File: //usr/lib/google-cloud-sdk/lib/surface/auth/__pycache__/revoke.cpython-312.pyc
�
��f � �� � d Z ddlmZ ddlmZ ddlmZ ddlZddlmZ ddlmZ ddl
m Z dd l m
Z
dd
l mZ dd l mZ dd lmZ ddlmZ dd
lmZ ddlmZ G d� dej0 � Zd� Zy)z.Revoke credentials being used by the CloudSDK.� )�absolute_import)�division)�unicode_literalsN)�base)�
exceptions)� auth_util)�config)�log)�
properties)�creds)�store)�resource_printerc �, � e Zd ZdZed� � Zd� Zd� Zy)�Revokea� Revoke access credentials for an account.
Revokes credentials for the specified user accounts, service accounts or
external accounts (workload identity pools).
When given a user account, this command revokes the user account token on the
server. If the revocation is successful, or if the token has already been
revoked, this command removes the credential from the local machine.
When given a service account, this command does not revoke the service account
token on the server because service account tokens are not revocable. Instead,
it will print a warning and remove the credential from the local machine. When
used with a service account, this command has only a local effect and the key
associated with the service account is not deleted. This can be done by
executing `gcloud iam service-accounts keys delete` after `revoke`.
When given an external account (workload identity pool), whether impersonated
or not, the command does not revoke the corresponding token on the server
because these tokens are not revocable. The underlying external credentials
(OIDC, AWS, etc.) used to generate these access tokens have to be revoked too,
but gcloud has no control over that. Instead, it will print a warning and
remove the credential from the local machine.
If no account is specified, this command revokes credentials for the currently
active account, effectively logging out of that account. If --all is given,
the behaviors described above apply individually to each account in the list.
You can revoke credentials when you want to prevent gcloud and other Google
Cloud CLI tools from using the specified account. You do not need to revoke
credentials to switch between accounts.
c � � | j ddd�� | j ddd�� | j j d � y )
N�accounts�*z-Accounts whose credentials are to be revoked.)�nargs�helpz--all�
store_truez$Revoke credentials for all accounts.)�actionr z"list[title="Revoked credentials:"])� add_argument� display_info� AddFormat)�parsers �lib/surface/auth/revoke.py�Argsz Revoke.ArgsE sM � �
���
�#� L� � N�
���� � C� � E�
���!�!�"F�G� c � � |j xs g }t |t � r|g}t j � }t |� t |� z
}|r%t
j ddj |� � �|j r|}t j j j j � }|s|r|g}|st
j dd� �d}|D �]V }||k( r8t j t j j j d� t j" |dd�� }t j( |� s�|j+ d� r%t- j. d j1 |� � ��t3 j4 |� r%t- j. d
j1 |� � ��t3 j6 |� st3 j8 |� r&t- j. d j1 |� � ��/t- j. d j1 |� � ��Ud}��Y t; |� |S # t$ j& $ r d}Y ��%w xY w)
z-Revoke credentials and update active account.r � z#No credentials available to revoke.FNT)�prevent_refresh�use_google_authz.gserviceaccount.comac [{}] appears to be a service account. Service account tokens cannot be revoked, but they will expire automatically. To prevent use of the service account token earlier than the expiration, delete or disable the parent service account. To explicitly delete the key associated with the service account use `gcloud iam service-accounts keys delete` instead`.zv[{}] appears to be an external account. External account tokens cannot be revoked, but they will expire automatically.z�[{}] appears to be an external account user. External account user tokens cannot be revoked, but they will expire automatically.z+[{}] already inactive (previously revoked?)) r �
isinstance�str�c_store�AvailableAccounts�set�c_exc�UnknownArgumentException�join�allr �VALUES�core�account�Get�InvalidArgumentException�PersistProperty�Load�creds_exceptions�Errorr �endswithr
�warning�format�c_creds� IsExternalAccountCredentials� IsExternalAccountUserCredentials�*IsExternalAccountAuthorizedUserCredentials�_WarnIfRevokeAndADCExists) �self�argsr �available_accounts�unknown_accounts�active_account�
creds_revokedr. r s r �Runz
Revoke.RunM s � ��}�}�"��H��(�C� ���h� �2�2�4���8�}�s�+=�'>�>��� � *� *�
�c�h�h� /�0�
2� 2� �x�x�#�h� �&�&�+�+�3�3�7�7�9�N� �� �!�h� � � *� *�
�;�
=� =� �M��� �7� "��"�"�:�#4�#4�#9�#9�#A�#A�4�H��� � � �T�4�A�� �^�^�G�
$� � � � 2� 3�
�+�+�H�
IO���I�
� �
1�
1�%�
8�
�+�+�N��v�g�� � �
5�
5� �� �H�H��O�
�+�+� � %�v�g�� 0�
�+�+�;�B�B�7�K� M� �
�U �X �m�,� �O��C �
#�
#� � ���s �I � I�Ic � � t j � }t j t j t
j �� }|j |� y )N)�out)r% � AllAccountsr �Printer�ACCOUNT_TABLE_FORMATr
�status�Print)r= � unused_results_were_displayedr �printers r �Epilogz
Revoke.Epilog� s= � ��"�"�$�H� �&�&��$�$�#�*�*��G� �M�M�(�r N)�__name__�
__module__� __qualname__�__doc__� staticmethodr rC rM � r r r r $ s* � � �@ �H� �H�F�P r r c �� � | r]t j j t j � � r+t j � rt j d� y y y y )NaH You also have Application Default Credentials (ADC) set up. If you want to revoke your Application Default Credentials as well, use the `gcloud auth application-default revoke` command.
For information about ADC credentials and gcloud CLI credentials, see https://cloud.google.com/docs/authentication/external/credential-types
) �os�path�isfiler � ADCFilePathr �ADCIsUserAccountr
r6 )rB s r r< r< � sF � �������v�'9�'9�';�<�� � �"��K�K� � � #� =�mr )rQ �
__future__r r r rU �googlecloudsdk.callioper r r( � googlecloudsdk.command_lib.authr �googlecloudsdk.corer r
r � googlecloudsdk.core.credentialsr r8 r3 r
r% � googlecloudsdk.core.resourcer �Commandr r< rS r r �<module>ra sL �� 5� &� � '� � (� 7� 5� &� #� *� <� J� <� 9�v �T�\�\� v �r r