
    2                         S r SSKJr  SSKJr  SSKJr  SSKJr  SSKrSSKJr  SSK	J
r   " S	 S
\5      r " S S\5      r " S S\5      rS rg)z7Contains helper objects for changing and deleting ACLs.    )absolute_import)print_function)division)unicode_literalsN)CommandException)storage_v1_messagesc                        \ rS rSrSrSrSrSrg)
ChangeType   UserGroupProject N)__name__
__module____qualname____firstlineno__USERGROUPPROJECT__static_attributes__r       )platform/gsutil/gslib/utils/acl_helper.pyr
   r
      s    	$
%'r   r
   c                       \ rS rSrSrSS/rSS/rSS/rS	/rS
/r	\\-   \-   \-   \	-   r
SrSr\\4rSrSrSrSrSrSSSSSSSS.rS rS rS rS rS rS rS rS rS rSrg )!	AclChange"   z6Represents a logical change to an access control list.AllAuthenticatedUsersAllUsersUserById	GroupByIdUserByEmailGroupByEmailGroupByDomainr   allUsersallAuthenticatedUsers)zproject-editors-zproject-owners-zproject-viewers-zgroup-zuser-zdomain-zproject-READERWRITEROWNER)RWFCOREADWRITEFULL_CONTROLc                 `    SU l         Xl        U R                  X5        U R                  5         g)a$  Creates an AclChange object.

Args:
  acl_change_descriptor: An acl change as described in the "ch" section of
                         the "acl" command's help.
  scope_type: Either ChangeType.USER or ChangeType.GROUP or
              ChangeType.PROJECT, specifying the extent of the scope.
 N)
identifierraw_descriptor_Parse	_Validate)selfacl_change_descriptor
scope_types      r   __init__AclChange.__init__@   s(     DO/KK%2NNr   c                 d    SR                  U R                  U R                  U R                  5      $ )NzAclChange<{0}|{1}|{2}>)formatr8   permr2   r6   s    r   __str__AclChange.__str__O   s(    #**4??DII+/??< <r   c                 
   S nUR                  S5      S:w  a  [        SR                  U5      5      eUR                  S5      u  pEUR	                  5       nXPR
                  ;   a  U R
                  U   U l        OXPl        U" U5      nUS:X  a  SR                  U5      U l        X@l        gUS;   a  SR                  X&5      U l        X@l        gUS	:X  a  S	U l        gUS
:X  a  S
U l        gUS:X  a  SU l        X@l        gX@l        g)z Parses an ACL Change descriptor.c                     SSSSSSS.nUR                  5        H3  u  p#[        R                  " X0[        R                  5      (       d  M1  Us  $    g )Nz!^(AllAuthenticatedUsers|AllAuth)$z^(AllUsers|All)$z^.+@.+\..+$z^[0-9A-Fa-f]{64}$z^[^@]+\.[^@]+$z(owners|editors|viewers)\-.+$)r   r   EmailIdDomainr   )itemsrematch
IGNORECASE)textre_maptype_stringregexs       r   _ClassifyScopeIdentifier2AclChange._Parse.<locals>._ClassifyScopeIdentifierV   sK    #G(!$%5f !'
+88E//
 !/r   :   z%{0} is an invalid change description.rE   z{0}ByDomain)rC   rD   z{0}By{1}r   r   r   N)	countr   r<   splitupperpermission_shorthand_mappingr=   r8   r2   )r6   change_descriptorr8   rN   scope_string
perm_tokenscope_classs          r   r4   AclChange._ParseS   s    s#q(
1
8
89J
KM M  166s;L!!#J66633J?dii*<8Kh &,,Z8do$o		'"))*Bdo$o	/	//do	
	""do			!!do$o %or   c                   ^  U 4S jnT R                   T R                  ;  a!  U" SR                  T R                   5      5        T R                   T R                  ;   a2  T R                  (       a!  U" SR                  T R                   5      5        T R                   T R
                  ;   a2  T R                  (       d!  U" SR                  T R                   5      5        T R                   T R                  ;   a2  T R                  (       d!  U" SR                  T R                   5      5        T R                   T R                  ;   a2  T R                  (       d!  U" SR                  T R                   5      5        T R                  T R                  R                  5       ;  aJ  SR                  [        T R                  R                  5       5      5      nU" SR                  U5      5        g	g	)
z$Validates a parsed AclChange object.c                 N   > [        SR                  TR                  U 5      5      e)Nz!{0} is not a valid ACL change
{1})r   r<   r3   )msgr6   s    r   _ThrowError(AclChange._Validate.<locals>._ThrowError   s)    AHH


s$ % %r   z{0} is not a valid scope typez{0} requires no argumentsz{0} requires an idz{0} requires an email addressz{0} requires domainz, zAllowed permissions are {0}N)r8   scope_typesr<   public_scopesr2   	id_scopesemail_scopesdomain_scopesr=   rU   valuesjoinset)r6   r^   permss   `  r   r5   AclChange._Validate   sI   % d...188IJ$,,,-44T__EF$..(&--doo>?$+++DOO188IJ$,,,T__'..t?@yy99@@BBiiD==DDFGHe/66u=> Cr   c              #     #    U GH  nU R                   S;   a1  UR                  (       a   U R                  UR                  :X  a  Uv   ME  U R                   S;   a1  UR                  (       a   U R                  UR                  :X  a  Uv   M  U R                   S:X  a1  UR                  (       a   U R                  UR                  :X  a  Uv   M  U R                   S:X  aW  UR
                  (       aF  U R                  UR
                  R                  < SUR
                  R                  < 3:X  a  Uv   GM.  U R                   S:X  a=  UR                  R                  5       U R                  R                  5       :X  a  Uv   GM{  U R                   S:X  d  GM  UR                  R                  5       U R                  R                  5       :X  d  GM  Uv   GM     g7f)	a6  Generator that yields entries that match the change descriptor.

Args:
  current_acl: A list of apitools_messages.BucketAccessControls or
               ObjectAccessControls which will be searched for matching
               entries.

Yields:
  An apitools_messages.BucketAccessControl or ObjectAccessControl.
)r   r    r!   r"   r#   r   -r   r   N)r8   entityIdr2   emaildomainprojectTeamteamprojectNumberentitylowerpublic_entity_all_userspublic_entity_all_auth_usersr6   current_aclentrys      r   _YieldMatchingEntriesAclChange._YieldMatchingEntries   s<     
//6
65>>
//U^^
+OO>>KKDOOu{{:OO.5<<OOu||+OOy(U->->OO##U%6%6%D%D F FOOz)LL D$@$@$F$F$HHOO66LL D$E$E$K$K$MM' s   FG4G
Gc                    U R                   S;   a  U R                  U R                  -   $ U R                   S;   a  U R                  U R                  -   $ U R                   S:X  a  U R                  U R                  -   $ U R                   S:X  a  U R
                  U R                  -   $ U R                   S:X  a  U R                  $ U R                   S:X  a  U R                  $ [        SU R                   -  5      e)z3Gets an appropriate entity string for an ACL grant.)r   r!   )r    r"   r   r#   r   r   z.Add entry to ACL got unexpected scope type %s.)	r8   user_entity_prefixr2   group_entity_prefixproject_entity_prefixdomain_entity_prefixrv   ru   r   r>   s    r   	GetEntityAclChange.GetEntity   s    55$$t66	9	9%%77	I	%''$//99	O	+&&88	3	3...	J	&)))M!__- . .r   c                 2   U R                  5       nU" U R                  US9nU R                  S;   a  U R                  Ul        OCU R                  S;   a  U R                  Ul        O!U R                  S:X  a  U R                  Ul        UR                  U5        g)zAdds an entry to current_acl.)rolers   )r   r    r   rk   r#   N)r   r=   r8   r2   rm   rn   ro   append)r6   rx   entry_classrs   ry   s        r   	_AddEntryAclChange._AddEntry   ss    ^^FTYYv6E>>en	;	;OOek	O	+__elur   c                 j    U H  nUR                   s  $    [        R                  " 5       R                   $ )N)	__class__apitools_messagesObjectAccessControl)r6   rx   	acl_entrys      r   _GetEntriesClassAclChange._GetEntriesClass   s/     	    ! 002<<<r   c                 0   UR                  SX0R                  U5        U R                  S:X  aJ  US:X  a3  UR                  5       (       a  UR	                  SU R                  U5        gUS:X  a  [        S5      eU R                  U5      n[        U R                  U5      5      nSnU(       a<  U H5  nUR                  U R                  :w  d  M  U R                  Ul	        US-  nM7     OU R                  X%5        SnUR                  S	[        U5      5        U$ )
ai  Executes the described change on an ACL.

Args:
  storage_url: StorageUrl representing the object to change.
  current_acl: A list of ObjectAccessControls or
               BucketAccessControls to permute.
  command_name: String name of comamnd being run (e.g., 'acl').
  logger: An instance of logging.Logger.

Returns:
  The number of changes that were made.
Executing %s %s on %sr'   aclz6Skipping %s on %s, as WRITER does not apply to objectsr   defaclzUWRITER cannot be set as a default object ACL because WRITER does not apply to objectsrQ   New Acl:
%s)debugr3   r=   IsObjectwarningr   r   listrz   r   r   str)	r6   storage_urlrx   command_nameloggerr   matching_entrieschange_country   s	            r   ExecuteAclChange.Execute   s    LL(,8K8K yyH		;#7#7#9#9O**K	98#  J K 	K ''4KD66{CDL#%::"yy%*
!
, $
 nn[.l
LL[!12r   r2   r=   r3   r8   N)r   r   r   r   __doc__ra   rb   rc   rd   project_scopesr`   ru   rv   public_entity_typesproject_entity_prefixesr~   r}   r   r   rU   r9   r?   r4   r5   rz   r   r   r   r   r   r   r   r   r   r   "   s    >*J7-;')0,"#-;.*\9MI + '!802NO1 "$ "</%b?4@.$
=&r   r   c                   4    \ rS rSrSrSSS.rS rS rS rS	r	g
)AclDeli  z8Represents a logical change from an access control list.r   r   )zAll(Users)?$zAllAuth(enticatedUsers)?$c                    SR                  U5      U l        Xl        U R                  R	                  5        HA  u  p#[
        R                  " X R                  [
        R                  5      (       d  M;  X0l        MC     SU l        SU l	        g )Nz-d {0}AnyNONE)
r<   r3   r2   scope_regexesrF   rG   rH   rI   r8   r=   )r6   r2   rM   scopes       r   r9   AclDel.__init__  sa    "//*5D O**002	%"--	8	8 3 DODIr   c              #     #    U GH  nUR                   (       a<  U R                  R                  5       UR                   R                  5       :X  a  Uv   MQ  UR                  (       a<  U R                  R                  5       UR                  R                  5       :X  a  Uv   M  UR                  (       a<  U R                  R                  5       UR                  R                  5       :X  a  Uv   M  UR
                  (       a`  U R                  R                  5       SR                  5       UR
                  R                  UR
                  R                  4-  :X  a  Uv   GM\  UR                  R                  5       S:X  a  U R                  S:X  a  Uv   GM  UR                  R                  5       S:X  d  GM  U R                  S:X  d  GM  Uv   GM     g7f)a;  Generator that yields entries that match the change descriptor.

Args:
  current_acl: An instance of apitools_messages.BucketAccessControls or
               ObjectAccessControls which will be searched for matching
               entries.

Yields:
  An apitools_messages.BucketAccessControl or ObjectAccessControl.
z%s-%sallusersr   allauthenticatedusersr   N)	rm   r2   rt   rn   ro   rp   rq   rr   rs   rw   s      r   rz   AclDel._YieldMatchingEntries  s6     	DOO113u~~7K7K7MM;;4??002ekk6G6G6II<<DOO113u||7I7I7KK$//"7"7"9W]]_##U%6%6%D%DE>F #F<<:-$//Z2OLL $;;OO66 s   F0G7G

Gc                     UR                  SX0R                  U5        [        U R                  U5      5      nU H  nUR	                  U5        M     UR                  S[        U5      5        [        U5      $ )Nr   r   )r   r3   r   rz   remover   len)r6   r   rx   r   r   r   ry   s          r   r   AclDel.Execute8  si    
LL(,8K8KD66{CD! "
LL[!12  r   r   N)
r   r   r   r   r   r   r9   rz   r   r   r   r   r   r   r     s!    @!$;-
6!r   r   c                    / n[         R                  [         R                  [         R                  S.nU  H  u  p4X2;   aJ  [	        XBU   S9nSR                  UR                  5       UR                  5      nUR                  X645        MT  US:X  a*  [        U5      nUR                  SUR                  45        M  UR                  X445        M     U$ )N)z-gz-pz-u)r8   zentity={},role={}z-d)r
   r   r   r   r   r<   r   r=   r   r   r2   )sub_optstranslated_sub_optsscope_type_from_flagflagvaluechange	new_values          r   translate_sub_opts_for_shimr   B  s    OO
  mt#+EFf%,,V-=-=-?Mi  $!23	e}f  $(9(9!:;  $/   
r   )r   
__future__r   r   r   r   rG   gslib.exceptionr   "gslib.third_party.storage_apitoolsr   r   objectr
   r   r   r   r   r   r   <module>r      sL    > & %  ' 	 , W h hV2!V 2!jr   