File: //lib/python3/dist-packages/uaclient/__pycache__/contract.cpython-310.pyc
o
nHJe6y � @ s� d dl Z d dlZd dlZd dlZd dlmZmZmZmZm Z d dl
m Z m Z m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZm Z d dl m Z d d l m Z d
Z!d Z"d Z#d Z$d
Z%dZ&dZ'dZ(dZ)dZ*dZ+ddddd�Z,e �-� Z.e�/e�0e1��Z2ej3G dd� dej4��Z5G dd� de j6�Z7de8fd d �Z9 dGd ed ee:ef d!ee:ef d"e;d#e;d$df d%d&�Z< ' dHd ed(ee:ef d)ee:ef d"e;d#e;d$e ee;f f d*d+�Z=d,ej>d$ej?fd-d.�Z@d/d0� ZAd ed$ee fd1d2�ZBd ed3e:d$ee:ef fd4d5�ZCd ed$e;fd6d7�ZDd8ee:e:f d9ee:e:f d$eEfd:d;�ZF dId<ee:ef d=e:d>e:d?ee: d$eeEee:ef f f
d@dA�ZG dJd(ee:ef dBee: d?ee: d$dfdCdD�ZHd ed$e e5eEf fdEdF�ZIdS )K� N)�Any�Dict�List�Optional�Tuple)�clouds� event_logger�
exceptions�http�messages�system�util�version)�_enabled_services)� _is_attached)�UAConfig)�ATTACH_FAIL_DATE_FORMAT�!CONTRACT_EXPIRY_GRACE_PERIOD_DAYS� CONTRACT_EXPIRY_PENDING_DAYS)�attachment_data_file)�
serviceclientz/v1/context/machines/tokenz3/v1/contracts/{contract}/context/machines/{machine}z
/v1/resourcesz3/v1/resources/{resource}/context/machines/{machine}z /v1/clouds/{cloud_type}/tokenz3/v1/contracts/{contract}/machine-activity/{machine}z /v1/contractz/v1/magic-attach� � � � )�series_overrides�series�cloud�variantc @ s e Zd ZdZdZdZdZdZdS )�ContractExpiryStatusr r r r r N)�__name__�
__module__� __qualname__�NONE�ACTIVE�ACTIVE_EXPIRED_SOON�EXPIRED_GRACE_PERIOD�EXPIRED� r( r( �3/usr/lib/python3/dist-packages/uaclient/contract.pyr > s r c
@ sN e Zd ZdZejejg d�d� d'dd��Zde e
e f fdd �Z d
e
de e
e f fd d �Z
ejejg d�d�d
ejfdd��Z d(de
de
dee
dede e
e f f
dd�Zdd� Zde
de e
e f fdd�Zde e
e f fd d �Zde
fd d �Z d'de
d e
dee
de e
e f fd!d"�Z d'de
d e
dee
de fd#d$�Zd%d&� ZdS ))�UAContractClient� contract_url)r r r )� retry_sleepsNc C s� |st �| j�}| �� }|�dd�|�i� | �� }|�� |d< ||d�}t|�}| j t
||d�}|j dkr:t �
� �|j dkrCt|� |j dkrRt jt
|j |jd ��|jS )
a} Requests machine attach to the provided machine_id.
@param contract_token: Token string providing authentication to
ContractBearer service endpoint.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@return: Dict of the JSON response containing the machine-token.
�
Authorization� Bearer {}�lastAttachment�� machineId� activityInfo)�data�headers� i� �� ��url�code�body)r �get_machine_id�cfgr4 �update�format�_get_activity_info� isoformat�_support_old_machine_info� request_url�API_V1_ADD_CONTRACT_MACHINEr9 r �AttachInvalidTokenError� _raise_attach_forbidden_message�ContractAPIErrorr: � json_dict) �self�contract_token�
attachment_dt�
machine_idr4 �
activity_infor3 �backcompat_data�responser( r( r) �add_contract_machineJ s,
�
�z%UAContractClient.add_contract_machine�returnc C sT | � � }| jt|d |d |d |d d�d�}|jdkr'tjt|j|jd��|jS ) z=Requests list of entitlements available to this machine type.� architecturer �kernel�virt�rQ r rR rS )� query_paramsr6 r7 )r? rB �API_V1_AVAILABLE_RESOURCESr9 r rF r: rG )rH rL rN r( r( r) �available_resourcesp s ��
�z$UAContractClient.available_resourcesrI c C sN | � � }|�dd�|�i� | jt|d�}|jdkr$tjt|j|jd��|j S )Nr- r. �r4 r6 r7 )
r4 r= r> rB � API_V1_GET_CONTRACT_USING_TOKENr9 r rF r: rG )rH rI r4 rN r( r( r) �get_contract_using_token� s �
�z)UAContractClient.get_contract_using_token�instancec C sv | j tj|jd�|jd�}|jdkr0|j�dd�}|r&t� |� t
j |d��t
j t|j|j
d��| j�d|j� |jS ) z�Requests contract token for auto-attach images for Pro clouds.
@param instance: AutoAttachCloudInstance for the cloud.
@return: Dict of the JSON response containing the contract-token.
)�
cloud_type)r3 r6 �message� )� error_msgr7 zcontract-token)rB �,API_V1_GET_CONTRACT_TOKEN_FOR_CLOUD_INSTANCEr> r\ � identity_docr9 rG �get�LOG�debugr �InvalidProImagerF r: r< � write_cache)rH r[ rN �msgr( r( r) �%get_contract_token_for_cloud_instance� s$
��
�z6UAContractClient.get_contract_token_for_cloud_instanceT�
machine_token�resourcerK � save_filec C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| j||d�}|jdkr3t j
t|j|j d��|j� d�rA|jd |j
d< |rN| j�d�|�|j
� |j
S ) a� Requests machine access context for a given resource
@param machine_token: The authentication token needed to talk to
this contract service endpoint.
@param resource: Entitlement name.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@save_file: If the machine access should be saved on the user machine
@return: Dict of the JSON response containing entitlement accessInfo.
r- r. )rj �machinerX r6 r7 �expireszmachine-access-{})r r; r< r4 r= r> �"API_V1_GET_RESOURCE_MACHINE_ACCESSrB r9 r rF r: rb rG rf )rH ri rj rK rk r4 r8 rN r( r( r) �get_resource_machine_access� s* �
� �z,UAContractClient.get_resource_machine_accessc C s� | j jj}| j j�d�}t�| j �}| �� }tj ||d�}| �
� }|� dd� |�i� | j |||d�}|j
dkrBtj||j
|jd��|jrW| j j}|j|d< | j j�|� d S d S )
z�Report current activity token and enabled services.
This will report to the contracts backend all the current
enabled services in the system.
� machineToken��contractrl r- r. )r4 r3 r6 r7 r2 N)r< �machine_token_file� contract_idri rb r r; r? � API_V1_UPDATE_ACTIVITY_TOKENr> r4 r= rB r9 r rF r: rG �write)rH rt ri rK � request_datar8 r4 rN r( r( r) �update_activity_token� s&
�
�
�z&UAContractClient.update_activity_token� magic_tokenc
C s� | � � }|�dd�|�i� z | jt|d�}W n tjy- } z t�|� t� � �d}~ww |j
dkr7t� � �|j
dkr@t� � �|j
dkrOtj
t|j
|jd��|jS ) z�Request magic attach token info.
When the magic token is registered, it will contain new fields
that will allow us to know that the attach process can proceed
r- r. rX Nr5 � r6 r7 )r4 r= r> rB �"API_V1_GET_MAGIC_ATTACH_TOKEN_INFOr �UrlErrorrc � exception�ConnectivityErrorr9 �MagicAttachTokenError�MagicAttachUnavailablerF r: rG �rH ry r4 rN �er( r( r) �get_magic_attach_token_info� s,
�
��
�z,UAContractClient.get_magic_attach_token_infoc
C s� | � � }z
| jt|dd�}W n tjy$ } z t�|� t�� �d}~ww |jdkr.t� � �|jdkr=tj
t|j|j d��|j S )z)Create a magic attach token for the user.�POST�r4 �methodNrz r6 r7 )
r4 rB �API_V1_NEW_MAGIC_ATTACHr r| rc r} r~ r9 r� rF r: rG )rH r4 rN r� r( r( r) �new_magic_attach_token s*
�
��
�z'UAContractClient.new_magic_attach_tokenc
C s� | � � }|�dd�|�i� z
| jt|dd�}W n tjy. } z t�|� t� � �d}~ww |j
dkr8t� � �|j
dkrAt� � �|j
dkrJt�
� �|j
d krYtjt|j
|jd
��dS ) z)Revoke a magic attach token for the user.r- r. �DELETEr� Ni� r5 rz r6 r7 )r4 r= r> rB �API_V1_REVOKE_MAGIC_ATTACHr r| rc r} r~ r9 � MagicAttachTokenAlreadyActivatedr r� rF r: r� r( r( r) �revoke_magic_attach_token3 s4
�
��
��z*UAContractClient.revoke_magic_attach_tokenrt c C s� |st �| j�}| �� }|�dd�|�i� tj||d�}| �� }| j|d||d |d |d |d d �d
�}|j d krFt
j ||j |j d ��|j�
d
�rT|jd
|jd
< |jS )a| Get the updated machine token from the contract server.
@param machine_token: The machine token needed to talk to
this contract service endpoint.
@param contract_id: Unique contract id provided by contract service
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
r- r. rq �GETrQ r rR rS rT )r� r4 rU r6 r7 rm )r r; r< r4 r= r> �API_V1_GET_CONTRACT_MACHINEr? rB r9 r rF r: rb rG )rH ri rt rK r4 r8 rL rN r( r( r) �get_contract_machineN s4 ���
� z%UAContractClient.get_contract_machinec C s� |st �| j�}| �� }|�dd�|�i� || �� d�}t|�}tj||d�}| j ||d|d�}|j
dkr@t j ||j
|j
d��|j�d �rN|jd |jd < |jS )
a� Request machine token refresh from contract server.
@param machine_token: The machine token needed to talk to
this contract service endpoint.
@param contract_id: Unique contract id provided by contract service.
@param machine_id: Optional unique system machine id. When absent,
contents of /etc/machine-id will be used.
@return: Dict of the JSON response containing refreshed machine-token
r- r. r0 rq r� )r4 r� r3 r6 r7 rm )r r; r< r4 r= r> r? rA � API_V1_UPDATE_CONTRACT_MACHINErB r9 r rF r: rb rG ) rH ri rt rK r4 r3 rM r8 rN r( r( r) �update_contract_machiney s* ���
� z(UAContractClient.update_contract_machinec C s� t �� jt �� jt �� jt �� t �� t �� t �
� d�}t | j �j
rQt| j �j}t�� }| j jjp5t �| j �| j jjdd� |D �dd� |D �|rL|j�� ndd�}ni }i |�|�S )z9Return a dict of activity info data for contract requests)� distributionrR r rQ �desktoprS �
clientVersionc S s g | ]}|j �qS r( )�name��.0�servicer( r( r) �
<listcomp>� s z7UAContractClient._get_activity_info.<locals>.<listcomp>c S s i | ]
}|j r|j|j�qS r( )�variant_enabledr� � variant_namer� r( r( r) �
<dictcomp>� s ��z7UAContractClient._get_activity_info.<locals>.<dictcomp>N)�
activityID�
activityToken� resources�resourceVariantsr/ )r �get_release_infor� �get_kernel_info�
uname_releaser �
get_dpkg_arch�
is_desktop�
get_virt_typer � get_versionr r< � is_attachedr �enabled_servicesr �readrs � activity_idr; �activity_token� attached_atr@ )rH � machine_infor� �attachment_datarL r( r( r) r? � s8 �
� ����z#UAContractClient._get_activity_info�N)NT)r r! r" �cfg_url_base_attrr
�retry�socket�timeoutrO r �strr rW rZ r �AutoAttachCloudInstancerh r �boolro rx r� r� r� r� r� r? r( r( r( r) r* G sb �% �!�����
�(& ����
�/����
� (r* � request_bodyc C sJ | � di �}| � d�||� d�|� d�|� d�|� d�dt�� jd�d �S )
a?
Transforms a request_body that has the new activity_info into a body that
includes both old and new forms of machineInfo/activityInfo
This is necessary because there may be old ua-airgapped contract
servers deployed that we need to support.
This function is used for attach and refresh calls.
r2 r1 rQ r� rR r �Linux)r� rR r �type�release)r1 r2 rQ �os)rb r r� r� )r� rL r( r( r) rA � s ��rA Tr< �past_entitlements�new_entitlements� allow_enabler rP c C sV ddl m} d}d}g }|| �D ]y} z|| }
W n ty! Y qw g }zt| |�| i �|
||d�\} } W nJ tjy[ }
zt�|
� d}|� | � t�
d| |
� W Y d}
~
qd}
~
w t y }
zt�|
� d}|� | � t�d| |
� W Y d}
~
qd}
~
ww | r�| r�t �
| � qt �|� |r�tjd d
� |D �d ��|r�tjd d
� |D �d ��dS )
a� Iterate over all entitlements in new_entitlement and apply any delta
found according to past_entitlements.
:param cfg: UAConfig instance
:param past_entitlements: dict containing the last valid information
regarding service entitlements.
:param new_entitlements: dict containing the current information regarding
service entitlements.
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:param series_overrides: Boolean set True if series overrides should be
applied to the new_access dict.
r )�entitlements_enable_orderF)r< � orig_access�
new_accessr� r Tz+Failed to process contract delta for %s: %rNz5Unexpected error processing contract delta for %s: %rc S � g | ]}|t jf�qS r( )r �UNEXPECTED_ERROR�r� r� r( r( r) r� ) s
�z.process_entitlements_delta.<locals>.<listcomp>)�failed_servicesc S r� r( )r �!E_ATTACH_FAILURE_DEFAULT_SERVICESr� r( r( r) r� / s ��)�uaclient.entitlementsr� �KeyError�process_entitlement_deltarb r �UbuntuProErrorrc r} �append�error� Exception�event�service_processed�services_failed�AttachFailureUnknownError� AttachFailureDefaultServices)r< r� r� r� r r� � delta_error�unexpected_errorr� r� �new_entitlement�deltas�service_enabledr� r( r( r) �process_entitlements_delta� sr �
�
��
���
�
�����r� Fr� r� c
C s� ddl m} |r t|� t�||�}d}|rn|�di ��d�}|s*|�di ��d�}|s3tj||d��|�di ��di ��d d
�} z || || d �}
W n tjy_ } zt �
d |� | �d
} ~ ww |
| |d�} | j |||d�}||fS )a, Process a entitlement access dictionary deltas if they exist.
:param cfg: UAConfig instance
:param orig_access: Dict with original entitlement access details before
contract refresh deltas
:param new_access: Dict with updated entitlement access details after
contract refresh
:param allow_enable: Boolean set True if allowed to perform the enable
operation. When False, a message will be logged to inform the user
about the recommended enabled service.
:param series_overrides: Boolean set True if series overrides should be
applied to the new_access dict.
:raise UbuntuProError: on failure to process deltas.
:return: A tuple containing a dict of processed deltas and a
boolean indicating if the service was fully processed
r )�entitlement_factoryF� entitlementr� )�orig�new� entitlements� obligations� use_selectorr^ )r< r� r z3Skipping entitlement deltas for "%s". No such classN)r< �
assume_yes�r� ) r� r� �apply_contract_overridesr
�get_dict_deltasrb r � InvalidContractDeltasServiceType�EntitlementNotFoundErrorrc rd �process_contract_deltas)
r< r� r� r� r r� r� �retr� r �ent_cls�excr� r( r( r) r� 6 s> �
���� �r� rN c C s� | j �d�}|rJ|d }|d }|dkr(|d �t�}tj|||d �d�d��|dkr@|d �t�}tj|||d �d�d ��|d
krJtj|d ��t�� �) N�info�
contractId�reasonzno-longer-effective�timez%m-%d-%Y)rt �date�contract_expiry_dateznot-effective-yet)rt r� �contract_effective_dateznever-effective)rt ) rG rb �strftimer r �AttachForbiddenExpired�AttachForbiddenNotYet�AttachForbiddenNever�AttachExpiredToken)rN r� rt r� r� r( r( r) rE r s* � � rE c C s� | j j}| j}|d }|d d d }t| �}|j||d�}| j �|� tj�� |� di �� dt�| ��}| �
d|� t | || j jdd � d
S ) a
Request contract refresh from ua-contracts service.
:param cfg: Instance of UAConfig for this machine.
:raise UbuntuProError: on failure to update contract or error processing
contract deltas
:raise UrlError: On failure during a connection
rp �machineTokenInfo� contractInfo�id)ri rt r1 z
machine-idFr� N) rs r� ri r* r� rv r r; � cache_clearrb rf r� )r< �orig_entitlements�
orig_tokenri rt �contract_client�resprK r( r( r) �refresh� s( �
�
�r� c C s t | �}|�� }|�dg �S )zDQuery available resources from the contract server for this machine.r� )r* rW rb )r< �clientr� r( r( r) �get_available_resources� s r �tokenc C s t | �}|�|�S )z/Query contract information for a specific token)r* rZ )r< r r r( r( r) �get_contract_information� s
r c
C s� | j }| jj}|�dd�}|�di ��di ��dd �}|s dS t| �}|�||�}|�di ��di ��dd �}|r;|n| jj}| jj|krGdS | j�|�} t| � � �D ]\}
} t
� |�|
i �| �} | rf dS qSdS ) Nrp r^ r� r� r� F� effectiveToT) ri rs r� rb r* r� �contract_expiry_datetime�get_entitlements_from_token�sorted�itemsr
r� )
r< r� r� ri rt r� r� � resp_expiry�
new_expiry�curr_entitlementsr� r� r� r( r( r) �is_contract_changed� s@
�
��� � ��r �override_selector�selector_valuesc C s< d}| � � D ]\}}||f|� � vr dS |t| 7 }q|S )Nr )r �OVERRIDE_SELECTOR_WEIGHTS)r
r �override_weight�selector�valuer( r( r) �_get_override_weight� s r r� � series_namer\ r c
C sz i }||d�}|r
||d< | � di �� |i �}|r ||td < t�| �dg ��}|D ]}t|� d�|�} | r:||| < q*|S )N)r r r r r � overridesr )�popr �copy�deepcopyrb r )
r� r r\ r r r r �general_overrides�override�weightr( r( r) �_select_overrides� s&
��
��r r c C s� ddl m} tt| t�d| v g�std�| ���|du r!t�� j n|}|� \}}| �
di �}t ||||�}t |�
� �D ]%\} }
|
�
� D ] \} } | d �
| �}
t|
t�rY|
�| � qC| | d | < qCq;dS )a� Apply series-specific overrides to an entitlement dict.
This function mutates orig_access dict by applying any series-overrides to
the top-level keys under 'entitlement'. The series-overrides are sparse
and intended to supplement existing top-level dict values. So, sub-keys
under the top-level directives, obligations and affordance sub-key values
will be preserved if unspecified in series-overrides.
To more clearly indicate that orig_access in memory has already had
the overrides applied, the 'series' key is also removed from the
orig_access dict.
:param orig_access: Dict with original entitlement access details
r )�get_cloud_typer� z?Expected entitlement access dict. Missing "entitlement" key: {}N)�uaclient.clouds.identityr �all�
isinstance�dict� RuntimeErrorr> r r� r rb r r r r= )r� r r r r r\ �_�orig_entitlementr �_weight�overrides_to_apply�keyr �currentr( r( r) r�
s* ��
�
��r� c C s� t | �js
tjdfS t}t}| jj}|du r!t� d� tj
| fS d| kr+|kr2n ntj |fS | | kr=dk rDn ntj |fS || k rNtj
|fS tj
|fS )z/Return a tuple [ContractExpiryStatus, num_days]r Nz:contract effectiveTo date is null - assuming it is expired)r r� r r# r r rs �contract_remaining_daysrc �warningr' r% r& r$ )r< � grace_period�pending_expiry�remaining_daysr( r( r) �get_contract_expiry_status> s"
�
r. )T)FTr� )NN)Jr �enum�loggingr� �typingr r r r r �uaclientr r r r
r r r
r �-uaclient.api.u.pro.status.enabled_services.v1r �(uaclient.api.u.pro.status.is_attached.v1r �uaclient.configr �uaclient.defaultsr r r �uaclient.files.state_filesr �
uaclient.httpr rC r� r� rV rn r` ru rY r{ r� r� r �get_event_loggerr� � getLogger� replace_top_level_logger_namer rc �unique�Enumr �UAServiceClientr* r! rA r� r� r� r� � HTTPResponse� NamedMessagerE r� r r r �intr r r� r. r( r( r( r) �<module> s� (
����� ��
�
���
�W��
�
���
�<�
� " &
�
�
��
����
� �
���
�1�
�