\dZddlmZddlmZddlmZddlmZddlmZddl mZ dZ dZ y ) zEUtility functions for Functions specific to deploying Gen2 functions.)absolute_import)division)print_function)unicode_literals)utilcdjtjtj}tj |ddgdy)zEnsures the project's Pub/Sub service account has permission to create tokens. If the permission is missing, prompts the user to grant it. If the console cannot prompt, prints a warning instead. z0service-{}@gcp-sa-pubsub.iam.gserviceaccount.comz$roles/iam.serviceAccountTokenCreatorzroles/pubsub.serviceAgentzPub/Sub needs this role to create identity tokens. For more details, please see https://cloud.google.com/pubsub/docs/push#authentication) alt_rolesreasonN)format projects_utilGetProjectNumberapi_util GetProjectPromptToBindRoleIfMissing) pubsub_sas :lib/googlecloudsdk/command_lib/functions/v2/deploy_util.py'ensure_pubsub_sa_has_token_creator_rolersN AGG$$X%8%8%:;) $$,,- E c|Dcgc]}|jdk(s|}}|r#tj|djyycc}w)aEnsures appropriate Data Access Audit Logs are enabled for the given event filters. If they're not, the user will be prompted to enable them or warned if the console cannot prompt. Args: trigger_event_filters: the CAL trigger's event filters. serviceNamerN) attributer!PromptToEnableDataAccessAuditLogsvalue)trigger_event_filtersfservice_filters r#ensure_data_access_logs_are_enabledr1sT'&A!++*Fa& ..~a/@/F/FGs AAN) __doc__ __future__rrrr#googlecloudsdk.api_lib.functions.v2rr#googlecloudsdk.command_lib.projectsr rrrrr#s*L'%'@E,Hr