
    w                     `    S r SSKJr  SSKJr  SSKJr  SSK	J
r
  S/rS/rS/rS	 rSS jrS rg
)z$Helpers for testing IAM permissions.    )iam)projects_api)base)
exceptionsz cloudkms.cryptoKeys.setIamPolicyz'privateca.certificateAuthorities.createzprivateca.certificates.createc                 h    [        U5      [        U 5      -
  nU(       a  [        R                  " X#S9eg)zDRaises an exception if the expected permissions are not all present.)resourcemissing_permissionsN)setr   InsufficientPermissionException)actual_permissionsexpected_permissionsr   diffs       /lib/googlecloudsdk/command_lib/privateca/iam.py_CheckAllPermissionsr   %   s8     
!	"S);%<	<$	

4
45 5 
    Nc                     [        [        R                  " U [        5      R                  [        S5        U(       a5  [        [
        R                  " U[        5      R                  [        S5        gg)a!  Ensures that the current user has the required permissions to create a CA.

Args:
  project_ref: The project where the new CA will be created.
  kms_key_ref: optional, The KMS key that will be used by the CA.

Raises:
  InsufficientPermissionException: If the user is missing permissions.
projectzKMS keyN)r   r   TestIamPermissions!_CA_CREATE_PERMISSIONS_ON_PROJECTpermissionskms_iamTestCryptoKeyIamPermissions_CA_CREATE_PERMISSIONS_ON_KEY)project_refkms_key_refs     r   *CheckCreateCertificateAuthorityPermissionsr   .   sZ     %%
8::E+'4 ++6	88C%y2 r   c           	         [         R                  " SS9n[         R                  " SS9nUR                  R	                  UR                  U R                  5       UR                  [        S9S95      n[        UR                  [        S5        g)zEnsures that the current user can issue a certificate from the given Pool.

Args:
  issuing_ca_pool_ref: The CA pool that will create the certificate.

Raises:
  InsufficientPermissionException: If the user is missing permissions.
v1)api_version)r   )r   testIamPermissionsRequestz
issuing CAN)privateca_baseGetClientInstanceGetMessagesModuleprojects_locations_caPoolsr   :PrivatecaProjectsLocationsCaPoolsTestIamPermissionsRequestRelativeNameTestIamPermissionsRequest*_CERTIFICATE_CREATE_PERMISSIONS_ON_CA_POOLr   r   )issuing_ca_pool_refclientmessagestest_responses       r   !CheckCreateCertificatePermissionsr-   C   s     ++=&--$?(33FFII&335$,$F$FD %G %F J GH-
 }00A<Qr   )N)__doc__googlecloudsdk.api_lib.cloudkmsr   r   +googlecloudsdk.api_lib.cloudresourcemanagerr    googlecloudsdk.api_lib.privatecar   r!   $googlecloudsdk.command_lib.privatecar   r   r   r(   r   r   r-    r   r   <module>r4      sN    + ; D C ; '!  .% !
 /N-N *52*Qr   