o

�N�gMk�@s�dZd
dl
Z
d
dlZd
dlZd
dlmZ
e�e�
Zdd�Z	ddd�
Z
dd	d
�
Z						
	
	ddd�
Zdd�Z
ddd�
Z							
				ddd�
Zddd�
ZdS)aJ

Github User State Module

.. versionadded:: 2016.3.0

This state is used to ensure presence of users in the Organization.

.. code-block:: yaml

    ensure user test is present in github:
        github.present:
            - name: 'Example TestUser1'
            - email: example@domain.com
            - username: 'gitexample'
�N)
�CommandExecutionErrorcCsd
tvrdSdS)zA
    Only load if the github module is available in __salt__
    zgithub.list_users�github)Fz!github module could not be loaded)
�__salt__�rr�F/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/github.py�__virtual__s

rrcKs,
|id
dd�}td|f
d|
i
|�
�
}|s"d|d<d|��|d	<|St
|t�r7|r7d
|�d�|d	<d|d<|S|�d
d�s�|�d�
dkr�tdrRd
|�d�|d	<|Std|f
d|
i
|�
�
}|rz|d�dd
�
|d�dd
|�d��
d|d<|Sd|d<d|�d�|d	<|Sd
|�d�|d	<d|d<|S)a%

    Ensure a user is present

    .. code-block:: yaml

        ensure user test is present in github:
            github.present:
                - name: 'gitexample'

    The following parameters are required:

    name
        This is the github handle of the user in the organization
    N���name�changes�result�comment�github.get_user�profileFrzCouldnt find user r
�User z is already in the org T�in_orgZmembership_state�pending�testz will be added to the orgzgithub.add_userr�old�newz exists in the org nowzFailed to add user z to the orgz has already been invited.)r�
isinstance�bool�get�__opts__�
setdefault�r
r�kwargs�ret�targetrrrr�present#s8

�


��





�
�
rcKs8
|�d
�
}|�d�
}|idd|�d�d�}t
d|f
d|
i
|�
�
}|r�t|t�s.|�d	d
�r�tdr@d|�d�|d
<d|d<|St
d|f
d|
i
|�
�
}|rsd|��|d
<|d�dd|�d��
|d�dd|�d��
d|d<|Sd|��|d
<d
|d<|Sd|�d�|d
<d|d<|Sd|�d�|d
<d|d<|S)av

    Ensure a github user is absent

    .. code-block:: yaml

        ensure user test is absent in github:
            github.absent:
                - name: 'Example TestUser1'
                - email: example@domain.com
                - username: 'gitexample'

    The following parameters are required:

    name
        Github handle of the user in organization

    �email�fullnameNrz is absent.r	rrrFr� will be deletedr
rzgithub.remove_userz
Deleted user rr� existsr� deletedT�Failed to delete z has already been deleted!� does not exist)rrrrrr)r
rrr Z	full_namerrrrrr�absentVs<






�








�
	�
�

r'�secret�pullFc	 Ks�|id
dd�}
td|f
d|i
|	�
�
}g}|�
rHi}
|
du
r(|d|
kr(|
|
d<|du
r6|d|kr6||
d<|du
rD|d	|krD||
d	<t
|
�
d
kr�tdr[|�d|
���

d|
d
<n(td|f
d|i
|
�
�
}|ryd|��d�|
�
d�|
dd<n
d|
d
<d|
d<|
S|du
}ttd||d����
}t|p�g�
}||}|r�||n
g}|r�tdr�|�d�|t|�
��

d|
d
<n9|D]6}td||fd|i
|	�
�
}|r�d|�d|��d|�d|��d�|
d|<q�d|
d
<d�||�|
d<|

S|�
rGtd�
r|�d�|t|�
��

d|
d
<n�|D]8}td ||fd|i
|	�
�
}|�
r7d|�d|��d|�d|��d�|
d|<�
qd|
d
<d!�||�|
d<|

SnOtd�
r[d"|�d#�|
d<d|
d
<|
Std$|f
|
||||d%�|	�
�
}|�
r�i|
dd<d|
ddd&<d"|�d'�|
ddd(<nd|
d
<d)|�d*�|
d<|
S|du
}tj�	�tj
|d+�
}td,|d�
}i}|�
p�i��D]\}}|||��<�
q�d}td-||d�}|�
p�i��D]�\}}t
�d.||�
|��|v
�rW|�
r�t||||��
r�td�
r�|�d/�|�
�

�
q�d
}td�r|�d0|�d1��

d|
d
<�
q�td2||fd|i
|	�
�
}|�rGi|
d|<d0|�d|��|
d|d&<d3�||�|
d|d(<�
q�d|
d
<d4�||�|
d<|

S�
q�|D]�}d}||v�rmt|||||�}|�ru||v
�s{|�r�|�r�d
}td�r�|�r�|�d5�|�
�

n	|�d0|�d6��

d|
d
<�q[td7||fd|i
|	�
�
}|�r�|�r�d8n
d}d0|�d|��d9�|||�d�|
d|<�q[d|
d
<d:�||�|
d<|

S�q[|�r�td-|f
|dd;�|	�
�

t
|�
d
k�r�d<�|�
|
d<|
S)=a�
    Ensure a team is present

    name
        This is the name of the team in the organization.

    description
        The description of the team.

    repo_names
        The names of repositories to add the team to.

    privacy
        The level of privacy for the team, can be 'secret' or 'closed'. Defaults
        to secret.

    permission
        The default permission for new repositories added to the team, can be
        'pull', 'push' or 'admin'. Defaults to pull.

    members
        The members belonging to the team, specified as a dict of member name to
        optional configuration. Options include 'enforce_mfa_from' and 'mfa_exempt'.

    enforce_mfa
        Whether to enforce MFA requirements on members of the team. If True then
        all members without `mfa_exempt: True` configured will be removed from
        the team. Note that `no_mfa_grace_seconds` may be set to allow members
        a grace period.

    no_mfa_grace_seconds
        The number of seconds of grace time that a member will have to enable MFA
        before being removed from the team. The grace period will begin from
        `enforce_mfa_from` on the member configuration, which defaults to
        1970/01/01.

    Example:

    .. code-block:: yaml

        Ensure team test is present in github:
            github.team_present:
                - name: 'test'
                - members:
                    user1: {}
                    user2: {}

        Ensure team test_mfa is present in github:
            github.team_present:
                - name: 'test_mfa'
                - members:
                    user1:
                        enforce_mfa_from: 2016/06/15
                - enforce_mfa: True

    .. versionadded:: 2016.11.0
    Trr	�github.get_teamrN�description�
permission�privacyr
rz&Team properties are set to be edited: rzgithub.edit_teamzTeam properties were z%Team properties (that changed) are {}�rrrZteamFz!Failed to update team properties.r
�github.list_team_repos�
rz0Team {} will have the following repos added: {}.�github.add_team_repo�Repo � is not in team � is in team z!Failed to add repo {} to team {}.z2Team {} will have the following repos removed: {}.�github.remove_team_repo�&Failed to remove repo {} from team {}.�Team z is set to be created.zgithub.add_team)r+�
repo_namesr,r-rr� has been createdrzFailed to create team �
.)
�secondszgithub.list_members_without_mfazgithub.list_team_memberszChecking member %s in team %szCUser {} will not be added to the team because they do not have MFA.rz set to be added to the team.zgithub.add_team_memberzUser {} is in team {}z!Failed to add user {} to team {}.zEUser {} set to be removed from the team because they do not have MFA.z! set to be removed from the team.zgithub.remove_team_memberz due to MFA violationzUser {} is not in team {}{}z&Failed to remove user {} from team {}.)rZignore_cache�

)r�lenr�append�format�set�keys�list�datetime�utcnow�	timedelta�items�lower�log�info�_member_violates_mfa�join) r
r+r8r-r,�membersZenforce_mfaZno_mfa_grace_secondsrrrrZ
test_comments�
parametersrZmanage_reposZ
current_reposZrepos_to_addZrepos_to_removeZ	repo_nameZmanage_members�mfa_deadlineZmembers_no_mfaZ
members_lower�member_namerIZ
member_changeZcurrent_members�member�member_infoZ
mfa_violationZ
extra_changesrrr�team_present�s�
E










�

�
�
�

��



�




��


�
�
�
�

�




��


�
�
�
�
���




�



��	





�





�


��




�
�
�

�
�
�

��"




��

�
�





�

�
�
�
�


��

��

�
�
�

rRcCs:|
�d
d�rdSt
j
�|
�dd�d�}|��|vo||kS)NZ
mfa_exemptF�enforce_mfa_fromz
1970/01/01z%Y/%m/%d)rrC�strptimerG)rPrQrNZmembers_without_mfarSrrrrJ�
s



�rJcKs�|id
dd�}td|f
d|
i
|�
�
}|s#d|�d�|d<d	|d
<|St
dr5d|�d�|d<d
|d
<|Std
|f
d|
i
|�
�
}|rhd|��|d<|d�dd|�d��
|d�dd|�d��
d	|d
<|Sd|��|d<d|d
<|S)aK

    Ensure a team is absent.

    Example:

    .. code-block:: yaml

        ensure team test is present in github:
            github.team_absent:
                - name: 'test'


    The following parameters are required:

    name
        This is the name of the team in the organization.

    .. versionadded:: 2016.11.0
    Nrr	r*rr7r&r
Trrr"zgithub.remove_teamz
Deleted team rrr#rr$r%F)rrrrrrr�team_absent�
s(









�

rUc Ks�|id
dd�}
td|d�

ztd|f
d|i
|�
�
}Wnt
y'


d}Yn
w|
||||||||	d	�	}d}|r�gd
�
}i}i}|��D]"\}}|du
rf||v
rf|||u
rf|||krf|||<||||<qDt|�
dkr�d|��d
|��d�}tdr�||
dd<d|
d<n�td|f
d|i
|�
�
}|r�||
dd<n�d|
d<d|
d<|
Sn�dd|�d�d�}tdr�||
dd<d|
d<nqt|�
}|�|�

td|f
i|�
�
}|s�d|
d<d|�d�|
d<|
Std�
D]0}t�	d�

ztd|f
d|i
|�
�
}W
nt
�
y
}
z
t
�d||�
WYd}~q�d}~w
w|du�
r*d|
d<d |�d!�|
d<|
S||
dd<|
du
�rjtd�
r@|�
s@g}n
|du�
rMtd||d�}d"d#�|D�
}|D]N}||
v
�
r�d|�d$|��d|�d%|��d�}td�
r||
d|<d|
d<�
qVtd&|||d�}|�
r�||
d|<�
qVd|
d<d'�||�|
d<|

S�
qV|
��D]�\}}||v
�
r�d|�d%|��d|�d$|��d�}td�
r�||
d|<d|
d<�
q�td(||||d)�}|�
r�||
d|<�
q�d|
d<d'�||�|
d<|

Std*||d��
|��i��
d+�
}|�sd|
d<d,�||�|
d<|

S||k�rhd-�|||�d-�|||�d�}td�rB||
d|<d|
d<�
q�td(||||d)�}|�rW||
d|<�
q�d|
d<d.�|||�|
d<|

S�
q�|
S)/a
    Ensure a repository is present

    name
        This is the name of the repository.

    description
        The description of the repository.

    homepage
        The URL with more information about the repository.

    private
        The visiblity of the repository. Note that private repositories require
        a paid GitHub account.

    has_issues
        Whether to enable issues for this repository.

    has_wiki
        Whether to enable the wiki for this repository.

    has_downloads
        Whether to enable downloads for this repository.

    auto_init
        Whether to create an initial commit with an empty README.

    gitignore_template
        The desired language or platform for a .gitignore, e.g "Haskell".

    license_template
        The desired LICENSE template to apply, e.g "mit" or "mozilla".

    teams
        The teams for which this repo should belong to, specified as a dict of
        team name to permission ('pull', 'push' or 'admin').

        .. versionadded:: 2017.7.0

    Example:

    .. code-block:: yaml

        Ensure repo my-repo is present in github:
            github.repo_present:
                - name: 'my-repo'
                - description: 'My very important repository'

    .. versionadded:: 2016.11.0
    Trr	zgithub.list_reposr0�github.get_repo_inforN)	r+�homepage�private�
has_issues�has_wiki�
has_downloads�	auto_init�gitignore_template�license_template)r\r]r^r
zRepo properties were z#Repo properties (that changed) are r.rrZreporzgithub.edit_repoFz!Failed to update repo properties.r
r2r9zgithub.add_repozFailed to create repo r:��
zgithub.get_repo_teamsz&Attempt %s to fetch new repo %s failedzFailed to verify repo z after creation.c
Ssh|]}
|
d�qS)
r
r)�.0�
trrr�	<setcomp>�szrepo_present.<locals>.<setcomp>r4r3r5r6r1)rr,r/r,z=Failed to determine current permission for team {} in repo {}z$Repo {} in team {} has permission {}z7Failed to set permission on repo {} from team {} to {}.)rrrFr=r�dict�update�range�time�sleeprHrIr?rrG) r
r+rWrXrYrZr[r\r]r^ZteamsrrrrZgiven_paramsZ
current_teamsZ
ignore_paramsrMZold_parametersZ
param_nameZparam_valueZrepo_changerZ
add_paramsZattempt�
eZcurrent_team_namesZ	team_nameZteam_changer,Zcurrent_permissionrrr�repo_present�
s>
B


�







�







�
�



�
�
�


�














�
�
�

��












�



�

���


�



�

��

�

�


�
��



�


��rjcKs
|id
dd�}ztd|f
d|
i
|�
�
}Wnt
y 


d
}Yn
w|s1d|�d�|d<d	|d
<|StdrCd|�d�|d<d
|d
<|Std
|f
d|
i
|�
�
}|rvd|��|d<|d�dd|�d��
|d�dd|�d��
d	|d
<|Sd�|�
|d<d|d
<|S)aO

    Ensure a repo is absent.

    Example:

    .. code-block:: yaml

        ensure repo test is absent in github:
            github.repo_absent:
                - name: 'test'

    The following parameters are required:

    name
        This is the name of the repository in the organization.

    .. versionadded:: 2016.11.0
    Nrr	rVrr2r&r
Trrr"zgithub.remove_repoz
Deleted repo rrr#rr$zQFailed to delete repo {}. Ensure the delete_repo scope is enabled if using OAuth.F)rrrrr?rrrr�repo_absent�s4


�









�
�
rk)
r)NNr(r)NFr
r)NNNNNNFNNNr)�__doc__rC�loggingrgZsalt.exceptionsr�	getLogger�__name__rHrrr'rRrJrUrjrkrrrr�<module>
sJ



	
3<







�(
	1










�