
                         @   d Z ddlmZ ddlmZ ddlmZ ddlZddlmZ ddlm	Z	 ddl
mZ dd	lmZ dd
lmZ  e	j                   e	j"                  j$                  e	j"                  j&                  e	j"                  j(                         G d de	j*                               Zy)z.Command for signing jwts for service accounts.    )absolute_import)division)unicode_literalsN)util)base)iam_util)log)filesc                   p    e Zd ZdZ ej
                  d       ej
                  d      dZed        Zd Z	y)SignJwtzSign a JWT with a managed service account key.

  This command signs a JWT using a system-managed service account key.

  If the service account does not exist, this command returns a
  `PERMISSION_DENIED` error.
  z
          To create a sign JWT with a system-managed service account key, run:

            $ {command} --iam-account=my-iam-account@my-project.iam.gserviceaccount.com input.json output.jwt
          z
          For more information on how this command ties into the wider cloud
          infrastructure, please see
          [](https://cloud.google.com/appengine/docs/java/appidentity/).
        )EXAMPLESzSEE ALSOc                 |    | j                  ddd       | j                  ddd       | j                  d	d
d       y )Nz--iam-accountTzThe service account to sign as.)requiredhelpinputz
INPUT-FILEzBA path to the file containing the JSON JWT Claim set to be signed.)metavarr   outputzOUTPUT-FILEz3A path the resulting signed JWT will be written to.)add_argument)parsers    ,lib/surface/iam/service_accounts/sign_jwt.pyArgszSignJwt.Args9   s^    
$-N  P '  (       c           
      *   t        j                         \  }}|j                  j                  |j	                  t        j                  |j                        |j                  t        j                  |j                                          }t        j                  |j                  |j                  dd       t        j                   j#                  dj%                  |j                  |j                  |j                  |j&                               y )N)payload)namesignJwtRequestFT)contentbinaryprivatez3signed jwt [{0}] as [{1}] for [{2}] using key [{3}])r   "GetIamCredentialsClientAndMessagesprojects_serviceAccountsr   3IamcredentialsProjectsServiceAccountsSignJwtRequestr   EmailToAccountResourceNameiam_accountSignJwtRequestr
   ReadFileContentsr   r	   WriteToFileOrStdoutr   	signedJwtstatusPrintformatkeyId)selfargsclientmessagesresponses        r   RunzSignJwt.RunJ   s    >>@FH..66DD44T5E5EF#22..tzz; 3 = 	E 	>?H X//tMJJ=DDJJT%5%5x~~	GHr   N)
__name__
__module____qualname____doc__textwrapdedentdetailed_helpstaticmethodr   r2    r   r   r   r      sR     (//   (//  -   Hr   r   )r6   
__future__r   r   r   r7   googlecloudsdk.api_lib.iamr   googlecloudsdk.callioper   googlecloudsdk.command_lib.iamr   googlecloudsdk.corer	   googlecloudsdk.core.utilr
   ReleaseTracksReleaseTrackALPHABETAGACommandr   r;   r   r   <module>rH      s     5 &  '  + ( 3 # * D%%++T->->-C-C%%((*5Hdll 5H*5Hr   