
    B                        d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlmZ ddl	m
Z
 dd	lmZ dd
lmZ ddlmc mZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dZ ed       ed       G d dej@                                      Z! ed       ed       G d dej@                                      Z" G d dejF                        Z$ G d dejJ                        Z&y)z"Integration tests for kms command.    )absolute_import)print_function)division)unicode_literalsN)randint)mock)AccessDeniedException)PopulateProjectId)SkipForJSON)	SkipForS3)
SkipForXML)ObjectToURI)SetBotoConfigForTest)SetEnvironmentForTest)Retry)	shim_utilOprojects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-keyz6gsutil does not support KMS operations for S3 buckets.c                   l     e Zd ZdZ fdZ eedd      dd       ZddZd Z	d	 Z
d
 Zd Zd Z xZS )TestKmsSuccessCasesz&Integration tests for the kms command.c                     t         t        |           | j                  j	                  t        d       t        j                  j                  t        j                  j                        | _
        y )N)location)superr   setUpkms_apiCreateKeyRingr
   testcaseKmsTestingResourcesKEYRING_NAMEKEYRING_LOCATIONkeyring_fqn)self	__class__s    'platform/gsutil/gslib/tests/test_kms.pyr   zTestKmsSuccessCases.setUp/   sV    	
t*, ||11$$$11-->> 2 @D          )triestimeout_secsc                    t         j                  j                  t        dd      t        dd      t        dd      fz  }| j                  j                  | j                  |      }| j                  j                  |      }|j                  r'|j                  j                          |j                  r'| j                  j                  ||       ddd|g}|r|j                  d|g       | j                  |d      }| j                  |d      }| j                  d	t        d       d
||       | j                  dt        d       d|d|       y )Nr   	   kms	authorize-k-pTreturn_stdoutzAuthorized project z" to encrypt and decrypt with key:
zProject z9 was already authorized to encrypt and decrypt with key:
.)r   r   MUTABLE_KEY_NAME_TEMPLATEr   r   CreateCryptoKeyr    GetKeyIamPolicybindingspopSetKeyIamPolicyextend	RunGsUtilassertInr
   )r!   specified_projectkey_namekey_fqn
key_policyauthorize_cmdstdout1stdout2s           r#   DoTestAuthorizez#TestKmsSuccessCases.DoTestAuthorize9   s/    ++EE1wq!}gamI5 5H ll**4+;+;XFG --g6J


 

LL  *5Kw7MD"345nn]$n?Gnn]$n?GMM	4	 '	+,35 	MM)$/
:<CEr$   c                     ddg}|r|j                  d|g       | j                  |d      }| j                  |d       y )Nr+   serviceaccountr.   Tr/   z4[^@]+@gs-project-accounts\.iam\.gserviceaccount\.com)r8   r9   assertRegex)r!   r;   serviceaccount_cmdstdouts       r#   DoTestServiceaccountz(TestKmsSuccessCases.DoTestServiceaccountV   sL    !12'8 9:^^.d^CFVLNr$   c                 $    | j                          y N)rB   r!   s    r#   $testKmsAuthorizeWithoutProjectOptionz8TestKmsSuccessCases.testKmsAuthorizeWithoutProjectOption`   s    r$   c                 :    | j                  t        d              y N)r;   )rB   r
   rK   s    r#   !testKmsAuthorizeWithProjectOptionz5TestKmsSuccessCases.testKmsAuthorizeWithProjectOptionc   s    +<T+BCr$   c                 $    | j                          y rJ   )rH   rK   s    r#   )testKmsServiceaccountWithoutProjectOptionz=TestKmsSuccessCases.testKmsServiceaccountWithoutProjectOptionf   s    r$   c                 :    | j                  t        d              y rN   )rH   r
   rK   s    r#   &testKmsServiceaccountWithProjectOptionz:TestKmsSuccessCases.testKmsServiceaccountWithProjectOptioni   s    0A$0GHr$   c           	         | j                         }| j                  j                  | j                  t        j
                  j                        }ddt        |      g}| j                  |d      }| j                  dt        |      z  |       | j                  ddd|t        |      gd      }| j                  dt        |      z  |       | j                  |d      }| j                  dt        |      d	||       | j                  ddd
t        |      gd      }| j                  dt        |      z  |       | j                  |d      }| j                  dt        |      z  |       y )Nr+   
encryptionTr/   z'Bucket %s has no default encryption keyr-   z(Setting default KMS key for bucket %s...zDefault encryption key for z:
-dz)Clearing default encryption key for %s...)
CreateBucketr   r3   r    r   r   CONSTANT_KEY_NAMEsurir9   r:   )r!   
bucket_urir=   encryption_get_cmdrG   s        r#   testKmsEncryptionFlowz)TestKmsSuccessCases.testKmsEncryptionFlowl   st   
 ""$Jll**(66HHJGtJ/?@ ^^.d^CFMM;d:>NN
 ^^	dG	j		  F 	MM<tJ?OO ^^.d^CFMM04Z0@'J ^^	dD$45T  KFMM3d:6FFP ^^.d^CFMM;d:>NNr$   rJ   )__name__
__module____qualname____doc__r   r   AssertionErrorrB   rH   rL   rO   rQ   rS   r\   __classcell__)r"   s   @r#   r   r   *   sN     /@ 	qq1E 2E8ND I'r$   r   z?These tests only check for failures when the XML API is forced.c                   @    e Zd ZdZg dZdZd Zd Zd Zd Z	d Z
d	 Zy
)#TestKmsSubcommandsFailWhenXmlForcedzETests that kms subcommands fail early when forced to use the XML API.))Credentialsgs_oauth2_refresh_tokenN)re   gs_service_client_idN)re   gs_service_key_fileN)re   gs_service_key_file_passwordN)re   gs_access_key_iddummykey)re   gs_secret_access_keydummysecretr   c                     t        | j                        5  | j                  |dd      }| j                  d|       d d d        y # 1 sw Y   y xY w)Nr&   T)expected_statusreturn_stderrz'The "kms" command can only be used with)r   boto_config_hmac_auth_onlyr9   r:   )r!   
subcommandstderrs      r#   6DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfigzZTestKmsSubcommandsFailWhenXmlForced.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig   s?    	d==	>~~j!4~Pf
mm=vF 
?	>	>s   'AAc                 *    | j                  g d       y )N)r+   rU   gs://dummybucketrt   rK   s    r#   4testEncryptionFailsWhenXmlForcedFromHmacInBotoConfigzXTestKmsSubcommandsFailWhenXmlForced.testEncryptionFailsWhenXmlForcedFromHmacInBotoConfig   s    ??13r$   c                 8    | j                  dddt        dg       y )Nr+   rU   r-   rv   rt   _DUMMY_KEYNAMErK   s    r#   9testEncryptionDashKFailsWhenXmlForcedFromHmacInBotoConfigz]TestKmsSubcommandsFailWhenXmlForced.testEncryptionDashKFailsWhenXmlForcedFromHmacInBotoConfig   s     ??	dN4FGIr$   c                 *    | j                  g d       y )N)r+   rU   rV   rv   rw   rK   s    r#   9testEncryptionDashDFailsWhenXmlForcedFromHmacInBotoConfigz]TestKmsSubcommandsFailWhenXmlForced.testEncryptionDashDFailsWhenXmlForcedFromHmacInBotoConfig   s    ??79r$   c                 *    | j                  g d       y )N)r+   rD   rv   rw   rK   s    r#   8testServiceaccountFailsWhenXmlForcedFromHmacInBotoConfigz\TestKmsSubcommandsFailWhenXmlForced.testServiceaccountFailsWhenXmlForcedFromHmacInBotoConfig   s    ??57r$   c                 8    | j                  dddt        dg       y )Nr+   r,   r-   rv   rz   rK   s    r#   3testAuthorizeFailsWhenXmlForcedFromHmacInBotoConfigzWTestKmsSubcommandsFailWhenXmlForced.testAuthorizeFailsWhenXmlForcedFromHmacInBotoConfig   s     ??	T>3EFHr$   N)r]   r^   r_   r`   rq   r{   rt   rx   r|   r~   r   r    r$   r#   rd   rd      s8     N	 <.G
3I97Hr$   rd   c                      e Zd ZdZ ej
                  d       ej
                  d       ej
                  d       ej
                  d      d                             Z ej
                  d       ej
                  d       ej
                  d       ej
                  d      d                             Z ej
                  d       ej
                  d       ej
                  d       ej
                  d      d                             Zy	)
TestKmsUnitTestszUnit tests for gsutil kms.Dgslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccountz7gslib.cloud_api_delegator.CloudApiDelegator.PatchBucket$gslib.kms_api.KmsApi.GetKeyIamPolicy$gslib.kms_api.KmsApi.SetKeyIamPolicyc           	         | j                         }g |j                  _        d|j                  _        | j	                  dddt
        t        |      gd      }| j                  d|       | j                  |j                         y )Ndummy@google.comr+   rU   r-   Tr/   "Setting default KMS key for bucket)
rW   return_valuer5   email_address
RunCommandr{   rY   r:   
assertTruecalledr!   mock_set_key_iam_policymock_get_key_iam_policymock_patch_bucket mock_get_project_service_accountrZ   rG   s          r#   7testEncryptionSetKeySucceedsWhenUpdateKeyPolicySucceedszHTestKmsUnitTests.testEncryptionSetKeySucceedsWhenUpdateKeyPolicySucceeds   s     ""$J46((1BT$11?__dNZ "  F 	MM6?OO%,,-r$   c           
         | j                         }t        d      |_        d|j                  _        | j                  dddt        dt        |      gd      }| j                  d	|       | j                  |j                         y )
NPermission deniedr   r+   rU   r-   -wTr/   r   )rW   r	   side_effectr   r   r   r{   rY   r:   r   r   r   s          r#   CtestEncryptionSetKeySucceedsWhenUpdateKeyPolicyFailsWithWarningFlagzTTestKmsUnitTests.testEncryptionSetKeySucceedsWhenUpdateKeyPolicyFailsWithWarningFlag   s     ""$J*?+'BT$11?__dNDZ "  F 	MM6?OO%,,-r$   c           	      8   | j                         }t        d      |_        d|j                  _        	 | j                  dddt        t        |      gd      }| j                  d       y # t        $ r&}| j                  d|j                         Y d }~y d }~ww xY w)	Nr   r   r+   rU   r-   Tr/   z*Did not get expected AccessDeniedException)rW   r	   r   r   r   r   r{   rY   failr:   reason)r!   r   r   r   r   rZ   rG   es           r#   CtestEncryptionSetKeyFailsWhenUpdateKeyPolicyFailsWithoutWarningFlagzTTestKmsUnitTests.testEncryptionSetKeyFailsWhenUpdateKeyPolicyFailsWithoutWarningFlag   s     ""$J*?+'BT$11?3
,nz"$  f ii<=  3
mm'223s   6A* *	B3BBN)	r]   r^   r_   r`   r   patchr   r   r   r   r$   r#   r   r      s&   "4::LN4::GH4::454::45. 6 6 IN
. 4::LN4::GH4::454::45. 6 6 IN
. 4::LN4::GH4::454::453 6 6 IN
3r$   r   c                   T   e Zd ZdZ ej
                  d       ej
                  d       ej
                  d      d                      Zd Z ej
                  d       ej
                  d       ej
                  d      d                      Zd Z	 ej
                  d      d	        Z
y
)TestKmsUnitTestsWithShimz%Unit tests for gsutil kms using shim.r   r   r   c           
         ~d|j                   _        g |j                   _        t        ddg      5  t	        ddd      5  | j                  ddd	d
dt        gd      }dj                  |j                  d         }| j                  dj                  t        j                  d      t              |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   GSUtiluse_gcloud_storageTruer   hidden_shim_modedry_runr   fake_dir(CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTILCLOUDSDK_ROOT_DIRr+   r,   r.   foor-   Treturn_log_handler
infozRGcloud Storage Command: {} storage service-agent --project foo --authorize-cmek {})r   r   r5   r   r   r   r{   joinmessagesr:   formatr   _get_gcloud_binary_path)r!   r   r   r   mock_log_handler
info_liness         r#   $test_shim_translates_authorize_flagsz=TestKmsUnitTestsWithShim.test_shim_translates_authorize_flags  s     	 BT$11?46((1	GHJ 
K 6<)" 	  ??53
 ?C + D YY/88@A
11711*=~2O			
K 
K	 	
K 
Ks$   C A5C5CC	CCc           
         | j                         }t        ddg      5  t        ddd      5  | j                  dddt	        |      gd	
      }dj                  |j                  d         }| j                  dj                  t        j                  d      t	        |            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   r   r   r   r+   rU   rV   Tr   r   r   zSGcloud Storage Command: {} storage buckets update --clear-default-encryption-key {}rW   r   r   r   rY   r   r   r:   r   r   r   r!   rZ   r   r   s       r#   )test_shim_translates_clear_encryption_keyzBTestKmsUnitTestsWithShim.test_shim_translates_clear_encryption_key&  s    ""$J	GHJ 
K 6<)" 	  ??L$Z(89# + % YY/88@A
11711*=Z 2"#-		/	
K 
K	 	
K 
Ks#   CA=B;*C;C	 CCc                    | j                         }~d|j                  _        g |j                  _        t	        ddg      5  t        ddd      5  | j                  ddd	d
t        t        |      gd      }dj                  |j                  d         }| j                  dj                  t        j                  d      t        t        |            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   r   r   r   r   r+   rU   r   r-   Tr   r   r   zQGcloud Storage Command: {} storage buckets update  --default-encryption-key {} {})rW   r   r   r5   r   r   r   r{   rY   r   r   r:   r   r   r   )r!   r   r   r   rZ   r   r   s          r#   *test_shim_translates_update_encryption_keyzCTestKmsUnitTestsWithShim.test_shim_translates_update_encryption_key9  s    ""$JBT$11?46((1	GHJ 
K 6<)" 	  ??L$n$&# + % YY/88@A
//5v11*=~Z 0"#-		/	
K 
K	 	
K 
Ks%   C5BC)C5)C2	.C55C>c           
         | j                         }t        ddg      5  t        ddd      5  | j                  ddt	        |      gd	      }d
j                  |j                  d         }| j                  dj                  t        j                  d      t	        |            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   r   r   r   r+   rU   Tr   r   r   zGcloud Storage Command: {} storage buckets describe --format=value[separator=": "](name, encryption.defaultKmsKeyName.yesno(no="No default encryption key.")) --raw {}r   r   s       r#   ,test_shim_translates_displays_encryption_keyzETestKmsUnitTestsWithShim.test_shim_translates_displays_encryption_keyV  s    ""$J	GHJ 
K 6<)" 	  ??L$z"23 + NYY/88@A
 y@@L#J/12<	>	
K 
K	 	
K 
Ks#   CA<B:)C:C	?CCc           	         d|j                   _        t        ddg      5  t        ddd      5  | j	                  dg dd	
      }dj                  |j                  d         }| j                  dj                  t        j                  d            |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   r   r   r   r   r+   )rD   r.   r   Tr   r   r   z>Gcloud Storage Command: {} storage service-agent --project foo)r   r   r   r   r   r   r   r:   r   r   r   )r!   r   r   r   s       r#   +test_shim_translates_serviceaccount_commandzDTestKmsUnitTestsWithShim.test_shim_translates_serviceaccount_commandi  s     CU$11?	GHJ 
K 6<)" 	  ??5+J>B + D YY/88@A
#V11*=?@J	L	
K 
K	 	
K 
Ks#   B4A)B(B4(B1	-B44B=N)r]   r^   r_   r`   r   r   r   r   r   r   r   r   r$   r#   r   r     s    -4::LN4::454::45 6 6N8/& 4::LN4::454::45/ 6 6N/2>& 4::LNLNLr$   r   )'r`   
__future__r   r   r   r   osrandomr   unittestr   gslib.cloud_apir	   gslib.project_idr
   gslib.tests.testcasetestsr   )gslib.tests.testcase.integration_testcaser   r   r   gslib.tests.utilr   rY   r   r   gslib.utils.retry_utilr   gslib.utilsr   r{   GsUtilIntegrationTestCaser   rd   GsUtilUnitTestCaser   ShimUnitTestBaser   r   r$   r#   <module>r      s    ) & %  ' 	   1 . ' ' A ? @ 0 1 2 ( !: CDDEg(<< g F EgT CDNO'H(*L*L 'H P E'HT>3x22 >3ByLx88 yLr$   