
    O,                         S r SSKrSSKJr  SSKJr  SSKJr  SSKJr  SSKJr	  SSKJ
r
  SSKJr  SSKJr  S	r " S
 S\	R                  5      r " S S\5      r " S S\5      rS rSS jrS r " S S\5      rg)z%Utilities for the iamcredentials API.    N
exceptions)http_wrapper)apis_internal)
properties)	resources)	transportz&https://iamcredentials.googleapis.com/c                       \ rS rSrSrSrg)Error"   z*Exception that are defined by this module. N__name__
__module____qualname____firstlineno____doc____static_attributes__r       1lib/googlecloudsdk/api_lib/iamcredentials/util.pyr   r   "   s    2r   r   c                       \ rS rSrSrSrg)InvalidImpersonationAccount&   z1Exception when the service account id is invalid.r   Nr   r   r   r   r   r   &   s    9r   r   c                       \ rS rSrSrSrg)&ImpersonatedCredGoogleAuthRefreshError*   zAException for google auth impersonated credentials refresh error.r   Nr   r   r   r   r   r   *   s    Ir   r   c           	      ^   SSK Jn  [        R                  R	                  U SSU S.S9nUR                  S[        R                  SS9n[        R                  " S	S
US9n UR                  R                  UR                  R                  UR                  5       UR                  R                  US9S95      nU$ ! [         R"                   a2  n[$        R&                  " USR)                  UR*                  U S9S9eSnAf[         R,                   a  n[$        R&                  " U5      eSnAff = f)z8Generates an access token for the given service account.r   
transportsiamcredentials.serviceAccounts-
projectsIdserviceAccountsId
collectionparamsFenable_resource_quotaresponse_encodingallow_account_impersonationiamcredentialsv1http_client)scope)namegenerateAccessTokenRequestzError {code} (Forbidden) - failed to impersonate [{service_acc}]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.)codeservice_accerror_formatN)googlecloudsdk.core.credentialsr   r   REGISTRYParseGetApitoolsTransportr	   ENCODINGr   _GetClientInstanceprojects_serviceAccountsGenerateAccessTokenMESSAGES_MODULE?IamcredentialsProjectsServiceAccountsGenerateAccessTokenRequestRelativeNameGenerateAccessTokenRequestapitools_exceptionsHttpForbiddenErrorr   HttpExceptionformatstatus_code	HttpError)service_account_idscopesr   service_account_refr/   
iam_clientresponsees           r   r>   r>   .   sC    9!**00%E6HI 1 K //!!**"' 0 )+
 //+7*&22FF""	H	H$113'1'A'A''f'5 
I 

H O		/	/ N

"
"	 $Vmm9K $ MN N 
	&	& &

"
"1
%%&s%   AB9 9D,-C::D,D''D,c           
         SSK Jn  [        R                  R	                  U SSU S.S9nUR                  S[        R                  SS9n[        R                  " S	S
US9nUR                  R                  UR                  R                  UR                  5       UR                  R                  XS9S95      nUR                   $ )z4Generates an id token for the given service account.r   r   r    r!   r"   r%   Fr(   r,   r-   r.   )audienceincludeEmail)r1   generateIdTokenRequest)r7   r   r   r8   r9   r:   r	   r;   r   r<   r=   GenerateIdTokenr?   ;IamcredentialsProjectsServiceAccountsGenerateIdTokenRequestrA   GenerateIdTokenRequesttoken)rI   rP   include_emailr   rK   r/   rL   rM   s           r   rS   rS   V   s     9!**00%E6HI 1 K //!!**"' 0 )+
 //+7* 00@@  BB"//1!+!;!;!!8!P C ( 
r   c                     [         R                  R                  R                  R	                  5       (       a2  [         R                  R                  R                  R                  5       $ [         R                  R                  R                  n U R                  5       U R                  :w  a$  [        R                  SU R                  5       5      $ [        $ )aq  Returns the effective IAM endpoint.

(1) If the [api_endpoint_overrides/iamcredentials] property is explicitly set,
return the property value.
(2) Otherwise if [core/universe_domain] value is not default, return
"https://iamcredentials.{universe_domain_value}/".
(3) Otherise return "https://iamcredentials.googleapis.com/"

Returns:
  str: The effective IAM endpoint.
zgoogleapis.com)r   VALUESapi_endpoint_overridesr,   IsExplicitlySetGetcoreuniverse_domaindefaultIAM_ENDPOINT_GDUreplace)universe_domain_propertys    r   GetEffectiveIamEndpointrc   r   s     --<<LLNN33BBFFHH'..33CC!!#'?'G'GG##2668  
r   c                   J    \ rS rSrSrS rS rS r\S 5       r	\S 5       r
Srg	)
 ImpersonationAccessTokenProvider   zvA token provider for service account elevation.

This supports the interface required by the core/credentials module.
c                     [        XU5      $ )N)rS   )selfrI   rP   rW   s       r   GetElevationIdToken4ImpersonationAccessTokenProvider.GetElevationIdToken   s    -GGr   c                    SSK Jn  SSK Jn  SSKJn  UR                  5       nUR                  U5        UR                  UUUUS9n	U R                  5          U	R                  U5        U	$ ! UR                   a  n
SR                  US9nSn [        R                  " U
R                  S	   5      nUS
-   US   S   -   US   S'   [        R                  " SUS   S   0[        R                   " U5      SS9n["        R$                  R'                  U5      nO! [(         a     Of = fU(       a  [        R*                  " USS9e[-        U5      eSn
A
ff = f)zCCreates a fresh impersonation credential using google-auth library.r   r   impersonated_credentialsrequests)source_credentialstarget_principaltarget_scopes	delegateszFailed to impersonate [{service_acc}]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.)r4   N    errormessagestatusr3   )infocontentrequest_urlz{message} {details?
{?}}r5   )google.authr   rm   googlecloudsdk.corero   GoogleAuthRequestrefreshCredentialsPerformIamEndpointsOverrideRefreshErrorrF   jsonloadsargsr   ResponsedumpsrC   rH   FromResponse	ExceptionrE   r   )rh   rp   rq   rs   rJ   google_auth_exceptions$google_auth_impersonated_credentialscore_requestsrequest_clientcredrN   original_message
http_errorrz   http_responses                  r   !GetElevationAccessTokenGoogleAuthBImpersonationAccessTokenProvider.GetElevationAccessTokenGoogleAuth   s    A\= #446N ~./;;-)	 < D 	$$&-E
ll>"\ K[ ".. +EBBH&* CI C  j **QVVAY' s"WW%5i%@@ 	#
 %--GG,V45JJw'

 )22??N
  
&&%@
 	

 33CDDW+Es=   A* *E:EBDE
D"E!D""*EEc                     SSK Jn  SSKJn  UR	                  UUUS9nUR                  5       nU R                  5         UR                  U5        U$ )z=Creates an ID token credentials for impersonated credentials.r   rl   rn   )target_audiencerW   )r|   rm   r}   ro   IDTokenCredentialsr~   r   r   )rh   %google_auth_impersonation_credentialsrP   rW   r   r   r   r   s           r   GetElevationIdTokenGoogleAuth>ImpersonationAccessTokenProvider.GetElevationIdTokenGoogleAuth   sW     ]=/BB- # C D
 #446N$$&LL Kr   c                 8    SSK Jn  [        XR                  5      $ )Nr   rl   )r|   rm   
isinstancer   )clsr   r   s      r   IsImpersonationCredential:ImpersonationAccessTokenProvider.IsImpersonationCredential   s     ]dLLMMr   c                    SSK Jn  [        5       nUR                  R	                  [
        U5      Ul        UR                  R	                  [
        U5      Ul        UR                  R	                  [
        U5      Ul        g)a
  Perform IAM endpoint override if needed.

We will override IAM generateAccessToken, signBlob, and generateIdToken
endpoint under the following conditions.
(1) If the [api_endpoint_overrides/iamcredentials] property is explicitly
set, we replace "https://iamcredentials.googleapis.com/" with the given
property value in these endpoints.
(2) If the property above is not set, and the [core/universe_domain] value
is not default, we replace "googleapis.com" with the [core/universe_domain]
property value in these endpoints.
r   )iamN)r|   r   rc   _IAM_ENDPOINTra   r`   _IAM_SIGN_ENDPOINT_IAM_IDTOKEN_ENDPOINT)r   google_auth_iameffective_iam_endpoints      r   r   <ImpersonationAccessTokenProvider.PerformIamEndpointsOverride   s|     3 56%%--"	
 ! 	**22"	
 & 	--55"	
 )r   r   N)r   r   r   r   r   ri   r   r   classmethodr   r   r   r   r   r   re   re      sC    
HGR" N N " "r   re   )F)r   r   apitools.base.pyr   rC   r   googlecloudsdk.api_lib.utilr   r}   core_exceptionsr   r   r	   r`   r   r   r   r>   rS   rc   objectre   r   r   r   <module>r      sy     ,  > ) 5 2 = * ) ) < 3O!! 3:% :JU J%&P8.Mv Mr   