
    T                     |    d Z ddlmZ ddlmZ ddlmZ ddlZddlmZ ddl	m
Z
 ddlmZ dd	lmZ d
 Zd Zd Zd Zy)zUtilities necessary to augment images statuses with org policy.

AugmentImagesStatus function in this module call OrgPolicy and augment images
status if the policy requires it.
    )absolute_import)division)unicode_literalsN)
exceptions)org_policies)log)	resourcesc              #   X  K   t        j                  t        |            }g }t        ||      }|M|D ]G  }|d   dk7  r| t	        | | j                  |d         j                  ||      r| ?d|d<   | I n|D ]  }|  |xs g D ]  }t        j                  |        yw)a  Sets images status to 'BLOCKED_BY_POLICY' as specified by OrgPolicy.

  Get OrgPolicy for the project and set images status to BLOCKED_BY_POLICY
  if the policy exists and blocks the image. If no policy exists, all images are
  allowed.

  NOTE: This function sends requests to OrgPolicy API.

  Args:
    resource_registry: resources.Registry, Resource registry
    project_id: str, Project in which image will be used
    images: Iterable[Dict], The images (in dict form) to set the status on

  Yields:
    Images (in dict form) with status set to BLOCKED_BY_POLICY as specified by
    OrgPolicy.

  Raises:
    exceptions.GetPolicyError if OrgPolicy call failed or returned malformed
    data.
  NstatusREADYselfLinkBLOCKED_BY_POLICY)	copydeepcopylist_GetPolicyNoThrow
_IsAllowedParseprojectr   info)resource_registry
project_idimageserrors_collectedpolicyimageerrors          7lib/googlecloudsdk/command_lib/compute/images/policy.pyAugmentImagesStatusr   !   s     4 ==f&& Z)9:& 	xG	#''--eJ.?@HH.0 -h  k   %2%eHHUO &s   B(B*c                    t        j                         }|j                  | |j                  t        j                  d                  }t        j
                         }|j                  j                  |      }|j                  S )z*Get effective org policy of given project.zcompute.trustedImageProjects)
constraint)
projectsIdgetEffectiveOrgPolicyRequest)	r   OrgPoliciesMessages8CloudresourcemanagerProjectsGetEffectiveOrgPolicyRequestGetEffectiveOrgPolicyRequestFormatConstraintOrgPoliciesClientprojectsGetEffectiveOrgPolicy
listPolicy)r   messagesrequestclientresponses        r   
_GetPolicyr0   _   s    --/(MM#+#H#H!22,. $I $/ N 0'
 ))+&__227;( 
		    c                 |    	 t        |       S # t        j                  $ r}|j                  |       Y d}~yd}~ww xY w)z7Call GetPolicy and handle possible errors from backend.N)r0   apitools_exceptions	HttpErrorappend)r   errors_to_propagatees      r   r   r   o   s;    j!!		&	&  q!s   
 ;6;c                    |j                   |j                  j                  u ry|j                   |j                  j                  u ryd}|j                  sd}	 |j                  D ]  }| j                  |d        	 | j                  |d      j                         |j                  v rd}	 d}	 |j                  D ]  }| j                  |d        	 | j                  |d      j                         |j                  v rd}	 |xr | S # t        j                  $ r}|j                  |       d}Y d}~d}~ww xY w# t        j                  $ r}d}|j                  |       Y d}~ed}~ww xY w)z,Decides if project is allowed within policy.TFzcompute.projects)
collectionN)	allValuesAllValuesValueValuesEnumALLOWDENYallowedValuesParseRelativeNamer   RelativeNamer	   InvalidResourceExceptionr5   deniedValues)r   r   r   r6   
is_allowedproject_recordr7   	is_denieds           r   r   r   |   sw    88>>>6::???*			J ..)).:LM / 	% 	  	''3|~9M9M	N j)
 --)).:LM . 	% 	  	''3|~9L9L	M i		%I%1 
	+	+  q!J	 
	+	+ "Iq!!"s0   #D
 /#D= 
D:D55D:=E-E((E-)__doc__
__future__r   r   r   r   apitools.base.pyr   r3   'googlecloudsdk.api_lib.resource_managerr   googlecloudsdk.corer   r	   r   r0   r   r    r1   r   <module>rL      s9    '  '  > @ # );| 
)&r1   