gWddlZddlZddlZddlmZddlmZmZmZm Z m Z ddl m cm ZddlmZmZmZmZmZmZmZmZmZddlmZddlmZddlmZddlm Z dd l!m"Z"m#Z#dd l$m%Z%dd l&m'Z'd Z(d Z)d Z*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3dddddZ4ejjZ6ejnejpe9Z:edddgZ;GddejxZ=Gdd e%j|Z?d!e@fd"ZA d>d#ed$eeBefd%eeBefd&eCd'eCd(df d)ZD d?d#ed*eeBefd+eeBefd&eCd'eCd(e eeCff d,ZEd-ejd(ejfd.ZHd#efd/ZId#ed(eefd0ZJd#ed1eBd(eeBeffd2ZKd3eeBeBfd4eeBeBfd(eLfd5ZM d@d6eeBefd7eBd8eBde eBd(eeLeeBefff d9ZN dAd*eeBefd:e eBde eBd(dfd;ZOd#ed$ 0$8!#6 *"4 0!2 . /+()NNNNNNNNNNNNNN) __name__ __module__ __qualname__r FieldStringDataValuefieldsrstrr:r;r9r%r%Fs  :55    &  & &   *"<"$>    !:#=#=    Z77%    *"<"r;)rrr) retry_sleepsc<|stj|j}|j}|j ddj |i|j }|j|d<||d}t|}|jt||}|jdk(rtj|jdk(r t||jdk7r0tjt|j|j |j"} t$j&j)| j+d d | j+d gD]1} t$j&j)| j+d d 3| S)a}Requests machine attach to the provided machine_id. @param contract_token: Token string providing authentication to ContractBearer service endpoint. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing the machine-token. Authorization Bearer {}lastAttachment machineId activityInfo)dataheadersiurlcodebody machineTokenresourceTokenstoken)rget_machine_idrGrYupdateformat_get_activity_info isoformat_support_old_machine_info request_urlAPI_V1_ADD_CONTRACT_MACHINEr^r AttachInvalidTokenError_raise_attach_forbidden_messageContractAPIErrorr_ json_dictrsecrets add_secretget) r8contract_token attachment_dt machine_idrY activity_inforXbackcompat_dataresponse response_jsonrcs r9add_contract_machinez%UAContractClient.add_contract_machinesl..txx8J,,.););N)KLM//1 *7*A*A*C &''G3D9## 'ow$  ==C 446 6 ]]c ! +H 5 ==C --/]]]]  !** ))   nb 1 #&&'7< FE  " " - -eii.D E Fr;c|j}|jt|d|d|d|dd}|jdk7r0t j t|j|j |jS) z=Requests list of entitlements available to this machine type. architecturerkernelvirtr|rr}r~) query_paramsr[r\)rgrjAPI_V1_AVAILABLE_RESOURCESr^r rnr_ro)r8rvrxs r9available_resourcesz$UAContractClient.available_resourcess//1 ## & -n ='1'1%f- $  ==C --.]]]]  !!!r;rsc*|j}|jddj|i|jt|}|j dk7r0t jt|j |j|jS)NrRrSrYr[r\) rYrerfrjAPI_V1_GET_CONTRACT_USING_TOKENr^r rnr_ro)r8rsrYrxs r9get_contract_using_tokenz)UAContractClient.get_contract_using_tokens,,.););N)KLM## +W$  ==C --3]]]]  !!!r; cloud_typerXc|jtj||}|jdk7ry|jj dd}|r+t j|tj|tjt|j|j|j}tjj|j dd|S) zRequests contract token for auto-attach images for Pro clouds. @param instance: AutoAttachCloudInstance for the cloud. @return: Dict of the JSON response containing the contract-token. )r)rXr[messagera) error_msgr\ contractToken)rj,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCErfr^rorrLOGdebugr InvalidProImagernr_rrprq)r8rrXrxmsgrys r9%get_contract_token_for_cloud_instancez6UAContractClient.get_contract_token_for_cloud_instances## 8 ? ?% @  $  ==C $$((B7C # 003??--@]]]]  !** ))   or 2 r; machine_tokenresourceruc|stj|j}|j}|j ddj |it j ||}|j||}|jdk7r0tjt |j|j|jjdr|jd|jd<|j}|jdgD]1}tjj!|jd d 3|S) aRequests machine access context for a given resource @param machine_token: The authentication token needed to talk to this contract service endpoint. @param resource: Entitlement name. @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. @return: Dict of the JSON response containing entitlement accessInfo. rRrS)rmachinerr[r\expiresrbrcra)rrdrGrYrerf"API_V1_GET_RESOURCE_MACHINE_ACCESSrjr^r rnr_rrrorrprq) r8rrrurYr]rxryrcs r9get_resource_machine_accessz,UAContractClient.get_resource_machine_accesss# ..txx8J,,.););M)JKL077z8 ##C#9 ==C --6]]]]       *,4,<,,>M. )  # # ) )- 8 r; magic_tokenc.|j}|jddj|i|jt|}|j dk(rt j|j dk(rt j|j dk7r0t jt|j |j|j}gd}|D]1}tjj|j|d 3|S) zRequest magic attach token info. When the magic token is registered, it will contain new fields that will allow us to know that the attach process can proceed rRrSrrZr[r\rcuserCoderra)rYrerfrj"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOr^r MagicAttachTokenErrorMagicAttachUnavailablernr_rorrprqrr)r8rrYrxry secret_fieldsfields r9get_magic_attach_token_infoz,UAContractClient.get_magic_attach_token_infocs ,,.););K)HIJ## .$  ==C 224 4 ==C 335 5 ==C --6]]]]  !** > " LE  " " - -m.?.?r.J K Lr;c|j}|jt|d}|jdk(rt j |jdk7r0t j t|j|j|j}gd}|D]1}tjj|j|d3|S)z)Create a magic attach token for the user.POSTrYmethodrr[r\rra) rYrjAPI_V1_NEW_MAGIC_ATTACHr^r rrnr_rorrprqrr)r8rYrxryrrs r9new_magic_attach_tokenz'UAContractClient.new_magic_attach_tokens,,.## #$  ==C 335 5 ==C --+]]]]  !** > " LE  " " - -m.?.?r.J K Lr;c|j}|jddj|i|jt|d}|j dk(rt j|j dk(rt j|j dk(rt j|j dk7r0t jt|j |j y ) z)Revoke a magic attach token for the user.rRrSDELETErrZrr[r\N) rYrerfrjAPI_V1_REVOKE_MAGIC_ATTACHr^r MagicAttachTokenAlreadyActivatedrrrnr_)r8rrYrxs r9revoke_magic_attach_tokenz*UAContractClient.revoke_magic_attach_tokens,,.););K)HIJ## &$  ==C ==? ? ==C 224 4 ==C 335 5 ==C --.]]]]  r;rc >|stj|j}|j}|j ddj |it j ||}|j}|j|d||d|d|d|dd  }|jd k7r,tj||j|j |jjd r|jd |jd <|jS)a|Get the updated machine token from the contract server. @param machine_token: The machine token needed to talk to this contract service endpoint. @param contract_id: Unique contract id provided by contract service @param machine_id: Optional unique system machine id. When absent, contents of /etc/machine-id will be used. rRrSrGETr|rr}r~r)rrYrr[r\r)rrdrGrYrerfAPI_V1_GET_CONTRACT_MACHINErgrjr^r rnr_rrro)r8rrrurYr]rvrxs r9get_contract_machinez%UAContractClient.get_contract_machines..txx8J,,.););M)JKL)00 1 //1 ##  -n ='1'1%f-  $   ==C --hmm(--       *,4,<,)*J r6)r<r=r>cfg_url_base_attrrrr:rretrysockettimeoutrzrrBrrrrrrrrrrrrrg __classcell__)rOs@r9rErEs&#'? h ? ?TZZY78<(8(T"T#s(^"( "s "tCH~ "TZZY7 (,S#X8H%) $$$SM $ c3h $L&9PstCH~8S#X.S6%) )")")"SM )" c3h )"^%) &"&"&"SM &"  &"P!"!"!" !"  !"F7 r;rE request_bodyc |jdi}|jd||jd|jd|jd|jddtjjdd S) a? Transforms a request_body that has the new activity_info into a body that includes both old and new forms of machineInfo/activityInfo This is necessary because there may be old ua-airgapped contract servers deployed that we need to support. This function is used for attach and refresh calls. rWrVr|rr}rLinux)rr}rtyperelease)rVrWr|os)rrrrr)rrvs r9riri]s!$$^R8M"%%k2%%)).9)--n=#''1#''1..088  r;rGpast_entitlementsnew_entitlements allow_enablerrHc ddlm}d}g}g}||D]I} || } g} t||j | i| ||\} } | s2| s5t j | Kt j|t|dkDretj t#||D cgc]9\} }| t$j&j)t+|t- f;c}} |r4tj.|D cgc]} | t$j0fc} y#t$rYwxYw#tj$rJ} tj| d}|j| tjd| | Yd} ~ sd} ~ wt$rY} tj| |j| |j| tjd| | Yd} ~ d} ~ wwxYwcc}} wcc} w) aIterate over all entitlements in new_entitlement and apply any delta found according to past_entitlements. :param cfg: UAConfig instance :param past_entitlements: dict containing the last valid information regarding service entitlements. :param new_entitlements: dict containing the current information regarding service entitlements. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. r)entitlements_enable_orderF)rG orig_access new_accessrrTz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %r)rlog_path)failed_services)uaclient.entitlementsrKeyErrorprocess_entitlement_deltarreventservice_processedr UbuntuProErrorr exceptionappenderror Exceptionservices_failedlenAttachFailureUnknownErrorzipr UNEXPECTED_ERRORrfrBrAttachFailureDefaultServices!E_ATTACH_FAILURE_DEFAULT_SERVICES)rGrrrrr delta_errorunexpected_errorsrr#new_entitlementdeltasservice_enableders r9process_entitlements_deltarxs*@KO)#.%. .t4O .&?-11$;*)!1 ' #FO86''-K%.L /* !22(+?G0 >G6 D-,D-0G-?F G-AG((G-rrc(ddlm}|r t|tj||}d}|r|j dij d}|s!|j dij d}|st j|||j dij dij d d } |||| } | j|||}||fS#t j$r} tjd || d } ~ wwxYw)a,Process a entitlement access dictionary deltas if they exist. :param cfg: UAConfig instance :param orig_access: Dict with original entitlement access details before contract refresh deltas :param new_access: Dict with updated entitlement access details after contract refresh :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :param series_overrides: Boolean set True if series overrides should be applied to the new_access dict. :raise UbuntuProError: on failure to process deltas. :return: A tuple containing a dict of processed deltas and a boolean indicating if the service was fully processed rentitlement_factoryF entitlementr)orignew entitlements obligations use_selectorrarGr#r!z3Skipping entitlement deltas for "%s". No such classNr) rrapply_contract_overridesrget_dict_deltasrrr InvalidContractDeltasServiceTypeEntitlementNotFoundErrorrrprocess_contract_deltas) rGrrrrrr retr#r!rexcs r9rrs0: ,  ! !+z :F C }b155f=::mR044V2 . S # S $  -K11 l2  3;22  IIEt I  s> C!!D4D  Drxc|jjd}|r|d}|d}|dk(rB|djt}t j |||djd|dk(rB|djt}t j |||djd |d k(rt j| t j) Ninfo contractIdreasonzno-longer-effectivetimez%m-%d-%Y)rdatecontract_expiry_dateznot-effective-yet)rr&contract_effective_dateznever-effective)r) rorrstrftimerr AttachForbiddenExpiredAttachForbiddenNotYetAttachForbiddenNeverAttachExpiredToken)rxr"rr$r&s r9rmrms    ! !& )D <( h * *<(()@AD33'%)&\%:%::%F   * *<(()@AD22'(,V (=(=j(I   ( (11kJ J  ' ' ))r;ctj|}|j}|j}|d}|ddd}t |}|j ||}|j |tjj|jdijdtj|}tj |t|||jd y ) zRequest contract refresh from ua-contracts service. :raise UbuntuProError: on failure to update contract or error processing contract deltas :raise ConnectivityError: On failure during a connection r`machineTokenInfo contractInfoidrJ)rrrVFrN) rLrMrrrErrrrd cache_clearrrrr) rGrNorig_entitlements orig_tokenrrcontract_clientresprus r9refreshr7.s33C8*779#11J~.M/0@FK&3/O  2 2# 3 DT" %%',b155V**3/J*% '') r;c\t|}|j}|jdgS)zDQuery available resources from the contract server for this machine.r)rErrr)rGclientrs r9get_available_resourcesr:Os+ c "F**,I ==b ))r;rcc:t|}|j|S)z/Query contract information for a specific token)rEr)rGrcr9s r9get_contract_informationr<Vs c "F  * *5 11r;override_selectorselector_valuesc~d}|jD]'\}}||f|jvry|t|z })|S)Nr)itemsOVERRIDE_SELECTOR_WEIGHTS)r=r>override_weightselectorvalues r9_get_override_weightrE\sVO,224?% e O$9$9$; ;4X>>? r;r series_namerc i}||d}|r||d<|jdij|i}|r ||td<tj|j dg}|D]%}t |jd|} | s!||| <'|S)N)rr r!rr overridesrC)poprAcopydeepcopyrrrE) rrFrr!rHr>rgeneral_overridesoverrideweights r9_select_overridesrOhs I!,zBO%, ""x488bI  +,>?@ kook2&FG%)% LL $o   (If  ) r;rcddlm}tt|td|vgst dj ||tjjn|}|\}}|jdi}t||||}t|jD][\} } | jD]C\} } |dj| } t| tr| j| <| |d| <E]y)aApply series-specific overrides to an entitlement dict. This function mutates orig_access dict by applying any series-overrides to the top-level keys under 'entitlement'. The series-overrides are sparse and intended to supplement existing top-level dict values. So, sub-keys under the top-level directives, obligations and affordance sub-key values will be preserved if unspecified in series-overrides. To more clearly indicate that orig_access in memory has already had the overrides applied, the 'series' key is also removed from the orig_access dict. :param orig_access: Dict with original entitlement access details r)get_cloud_typerz?Expected entitlement access dict. Missing "entitlement" key: {}N)uaclient.clouds.identityrQall isinstancedict RuntimeErrorrfrrrrrrOsortedr@re)rrr!rQrFr_orig_entitlementrH_weightoverrides_to_applykeyrDcurrents r9rrs &8  ;-} /KL M &%  -3N!((#$MJ"}b9!+z7I(.ioo.?'@ 8##,224 8JC!-044S9G'4(u%38 M*3/ 8 8r;rcddlm}g}|jD]\}}|jdijdd} ||||}|jdijdi}|jd} |j || sz|j\} } | s|jt|| |S#tj $rYwxYw) Nrrrrrarr resourceToken)r#r!) rrr@rrr r_should_enable_by_default can_enablerr") rGrrenable_by_default_servicesent_name ent_valuer!entrr_rarXs r9get_enabled_by_default_servicesrfs:!#+113)-- r266~rJ %#HgNC mmM26::="M ! o6  ( (m DNN,MJ*11*% '* &%!22   s C  CC)T)FTr6)NN)QrJloggingr collectionsrtypingrrrrruaclient.files.machine_tokenfilesrrLuaclientr r r r r rrrr-uaclient.api.u.pro.status.enabled_services.v1r(uaclient.api.u.pro.status.is_attached.v1ruaclient.configruaclient.defaultsruaclient.files.state_filesrr uaclient.httpr uaclient.logrrkrrrrrrrrrrrrAget_event_loggerr getLoggerreplace_top_level_logger_namer<rr" DataObjectr%UAServiceClientrErUrirBboolrr HTTPResponse NamedMessagermr7r:r<intrErOrrfrCr;r9r}sJ  "33**   LA$5L'7;9:-9#0O,9#1%7",/F    & %%'g:::8DE$vy1 T)*''T)n} }44} @D@" W W CH~W 38nW  W  W  W |! < <c3h<S#X< <  <  4: <~** *:B**d4j*2(2324S>2 CH~ 8!!.8c3h.8 SM.8c].8 .8b& &!%c3h& !&r;