
    j                     l   S r SSKrSSKJr  SSKJr  SSKJr  SSK	J
r
  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  S rS rS rS rS&S jr S&S jrS rS rS rS rS rS r " S S\R<                  5      rS r S r!S r"S r#S r$S r%S r&S  r' " S! S"\
RP                  5      r)S# r* " S$ S%5      r+g)'z<Command line processing utilities for cloud access bindings.    N)encoding)util)
exceptions)common)
properties)	resources)iso_duration)timesc                    A / nUR                  S5      (       a  UR                  S5        UR                  S5      (       a  UR                  S5        UR                  S5      (       a  UR                  S5        UR                  S5      (       a  UR                  S5        U(       d  [        R                  " / S	Q5      eS
R	                  U5      Ul        U$ )zHook to add update mask.levelaccess_levelsdry_run_leveldry_run_access_levelssession_lengthsession_settingsbinding_filescoped_access_settings)--level--dry_run_level--session-length--binding-file,IsKnownAndSpecifiedappendcalliope_exceptionsMinimumArgumentExceptionjoin
updateMaskrefargsrequpdate_masks       Elib/googlecloudsdk/command_lib/accesscontextmanager/cloud_bindings.pyAddUpdateMaskr&      s    	+	g&&'	o.../	.//)*	n--/0	

6
6L  88K(#.	*    c                 (   A / nUR                  S5      (       a  UR                  S5        UR                  S5      (       a  UR                  S5        UR                  S5      (       d  UR                  S5      (       a  UR                  S5        UR                  S5      (       a  UR                  S	5        UR                  S
5      (       a  UR                  S5        U(       d  [        R                  " / SQ5      eSR	                  U5      Ul        U$ )z'Hook to add update mask in Alpha track.r   r   r   r   (restricted_client_application_client_ids#restricted_client_application_namesrestricted_client_applicationsr   r   r   r   )r   r   z%--restricted_client_application_namesz*--restricted_client_application_client_idsr   r   r   r   r    s       r%   AddUpdateMaskAlphar,   5   s    	+	g&&'	o.../	0  EFF78	.//)*	n--/0	

6
6 8   88K(#.	*r'   c                 &   A AUR                   b  U$ [        R                  R                  R                  R                  5       nUc  [        R                  " SS5      e[        R                  R                  USS9nUR                  5       Ul         U$ )z#Hook to process organization input.z--organizationzThe attribute can be set in the following ways: 
- provide the argument `--organization` on the command line 
- set the property `access_context_manager/organization`z"accesscontextmanager.organizations
collection)parentr   VALUESaccess_context_managerorganizationGetr   RequiredArgumentExceptionr   REGISTRYParseRelativeName)r!   r"   r#   orgorg_refs        r%   ProcessOrganizationr;   T   s    	4ZZJ00==AAC#[

7
7	E  $$	: % ' ##%#*	*r'   c                     A [        XSS9$ )zDHook to process restricted client applications input in Alpha track.v1alphaversion)$_ProcessRestrictedClientApplications)
unused_refr"   r#   s      r%   (ProcessRestrictedClientApplicationsAlpharB   j   s    	-d	KKr'   c                 B   U R                  S5      (       ay  U R                  n[        USUS9nUR                  c'  [        R
                  " US9R                  5       Ul        U H(  nUR                  R                  R                  U5        M*     U R                  S5      (       ay  U R                  n[        USUS9nUR                  c'  [        R
                  " US9R                  5       Ul        U H(  nUR                  R                  R                  U5        M*     U$ )zCProcess restricted client applications input for the given version.r)   r>   r*   )
r   r)   0_MakeRestrictedClientApplicationsFromIdentifiersgcpUserAccessBindingr   GetMessagesGcpUserAccessBindingrestrictedClientApplicationsr   r*   )r"   r#   r?   
client_ids"restricted_client_application_refs!restricted_client_application_refclient_namess          r%   r@   r@   p   s+    
HII>>J86	
 ' '!%!1!1" 
 .P)	;;BB
+ .P
 
CDD;;L81	
 ' '!%!1!1" 
 .P)	;;BB
+ .P 
*r'   c                 :   / nU b  U  Vs/ s H  nU(       d  M  UPM     n nU  H  nUS:X  a3   UR                  [        R                  " US9R                  US95        M<  US:X  a3   UR                  [        R                  " US9R                  US95        Mu  [        R
                  " SR                  S5      S	5      e   U$ s  snf !   [        R
                  " SR                  S5      S5      e= f!   [        R
                  " SR                  S5      S5      e= f)
zJParse restricted client applications and return their resource references.r)   r>   )clientId--{}z:Unable to parse input. The input must be of type string[].r*   )namearg_namez:The input is not valid for Restricted Client Applications.)r   r   rF   Applicationr   InvalidArgumentExceptionformat)app_identifiersrQ   r?   resource_refs
identifierapp_identifiers         r%   rD   rD      s>    -  * *J 	)   *	?	?
	


w/;;) <  <<	


w/;;;P "::MM*%H
 	
1 *8 
E	#<<mmFGJ 	#<<mmABJ s!   CC0C&0C2(C/2(Dc                    U R                   R                  nU(       a  U R                   R                  n/ nU Vs/ s H  oU(       d  M  UPM     nnU(       d  U$ U(       a  SOSnU H4  n [        R                  R                  UUSS9nUR                  U5        M6     U$ s  snf !   [        R                  " SR                  U5      S5      e= f)z9Parse level strings and return their resource references.r   r   0accesscontextmanager.accessPolicies.accessLevelsparamsr/   rO   zjThe input must be the full identifier for the access level, such as `accessPolicies/123/accessLevels/abc`.)
rE   accessLevelsdryRunAccessLevelsr   r6   r7   r   rS   rT   r   )r#   param
is_dry_runlevel_inputs
level_refslevel_inputrQ   	level_refs           r%   _ParseLevelRefsre      s    ))66,++>>L*1=M++,M	",)(!k$$**
G + i i  " 
) N88
--
!; s   
B B *B%%(Cc                 
  ^
^^ A 0 n0 nSnUR                  S5      (       aT   [        R                  R                  UR	                  S5      SS9nSUR                  5       0nUR                  5       US'   OAUR                  S5      (       a
  [        X$S	S
9O/ nUR                  S5      (       a
  [        X$SS
9O/ nU Vs/ s H  oR                  5       PM     snmU Vs/ s H  oR                  5       PM     snm
[        U4S jT 5       5      (       d  [        S/5      e[        U
4S jT
 5       5      (       d  [        S/5      eT(       a  TS   R                  5       US'   T
(       a  T
S   R                  5       US'   [        UR                  5       5      n	U	R                  5         [        UR!                  5       5      m[        U4S jT 5       5      (       d  [        U	5      eU(       a/  U Vs/ s H  oR                  5       PM     snUR"                  l        U(       a/  U Vs/ s H  oR                  5       PM     snUR"                  l        U$ !   [
        R                  " SS5      e= fs  snf s  snf s  snf s  snf )z0Hook to format levels and validate all policies.Npolicy#accesscontextmanager.accessPoliciesr.   --policybThe input must be the full identifier for the access policy, such as `123` or `accessPolicies/123.accessPoliciesIdr   F)r`   r   Tc              3   2   >#    U  H  oTS    :H  v   M     g7fr   N ).0xlevel_parentss     r%   	<genexpr> ProcessLevels.<locals>.<genexpr>  s     :Mq-""M   r   c              3   2   >#    U  H  oTS    :H  v   M     g7frm   rn   )ro   rp   dry_run_level_parentss     r%   rr   rs     s     J4Iq'**4Irt   --dry-run-levelr   c              3   2   >#    U  H  oTS    :H  v   M     g7frm   rn   )ro   rp   policies_valuess     r%   rr   rs     s     >o/!$$ort   )r   r   r6   r7   GetValuer   rS   Namer8   re   ParentallConflictPolicyExceptionlistkeyssortvaluesrE   r]   r^   )r!   r"   r#   policies_to_checkr_   
policy_refrb   dry_run_level_refsrp   flags_to_complainrv   rq   ry   s             @@@r%   ProcessLevelsr      sh   	
%*	h''
%%++
--
!: , j  !23E$.$;$;$=j!
 
	!	!'	*	* cU3  
	!	!/	2	2 cT2  (22z!88:z2-/AB/A!88:/AB	:M:	:	:
!9+
..	J4IJ	J	J
!#4"5
66 #0#3#@#@#Bi +@	,ln '( ,1134*1134/	>o>	>	>
!"3
44 ",-",Q*-C) "43"4Q"43C/ 
*k88
2 . 3B*-3s#   -I >I1I62I;(J I.c                 2   U (       a  [         R                  " U 5      O[        R                  " SS9nUR                  [        R                  " SS9R                  :  a  [
        R                  " SS5      eSR                  [        UR                  5      5      $ )zVProcess the session-length argument into an acceptable form for GCSL session settings.)hours   daysr   z2The session length cannot be greater than one day.z{}s)	r
   ParseDurationr	   Durationtotal_secondsr   rS   rT   int)stringdurations     r%   ProcessSessionLengthr   -  s|     &,e&!1F1FR1P 
 l33;III

6
6< 
 
c(001	22r'   c                 f   A UR                  S5      (       a  UR                  S5      (       d  UR                  S5      (       a  [        R                  " SS5      e[        R                  " UR
                  R                  R                  5      R                  nUS:  a  SUR
                  l        U$ US:X  a  SUR
                  R                  l	        U$ S	UR
                  R                  l	         U$ UR                  S
5      (       a  [        R                  " SS5      eSUR
                  l        U$ )a  Hook to process GCSL session settings.

  When --session-length=0 make sure the sessionLengthEnabled is set to false.

  Throw an error if --session-reauth-method or --use-oidc-max-age are set
  without --session-length.

Args:
    unused_ref: Unused
    args: The command line arguments
    req: The request object

Returns:
  The modified request object.

Raises:
  calliope_exceptions.InvalidArgumentException: If arguments are incorrectly
  set.
r   r)   r*   r   zXCannot set session length on restricted client applications. Use scoped access settings.r   NFTsession_reauth_methodz--session_reauth_methodz;Cannot set --session_reauth_method without --session-length)
r   r   rS   r
   r   rE   sessionSettingssessionLengthr   sessionLengthEnabled)rA   r"   r#   r   s       r%   ProcessSessionSettingsr   C  s0   ( 	.//2 		!	!"G	H	H88
$ 
 ((  00>>m  15c. 
* 
1	FKc..C 
* GKc..C 
*  78888
#
G  04C,	*r'   c                     [         R                  " S5      R                  SU 5      n[         R                  " SS U5      $ )Nz([a-z0-9])([A-Z])z\1_\2z_[A-Z]+c                 @    U R                  S5      R                  5       $ )Nr   )grouplower)ms    r%   <lambda>&_CamelCase2SnakeCase.<locals>.<lambda>y  s    QWWQZ%5%5%7r'   )recompilesub)rP   s1s     r%   _CamelCase2SnakeCaser   w  s2    	zz%&**8T:"		7	<<r'   c                     A UR                  S5      (       a+  SUR                  ;   a  [        UR                  5      nX2l        U$ )z8Hook to process filter. Covert camel case to snake case.filter	principal)r   r   r   )rA   r"   r#   
filter_strs       r%   ProcessFilterr   |  s:    	h''dkk!'4jj	*r'   c                   ,   ^  \ rS rSrSrU 4S jrSrU =r$ )r~   i  z"For conflict policies from inputs.c                    > [         [        U ]  SR                  SR	                  U Vs/ s H  nSR                  U5      PM     sn5      5      5        g s  snf )NzTInvalid value for [{0}]: Ensure that the {0} resources are all from the same policy., z{0})superr~   __init__rT   r   )selfparameter_namesp	__class__s      r%   r    ConflictPolicyException.__init__  sK    	
!41	$$*FII@1u||A@A%
 As   Arn   )__name__
__module____qualname____firstlineno____doc__r   __static_attributes____classcell__r   s   @r%   r~   r~     s    * r'   r~   c           	         / nU Vs/ s H  oU(       d  M  UPM     nnU H2  n UR                  [        R                  R                  UU SS95        M4     U$ s  snf !   [        R
                  " SR                  U5      U5      e= f)a  Try to get the access level cloud resources that correspond to the `access levels`.

Args:
  param: The parameters to pass to the resource registry
  access_levels: The access levels to turn into cloud resources
  field_name: The name of the field to use in the error message
  error_message: The error message to use if the access levels cannot be
    parsed

Returns:
  The access level cloud resources that correspond to the `access levels`.
rZ   r[   rO   )r   r   r6   r7   r   rS   rT   )r_   r   
field_nameerror_messageaccess_level_resourcesaccess_levelaccess_level_inputsaccess_level_inputs           r%   _TryGetAccessLevelResourcesr     s     '4'4|l}   0##



"
" K #  0 
 '88
--

#
 s   
AA.A(Bc                      [         R                  R                  U SS9$ !   [        R                  " SR                  U5      U5      e= f)aR  Try to get the policy cloud resource that corresponds to the `policy`.

Args:
  policy: The policy to turn into a cloud resource
  field_name: The name of the field to use in the error message
  error_message: The error message to use if the policy cannot be parsed

Returns:
  The policy cloud resource that corresponds to the `policy`.
rh   r.   rO   )r   r6   r7   r   rS   rT   )rg   r   r   s      r%   _TryGetPolicyCloudResourcer     sS    ##8 $  

6
6j!= s	     (Ac                 @   ^^^ S mS mU4S jmUU4S jnU" U 5        g)z2Validates the scope in the scoped access settings.c                     U  Vs/ s H  n[        UR                  5      PM     nn[        U5      [        [        U5      5      :w  a  [        R
                  " SS5      eg s  snf )Nr   z8ScopedAccessSettings in the binding-file must be unique.)strscopelensetr   rS   )r   rp   scopess      r%   ._ValidateScopeInScopedAccessSettingsUniqueness\_ProcessScopesInScopedAccessSettings.<locals>._ValidateScopeInScopedAccessSettingsUniqueness  sX    $:;$:qc!''l$:F;
6{c#f+&&88

D  ' <s   Ac                    U (       d  gU R                   (       aK  [        R                  " U R                   5      nU(       d  gUR                  5        H  nX   (       a  M    g   g[	        U S5      (       a\  U R
                  (       aK  [        R                  " U R
                  5      nU(       d  gUR                  5        H  nX2   (       a  M    g   gg)NFTrestrictedProject)restrictedClientApplicationr   MessageToDictr   hasattrr   )client_scope"restricted_client_application_dictkeyrestricted_project_dicts       r%   _IsClientScopeSet?_ProcessScopesInScopedAccessSettings.<locals>._IsClientScopeSet  s    //+3+A+A

2
2,( 0388:#166 ; 122** ( 6 6

(
(! %(--/#&++ 0 r'   c                    > U R                   (       a!  T" U R                   R                  5      (       d  [        R                  " SS5      eg )Nr   z;ScopedAccessSettings in the binding-file must have a scope.)r   clientScoper   rS   )scoped_access_settingr   s    r%   -_ValidateScopeInScopedAccessSettingIsNotEmpty[_ProcessScopesInScopedAccessSettings.<locals>._ValidateScopeInScopedAccessSettingIsNotEmpty  sH     &&.?##/// /  88

G /r'   c                 d   > U R                   R                  nT" U5        U H  nT" U5        M     g N)rE   scopedAccessSettings)r#   r   r   r   r   s      r%   _Start4_ProcessScopesInScopedAccessSettings.<locals>._Start   s2     55JJ23IJ!734IJ "8r'   Nrn   )r#   r   r   r   r   s     @@@r%   $_ProcessScopesInScopedAccessSettingsr     s!    :K 	+r'   c                 6   ^^ S mU4S jmU4S jnU" U 5        g)z<Validates the access settings in the scoped access settings.c                     U (       d  g[         R                  " U 5      nU(       d  gUR                  5        H  nX   (       a  M    g   g)NFT)r   r   r   )access_settingsaccess_settings_dictr   s      r%   _IsAccessSettingsSetJ_ProcessAccessSettingsInScopedAccessSettings.<locals>._IsAccessSettingsSet  sC    #11/B#((*!&& + r'   c                 j   > T" U 5      (       d%  T" U5      (       d  [         R                  " SS5      eg g )Nr   zhScopedAccessSettings in the binding-file must have at least one of activeSettings or dryRunSettings set.)r   rS   )r   dry_run_settingsr   s     r%   @_ValidateAccessSettingsInScopedAccessSettingAtLeastOneIsNotEmptyv_ProcessAccessSettingsInScopedAccessSettings.<locals>._ValidateAccessSettingsInScopedAccessSettingAtLeastOneIsNotEmpty  sE      009M: :  88
3 :0r'   c                 ~   > U R                   R                  nU H   nT" UR                  UR                  5        M"     g r   )rE   r   activeSettingsdryRunSettings)r#   r   r   r   s      r%   r   <_ProcessAccessSettingsInScopedAccessSettings.<locals>._Start$  s:     55JJ!7F

.
.

.
. "8r'   Nrn   )r#   r   r   r   s     @@r%   ,_ProcessAccessSettingsInScopedAccessSettingsr   	  s    

 	+r'   c                 <   ^^^ S mS mS mUUU4S jnU" X5        g)z8Process the access levels in the scoped access settings.c                 :  ^ X-   nU(       a  U Vs/ s H  oUR                  5       PM     snm[        U4S jT 5       5      (       d  [        U5      eU(       a=  T(       a5  UR                  5       TS   R                  5       :w  a  [        S/U-   5      eggggs  snf )zEValidate that the access levels and policy belong to the same policy.c              3   4   >#    U  H  nUTS    :H  v   M     g7frm   rn   )ro   rp   access_level_resources_parentss     r%   rr   c_ProcessAccessLevelsInScopedAccessSettings.<locals>._ValidateBelongsToSamePolicy.<locals>.<genexpr>A  s#      1a -a0
01s   r   ri   N)r|   r}   r~   r8   )r   dry_run_access_level_resourcespolicy_resourcer   combined_access_levelrp   r   s         @r%   _ValidateBelongsToSamePolicyP_ProcessAccessLevelsInScopedAccessSettings.<locals>._ValidateBelongsToSamePolicy2  s     	?   4(3((*3($  1   &o66 ,**,/2??AB &zl_&DEE	B -  (s   Bc                 h    U(       a&  U Vs/ s H  o"R                  5       PM     snU l        ggs  snf )a  Replace the access levels in the scoped access settings with relative names.

For example,

{
  'activeSettings': {
    'accessLevels': [
      'accessPolicies/123/accessLevels/access_level_1'
    ]
  }
}

is replaced with:

{
  'activeSettings': {
    'accessLevels': [
      access_level_resources.RelativeName()
    ]
  }
}

Args:
  access_settings: The access settings to replace the access levels in.
  access_level_resources: The access level resources to replace the access
    levels with.
N)r8   r]   )r   r   rp   s      r%   5_ReplaceAccessLevelsInAccessSettingsWithRelativeNamesi_ProcessAccessLevelsInScopedAccessSettings.<locals>._ReplaceAccessLevelsInAccessSettingsWithRelativeNamesR  s3    > $:&$:q..
$:&o" &s   /c                 j    U (       d  0 OSU R                  5       0n/ nU(       a  [        UUSS5      nU$ )a  Get the access level resources from the scoped access settings.

Args:
  policy_resource: The policy resource
  access_levels: The access levels to turn into cloud resources. For
    example, ['accessPolicies/123/accessLevels/access_level_1']

Returns:
  The access level cloud resources that correspond to the `access levels`.
  For example,
  ['https://accesscontextmanager.googleapis.com/v1/accessPolicies/123/accessLevels/access_level_1']
rk   zbinding-filezAccess levels in ScopedAccessSettings must contain the full identifier. For example: `accessPolicies/123/accessLevels/access_level_1)r{   r   )r   r   r_   r   s       r%   _GetAccessLevelResourcesL_ProcessAccessLevelsInScopedAccessSettings.<locals>._GetAccessLevelResourcesv  sN      	 /"6"6"89 
  :


=	  "!r'   c                   > S nU R                  S5      (       a  [        U R                  S5      SS5      nUR                  R                  n/ n/ nU H  n/ nUR
                  (       aK  UR
                  R                  (       a0  T
" X&R
                  R                  5      nUR                  US   5        / nUR                  (       aL  UR                  R                  (       a1  T
" UUR                  R                  5      nUR                  US   5        T" UUUS/5        T" UR
                  U5        T" UR                  U5        M     T" UUUS/5        / n	UR                  R                  (       a   T
" X!R                  R                  5      n	U	(       d   T
" X!R                  R                  5      n	T" UU	U/ SQ5        g ! [        R                   a     NHf = f! [        R                   a     N>f = f)Nrg   rj   r   r   )r   r   rw   )r   r   rz   rE   r   r   r]   r   r   r   rS   r^   )r"   r#   r   r   access_level_resources_sample%dry_run_access_level_resources_sampler   r   r   global_access_level_resourcesr  r  r   s             r%   r   :_ProcessAccessLevelsInScopedAccessSettings.<locals>._Start  s   O))2
--
!
2o !55JJ$&!,.)!7!

.
.#22??!9AANN"
 	&,,-CA-FG (*$

.
.#22??)A!00==*
& 	.44*1-	
 #
 
(

	 <

.
.0F <

.
.0NE "8P !%-		 %'!
,,(@55BB)
% )(@55HH)
% !%%8	 !99  !99 s$   2G  G  GGG10G1Nrn   )r"   r#   r   r  r  r   s      @@@r%   *_ProcessAccessLevelsInScopedAccessSettingsr  /  s&    F@"H">Wr 	r'   c                 2   ^^ S mS mUU4S jnU" U 5        g)z;Process the session settings in the scoped access settings.c                 T   U c  g U R                   c  [        R                  " SS5      e[        R                  " U R                   5      R
                  nU[        R                  " SS9R
                  :  a  [        R                  " SS5      eUS:  a  [        R                  " SS5      eg )Nr   zISessionSettings within ScopedAccessSettings must include a sessionlength.r   r   zJSessionLength within ScopedAccessSettings must not be greater than one dayr   zDSessionLength within ScopedAccessSettings must not be less than zero)r   r   rS   r
   r   r   r	   r   )r   r   s     r%   _ValidateSessionSettingsO_ProcessSessionSettingsInScopedAccessSettings.<locals>._ValidateSessionSettings  s    %%-88
 
 ((&&m  --15CCC88
 
 88
  r'   c                    U R                   c  [        R                  " S5      n[        XR                  5      (       a&  UR                  R
                  R                  U l         O9[        R                  " S5      R                  R
                  R                  U l         U R                  c?  [        R                  " U R                  5      R                  nUS:  a  SU l        OSU l        U R                  c  SU l        g g )Nv1r=   r   TF)sessionReauthMethodr   rF   
isinstanceSessionSettings"SessionReauthMethodValueValuesEnumLOGINr   r
   r   r   r   useOidcMaxAge)r   v1_messagesr   s      r%    _InferEmptySessionSettingsFieldsW_ProcessSessionSettingsInScopedAccessSettings.<locals>._InferEmptySessionSettingsFields  s    ++3$$T*k	$&A&A	B	B''JJPP 	, 04/?/?0

/<<UU 	,
 ,,4**

(
(  
!	04-05-%%-',$ .r'   c                    > U R                   R                  nU HE  nUR                  (       d  M  UR                  R                  nU(       d  M5  T" U5        T" U5        MG     g r   )rE   r   r   r   )r#   r   sr   r  r  s       r%   r   =_ProcessSessionSettingsInScopedAccessSettings.<locals>._Start'  sU     55JJ#))99/0&'78 $r'   Nrn   )r#   r   r  r  s     @@r%   -_ProcessSessionSettingsInScopedAccessSettingsr    s    2-4	9 	+r'   c                 f   UR                   (       a  UR                   R                  (       d  gSnUR                   R                   GHh  nUR                  (       d  M  UR                  R                  (       d  M4  [	        UR                  R                  SS5      (       d  M\  Sn[        U S5      (       a-  U R                  S5      (       a  [        R                  " SS5      eUR                  (       a  UR                  R                  (       d  [        R                  " SS	5      eUR                  (       a2  UR                  R                  (       a  [        R                  " SS
5      eUR                  (       d  GM6  UR                  R                  (       d  GMT  [        R                  " SS5      e   U(       ax  [        R                  R                  R                   R#                  5       (       a@  [        U S5      (       a.  U R                  S5      (       d  [        R                  " SS5      egggg)z"Validate restricted project scope.NFr   T	group_keyz--group-keyz\Restricted project scope cannot be used with --group-key; use --federated-principal instead.r   z?Restricted project scope must have active session settings set.zMRestricted project scope cannot be used with access levels in activeSettings.zMRestricted project scope cannot be used with access levels in dryRunSettings.federated_principalzOWhen using a restricted project scope, --federated-principal must be specified.)rE   r   r   r   getattrr   r   r   rS   r   r   r]   r   r   r1   r2   enable_gcslGetBool)r"   r#   has_restricted_projectsass       r%   _ValidateRestrictedProjectScoper'  5  s    
"
"%%::
 %%::c			II!!!CII))+>EE# 
{	#	#(@(@(M(M!::.
 	
 s'9'9'I'I!::M
 	

 
		 2 2 ? ?!::
 	

 
			 2 2 ? ? ?!::
 	
; ;D //;;CCEE	,	-	-d6N6N
7 7 "::
 	
7	- F r'   c                 (   ^ S mU4S jnU" XU5      $ )zEHook to process and validate scoped access settings from the request.c                     U R                  S5      =(       d    U R                  S5      nU(       a  [        R                  " SS5      eg )Nr*   r)   r   zThe binding-file cannot be specified at the same time as `--restricted-client-application-names` or `--restricted-client-application-client-ids`.)r   r   rS   )r"   legacy_prca_fields_specifieds     r%   D_ValidateRestrictedClientApplicationNamesAndClientIdsAreNotSpecifiediProcessScopedAccessSettings.<locals>._ValidateRestrictedClientApplicationNamesAndClientIdsAreNotSpecifiedp  sT     $(#;#;-$ $N		!	!"L	M ! $88
;  $r'   c                    > A UR                  S5      (       d  U$ T" U5        [        U5        [        X5        [        U5        [	        X5        [        U5        U$ )Nr   )r   r   r'  r   r  r  )rA   r"   r#   r+  s      r%   r   +ProcessScopedAccessSettings.<locals>._Start~  sQ    ##N33jHN(-#D.05.t91#6Jr'   rn   )rA   r"   r#   r   r+  s       @r%   ProcessScopedAccessSettingsr/  m  s     

#	&&r'   c                   (   ^  \ rS rSrU 4S jrSrU =r$ )InvalidFormatErrori  c                 L   > [         [        U ]  USR                  U5      5        g )Na  Invalid format: {}

 A binding-file is a YAML-formatted file containing a single gcpUserAccessBinding. For example:

  scopedAccessSettings:
  - scope:
      clientScope:
        restrictedClientApplication:
          name: Cloud Console
    activeSettings:
      accessLevels:
      - accessPolicies/123/accessLevels/access_level_1
    dryRunSettings:
      accessLevels:
      - accessPolicies/123/accessLevels/dry_run_access_level_1
  - scope:
      clientScope:
        restrictedClientApplication:
          clientId: my_client_id.google.com
    activeSettings:
      accessLevels:
      - accessPolicies/123/accessLevels/access_level_2
    dryRunSetting:
      accessLevels:
      - accessPolicies/123/accessLevels/dry_run_access_level_2
)r   r1  r   rT   )r   pathreasonr   s      r%   r   InvalidFormatError.__init__  s+    	
d,O2 &
9r'   rn   )r   r   r   r   r   r   r   r   s   @r%   r1  r1    s       r'   r1  c                    ^ ^ S mUU 4S jnU$ )zParse a GcpUserAccessBinding from a YAML file.

Args:
  api_version: str, the API version to use for parsing the messages

Returns:
  A function that parses a GcpUserAccessBinding from a file.
c                 P    [        U 5      S:  a  [        R                  " SS5      eg )Nr   z--input-filez{The input file contains more than one GcpUserAccessBinding. Please specify only one GcpUserAccessBinding in the input file.)r   r   rS   )bindingss    r%   #_ValidateSingleGcpUserAccessBindingUParseGcpUserAccessBindingFromBindingFile.<locals>._ValidateSingleGcpUserAccessBinding  s/    
8}q88
L  r'   c                    > [         R                  " U [        R                  " TS9R                  S5      nT" U5        [        XS   T5      R                  5         US   $ )Nr>   Fr   )r   )ParseAccessContextManagerMessagesFromYamlr   rF   rG   &GcpUserAccessBindingStructureValidatorValidate)r3  r8  r9  api_versions     r%   2_ParseVersionedGcpUserAccessBindingFromBindingFiledParseGcpUserAccessBindingFromBindingFile.<locals>._ParseVersionedGcpUserAccessBindingFromBindingFile  sW    ??d{3HH%H (1*qk;hjA;r'   rn   )r?  r@  r9  s   ` @r%   (ParseGcpUserAccessBindingFromBindingFilerB    s     
<;r'   c                   Z    \ rS rSrSrS rS rS rS rS r	S r
S	 rS
 rS rS rS rSrg)r=  i  zGValidates a GcpUserAccessBinding structure against unrecognized fields.c                 (    Xl         X l        X0l        g r   )r3  gcp_user_access_bindingr?  )r   r3  rE  r?  s       r%   r   /GcpUserAccessBindingStructureValidator.__init__  s    I#: "r'   c                     U R                  U R                  5        U R                  U R                  R                  5        g)z-Validates the GcpUserAccessBinding structure.N)3_ValidateAllFieldsRecognizedForGcpUserAccessBindingrE  _ValidateScopedAccessSettingsr   )r   s    r%   r>  /GcpUserAccessBindingStructureValidator.Validate  s8    <<$$ 	&&$$99r'   c                    U(       a  [        [        U5      5       Hi  nX   nU R                  U5        U R                  UR                  5        U R                  UR                  5        U R                  UR                  5        Mk     gg)z-Validates the ScopedAccessSettings structure.N)ranger   _ValidateAllFieldsRecognized_ValidateAccessScoper   _ValidateAccessSettingsr   r   )r   scoped_access_settings_listir   s       r%   rI  DGcpUserAccessBindingStructureValidator._ValidateScopedAccessSettings  sv    "S456!!<!?))*@A!!"8">">?$$%;%J%JK$$%;%J%JK 7 #r'   c                 l    U(       a-  U R                  U5        U R                  UR                  5        gg)z$Validates the AccessScope structure.N)rM  _ValidateClientScoper   )r   access_scopes     r%   rN  ;GcpUserAccessBindingStructureValidator._ValidateAccessScope  s,    
''5
 8 89 r'   c                 6   U(       a  U R                  U5        U R                  UR                  5        [        R                  R
                  R                  R                  5       (       a.  [        US5      (       a  U R                  UR                  5        gggg)z(Validates the AccessScopeType structure.r   N)rM  $_ValidateRestrictedClientApplicationr   r   r1   r2   r#  r$  r   _ValidateProjectr   )r   r   s     r%   rT  ;GcpUserAccessBindingStructureValidator._ValidateClientScope  s    
''5
//

2
2 


2
2
>
>
F
F
H
Hl$788l<<= 9 I r'   c                 6    U(       a  U R                  U5        gg)z+Validates the RestrictedClientApplications.NrM  )r   restricted_client_applications     r%   rX  KGcpUserAccessBindingStructureValidator._ValidateRestrictedClientApplication  s    $
''(EF %r'   c                 6    U(       a  U R                  U5        gg)zValidates the Project.Nr\  )r   restricted_projects     r%   rY  7GcpUserAccessBindingStructureValidator._ValidateProject  s    
''(:; r'   c                 6    U(       a  U R                  U5        gg)zValidate the SessionSettings.Nr\  )r   r   s     r%   r  ?GcpUserAccessBindingStructureValidator._ValidateSessionSettings  s    
''(89 r'   c                 l    U(       a-  U R                  U5        U R                  UR                  5        gg)z'Validates the AccessSettings structure.N)rM  r  r   )r   r   s     r%   rO  >GcpUserAccessBindingStructureValidator._ValidateAccessSettings  s,    
''8
##O$C$CD r'   c           
      >   S/n[        5       n/ nUR                  U:w  a  UR                  S5        UR                  U:w  a  UR                  S5        UR                  b  UR                  S5        UR
                  (       a  UR                  S5        [        US5      (       a  UR                  b  UR                  S5        UR                  b  UR                  S5        UR                  (       a  UR                  S	5        UR                  5       (       a  UR                  UR                  5       5        U(       ab  [        U R                  S
R                  [        U R                   5      R"                  SR%                  U5      SR%                  U5      5      5      eg)ad  Validates that all fields in the GcpUserAccessBinding are recognized.

Note:Because ScopedAccessSettings is the only field supported in the
GcpUserAccessBinding, a custom validation is required.

Args:
  gcp_user_access_binding: The GcpUserAccessBinding to validate

Raises:
  InvalidFormatError: if the GcpUserAccessBinding contains unrecognized
  fields
r   r]   r^   NgroupKeyrP   r   r   rH   z@"{}" contains unrecognized fields: [{}]. Valid fields are: [{}].r   )r   r]   addr^   rg  rP   r   r   r   rH   all_unrecognized_fieldsupdater1  r3  rT   typerE  r   r   )r   rE  valid_fieldsunrecognized_fields
empty_lists        r%   rH  ZGcpUserAccessBindingStructureValidator._ValidateAllFieldsRecognizedForGcpUserAccessBinding  s_    ++L%J++z9n-11Z?23''3j)##f%'55#--9k*..:/0;;<=6688  
!
9
9
; 
))
L64//099ii+,ii%  r'   c                    [        UR                  5       5      n[        U5      nUR                  5        Vs/ s H  oDR                  PM     nnUR
                  S:X  a  [        R                  R                  R                  R                  5       (       dJ  SU;   a  UR                  S5        [        US5      (       a"  UR                  (       a  UR                  S5        U(       aa  [        U R                   SR#                  UR
                  SR%                  ['        U5      5      SR%                  ['        U5      5      5      5      egs  snf )zValidates that all fields in the message are recognized.

Args:
  message: object to validate

Raises:
  InvalidFormatError: if the message contains unrecognized fields
ClientScoper   z?"{}" contains unrecognized fields: [{}]. Valid fields are: [{}]r   N)r   ri  rk  
all_fieldsrP   r   r   r1   r2   r#  r$  remover   r   rh  r1  r3  rT   r   sorted)r   messageunrecognized_fields_setmessage_typefvalid_fields_lists         r%   rM  CGcpUserAccessBindingStructureValidator._ValidateAllFieldsRecognizedH  s    "'"A"A"CD=L)5)@)@)BC)BA)BC-55AAIIKK"33

"
"#6
77/00W5N5N
!
%
%&9
:
))
K6##ii678ii012   Ds   E)r?  rE  r3  N)r   r   r   r   r   r   r>  rI  rN  rT  rX  rY  r  rO  rH  rM  r   rn   r'   r%   r=  r=    s@    O#
L:>G
<
:
E0dr'   r=  r   ),r   r   apitools.base.pyr   +googlecloudsdk.api_lib.accesscontextmanagerr   googlecloudsdk.callioper   r   /googlecloudsdk.command_lib.accesscontextmanagerr   googlecloudsdk.corecore_exceptionsr   r   googlecloudsdk.core.utilr	   r
   r&   r,   r;   rB   r@   rD   re   r   r   r   r   r   Errorr~   r   r   r   r   r  r  r'  r/  ParseFileErrorr1  rB  r=  rn   r'   r%   <module>r     s    C 
 % < E B = * ) 1 *,>,L,` (,(V<BJ3,1h=
	o33 	# L,7t#LDAH5
p'D".. "J<>Q Qr'   