
    2                         d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlmZ ddl	m
Z  G d	 d
e      Z G d de      Z G d de      Zd Zy)z7Contains helper objects for changing and deleting ACLs.    )absolute_import)print_function)division)unicode_literalsN)CommandException)storage_v1_messagesc                       e Zd ZdZdZdZy)
ChangeTypeUserGroupProjectN)__name__
__module____qualname__USERGROUPPROJECT     )platform/gsutil/gslib/utils/acl_helper.pyr
   r
      s    	$
%'r   r
   c                       e Zd ZdZddgZddgZddgZdgZd	gZeez   ez   ez   ez   Z	d
Z
dZe
efZdZdZdZdZdZddddddddZd Zd Zd Zd Zd Zd Zd Zd Zd Zy)	AclChangez6Represents a logical change to an access control list.AllAuthenticatedUsersAllUsersUserById	GroupByIdUserByEmailGroupByEmailGroupByDomainr   allUsersallAuthenticatedUsers)zproject-editors-zproject-owners-zproject-viewers-zgroup-zuser-zdomain-zproject-READERWRITEROWNER)RWFCOREADWRITEFULL_CONTROLc                 d    d| _         || _        | j                  ||       | j                          y)a<  Creates an AclChange object.

    Args:
      acl_change_descriptor: An acl change as described in the "ch" section of
                             the "acl" command's help.
      scope_type: Either ChangeType.USER or ChangeType.GROUP or
                  ChangeType.PROJECT, specifying the extent of the scope.
     N)
identifierraw_descriptor_Parse	_Validate)selfacl_change_descriptor
scope_types      r   __init__zAclChange.__init__@   s,     DO/DKK%z2NNr   c                 d    dj                  | j                  | j                  | j                        S )NzAclChange<{0}|{1}|{2}>)formatr4   permr.   r2   s    r   __str__zAclChange.__str__O   s(    #**4??DII+/??< <r   c                    d }|j                  d      dk7  rt        dj                  |            |j                  d      \  }}|j	                         }|| j
                  v r| j
                  |   | _        n|| _         ||      }|dk(  rdj                  |      | _        || _        y|dv rdj                  ||      | _        || _        y|d	k(  rd	| _        y|d
k(  rd
| _        y|dk(  rd| _        || _        y|| _        y)z Parses an ACL Change descriptor.c                     ddddddd}|j                         D ].  \  }}t        j                  || t        j                        s,|c S  y )Nz!^(AllAuthenticatedUsers|AllAuth)$z^(AllUsers|All)$z^.+@.+\..+$z^[0-9A-Fa-f]{64}$z^[^@]+\.[^@]+$z(owners|editors|viewers)\-.+$)r   r   EmailIdDomainr   )itemsrematch
IGNORECASE)textre_maptype_stringregexs       r   _ClassifyScopeIdentifierz2AclChange._Parse.<locals>._ClassifyScopeIdentifierV   sL    #G(!$%5f !'
+u88E4/
 !/r   :   z%{0} is an invalid change description.r?   z{0}ByDomain)r=   r>   z{0}By{1}r   r   r   N)	countr   r7   splitupperpermission_shorthand_mappingr8   r4   r.   )r2   change_descriptorr4   rH   scope_string
perm_tokenscope_classs          r   r0   zAclChange._ParseS   s    s#q(
1
8
89J
KM M  166s;L*!!#JT66633J?didi*<8Kh &,,Z8do$do		'"))*kBdo$do	/	//do	
	""do			!!do$do %dor   c                      fd} j                    j                  vr! |dj                   j                                 j                    j                  v r- j                  r! |dj                   j                                 j                    j
                  v r- j                  s! |dj                   j                                 j                    j                  v r- j                  s! |dj                   j                                 j                    j                  v r- j                  s! |dj                   j                                 j                   j                  j                         vrJdj                  t         j                  j                                     } |dj                  |             y	y	)
z$Validates a parsed AclChange object.c                 N    t        dj                  j                  |             )Nz!{0} is not a valid ACL change
{1})r   r7   r/   )msgr2   s    r   _ThrowErrorz(AclChange._Validate.<locals>._ThrowError   s)    AHH


s$ % %r   z{0} is not a valid scope typez{0} requires no argumentsz{0} requires an idz{0} requires an email addressz{0} requires domainz, zAllowed permissions are {0}N)r4   scope_typesr7   public_scopesr.   	id_scopesemail_scopesdomain_scopesr8   rN   valuesjoinset)r2   rV   permss   `  r   r1   zAclChange._Validate   sI   % d...188IJ$,,,-44T__EF$..(&--doo>?$+++DOO188IJ$,,,T__'..t?@yy99@@BBiiD==DDFGHe/66u=> Cr   c              #   V  K   |D ]  }| j                   dv r*|j                  r| j                  |j                  k(  r| <| j                   dv r*|j                  r| j                  |j                  k(  r| t| j                   dk(  r*|j                  r| j                  |j                  k(  r| | j                   dk(  rN|j
                  rB| j                  |j
                  j                  d|j
                  j                  k(  r| 
| j                   dk(  r;|j                  j                         | j                  j                         k(  r| T| j                   dk(  se|j                  j                         | j                  j                         k(  s|  yw)	aR  Generator that yields entries that match the change descriptor.

    Args:
      current_acl: A list of apitools_messages.BucketAccessControls or
                   ObjectAccessControls which will be searched for matching
                   entries.

    Yields:
      An apitools_messages.BucketAccessControl or ObjectAccessControl.
    )r   r   r   r   r   r   -r   r   N)r4   entityIdr.   emaildomainprojectTeamteamprojectNumberentitylowerpublic_entity_all_userspublic_entity_all_auth_usersr2   current_aclentrys      r   _YieldMatchingEntrieszAclChange._YieldMatchingEntries   s=     
//6
65>>
//U^^
+OO>>KKDOOu{{:OO.5<<OOu||+OOy(U->->OO##U%6%6%D%D F FOOz)LL D$@$@$F$F$HHOO66LL D$E$E$K$K$MM' s   E&F)*5F)!F)c                    | j                   dv r| j                  | j                  z   S | j                   dv r| j                  | j                  z   S | j                   dk(  r| j                  | j                  z   S | j                   dk(  r| j
                  | j                  z   S | j                   dk(  r| j                  S | j                   dk(  r| j                  S t        d| j                   z        )z3Gets an appropriate entity string for an ACL grant.)r   r   )r   r   r   r   r   r   z.Add entry to ACL got unexpected scope type %s.)	r4   user_entity_prefixr.   group_entity_prefixproject_entity_prefixdomain_entity_prefixrl   rk   r   r9   s    r   	GetEntityzAclChange.GetEntity   s    55$$t66	9	9%%77	I	%''$//99	O	+&&88	3	3...	J	&)))M!__- . .r   c                 .   | j                         } || j                  |      }| j                  dv r| j                  |_        n@| j                  dv r| j                  |_        n | j                  dk(  r| j                  |_        |j                  |       y)zAdds an entry to current_acl.)roleri   )r   r   r   ra   r   N)rv   r8   r4   r.   rc   rd   re   append)r2   rn   entry_classri   ro   s        r   	_AddEntryzAclChange._AddEntry   ss    ^^FTYYv6E>>en	;	;OOek	O	+__elur   c                 f    |D ]  }|j                   c S  t        j                         j                   S )N)	__class__apitools_messagesObjectAccessControl)r2   rn   	acl_entrys      r   _GetEntriesClasszAclChange._GetEntriesClass   s/     	    ! 002<<<r   c                    |j                  d|| j                  |       | j                  dk(  rC|dk(  r.|j                         r|j	                  d| j                  |       y|dk(  rt        d      | j                  |      }t        | j                  |            }d}|r8|D ]2  }|j                  | j                  k7  s| j                  |_	        |dz  }4 n| j                  ||       d}|j                  d	t        |             |S )
a  Executes the described change on an ACL.

    Args:
      storage_url: StorageUrl representing the object to change.
      current_acl: A list of ObjectAccessControls or
                   BucketAccessControls to permute.
      command_name: String name of comamnd being run (e.g., 'acl').
      logger: An instance of logging.Logger.

    Returns:
      The number of changes that were made.
    Executing %s %s on %sr#   aclz6Skipping %s on %s, as WRITER does not apply to objectsr   defaclzUWRITER cannot be set as a default object ACL because WRITER does not apply to objectsrJ   New Acl:
%s)debugr/   r8   IsObjectwarningr   r   listrp   rx   r{   str)	r2   storage_urlrn   command_nameloggerrz   matching_entrieschange_countro   s	            r   ExecutezAclChange.Execute   s    LL(,8K8K yyH		;#7#7#9O**K	98#  J K 	K ''4KD66{CDL#%::"yy%*
!
, $
 nn[+.l
LL[!12r   N)r   r   r   __doc__rX   rY   rZ   r[   project_scopesrW   rk   rl   public_entity_typesproject_entity_prefixesrs   rr   ru   rt   rN   r5   r:   r0   r1   rp   rv   r{   r   r   r   r   r   r   r   "   s    >*J7-;')0,"#-;.*\9MI + '!802NO1 "$ "</%b?4@.$
=&r   r   c                   ,    e Zd ZdZdddZd Zd Zd Zy)	AclDelz8Represents a logical change from an access control list.r   r   )zAll(Users)?$zAllAuth(enticatedUsers)?$c                    dj                  |      | _        || _        | j                  j	                         D ]<  \  }}t        j                  || j                  t
        j                        s6|| _        > d| _        d| _	        y )Nz-d {0}AnyNONE)
r7   r/   r.   scope_regexesr@   rA   rB   rC   r4   r8   )r2   r.   rG   scopes       r   r5   zAclDel.__init__  sf    "//*5D DO**002u	%"--	8 3 DODIr   c              #   b  K   |D ]  }|j                   r:| j                  j                         |j                   j                         k(  r| J|j                  r:| j                  j                         |j                  j                         k(  r| |j                  r:| j                  j                         |j                  j                         k(  r| |j
                  r^| j                  j                         dj                         |j
                  j                  |j
                  j                  fz  k(  r| @|j                  j                         dk(  r| j                  dk(  r| r|j                  j                         dk(  s| j                  dk(  s|  yw)aW  Generator that yields entries that match the change descriptor.

    Args:
      current_acl: An instance of apitools_messages.BucketAccessControls or
                   ObjectAccessControls which will be searched for matching
                   entries.

    Yields:
      An apitools_messages.BucketAccessControl or ObjectAccessControl.
    z%s-%sallusersr   allauthenticatedusersr   N)	rc   r.   rj   rd   re   rf   rg   rh   ri   rm   s      r   rp   zAclDel._YieldMatchingEntries  s7     	DOO113u~~7K7K7MM;;4??002ekk6G6G6II<<DOO113u||7I7I7KK$//"7"7"9W]]_##U%6%6%D%DE>F #F<<:-$//Z2OLL $;;OO66 s   FF/F/'F/c                     |j                  d|| j                  |       t        | j                  |            }|D ]  }|j	                  |        |j                  dt        |             t        |      S )Nr   r   )r   r/   r   rp   remover   len)r2   r   rn   r   r   r   ro   s          r   r   zAclDel.Execute8  sk    
LL(,8K8KD66{CD! "
LL[!12  r   N)r   r   r   r   r   r5   rp   r   r   r   r   r   r     s!    @!$;-
6!r   r   c                    g }t         j                  t         j                  t         j                  d}| D ]  \  }}||v rNt	        |||         }dj                  |j                         |j                        }|j                  ||f       X|dk(  r)t        |      }|j                  d|j                  f       |j                  ||f        |S )N)z-gz-pz-u)r4   zentity={},role={}z-d)r
   r   r   r   r   r7   rv   r8   ry   r   r.   )sub_optstranslated_sub_optsscope_type_from_flagflagvaluechange	new_values          r   translate_sub_opts_for_shimr   B  s    OO
  mtU##+?+EFf%,,V-=-=-?Mi  $	!23	e}f  $(9(9!:;  $/   
r   )r   
__future__r   r   r   r   rA   gslib.exceptionr   "gslib.third_party.storage_apitoolsr   r~   objectr
   r   r   r   r   r   r   <module>r      sL    > & %  ' 	 , W h hV2!V 2!jr   