264 lines
8.0 KiB
Python
264 lines
8.0 KiB
Python
# -*- coding: utf-8 -*- #
|
|
# Copyright 2025 Google LLC. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""Updates a user's database roles in a given instance."""
|
|
|
|
from __future__ import absolute_import
|
|
from __future__ import division
|
|
from __future__ import unicode_literals
|
|
|
|
from googlecloudsdk.api_lib.sql import api_util
|
|
from googlecloudsdk.api_lib.sql import instances as instances_api_util
|
|
from googlecloudsdk.api_lib.sql import operations
|
|
from googlecloudsdk.calliope import base
|
|
from googlecloudsdk.calliope import exceptions
|
|
from googlecloudsdk.command_lib.sql import flags
|
|
from googlecloudsdk.command_lib.sql import users
|
|
from googlecloudsdk.core import properties
|
|
|
|
|
|
DETAILED_HELP = {
|
|
'DESCRIPTION':
|
|
'{description}',
|
|
'EXAMPLES':
|
|
"""\
|
|
To grant database roles ``role1'' and ``role2'' for ``my-user'' in instance ``prod-instance'', run:
|
|
|
|
$ {command} my-user --instance=prod-instance --database-roles=role1,role2 --type=BUILT_IN
|
|
|
|
To revoke existing database roles and grant new database roles ``role3'' and ``role4'' for ``my-user'' in instance
|
|
``prod-instance'', run:
|
|
|
|
$ {command} my-user --instance=prod-instance --revoke-existing-roles --database-roles=role3,role4 --type=BUILT_IN
|
|
""",
|
|
}
|
|
|
|
|
|
def AddBaseArgs(parser):
|
|
"""Args is called by calliope to gather arguments for this command.
|
|
|
|
Args:
|
|
parser: An argparse parser that you can use it to add arguments that go on
|
|
the command line after this command. Positional arguments are allowed.
|
|
"""
|
|
flags.AddInstance(parser)
|
|
flags.AddUsername(parser)
|
|
flags.AddHost(parser)
|
|
flags.AddType(parser, required=True)
|
|
flags.AddDatabaseRoles(parser)
|
|
flags.AddRevokeExistingRoles(parser)
|
|
parser.display_info.AddCacheUpdater(None)
|
|
|
|
|
|
def AddBetaArgs(parser):
|
|
del parser # Unused.
|
|
pass
|
|
|
|
|
|
def AddAlphaArgs(parser):
|
|
del parser # Unused.
|
|
pass
|
|
|
|
|
|
def RunBaseAssignRolesCommand(args):
|
|
"""Updates a user's database roles in a given instance.
|
|
|
|
Args:
|
|
args: argparse.Namespace, The arguments that this command was invoked
|
|
with.
|
|
|
|
Returns:
|
|
SQL user resource iterator.
|
|
"""
|
|
client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
|
|
sql_client = client.sql_client
|
|
sql_messages = client.sql_messages
|
|
|
|
instance_ref = client.resource_parser.Parse(
|
|
args.instance,
|
|
params={'project': properties.VALUES.core.project.GetOrFail},
|
|
collection='sql.instances',
|
|
)
|
|
|
|
instance = sql_client.instances.Get(
|
|
sql_messages.SqlInstancesGetRequest(
|
|
project=instance_ref.project, instance=instance_ref.instance
|
|
)
|
|
)
|
|
is_mysql = instances_api_util.InstancesV1Beta4.IsMysqlDatabaseVersion(
|
|
instance.databaseVersion
|
|
)
|
|
name = args.username
|
|
host = args.host
|
|
user_type = users.ParseUserType(sql_messages, args)
|
|
if (
|
|
user_type == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_GROUP
|
|
and is_mysql
|
|
):
|
|
# MySQL IAM groups are stored with the domain in the host field.
|
|
if '@' not in name:
|
|
raise exceptions.InvalidArgumentException(
|
|
'username',
|
|
message=(
|
|
'Cloud SQL IAM groups must be specified with the domain name in'
|
|
' the username field.'
|
|
),
|
|
)
|
|
host = name.split('@')[1]
|
|
name = name.split('@')[0]
|
|
|
|
if is_mysql and user_type in [
|
|
# TODO: b/437180966 - Add support for 3P user types in MySQL once the
|
|
# support for 3P users is launched.
|
|
sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_USER,
|
|
sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_SERVICE_ACCOUNT,
|
|
]:
|
|
# Truncate the domain from the username for MySQL IAM users and service
|
|
# accounts.
|
|
name = name.split('@')[0]
|
|
# For MySQL IAM users, the host is not supported.
|
|
host = '%'
|
|
|
|
user = sql_client.users.Get(
|
|
sql_messages.SqlUsersGetRequest(
|
|
project=instance_ref.project,
|
|
instance=args.instance,
|
|
name=name,
|
|
host=host,
|
|
)
|
|
)
|
|
|
|
user_type = user.type
|
|
name = user.name
|
|
if (
|
|
user_type == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_USER
|
|
or user_type
|
|
== sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_SERVICE_ACCOUNT
|
|
or user_type
|
|
== sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_GROUP
|
|
):
|
|
# For MySQL, the iam email needs to be passed in as the name.
|
|
if user.iamEmail:
|
|
name = user.iamEmail
|
|
# For MySQL IAM users, the host is not supported.
|
|
host = ''
|
|
|
|
result_operation = sql_client.users.Update(
|
|
sql_messages.SqlUsersUpdateRequest(
|
|
project=instance_ref.project,
|
|
instance=args.instance,
|
|
name=name,
|
|
host=host,
|
|
user=sql_messages.User(
|
|
project=instance_ref.project,
|
|
instance=args.instance,
|
|
name=name,
|
|
type=user.type),
|
|
databaseRoles=args.database_roles,
|
|
revokeExistingRoles=args.revoke_existing_roles))
|
|
operation_ref = client.resource_parser.Create(
|
|
'sql.operations',
|
|
operation=result_operation.name,
|
|
project=instance_ref.project)
|
|
if args.async_:
|
|
return sql_client.operations.Get(
|
|
sql_messages.SqlOperationsGetRequest(
|
|
project=operation_ref.project, operation=operation_ref.operation))
|
|
operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
|
|
'Updating Cloud SQL user')
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.GA)
|
|
@base.UniverseCompatible
|
|
@base.Hidden
|
|
class AssignRoles(base.UpdateCommand):
|
|
"""Updates a user's database roles in a given instance.
|
|
|
|
Updates a user's database roles in a given instance with a specified
|
|
username and host.
|
|
"""
|
|
|
|
detailed_help = DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Args is called by calliope to gather arguments for this command.
|
|
|
|
Args:
|
|
parser: An argparse parser that you can use it to add arguments that go on
|
|
the command line after this command. Positional arguments are allowed.
|
|
"""
|
|
AddBaseArgs(parser)
|
|
base.ASYNC_FLAG.AddToParser(parser)
|
|
|
|
def Run(self, args):
|
|
return RunBaseAssignRolesCommand(args)
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.BETA)
|
|
@base.UniverseCompatible
|
|
@base.Hidden
|
|
class AssignRolesBeta(base.UpdateCommand):
|
|
"""Updates a user's database roles in a given instance.
|
|
|
|
Updates a user's database roles in a given instance with a specified
|
|
username and host.
|
|
"""
|
|
|
|
detailed_help = DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Args is called by calliope to gather arguments for this command.
|
|
|
|
Args:
|
|
parser: An argparse parser that you can use it to add arguments that go on
|
|
the command line after this command. Positional arguments are allowed.
|
|
"""
|
|
AddBetaArgs(parser)
|
|
AddBaseArgs(parser)
|
|
base.ASYNC_FLAG.AddToParser(parser)
|
|
|
|
def Run(self, args):
|
|
return RunBaseAssignRolesCommand(args)
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
|
|
@base.UniverseCompatible
|
|
@base.Hidden
|
|
class AssignRolesAlpha(base.UpdateCommand):
|
|
"""Updates a user's database roles in a given instance.
|
|
|
|
Updates a user's database roles in a given instance with a specified
|
|
username and host.
|
|
"""
|
|
|
|
detailed_help = DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Args is called by calliope to gather arguments for this command.
|
|
|
|
Args:
|
|
parser: An argparse parser that you can use it to add arguments that go on
|
|
the command line after this command. Positional arguments are allowed.
|
|
"""
|
|
AddAlphaArgs(parser)
|
|
AddBetaArgs(parser)
|
|
AddBaseArgs(parser)
|
|
base.ASYNC_FLAG.AddToParser(parser)
|
|
|
|
def Run(self, args):
|
|
return RunBaseAssignRolesCommand(args)
|