
                         8   d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl	mZ ddl	m
Z
 ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ  ej.                  ej0                  j2                         G d dej4                               Zy)z)Activate a pending certificate authority.    )absolute_import)division)unicode_literals)base)request_utils)
exceptions)create_utils)flags)
operations)	pem_utils)resource_args)log)
console_io)filesc                   J     e Zd ZdZ fdZed        Zd Zd Zd Z	d Z
 xZS )Activateap  Activate a subordinate certificate authority awaiting user activation.

  ## EXAMPLES

  To activate a subordinate CA named 'server-tls-1' in the location 'us-west1'

  and CA Pool 'server-tls-pool' using a PEM certificate chain in 'chain.crt':

    $ {command} server-tls-1 \
      --location=us-west1 \
      --pool=server-tls-pool \
      --pem-chain=./chain.crt
  c                     t        t        | 
  |i | t        j                  d      | _        t        j                  d      | _        y )Nv1api_version)superr   __init__privateca_baseGetClientInstanceclientGetMessagesModulemessages)selfargskwargs	__class__s      .lib/surface/privateca/subordinates/activate.pyr   zActivate.__init__3   s;    	(D"D3F3 22tDDK"44FDM    c                     t        j                  | d       t        j                  ddd      j	                  |        t        j                  |        y )Nzto activatez--pem-chainTzA file containing a list of PEM-encoded certificates, starting with the current CA certificate and ending with the root CA certificate.)requiredhelp)r   %AddCertAuthorityPositionalResourceArgr   ArgumentAddToParserr
   AddAutoEnableFlag)parsers    r"   ArgszActivate.Args8   sC    77NMM	 k&	F#r#   c                 @   	 t        j                  |      }t        j                  |      }t        |      dk  rt        j                  dd      |d   |dd fS # t         j                  t        t        f$ r% t        j                  dj                  |            w xY w)a)  Parses a pem chain from a file, splitting the leaf cert and chain.

    Args:
      pem_chain_file: file containing the pem_chain.

    Raises:
      exceptions.InvalidArgumentException if not enough certificates are
      included.

    Returns:
      A tuple with (leaf_cert, rest_of_chain)
    z,Could not read provided PEM chain file '{}'.   z	pem-chainzpThe pem_chain must include at least two certificates - the subordinate CA certificate and an issuer certificate.r      N)r   ReadFileContentsErrorOSErrorIOErrorr   BadFileExceptionformatr   ValidateAndParsePemChainlenInvalidArgumentException)r   pem_chain_filepem_chain_inputcertss       r"   _ParsePemChainFromFilezActivate._ParsePemChainFromFileF   s    ..~>o ..?E
5zA~//
C  8U12Y KK'* ''
8
?
?
O s   A ABc                    | j                   j                  || j                   j                  t        j                                     }| j
                  j                  j                  |      }t        j                  |dd      S )zEnables the given CA.)	requestId)name!enableCertificateAuthorityRequestzEnabling CA.r   r   )
r   DPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesEnableRequest!EnableCertificateAuthorityRequestr   GenerateRequestIdr   1projects_locations_caPools_certificateAuthoritiesEnabler   Await)r   ca_nameenable_request	operations       r"   _EnableCertificateAuthorityz$Activate._EnableCertificateAuthorityd   s|    ]]gg*.--*Y*Y#557 +Z +
 h N 	EELL	
 
 I~4HHr#   c                    |j                   ry|j                         j                         }| j                  j                  j                  | j                  j                  |            }t        j                  |j                  | j                        ryt        j                  dj                  |j                         j                               d      S )z3Determines whether the CA should be enabled or not.T)parentFzThe CaPool [{}] has no enabled CAs and cannot issue any certificates until at least one CA is enabled. Would you like to also enable this CA?)messagedefault)auto_enableParentRelativeNamer   rD   Listr   BPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesListRequestr	   HasEnabledCacertificateAuthoritiesr   PromptContinuer5   Name)r   r   ca_refca_pool_namelist_responses        r"   _ShouldEnableCazActivate._ShouldEnableCas   s     ==?//1LKKQQVVXX 	Y 	
M
   ,,dmm  $$##)6&--/*>*>*@#A r#   c                    t        j                  d      }t        j                  d      }|j                  j                  j                         }| j                  |j                        \  }}|j                  j                  |j                  |j                         |j                  ||j                  |j                  |                              }t        j                   |dd       t"        j$                  j'                  dj)                  |j+                                      | j-                  ||      r | j/                  |j                                y y )	Nr   r   )pemCertificates)pemIssuerChain)pemCaCertificatesubordinateConfig)r?   #activateCertificateAuthorityRequestz!Activating Certificate Authority.z%Activated Certificate Authority [{}].)r   r   r   CONCEPTScertificate_authorityParser<   	pem_chainrD   r   FPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesActivateRequestrQ   #ActivateCertificateAuthorityRequestSubordinateConfigSubordinateConfigChainr   rF   r   statusPrintr5   rW   r[   rJ   )r   r   r   r   rX   pem_certre   rI   s           r"   RunzActivate.Run   s8   --$?F//DAH]]00668F55dnnEHiHHQQWW$$&080\0\!)"*"<"<#+#B#B(1 $C $ #= # 1] 1 	X 
	
I 6D JJ/66v{{}E D&)
&&v':':'<= *r#   )__name__
__module____qualname____doc__r   staticmethodr,   r<   rJ   r[   rm   __classcell__)r!   s   @r"   r   r   #   s7    G
 $ $<I6>r#   r   N)rq   
__future__r   r   r    googlecloudsdk.api_lib.privatecar   r   r   googlecloudsdk.callioper   $googlecloudsdk.command_lib.privatecar	   r
   r   r   r   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   ReleaseTracksReleaseTrackGASilentCommandr    r#   r"   <module>r      st    0 &  ' C : ( . = 6 ; : > # 2 * D%%(()F>t!! F> *F>r#   