OXIESEC PANEL
- Current Dir:
/
/
opt
/
gsutil
/
gslib
/
commands
/
__pycache__
Server IP: 2a02:4780:11:1594:0:ef5:22d7:a
Upload:
Create Dir:
Name
Size
Modified
Perms
📁
..
-
02/11/2025 08:19:49 AM
rwxr-xr-x
📄
__init__.cpython-39.pyc
323 bytes
02/11/2025 08:19:49 AM
rw-r--r--
📄
acl.cpython-39.pyc
18.76 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
autoclass.cpython-39.pyc
6.01 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
bucketpolicyonly.cpython-39.pyc
6.75 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
cat.cpython-39.pyc
4.17 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
compose.cpython-39.pyc
4.57 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
config.cpython-39.pyc
40.97 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
cors.cpython-39.pyc
6.56 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
cp.cpython-39.pyc
42.21 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
defacl.cpython-39.pyc
11.25 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
defstorageclass.cpython-39.pyc
5.78 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
du.cpython-39.pyc
8.47 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
hash.cpython-39.pyc
7.87 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
help.cpython-39.pyc
6.41 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
hmac.cpython-39.pyc
12.39 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
iam.cpython-39.pyc
24.6 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
kms.cpython-39.pyc
14.88 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
label.cpython-39.pyc
10.46 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
lifecycle.cpython-39.pyc
6.37 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
logging.cpython-39.pyc
9.04 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
ls.cpython-39.pyc
18.81 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
mb.cpython-39.pyc
12.23 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
mv.cpython-39.pyc
5.06 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
notification.cpython-39.pyc
25.47 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
pap.cpython-39.pyc
6.53 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
perfdiag.cpython-39.pyc
62.18 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
rb.cpython-39.pyc
3.78 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
requesterpays.cpython-39.pyc
5.53 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
retention.cpython-39.pyc
20.02 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
rewrite.cpython-39.pyc
16.12 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
rm.cpython-39.pyc
10.86 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
rpo.cpython-39.pyc
5.96 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
rsync.cpython-39.pyc
53.86 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
setmeta.cpython-39.pyc
11.25 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
signurl.cpython-39.pyc
20.99 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
stat.cpython-39.pyc
5.04 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
test.cpython-39.pyc
17.73 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
ubla.cpython-39.pyc
6.96 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
update.cpython-39.pyc
12.26 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
version.cpython-39.pyc
5.25 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
versioning.cpython-39.pyc
5.51 KB
02/11/2025 08:19:49 AM
rw-r--r--
📄
web.cpython-39.pyc
7.63 KB
02/11/2025 08:19:49 AM
rw-r--r--
Editing: iam.cpython-39.pyc
Close
a +(Wg� � @ s� d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZ ddlmZ dd lmZ dd lmZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z( ddl'm)Z) ddl*m+Z+ ddl,m-Z- ddl,m.Z. ddl,m/Z/ dd l,m0Z0 dd l1m2Z3 dd l4m5Z5 dd l6m7Z7 dd l8m9Z9 dd!l8m:Z: dd"l4m;Z; dd#l<m=Z= dd$l<m>Z> dd%l<m?Z? dd&l<m@Z@ dd'l<mAZA dd(l<mBZB dd)lCmDZD dd*lEmFZF dd+lEmGZG d,ZHd-ZId.ZJd/ZKd0ZLd1ZMeHeI�Nd2� eJ�Nd2� d3 ZOd4d2�PeKeLeMg� ZQe$eOeQ�ZRe$eIeK�ZSe$eHeL�ZTe$eJeM�ZUe �Vd5�ZWd6ZXd7d8� ZYd9d:� ZZd;d<� Z[d=d>� Z\d?d@� Z]G dAdB� dBe�Z^dS )Cz8Implementation of IAM policy management command for GCS.� )�absolute_import)�print_function)�division)�unicode_literalsN)�zip)� protojson)� DecodeError)�config)�ArgumentException)�PreconditionException)�ServiceException)�Command)�GetFailureCount)�CommandArgument)� ApiSelector)�CommandException)�&IamChOnResourceWithConditionsException)�CreateHelpText)�LogCommandParams)�NameExpansionIterator)� SeekAheadNameExpansionIterator)�PluralityCheckableIterator)�GetSchemeFromUrlString)�IsKnownUrlScheme)�StorageUrlFromString)� UrlsAreMixOfBucketsAndObjects)�storage_v1_messages)� shim_util)�GetCloudApiInstance)�IAM_POLICY_VERSION)�NO_MAX)� iam_helper)�BindingStringToTuple)� BindingsTuple��DeserializeBindingsTuple)�IsEqualBindings)� PatchBindings��SerializeBindingsTuple)�Retry)�GcloudStorageMap)�GcloudStorageFlagz3 gsutil iam set [-afRr] [-e <etag>] file url ... z gsutil iam get url a� gsutil iam ch [-fRr] binding ... url where each binding is of the form: [-d] ("user"|"serviceAccount"|"domain"|"group"):id:role[,...] [-d] ("allUsers"|"allAuthenticatedUsers"):role[,...] -d ("user"|"serviceAccount"|"domain"|"group"):id -d ("allUsers"|"allAuthenticatedUsers") NOTE: The "iam ch" command does not support changing Cloud IAM policies with bindings that contain conditions. As such, "iam ch" cannot be used to add conditions to a policy or to change the policy of a resource that already contains conditions. See additional details below. NOTE: The "gsutil iam" command does not allow you to add convenience values (projectOwner, projectEditor, projectViewer), but you can remove existing ones. a <B>GET</B> The ``iam get`` command gets the Cloud IAM policy for a bucket or object, which you can save and edit for use with the ``iam set`` command. The following examples save the bucket or object's Cloud IAM policy to a text file: gsutil iam get gs://example > bucket_iam.txt gsutil iam get gs://example/important.txt > object_iam.txt The Cloud IAM policy returned by ``iam get`` includes an etag. The etag is used in the precondition check for ``iam set`` unless you override it using ``iam set -e``. a� <B>SET</B> The ``iam set`` command sets a Cloud IAM policy on one or more buckets or objects, replacing the existing policy on those buckets or objects. For an example of the correct formatting for a Cloud IAM policy, see the output of the ``iam get`` command. You can use the ``iam ch`` command to edit an existing policy, even in the presence of concurrent updates. You can also edit the policy concurrently using the ``-e`` flag to override the Cloud IAM policy's etag. Specifying ``-e`` with an empty string (i.e. ``gsutil iam set -e '' ...``) instructs gsutil to skip the precondition check when setting the Cloud IAM policy. When you set a Cloud IAM policy on a large number of objects, you should use the gsutil ``-m`` option for concurrent processing. The following command applies ``iam.txt`` to all objects in the ``dogs`` bucket: gsutil -m iam set -r iam.txt gs://dogs Note that only object-level operations are parallelized; setting a Cloud IAM policy on a large number of buckets with the ``-m`` flag does not improve performance. <B>SET OPTIONS</B> The ``set`` sub-command has the following options: -R, -r Performs ``iam set`` recursively on all objects under the specified bucket. This flag can only be set if the policy exclusively uses ``roles/storage.legacyObjectReader`` or ``roles/storage.legacyObjectOwner``. This flag cannot be used if the bucket is configured for uniform bucket-level access. -a Performs ``iam set`` on all object versions. -e <etag> Performs the precondition check on each object with the specified etag before setting the policy. You can retrieve the policy's etag using ``iam get``. -f The default gsutil error-handling mode is fail-fast. This flag changes the request to fail-silent mode. This option is implicitly set when you use the gsutil ``-m`` option. av <B>CH</B> The ``iam ch`` command incrementally updates Cloud IAM policies. You can specify multiple access grants or removals in a single command. The access changes are applied as a batch to each url in the order in which they appear in the command line arguments. Each access change specifies a principal and a role that is either granted or revoked. You can use gsutil ``-m`` to handle object-level operations in parallel. NOTE: The ``iam ch`` command cannot be used to change the Cloud IAM policy of a resource that contains conditions in its policy bindings. Attempts to do so result in an error. To change the Cloud IAM policy of such a resource, you can perform a read-modify-write operation by saving the policy to a file using ``iam get``, editing the file, and setting the updated policy using ``iam set``. <B>CH EXAMPLES</B> Examples for the ``ch`` sub-command: To grant a single role to a single principal for some targets: gsutil iam ch user:john.doe@example.com:objectCreator gs://ex-bucket To make a bucket's objects publicly readable: gsutil iam ch allUsers:objectViewer gs://ex-bucket To grant multiple bindings to a bucket: gsutil iam ch user:john.doe@example.com:objectCreator \ domain:www.my-domain.org:objectViewer gs://ex-bucket To specify more than one role for a particular principal: gsutil iam ch user:john.doe@example.com:objectCreator,objectViewer \ gs://ex-bucket To specify a custom role for a particular principal: gsutil iam ch user:john.doe@example.com:roles/customRoleName gs://ex-bucket To apply a grant and simultaneously remove a binding to a bucket: gsutil iam ch -d group:readers@example.com:legacyBucketReader \ group:viewers@example.com:objectViewer gs://ex-bucket To remove a user from all roles on a bucket: gsutil iam ch -d user:john.doe@example.com gs://ex-bucket <B>CH OPTIONS</B> The ``ch`` sub-command has the following options: -d Removes roles granted to the specified principal. -R, -r Performs ``iam ch`` recursively to all objects under the specified bucket. This flag can only be set if the policy exclusively uses ``roles/storage.legacyObjectReader`` or ``roles/storage.legacyObjectOwner``. This flag cannot be used if the bucket is configured for uniform bucket-level access. -f The default gsutil error-handling mode is fail-fast. This flag changes the request to fail-silent mode. This is implicitly set when you invoke the gsutil ``-m`` option. � z a7 Cloud Identity and Access Management (Cloud IAM) allows you to control who has access to the resources in your Google Cloud project. For more information, see `Cloud Identity and Access Management <https://cloud.google.com/storage/docs/access-control/iam>`_. The iam command has three sub-commands: z [a-z]+://.+z�To change the IAM policy of a resource that has bindings containing conditions, perform a read-modify-write operation using "iam get" and "iam set".c C s t | �r|std��d S )Nz/Cannot operate on a mix of buckets and objects.)r r )�urls�recursion_requested� r0 �!/opt/gsutil/gslib/commands/iam.py�*_RaiseErrorIfUrlsAreMixOfBucketsAndObjects� s r2 c C s$ |\}}| j |jdd� |D �|d�S )Nc S s g | ] }t |��qS r0 r$ ��.0�tr0 r0 r1 � <listcomp> � z$_PatchIamWrapper.<locals>.<listcomp>�� thread_state)�PatchIamHelper�expanded_storage_url)�cls� iter_resultr9 Zserialized_bindings_tuples�expansion_resultr0 r0 r1 �_PatchIamWrapper s �r? c C s$ |\}}| j |jt�tj|�|d�S )Nr8 )� SetIamHelperr; r �decode_message�apitools_messages�Policy)r< r= r9 Zserialized_policyr> r0 r0 r1 �_SetIamWrapper s �rD c C s | j �t|�� d S �N��logger�error�str�r< �er0 r0 r1 �_SetIamExceptionHandler s rL c C s | j �t|�� d S rE rF rJ r0 r0 r1 �_PatchIamExceptionHandler s rM c s e Zd ZdZejdededdddej gej e � d�ge � d�e � � ge �� e � � gd�d � Zejdg d d eeeed�d �Zd d� Z� fdd�Zdd� Zdd� Zd/dd�Z� fdd�Zd0dd�Z d1d d �Z d2d d �Z d3d d!�Z d4d"d#�Z e!e"d$d%d&�d5d'd(��Z#d)d*� Z$d+d,� Z%d-d.� Z&� Z'S )6� IamCommandz%Implementation of gsutil iam command.�iam� zafRrd:e:TF� )�get�set�ch) �usage_synopsis�min_args�max_args�supported_sub_args� file_url_ok�provider_url_ok�urls_start_arg�gs_api_support�gs_default_api�argparse_arguments� command_helpz9Get, set, or change bucket and/or object IAM permissions.)� help_name�help_name_aliases� help_type�help_one_line_summary� help_text�subcommand_help_textc C s | j s|d �� rdS dS d S )Nr �objects�buckets)r/ �IsObject)�self� url_patternsr0 r0 r1 �_get_resource_typeD s z IamCommand._get_resource_typec s� | j �d�| _| jdkrLt| j d ��� r0d}nd}td|ddgi d�}�n.| jd k�r@tg d �td �td �td �td�td�td�d�d�}| �� | j dd � }tt t|��}d}t | j �D ]4\}\}}|dv r�d}q�|dkr�|dkr�d| j |< q�t ||� |�s|d �� �r d|j d< n d|j d< || j d d� | _ n:| jdk�rzt�t�ddd��tjju �rv| j�d � g S t� �|�S ) Nr rR rf rg �storage�get-iam-policy� --format=json)�gcloud_command�flag_maprS )rl N�set-iam-policyrn z--all-versionsz--etagz--etag=z--continue-on-errorz --recursive)�-a�-e� _empty_etag�-f�-R�-rrQ F�rw rv Trs � )rt ry rT �GSUtil�hidden_shim_mode�nonez|The shim maps iam ch commands to several gcloud storage commands, which cannot be determined without running gcloud storage.)�args�pop� sub_commandr rh r+ r, � ParseSubOpts�list�map� enumerate�sub_optsr2 ro r �HIDDEN_SHIM_MODEr rR �DRY_RUNrG �warning�super�get_gcloud_storage_args) ri � command_group�gcloud_storage_map� url_strings� url_objects�recurse�i�flag_key� flag_value�� __class__r0 r1 r� J s` �� �� ����z"IamCommand.get_gcloud_storage_argsc C s: |� � r6d|j }t|j��td��r.|d7 }t|��d S )NzInvalid Cloud URL "%s".z-Rrfzz This resource handle looks like a flag, which must appear before all bindings. See "gsutil help iam ch" for more details.)� IsFileUrl� object_namerS �issubsetr )ri �url� error_msgr0 r0 r1 �_RaiseIfInvalidUrl� s �z IamCommand._RaiseIfInvalidUrlc C s* d| _ d| _g }| jr^| jD ]@\}}|dv r4d| _q |dkrDd| _ q |dkr |�td|�� q g }t| j�}|D ]v}t�|�r�t t |��r�|�|� q�|dkr�z|�tdt |��� W q� t y� t d��Y q�0 qp|�td|�� qp|s�t d��|D ]}|�|� q�ttt|��}t|| j� ||fS )NFrx Tru z-dz?A -d flag is missing an argument specifying bindings to remove.z"Must specify at least one binding.)�continue_on_errorr/ r� �appendr" �iterr} �STORAGE_URI_REGEX�matchr r �next� StopIterationr r� r� r r2 )ri �patch_bindings_tuples�o�aZurl_pattern_strings�it�tokenr� r0 r0 r1 �_GetSettingsAndDiffs� sH � � �z IamCommand._GetSettingsAndDiffsNc C sZ | � |�\}}tj|| �� |tjtjdd�}|jdkrV| jrL| j�|j � n t |j ��|S )NT)�env�input�stderr�stdout�textr ) �._get_full_gcloud_storage_execution_information� subprocess�run�'_get_shim_command_environment_variables�PIPE� returncoder� rG rH r� r )ri r} �stdin�_�command�processr0 r0 r1 �_run_ch_subprocess� s � z IamCommand._run_ch_subprocessc sj | j dkrt� �� S | �� | �� \}}| �|�}g }| jrF|�d� d}|D �]}| �|� |dkr�| � g d�| t |�g �}|j r�d}qNt � |j�}dd� |D �} n t |�g} | D ]�} | � d |d | d g�} | j r�d}q�t � | j�} t�| d �} |D ] \}}t�|�}t| ||�} q�d d� tt�| ��D �| d < | j d |d| dgt j| dd�d�}|j r�d}q�qN|S )NrT rw r rf )rl �lsz--jsonrQ c S s g | ]}|d dkr|d �qS )�type� cloud_objectr� r0 )r4 �resourcer0 r0 r1 r6 � s �z1IamCommand.run_gcloud_storage.<locals>.<listcomp>rl rm rn �bindingsc S s" g | ]\}}|t t|��d ��qS �)�role�members)�sortedr� �r4 �r�mr0 r0 r1 r6 � s � �rq �-T)� sort_keys)r� )r r� �run_gcloud_storager� r� rk r/ r� r� r� rI r� �json�loadsr� r! ZBindingsDictToUpdateDictr' r� �six� iteritems�dumps)ri �bindings_tuples�patternsZ resource_typeZ list_settings� return_codeZ url_patternZ ls_processZ ls_outputr. r� Z get_process�policyr� �is_grant�diff� diff_dictZ set_processr� r0 r1 r� � s^ �� � � � �z IamCommand.run_gcloud_storagec C sR t | |d�}|�� r.|j|j|jddgd�}n |j|j|j|j|jddgd�}|S )a� Gets an IAM policy for a single, resolved bucket / object URL. Args: storage_url: A CloudUrl instance with no wildcards, pointing to a specific bucket or object. thread_state: CloudApiDelegator instance which is passed from command.WorkerThread.__init__() if the global -m flag is specified. Will use self.gsutil_api if thread_state is set to None. Returns: Policy instance. r8 r� �etag)�provider�fields)� generationr� r� )r �IsBucket�GetBucketIamPolicy� bucket_name�scheme�GetObjectIamPolicyr� r� )ri � storage_urlr9 � gsutil_apir� r0 r0 r1 � GetIamHelper s ��zIamCommand.GetIamHelperc C s� | j d }t| �|�jdgd��}|�� r6td| ��|�� rPtd|| jf ��tt |�d j �}| j ||d�}t � t�|��}t j|ddd d �}t|� d S ) z,Gets IAM policy for single bucket or object.r �name)�bucket_listing_fieldsz%s matched no URLszD%s matched more than one URL, which is not allowed by the %s commandr8 T)�,z: rP )r� � separators�indentN)r} r �WildcardIterator�IterAll�IsEmptyr � HasPlurality� command_namer r� � url_stringr� r� r� r �encode_messager� �print)ri r9 �pattern�matchesr� r� � policy_jsonZ policy_strr0 r0 r1 �_GetIam) s, � ���zIamCommand._GetIamc C sJ t | |d�}|�� r*|j|j||jd� n |j|j|j||j|jd� dS )aP Sets IAM policy for a single, resolved bucket / object URL. Args: storage_url: A CloudUrl instance with no wildcards, pointing to a specific bucket or object. policy: A Policy object to set on the bucket / object. thread_state: CloudApiDelegator instance which is passed from command.WorkerThread.__init__() if the -m flag is specified. Will use self.gsutil_api if thread_state is set to None. Raises: ServiceException passed from the API call if an HTTP error was returned. r8 )r� )r� r� N)r r� �SetBucketIamPolicyr� r� �SetObjectIamPolicyr� r� )ri r� r� r9 r� r0 r0 r1 �_SetIamHelperInternalB s ��z IamCommand._SetIamHelperInternalc C s< z| j |||d� W n" ty6 | jr0d| _n� Y n0 dS )zDHandles the potential exception raised by the internal set function.r8 FN)r� r r� �everything_set_okay)ri r� r� r9 r0 r0 r1 r@ c s zIamCommand.SetIamHelperc C s� z| j |||d� W np ty6 | jr0d| _n� Y nP ty� } z8| jrfd| _d| _| j�|j� n t |j��W Y d}~n d}~0 0 dS )a� Patches an IAM policy for a single, resolved bucket / object URL. The patch is applied by altering the policy from an IAM get request, and setting the new IAM with the specified etag. Because concurrent IAM set requests may alter the etag, we may need to retry this operation several times before success. Args: storage_url: A CloudUrl instance with no wildcards, pointing to a specific bucket or object. bindings_tuples: A list of BindingsTuple instances. thread_state: CloudApiDelegator instance which is passed from command.WorkerThread.__init__() if the -m flag is specified. Will use self.gsutil_api if thread_state is set to None. r8 FTN) �_PatchIamHelperInternalr r� r� r �$tried_ch_on_resource_with_conditionsrG �debug�messager )ri r� r� r9 rK r0 r0 r1 r: m s � zIamCommand.PatchIamHelper� g �?)�tries� timeout_secsc C s� | j ||d�}|j|j }}|D ]:}|jr d| }|d7 }|d�t�dt ��7 }t|��q t |�} |D ]<\} } t � |�} t � | �} t | | | �}dd� t �|�D �}qht|| �r�| j�d|� d S tj||d�}| j|||d� d S ) Nr8 z"Could not patch IAM policy for %s.r- zfThe resource had conditions present in its IAM policy bindings, which is not supported by "iam ch". %sc S s$ g | ] \}}t jj|t|�d ��qS r� )rB rC �BindingsValueListEntryr� r� r0 r0 r1 r6 � s ��z6IamCommand._PatchIamHelperInternal.<locals>.<listcomp>zNo changes made to %s)r� r� )r� r� r� � condition�join�textwrap�wrap� IAM_CH_CONDITIONS_WORKAROUND_MSGr r� r! ZBindingsMessageToUpdateDictr' r� r� r& rG �inforB rC r� )ri r� r� r9 r� r� r� �bindingr� Z orig_bindingsr� r� Z bindings_dictr� Znew_bindings_dictr0 r0 r1 r� � s6 ��� � z"IamCommand._PatchIamHelperInternalc C s� | � � \}}g }|D ]J\}}g }|D ]&}tjj|d |d d�}|�|� q$|�t||d�� qd| _d| _g } |D ]b} z@| �� r�| j r�d| _ | �| j � q�| � | |� n | �| j � W qt t y� | �| � Y qt0 qt| �rxt| j| j| j| j| | j | j| j�p| jdgd � } t| j| j| �� | | j | jd �} t�d d � |D ��} | jt t | | �t | j | d � | jt � dk M _| j�s�d}| j�r�|d7 }|d� t!�"dt# ��7 }t$|��d S )Nr� r� )r� r� )r� r� TF�*r� �� all_versionsr� r� �r c S s g | ] }t |��qS r0 r( r3 r0 r0 r1 r6 � r7 z(IamCommand._PatchIam.<locals>.<listcomp>�� fail_on_error�seek_ahead_iteratorr z'Some IAM policies could not be patched.r- zjSome resources had conditions present in their IAM policy bindings, which is not supported by "iam ch". %s)%r� rB rC r� r� r# r� r� r� r/ �objectr� r: �AttributeErrorr� r r� r� rG r� r r� �parallel_operationsr �GetSeekAheadGsutilApi� itertools�repeat�Applyr? r rM r r� r� r� r� r )ri Zraw_bindings_tuplesrj r� r� r� Zbindings_messagesr Zbindings_message�threaded_wildcards�surl�name_expansion_iteratorr Z serialized_bindings_tuples_it�msgr0 r0 r1 � _PatchIam� s� � � � � �����zIamCommand._PatchIamc C s� d| _ d| _d| _d}d}| jr~| jD ]V\}}|dv r>d| _q&|dkrNd| _ q&|dkr^d| _q&|dkrtt|�}d}q&| �� q&| jd }| jd d � }z<t|d �� }t� |� � �}W d � n1 s�0 Y W n\ t y� t d | ��Y n@ t �y. } z&| j�d | � t d| ��W Y d } ~ n d } ~ 0 0 |�dg �} |�sN|�dd�}t�| |td��} zt�tj| �}W n$ t�y� t d||f ��Y n0 d| _g } ttt|��} t | | j� | D ]P}t |j � |� � �r| j�r�d|_ | �!|j � n | �"||� n | �!|j � �q�| �r�t#| j$| j| j| j%| | j| j| j �p@| j&dgd� }t'| j$| j| �(� | | j| jd�}t)�*t�+|��}| j,t-t.||�t/| j |d� | jt0� dk M _| j�s�t1d��d S )z7Set IAM policy for given wildcards on the command line.Fry rx Tru rr rs r rQ Nr� z.Specified IAM policy file "%s" does not exist.z'Invalid IAM policy file, ValueError: %sz Invalid IAM policy file "%s".r� r� )r� r� �versionz*Invalid IAM policy file "%s" or etag "%s".r r� r r r z#Some IAM policies could not be set.)2r� r/ r r� rI � RaiseInvalidArgumentExceptionr} �openr� r� �read�IOErrorr � ValueErrorrG r� rR r� r r rA rB rC r r� r� r� r r2 r� r� r� r� r� r@ r r� r� r r r r r r� r rD r rL r r )ri Z force_etagr� r� �argZfile_urlr� �fpr� rK r� r� r Zsurlsr r r Z policy_itr0 r0 r1 �_SetIam s� 0 � " �� � ��zIamCommand._SetIamc C s� | j �d�}| jdd� t| jd� d| _|dkrHt|gd� | �� nN|dkrft|gd� | �� n0|d kr�t|gd� | �� nt d || j f ��dS ) z(Command entry point for the acl command.r T)� check_args)r� FrR )� subcommandsrS rT zBInvalid subcommand "%s" for the %s command. See "gsutil help iam".) r} r~ r� r r� �def_aclr� r r r r� )ri �action_subcommandr0 r0 r1 � RunCommandv s" �zIamCommand.RunCommand)N)N)N)N)N)N)N)(�__name__� __module__� __qualname__�__doc__r �CreateCommandSpec� _SYNOPSISr r �JSONr �MakeNCloudURLsArgument�MakeNFileURLsArgument� MakeZeroOrMoreCloudURLsArgument� MakeOneOrMoreBindingsArgument� command_spec�HelpSpec�_DETAILED_HELP_TEXT�_get_help_text�_set_help_text� _ch_help_text� help_specrk r� r� r� r� r� r� r� r� r@ r: r* r r� r r r" � __classcell__r0 r0 r� r1 rN sb ������ 8 1 : ! ! " � /InrN )_r& � __future__r r r r r r� �os�rer� r� r� � six.movesr �apitools.base.protorpcliter Z#apitools.base.protorpclite.messagesr �botor �gslib.cloud_apir r r � gslib.commandr r �gslib.command_argumentr �gslib.cs_api_mapr �gslib.exceptionr r �gslib.help_providerr Z gslib.metricsr �gslib.name_expansionr r �"gslib.plurality_checkable_iteratorr �gslib.storage_urlr r r r �"gslib.third_party.storage_apitoolsr rB Z gslib.utilsr � gslib.utils.cloud_api_helperr �gslib.utils.constantsr r r! Zgslib.utils.iam_helperr" r# r% r& r' r) �gslib.utils.retry_utilr* �gslib.utils.shim_utilr+ r, � _SET_SYNOPSIS� _GET_SYNOPSIS� _CH_SYNOPSIS�_GET_DESCRIPTION�_SET_DESCRIPTION�_CH_DESCRIPTION�lstripr( r� � _DESCRIPTIONr0 r1 r2 r3 �compiler� r� r2 r? rD rL rM rN r0 r0 r0 r1 �<module> s� +E ��� �