
                             d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
mZ ddlmZ d	gZd
gZdgZd ZddZd Zy)z$Helpers for testing IAM permissions.    )absolute_import)division)unicode_literals)iam)projects_api)base)
exceptionsz cloudkms.cryptoKeys.setIamPolicyz'privateca.certificateAuthorities.createzprivateca.certificates.createc                 d    t        |      t        |       z
  }|rt        j                  ||      y)zDRaises an exception if the expected permissions are not all present.)resourcemissing_permissionsN)setr	   InsufficientPermissionException)actual_permissionsexpected_permissionsr   diffs       /lib/googlecloudsdk/command_lib/privateca/iam.py_CheckAllPermissionsr   (   s:     
!	"S);%<	<$	

4
4t5 5 
    Nc                     t        t        j                  | t              j                  t        d       |r4t        t        j                  |t              j                  t        d       yy)a-  Ensures that the current user has the required permissions to create a CA.

  Args:
    project_ref: The project where the new CA will be created.
    kms_key_ref: optional, The KMS key that will be used by the CA.

  Raises:
    InsufficientPermissionException: If the user is missing permissions.
  projectzKMS keyN)r   r   TestIamPermissions!_CA_CREATE_PERMISSIONS_ON_PROJECTpermissionskms_iamTestCryptoKeyIamPermissions_CA_CREATE_PERMISSIONS_ON_KEY)project_refkms_key_refs     r   *CheckCreateCertificateAuthorityPermissionsr   1   sZ     %%
8::E+'4 ++6	88C%y2 r   c                 .   t        j                  d      }t        j                  d      }|j                  j	                  |j                  | j                         |j                  t                          }t        |j                  t        d       y)zEnsures that the current user can issue a certificate from the given Pool.

  Args:
    issuing_ca_pool_ref: The CA pool that will create the certificate.

  Raises:
    InsufficientPermissionException: If the user is missing permissions.
  v1)api_version)r   )r   testIamPermissionsRequestz
issuing CAN)privateca_baseGetClientInstanceGetMessagesModuleprojects_locations_caPoolsr   :PrivatecaProjectsLocationsCaPoolsTestIamPermissionsRequestRelativeNameTestIamPermissionsRequest*_CERTIFICATE_CREATE_PERMISSIONS_ON_CA_POOLr   r   )issuing_ca_pool_refclientmessagestest_responses       r   !CheckCreateCertificatePermissionsr0   F   s     ++=&--$?(33FFII&335$,$F$FD %G %F J GH-
 }00A<Qr   )N)__doc__
__future__r   r   r   googlecloudsdk.api_lib.cloudkmsr   r   +googlecloudsdk.api_lib.cloudresourcemanagerr    googlecloudsdk.api_lib.privatecar   r$   $googlecloudsdk.command_lib.privatecar	   r   r   r+   r   r   r0    r   r   <module>r8      sU    + &  ' : D C ; '!  .% !
 /N-N *52*Qr   