CURRENT PATH:
/
opt
/
gsutil
/
gslib
/
__pycache__
/
[ ⬅ KEMBALI ]
|
[ HOME ]
Upload File:
Upload Ke Sini
Dir Baru
File Baru
Editing:
gcs_json_credentials.cpython-39.pyc
a +(Wg9Q � @ s� d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZ ddl mZ dd lmZ dd lmZ dd lmZ dd lmZ dd lmZ ddlm Z ddlm Z ddl m Z ddl m Z ddl m!Z! ddl m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z( ddl)m*Z+ ddl,m-Z- ddl.m/Z/ ddl0Z0ddl1m2Z2 ddl3m4Z4 dd l5m6Z6 dd l7m8Z8 dd l3m9Z9 dd l m:Z: d Z;d!Z<e j=j>e j=j?e j=j@e j=jAe j=jBgZCd"ZDd#d$� ZEG d%d&� d&e+jFe+jG�ZHG d'd(� d(e/jI�ZJdKd)d*�ZKd+d,� ZLdLd-d.�ZMd/d0� ZNd1d2� ZOd3d4� ZPd5d6� ZQd7d8� ZRd9d:� ZSd;d<� ZTd=d>� ZUd?d@� ZVdAdB� ZWdCdD� ZXdEdF� ZYdGdH� ZZdIdJ� Z[dS )Mz3Credentials logic for JSON CloudApi implementation.� )�absolute_import)�print_function)�division)�unicode_literalsN)�credentials_lib)� exceptions)�config)� CredTypes)�CommandException)�ImpersonationCredentials)�NoOpCredentials)� constants)� system_util)�GetFriendlyConfigFilePaths)�GetCredentialStoreFilename)� GetGceCredentialCacheFilename)�GetGcsJsonApiVersion)�UTF8)�WrappedCredentials)�_helpers)�base��AuthorizedHttp)�service_account)� HAS_CRYPTO)�devshell)�ServiceAccountCredentials)� reauth_creds)�multiprocess_file_storage)�BytesIOz)https://accounts.google.com/o/oauth2/authz#https://oauth2.googleapis.com/token� notasecretc C s t | t�S �N)� isinstance�P12Credentials)� credentials� r% �)/opt/gsutil/gslib/gcs_json_credentials.py�isP12CredentialsO s r' c @ s: e Zd ZdZdd� Zedd� �Zdd� Zed d d ��Z dS ) � PKCS12Signerz%Signer for a p12 service account key.c C s || _ d S r! )�_key)�self�keyr% r% r& �__init__U s zPKCS12Signer.__init__c C s d S r! r% )r* r% r% r& �key_idZ s zPKCS12Signer.key_idc C s* t �|�}ddlm} | j�||j|j�S )Nr )�_cryptography_rsa)r �to_bytes�google.auth.cryptr. r) �sign�_PADDING�_SHA256)r* �messager. r% r% r& r1 ^ s �zPKCS12Signer.signNc C sV ~dd� |D �\}}ddl m} z |�||�\}}}| |�W S td��Y n0 d S )Nc s s | ]}t �|�V qd S r! )r r/ )�.0�kr% r% r& � <genexpr>i � z+PKCS12Signer.from_string.<locals>.<genexpr>r )�pkcs12z<Unable to load the keyfile, Invalid password or PKCS12 data.)�,cryptography.hazmat.primitives.serializationr9 Zload_key_and_certificatesr )�clsZ key_stringsr- � key_string�passwordr9 r+ �_r% r% r& � from_stringf s zPKCS12Signer.from_string)N) �__name__� __module__� __qualname__�__doc__r, �propertyr- r1 � classmethodr? r% r% r% r& r( R s r( c @ s* e Zd ZdZdZdd� Zeddd��ZdS ) r# a google-auth service account credentials for p12 keys. p12 keys are not supported by the google-auth service account credentials. gsutil uses oauth2client to support p12 key users. Since oauth2client was deprecated and bundling it is security concern, we decided to support p12 in gsutil codebase. We prefer not adding it to the google-auth library because p12 is not supported from the beginning by google-auth. GCP strongly suggests users to use the JSON format. gsutil has to support it to not break users. )�service_account_email� token_uri�scopesc C s t | |d�S )N)�httpr )r* rI r% r% r& � authorize� s zP12Credentials.authorizeNc sV |pt }t�||f�}� fdd�| jD �}|rBtd�d�|����| |fi � ��}|S )Nc s g | ]}|� vr|�qS r% r% )r5 �f��kwargsr% r& � <listcomp>� r8 zHP12Credentials.from_service_account_pkcs12_keystring.<locals>.<listcomp>zMissing fields: {}.z, )�#GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORDr( r? �_REQUIRED_FIELDSr �format�join)r; r< r= rM �signer�missing_fields�credsr% rL r& �%from_service_account_pkcs12_keystring� s �z4P12Credentials.from_service_account_pkcs12_keystring)N)r@ rA rB rC rP rJ rE rV r% r% r% r& r# s s �r# c K s6 zt j| |fi |��W S ty0 td��Y n0 dS )zCCreates a service account from a p12 key and handles import errors.zapyca/cryptography is not available. Either install it, or please consider using the .json keyfileN)r# rV � ImportErrorr )r< r= rM r% r% r& �CreateP12ServiceAccount� s �� �rX c C s� |g}t | tj�r |�| j� n�t | t�rx|�| j� t| dd�rP|�| j� q�t| dd�r�|�t � | j �dd� � nFt | t j j�r�| jr�| jdkr�|�| j� n |�d� |�| jp�d� t| dd�r�|�| j� d d � |D �}d �|�S ) a� Disambiguates a credential for caching in a credential store. Different credential types have different fields that identify them. This function assembles relevant information in a string to be used as the key for accessing a credential. Note that in addition to uniquely identifying the entity to which a credential corresponds, we must differentiate between two or more of that entity's credentials that have different attributes such that the credentials should not be treated as interchangeable, e.g. if they target different API versions (happens for developers targeting different test environments), have different private key IDs (for service account JSON keyfiles), or target different provider token (refresh) URIs. Args: credentials: An OAuth2Credentials object. api_version: JSON API version being used. Returns: A string that can be used as the key to identify a credential, e.g. "v1-909320924072.apps.googleusercontent.com-1/rEfrEshtOkEn-https://..." �_private_key_idN�_private_key_pkcs12� �nullZ noclientidZnorefreshtokenrG c S s g | ]}t �|��qS r% )�six� ensure_text)r5 �partr% r% r& rN � r8 z)GetCredentialStoreKey.<locals>.<listcomp>�-)r" r �DevshellCredentials�append� user_emailr �_service_account_email�getattrrY �base64� b64encoderZ � oauth2client�client�OAuth2Credentials� client_id� refresh_tokenrG rR )r$ � api_versionZ key_partsr% r% r& �GetCredentialStoreKey� s$ rn c C s� |pt |�pt� | _t| jt�r.|�dt� � t| j�s�t| jt � �}| j� t � t � |�� d}t| jt�sx| jj�� }|r�t|�tjjkr�|| _dS )zAHelper to ensure each GCS API client shares the same credentials.zeWARNING: This command is using service account impersonation. All API calls will be executed as [%s].N)�_CheckAndGetCredentialsr r$ r" r �warn� _GetImpersonateServiceAccountr' rn r � set_storer �MultiprocessFileStorager �store�get�typerh ri rj )�api�loggerr$ Zcredential_store_keyZ cached_credr% r% r& � SetUpJsonCredentialsAndCache� s0 � � ��� �ry c C sV g }d}z�t � r |�tj� t� r.|�tj� t|�dkrLtd|t� f ��tj}t � }tj}t � }tj }t � }tj }t� }tj}t� }tj}t� }|p�|p�|p�|p�|p�|} t� r�| r�tj}t| | �W S | W S W n� t�yP } zf|�r:| �tj��r| �t� � � |tjk�r| �n$t � � �r.| � d|� n | � d|� � W Y d} ~ n d} ~ 0 0 dS )z�Returns credentials from the configuration file, if any are present. Args: logger: logging.Logger instance for outputting messages. Returns: OAuth2Credentials object if any valid ones are found, otherwise None. N� a& You have multiple types of configured credentials (%s), which is not supported. One common way this happens is if you run gsutil config to create credentials and later run gcloud auth, and create a second set of credentials. Your boto config path is: %s. For more help, see "gsutil help creds".zCYour "%s" credentials are invalid. Please run $ gcloud auth loginz�Your "%s" credentials are invalid. For more help, see "gsutil help creds", or re-run the gsutil config command (see "gsutil help config").) �_HasOauth2UserAccountCredsrb r ZOAUTH2_USER_ACCOUNT� _HasOauth2ServiceAccountCredsZOAUTH2_SERVICE_ACCOUNT�lenr r � _GetOauth2UserAccountCredentials�#_GetOauth2ServiceAccountCredentialsZEXTERNAL_ACCOUNT� _GetExternalAccountCredentialsZ EXTERNAL_ACCOUNT_AUTHORIZED_USER�,_GetExternalAccountAuthorizedUserCredentialsZGCE� _GetGceCredsZDEVSHELL�_GetDevshellCreds� _HasImpersonateServiceAccountZ IMPERSONATION� _GetImpersonationCredentials� Exception� isEnabledFor�logging�DEBUG�debug� traceback� format_excr �InvokedViaCloudSdkrp ) rx Zconfigured_cred_typesZfailed_cred_typeZ user_credsZservice_account_credsZexternal_account_credsZ&external_account_authorized_user_credsZ gce_credsZdevshell_credsrU �er% r% r& ro s\ �� �� ro c C s t �ddt�S )N�OAuth2�provider_token_uri)r ru �(DEFAULT_GOOGLE_OAUTH2_PROVIDER_TOKEN_URIr% r% r% r& �_GetProviderTokenUriU s �r� c C s t �dd�S )N� Credentials�gs_service_key_file�r � has_optionr% r% r% r& r| Z s r| c C s t �dd�S )Nr� �gs_oauth2_refresh_tokenr� r% r% r% r& r{ ^ s r{ c C s t �dd�S )N� GoogleComputer r� r% r% r% r& � _HasGceCredsb s r� c C s t � dvS )N)N� )rq r% r% r% r& r� f s r� c C s t �ddd �} | sd S t�| �S )Nr� �gs_external_account_file)r ru r Zfor_external_account)Zexternal_account_filenamer% r% r& r� j s �r� c C s t �ddd �} | sd S t�| �S )Nr� �(gs_external_account_authorized_user_file)r ru r Z$for_external_account_authorized_user)Z)external_account_authorized_user_filenamer% r% r& r� s s ��r� c C s t jpt�ddtj�d��S )Nr� Z gs_impersonate_service_accountZ)CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT)r �IMPERSONATE_SERVICE_ACCOUNTr ru �os�environr% r% r% r& rq } s �rq c C s t � s dS t� } t�ddd�}t�ddd�}t�|d��}|�� }W d � n1 sV0 Y d}z|�t�}d}W n t y� Y n0 |r�zt � |�}W n t y� t d | ��Y n0 d D ] }||vr�t d ||f ��q�tj|t| d �S t�dd t�}t||t|| d�S dS )zDRetrieves OAuth2 service account credentials for a private key file.Nr� �gs_service_client_idr� r� �rbFTz/Could not parse JSON keyfile "%s" as valid JSON)rk � client_email�private_key_id� private_keyzFThe JSON private key file at %s did not contain the required entry: %s)rH rG Z gs_service_key_file_password)rH rF rG )r| r� r ru �io�open�read�decoder �UnicodeDecodeError�json�loads� ValueErrorr� r �from_json_keyfile_dict�DEFAULT_SCOPESrO rX ) r� Zservice_client_id�private_key_filenameZprivate_key_filer� Zkeyfile_is_utf8Z json_key_dictZ json_entryZ key_file_passr% r% r& r � s@ & � ���r c C s~ t � s dS t� } t�� \}}t�ddtj�d|��}t�ddtj�d|��}tj j tj j g}t j d||t�dd�d| d|d �S ) zARetrieves OAuth2 service account credentials for a refresh token.Nr� rk ZOAUTH2_CLIENT_ID� client_secretZOAUTH2_CLIENT_SECRETr� r� )rH )r{ r� r �GetGsutilClientIdAndSecretr ru r� r� r �Scopes�CLOUD_PLATFORM�REAUTHr �Oauth2WithReauthCredentials)r� �gsutil_client_id�gsutil_client_secretrk r� Zscopes_for_reauth_challenger% r% r& r~ � s0 � � � � �r~ c C sz t � s d S z tjt�ddd�t� d�W S tjyt } z4dt| �v r^dt| �v r^W Y d } ~ d S � W Y d } ~ n d } ~ 0 0 d S )Nr� r �default)�service_account_name�cache_filenamezservice accountzdoes not exist) r� r �GceAssertionCredentialsr ru r �apitools_exceptions�ResourceUnavailableError�str)r� r% r% r& r� � s ��r� c C s2 z t �� W S t jy Y d S � Y n0 d S r! )r ra �NoDevshellServerr% r% r% r& r� � s r� c C s$ t | t�rdS tt� tjjg| |�S )z?Retrieves temporary credentials impersonating a service accountN)r" r rq r r� r� )r$ rx r% r% r& r� � s �r� )N)N)\rC � __future__r r r r rf r� r� r� r� r] r� �apitools.base.pyr r r� �botor Zgslib.cred_typesr �gslib.exceptionr � gslib.impersonation_credentialsr �gslib.no_op_credentialsr � gslib.utilsr r �gslib.utils.boto_utilr r r r �gslib.utils.constantsr Z gslib.utils.wrapped_credentialsr � google.authr r0 r Z crypt_baseZgoogle_auth_httplib2r � google.oauth2r rh �oauth2client.clientr �oauth2client.contribr � oauth2client.service_accountr � google_reauthr r r Z0DEFAULT_GOOGLE_OAUTH2_PROVIDER_AUTHORIZATION_URIr� r� r� �CLOUD_PLATFORM_READ_ONLY� FULL_CONTROL� READ_ONLY� READ_WRITEr� rO r' �SignerZFromServiceAccountMixinr( r� r# rX rn ry ro r� r| r{ r� r� r� r� rq r r~ r� r� r� r% r% r% r& �<module> s� ���! = *S *
SIMPAN
[ BATAL ]