o `j6@s dZddlmZddlZddlmZddlmZddlm Z ddlm Z ddl m Z mZmZer6ddlmZeeZGd d d ZGd d d eZGd ddeZGdddeZGdddeZGdddZGdddeZGdddZGdddeZddZdS)zACL management mixin for KafkaAdminClient. Also defines ACL data types: ResourceType, ACLOperation, ACLPermissionType, ACLResourcePatternType, ACLFilter, ACL, ResourcePatternFilter, ResourcePattern. ) annotationsN)IntEnum) TYPE_CHECKING)IllegalArgumentError)CreateAclsRequestDeleteAclsRequestDescribeAclsRequest)KafkaConnectionManagerc@s~eZdZUdZded<ded<ddZdd Zed d Zed d Z eddZ ddZ eddZ eddZ ddZdS) ACLAdminMixinzsz7ACLAdminMixin._process_acl_operations..)getlistmapvalid_acl_operations)selfobjrrr_process_acl_operationssz%ACLAdminMixin._process_acl_operationsc Cs^|jjtjkr dnd}t||jj|jj|jj|j|j|j |j d}|j |j j |}||S)aDescribe a set of ACLs Used to return a set of ACLs matching the supplied ACLFilter. The cluster must be configured with an authorizer for this to work, or you will get a SecurityDisabledError Arguments: acl_filter: an ACLFilter object Returns: tuple of a list of matching ACL objects and a KafkaError (NoError if successful) r) min_versionresource_type_filterresource_name_filterpattern_type_filterprincipal_filter host_filter operationpermission_type)resource_pattern resource_type ResourceTypeUSERr resource_name pattern_type principalhostr#r$r runsend'_convert_describe_acls_response_to_acls)r acl_filterrrequestresponserrr describe_acls"s  zACLAdminMixin.describe_aclscCst|j}|tjur||jg}|jD](}|jD]"}|t|j |j t |j t |jtt|j|jt|jddqq|tjfS)aRConvert a DescribeAclsResponse into a list of ACL objects and a KafkaError. Arguments: describe_response: The response object from the DescribeAclsRequest. Returns: A tuple of (list_of_acl_objects, error) where error is an instance of KafkaError (NoError if successful). r&r)r*r+r,r#r$r%)Errorsfor_code error_codeNoError error_message resourcesaclsappendACLr+r, ACLOperationr#ACLPermissionTyper$ResourcePatternr'r&r)ACLResourcePatternTyper*)describe_response error_typeacl_listresourcerrrrr/=s*     z5ACLAdminMixin._convert_describe_acls_response_to_aclsc C0tj}||jj|jj|jj|j|j|j|j dS)z8Convert an ACL object into the CreateAclsRequest format.)r&r)resource_pattern_typer+r,r#r$) r AclCreationr%r&r)r*r+r,r#r$)r _AclCreaterrr%_convert_create_acls_resource_requestZz3ACLAdminMixin._convert_create_acls_resource_requestcCsZggd}t|jD] \}}||}|jdkr|d|q |dt|jq |S)zGParse a CreateAclsResponse, returning a dict of successes and failures.) succeededfailedrrMrN) enumerateresultsr8r=r6r7)r<create_responserPiresultrrrr%_convert_create_acls_response_to_aclshs  z3ACLAdminMixin._convert_create_acls_response_to_aclscr|D] }t|ts tdqfdd|D}tdd|Dr"dnd}t||d}jjj|}||S) a.Create a list of ACLs This endpoint only accepts a list of concrete ACL objects, no ACLFilters. Throws TopicAlreadyExistsError if topic is already present. Arguments: acls: a list of ACL objects Returns: dict of successes and failures zacls must contain ACL objectscg|]}|qSr)rK.0rrrr z-ACLAdminMixin.create_acls..cs|] }|jtjkVqdSr)r&r'r()rXcreationrrr z,ACLAdminMixin.create_acls..rr) creationsr) isinstancer>ranyrr r-r.rT)rr<rr`rr1r2rrYr create_aclst   zACLAdminMixin.create_aclsc CrG)z>Convert an ACLFilter object into the DeleteAclsRequest format.)rrr r!r"r#r$) rDeleteAclsFilterr%r&r)r*r+r,r#r$)r _AclsFilterrrr%_convert_delete_acls_resource_requestrLz3ACLAdminMixin._convert_delete_acls_resource_requestc Csg}t|jD]D\}}||}t|j}g}|jD](}t|j} |t|j|j t |j t |j tt|j|jt|jddq||||fq|S)zUParse a DeleteAclsResponse, returning a list of (filter, matched ACLs, error) tuples.r4r5)rOfilter_resultsr6r7r8 matching_aclsr=r>r+r,r?r#r@r$rAr'r&r)rBr*) acl_filtersdelete_responserPrRrSr0rDrirerrorrrr._convert_delete_acls_response_to_matching_aclss,    z.csr\r)rr'r()rX_filterrrrr^r_z,ACLAdminMixin.delete_acls..rr)filtersr) ra ACLFilterrrbrr r-r.rm)rrjrrorr1r2rrYr delete_aclsrdzACLAdminMixin.delete_aclsN)__name__ __module__ __qualname____doc____annotations__rr3 staticmethodr/rKrTrcrgrmrqrrrrr s$        r c@s0eZdZdZdZdZdZdZdZdZ dZ d Z d S) r'zaType of kafka resource to set ACL for. The ANY value is only valid in a filter context. rrN) rrrsrtruUNKNOWNANYTOPICGROUPCLUSTERTRANSACTIONAL_IDDELEGATION_TOKENr(rrrrr'sr'c@sLeZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdS)r?zMType of operation. The ANY value is only valid in a filter context. rrxryrrzr{r|r} N)rrrsrtrur~rALLREADWRITECREATEDELETEALTERDESCRIBECLUSTER_ACTIONDESCRIBE_CONFIGS ALTER_CONFIGSIDEMPOTENT_WRITE CREATE_TOKENSDESCRIBE_TOKENSrrrrr?s"r?c@s eZdZdZdZdZdZdZdS)r@z]An enumerated type of permissions. The ANY value is only valid in a filter context. rrxryrN)rrrsrtrur~rDENYALLOWrrrrr@s r@c@s$eZdZdZdZdZdZdZdZdS)rBzAn enumerated type of resource patterns. More details on the pattern types and how they work can be found in KIP-290 (Support for prefixed ACLs). rrxryrrzN) rrrsrtrur~rMATCHLITERALPREFIXEDrrrrrBsrBc@s4eZdZddZddZddZddZd d Zd S) ResourcePatternFiltercCs||_||_||_|dSr)r&r)r*validaterr&r)r*rrr__init__ s zResourcePatternFilter.__init__cCs,t|jts tdt|jtstddS)Nz+resource_type must be a ResourceType objectz5pattern_type must be an ACLResourcePatternType object)rar&r'rr*rBrYrrrrs  zResourcePatternFilter.validatecCsd|jj|j|jjS)Nz.)formatr&rr)r*rYrrr__repr__szResourcePatternFilter.__repr__cCs&t|j|jk|j|jk|j|jkfSr)allr&r)r*rotherrrr__eq__s    zResourcePatternFilter.__eq__cCst|j|j|jfSr)hashr&r)r*rYrrr__hash__ szResourcePatternFilter.__hash__N)rrrsrtrrrrrrrrrrs  rcs.eZdZdZejffdd ZddZZS)rAz'A resource pattern to apply the ACL to.cst||||dSrsuperrrr __class__rrr&s zResourcePattern.__init__cCs<|jtjkr td|jtjtjfvrtd|jjdS)Nzresource_type cannot be ANYz7pattern_type cannot be {} on a concrete ResourcePattern) r&r'rrr*rBrrrrYrrrr*s  zResourcePattern.validate) rrrsrtrurBrrr __classcell__rrrrrA$srAc@s8eZdZdZddZddZddZdd Zd d Zd S) rpz=Represents a filter to use with describing and deleting ACLs.cCs*||_||_||_||_||_|dSr)r+r,r#r$r%rrr+r,r#r$r%rrrr4s  zACLFilter.__init__cCs@t|jts tdt|jtstdt|jtstddS)Nz;operation must be an ACLOperation object, and cannot be ANYzFpermission_type must be an ACLPermissionType object, and cannot be ANYz7resource_pattern must be a ResourcePatternFilter object)rar#r?rr$r@r%rrYrrrr<   zACLFilter.validatecCs"dj|j|j|jj|jj|jdS)Nza)r+r,r#typerF)rr+r,r#rr$r%rYrrrrDs zACLFilter.__repr__cCs:t|j|jk|j|jk|j|jk|j|jk|j|jkfSr)rr+r,r#r$r%rrrrrIs  zACLFilter.__eq__cCst|j|j|j|j|jfSr)rr+r,r#r$r%rYrrrrOszACLFilter.__hash__N) rrrsrtrurrrrrrrrrrp2s rpcs(eZdZdZfddZddZZS)r>z9Represents a concrete ACL for a specific ResourcePattern.cs t||||||dSrrrrrrrUs z ACL.__init__cCs@|jtjkr td|jtjkrtdt|jtstddS)Nzoperation cannot be ANYzpermission_type cannot be ANYz1resource_pattern must be a ResourcePattern object) r#r?rrr$r@rar%rArYrrrrYrz ACL.validate)rrrsrtrurrrrrrrr>Ss r>cCstdd|DS)NcSsg|] }|dvrt|qS))rrxry)r?)rXvrrrrZcsz(valid_acl_operations..)set)int_valsrrrrbsr)ru __future__rloggingenumrtypingr kafka.errorserrorsr6rkafka.protocol.adminrrrkafka.net.managerr getLoggerrrlogr r'r?r@rBrrArpr>rrrrrs,       5  !