
    7                         S r SSKrSSKJr  SSKJr  SSKJr  SSKJr	  SSK
Jr  SSKJr  SS	KJr  S
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS r S r!S r"S r#S r$S r%S  r&g)!z!The python hooks for IAM surface.    N)util)apis)arg_parsers)
exceptions)iam_util)	arg_utils)logc                 &   A UR                  S5      (       ay  [        R                  " 5       u  p4UR                  UR                  R                  S5      UR                  R                  S5      UR                  R                  S5      S9nXRl        U$ )a  Python hook to add condition from --condition-from-file to request.

Args:
  ref: A resource ref to the parsed resource.
  args: Parsed args namespace.
  request: The apitools request message to be modified.

Returns:
  The modified apitools request message.
condition_from_filedescriptiontitle
expression)r   r   r   )IsSpecifiedr   GetClientAndMessagesExprr   get	condition)refargsrequest_messagescondition_messages         +lib/googlecloudsdk/command_lib/iam/hooks.py"UpdateRequestWithConditionFromFiler      s     
	+,,++-KA ,,00?&&**73++//= & 
 *	.    c                 J    [         R                  " SSR                  U S95      $ )Nzcondition-from-filez{filename} must be a path to a YAML or JSON file containing the condition. `expression` and `title` are required keys. `description` is optional.filename)gcloud_exceptionsInvalidArgumentExceptionformatr   s    r   _ConditionFileFormatExceptionr#   4   s)    		3	3&(&+	
 r   c                 |    [         R                  " 5       " U 5      n[        R                  " U[	        U 5      5      nU$ )z&Read condition from YAML or JSON file.)r   FileContentsr   ParseYamlOrJsonConditionr#   )r   r   condition_dicts      r   ParseConditionFromFiler(   =   s<     &&()<=)44./BC. 
r   c                     A UR                   [        UR                   5      S-
  S  / SQ:X  a9  [        R                  R	                  SR                  UR                  5      5        g g )N   )iamservice-accountsenablezEnabled service account [{}].command_pathlenr	   statusPrintr"   service_accountresponser   s     r   EnableIamAccountConfirmationr6   G   s]    	s4,,-134 9 
 JJ'..t/C/CDr   c                     A UR                   [        UR                   5      S-
  S  / SQ:X  a9  [        R                  R	                  SR                  UR                  5      5        g g )Nr*   )r+   r,   disablezDisabled service account [{}].r.   r4   s     r   DisableIamAccountConfirmationr9   S   s]    	s4,,-134 9 
 JJ(//0D0DEr   c                     A [         R                  R                  SR                  UR                  UR
                  5      5        g )Nz,Enabled key [{0}] for service account [{1}].r	   r1   r2   r"   iam_keyiam_accountr4   s     r   EnableIamKeyConfirmationr>   _   s4    **4;;
,,((r   c                     A [         R                  R                  SR                  UR                  UR
                  5      5        g )Nz-Disabled key [{0}] for service account [{1}].r;   r4   s     r   DisableIamKeyConfirmationr@   h   s4    **5<<
,,((r   c                 0    U R                  5       Ul        U$ )z)Add service account name to request name.)RelativeNamename)r   unused_argsr   s      r   SetServiceAccountResourcerE   q   s     !!#',	.r   c                 v    A AUR                   R                  (       d  SS/n[        R                  " US5      eU$ )z.Validate the field mask for an update request.z--display-namez--descriptionz%Specify at least one field to update.)patchServiceAccountRequest
updateMaskr    OneOfArgumentsRequiredException)r   rD   r   update_fieldss       r   ValidateUpdateFieldMaskrK   x   sB     
;		+	+	6	6%7M

;
;>  
.r   c                    ^  U 4S jnU$ )zDSet requestedPolicyVersion to max supported in GetIamPolicy request.c                 X   > A A[         R                  " UT[        R                  5        U$ )N)r   SetFieldInMessager   !MAX_LIBRARY_IAM_SUPPORTED_VERSION)r   r   r   	api_fields      r   Process-UseMaxRequestedPolicyVersion.<locals>.Process   s*    THFF Nr    )rP   rQ   s   ` r   UseMaxRequestedPolicyVersionrT      s     
.r   c                    ^  U 4S jnU$ )z3Add ',version' to update_mask if it is not present.c                    > A A[         R                  " UT5      nSU;  a  Uc  SnOUS-  n[         R                  " UTU5        U$ )z+The implementation of Process for the hook.versionz,version)r   GetFieldValueFromMessagerN   )r   r   r   update_maskupdate_mask_paths       r   rQ   3AddVersionToUpdateMaskIfNotPresent.<locals>.Process   sP    T44W>NOK#		z!)9;GNr   rS   )rZ   rQ   s   ` r   "AddVersionToUpdateMaskIfNotPresentr\      s     
.r   c                 d    U R                  5       (       d  [        R                  " SS5      eSU -   $ )N
account_idzSAccount unique ID should be a number. Please double check your input and try again.zprojects/-/serviceAccounts/)isdigitr    r!   )r^   s    r   "CreateFullServiceAccountNameFromIdr`      s9    					

4
4	 
 
'	33r   c                      [         R                  " 5       " U 5      R                  5       nUR                  S5      $ ! [         R                   a+  n[        R
                  " SSR                  U5      5      eSnAff = f)a+  Generate public key data from a path.

Args:
  path: (bytes) the public key file path given by the command.

Raises:
  InvalidArgumentException: if the public key file path provided does not
                            exist or is too large.
Returns:
  A public key encoded using the UTF-8 charset.
public_key_filez1{}. Please double check your input and try again.Nzutf-8)r   r%   stripArgumentTypeErrorr    r!   r"   encode)pathpublic_key_dataes      r   GeneratePublicKeyDataFromFileri      sr    !..06<<>O 
			(( 
	&	& 

4
4;BB1E s   )< A;&A66A;c                 f    A [         R                  " SS5      n[        X!U5        [        X!U5        U$ )zsAdd ExtraAttributesOAuth2Client and ExtendedAttributesOAuth2Client fields to create workforcePoolProvider requests.r+   v1)r   GetMessagesModule$SetExtraAttributesOauth2ClientFields'SetExtendedAttributesOauth2ClientFieldsr   r   r   r   s       r   2AddCreateExtraAndExtendedAttributesConfigToRequestrp      s2     
##E40(&wh?)'B	.r   c                     A [         R                  " SS5      nUR                  b+  UR                  (       a  [        R                  " USS5        U$ [        X!U5        U$ )PAdd ExtraAttributesOAuth2Client fields to update workforcePoolProvider requests.r+   rk   Nz1workforcePoolProvider.extraAttributesOauth2Client)r   rl   clear_extra_attributes_configr   rN   rm   ro   s       r   *AddClearableExtraAttributesConfigToRequestrt      s[    	##E40(
((4

,
,; 
. )A	.r   c                     A [         R                  " SS5      nUR                  b+  UR                  (       a  [        R                  " USS5        U$ [        X!U5        U$ )rr   r+   rk   Nz4workforcePoolProvider.extendedAttributesOauth2Client)r   rl    clear_extended_attributes_configr   rN   rn   ro   s       r   -AddClearableExtendedAttributesConfigToRequestrw      s[    	##E40(
++7

/
/> 
. ,G8D	.r   c                    UR                   b  UR                  R                  nSUR                   ;   a#  [        R                  " U SUR
                  5        OeSUR                   ;   a#  [        R                  " U SUR                  5        O2SUR                   ;   a"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b#  [        R                  " U S	UR                  5        gg)
z6Set ExtraAttributesOauth2Client fields in the request.Nzazure-ad-groups-mailz@workforcePoolProvider.extraAttributesOauth2Client.attributesTypeazure-ad-groups-idzazure-ad-groups-display-namez:workforcePoolProvider.extraAttributesOauth2Client.clientIdzNworkforcePoolProvider.extraAttributesOauth2Client.clientSecret.value.plainTextz;workforcePoolProvider.extraAttributesOauth2Client.issuerUrizHworkforcePoolProvider.extraAttributesOauth2Client.queryParameters.filter)extra_attributes_type@GoogleIamAdminV1WorkforcePoolProviderExtraAttributesOAuth2ClientAttributesTypeValueValuesEnumr   rN   AZURE_AD_GROUPS_MAILAZURE_AD_GROUPS_IDAZURE_AD_GROUPS_DISPLAY_NAMEextra_attributes_client_id$extra_attributes_client_secret_valueextra_attributes_issuer_uriextra_attributes_filterr   r   r   response_types       r   rm   rm      sZ   	+QQoo  !;!;;!!

L

,
,
 
!;!;	;!!

L

*
*
 
(4+E+E	E!!

L

4
4
 
$$0D''
 
..:X11
 
%%1E((
 
!!-R$$ .r   c                 (   UR                   bH  UR                  R                  nSUR                   ;   a"  [        R                  " U SUR
                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b"  [        R                  " U SUR                  5        UR                  b#  [        R                  " U SUR                  5        gg)z9Set ExtendedAttributesOauth2Client fields in the request.Nry   zCworkforcePoolProvider.extendedAttributesOauth2Client.attributesTypez=workforcePoolProvider.extendedAttributesOauth2Client.clientIdzQworkforcePoolProvider.extendedAttributesOauth2Client.clientSecret.value.plainTextz>workforcePoolProvider.extendedAttributesOauth2Client.issuerUrizKworkforcePoolProvider.extendedAttributesOauth2Client.queryParameters.filter)
extended_attributes_typer{   r|   r   rN   r~   extended_attributes_client_id'extended_attributes_client_secret_valueextended_attributes_issuer_uriextended_attributes_filterr   s       r   rn   rn   )  s    	"".QQoo  t<<<!!

O

*
*
 
''3G**
 
11=[44
 
((4H++
 
$$0U'' 1r   c                 &   / nUR                   (       a  UR                   R                  S5      nUR                  b"  UR                  (       a  UR                  S5        UR                  b  UR                  S5        UR
                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        U(       a  SR                  U5      Ul         U$ )zhAdds ExtraAttributesOauth2Client specific fieldmask entries to the update workforcePoolProvider request.,extraAttributesOauth2Clientz*extraAttributesOauth2Client.attributesTypez$extraAttributesOauth2Client.clientIdz8extraAttributesOauth2Client.clientSecret.value.plainTextz%extraAttributesOauth2Client.issuerUriz2extraAttributesOauth2Client.queryParameters.filter)
rH   splitrs   appendrz   r   r   r   r   join
unused_refr   r   mask_fieldss       r   !AddExtraAttributesConfigFieldMaskr   O  s    +$$**3/K
((4

,
,45	+CD	$$0=>	..:B 
%%1>?	!!-KL+.G	.r   c                 &   / nUR                   (       a  UR                   R                  S5      nUR                  b"  UR                  (       a  UR                  S5        UR                  b  UR                  S5        UR
                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        UR                  b  UR                  S5        U(       a  SR                  U5      Ul         U$ )zkAdds ExtendedAttributesOauth2Client specific fieldmask entries to the update workforcePoolProvider request.r   extendedAttributesOauth2Clientz-extendedAttributesOauth2Client.attributesTypez'extendedAttributesOauth2Client.clientIdz;extendedAttributesOauth2Client.clientSecret.value.plainTextz(extendedAttributesOauth2Client.issuerUriz5extendedAttributesOauth2Client.queryParameters.filter)
rH   r   rv   r   r   r   r   r   r   r   r   s       r   $AddExtendedAttributesConfigFieldMaskr   j  s    +$$**3/K
++7

/
/78	"".FG	''3@A	11=E 
((4AB	$$0NO+.G	.r   c                     A g)zClear the value for a flag.NrS   )r   s    r   	ClearFlagr     s    
	r   c                 Z    A UR                   (       d  [        R                  " USS5        U$ )z:Remove the flag from the request when it is not specified.
hardDeleteN)hard_deleter   rN   )r   r   r   s      r   ModifyHardDeleteFlagInRequestr     s,    				
 
.r   c                 T    [         R                  " SSUR                  5      Ul        U$ )zHook to erase the project identifier from the request.

Args:
  unused_ref: The resource reference of the response.
  unused_args: The arguments of the command.
  request: The request of the command.

Returns:
  The modified apitools request message.
zprojects/[^/]+/zprojects/-/)resubrC   )r   rD   r   s      r   EraseProjectHookr     s"     )=',,G',	.r   )'__doc__r   googlecloudsdk.api_lib.iamr   googlecloudsdk.api_lib.utilr   googlecloudsdk.callioper   r   r    googlecloudsdk.command_lib.iamr   $googlecloudsdk.command_lib.util.apisr   googlecloudsdk.corer	   r   r#   r(   r6   r9   r>   r@   rE   rK   rT   r\   r`   ri   rp   rt   rw   rm   rn   r   r   r   r   r   rS   r   r   <module>r      s    ( 
 + , / C 3 : #.		
(4),&&/d#L66	r   