Your IP : 216.73.216.52
U
8�-d�m � @ s� d dl Z d dlZd dlmZmZmZmZmZ d dlm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZ d dlmZ dZdZd Zd
Zd Zd Zd
Z dZ dddd�Z e
� � Z G dd� de
j!�Z"d4eee#ef ee#ef e$e$dd�dd�Z%d5eee#ef ee#ef e$e$eee$f d�dd �Z&e j'e j(d �d d �Z)d6ee# d �d!d"�Z*eee d#�d$d%�Z+ee#ee#ef d&�d'd(�Z,ee$d#�d)d*�Z-ee#e#f ee#e#f e.d+�d,d-�Z/ee#ef e#e#ee.ee#ef f d.�d/d0�Z0d7ee#ef ee# dd1�d2d3�Z1dS )8� N)�Any�Dict�List�Optional�Tuple)�clouds� event_logger�
exceptions�messages�
serviceclient�system�util)�UAConfig)�ATTACH_FAIL_DATE_FORMAT)�UserFacingStatusz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z
/v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attach� � � )�series_overrides�series�cloudc @ s� e Zd ZdZejZeje j
dddgd�d/dd��Z e e
ef d�d d
�Ze
e e
ef d �d d
�Zeje j
dddgd�ejd�dd��Zd0e
e
ee
e e
ef d�dd�Zd1e
e
ee
e d�dd�Zdd� Ze
e e
ef d�dd�Ze e
ef d�d d �Ze
d �d d �Zd2e
e
ee
e e
ef d�d!d"�Zd3e
e
ee
e d�d#d$�Z e e
ef d%�d&d'�Z d(d)� Z d*d+� Z d4ee
d,�d-d.�Z dS )5�UAContractClientZ contract_urlr r )Z retry_sleepsNc C s~ | � � }|�dd�|�i� | �|�}| jt||d�\}}| jj�|� t j
� � |� di �� d|� d��}| j�
d|� |S )a} Requests machine attach to the provided machine_id.
@param contract_token: Token string providing authentication to
ContractBearer service endpoint.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@return: Dict of the JSON response containing the machine-token.
�
Authorization� Bearer {})�data�headers�machineTokenInfo� machineId�
machine-id)r �update�format�_get_platform_data� request_url� API_V1_CONTEXT_MACHINE_TOKEN�cfg�machine_token_file�writer �get_machine_id� cache_clear�get� write_cache)�self�contract_token�
machine_idr r �
machine_token�_headers� r0 �3/usr/lib/python3/dist-packages/uaclient/contract.py� request_contract_machine_attach* s
�
�z0UAContractClient.request_contract_machine_attach)�returnc C s | j t| �� d�\}}|S )z=Requests list of entitlements available to this machine type.)� query_params)r" �API_V1_RESOURCES�_get_platform_basic_info)r+ Zresource_responser r0 r0 r1 �request_resourcesE s
�
z"UAContractClient.request_resources)r, r3 c C s2 | � � }|�dd�|�i� | jt|d�\}}|S )Nr r �r )r r r r" �API_V1_CONTRACT_INFORMATION)r+ r, r Z
response_dataZ_response_headersr0 r0 r1 � request_contract_informationL s �
z-UAContractClient.request_contract_information)�instancec
C s� z"| j tj|jd�|jd�\}}W nP tjk
rr } z0|j�dd�}|r^t �
|� tj |d��|�W 5 d}~X Y nX | j �
d|� |S )z�Requests contract token for auto-attach images for Pro clouds.
@param instance: AutoAttachCloudInstance for the cloud.
@return: Dict of the JSON response containing the contract-token.
)�
cloud_type)r �message� )Z error_msgNzcontract-token)r" � API_V1_AUTO_ATTACH_CLOUD_TOKENr r< Z identity_docr �ContractAPIError� api_errorr) �logging�debugZInvalidProImager$ r* )r+ r; �responser/ �e�msgr0 r0 r1 �"request_auto_attach_contract_tokenV s
��
z3UAContractClient.request_auto_attach_contract_token)r. �resourcer- r3 c C sz |st �| j�}| �� }|�dd�|�i� tj||d�}| j||d�\}}|�d�rb|d |d< | j� d�|�|� |S )a� Requests machine access context for a given resource
@param machine_token: The authentication token needed to talk to
this contract service endpoint.
@param resource: Entitlement name.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@return: Dict of the JSON response containing entitlement accessInfo.
r r )rH �machiner8 �expireszmachine-access-{})
r r' r$ r r r �#API_V1_TMPL_RESOURCE_MACHINE_ACCESSr" r) r* )r+ r. rH r- r �urlZresource_accessr0 r0 r1 � request_resource_machine_accessq s �
�z0UAContractClient.request_resource_machine_access)r. � contract_idr- r3 c C s | j |||d�S )z6Update existing machine-token for an attached machine.)r. rN r- )� _request_machine_token_update)r+ r. rN r- r0 r0 r1 � request_machine_token_update� s
�z-UAContractClient.request_machine_token_updatec C s� | j jj}| j j�d�}t�| j �}| �|�}tj ||d�}| �
� }|� dd� |�i� | j |||d�\}}|r�| j j}||d< | j j�
|� dS )z�Report current activity token and enabled services.
This will report to the contracts backend all the current
enabled services in the system.
� machineToken�ZcontractrI r r )r r � activityInfoN)r$ r% rN r. r) r r' �_get_activity_info�API_V1_MACHINE_ACTIVITYr r r r" r& ) r+ rN r. r- Z request_datarL r rD �_r0 r0 r1 �report_machine_activity� s
�z(UAContractClient.report_machine_activity)� magic_tokenr3 c
C s� | � � }|�dd�|�i� z| jt|d�\}}W n� tjk
r� } z8t|d�rv|jdkrdt� � �n|jdkrvt�
� �|�W 5 d}~X Y n: tj k
r� } zt �
t|�� t�� �W 5 d}~X Y nX |S )z�Request magic attach token info.
When the magic token is registered, it will contain new fields
that will allow us to know that the attach process can proceed
r r r8 �code� � N)r r r r" �API_V1_MAGIC_ATTACHr r@ �hasattrrY �MagicAttachTokenError�MagicAttachUnavailable�UrlErrorrB � exception�str�ConnectivityError)r+ rX r rD rV rE r0 r0 r1 �get_magic_attach_token_info� s$ �
z,UAContractClient.get_magic_attach_token_infoc
C s� | � � }z| jt|dd�\}}W nr tjk
rZ } z|jdkrFt�� �|�W 5 d}~X Y n: tjk
r� } zt� t
|�� t� � �W 5 d}~X Y nX |S )z)Create a magic attach token for the user.�POST�r �methodr[ N) r r" r\ r r@ rY r_ r` rB ra rb rc )r+ r rD rV rE r0 r0 r1 �new_magic_attach_token� s �
z'UAContractClient.new_magic_attach_token)rX c
C s� | � � }|�dd�|�i� z| jt|dd� W n� tjk
r� } zLt|d�r�|jdkrbt� � �n&|jdkrvt�
� �n|jdkr�t� � �|�W 5 d }~X Y n: tj k
r� } zt
�t|�� t�� �W 5 d }~X Y nX d S )
z)Revoke a magic attach token for the user.r r ZDELETErf rY i� rZ r[ N)r r r r" r\ r r@ r] rY Z MagicAttachTokenAlreadyActivatedr^ r_ r` rB ra rb rc )r+ rX r rE r0 r0 r1 �revoke_magic_attach_token� s( �
z*UAContractClient.revoke_magic_attach_tokenc C sv |s| � |��dd�}| �� }|�dd�|�i� tj||d�}| j|d|| �� dd�\}}|�d �rr|d |d < |S )
a| Get the updated machine token from the contract server.
@param machine_token: The machine token needed to talk to
this contract service endpoint.
@param contract_id: Unique contract id provided by contract service
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
r Nr r rR ZGETr )rg r r4 �timeoutrJ )r! r) r r r �*API_V1_TMPL_CONTEXT_MACHINE_TOKEN_RESOURCEr" r6 )r+ r. rN r- r rL rD r0 r0 r1 �get_updated_contract_info s*
���
z*UAContractClient.get_updated_contract_infoc C s� | � � }|�dd�|�i� | �|�}| �� |d< tj||d d�}| j||d|d�\}}|�d�rp|d |d< |�d i ��d|�d��}|S )
a� Request machine token refresh from contract server.
@param machine_token: The machine token needed to talk to
this contract service endpoint.
@param contract_id: Unique contract id provided by contract service.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@return: Dict of the JSON response containing refreshed machine-token
r r rS r rR re )r rg r rJ r )r r r r! rT rk r" r) )r+ r. rN r- r r rL rD r0 r0 r1 rO ) s*
� �
�z.UAContractClient._request_machine_token_update)rD c C sN | j j�|� tj�� | �d �}|�di ��d|�d��}| j �d|� d S )Nr r r ) r$ r% r& r r' r( r! r) r* )r+ rD r r- r0 r0 r1 �'update_files_after_machine_token_updateJ s
�z8UAContractClient.update_files_after_machine_token_updatec C s6 |st �| j�}t �� }|�� }|�d�}|||d�S )z<Return a dict of platform-related data for contract requests�arch)r � architecture�os)r r' r$ �get_platform_info�copy�pop)r+ r- �platformZ platform_osrn r0 r0 r1 r! U s
�z#UAContractClient._get_platform_datac C s& t �� }|d |d |d |d d�S )z?Return a dict of platform basic info for some contract requestsrn r �kernel�virt)ro r ru rv )r rq )r+ rt r0 r0 r1 r6 b s �z)UAContractClient._get_platform_basic_info)r- c sN ddl m} |s t�� j�}� jjjp(|}� fdd�|D �}|� jjj|d�S )z9Return a dict of activity info data for contract requestsr )�ENTITLEMENT_CLASSESc s0 g | ](}|� j ��� d tjkr|� j �j�qS )r )r$ Zuser_facing_statusr ZACTIVE�name)�.0Zent�r+ r0 r1 �
<listcomp>w s �z7UAContractClient._get_activity_info.<locals>.<listcomp>)Z
activityIDZ
activityToken� resources)�uaclient.entitlementsrw r r' r$ r% � activity_idZactivity_token)r+ r- rw r~ Zenabled_servicesr0 rz r1 rT l s
��z#UAContractClient._get_activity_info)N)N)N)N)N)N)!�__name__�
__module__� __qualname__Zcfg_url_base_attrr r@ Z
api_error_clsr
Zretry�socketrj r2 r rb r r7 r: r ZAutoAttachCloudInstancerG r rM rP rW rd rh ri rl rO rm r! r6 rT r0 r0 r0 r1 r % s`
�
� �
� # ��
# �
� ' �� "
�
r T)r$ �past_entitlements�new_entitlements� allow_enabler r3 c
C sP ddl m} d}d}|| �D ]�}z || } W n tk
rD Y q Y nX z"t| |�|i �| ||d�\}
} W n� tjk
r� d}t�|� t �
� � t � dj
|| d�� W 5 Q R X Y q tk
r� d}t�|� t �
� � t �dj
|| d�� W 5 Q R X Y q X | r |
r t�|� q |�r0tjtjjtjjd ��n |�rLtjtjjtjjd ��d
S ) a� Iterate over all entitlements in new_entitlement and apply any delta
found according to past_entitlements.
:param cfg: UAConfig instance
:param past_entitlements: dict containing the last valid information
regarding service entitlements.
:param new_entitlements: dict containing the current information regarding
service entitlements.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:param series_overrides: Boolean set True if series overrides should be
applied to the new_access dict.
r )�entitlements_enable_orderF)r$ � orig_access�
new_accessr� r Tz4Failed to process contract delta for {name}: {delta})rx Zdeltaz>Unexpected error processing contract delta for {name}: {delta}�rF �msg_codeN)r} r� �KeyError�process_entitlement_deltar) r �UserFacingError�eventZservice_failedr
�disable_log_to_consolerB �errorr � Exceptionra Zservice_processedr
ZUNEXPECTED_ERRORrF rx Z ATTACH_FAILURE_DEFAULT_SERVICES) r$ r� r� r� r r� Z delta_errorZunexpected_errorrx �new_entitlement�deltasZservice_enabledr0 r0 r1 �process_entitlements_delta� s`
�
��
�� ��r� F)r$ r� r� r� r r3 c
C s� ddl m} |rt|� t�||�}d}|r�|�di ��d�}|sT|�di ��d�}|sztjj||d�} t j
| j | j d��z|| |d�}
W n4 t j
k
r� } zt�d |� | �W 5 d
} ~ X Y nX |
| |d �} | j|||d �}||fS )
a- Process a entitlement access dictionary deltas if they exist.
:param cfg: UAConfig instance
:param orig_access: Dict with original entitlement access details before
contract refresh deltas
:param new_access: Dict with updated entitlement access details after
contract refresh
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:param series_overrides: Boolean set True if series overrides should be
applied to the new_access dict.
:raise UserFacingError: on failure to process deltas.
:return: A tuple containing a dict of processed deltas and a
boolean indicating if the service was fully processed
r )�entitlement_factoryF� entitlement�type)Zorig�newr� )r$ rx z3Skipping entitlement deltas for "%s". No such classN)r$ Z
assume_yes)r� )r} r� �apply_contract_overridesr
�get_dict_deltasr) r
Z$INVALID_CONTRACT_DELTAS_SERVICE_TYPEr r r� rF rx ZEntitlementNotFoundErrorrB rC Zprocess_contract_deltas)
r$ r� r� r� r r� r� Zretrx rF Zent_cls�excr� r0 r0 r1 r� � s< � � �r� )rE r3 c C s� t j}t| d�r�d| jkr�| jd }|d }|d }d }|dkrz|d �t�}|d �d�|d�}t jj||d �}||_nX|d
kr�|d �t�}|d �d�|d �}t j j||d �}||_n|d kr�t j
j|d
�}|r�t j j|j d�}|j
|_
|j|_|S )NrA �infoZ
contractId�reasonzno-longer-effective�timez%m-%d-%Y)Zcontract_expiry_daterN )rN �dateznot-effective-yet)Zcontract_effective_daterN znever-effective)rN )r� )r
ZATTACH_EXPIRED_TOKENr] rA �strftimer ZATTACH_FORBIDDEN_EXPIREDr �additional_infoZATTACH_FORBIDDEN_NOT_YETZATTACH_FORBIDDEN_NEVERZATTACH_FORBIDDENrF rx )rE rF r� rN r� Z
reason_msgr� r� r0 r0 r1 � _create_attach_forbidden_message sF
� � � ��r� �r, c C s8 | j }| jj}|r.|r.tj}tj|j|jd��t | �}|r�z|j
|d� W n� tj k
r� } z�t |tj
�r�t|d�r�|jdkr�t�� �n(|jdkr�t|�}tj|j|j|jd��|�t�� � t�t|�� W 5 Q R X t�� �W 5 d}~X Y nX n0|d }|d d
d } |j|| d �}
|�|
� t| || jj|� dS )
af Request contract refresh from ua-contracts service.
Compare original token to new token and react to entitlement deltas.
:param cfg: Instance of UAConfig for this machine.
:param contract_token: String contraining an optional contract token.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:raise UserFacingError: on failure to update contract or error processing
contract deltas
:raise UrlError: On failure to contact the server
r� r� rY rZ i� )rF r� r� NrQ r � contractInfo�id)r. rN ) r. r% � entitlementsr
Z-UNEXPECTED_CONTRACT_TOKEN_ON_ATTACHED_MACHINEr r� rF rx r r2 r` �
isinstancer@ r] rY ZAttachInvalidTokenErrorr� r� r
r� rB ra rb rc rP rm r� ) r$ r, r� �
orig_token�orig_entitlementsrF �contract_clientrE r. rN �respr0 r0 r1 �request_updated_contract1 sP �
�
�
�r� )r$ r3 c C s t | �}|�� }|�dg �S )zDQuery available resources from the contract server for this machine.r| )r r7 r) )r$ �clientr| r0 r0 r1 �get_available_resourcesm s r� )r$ �tokenr3 c C s t | �}|�|�S )z/Query contract information for a specific token)r r: )r$ r� r� r0 r0 r1 �get_contract_informationt s r� c
C s� | j }| jj}|�dd�}|�di ��di ��dd �}|s>dS t| �}|�||�}|�di ��di ��dd �}|rv|n| jj}| jj|kr�dS | j�|�} t| � � �D ]&\}
} t
� |�|
i �| �} | r� dS q�dS ) NrQ r> r r� r� FZ effectiveToT) r. r% r� r) r rl Zcontract_expiry_datetimeZget_entitlements_from_token�sorted�itemsr
r� )
r$ r� r� r. rN r� r� Z resp_expiryZ
new_expiryZcurr_entitlementsrx r� r� r0 r0 r1 �is_contract_changedz sV � �� � � ���� �
�r� )�override_selector�selector_valuesr3 c C s< d}| � � D ]*\}}||f|� � kr* dS |t| 7 }q |S )Nr )r� �OVERRIDE_SELECTOR_WEIGHTS)r� r� Zoverride_weight�selector�valuer0 r0 r1 �_get_override_weight� s r� )r� � series_namer< r3 c C sh i }||d�}| � di �� |i �}|r2||td < | � dg �}|D ] }t|� d�|�}|rB|||< qB|S )N)r r r r � overridesr� )rs r� r� ) r� r� r< r� r� r Zgeneral_overrides�overrideZweightr0 r0 r1 �_select_overrides� s"
�� �
r� )r� r r3 c
C s� ddl m} tt| t�d| kg�s0td�| ���|dkrDt�� d n|}|� \}}| � di �}t
|||�}t |� � �D ]J\}} | � � D ]8\}
} | d � |
�} t| t�r�| �
| � q�| | d |
< q�qvdS )a� Apply series-specific overrides to an entitlement dict.
This function mutates orig_access dict by applying any series-overrides to
the top-level keys under 'entitlement'. The series-overrides are sparse
and intended to supplement existing top-level dict values. So, sub-keys
under the top-level directives, obligations and affordance sub-key values
will be preserved if unspecified in series-overrides.
To more clearly indicate that orig_access in memory has already had
the overrides applied, the 'series' key is also removed from the
orig_access dict.
:param orig_access: Dict with original entitlement access details
r )�get_cloud_typer� z?Expected entitlement access dict. Missing "entitlement" key: {}Nr )Zuaclient.clouds.identityr� �allr� �dict� RuntimeErrorr r rq r) r� r� r� r )
r� r r� r� r< rV Zorig_entitlementr� Z_weightZoverrides_to_apply�keyr� Zcurrentr0 r0 r1 r� � s$ ���
r� )T)FT)NF)N)2rB r� �typingr r r r r Zuaclientr r r r
r r r
Zuaclient.configr Zuaclient.defaultsr Z(uaclient.entitlements.entitlement_statusr r# rk r5 rK r? rU r9 r\ r� Zget_event_loggerr� ZUAServiceClientr rb �boolr� r� r@ Z NamedMessager� r� r� r� r� �intr� r� r� r0 r0 r0 r1 �<module> s� $ �� f �
� O �
� 8� , �� <)
�
� �
�