
    3                     ,   d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z
 ddlmZ ddlmZ ddlm	Z	 dd	lmZ dd
lmZ dd	lmZ dgZdZ G d dej*                        Z	 	 	 	 	 	 	 ddZ G d dej.                  ej0                  e	j2                        Zy)z@A module to get a credentialed http object for making API calls.    )absolute_import)division)unicode_literals)external_account)requests)base)
exceptions)	transport)storei     c                       e Zd ZdZy)ErrorzExceptions for this module.N)__name__
__module____qualname____doc__     /lib/googlecloudsdk/core/credentials/requests.pyr   r   #   s    #r   r   Nc                     t        j                  | ||||      }t               }t        j                         }t        j                  ||      }	|j                  |||d|	      }|j                  |||	      }|S )a  Get requests.Session object for working with the Google API.

  Args:
    timeout: double, The timeout in seconds to pass to httplib2.  This is the
        socket level timeout.  If timeout is None, timeout is infinite.  If
        default argument 'unset' is given, a sensible default is selected.
    ca_certs: str, absolute filename of a ca_certs file that overrides the
        default
    enable_resource_quota: bool, By default, we are going to tell APIs to use
        the quota of the project being operated on. For some APIs we want to use
        gcloud's quota, so you can explicitly disable that behavior by passing
        False here.
    allow_account_impersonation: bool, True to allow use of impersonated service
        account credentials for calls made with this client. If False, the
        active user credentials will always be used.
    session: requests.Session instance. Otherwise, a new requests.Session will
        be initialized.
    streaming_response_body: bool, True indicates that the response body will
        be a streaming body.
    redact_request_body_reason: str, the reason why the request body must be
        redacted if --log-http is used. If None, the body is not redacted.

  Returns:
    1. A regular requests.Session object if no credentials are available;
    2. Or an authorized requests.Session object authorized by google-auth
       credentials.

  Raises:
    creds_exceptions.Error: If an error loading the credentials occurs.
  )timeoutca_certssessionstreaming_response_bodyredact_request_body_reasonTcredentials)	r   
GetSessionRequestWrapperr   UseGoogleAuthr   LoadIfEnabled	WrapQuotaWrapCredentials)
r   r   enable_resource_quotaallow_account_impersonationr   r   r   request_wrapperuse_google_authr   s
             r   r   r   '   s    J 5!;' #$/&&(/##!?+ %%!
 & ' ++* , ' 
.r   c                        e Zd ZdZd Z	 ddZy)r   z-Class for wrapping requests.Session requests.c                 |    j                   ddit        j                        dfd	}|_         S )z=Returns an http_client authorized with the given credentials.attemptr   c                    
j                   }
_         	j                  | ||       |
_          | |f||xs i d|}|j                  t        v rst	        	t
        j                        r	j                  sMd   t        k  rAdxx   dz  cc<   	j                  t        j                                 | |f||xs i d|}|S )N)dataheadersr*   r   )requestbefore_requeststatus_codeREFRESH_STATUS_CODES
isinstancegoogle_auth_external_accountCredentialsvalidMAX_REFRESH_ATTEMPTSrefreshr   GoogleAuthRequest)methodurlr,   r-   kwargswrapped_requestresponseauth_requestcredential_refresh_statecredshttp_clientorig_requests          r   WrappedRequestz6RequestWrapper.AuthorizeClient.<locals>.WrappedRequests   s    #++o(k<g>+k
#C '-RC;ACh 

"6
6%!=!I!IJ{{
"9
-0D
D +q0+h0023CE"GMrE=CE or   )NN)r.   google_auth_requestsRequest)selfrA   r@   rC   r>   r?   rB   s    `` @@@r   AuthorizeClientzRequestWrapper.AuthorizeClientm   sB    &&L )1~'//<L * )Kr   Nc                    	 | j                  ||||      }|s|S |j                  | j                  ||      		fd}t        j                         r	||_        |S 	|_        |S )z3Returns an http_client with quota project handling.r   c                       | i |}|j                   dk7  r|S |j                  }|j                  xs t        j                  |_        	 |j	                         d   d   }	 ||_        |D ]f  }|j                  d      dk(  s|j                  d      t        j                  k(  s;|j                  d      t        j                  k(  s^ | i |c S  |S # t
        t        f$ r |cY ||_        S w xY w# ||_        w xY w)a  Retries the request after removing the quota project header.

      Try the request with the X-Goog-User-Project header. If the account does
      not have the permission to expense the quota of the user project in the
      header, remove the header and retry.

      Args:
        *args: *args to send to requests.Session.request method.
        **kwargs: **kwargs to send to requests.Session.request method.

      Returns:
        Response from requests.Session.request.
      i  errordetailsz@typez(type.googleapis.com/google.rpc.ErrorInforeasondomain)r0   encodingcore_transportENCODINGjsonKeyError
ValueErrorgetr
   USER_PROJECT_ERROR_REASONUSER_PROJECT_ERROR_DOMAIN)argsr;   r=   old_encodingerr_details
err_detailrB   r<   s         r   RequestWithRetryz2RequestWrapper.WrapQuota.<locals>.RequestWithRetry   s     !$1&1h				$&&l"++F~/F/Fh)mmog.y9 )#*NN7#9:NN8$	(K(KKNN8$	(K(KKt.v.
. $ o 
# ( )s$   C C1'C4 0C11C4 4	C=)QuotaProjectr.   QuotaWrappedRequestr   #UserProjectQuotaWithFallbackEnabled)
rF   rA   r$   r%   r'   r   quota_projectr[   rB   r<   s
           @@r   r"   zRequestWrapper.WrapQuota   s     %%#	 & M &&L..{MJOB //1,k  ,kr   )N)r   r   r   r   rG   r"   r   r   r   r   r   f   s    
 6H 9r   r   )unsetNTTNFN)r   
__future__r   r   r   google.authr   r3   google.auth.transportr   rD   googlecloudsdk.callioper   googlecloudsdk.corer	   r
   rO   googlecloudsdk.core.credentialsr   r1   r6   r   r   CredentialWrappingMixinQuotaHandlerMixinr   r   r   r   <module>ri      s     G &  ' H B ( * ( ; 1 5u  $J $ %)+/',*.<~^%%^r   