Skip to content

Commit 19b4f37

Browse files
tseavertseaver
committed
Move remaining IAM policy API methods from 'Connection' to '_IAMPolicyAPI'.
1 parent fbc4ee2 commit 19b4f37

File tree

6 files changed

+225
-242
lines changed

6 files changed

+225
-242
lines changed

‎gcloud/pubsub/connection.py‎

Lines changed: 60 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -89,63 +89,6 @@ def build_api_url(self, path, query_params=None,
8989
path, query_params=query_params,
9090
api_base_url=api_base_url, api_version=api_version)
9191

92-
def get_iam_policy(self, target_path):
93-
"""Fetch the IAM policy for the target.
94-
95-
See:
96-
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/getIamPolicy
97-
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/getIamPolicy
98-
99-
:type target_path: string
100-
:param target_path: the path of the target object.
101-
102-
:rtype: dict
103-
:returns: the resource returned by the ``getIamPolicy`` API request.
104-
"""
105-
path = '/%s:getIamPolicy' % (target_path,)
106-
return self.api_request(method='GET', path=path)
107-
108-
def set_iam_policy(self, target_path, policy):
109-
"""Update the IAM policy for the target.
110-
111-
See:
112-
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/setIamPolicy
113-
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/setIamPolicy
114-
115-
:type target_path: string
116-
:param target_path: the path of the target object.
117-
118-
:type policy: dict
119-
:param policy: the new policy resource.
120-
121-
:rtype: dict
122-
:returns: the resource returned by the ``setIamPolicy`` API request.
123-
"""
124-
wrapped = {'policy': policy}
125-
path = '/%s:setIamPolicy' % (target_path,)
126-
return self.api_request(method='POST', path=path, data=wrapped)
127-
128-
def test_iam_permissions(self, target_path, permissions):
129-
"""Update the IAM policy for the target.
130-
131-
See:
132-
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/testIamPermissions
133-
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/testIamPermissions
134-
135-
:type target_path: string
136-
:param target_path: the path of the target object.
137-
138-
:type permissions: list of string
139-
:param permissions: the permissions to check
140-
141-
:rtype: dict
142-
:returns: the resource returned by the ``getIamPolicy`` API request.
143-
"""
144-
wrapped = {'permissions': permissions}
145-
path = '/%s:testIamPermissions' % (target_path,)
146-
resp = self.api_request(method='POST', path=path, data=wrapped)
147-
return resp.get('permissions', [])
148-
14992

15093
class _PublisherAPI(object):
15194
"""Helper mapping publisher-related APIs.
@@ -533,3 +476,63 @@ class _IAMPolicyAPI(object):
533476

534477
def __init__(self, connection):
535478
self._connection = connection
479+
480+
def get_iam_policy(self, target_path):
481+
"""Fetch the IAM policy for the target.
482+
483+
See:
484+
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/getIamPolicy
485+
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/getIamPolicy
486+
487+
:type target_path: string
488+
:param target_path: the path of the target object.
489+
490+
:rtype: dict
491+
:returns: the resource returned by the ``getIamPolicy`` API request.
492+
"""
493+
conn = self._connection
494+
path = '/%s:getIamPolicy' % (target_path,)
495+
return conn.api_request(method='GET', path=path)
496+
497+
def set_iam_policy(self, target_path, policy):
498+
"""Update the IAM policy for the target.
499+
500+
See:
501+
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/setIamPolicy
502+
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/setIamPolicy
503+
504+
:type target_path: string
505+
:param target_path: the path of the target object.
506+
507+
:type policy: dict
508+
:param policy: the new policy resource.
509+
510+
:rtype: dict
511+
:returns: the resource returned by the ``setIamPolicy`` API request.
512+
"""
513+
conn = self._connection
514+
wrapped = {'policy': policy}
515+
path = '/%s:setIamPolicy' % (target_path,)
516+
return conn.api_request(method='POST', path=path, data=wrapped)
517+
518+
def test_iam_permissions(self, target_path, permissions):
519+
"""Update the IAM policy for the target.
520+
521+
See:
522+
https://cloud.google.com/pubsub/reference/rest/v1/projects.topics/testIamPermissions
523+
https://cloud.google.com/pubsub/reference/rest/v1/projects.subscriptions/testIamPermissions
524+
525+
:type target_path: string
526+
:param target_path: the path of the target object.
527+
528+
:type permissions: list of string
529+
:param permissions: the permissions to check
530+
531+
:rtype: dict
532+
:returns: the resource returned by the ``getIamPolicy`` API request.
533+
"""
534+
conn = self._connection
535+
wrapped = {'permissions': permissions}
536+
path = '/%s:testIamPermissions' % (target_path,)
537+
resp = conn.api_request(method='POST', path=path, data=wrapped)
538+
return resp.get('permissions', [])

‎gcloud/pubsub/subscription.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,8 @@ def get_iam_policy(self, client=None):
303303
``getIamPolicy`` API request.
304304
"""
305305
client = self._require_client(client)
306-
resp = client.connection.get_iam_policy(self.full_name)
306+
api = client.iam_policy_api
307+
resp = api.get_iam_policy(self.full_name)
307308
return Policy.from_api_repr(resp)
308309

309310
def set_iam_policy(self, policy, client=None):
@@ -325,8 +326,9 @@ def set_iam_policy(self, policy, client=None):
325326
``setIamPolicy`` API request.
326327
"""
327328
client = self._require_client(client)
329+
api = client.iam_policy_api
328330
resource = policy.to_api_repr()
329-
resp = client.connection.set_iam_policy(self.full_name, resource)
331+
resp = api.set_iam_policy(self.full_name, resource)
330332
return Policy.from_api_repr(resp)
331333

332334
def check_iam_permissions(self, permissions, client=None):
@@ -346,5 +348,6 @@ def check_iam_permissions(self, permissions, client=None):
346348
:returns: subset of ``permissions`` allowed by current IAM policy.
347349
"""
348350
client = self._require_client(client)
349-
return client.connection.test_iam_permissions(
351+
api = client.iam_policy_api
352+
return api.test_iam_permissions(
350353
self.full_name, list(permissions))

‎gcloud/pubsub/test_connection.py‎

Lines changed: 85 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -113,126 +113,6 @@ def test_build_api_url_w_base_url_override(self):
113113
self.assertEqual(conn.build_api_url('/foo', api_base_url=base_url2),
114114
URI)
115115

116-
def _verify_uri(self, uri, expected_path, **expected_qs):
117-
from six.moves.urllib import parse
118-
klass = self._getTargetClass()
119-
scheme, netloc, path, query, _ = parse.urlsplit(uri)
120-
self.assertEqual('%s://%s' % (scheme, netloc), klass.API_BASE_URL)
121-
self.assertEqual(path, '/%s/%s' % (klass.API_VERSION, expected_path))
122-
qs = dict(parse.parse_qsl(query))
123-
self.assertEqual(qs, expected_qs)
124-
125-
def test_get_iam_policy(self):
126-
import json
127-
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
128-
PATH = '%s:getIamPolicy' % (self.TOPIC_PATH,)
129-
OWNER1 = 'user:[email protected]'
130-
OWNER2 = 'group:[email protected]'
131-
EDITOR1 = 'domain:google.com'
132-
EDITOR2 = 'user:[email protected]'
133-
VIEWER1 = 'serviceAccount:[email protected]'
134-
VIEWER2 = 'user:[email protected]'
135-
RETURNED = {
136-
'etag': 'DEADBEEF',
137-
'version': 17,
138-
'bindings': [
139-
{'role': OWNER_ROLE, 'members': [OWNER1, OWNER2]},
140-
{'role': EDITOR_ROLE, 'members': [EDITOR1, EDITOR2]},
141-
{'role': VIEWER_ROLE, 'members': [VIEWER1, VIEWER2]},
142-
],
143-
}
144-
HEADERS = {
145-
'status': '200',
146-
'content-type': 'application/json',
147-
}
148-
http = _Http(HEADERS, json.dumps(RETURNED))
149-
conn = self._makeOne(http=http)
150-
151-
policy = conn.get_iam_policy(self.TOPIC_PATH)
152-
153-
self.assertEqual(policy, RETURNED)
154-
self.assertEqual(http._called_with['method'], 'GET')
155-
self._verify_uri(http._called_with['uri'], PATH)
156-
self.assertEqual(http._called_with['body'], None)
157-
158-
def test_set_iam_policy(self):
159-
import json
160-
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
161-
PATH = '%s:setIamPolicy' % (self.TOPIC_PATH,)
162-
OWNER1 = 'user:[email protected]'
163-
OWNER2 = 'group:[email protected]'
164-
EDITOR1 = 'domain:google.com'
165-
EDITOR2 = 'user:[email protected]'
166-
VIEWER1 = 'serviceAccount:[email protected]'
167-
VIEWER2 = 'user:[email protected]'
168-
POLICY = {
169-
'etag': 'DEADBEEF',
170-
'version': 17,
171-
'bindings': [
172-
{'role': OWNER_ROLE, 'members': [OWNER1, OWNER2]},
173-
{'role': EDITOR_ROLE, 'members': [EDITOR1, EDITOR2]},
174-
{'role': VIEWER_ROLE, 'members': [VIEWER1, VIEWER2]},
175-
],
176-
}
177-
RETURNED = POLICY.copy()
178-
HEADERS = {
179-
'status': '200',
180-
'content-type': 'application/json',
181-
}
182-
http = _Http(HEADERS, json.dumps(RETURNED))
183-
conn = self._makeOne(http=http)
184-
185-
policy = conn.set_iam_policy(self.TOPIC_PATH, POLICY)
186-
187-
self.assertEqual(policy, RETURNED)
188-
self.assertEqual(http._called_with['method'], 'POST')
189-
self._verify_uri(http._called_with['uri'], PATH)
190-
self.assertEqual(http._called_with['body'],
191-
json.dumps({'policy': POLICY}))
192-
193-
def test_test_iam_permissions(self):
194-
import json
195-
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
196-
PATH = '%s:testIamPermissions' % (self.TOPIC_PATH,)
197-
ALL_ROLES = [OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE]
198-
ALLOWED = ALL_ROLES[1:]
199-
RETURNED = {'permissions': ALLOWED}
200-
HEADERS = {
201-
'status': '200',
202-
'content-type': 'application/json',
203-
}
204-
http = _Http(HEADERS, json.dumps(RETURNED))
205-
conn = self._makeOne(http=http)
206-
207-
allowed = conn.test_iam_permissions(self.TOPIC_PATH, ALL_ROLES)
208-
209-
self.assertEqual(allowed, ALLOWED)
210-
self.assertEqual(http._called_with['method'], 'POST')
211-
self._verify_uri(http._called_with['uri'], PATH)
212-
self.assertEqual(http._called_with['body'],
213-
json.dumps({'permissions': ALL_ROLES}))
214-
215-
def test_test_iam_permissions_missing_key(self):
216-
import json
217-
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
218-
PATH = '%s:testIamPermissions' % (self.TOPIC_PATH,)
219-
ALL_ROLES = [OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE]
220-
RETURNED = {}
221-
HEADERS = {
222-
'status': '200',
223-
'content-type': 'application/json',
224-
}
225-
http = _Http(HEADERS, json.dumps(RETURNED))
226-
conn = self._makeOne(http=http)
227-
228-
allowed = conn.test_iam_permissions(self.TOPIC_PATH, ALL_ROLES)
229-
230-
self.assertEqual(allowed, [])
231-
self.assertEqual(http._called_with['method'], 'POST')
232-
self._verify_uri(http._called_with['uri'], PATH)
233-
self.assertEqual(http._called_with['body'],
234-
json.dumps({'permissions': ALL_ROLES}))
235-
236116

237117
class Test_PublisherAPI(_Base):
238118

@@ -691,19 +571,95 @@ def test_ctor(self):
691571
api = self._makeOne(connection)
692572
self.assertTrue(api._connection is connection)
693573

574+
def test_get_iam_policy(self):
575+
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
576+
OWNER1 = 'user:[email protected]'
577+
OWNER2 = 'group:[email protected]'
578+
EDITOR1 = 'domain:google.com'
579+
EDITOR2 = 'user:[email protected]'
580+
VIEWER1 = 'serviceAccount:[email protected]'
581+
VIEWER2 = 'user:[email protected]'
582+
RETURNED = {
583+
'etag': 'DEADBEEF',
584+
'version': 17,
585+
'bindings': [
586+
{'role': OWNER_ROLE, 'members': [OWNER1, OWNER2]},
587+
{'role': EDITOR_ROLE, 'members': [EDITOR1, EDITOR2]},
588+
{'role': VIEWER_ROLE, 'members': [VIEWER1, VIEWER2]},
589+
],
590+
}
591+
connection = _Connection(RETURNED)
592+
api = self._makeOne(connection)
593+
594+
policy = api.get_iam_policy(self.TOPIC_PATH)
694595

695-
class _Http(object):
596+
self.assertEqual(policy, RETURNED)
597+
self.assertEqual(connection._called_with['method'], 'GET')
598+
path = '/%s:getIamPolicy' % (self.TOPIC_PATH,)
599+
self.assertEqual(connection._called_with['path'], path)
696600

697-
_called_with = None
601+
def test_set_iam_policy(self):
602+
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
603+
OWNER1 = 'user:[email protected]'
604+
OWNER2 = 'group:[email protected]'
605+
EDITOR1 = 'domain:google.com'
606+
EDITOR2 = 'user:[email protected]'
607+
VIEWER1 = 'serviceAccount:[email protected]'
608+
VIEWER2 = 'user:[email protected]'
609+
POLICY = {
610+
'etag': 'DEADBEEF',
611+
'version': 17,
612+
'bindings': [
613+
{'role': OWNER_ROLE, 'members': [OWNER1, OWNER2]},
614+
{'role': EDITOR_ROLE, 'members': [EDITOR1, EDITOR2]},
615+
{'role': VIEWER_ROLE, 'members': [VIEWER1, VIEWER2]},
616+
],
617+
}
618+
RETURNED = POLICY.copy()
619+
connection = _Connection(RETURNED)
620+
api = self._makeOne(connection)
698621

699-
def __init__(self, headers, content):
700-
from httplib2 import Response
701-
self._response = Response(headers)
702-
self._content = content
622+
policy = api.set_iam_policy(self.TOPIC_PATH, POLICY)
703623

704-
def request(self, **kw):
705-
self._called_with = kw
706-
return self._response, self._content
624+
self.assertEqual(policy, RETURNED)
625+
self.assertEqual(connection._called_with['method'], 'POST')
626+
path = '/%s:setIamPolicy' % (self.TOPIC_PATH,)
627+
self.assertEqual(connection._called_with['path'], path)
628+
self.assertEqual(connection._called_with['data'],
629+
{'policy': POLICY})
630+
631+
def test_test_iam_permissions(self):
632+
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
633+
ALL_ROLES = [OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE]
634+
ALLOWED = ALL_ROLES[1:]
635+
RETURNED = {'permissions': ALLOWED}
636+
connection = _Connection(RETURNED)
637+
api = self._makeOne(connection)
638+
639+
allowed = api.test_iam_permissions(self.TOPIC_PATH, ALL_ROLES)
640+
641+
self.assertEqual(allowed, ALLOWED)
642+
self.assertEqual(connection._called_with['method'], 'POST')
643+
path = '/%s:testIamPermissions' % (self.TOPIC_PATH,)
644+
self.assertEqual(connection._called_with['path'], path)
645+
self.assertEqual(connection._called_with['data'],
646+
{'permissions': ALL_ROLES})
647+
648+
def test_test_iam_permissions_missing_key(self):
649+
from gcloud.pubsub.iam import OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE
650+
ALL_ROLES = [OWNER_ROLE, EDITOR_ROLE, VIEWER_ROLE]
651+
RETURNED = {}
652+
connection = _Connection(RETURNED)
653+
api = self._makeOne(connection)
654+
655+
allowed = api.test_iam_permissions(self.TOPIC_PATH, ALL_ROLES)
656+
657+
self.assertEqual(allowed, [])
658+
self.assertEqual(connection._called_with['method'], 'POST')
659+
path = '/%s:testIamPermissions' % (self.TOPIC_PATH,)
660+
self.assertEqual(connection._called_with['path'], path)
661+
self.assertEqual(connection._called_with['data'],
662+
{'permissions': ALL_ROLES})
707663

708664

709665
class _Connection(object):

0 commit comments

Comments
 (0)