
    B                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSK	J
r
  SS	KJr  SS
KJr  SSKJs  Jr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  Sr\" S5      \" S5       " S S\R@                  5      5       5       r!\" S5      \" S5       " S S\R@                  5      5       5       r" " S S\RF                  5      r$ " S S\RJ                  5      r&g)z"Integration tests for kms command.    )absolute_import)print_function)division)unicode_literalsN)randint)mock)AccessDeniedException)PopulateProjectId)SkipForJSON)	SkipForS3)
SkipForXML)ObjectToURI)SetBotoConfigForTest)SetEnvironmentForTest)Retry)	shim_utilOprojects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-keyz6gsutil does not support KMS operations for S3 buckets.c                   t   ^  \ rS rSrSrU 4S jr\" \SSS9SS j5       rSS jr	S	 r
S
 rS rS rS rSrU =r$ )TestKmsSuccessCases*   z&Integration tests for the kms command.c                    > [         [        U ]  5         U R                  R	                  [        S 5      [        R                  R                  [        R                  R                  S9U l
        g )N)location)superr   setUpkms_apiCreateKeyRingr
   testcaseKmsTestingResourcesKEYRING_NAMEKEYRING_LOCATIONkeyring_fqn)self	__class__s    'platform/gsutil/gslib/tests/test_kms.pyr   TestKmsSuccessCases.setUp/   sV    	
t*, ||11$$$11-->> 2 @D          )triestimeout_secsc                    [         R                  R                  [        SS5      [        SS5      [        SS5      4-  nU R                  R                  U R                  U5      nU R                  R                  U5      nUR                  (       a-  UR                  R                  5         UR                  (       a  M-  U R                  R                  X45        SSSU/nU(       a  UR                  SU/5        U R                  USS9nU R                  USS9nU R                  S	[        S 5      < S
U< 3U5        U R                  S[        S 5      < SU< S3U5        g )Nr   	   kms	authorize-k-pTreturn_stdoutzAuthorized project z" to encrypt and decrypt with key:
zProject z9 was already authorized to encrypt and decrypt with key:
.)r   r   MUTABLE_KEY_NAME_TEMPLATEr   r   CreateCryptoKeyr!   GetKeyIamPolicybindingspopSetKeyIamPolicyextend	RunGsUtilassertInr
   )r"   specified_projectkey_namekey_fqn
key_policyauthorize_cmdstdout1stdout2s           r$   DoTestAuthorize#TestKmsSuccessCases.DoTestAuthorize9   s0    ++EE1wq!}gamI5 5H ll**4+;+;XFG --g6J


 


LL  5Kw7MD"345nn]$n?Gnn]$n?GMM	4	 '	+,35 	MM)$/
:<CEr&   c                     SS/nU(       a  UR                  SU/5        U R                  USS9nU R                  US5        g )Nr-   serviceaccountr0   Tr1   z4[^@]+@gs-project-accounts\.iam\.gserviceaccount\.com)r:   r;   assertRegex)r"   r=   serviceaccount_cmdstdouts       r$   DoTestServiceaccount(TestKmsSuccessCases.DoTestServiceaccountV   sL    !12'8 9:^^.d^CFVLNr&   c                 $    U R                  5         g N)rD   r"   s    r$   $testKmsAuthorizeWithoutProjectOption8TestKmsSuccessCases.testKmsAuthorizeWithoutProjectOption`   s    r&   c                 4    U R                  [        S 5      S9  g N)r=   )rD   r
   rO   s    r$   !testKmsAuthorizeWithProjectOption5TestKmsSuccessCases.testKmsAuthorizeWithProjectOptionc   s    +<T+BCr&   c                 $    U R                  5         g rN   )rK   rO   s    r$   )testKmsServiceaccountWithoutProjectOption=TestKmsSuccessCases.testKmsServiceaccountWithoutProjectOptionf   s    r&   c                 4    U R                  [        S 5      S9  g rS   )rK   r
   rO   s    r$   &testKmsServiceaccountWithProjectOption:TestKmsSuccessCases.testKmsServiceaccountWithProjectOptioni   s    0A$0GHr&   c           	         U R                  5       nU R                  R                  U R                  [        R
                  R                  5      nSS[        U5      /nU R                  USS9nU R                  S[        U5      -  U5        U R                  SSSU[        U5      /SS9nU R                  S[        U5      -  U5        U R                  USS9nU R                  S[        U5      < S	U< 3U5        U R                  SSS
[        U5      /SS9nU R                  S[        U5      -  U5        U R                  USS9nU R                  S[        U5      -  U5        g )Nr-   
encryptionTr1   z'Bucket %s has no default encryption keyr/   z(Setting default KMS key for bucket %s...zDefault encryption key for z:
-dz)Clearing default encryption key for %s...)
CreateBucketr   r5   r!   r   r   CONSTANT_KEY_NAMEsurir;   r<   )r"   
bucket_urir?   encryption_get_cmdrJ   s        r$   testKmsEncryptionFlow)TestKmsSuccessCases.testKmsEncryptionFlowl   st   
 ""$Jll**(66HHJGtJ/?@ ^^.d^CFMM;d:>NN
 ^^	dG	j		  F 	MM<tJ?OO ^^.d^CFMM04Z0@'J ^^	dD$45T  KFMM3d:6FFP ^^.d^CFMM;d:>NNr&   )r!   rN   )__name__
__module____qualname____firstlineno____doc__r   r   AssertionErrorrD   rK   rP   rT   rW   rZ   rd   __static_attributes____classcell__)r#   s   @r$   r   r   *   sS     /@ 	qq1E 2E8ND I' 'r&   r   z?These tests only check for failures when the XML API is forced.c                   H    \ rS rSrSr/ SQrSrS rS rS r	S r
S	 rS
 rSrg)#TestKmsSubcommandsFailWhenXmlForced   zETests that kms subcommands fail early when forced to use the XML API.))Credentialsgs_oauth2_refresh_tokenN)rq   gs_service_client_idN)rq   gs_service_key_fileN)rq   gs_service_key_file_passwordN)rq   gs_access_key_iddummykey)rq   gs_secret_access_keydummysecretr   c                     [        U R                  5         U R                  USSS9nU R                  SU5        S S S 5        g ! , (       d  f       g = f)Nr(   T)expected_statusreturn_stderrz'The "kms" command can only be used with)r   boto_config_hmac_auth_onlyr;   r<   )r"   
subcommandstderrs      r$   6DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfigZTestKmsSubcommandsFailWhenXmlForced.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig   s?    	d==	>~~j!4~Pf
mm=vF 
?	>	>s   $A
Ac                 *    U R                  / SQ5        g )N)r-   r]   gs://dummybucketr   rO   s    r$   4testEncryptionFailsWhenXmlForcedFromHmacInBotoConfigXTestKmsSubcommandsFailWhenXmlForced.testEncryptionFailsWhenXmlForcedFromHmacInBotoConfig   s    ??13r&   c                 8    U R                  SSS[        S/5        g )Nr-   r]   r/   r   r   _DUMMY_KEYNAMErO   s    r$   9testEncryptionDashKFailsWhenXmlForcedFromHmacInBotoConfig]TestKmsSubcommandsFailWhenXmlForced.testEncryptionDashKFailsWhenXmlForcedFromHmacInBotoConfig   s     ??	dN4FGIr&   c                 *    U R                  / SQ5        g )N)r-   r]   r^   r   r   rO   s    r$   9testEncryptionDashDFailsWhenXmlForcedFromHmacInBotoConfig]TestKmsSubcommandsFailWhenXmlForced.testEncryptionDashDFailsWhenXmlForcedFromHmacInBotoConfig   s    ??79r&   c                 *    U R                  / SQ5        g )N)r-   rG   r   r   rO   s    r$   8testServiceaccountFailsWhenXmlForcedFromHmacInBotoConfig\TestKmsSubcommandsFailWhenXmlForced.testServiceaccountFailsWhenXmlForcedFromHmacInBotoConfig   s    ??57r&   c                 8    U R                  SSS[        S/5        g )Nr-   r.   r/   r   r   rO   s    r$   3testAuthorizeFailsWhenXmlForcedFromHmacInBotoConfigWTestKmsSubcommandsFailWhenXmlForced.testAuthorizeFailsWhenXmlForcedFromHmacInBotoConfig   s     ??	T>3EFHr&    N)rf   rg   rh   ri   rj   r}   r   r   r   r   r   r   r   rl   r   r&   r$   ro   ro      s8     N	 <.G
3I97Hr&   ro   c                   "   \ rS rSrSr\R                  " S5      \R                  " S5      \R                  " S5      \R                  " S5      S 5       5       5       5       r\R                  " S5      \R                  " S5      \R                  " S5      \R                  " S5      S 5       5       5       5       r\R                  " S5      \R                  " S5      \R                  " S5      \R                  " S5      S	 5       5       5       5       r	S
r
g)TestKmsUnitTests   zUnit tests for gsutil kms.Dgslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccountz7gslib.cloud_api_delegator.CloudApiDelegator.PatchBucket$gslib.kms_api.KmsApi.GetKeyIamPolicy$gslib.kms_api.KmsApi.SetKeyIamPolicyc           	         U R                  5       n/ UR                  l        SUR                  l        U R	                  SSS[
        [        U5      /SS9nU R                  SU5        U R                  UR                  5        g )Ndummy@google.comr-   r]   r/   Tr1   "Setting default KMS key for bucket)
r_   return_valuer7   email_address
RunCommandr   ra   r<   
assertTruecalledr"   mock_set_key_iam_policymock_get_key_iam_policymock_patch_bucket mock_get_project_service_accountrb   rJ   s          r$   7testEncryptionSetKeySucceedsWhenUpdateKeyPolicySucceedsHTestKmsUnitTests.testEncryptionSetKeySucceedsWhenUpdateKeyPolicySucceeds   s     ""$J46((1BT$11?__dNZ "  F 	MM6?OO%,,-r&   c           
         U R                  5       n[        S5      Ul        SUR                  l        U R                  SSS[        S[        U5      /SS9nU R                  S	U5        U R                  UR                  5        g )
NPermission deniedr   r-   r]   r/   -wTr1   r   )r_   r	   side_effectr   r   r   r   ra   r<   r   r   r   s          r$   CtestEncryptionSetKeySucceedsWhenUpdateKeyPolicyFailsWithWarningFlagTTestKmsUnitTests.testEncryptionSetKeySucceedsWhenUpdateKeyPolicyFailsWithWarningFlag   s     ""$J*?+'BT$11?__dNDZ "  F 	MM6?OO%,,-r&   c           	      4   U R                  5       n[        S5      Ul        SUR                  l         U R                  SSS[        [        U5      /SS9nU R                  S5        g ! [         a&  nU R                  SUR                  5         S nAg S nAff = f)	Nr   r   r-   r]   r/   Tr1   z*Did not get expected AccessDeniedException)r_   r	   r   r   r   r   r   ra   failr<   reason)r"   r   r   r   r   rb   rJ   es           r$   CtestEncryptionSetKeyFailsWhenUpdateKeyPolicyFailsWithoutWarningFlagTTestKmsUnitTests.testEncryptionSetKeyFailsWhenUpdateKeyPolicyFailsWithoutWarningFlag   s     ""$J*?+'BT$11?3
,nz"$  f ii<=  3
mm'223s   3A' '
B1BBr   N)rf   rg   rh   ri   rj   r   patchr   r   r   rl   r   r&   r$   r   r      s   "::LN::GH::45::45. 6 6 IN
. ::LN::GH::45::45. 6 6 IN
. ::LN::GH::45::453 6 6 IN
3r&   r   c                   \   \ rS rSrSr\R                  " S5      \R                  " S5      \R                  " S5      S 5       5       5       rS r\R                  " S5      \R                  " S5      \R                  " S5      S 5       5       5       r	S	 r
\R                  " S5      S
 5       rSrg)TestKmsUnitTestsWithShimi  z%Unit tests for gsutil kms using shim.r   r   r   c           
         ASUR                   l        / UR                   l        [        SS/5         [	        SSS.5         U R                  SSS	S
S[        /SS9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      [        5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   GSUtiluse_gcloud_storageTruer   hidden_shim_modedry_runr   fake_dir(CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTILCLOUDSDK_ROOT_DIRr-   r.   r0   foor/   Treturn_log_handler
infozRGcloud Storage Command: {} storage service-agent --project foo --authorize-cmek {})r   r   r7   r   r   r   r   joinmessagesr<   formatr   _get_gcloud_binary_path)r"   r   r   r   mock_log_handler
info_liness         r$   $test_shim_translates_authorize_flags=TestKmsUnitTestsWithShim.test_shim_translates_authorize_flags  s     	 BT$11?46((1	GHJ 
K 6<)" 	  ??53
 ?C + D YY/88@A
11711*=~2O			
K 
K	 	
K 
Ks$   C A3C3C
C	C
C#c           
         U R                  5       n[        SS/5         [        SSS.5         U R                  SSS[	        U5      /S	S
9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      [	        U5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   r   r   r   r   r-   r]   r^   Tr   r   r   zSGcloud Storage Command: {} storage buckets update --clear-default-encryption-key {}r_   r   r   r   ra   r   r   r<   r   r   r   r"   rb   r   r   s       r$   )test_shim_translates_clear_encryption_keyBTestKmsUnitTestsWithShim.test_shim_translates_clear_encryption_key&  s    ""$J	GHJ 
K 6<)" 	  ??L$Z(89# + % YY/88@A
11711*=Z 2"#-		/	
K 
K	 	
K 
Ks#   C
A;B9(C
9
C	C


Cc                    U R                  5       nASUR                  l        / UR                  l        [	        SS/5         [        SSS.5         U R                  SSS	S
[        [        U5      /SS9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      [        [        U5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   r   r   r   r   r   r-   r]   r   r/   Tr   r   r   zQGcloud Storage Command: {} storage buckets update  --default-encryption-key {} {})r_   r   r   r7   r   r   r   r   ra   r   r   r<   r   r   r   )r"   r   r   r   rb   r   r   s          r$   *test_shim_translates_update_encryption_keyCTestKmsUnitTestsWithShim.test_shim_translates_update_encryption_key9  s    ""$JBT$11?46((1	GHJ 
K 6<)" 	  ??L$n$&# + % YY/88@A
//5v11*=~Z 0"#-		/	
K 
K	 	
K 
Ks%   C8BC'C8'
C5	1C88
Dc           
         U R                  5       n[        SS/5         [        SSS.5         U R                  SS[	        U5      /SS	9nS
R                  UR                  S   5      nU R                  SR                  [        R                  " S5      [	        U5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   r   r   r   r   r-   r]   Tr   r   r   zGcloud Storage Command: {} storage buckets describe --format=value[separator=": "](name, encryption.defaultKmsKeyName.yesno(no="No default encryption key.")) --raw {}r   r   s       r$   ,test_shim_translates_displays_encryption_keyETestKmsUnitTestsWithShim.test_shim_translates_displays_encryption_keyV  s    ""$J	GHJ 
K 6<)" 	  ??L$z"23 + NYY/88@A
 y@@L#J/12<	>	
K 
K	 	
K 
Ks#   C	A:B8'C	8
C	C		
Cc           	         SUR                   l        [        SS/5         [        SSS.5         U R	                  S/ SQS	S
9nSR                  UR                  S   5      nU R                  SR                  [        R                  " S5      5      U5        S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   r   r   r   r   r   r-   )rG   r0   r   Tr   r   r   z>Gcloud Storage Command: {} storage service-agent --project foo)r   r   r   r   r   r   r   r<   r   r   r   )r"   r   r   r   s       r$   +test_shim_translates_serviceaccount_commandDTestKmsUnitTestsWithShim.test_shim_translates_serviceaccount_commandi  s     CU$11?	GHJ 
K 6<)" 	  ??5+J>B + D YY/88@A
#V11*=?@J	L	
K 
K	 	
K 
Ks#   B7A'B&B7&
B4	0B77
Cr   N)rf   rg   rh   ri   rj   r   r   r   r   r   r   r   rl   r   r&   r$   r   r     s    -::LN::45::45 6 6N8/& ::LN::45::45/ 6 6N/2>& ::LNLNLr&   r   )'rj   
__future__r   r   r   r   osrandomr   unittestr   gslib.cloud_apir	   gslib.project_idr
   gslib.tests.testcasetestsr   )gslib.tests.testcase.integration_testcaser   r   r   gslib.tests.utilr   ra   r   r   gslib.utils.retry_utilr   gslib.utilsr   r   GsUtilIntegrationTestCaser   ro   GsUtilUnitTestCaser   ShimUnitTestBaser   r   r&   r$   <module>r      s    ) & %  ' 	   1 . ' ' A ? @ 0 1 2 ( !: CDDEg(<< g F EgT CDNO'H(*L*L 'H P E'HT>3x22 >3ByLx88 yLr&   