
    j                       d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlZddl	Z	ddl
Z
ddlmZ dd	lmZ dd
lmZ ddlmc mZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl m!Z! ddl"m#Z# ddl$m%Z% ddl$m&Z& ddl$m'Z( ddl$m)Z) ddl$m*Z* ddl$m+Z+ ddl,m-Z- ddl.m/Z/m0Z0  e/ e0ddd             ddl1m2Z2 ejf                  jh                  Z5dZ6d e6z  Z7d!Z8d"Z9d#Z:d$Z;d%Z<d4d&Z=d' Z> G d( d)ej~                        Z@ ed*       ed+       G d, d-ej                                      ZB ed*       ed+       G d. d/e@                    ZC ed*       ed+       G d0 d1e@                    ZD G d2 d3ej                        ZFy)5z&Integration tests for the iam command.    )absolute_import)print_function)division)unicode_literals)defaultdictN)iam)CommandException)PopulateProjectId)	SkipForS3)
SkipForXML)GenerationFromURI)SetBotoConfigForTest)SetEnvironmentForTest)unittest)storage_v1_messages)	shim_util)UTF8)BindingsMessageToUpdateDict)BindingsDictToUpdateDict)BindingStringToTuple)DiffBindings)IsEqualBindings)PatchBindings)Retry)add_moveMovedModulemockzunittest.mock)r   legacyBucketReaderzroles/storage.%sz roles/storage.legacyObjectReaderzroles/storage.objectViewerz#Description for our test condition.z.resource.type == "google.cloud.storage.Object"zTest Condition Titlec                 *    |dgn|| d}|r||d<   |gS )aT  Generate the "bindings" portion of an IAM Policy dictionary.

  Generates list of dicts which each represent a
  storage_v1_messages.Policy.BindingsValueListEntry object. The list will
  contain a single dict which has attributes corresponding to arguments passed
  to this method.

  Args:
    role: (str) An IAM policy role (e.g. "roles/storage.objectViewer"). Fully
        specified in BindingsValueListEntry.
    members: (List[str]) A list of members (e.g. ["user:foo@bar.com"]). If None,
        bind to ["allUsers"]. Fully specified in BindingsValueListEntry.
    condition: (Dict) A dictionary representing the JSON used to define a
        binding condition, containing the keys "description", "expression", and
        "title".

  Returns:
    (List[Dict[str, Any]]) A Python representation of the "bindings" portion of
    an IAM Policy.
  allUsersmembersrole	condition )r#   r"   r$   bindings       'platform/gsutil/gslib/tests/test_iam.pygen_bindingr(   D   s0    , ")*g' $GK
    c                     | j                  dg       D cg c]  }|j                  dd      |k7  s| }}|j                  |       t        |       } || d<   | S c c}w )a  Returns a patched Python object representation of a Policy.

  Given replaces the original role:members binding in policy with new_policy.

  Args:
    policy: Python dict representation of a Policy instance.
    role: An IAM policy role (e.g. "roles/storage.objectViewer"). Fully
          specified in BindingsValueListEntry.
    new_policy: A Python dict representation of a Policy instance, with a
                single BindingsValueListEntry entry.

  Returns:
    A Python dict representation of the patched IAM Policy object.
  bindingsr#    )getextenddict)policyr#   
new_policybr+   s        r'   patch_bindingr3   b   si      J++AquuVR/@D/Ha+   //*<&&	-s
   AAc                       e Zd ZdZd Zy)TestIamIntegrationz*Superclass for iam integration test cases.c                 &   t        j                  |      d   D cg c]  }t        |d   |d          }}t        j                  |      d   D cg c]  }t        |d   |d          }}| j                  t	        ||             yc c}w c c}w )z1Asserts two serialized policy bindings are equal.r+   r"   r#   r!   N)jsonloadsbvle
assertTruer   )selfar2   binding_dictexpectedresults         r'   assertEqualsPoliciesStringz-TestIamIntegration.assertEqualsPoliciesString}   s     !JJqM*55L 	\),<3GH5   !JJqM*55L 	\),<3GH5   	OOOHf56s   B	BN)__name__
__module____qualname____doc__r@   r%   r)   r'   r5   r5   z   s
    2
7r)   r5   zTests use GS IAM model.z!XML IAM control is not supported.c                       e Zd ZdZd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d Z!y )!TestIamHelpersz"Unit tests for iam command helper.c                     | j                  t        g       t        t                     t        t        dt        dg      i      }| j                  t        t	        ddg      g      |       yzATests that Policy.bindings lists are converted to dicts properly.xyr#   r"   N)assertEqualr   r   setr9   r;   r>   s     r'   test_convert_bindings_simplez+TestIamHelpers.test_convert_bindings_simple   sY    04k#6FG3c3%j 12H#TsSE%B$CDhPr)   c                    t        t        dt        ddg      i      }t        ddg      t        ddg      g}t        dddg      t        ddg      g}| j                  t	        |      |       | j                  t	        |      |       yz>Test that role and member duplication are converted correctly.rI   rJ   zrK   N)r   rM   r9   rL   r   r;   r>   duplicate_rolesduplicate_memberss       r'    test_convert_bindings_duplicatesz/TestIamHelpers.test_convert_bindings_duplicates   s    3c3*o 67H#u%#u%O
 	#Sz*#u% 	0A8L01BCXNr)   c                     | j                  t        g       t        t                     t        t        dt        dg      i      }| j                  t        ddgdg      |       yrH   )rL   r   r   rM   rN   s     r'   !test_convert_bindings_dict_simplez0TestIamHelpers.test_convert_bindings_dict_simple   sa    -b1;s3CD3c3%j 12H u#
 " 	 	r)   c                     t        t        dt        ddg      i      }ddgdddgdg}dddgdddgdg}| j                  t        |      |       | j                  t        |      |       yrQ   )r   rM   rL   r   rS   s       r'   %test_convert_bindings_dict_duplicatesz4TestIamHelpers.test_convert_bindings_dict_duplicates   s    3c3*o 67H5 5O : 5 	-o>I-.?@(Kr)   c                     t        ddg      g}| j                  t        g g              | j                  t        ||             y)z)Tests an easy case of identical bindings.rI   rJ   rK   Nr9   r:   r   )r;   r+   s     r'   test_equality_bindings_literalz-TestIamHelpers.test_equality_bindings_literal   s9    #u-.HOOOB+,OOOHh78r)   c                     t        dddg      g}|dz  }t        ddg      t        ddg      g}| j                  t        ||             | j                  t        ||             y)z7Tests bindings equality when duplicate roles are added.rI   rJ   rK      Nr\   )r;   r+   	bindings2	bindings3s       r'   "test_equality_bindings_extra_rolesz1TestIamHelpers.test_equality_bindings_extra_roles   se    #Sz23H1I#u%#u%I 	OOOHi89OOOHi89r)   c                     t        ddg      g}t        g |      \  }}| j                  |j                  |       | j                  |j                  g        y)z4Tests simple grant behavior of Policy.bindings diff.rI   rJ   rK   Nr9   r   rL   r+   r;   r>   grantedremoveds       r'   test_diff_bindings_add_rolez*TestIamHelpers.test_diff_bindings_add_role   sP    #u-.H%b(3WgW%%x0W%%r*r)   c                     t        ddg      g}t        |g       \  }}| j                  |j                  g        | j                  |j                  |       y)z5Tests simple remove behavior of Policy.bindings diff.rI   rJ   rK   Nrd   re   s       r'   test_diff_bindings_drop_rolez+TestIamHelpers.test_diff_bindings_drop_role   sP    #u-.H%h3WgW%%r*W%%x0r)   c                     t        ddg      g}t        ddg      g}t        ||      \  }}| j                  |j                  |       | j                  |j                  |       y)z,Tests expected behavior of switching a role.rI   rJ   rK   r<   r2   Nrd   r;   oldnewrf   rg   s        r'   test_diff_bindings_swap_rolez+TestIamHelpers.test_diff_bindings_swap_role   a    S3%(
)CS3%(
)C%c3/WgW%%s+W%%s+r)   c                     t        ddg      g}t        dddg      g}t        ddg      g}t        ||      \  }}| j                  |j                  |       | j                  |j                  g        y)z5Tests expected behavior of adding a member to a role.rI   rJ   rK   rR   Nrd   r;   rm   rn   r>   rf   rg   s         r'   test_diff_bindings_add_memberz,TestIamHelpers.test_diff_bindings_add_member   st    S3%(
)CS3*-
.C#u-.H%c3/WgW%%x0W%%r*r)   c                     t        dddg      g}t        ddg      g}t        ddg      g}t        ||      \  }}| j                  |j                  g        | j                  |j                  |       y)z9Tests expected behavior of dropping a member from a role.rI   rR   rJ   rK   Nrd   rr   s         r'   test_diff_bindings_drop_memberz-TestIamHelpers.test_diff_bindings_drop_member   st    S3*-
.CS3%(
)C#u-.H%c3/WgW%%r*W%%x0r)   c                     t        ddg      g}t        ddg      g}t        ||      \  }}| j                  |j                  |       | j                  |j                  |       y)z8Tests expected behavior of switching a member in a role.rI   rR   rK   rJ   Nrd   rl   s        r'   test_diff_bindings_swap_memberz-TestIamHelpers.test_diff_bindings_swap_member   rp   r)   c                     t        ddg      t        ddg      t        ddg      g}t        |      }t        ddg      g}t        |      }t        ||z         }t        ||d      }| j                  ||       y)	zTests patching a grant binding.r<   user:foo@bar.comrK   r2   cdTNr9   r   r   rL   )r;   	base_listbase	diff_listdiffr>   ress          r'   test_patch_bindings_grantz(TestIamHelpers.test_patch_bindings_grant  s     	# 234# 234# 234I
 'y1D# 234I 'y1D*9y+@AH
dD
)CS(#r)   c                     t        t        dgd      t        dgd      t        dgd      g      }t        t        dgd      g      }t        t        dgd      t        dgd      g      }t        ||d      }| j                  ||       y)z Tests patching a remove binding.ry   r<   r!   r2   rz   FNr   r9   r   rL   r;   r~   r   r>   r   s        r'   test_patch_bindings_removez)TestIamHelpers.test_patch_bindings_remove  s    &()4()4()4( D
 '()4( D +()4()4, H
 dE
*CS(#r)   c                 x   t        t        dgd      t        dgd      t        dgd      g      }t        t        dgd      g      }t        ||d      }| j                  |i        t        t        dgd      t        dgd      t        dgd      g      }t        ||d      }| j                  |i        y)	z'Tests removing all roles from a member.ry   r<   r!   r2   rz   r,   FNr   )r;   r~   r   r   s       r'   test_patch_bindings_remove_allz-TestIamHelpers.test_patch_bindings_remove_all%  s    &()4()4()4( D
 '()3( D dE
*CS"&()4()4()4( D dE
*CS"r)   c                 <   t        t        dgd      g      }t        t        dgd      t        ddgd      t        dgd      g      }t        t        dgd      t        dgd      t        dgd      g      }t        ||d      }| j                  ||       y)	z2Tests expected behavior when multiple users exist.zuser:fii@bar.comr2   r!   ry   r<   rz   FNr   )r;   r>   r~   r   r   s        r'   "test_patch_bindings_multiple_usersz1TestIamHelpers.test_patch_bindings_multiple_users;  s    *()4, H '()4(*<=CH()4( D
 '()4()4()4( D
 dE
*CS(#r)   c                 <   t        t        ddg      t        ddg      t        ddg      g      }t        t        ddg      g      }t        t        dddg      t        ddg      t        ddg      g      }t        ||d      }| j                  ||       y)	zTests a public member grant.r<   ry   rK   r2   rz   r    TNr   r   s        r'   #test_patch_bindings_grant_all_usersz2TestIamHelpers.test_patch_bindings_grant_all_usersM  s    &# 234# 234# 234( D
 '#
|,( D +#
,>?@# 234# 234, H dD
)CS(#r)   c                     t        ddg      g}t        |      }t        ddg      g}t        |      }t        ||d      }| j                  |t        ||z                y)z2Tests public member vs. public member interaction.r<   r    rK   allAuthenticatedUsersTNr|   )r;   r}   r~   r   r   r   s         r'   +test_patch_bindings_public_member_overwritez:TestIamHelpers.test_patch_bindings_public_member_overwrite`  sm     	#
|,I 'y1D# 789I 'y1D
dD
)CS5i)6KLMr)   c                     t        dd      \  }}| j                  t        |      d       | j                  dgdd|       y)z-Tests parsing single role (case insensitive).Tzallusers:admin   r    roles/storage.adminr!   NbsttrL   lenassertInr;   _r+   s      r'   $test_valid_public_member_single_rolez3TestIamHelpers.test_valid_public_member_single_rolen  sE    /0MQS]A&MM<% r)   c                    | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       y# 1 sw Y   xY w# 1 sw Y   jxY w# 1 sw Y   LxY w# 1 sw Y   yxY w)zDTests that an error is raised when no role is specified for a grant.Tr    Nry   zuser:foo@bar.com:z"deleted:user:foo@bar.com?uid=1234:assertRaisesr	   r   r;   s    r'   test_grant_no_role_errorz'TestIamHelpers.test_grant_no_role_errorw  s    			+	,
4 
-			+	,
4#$ 
-			+	,
4$% 
-			+	,
456 
-	, 
-	,	,	,	,	,	,	,s/   B* B6*CC*B36B?CCc                    t        dd      \  }}| j                  t        |      d       | j                  dgdd|       | j                  ||ft        dd             t        dd      \  }}| j                  t        |      d       y)	z;Tests parsing a -d allUsers or -d user:foo@bar.com request.Fr    r   r,   r!   z	allUsers:ry   Nr   )r;   is_grantr+   r   s       r'   test_remove_all_rolesz$TestIamHelpers.test_remove_all_roles  s      z2XxS]A&MMzlB7Bh)4{+CD  23MQS]A&r)   c                    t        dd      \  }}| j                  t        |      d       | j                  dgdd|       | j                  dgdd|       | j                  dgdd|       | j                  dgd	d|       y
)z2Tests parsing of multiple roles bound to one user.TzallUsers:a,b,c,roles/custom   r    roles/storage.ar!   zroles/storage.bzroles/storage.czroles/customNr   r   s      r'   test_valid_multiple_rolesz(TestIamHelpers.test_valid_multiple_roles  s    <=MQS]A&MM<!  	MM<!  	MM<!  	MMzlNCXNr)   c                     t        dd      \  }}| j                  t        |      d       | j                  dgdd|       | j                  dgdd|       y)	z0Tests parsing of custom roles bound to one user.Tz,user:foo@bar.com:roles/custom1,roles/custom2r_   ry   zroles/custom1r!   zroles/custom2Nr   r   s      r'   test_valid_custom_rolesz&TestIamHelpers.test_valid_custom_roles  sg    MNMQS]A&MM&'  	MM&' r)   c                     t        dd      \  }}| j                  t        |      d       | j                  dgdd|       y)z(Tests member parsing (case insensitive).TzUser:foo@bar.com:adminr   ry   r   r!   Nr   r   s      r'   test_valid_memberz TestIamHelpers.test_valid_member  sF    78MQS]A&MM*+)	
 	r)   c                    t        dd      \  }}| j                  t        |      d       | j                  dgdd|       t        dd      \  }}| j                  t        |      d       | j                  dgd	d|       t        dd
      \  }}| j                  t        |      d       | j                  dgd	d|       | j                  dgdd|       y)z0Tests deleted member parsing (case insensitive).Fz Deleted:User:foo@bar.com?uid=123r   z deleted:user:foo@bar.com?uid=123r,   r!   Tz&deleted:User:foo@bar.com?uid=123:adminr   zAdeleted:user:foo@bar.com?query=param,uid=123?uid=456:admin,admin2r_   z4deleted:user:foo@bar.com?query=param,uid=123?uid=456zroles/storage.admin2Nr   r   s      r'   test_valid_deleted_memberz(TestIamHelpers.test_valid_deleted_member  s     BCMQS]A&MM67  GHMQS]A&MM:;)	
 	 KMMQ 	S]A&MMNO)	
 	
 	MMNO*	
 	r)   c                     t        dd      \  }}| j                  t        |      d       | j                  dgdd|       y)z'Tests that duplicate roles are ignored.TzallUsers:a,ar   r    r   r!   Nr   r   s      r'   test_duplicate_rolesz#TestIamHelpers.test_duplicate_roles  sD    ~.MQS]A&MM<! r)   c                    t        dd      \  }}| j                  t        |      d       | j                  dgdd|       t        dd      \  }}| j                  t        |      d       | j                  dgdd|       y)	z4Tests that project convenience roles can be removed.FprojectViewer:123424:adminr   zprojectViewer:123424r   r!   r,   Nr   r   s      r'   (test_removing_project_convenience_groupsz7TestIamHelpers.test_removing_project_convenience_groups  s     <=MQS]A&MM./)	
 	
  67MQS]A&MM56CXNr)   c                 p    | j                  t              5  t        dd       ddd       y# 1 sw Y   yxY w)z5Tests that project convenience roles cannot be added.Tr   Nr   r   s    r'   &test_adding_project_convenience_groupsz5TestIamHelpers.test_adding_project_convenience_groups  s(    			+	,
4-. 
-	,	,s   ,5c                    | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       y# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   dxY w# 1 sw Y   yxY w)	zTests invalid input handling.Tznon_valid_public_member:roleNznon_valid_type:id:rolezuser:rzdeleted:userzdeleted:not_a_typezdeleted:user:foo@no_uid_suffixr   r   s    r'   test_invalid_inputz!TestIamHelpers.test_invalid_input  s    			+	,
4/0 
-			+	,
4)* 
-			+	,
4 
-			+	,
4  
-			+	,
4%& 
-			+	,
412 
-	, 
-	,	,	,	,	,	,	,	,	,	,	,sG   C> D
*DD">D.(D:>D
DD"D+.D7:Ec                 H   | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       | j                  t              5  t        dd       ddd       y# 1 sw Y   ^xY w# 1 sw Y   @xY w# 1 sw Y   yxY w)z+Tests invalid input due to too many colons.TzallUsers:some_id:some_roleNzuser:foo@bar.com:r:nonsensez,deleted:user:foo@bar.com?uid=1234:r:nonsenser   r   s    r'   test_invalid_n_argsz"TestIamHelpers.test_invalid_n_args   sy    			+	,
4-. 
-			+	,
4./ 
-			+	,
4?@ 
-	,	 
-	,	,	,	,	,s#   B  B*B B	BB!N)"rA   rB   rC   rD   rO   rV   rX   rZ   r]   rb   rh   rj   ro   rs   ru   rw   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r)   r'   rF   rF      s     +POL(9	:+1,+1,$ $$,$$$&N	7
'O$>O/
3Ar)   rF   c                        e Zd ZdZ fdZd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z xZS )	TestIamChz%Integration tests for iam ch command.c                 <   t         t        |           | j                         | _        | j                         | _        | j                  | j                  d      | _        | j                  | j                  d      | _        | j                  dd| j                  j                  gd      | _        | j                  dd| j                  j                  gd      | _        | j                  dd| j                  j                  gd      | _        d| _        d	| _        y )
N   foo
bucket_uricontents   barr   r-   Treturn_stdoutry   zuser:bar@foo.com)superr   setUpCreateBucketbucketbucket2CreateObjectobjectobject2	RunGsUtiluribucket_iam_stringobject_iam_stringobject2_iam_stringuseruser2r;   	__class__s    r'   r   zTestIamCh.setUp  s    	)T "##%DK$$&DL##t{{V#LDK$$f$MDL!^^UE4;;??,K:> , @D!^^UE4;;??,K:> , @D"nneUDLL<L<L-M;? - AD #DI#DJr)   c                 ~    | j                  dd| j                  j                  gdd      }| j                  d|       y)1Tests expected failure if no bindings are listed.r   chTr   return_stderrexpected_statusr	   Nr   r   r   r   r;   stderrs     r'   test_patch_no_rolezTestIamCh.test_patch_no_role   s=    ^^UD$++//:*.,-  /F 	MM$f-r)   c                 ~    | j                  dd| j                  dt        dgdd      }| j                  d|       y	)
r   r   r   :-dTr   r   z?A -d flag is missing an argument specifying bindings to remove.Nr   r   IAM_BUCKET_READ_ROLE_ABBREVr   r   s     r'   5test_raises_error_message_for_d_flag_missing_argumentz?TestIamCh.test_raises_error_message_for_d_flag_missing_argument'  sI    ^^	II:	;T	C	  F
 	MMIr)   c                     | j                  dd| j                  dt        | j                  j                  | j
                  j                  gdd      }| j                  d|       y)	z@Tests expected failure if both buckets and objects are provided.r   r   r   Tr   r   r	   N)r   r   r   r   r   r   r   r   s     r'   $test_path_mix_of_buckets_and_objectsz.TestIamCh.test_path_mix_of_buckets_and_objects2  sZ    ^^t999:DKKOO
 +/,-  /F 	MM$f-r)   c                 ~    | j                  dd| j                  dt        dgdd      }| j                  d|       y	)
z=Tests expected failure is caught when a file url is provided.r   r   r   file://somefileTr   r   AttributeErrorNr   r   s     r'   test_path_file_urlzTestIamCh.test_path_file_url=  sH    ^^t999:<M +/,-  /F 	MM"F+r)   c                 h   | j                  | j                  | j                  t               | j	                  dd| j                  dt
        | j                  j                  g       | j	                  dd| j                  j                  gd      }| j                  || j                  t               y)zTests granting single role.r   r   r   r-   Tr   N)	assertHasNor   r   IAM_BUCKET_READ_ROLEr   r   r   r   	assertHasr;   r   s     r'   %test_patch_single_grant_single_bucketz/TestIamCh.test_patch_single_grant_single_bucketG  s    T++TYY8LMNNt999:DKKOO 
 udkkoo'F59 ' ;NN$dii1EFr)   c                    | j                  dd| j                  dt        | j                  j                  g       | j                  dd| j                  dt        | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  || j                  t               y)z@Granting multiple times for the same member will have no effect.r   r   r   r-   Tr   Nr   r   r   r   r   r   r   r   s     r'   test_patch_repeated_grantz#TestIamCh.test_patch_repeated_grantS  s    NNt999:DKKOO  	NNt999:DKKOO 
 udkkoo'F59 ' ;NN$dii1EFr)   c                    | j                  dd| j                  dt        | j                  j                  g       | j                  ddd| j                  dt        | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  || j                  t               y)	zTests removing a single role.r   r   r   r   r-   Tr   Nr   r   r   r   r   r   r   r   s     r'   &test_patch_single_remove_single_bucketz0TestIamCh.test_patch_single_remove_single_bucketb  s    NNt999:DKKOO  	NNtT999:DKKOO 
 udkkoo'F59 ' ;&		3GHr)   c                 L   | j                  ddd| j                  dt        | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  || j                  t               | j                  || j                         y)	z4Removing a non-existent binding will have no effect.r   r   r   r   r-   Tr   N)	r   r   r   r   r   r   r   r@   r   r   s     r'   test_patch_null_removez TestIamCh.test_patch_null_removeq  s    NNtT999:DKKOO 
 udkkoo'F59 ' ;&		3GH##$5t7M7MNr)   c           	         | j                  dd| j                  dt        | j                  j                  g       | j                  dd| j
                  dt        d| j                  dt        | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  || j
                  t               | j                  || j                  t               y)	z9Tests that mixing grant and remove requests will succeed.r   r   r   r   r-   Tr   N)	r   r   r   r   r   r   r   r   r   r   s     r'   +test_patch_mixed_grant_remove_single_bucketz5TestIamCh.test_patch_mixed_grant_remove_single_bucket}  s    NNt:::;T[[__  	NNt999:D:::;T[[__  udkkoo'F59 ' ;NN$dii1EF&

4HIr)   c                    | j                  dd| j                  dt        | j                  j                  g       | j                  dddt        z  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  |dt               | j                  || j                  t               y	)
zCTest public grant request interacts properly with existing members.r   r   r   zallUsers:%sr-   Tr   r    Nr   r   s     r'   %test_patch_public_grant_single_bucketz/TestIamCh.test_patch_public_grant_single_bucket  s    NNt999:DKKOO  	NNt33T[[__ 
 udkkoo'F59 ' ;NN$j2FGNN$dii1EFr)   c                 z   | j                  dd| j                  dt        | j                  j                  g       | j                  ddd| j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  || j                  t               y)	zDRemove with no roles specified will remove member from all bindings.r   r   r   r   r-   Tr   Nr   r   s     r'   test_patch_remove_all_rolesz%TestIamCh.test_patch_remove_all_roles  s    NNt999:DKKOO  	NNE4tyy$++//BCudkkoo'F59 ' ;&		3GHr)   c                 \   | j                  | j                  | j                  t               | j	                  ddd| j                  z  | j
                  j                  g       | j	                  dd| j
                  j                  gd      }| j                  || j                  t               y)z Tests object IAM patch behavior.r   r   %s:legacyObjectReaderr-   Tr   Nr   r   r   IAM_OBJECT_READ_ROLEr   r   r   r   r;   r   s     r'   test_patch_single_objectz"TestIamCh.test_patch_single_object  s    T++TYY8LMNN		 499	,dkkoo	?@ udkkoo'F59 ' ;NN$dii1EFr)   c                 ^   | j                  | j                  | j                  t               | j	                  dddd| j                  z  | j
                  j                  g       | j	                  dd| j
                  j                  gd      }| j                  || j                  t               y)	z8Tests the edge-case behavior of multithreaded execution.-mr   r   r   r-   Tr   Nr   r   s     r'   &test_patch_multithreaded_single_objectz0TestIamCh.test_patch_multithreaded_single_object  s    T++TYY8LMNNeT$))+T[[__ 
 udkkoo'F59 ' ;NN$dii1EFr)   c           	         | j                  dd| j                  dt        | j                  j                  | j
                  dt        gdd      }| j                  d|       | j                  dd| j                  j                  gd	      }| j                  || j                  t               | j                  || j
                  t               y
)z?Tests that listing bindings after a bucket will throw an error.r   r   r   Tr   r   r	   r-   r   N)
r   r   r   r   r   r   r   r   r   r   )r;   r   r   s      r'   test_patch_invalid_inputz"TestIamCh.test_patch_invalid_input  s    ^^t999:DKKOO:::;
 +/,-  /F 	MM$f-udkkoo'F59 ' ;NN$dii1EF&

4HIr)   c                     | j                  ddd| j                  j                  gdd      }| j                  d|       y)	zBTests that we disallow certain binding types with appropriate err.r   r   zprojectOwner:my-project:adminTr   r   znot supportedNr   r   s     r'   "test_patch_disallowed_binding_typez,TestIamCh.test_patch_disallowed_binding_type  s@    ^^	5t{{G  F 	MM/6*r)   c                    dt               z  }| j                  t        j                  t	        t        j
                  | j                        t        t        t        |g                  j                  t                    }| j                  dd|| j                  j                  g       | j                  dd| j                  j                  gd      }| j                  ||t               | j                  dd	d
|| j                  j                  g       | j                  dd| j                  j                  gd      }| j                  ||t               y)z4Tests that we can remove project convenience values.projectViewer:%s)r"   r   r   rM   r-   Tr   r   r   N)r
   CreateTempFiler7   dumpsr3   r8   r   r   r(   encoder   r   r   r   r   r   )r;   disallowed_memberpolicy_file_path
iam_strings       r'   )test_patch_remove_disallowed_binding_typez3TestIamCh.test_patch_remove_disallowed_binding_type  s%    +->-@@**DJJJJt--.0D,7H 78 9	:5; <B6$<	 + I
 	NNE5"2DKKOODEt{{ ?.2   4JNN:02FGNNE4'8$++//JKt{{ ?.2   4JZ!24HIr)   c                    | j                  dddd| j                  z  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  dd| j
                  j                  gd      }| j                  || j                  t               | j                  || j                  t               y)	z)Tests IAM patch against multiple objects.r   r   -rr   r-   Tr   Nr   r   r   r   r   r   r   r   r;   r   r   s      r'   test_patch_multiple_objectsz%TestIamCh.test_patch_multiple_objects  s    NNtT$))+T[[__ 
 udkkoo'F59 ' ;t||7G7G(H6: ( <NN$dii1EFNN%tyy2FGr)   c                    | j                  ddddd| j                  z  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  dd| j
                  j                  gd      }| j                  || j                  t               | j                  || j                  t               y	)
z6Tests multithreaded behavior against multiple objects.r  r   r   r  r   r-   Tr   Nr  r  s      r'   )test_patch_multithreaded_multiple_objectsz3TestIamCh.test_patch_multithreaded_multiple_objects  s    NNeT4$))+T[[__ 
 udkkoo'F59 ' ;t||7G7G(H6: ( <NN$dii1EFNN%tyy2FGr)   c                 L   | j                  dd| j                  dt        | j                  j                  d| j
                  z  | j                  j                  gdd      }| j                  r| j                  d|       n| j                  d	|       | j                  dd
| j                  j                  gd      }| j                  dd
| j                  j                  gd      }| j                  || j                  t               | j                  || j                         y)zSee TestIamSet.test_set_error.r   r   r   gs://%sTr   r   not found: 404.BucketNotFoundExceptionr-   r   N)r   r   r   r   r   nonexistent_bucket_namer   _use_gcloud_storager   r   r   r@   r   r;   r   r   bucket2_iam_strings       r'   test_patch_errorzTestIamCh.test_patch_error
  s   ^^t999:DKKOOD000$,,2B2B
 +/,-  /F 
mm%v.
mm-v6udkkoo'F59 ' ;t||7G7G(H6: ( < 	NN$dii1EF##$68N8NOr)   c           	      X   | j                  ddd| j                  dt        | j                  j                  d| j
                  z  | j                  j                  gdd      }| j                  r| j                  d	|       n| j                  d
|       | j                  dd| j                  j                  gd      }| j                  dd| j                  j                  gd      }| j                  || j                  t               | j                  || j                  t               y)z$See TestIamSet.test_set_force_error.r   r   -fr   r  Tr   r   r  r	   r-   r   N)r   r   r   r   r   r  r   r  r   r   r   r   s       r'   test_patch_force_errorz TestIamCh.test_patch_force_error   s   ^^tT999:DKKOOD000$,,2B2B
 +/,-  /F 
mm%v.
mm&/udkkoo'F59 ' ;t||7G7G(H6: ( < 	NN$dii1EFNN%tyy2FGr)   c                      t        t        dd       fd       }t        t        dd       fd       } |         |        y)z,See TestIamSet.test_set_multithreaded_error.   r   triestimeout_secsc            	          j                  dddddj                  z  dj                  z  j                  j                  gdd	      } j
                  rj                  d
|        y j                  d|        y )Nr  r   r   r  r   r  Tr   r   r  r  )r   r   r  r   r   r  r   )r   r;   s    r'   _Check1z9TestIamCh.test_patch_multithreaded_error.<locals>._Check19  sy    ~~
tT
!DII
-
d22
2DKKOO
 -1./  1f 
	!	!'0/8r)   c                     j                  ddj                  j                  gd      } j                  ddj                  j                  gd      }j	                  j
                  |        j	                  j
                  |       y )Nr   r-   Tr   )r   r   r   r   r@   r   )r   r   r;   s     r'   _Check2z9TestIamCh.test_patch_multithreaded_error.<locals>._Check2H  s    ..%)H7; ) =>>5%9I9I*J8< * > %%d&<&<>OP
%%d&<&<&8:r)   Nr   AssertionErrorr;   r,  r.  s   `  r'   test_patch_multithreaded_errorz(TestIamCh.test_patch_multithreaded_error6  sI     >39 49 >3: 4: IIr)   c                 j   ddgddddgt         dgi}| j                  t        j                  |      dd       | j                  t        j                  |      dt                | j	                  t        j                  |      dt                | j	                  t        j                  |      dd       y )Nr+   r    r   r!   ry   zserviceAccount:bar@foo.com)r   r   r7   r  r   )r;   test_policys     r'   test_assert_haszTestIamCh.test_assert_hasV  s    "|)
 +,HI(
K 	NN4::k*J8MNNN4::k*,>')TZZ,j:NOTZZ,.@*,r)   c                     t        j                  |      }t        d |j                  dg       D              }||v r|||   d   v ryt	        d|d|d|      )ax  Asserts a member has permission for role.

    Given an IAM policy, check if the specified member is bound to the
    specified role. Does not check group inheritence -- that is, if checking
    against the [{'member': ['allUsers'], 'role': X}] policy, this function
    will still raise an exception when testing for any member other than
    'allUsers' against role X.

    This function does not invoke the TestIamPolicy endpoints to smartly check
    IAM policy resolution. This function is simply to assert the expected IAM
    policy is returned, not whether or not the IAM policy is being invoked as
    expected.

    Args:
      policy: Policy object as formatted by IamCommand._GetIam()
      member: A member string (e.g. 'user:foo@bar.com').
      role: A fully specified role (e.g. 'roles/storage.admin')

    Raises:
      AssertionError if member is not bound to role.
    c              3   *   K   | ]  }|d    |f  yw)r#   Nr%   ).0ps     r'   	<genexpr>z&TestIamCh.assertHas.<locals>.<genexpr>  s     G,FqQvYN,Fs   r+   r"   NMember 'z' does not have permission '' in policy )r7   r8   r/   r-   r0  )r;   r0   memberr#   r+   s        r'   r   zTestIamCh.assertHash  sb    . ZZFGFJJz2,FGGHx	8D>),	,
(.f> ? ?r)   c                 p    	 | j                  |||       t        d|d|d|      # t        $ r Y yw xY w)z9Functions as logical compliment of TestIamCh.assertHas().r;  z' has permission 'r<  N)r   r0  )r;   r0   r=  r#   s       r'   r   zTestIamCh.assertHasNo  sJ    A
nnVVT* *0$@ A A  
s   ) 	55)rA   rB   rC   rD   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r"  r%  r2  r5  r   r   __classcell__r   s   @r'   r   r   
  s     .$".		.,
GGI
OJ"G 
I	G
GJ +J*HHP,H,@,$?>Ar)   r   c                        e Zd ZdZ fdZd Zd Zd Zd Zd Z	d Z
 ej                  d	      d
        Z ej                  d	      d        Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z xZS )
TestIamSetz&Integration tests for iam set command.c                    t         t        |           t        t              | _        t        t              | _        t        t        dt               z  gt        t        t        d      | _        | j                         | _        | j!                         | _        | j%                  dd| j                  j&                  gd      | _        | j+                  | j(                  j-                  t.                    | _        t3        t5        j6                  | j(                        t        | j
                        | _        | j+                  t5        j:                  | j8                        j-                  t.                    | _        t5        j6                  | j(                        | _        | j>                  d	   jA                  | j                  d
          | j+                  t5        j:                  | j>                              | _!        | jE                  d      | _#        | j%                  dd| jF                  j&                  gd      | _$        | j+                  | jH                  j-                  t.                    | _%        t3        t5        j6                  | jH                        t        | j                        | _&        | j+                  t5        j:                  | jL                        j-                  t.                    | _'        y )Nr
  )titledescription
expression)r"   r$   r   r-   Tr   r  r+   r   foobar)(r   rB  r   r(   r   public_bucket_read_bindingr   public_object_read_bindingIAM_OBJECT_VIEWER_ROLEr
   TEST_CONDITION_TITLETEST_CONDITION_DESCRIPTION&TEST_CONDITION_EXPR_RESOURCE_IS_OBJECT-project_viewer_objectviewer_with_cond_bindingr   r   CreateVersionedBucketversioned_bucketr   r   r   r  r  r   old_bucket_iam_pathr3   r7   r8   new_bucket_iam_policyr  new_bucket_iam_path(new_bucket_policy_with_conditions_policyappend&new_bucket_policy_with_conditions_pathr   r   r   old_object_iam_pathnew_object_iam_policynew_object_iam_pathr   s    r'   r   zTestIamSet.setUp  s~   	*d!#&12F&GD#&12F&GD#9D $&7&99:)5@

:D6 ##%DK 668D "^^UE4;;??,K:> , @D#22''..t4  3  6D "/

4))*,@''")D  $22D667>>tD  3  FD
 59JJ5 D111*=DD::1=?262E2EDIIJ 3F 3LD/ ##X#6DK!^^UE4;;??,K:> , @D#22''..t4  3  6D "/

4))*,@''")D  $22D667>>tD  3  FDr)   c                     | j                  | j                  d      }t        ddg      5  | j                  ddd| j                  |j
                  gd	      }| j                  d
|       ddd       y# 1 sw Y   yxY w)zEEnsures that the seek-ahead iterator is being used with iam commands.   foobarr   )GSUtiltask_estimation_threshold1)r\  task_estimation_forceTruer  r   rM   T)r   z,Estimated work for this command: objects: 1
N)r   r   r   r   rY  r   r   )r;   gsutil_objectr   s      r'   test_seek_ahead_iamzTestIamSet.test_seek_ahead_iam  s     %%/8 & :M 
KJL 
M~~t779J9J
K  f mmCVL
M 
M 
Ms   ?A33A<c                     | j                  dd| j                  | j                  j                  | j                  j                  gdd      }| j                  d|       y)zCTests that failure is thrown when buckets and objects are provided.r   rM   Tr   r   r	   N)r   rY  r   r   r   r   r   s     r'   #test_set_mix_of_buckets_and_objectsz.TestIamSet.test_set_mix_of_buckets_and_objects  sV     ^^ud.. +/,-	  /F
 	MM$f-r)   c                 l    | j                  dd| j                  dgdd      }| j                  d|       y)	z9Tests that failure is thrown when a file url is provided.r   rM   r   Tr   r   r   N)r   rY  r   r   s     r'   test_set_file_urlzTestIamSet.test_set_file_url  s?    ^^	t//1BC  F 	MM"F+r)   c                      t        t        dd       fd       }t        t        dd       fd       } |         |        y)z5Ensures invalid content returns error on input check.r'  r   r(  c                      j                  d      } j                  dd| j                  j                  gdd      }j                  rdnd	}j                  ||       y )
Ns   badIamr  r   rM   Tr   r   zFound invalid JSON/YAMLArgumentException)r  r   r   r   r  r   )inpathr   error_messager;   s      r'   r,  z7TestIamSet.test_set_invalid_iam_bucket.<locals>._Check1  sh    ""I"6f~~ueVT[[__E,0./  1f 22 18K 
mmM6*r)   c                      j                  dddj                  j                  gdd      } j                  rdnd}j	                  ||        y )	Nr   rM   znonexistent/pathTr   r   zNo such file or directoryri  )r   r   r   r  r   r   rk  r;   s     r'   r.  z7TestIamSet.test_set_invalid_iam_bucket.<locals>._Check2  sY     ~~%+T[[__
=  f
 22 38K 
mmM6*r)   Nr/  r1  s   `  r'   test_set_invalid_iam_bucketz&TestIamSet.test_set_invalid_iam_bucket  sI     >3+ 4+ >3+ 4+ IIr)   c                 Z     j                  dd j                  gdd      } j                  rdnd} j                  ||        j                  ddd j                  z  gdd      } j                  rd	nd
} j                  ||       t	        t
        dd       fd       } |        y)z3Ensures that invalid bucket names returns an error.r   r-   Tr   r   r   r	   r  	not foundr  r'  r(  c                  v    j                  g ddd      } j                  rdnd}j                  ||        y )N)r   r-   zgs://*Tr   r   z"must match a single cloud resourcer	   )r   r  r   rm  s     r'   _Checkz2TestIamSet.test_get_invalid_bucket.<locals>._Check%  sG     ~~6,0./  1f 22 <8J 
mmM6*r)   N)r   r  r  r   r   r0  )r;   r   rk  rr  s   `   r'   test_get_invalid_bucketz"TestIamSet.test_get_invalid_bucket  s    ^^UE4+G+GH*.,-  /F 00 &6H MM-(^^	y4#?#??@  F
 00 !6O MM-(
 >3+ 4+ Hr)   c                 "   | j                  dddd| j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  dddd| j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  | j                  |       | j                  | j                  d   t        j                  |      d	          y
)z&Tests setting a valid IAM on a bucket.r   rM   -er,   r-   Tr   r   r+   N)r   rS  r   r   rQ  r@   r   r   rH  r7   r8   r;   set_iam_stringreset_iam_strings      r'   test_set_valid_iam_bucketz$TestIamSet.test_set_valid_iam_bucket2  s    NN	tR!9!94;;??KM^^UE4;;??$C26 $ 8NNN	tR!9!94;;??KM~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   z7Disabled until all projects whitelisted for conditions.c                 f   | j                  dddd| j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j	                  t
        |       | j	                  t        |j                  dd             | j	                  t        |       y	)
zDTests setting and getting an IAM policy with conditions on a bucket.r   rM   ru  r,   r-   Tr   \N)	r   rV  r   r   r   rL  rM  replacerK  )r;   get_iam_strings     r'   4test_set_and_get_valid_bucket_policy_with_conditionsz?TestIamSet.test_set_and_get_valid_bucket_policy_with_conditionsA  s     	NNudB K K  ^^UE4;;??$C26 $ 8NMM,n=MM8 ((r24MM&7r)   c                    t                | j                  dddd| j                  | j                  j                  g       | j                  ddd| j                  j                  gdd	      }| j                  d
|       | j                  d|       | j                  dddd| j                  j                  gdd	      }| j                  d|       | j                  d|       y)zETests that if we "set" a policy with conditions, "ch" won't patch it.r   rM   ru  r,   r   zallUsers:objectViewerTr   r   z0CommandException: Could not patch IAM policy forz#The resource had conditions presentr$  z8CommandException: Some IAM policies could not be patchedzSome resources had conditionsN)printr   rV  r   r   r   r   s     r'   &test_ch_fails_after_setting_conditionsz1TestIamSet.test_ch_fails_after_setting_conditionsQ  s     
GNNudB K K  ^^	-t{{?  F 	MMDfMMM7@ ^^	d3T[[__E  F 	MML 	MM16:r)   c                 N   | j                  dddd| j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  dddt	        j
                  |      d   | j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  | j                  |       | j                  | j                  d	   t	        j
                  |      d
          y)z/Tests setting blank etag behaves appropriately.r   rM   ru  r,   r-   Tr   etagr   r+   N)r   rS  r   r   r7   r8   rQ  r@   r   r   rH  rv  s      r'   test_set_blank_etagzTestIamSet.test_set_blank_etagn  s   NN	tR!9!94;;??KM ^^UE4;;??$C26 $ 8N 	NNud

>"6*D,D,D  ~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    | j                  dd| j                  j                  gd      }| j                  dddt        j                  |      d   | j
                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  dddt        j                  |      d   | j                  | j                  j                  g       | j                  dd| j                  j                  gd      }| j                  | j                  |       | j                  | j                  d   t        j                  |      d	          y
)z+Tests setting valid etag behaves correctly.r   r-   Tr   rM   ru  r  r   r+   N)r   r   r   r7   r8   rS  rQ  r@   r   r   rH  )r;   r}  rw  rx  s       r'   test_set_valid_etagzTestIamSet.test_set_valid_etag  s7   ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D  ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D  ~~ueT[[__&E48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    | j                  dd| j                  j                  gd       | j                  dddd| j                  | j                  j                  gdd	      }| j                  rd
nd}| j                  ||       y)z5Tests setting an invalid etag format raises an error.r   r-   Tr   rM   ru  zsome invalid etagr   r   DecodeErrorri  N)r   r   r   rS  r  r   )r;   r   rk  s      r'   test_set_invalid_etagz TestIamSet.test_set_invalid_etag  s    NNE5$++//2$NG^^ud/1I1I +/,-  /F 00 #6I MM-(r)   c                    | j                  dd| j                  j                  gd      }| j                  dddt        j                  |      d   | j
                  | j                  j                  g       | j                  dddt        j                  |      d   | j
                  | j                  j                  gdd	      }| j                  rd
nd}| j                  ||       y)z.Tests setting mismatched etag raises an error.r   r-   Tr   rM   ru  r  r   r   z)pre-conditions you specified did not holdPreconditionExceptionN)r   r   r   r7   r8   rS  r  r   )r;   r}  r   rk  s       r'   test_set_mismatched_etagz#TestIamSet.test_set_mismatched_etag  s    ^^UE4;;??$C26 $ 8NNNud

>"6*D,D,D 
 ^^ud

>"6*D,D,D
 +/,-  /F 00 A6M MM-(r)   c                 J   | j                  | j                  d      }| j                  | j                  d      }| j                  | j                  |j                  dt        |            }| j                  | j                  |j                  dt        |            }||||fS )zCreates two versioned objects and return references to all versions.

    Returns:
      A four-tuple (a, b, a*, b*) of storage_uri.BucketStorageUri instances.
    r   r   r   s   new_foo)r   object_namer   gs_idempotent_generations   new_bar)r   rP  r  urigen)r;   old_gsutil_objectold_gsutil_object2ra  gsutil_object2s        r'   _create_multiple_objectsz#TestIamSet._create_multiple_objects  s     ))T5J5J39 * ;**d6K6K4: + <%%((%11!'(9!:	 & <M
 &&((&22!'(:!;	 ' =N
 1= r)   c                    | j                         \  }}}}| j                  ddd| j                  | j                  j                  g       | j                  dd|j                  gd      }| j                  dd|j                  gd      }| j                  ||       | j                  | j                  d   t        j                  |      d          | j                  dd|j                  gd      }| j                  dd|j                  gd      }| j                  ||       | j                  | j                  |       y	)
.Tests setting a valid IAM on multiple objects.r   rM   r  r-   Tr   r   r+   Nr  r   rY  rP  r   r@   r   rI  r7   r8   version_specific_urir   	r;   r  r  ra  r  rw  set_iam_string2iam_string_oldiam_string_old2s	            r'   #test_set_valid_iam_multiple_objectsz.TestIamSet.test_set_valid_iam_multiple_objects  sP    446*M 	NNudD44d6K6K6O6O  ^^UE=3D3D$E26 $ 8NnneUN4F4F%G37 % 9O##NODMM$11!4**^,Z8: ^^	(==> $ N nn	)>>? % O 	##NOD##D$:$:NKr)   c                    | j                         \  }}}}| j                  dddd| j                  | j                  j                  g       | j                  dd|j                  gd      }| j                  dd|j                  gd      }| j                  ||       | j                  | j                  d   t        j                  |      d	          | j                  dd|j                  gd      }| j                  dd|j                  gd      }| j                  ||       | j                  | j                  |       y
)r  r  r   rM   r  r-   Tr   r   r+   Nr  r  s	            r'   1test_set_valid_iam_multithreaded_multiple_objectsz<TestIamSet.test_set_valid_iam_multithreaded_multiple_objects  sS    446*M 	NNeUD$":":!!  ^^UE=3D3D$E26 $ 8NnneUN4F4F%G37 % 9O##NODMM$11!4**^,Z8: ^^	(==> $ N nn	)>>? % O 	##NOD##D$:$:NKr)   c                 l   | j                         \  }}}}| j                  ddd| j                  | j                  j                  g       | j                  dd|j
                  gd      }| j                  dd|j
                  gd      }| j                  dd|j
                  gd      }| j                  dd|j
                  gd      }| j                  ||       | j                  ||       | j                  ||       | j                  | j                  d   t        j                  |      d          y	)
z4Tests set IAM policy on all versions of all objects.r   rM   z-rar-   Tr   r   r+   N)r  r   rY  rP  r   r  r@   r   rI  r7   r8   )	r;   r  r  ra  r  rw  r  set_iam_string_oldset_iam_string_old2s	            r'   0test_set_valid_iam_multiple_objects_all_versionsz;TestIamSet.test_set_valid_iam_multiple_objects_all_versions  sL    446*MNNueT55t7L7L7P7P  ^^	}99:$ $ PNnn	~::;4 % QO	(==> (  ..	)>>? )  	##NOD##N4FG##N4GHMM$11!4**^,Z8:r)   c           
      8   | j                         }| j                         }| j                  dddd| j                  |j                  d| j                  z  |j                  gdd      }| j
                  rd	nd
}| j                  ||       | j                  dd|j                  gd      }| j                  dd|j                  gd      }| j                  | j                  d   t        j                  |      d          | j                  | j                  |       y)a  Tests fail-fast behavior of iam set.

    We initialize two buckets (bucket, bucket2) and attempt to set both along
    with a third, non-existent bucket in between, self.nonexistent_bucket_name.

    We want to ensure
      1.) Bucket "bucket" IAM policy has been set appropriately,
      2.) Bucket self.nonexistent_bucket_name has caused an error, and
      3.) gsutil has exited and "bucket2"'s IAM policy is unaltered.
    r   rM   ru  r,   r  Tr   r   rp  r  r-   r   r   r+   N)r   r   rS  r   r  r  r   rH  r7   r8   r@   r   r;   r   r   r   rk  rw  r  s          r'   test_set_errorzTestIamSet.test_set_error$  s     F!G^^udB 8 8&**D000'++ +/,-  /F 00 !6O MM-(^^UE6::$>26 $ 8NnneUGKK%@37 % 9O 	MM$11!4**^,Z8: 	##D$:$:OLr)   c           	      "   | j                         }| j                         }| j                  ddd| j                  |j                  d| j                  z  |j                  gdd      }| j
                  rdnd	}| j                  ||       | j                  dd
|j                  gd      }| j                  dd
|j                  gd      }| j                  | j                  d   t        j                  |      d          | j                  ||       y)aQ  Tests ignoring failure behavior of iam set.

    Similar to TestIamSet.test_set_error, except here we want to ensure
      1.) Bucket "bucket" IAM policy has been set appropriately,
      2.) Bucket self.nonexistent_bucket_name has caused an error, BUT
      3.) gsutil has continued and "bucket2"'s IAM policy has been set as well.
    r   rM   r$  r  Tr   r   rp  r	   r-   r   r   r+   N)r   r   rS  r   r  r  r   rH  r7   r8   r@   r  s          r'   test_set_force_errorzTestIamSet.test_set_force_errorJ  s     F!G^^udD44fjjD000'++ +/,-  /F 00 !6H MM-(^^UE6::$>26 $ 8NnneUGKK%@37 % 9O 	MM$11!4**^,Z8: 	##NODr)   c                      t        t        dd       fd       }t        t        dd       fd       } |         |        y)a  Tests fail-fast behavior of multithreaded iam set.

    This is testing gsutil iam set with the -m and -r flags present in
    invocation.

    N.B.: Currently, (-m, -r) behaves identically to (-m, -fr) and (-fr,).
    However, (-m, -fr) and (-fr,) behavior is not as expected due to
    name_expansion.NameExpansionIterator.next raising problematic e.g. 404
    or 403 errors. More details on this issue can be found in comments in
    commands.iam.IamCommand._SetIam.

    Thus, the following command
      gsutil -m iam set -fr <object_policy> gs://bad_bucket gs://good_bucket

    will NOT set policies on objects in gs://good_bucket due to an error when
    iterating over gs://bad_bucket.
    r'  r   r(  c            	          j                  ddddj                  dj                  z  j                  j                  gdd      } j
                  rd	nd
}j                  ||        y )Nr  r   rM   r  r  Tr   r   rp  r  )r   rY  r  r   r   r  r   rm  s     r'   r,  z8TestIamSet.test_set_multithreaded_error.<locals>._Check1  so    ~~
udD$<$<
d22
2DKKOO -1./  1f '+&>&>{0 
mmM6*r)   c                  V   j                  j                  d      } j                  j                  d      }j                  dd| j                  gd      }j                  dd|j                  gd      }j	                  ||       j	                  j
                  |       y )Nr[  r   r   r-   Tr   )r   r   r   r   r@   r   )ra  r  rw  r  r;   s       r'   r.  z8TestIamSet.test_set_multithreaded_error.<locals>._Check2  s    ''4;;1: ( <m((DKK2; ) =n~~ue]5F5F&G48 & :nun6H6H'I59 ' ;o
%%noF
%%d&<&<nMr)   Nr/  r1  s   `  r'   test_set_multithreaded_errorz'TestIamSet.test_set_multithreaded_errorm  sK    ( >3	+ 4	+ >3
N 4
N IIr)   c                    | j                  | j                  d      }|j                  }| j                  dd| j                  |g       | j                  dd|gd      }| j                  dddt        j                  |      d	   | j                  |g       | j                  dd|gd      }| j                  | j                  |       | j                  | j                  d
   t        j                  |      d          y)z'Tests setting a valid IAM on an object.r[  r   r   rM   r-   Tr   ru  r  r   r+   N)r   r   r   r   rY  r7   r8   rW  r@   r   r   rI  r;   ra  
lookup_urirw  rx  s        r'   ,test_set_valid_iam_single_unversioned_objectz7TestIamSet.test_set_valid_iam_single_unversioned_object  s    %%/8 & :M ""JNNE5$":":JGH^^UE:$>26 $ 8NNNud

>"6*D,D,Dj  ~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c                    | j                  | j                  d      }|j                  }| j                  dd| j                  |g       | j                  dd|gd      }| j                  dddt        j                  |      d	   | j                  |g       | j                  dd|gd      }| j                  | j                  |       | j                  | j                  d
   t        j                  |      d          y)z0Tests setting a valid IAM on a versioned object.r[  r   r   rM   r-   Tr   ru  r  r   r+   N)r   r   r  r   rY  r7   r8   rW  r@   r   r   rI  r  s        r'   *test_set_valid_iam_single_versioned_objectz5TestIamSet.test_set_valid_iam_single_versioned_object  s    %%/8 & :M 33JNNE5$":":JGH^^UE:$>26 $ 8NNNud

>"6*D,D,Dj  ~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   c           	         | j                  | j                  d      }|j                  }| j                  ddddd| j                  |g       | j                  dd|gd	
      }| j                  ddddd| j
                  |g       | j                  dd|gd	
      }| j                  | j                  |       | j                  | j                  d   t        j                  |      d          d| j                  j                  z  }| j                  ddddd| j                  |g       | j                  dd|gd	
      }| j                  ddddd| j
                  |g       | j                  dd|gd	
      }| j                  | j                  |       | j                  | j                  d   t        j                  |      d          y)zATests setting a valid IAM on a single object with multithreading.r[  r   r  r   rM   ru  r,   r-   Tr   r   r+   z%s*N)r   r   r  r   rY  rW  r@   r   r   rI  r7   r8   r   r  s        r'   .test_set_valid_iam_multithreaded_single_objectz9TestIamSet.test_set_valid_iam_multithreaded_single_object  s   %%/8 & :M 33JNN	ueT2t'?'?LN^^UE:$>26 $ 8NNN	ueT2t'?'?LN~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8: (JNN	ueT2t'?'?LN^^UE:$>26 $ 8NNN	ueT2t'?'?LN~~ueZ&@48 & : 	##D$:$:<LMMM$11!4**^,Z8:r)   )rA   rB   rC   rD   r   rb  rd  rf  rn  rs  ry  r   skipr~  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r?  r@  s   @r'   rB  rB    s     /:FxM.,8B: 8==JK8 L8 8==JK; L;8:*:2))(0L6L8:0$ML!EF/b:(:( :r)   rB  c                   ^   e Zd Z ej                  g dd      Z ej                   ej                  d      dddgddd	
      Z
ej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej                  j                  ej                  d ej                               d        Zej2                  dej4                  ej4                  dfdZd Zd Zd Zd Zd Z d Z!d Z"d  Z#d! Z$d" Z%y)#TestIamShimr   fake_account@gmail.comargs
returncodestdoutfake_dirconfigr-   accountzutf-8)r   r  encoding
RunCommand)rn   c           	      ^   t        ddg      5  t        ddd      5  | j                  dddgd	
      }dj                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr\  use_gcloud_storager`  r\  hidden_shim_modedry_runr`  r  (CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTILCLOUDSDK_ROOT_DIRr   r-   zgs://bucket/objectTreturn_log_handler
infozZGcloud Storage Command: {} storage objects get-iam-policy --format=json gs://bucket/object	r   r   r  joinmessagesr   formatr   _get_gcloud_binary_pathr;   mock_log_handler
info_liness      r'   #test_shim_translates_iam_get_objectz/TestIamShim.test_shim_translates_iam_get_object  s    	GHJ 
K 6<)" 	  ??55:N2O>B + DYY/88@A
128&22:>3@AK	M	
K 
K	 	
K 
K#   B#A)BB#B 	B##B,c           	      ^   t        ddg      5  t        ddd      5  | j                  dddgd	
      }dj                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   r-   zgs://bucketTr  r  r  zSGcloud Storage Command: {} storage buckets get-iam-policy --format=json gs://bucketr  r  s      r'   #test_shim_translates_iam_get_bucketz/TestIamShim.test_shim_translates_iam_get_bucket  s    	GHJ 
K 6<)" 	  ??55-2H>B + DYY/88@A
*+1622:>,@AK	M	
K 
K	 	
K 
Kr  c           	      ^   t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )rM   policy-file	gs://b/o1	gs://b/o2Tr  r  r  zgGcloud Storage Command: {} storage objects set-iam-policy --format=json gs://b/o1 gs://b/o2 policy-filer  r  s      r'   #test_shim_translates_iam_set_objectz/TestIamShim.test_shim_translates_iam_set_object  s    	GHJ 
K 6<)" 	  ??C# + % YY/88@A
>?Ev22:>@@AK	M	
K 
K	 	
K 
Kr  c           	      ^   t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )rM   r  gs://b1gs://b2Tr  r  r  zcGcloud Storage Command: {} storage buckets set-iam-policy --format=json gs://b1 gs://b2 policy-filer  r  s      r'   #test_shim_translates_iam_set_bucketz/TestIamShim.test_shim_translates_iam_set_bucket'  s    	GHJ 
K 6<)" 	  ???# + % YY/88@A
:;A622:><@AK	M	
K 
K	 	
K 
Kr  c           	      ^   t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )rM   r  r  r  z	gs://b2/oTr  r  r  zqGcloud Storage Command: {} storage objects set-iam-policy --format=json --recursive gs://b1 gs://b2/o policy-filer  r  s      r'   Ctest_shim_translates_iam_set_mix_of_bucket_and_objects_if_recursivezOTestIamShim.test_shim_translates_iam_set_mix_of_bucket_and_objects_if_recursive8  s    	GHJ 
K 6<)" 	  ??G# + % YY/88@A
HIO22:>J@AK	M	
K 
K	 	
K 
Kr  c                    t        ddg      5  t        ddd      5  | j                  t        d      5  | j	                  dg d       d d d        d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   y xY w)	Nr  r  r`  r  r  z/Cannot operate on a mix of buckets and objects.r   )rM   r  gs://bgs://b/o)r   r   assertRaisesRegexr	   r  r   s    r'   6test_shim_raises_for_iam_set_mix_of_bucket_and_objectszBTestIamShim.test_shim_raises_for_iam_set_mix_of_bucket_and_objectsI  s    	GHJ 
K 6<)" 	 ##=? //%!M
N?		
K 
K? ?		 	
K 
Ks9   A:A.A"	A.A:"A+'A..A7	3A::Bc           	      ^   t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )rM   ru  zabc=r  r  Tr  r  r  zfGcloud Storage Command: {} storage buckets set-iam-policy --format=json --etag abc= gs://b policy-filer  r  s      r'   /test_shim_translates_iam_set_handles_valid_etagz;TestIamShim.test_shim_translates_iam_set_handles_valid_etagV  s    	GHJ 
K 6<)" 	  ??A# + % YY/88@A
=>Df22:>?@AK	M	
K 
K	 	
K 
Kr  c           	      ^   t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )rM   ru  r,   r  r  Tr  r  r  zbGcloud Storage Command: {} storage buckets set-iam-policy --format=json --etag= gs://b policy-filer  r  s      r'   /test_shim_translates_iam_set_handles_empty_etagz;TestIamShim.test_shim_translates_iam_set_handles_empty_etagg  s    	GHJ 
K 6<)" 	  ??=# + % YY/88@A
9:@&22:>;@AK	M	
K 
K	 	
K 
Kr  c                    t        ddg      5  t        ddd      5  | j                  dg dd	      }d
j                  |j                  d         }| j                  d|       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r`  r  r  r   )r   r   r    r  Tr  r  warningz|The shim maps iam ch commands to several gcloud storage commands, which cannot be determined without running gcloud storage.)r   r   r  r  r  r   )r;   r  warning_liness      r'   ,test_shim_warns_with_dry_run_mode_for_iam_chz8TestIamShim.test_shim_warns_with_dry_run_mode_for_iam_chx  s    	GHJ 
K 6<)" 	  ??5+M>B + D 		"2";";I"FGJ		
K 
K	 	
K 
Ks#   BAA5$B5A>	:BB
NTc                 8    t        j                  ||||||      S )N)envinputr   r  text)r   call)r;   commandr  stdinr   r  r  s          r'   _get_run_callzTestIamShim._get_run_call  s&     99W ""   r)   c                    dddgddddgdddgdgi}dddgddddgdgi}t        d	g      5  t        j                  g d
t        j                  |            }t        j                  g d
      }| j
                  ||g| j                  _        t        ddd      5  | j                  dg d       d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt        j                  |d            g       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr+   zpreserved-roler    rK   roles/storage.modified-roleuser:deleted-user@example.comzroles/storage.deleted-roler   r  r   r  r  r  r`  r  r  r   )r   #allAuthenticatedUsers:modified-roler   r  r   zallUsers:deleted-roler  storagebucketsget-iam-policygs://b/--format=jsonset-iam-policy-T	sort_keysr  r   
subprocessCompletedProcessr7   r   _FAKE_CONFIG_GET_ACCOUNT_PROCESS_mock_subprocess_runside_effectr   r  rL   call_args_list_MOCK_CONFIG_GET_ACCOUNT_CALLr  r   r  )r;   original_policyr1   get_processset_processs        r'   4test_iam_ch_adds_updates_and_deletes_bucket_policiesz@TestIamShim.test_iam_ch_adds_updates_and_deletes_bucket_policies  s   $"|
 2"$CD
 1"|
	O 	$"|
 2/<
J 
GH	I//a

?(CEk//RAFk

/
/k/d+ !6<)" 	 	  
 			 t00??

,
,


//
;Y)9o  

//
; $(::jD#I  KB 	# 
J	I	 	 
J	Is%   A/E+E4B"E+E(	$E++E4c                 "   dddgdgi}dddgdgi}ddddgdgi}ddddgdgi}t        dg      5  t        j                  g dt        j                  |      	      }t        j                  g dt        j                  |      	      }t        j                  g d
      }| j
                  ||||g| j                  _        t        ddd      5  | j                  dg d       d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt        j                  |d            | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt        j                  |d            g       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr+   r  zuser:test-user1@example.comrK   zuser:test-user2@example.comr   r  r   r  r  r`  r  r  r   )r   r   r  r  r  r  r  zgs://b1/r  r  r  Tr  r
  zgs://b2/r  )r;   original_policy1original_policy2new_policy1new_policy2get_process1get_process2r  s           r'   5test_iam_ch_updates_bucket_policies_for_multiple_urlszATestIamShim.test_iam_ch_updates_bucket_policies_for_multiple_urls  sp   156
  	156
  	1/1NO
 K 	1/1NO
 K 
GH	I00a

3C(DFl00a

3C(DFl//RAFk

/
/{
/d+
 !6<)" 	 	O	Q		 t00??

,
,


//
;Y):  

//
; $(::kT#J  L 

//
;Y):  

//
; $(::kT#J  L'B 	' 
J	I	 	 
J	Is%   BHG8$DH8H	=HHc                 ~   dddgdgi}ddddgdgi}t        dg      5  t        j                  g dt        j                  dd	d
g            }t        j                  g dt        j                  |            }t        j                  g d      }| j
                  |||g| j                  _        t        ddd      5  | j                  dg d       d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      ddddg      | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt        j                  |d            g       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr+   r  r    rK   r   r  r   r  cloud_objecturltyper  r  r`  r  r  r   r   r   r  r  ls--jsonobjectsr  r  r  r  Tr  r
  r  )r;   r  r1   
ls_processr  r  s         r'   #test_iam_ch_updates_object_policiesz/TestIamShim.test_iam_ch_updates_object_policies  s   1"|
 O 	1/<
 J 
GH	I..B:;6:jj:D;IC1 B2 734j //a

?(CEk//RAFk

/
/[
/d+ !6<)" 	 	L	N		 t00??

,
,


//
;Y
  

//
;Y):  

//
; $(::jD#I  KB 	+ 
J	I	 	 
J	Is%   BF3?F'C
F3'F0	,F33F<c                 H   dddgdgi}t        dg      5  t        j                  g dt        j                  ddd	d
dd	ddd	ddd	g            }t        j                  g dt        j                  |            }t        j                  g d      }| j
                  |g||gdz  z   | j                  _        t        ddd      5  | j                  dg d       d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      dddddg      | j                  t        j                  d      dddd
dg      | j                  t        j                  d      dddd
dgt         j"                         | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt         j"                         g       d d d        y # 1 sw Y   1xY w# 1 sw Y   y xY w)!Nr+   zmodified-roler    rK   r  r   zgs://b/dir/prefixr!  zgs://b/dir/:r   zgs://b/dir2/zgs://b/dir2/or  r  r'  r`  r  r  r   )r   r  r   r  r  r%  r&  r  r  r'  r  r  r  r  r
  )r   r  r  r7   r  r  r  r  r   r  rL   r  r  r  r   r  r   ANY)r;   r  r(  r  r  s        r'   Etest_iam_ch_expands_urls_with_recursion_and_ignores_container_headerszQTestIamShim.test_iam_ch_expands_urls_with_recursion_and_ignores_container_headersP  sr    	#"|
 O 
GH	I..B:;6:jj:G;CC1 ;I;I31 ;I;C31 ;J;I31B2 734j //a

?(CEk//RAFk00*
=
$q
() + !6<)" 	 	I	K		 t00??

,
,


//
;Yi  

//
;Y)>?  

//
; $(88  - 

//
;Y)?O  

//
; $(88  -/ B  	= 
J	I,	 	- 
J	Is%   B1HHD&HH	HH!c                    t        dg      5  t        j                  g dd      }t        j                  g dd      }||g| j                  _        t        dd	d
      5  | j                  t        d      5  | j                  dg d       d d d        | j                  | j                  j                  d       d d d        d d d        y # 1 sw Y   @xY w# 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r   r  r  r   	An error.r  r  r   r`  r  r  r   r$  r_   )r   r  r  r  r  r   r  r	   r  rL   
call_count)r;   get_account_processr(  s      r'   test_iam_ch_raises_ls_errorz'TestIamShim.test_iam_ch_raises_ls_error  s    	GH	I&77a(@B..B:;6ACj 0CJ.Od+ 6<)" 	 ##$4kB
//NP C 	22==qA	 
J	I CB		 	 
J	Is<   AC"C6C
.C9C"
CCC	C""C+c           
      <   t        dg      5  t        j                  g dd      }t        j                  g dt        j                  dddg            }t        j                  g dd	
      }|||g| j
                  _        t        ddd      5  | j                  t        d	      5  | j                  dg d       d d d        | j                  | j
                  j                  d       d d d        d d d        y # 1 sw Y   @xY w# 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r   r  r  r  r   r!  r   r/  r0  r`  r  r  r   r$  r'  r   r  r  r7   r  r  r  r   r  r	   r  rL   r1  )r;   r2  r(  r  s       r'   test_iam_ch_raises_get_errorz(TestIamShim.test_iam_ch_raises_get_error  s   	GH	I&77a(@B..B:;6:jj:D;IC1 B2 734j //R;<7BDk z;/d+ !6<)" 	 ##$4kB
//NP C 	22==qA	! 
J	I( CB		 	! 
J	Is<   BDD&C:;.D)D:D?DD	DDc           
      n   t        dg      5  t        j                  g dd      }t        j                  g dt        j                  dddg            }t        j                  g dd      }t        j                  g d	d
      }||||g| j
                  _        t        ddd      5  | j                  t        d
      5  | j                  dg d       d d d        | j                  | j
                  j                  d       d d d        d d d        y # 1 sw Y   @xY w# 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r   r  r  r  r   r!  z{"bindings": []}r   r/  r0  r`  r  r  r   r$  r   r5  )r;   r2  r(  r  r  s        r'   test_iam_ch_raises_set_errorz(TestIamShim.test_iam_ch_raises_set_error  s8   	GH	I&77a(@B..B:;6:jj:D;IC1 B2 734j //R;<7IKk //R;<7BDk z;/d+ !6<)" 	 ##$4kB
//NP C 	22==qA	' 
J	I. CB		 	' 
J	Is<   BD+(D?D.DD+DDD(	$D++D4c                    dddgdgi}ddddgdgi}t        dg      5  t        j                  g dd	      }t        j                  g dd
	      }| j                  ||g| j                  _        t        ddd      5  | j                  dg ddd      }d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      ddddg      | j                  t        j                  d      ddddg      g       dj                  j                  d         }| j!                  d|       | j!                  d
|       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr+   r  r    rK   r   r  r   r/  r0  Another error.r`  r  r  r   r   r$  r   r  r  Tdebugr  r  r%  r&  r  r  r  error)r   r  r  r  r  r  r   r  rL   r  r  r  r   r  r  r  r   )r;   r  r1   r(  ls_process2r  error_liness          r'   !test_iam_ch_continues_on_ls_errorz-TestIamShim.test_iam_ch_continues_on_ls_error  s   1"|
 O 	1/<
 J 
GH	I..B:;6ACj //R;<7GIk 
/
/[/d+ !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y 
B 
	 II.77@Ak
mmK-
mm$k2O 
J	I	 	 
J	Is%   AE5=E)CE5)E2	.E55E>c                    dddgdgi}ddddgdgi}t        dg      5  t        j                  g dt        j                  dd	d
g            }t        j                  g dd      }t        j                  g dd      }| j
                  |||g| j                  _        t        ddd      5  | j                  dg ddd      }d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      ddddg      | j                  t        j                  d      dddddg      | j                  t        j                  d      ddddg      g       dj!                  j"                  d         }| j%                  d|       | j%                  d|       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w) Nr+   r  r    rK   r   r  r   r  r   r!  r  r   r/  r0  r:  r`  r  r  r   r;  Tr<  r  r%  r&  r'  r  r  r  r  r>  r   r  r  r7   r  r  r  r  r   r  rL   r  r  r  r   r  r  r  r   )r;   r  r1   r(  r  r?  r  r@  s           r'   "test_iam_ch_continues_on_get_errorz.TestIamShim.test_iam_ch_continues_on_get_error  s"   1"|
 O 	1/<
 J 
GH	I..B:;6:jj:E;IC1 B2 734j //R;<7BDk //R;<7GIk 
/
/[
/d+ !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y);  

//
;Y B 	  II.77@Ak
mmK-
mm$k2c 
J	I"	 	# 
J	Is%   BG-GC4GG	GGc                    dddgdgi}ddddgdgi}t        dg      5  t        j                  g dt        j                  dd	d
g            }t        j                  g dt        j                  |            }t        j                  g dd      }t        j                  g dd      }| j
                  ||||g| j                  _        t        ddd      5  | j                  dg ddd      }d d d        | j                  | j                  j                  | j                  | j                  t        j                  d      ddddg      | j                  t        j                  d      dddddg      | j                  t        j                  d      dddddgt        j                  |d             | j                  t        j                  d      dddd!g      g       d"j!                  j"                  d#         }| j%                  d|       | j%                  d|       d d d        y # 1 sw Y   ?xY w# 1 sw Y   y xY w)$Nr+   r  r    rK   r   r  r   r  r   r!  r  r   r/  r0  r:  r`  r  r  r   r;  Tr<  r  r%  r&  r'  r  r  r  r  r  r
  r  r  r>  rC  )	r;   r  r1   r(  r  r  r?  r  r@  s	            r'   "test_iam_ch_continues_on_set_errorz.TestIamShim.test_iam_ch_continues_on_set_errorW  s   1"|
 O 	1/<
 J 
GH	I..B:;6:jj:E;IC1 B2 734j //a

?(CEk//R;<7BDk //R;<7GIk 
/
/[
{/d+
 !6<)" 	  ??5 3
 23>B + D		 t00??

,
,


//
;Y  

//
;Y);  

//
; $(::jD#I  K 

//
;Y 'B 	2 II.77@Ak
mmK-
mm$k2u 
J	I(	 	) 
J	Is%   B9H;H.1D4H;.H8	3H;;I)&rA   rB   rC   r  r  r  r   r  r   r  r  patchr   r   
IamCommandMockr  r  r  r  r  r  r  r  r  r,  PIPEr  r  r  r)  r-  r3  r6  r8  rA  rD  rF  r%   r)   r'   r  r    s   %@Z%@%@!$<&>""+$))
+)
+
+J
75
 # ::S^^\ytyy{CM DM ::S^^\ytyy{CM DM ::S^^\ytyy{CM DM  ::S^^\ytyy{CM DM  ::S^^\ytyy{CM DM  ::S^^\ytyy{C
O D
O ::S^^\ytyy{CM DM  ::S^^\ytyy{CM DM  ::S^^\ytyy{C D$ %??%?? 6	pH	T5	nF	PB$B4B:43l>3@G3r)   r  )NN)GrD   
__future__r   r   r   r   collectionsr   r7   osr  gslib.commandsr   gslib.exceptionr	   gslib.project_idr
   gslib.tests.testcaseteststestcase)gslib.tests.testcase.integration_testcaser   r   gslib.tests.utilr   r  r   r   r   "gslib.third_party.storage_apitoolsr   apitools_messagesgslib.utilsr   gslib.utils.constantsr   gslib.utils.iam_helperr   r   r   r   r   r   r   gslib.utils.retry_utilr   sixr   r   	six.movesr   PolicyBindingsValueListEntryr9   r   r   r   rJ  rL  rM  rK  r(   r3   GsUtilIntegrationTestCaser5   GsUtilUnitTestCaserF   r   rB  ShimUnitTestBaser  r%   r)   r'   <module>rc     s   - & %  ' #  	   , . ' ' ? @ 8 1 2 % W ! & > ; ? / 2 0 ( % VV_	5 6 66 3 ),GG 9 5 B 4 '- <07;; 7  $%/0{AX00 {A 1 &{A| $%/0CA" CA 1 &CAL $%/0R	:# R	: 1 &R	:ju
3(++ u
3r)   