<)" 	 ##=? //%!M
N?		
K 
K? ?		 	
K 
Ks9   BA3A"	A3B"
A0,A33
B	=B
Bc           	      n   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )rR   r  zabc=r:  rH  Tr'  r)  r*  zfGcloud Storage Command: {} storage buckets set-iam-policy --format=json --etag abc= gs://b policy-filer+  r0  s      r'   /test_shim_translates_iam_set_handles_valid_etag;TestIamShim.test_shim_translates_iam_set_handles_valid_etagV  s    	GHJ 
K 6<)" 	  ??A# + % YY/88@A
=>Df22:>?@AK	M	
K 
K	 	
K 
Kr5  c           	      n   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )rR   r  r,   r:  rH  Tr'  r)  r*  zbGcloud Storage Command: {} storage buckets set-iam-policy --format=json --etag= gs://b policy-filer+  r0  s      r'   /test_shim_translates_iam_set_handles_empty_etag;TestIamShim.test_shim_translates_iam_set_handles_empty_etagg  s    	GHJ 
K 6<)" 	  ??=# + % YY/88@A
9:@&22:>;@AK	M	
K 
K	 	
K 
Kr5  c                 (   [        SS/5         [        SSS.5         U R                  S/ SQSS	9nS
R                  UR                  S   5      nU R                  SU5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr  r!  r  r  r$  r   )r   r  r    rH  Tr'  r)  warningz|The shim maps iam ch commands to several gcloud storage commands, which cannot be determined without running gcloud storage.)r   r   r  r,  r-  r   )r<   r1  warning_liness      r'   ,test_shim_warns_with_dry_run_mode_for_iam_ch8TestIamShim.test_shim_warns_with_dry_run_mode_for_iam_chx  s    	GHJ 
K 6<)" 	  ??5+M>B + D 		"2";";I"FGJ		
K 
K	 	
K 
Ks#   BAA2!B2
B 	<B
BNTc           	      4    [         R                  " UUUUUUS9$ )N)envinputr   r  text)r   call)r<   commandrY  stdinr   r  r[  s          r'   _get_run_callTestIamShim._get_run_call  s&     99W ""   r)   c                    SSS/S.SSS/S.SS/S./0nSSS/S.SSS/S./0n[        S	/5         [        R                  " / S
[        R                  " U5      S9n[        R                  " / S
S9nU R
                  X4/U R                  l        [        SSS.5         U R                  S/ SQ5        S S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[        R                  " USS9S9/5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr+   zpreserved-roler    rP   roles/storage.modified-roleuser:deleted-user@example.comzroles/storage.deleted-roler   r  r   r  r  r  r  r  r$  r   )r   #allAuthenticatedUsers:modified-roler  rc  r  zallUsers:deleted-rolerH  storagebucketsget-iam-policygs://b/--format=jsonset-iam-policy-T	sort_keysr^  r   
subprocessCompletedProcessr8   r@   _FAKE_CONFIG_GET_ACCOUNT_PROCESS_mock_subprocess_runside_effectr   r  rQ   call_args_list_MOCK_CONFIG_GET_ACCOUNT_CALLr_  r   r/  )r<   original_policyr1   get_processset_processs        r'   4test_iam_ch_adds_updates_and_deletes_bucket_policies@TestIamShim.test_iam_ch_adds_updates_and_deletes_bucket_policies  s   $"|
 2"$CD
 1"|
	O 	$"|
 2/<
J 
GH	I//a

?(CEk//RAFk

/
//d+ !6<)" 	 	  
 			 t00??

,
,


//
;Y)9o  

//
; $(::jD#I  KB 	# 
J	I	 	 
J	Is%   A+E)E0BE)
E&	"E))
E7c                    SSS/S./0nSSS/S./0nSSSS/S./0nSSSS/S./0n[        S/5         [        R                  " / S[        R                  " U5      S	9n[        R                  " / S[        R                  " U5      S	9n[        R                  " / SS
9nU R
                  XWXg/U R                  l        [        SSS.5         U R                  S/ SQ5        S S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[        R                  " USS9S9U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[        R                  " USS9S9/5        S S S 5        g ! , (       d  f       GN= f! , (       d  f       g = f)Nr+   rb  zuser:test-user1@example.comrP   zuser:test-user2@example.comr   r  r   r  rd  r  r  r$  r   )r   re  r@  rA  rf  rg  rh  zgs://b1/rj  rk  rl  Trm  ro  zgs://b2/rp  )r<   original_policy1original_policy2new_policy1new_policy2get_process1get_process2rz  s           r'   5test_iam_ch_updates_bucket_policies_for_multiple_urlsATestIamShim.test_iam_ch_updates_bucket_policies_for_multiple_urls  sl   156
  	156
  	1/1NO
 K 	1/1NO
 K 
GH	I00a

3C(DFl00a

3C(DFl//RAFk

/
/
/d+
 !6<)" 	 	O	Q		 t00??

,
,


//
;Y):  

//
; $(::kT#J  L 

//
;Y):  

//
; $(::kT#J  L'B 	' 
J	I	 	 
J	Is%   BG>	G,DG>,
G;	6G>>
Hc                    SSS/S./0nSSSS/S./0n[        S/5         [        R                  " / S[        R                  " SS	S
./5      S9n[        R                  " / S[        R                  " U5      S9n[        R                  " / SS9nU R
                  X4U/U R                  l        [        SSS.5         U R                  S/ SQ5        S S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSS/5      U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[        R                  " USS9S9/5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr+   rb  r    rP   r   r  r   rI  cloud_objecturltyper  rd  r  r  r$  r   r   re  rI  rf  ls--jsonobjectsrh  rj  rk  rl  Trm  ro  rp  )r<   rx  r1   
ls_processry  rz  s         r'   #test_iam_ch_updates_object_policies/TestIamShim.test_iam_ch_updates_object_policies  s   1"|
 O 	1/<
 J 
GH	I..B:;6:jj:D;IC1 B2 734j //a

?(CEk//RAFk

/
/
/d+ !6<)" 	 	L	N		 t00??

,
,


//
;Y
  

//
;Y):  

//
; $(::jD#I  KB 	+ 
J	I	 	 
J	Is%   BF1:F CF1 
F.	*F11
F?c                 P   SSS/S./0n[        S/5         [        R                  " / S[        R                  " SSS	.S
SS	.SSS	.SSS	./5      S9n[        R                  " / S[        R                  " U5      S9n[        R                  " / SS9nU R
                  U/X4/S-  -   U R                  l        [        SSS.5         U R                  S/ SQ5        S S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSS
S/5      U R                  [        R                  " S5      SSSS
S/[         R"                  S 9U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[         R"                  S 9/5        S S S 5        g ! , (       d  f       GN5= f! , (       d  f       g = f)!Nr+   zmodified-roler    rP   r  r   zgs://b/dir/prefixr  zgs://b/dir/:r  zgs://b/dir2/zgs://b/dir2/or  rd  r_  r  r  r$  r   )r   rH  re  rH  rf  r  r  rH  ri  r  rh  rj  rk  rl  ro  )r   rq  rr  r8   r@  rs  rt  ru  r   r  rQ   rv  rw  r_  r   r/  r   ANY)r<   rx  r  ry  rz  s        r'   Etest_iam_ch_expands_urls_with_recursion_and_ignores_container_headersQTestIamShim.test_iam_ch_expands_urls_with_recursion_and_ignores_container_headersP  sp    	#"|
 O 
GH	I..B:;6:jj:G;CC1 ;I;I31 ;I;C31 ;J;I31B2 734j //a

?(CEk//RAFk00*
=
$q
() + !6<)" 	 	I	K		 t00??

,
,


//
;Yi  

//
;Y)>?  

//
; $(88  - 

//
;Y)?O  

//
; $(88  -/ B  	= 
J	I,	 	- 
J	Is%   B,HHD%H
H	H
H%c                    [        S/5         [        R                  " / SSS9n[        R                  " / SSS9nX/U R                  l        [        SS	S
.5         U R                  [        S5         U R                  S/ SQ5        S S S 5        U R                  U R                  R                  S5        S S S 5        S S S 5        g ! , (       d  f       NE= f! , (       d  f       N(= f! , (       d  f       g = f)Nr  r   r  r  r   	An error.r  r  r   r  r  r$  r   r  ri   )r   rq  rr  rt  ru  r   rJ  r	   r  rQ   
call_count)r<   get_account_processr  s      r'   test_iam_ch_raises_ls_error'TestIamShim.test_iam_ch_raises_ls_error  s    	GH	I&77a(@B..B:;6ACj 0C.Od+ 6<)" 	 ##$4kB
//NP C 	22==qA	 
J	I CB		 	 
J	Is<   AC'C1C.C4C'
CC
C$	 C''
C5c           
      N   [        S/5         [        R                  " / SSS9n[        R                  " / S[        R                  " SSS./5      S9n[        R                  " / SS	S
9nXU/U R
                  l        [        SSS.5         U R                  [        S	5         U R                  S/ SQ5        S S S 5        U R                  U R
                  R                  S5        S S S 5        S S S 5        g ! , (       d  f       NE= f! , (       d  f       N(= f! , (       d  f       g = f)Nr  r   r  r  rI  r  r  r   r  r  r  r  r$  r   r  r_  r   rq  rr  r8   r@  rt  ru  r   rJ  r	   r  rQ   r  )r<   r  r  ry  s       r'   test_iam_ch_raises_get_error(TestIamShim.test_iam_ch_raises_get_error  s   	GH	I&77a(@B..B:;6:jj:D;IC1 B2 734j //R;<7BDk ;/d+ !6<)" 	 ##$4kB
//NP C 	22==qA	! 
J	I( CB		 	! 
J	Is<   A<D	D C45.D#D4
D>D
D	D
D$c           
      z   [        S/5         [        R                  " / SSS9n[        R                  " / S[        R                  " SSS./5      S9n[        R                  " / SSS9n[        R                  " / S	S
S9nXX4/U R
                  l        [        SSS.5         U R                  [        S
5         U R                  S/ SQ5        S S S 5        U R                  U R
                  R                  S5        S S S 5        S S S 5        g ! , (       d  f       NE= f! , (       d  f       N(= f! , (       d  f       g = f)Nr  r   r  r  rI  r  r  z{"bindings": []}r   r  r  r  r  r$  r   r  r   r  )r<   r  r  ry  rz  s        r'   test_iam_ch_raises_set_error(TestIamShim.test_iam_ch_raises_set_error  s4   	GH	I&77a(@B..B:;6:jj:D;IC1 B2 734j //R;<7IKk //R;<7BDk ;/d+ !6<)" 	 ##$4kB
//NP C 	22==qA	' 
J	I. CB		 	' 
J	Is<   BD,D6D
.D9D,

DD
D)	%D,,
D:c                 
   SSS/S./0nSSSS/S./0n[        S/5         [        R                  " / SSS	9n[        R                  " / SS
S	9nU R                  X4/U R                  l        [        SSS.5         U R                  S/ SQSSS9nS S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSS/5      U R                  [        R                  " S5      SSSS/5      /5        SR                  WR                  S   5      nU R!                  SU5        U R!                  S
U5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr+   rb  r    rP   r   r  r   r  r  Another error.r  r  r$  r   r   r[  re  r;  r<  Tdebugr(  rf  r  r  r;  r<  r)  error)r   rq  rr  rs  rt  ru  r   r  rQ   rv  rw  r_  r   r/  r,  r-  r   )r<   rx  r1   r  ls_process2r1  error_liness          r'   !test_iam_ch_continues_on_ls_error-TestIamShim.test_iam_ch_continues_on_ls_error  s   1"|
 O 	1/<
 J 
GH	I..B:;6ACj //R;<7GIk 
/
//d+ !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y 
B 
	 II.77@Ak
mmK-
mm$k2O 
J	I	 	 
J	Is%   AE48E#CE4#
E1	-E44
Fc                    SSS/S./0nSSSS/S./0n[        S/5         [        R                  " / S[        R                  " SS	S
./5      S9n[        R                  " / SSS9n[        R                  " / SSS9nU R
                  X4U/U R                  l        [        SSS.5         U R                  S/ SQSSS9nS S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSS/5      U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSS/5      /5        SR!                  WR"                  S   5      nU R%                  SU5        U R%                  SU5        S S S 5        g ! , (       d  f       GN= f! , (       d  f       g = f) Nr+   rb  r    rP   r   r  r   r;  r  r  r  r   r  r  r  r  r  r$  r   r  Tr  rf  r  r  r  rh  rj  r<  r)  r  r   rq  rr  r8   r@  rs  rt  ru  r   r  rQ   rv  rw  r_  r   r/  r,  r-  r   )r<   rx  r1   r  ry  r  r1  r  s           r'   "test_iam_ch_continues_on_get_error.TestIamShim.test_iam_ch_continues_on_get_error  s    1"|
 O 	1/<
 J 
GH	I..B:;6:jj:E;IC1 B2 734j //R;<7BDk //R;<7GIk 
/
/
/d+ !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y);  

//
;Y B 	  II.77@Ak
mmK-
mm$k2c 
J	I"	 	# 
J	Is%   BG'F<<C7G<
G	G
Gc                    SSS/S./0nSSSS/S./0n[        S/5         [        R                  " / S[        R                  " SS	S
./5      S9n[        R                  " / S[        R                  " U5      S9n[        R                  " / SSS9n[        R                  " / SSS9nU R
                  X4XV/U R                  l        [        SSS.5         U R                  S/ SQSSS9nS S S 5        U R                  U R                  R                  U R                  U R                  [        R                  " S5      SSSS/5      U R                  [        R                  " S5      SSSSS/5      U R                  [        R                  " S5      SSSSS/[        R                  " USS9S 9U R                  [        R                  " S5      SSSS!/5      /5        S"R!                  WR"                  S#   5      nU R%                  SU5        U R%                  SU5        S S S 5        g ! , (       d  f       GNC= f! , (       d  f       g = f)$Nr+   rb  r    rP   r   r  r   r;  r  r  r  r   r  r  r  r  r  r$  r   r  Tr  rf  r  r  r  rh  rj  rk  rl  rm  ro  r<  r)  r  r  )	r<   rx  r1   r  ry  rz  r  r1  r  s	            r'   "test_iam_ch_continues_on_set_error.TestIamShim.test_iam_ch_continues_on_set_errorW  s   1"|
 O 	1/<
 J 
GH	I..B:;6:jj:E;IC1 B2 734j //a

?(CEk//R;<7BDk //R;<7GIk 
/
/
/d+
 !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y);  

//
; $(::jD#I  K 

//
;Y 'B 	2 II.77@Ak
mmK-
mm$k2u 
J	I(	 	) 
J	Is%   B1H4H"&D3H4"
H1	,H44
Ir%   )(rC   rD   rE   rF   rq  rr  rs  r   r\  r   r/  rw  patchr   r   
IamCommandMockr3  r7  r=  rB  rE  rK  rN  rQ  rV  r  PIPEr_  r{  r  r  r  r  r  r  r  r  r  rH   r%   r)   r'   r  r    s   %/%@%@!$<&>""&))

+
+J
75
 # ::S^^\tyy{CM DM ::S^^\tyy{CM DM ::S^^\tyy{CM DM  ::S^^\tyy{CM DM  ::S^^\tyy{CM DM  ::S^^\tyy{C
O D
O ::S^^\tyy{CM DM  ::S^^\tyy{CM DM  ::S^^\tyy{C D$ %??%?? 6	pH	T5	nF	PB$B4B:43l>3@G3r)   r  )NN)GrG   
__future__r   r   r   r   collectionsr   r8   osrq  gslib.commandsr   gslib.exceptionr	   gslib.project_idr
   gslib.tests.testcaseteststestcase)gslib.tests.testcase.integration_testcaser   r   gslib.tests.utilr   r  r   r   r   "gslib.third_party.storage_apitoolsr   apitools_messagesgslib.utilsr   gslib.utils.constantsr   gslib.utils.iam_helperr   r   r   r   r   r   r   gslib.utils.retry_utilr   sixr   r   	six.movesr   PolicyBindingsValueListEntryr:   r  r  r.  r  r  r  r  r(   r3   GsUtilIntegrationTestCaser5   GsUtilUnitTestCaserJ   r   r  ShimUnitTestBaser  r%   r)   r'   <module>r     s   - & %  ' #  	   , . ' ' ? @ 8 1 2 % W ! & > ; ? / 2 0 ( % VV_	5 6 66 3 ),GG 9 5 B 4 '- <07;; 7  $%/0{AX00 {A 1 &{A| $%/0CA" CA 1 &CAL $%/0R	:# R	: 1 &R	:ju
3(++ u
3r)   