o

S��cz��@s�dd
lZdd
l
Z
dd
lZdd
lZddlmZ
ddlmZmZmZm	Z	m
Z
mZmZ
dd
l
Z
ddlmZmZmZmZmZmZ
ddlmZ
ddlmZmZmZmZmZmZmZmZ
ddl m!Z!m"Z"
ddl#m$Z$
e�%�Z&Gd	d
�d
�Z'Gdd�dej(d
�Z)d
S)�N)
�datetime)�Any�Dict�List�Optional�Tuple�Type�Union)�config�contract�event_logger�messages�system�util)
�DEFAULT_HELP_FILE)�ApplicabilityStatus�ApplicationStatus�CanDisableFailure�CanDisableFailureReason�CanEnableFailure�CanEnableFailureReason�ContractStatus�UserFacingStatus)�MessagingOperationsDict�StaticAffordance)
�is_config_value_truec@s$eZ
dZd
eddejfdd�ZdS)�IncompatibleService�entitlement�
UAEntitlement�	named_msgcCs|
|_||_
dS�
N)rr)�selfrr�r"�</usr/lib/python3/dist-packages/uaclient/entitlements/base.py�__init__s

zIncompatibleService.__init__N)�__name__�
__module__�__qualname__rr
�NamedMessager$r"r"r"r#rs
��rc
@s�eZ
dZd
ZdZdZdZd
ZdZdZ	dZ
eej
defdd��
�
Zedeefdd��
Zeej
defd	d
��
�
Zeej
defdd��
�
Zedefd
d��
Zedefdd��
Zedeedffdd��
Zedeedffdd��
Zedeeddffdd��
Zedeeddffdd��
Zedefdd��
Z	
				dXde e!j"de#de#d ed!e#dd
fd"d#�Z$ed$d%��
Z%	dYd&e#dee#e&d
e'fffd'd(�Z(ej
dYd&e#de#fd)d*��
Z)	dYd+e#dee#e e*ffd,d-�Z+dee#e e'ffd.d/�Z,de#fd0d1�Z-d2d3�Z.deefd4d5�Z/de#fd6d7�Z0dee#e e1j2ffd8d9�Z3dee#e e1j2ffd:d;�Z4dee5e e1j2ffd<d=�Z6ej
dYd&e#de#fd>d?��
Z7d&e#dee#e e1j2ffd@dA�Z8de#fdBdC�Z9	dYdDed&e#dd
fdEdF�Z:	dYd&e#dee#e e*ffdGdH�Z;de<fdIdJ�Z=de#fdKdL�Z>de?fdMdN�Z@	dYdOeAeeBfdPeAeeBfdQe#de#fdRdS�ZCdeeDe e1j2ffdTdU�ZEej
dee?e e1j2ffdVdW��
ZFd
S)ZrNFr"�returnc


C�d
S)z&The lowercase name of this entitlementNr"�
r!r"r"r#�name@�zUAEntitlement.namec
Cs$|jg
}
|j
|jkr|
�|j
�

|
S)
z1The list of names this entitlement may be called.)r,�presentation_name�append)r!�valid_namesr"r"r#r0Fs


zUAEntitlement.valid_namesc


Cr*)z,The human readable title of this entitlementNr"r+r"r"r#�titleNr-zUAEntitlement.titlec


Cr*)z&A sentence describing this entitlementNr"r+r"r"r#�descriptionTr-zUAEntitlement.descriptionc

Cs>|jj
jr|jj
j�|ji��d
i��di��d|j�S|jS)z/The user-facing name shown for this entitlementr�affordances�presentedAs)�cfg�machine_token_file�
is_present�entitlements�getr,r+r"r"r#r.Zs




�zUAEntitlement.presentation_namec
Csl|jd
ur3i}
t
j�t�
r'ttd��
}t�|�
}
Wd
�
n1s"w



Y
|
�|j	i��dd�|_|jS)z$Help information for the entitlementN�
r�help�)
�
_help_info�os�path�existsr�open�yaml�	safe_loadr9r,)r!�	help_dict�
fr"r"r#�	help_infogs



�zUAEntitlement.help_info.c


Cr*)Nr"r"r+r"r"r#�static_affordancesx�z UAEntitlement.static_affordancesc


C�|jS)
a

        Return a list of packages that aren't compatible with the entitlement.
        When we are enabling the entitlement we can directly ask the user
        if those entitlements can be disabled before proceding.
        Overridden in livepatch and fips
        )
�_incompatible_servicesr+r"r"r#�incompatible_services|�z#UAEntitlement.incompatible_servicesc


CrI)
a

        Return a list of packages that must be active before enabling this
        service. When we are enabling the entitlement we can directly ask
        the user if those entitlements can be enabled before proceding.
        Overridden in ros and ros-updates.
        )
�_required_servicesr+r"r"r#�required_services�rLzUAEntitlement.required_servicesc


CrI)
a

        Return a list of packages that depend on this service.
        We will use that list during disable operations, where
        a disable operation will also disable all of the services
        required by the original service
        Overriden in esm-apps and esm-infra
        )
�_dependent_servicesr+r"r"r#�dependent_services�s	z UAEntitlement.dependent_servicesc


CsiSr r"r+r"r"r#�	messaging�rHzUAEntitlement.messagingr<r5�
assume_yes�
allow_beta�called_name�access_onlycCsD|
st�
�d
k}tj|d�
}
|
|_||_||_||_||_d|_	dS)z]Setup UAEntitlement instance

        @param config: Parsed configuration dictionary
        r
)
�	root_modeN)
r>�getuidr
�UAConfigr5rRrSrU�_called_name�_valid_service)r!r5rRrSrTrUrVr"r"r#r$�s








zUAEntitlement.__init__c

Cs.|jd
ur|j
p|jpt|jjd�|_|jS)z2Check if the service is marked as valid (non-beta)Nzfeatures.allow_beta)rZ�is_betarSrr5r+r"r"r#�
valid_service�s

��zUAEntitlement.valid_service�silentc	Cs�|j�
d
g�}t�|�
sdS|��\}}|sL|durdS|jtjkr2|��\}}|s1||_	d|fSn|jtj
krH|��\}}|sG||_	d|fSnd|fS|j�
dg�}t�|�
sZdS|j|
d�
}|sddS|j�
dg�}t�|�
srdSdS)	aN
Enable specific entitlement.

        @return: tuple of (success, optional reason)
            (True, None) on success.
            (False, reason) otherwise. reason is only non-None if it is a
                populated CanEnableFailure reason. This may expand to
                include other types of reasons in the future.
        �pre_can_enable�FNNF�
pre_enable�
r]�post_enable�TN)
rQr9r�handle_message_operations�
can_enable�reasonr�INCOMPATIBLE_SERVICE�handle_incompatible_services�message�INACTIVE_REQUIRED_SERVICES�_enable_required_services�_perform_enable)	r!r]�msg_opsre�fail�incompat_ret�error�req_ret�retr"r"r#�enable�sB








�
��


�







zUAEntitlement.enablec
Cr*)a

        Enable specific entitlement. This should be implemented by subclasses.
        This method does the actual enablement, and does not check can_enable
        or handle pre_enable or post_enable messaging.

        @return: True on success, False otherwise.
        Nr"�r!r]r"r"r#rl�s	zUAEntitlement._perform_enable�ignore_dependent_servicescCsX|��\}}|t
jkrd
ttjtjj|jd�
d�fS|j	r*|
s*|�
�r*d
ttj�
fSdS)z�Report whether or not disabling is possible for the entitlement.

        :return:
            (True, None) if can disable
            (False, CanDisableFailure) if can't disable
        F�
r1�
rirc)�application_statusr�DISABLEDrr�ALREADY_DISABLEDr
�formatr1rP�detect_dependent_services�ACTIVE_DEPENDENT_SERVICES)r!rurx�
_r"r"r#�can_disable
s 	



��



��zUAEntitlement.can_disablec
Cs"
|��rt
�d
|j�
t�|j�

|��tj	ks'dt
tjt
jj|jd�
d�fS|��\}
}|
tjkrAdt
tjt
jj|jd�
d�fS|jsKdt
tj�
fS|��\}}|tjkr_dt
tj|d�fS|jrm|��rmdt
tj�
fS|jr{|��s{dt
tj�
fS|j s�|j!r�dt
tj"t
j#j|jd�
�fSdS)z�
        Report whether or not enabling is possible for the entitlement.

        :return:
            (True, None) if can enable
            (False, CanEnableFailure) if can't enable
        z(Updating contract on service '%s' expiryFrvrwrc)$�is_access_expired�logging�debugr,r�request_updated_contractr5�contract_statusr�ENTITLEDrr�NOT_ENTITLEDr
�
UNENTITLEDr{r1rxrry�ALREADY_ENABLEDr\�IS_BETA�applicability_statusr�INAPPLICABLErK�detect_incompatible_servicesrgrN�check_required_services_activerj�supports_access_onlyrU�ACCESS_ONLY_NOT_SUPPORTED� ENABLE_ACCESS_ONLY_NOT_SUPPORTED)r!rxr~r��detailsr"r"r#re&
sj	

�


��




��




��


��


��



���
zUAEntitlement.can_enablec
Cs2|jD]}
|
|j
�
��\}}|tjkr
d
SqdS)z�
        Check for depedent services.

        :return:
            True if there are dependent services enabled
            False if there are no dependent services enabled
        TF)rPr5rxr�ENABLED)r!�dependent_service_cls�
ent_statusr~r"r"r#r|s
s


��

�z'UAEntitlement.detect_dependent_servicesc
Cs2|jD]}
|
|j
�
��\}}|tjkr
d
SqdS)z�
        Check if all required services are active

        :return:
            True if all required services are active
            False is at least one of the required services is disabled
        FT)rNr5rxrr�)r!�required_service_clsr�r~r"r"r#r��
s




�z,UAEntitlement.check_required_services_activec
Cs<g}
|jD]}|�
|j�
��\}}|tjkr|
�|�

q|
S)
zI
        :return: List of incompatible services that are enabled
        )rKrr5rxrr�r/)r!rr�servicer�r~r"r"r#�blocking_incompatible_services�
s






�z,UAEntitlement.blocking_incompatible_servicesc

Cst|�
��
d
kS)z�
        Check for incompatible services.

        :return:
            True if there are incompatible services enabled
            False if there are no incompatible services enabled
        r
)�lenr�r+r"r"r#r��
sz*UAEntitlement.detect_incompatible_servicesc
Cs�tj
|jjd
d�}
|��D]M}|j|jdd�}tjj|j|jd�}tj	j|j|jd�}|
r3d|f
Stj
||jd�sAd|f
Sd�|j�
}t�
|�

|jdd	�
}|sZ|d
f
Sq
dS)a)
        Prompt user when incompatible services are found during enable.

        When enabling a service, we may find that there is an incompatible
        service already enable. In that situation, we can ask the user
        if the incompatible service should be disabled before proceeding.
        There are also different ways to configure that behavior:

        We can disable removing incompatible service during enable by
        adding the following lines into uaclient.conf:

        features:
          block_disable_on_enable: true
        z features.block_disable_on_enable)r
�
path_to_valueT)
rR)�service_being_enabled�incompatible_serviceF��msgrRz"Disabling incompatible service: {}raNrc)rrr5r�rr
rgr{r1�!INCOMPATIBLE_SERVICE_STOPS_ENABLE�prompt_for_confirmationrR�event�info�disable)r!�cfg_block_disable_on_enabler��ent�user_msg�e_msg�disable_msgrrr"r"r#rh�
s:

�


�

�

�
�


�z*UAEntitlement.handle_incompatible_servicesc

Cs�|jD]i}
|
|j
d
d�}|��dtjk}|rltjj|j|jd�}tj	j|j|jd�}t
j||jd�s9d|f
St
�d�|j�
�

|jd
d�
\}}|sld	}|r]|jr]|jjr]d
|jj}tjj||jd�}	||	f
SqdS)
a,

        Prompt user when required services are found during enable.

        When enabling a service, we may find that there are required services
        that must be enabled first. In that situation, we can ask the user
        if the required service should be enabled before proceeding.
        T)
rSr
)r��required_servicer�FzEnabling required service: {}rar<�

)rpr�rc)rNr5rxrryr
�REQUIRED_SERVICEr{r1�REQUIRED_SERVICE_STOPS_ENABLErr�rRr�r�rsrir��ERROR_ENABLING_REQUIRED_SERVICE)
r!r�r��is_service_disabledr�r�rrrn�	error_msgr�r"r"r#rk�
s:


�


�

�
�





��z'UAEntitlement._enable_required_servicesc
Cs�
|jj
j�|j�
}
|
stjtjfS|j	D]\}}}|�|kr%tj
|f
Sq|
d
�di�}t��}|�dd�}|du
rY|d|v
rYt
�|�
}tj
tjj|j|dd�|�
d�fS|�dd�}	|	du
rw|d|	v
rwtj
tjj|j|d	d
�fSt��}
|�dd�}|�d�
}|du
r�|
j|v
r�tj
tjj|j|
jd�|�
d
�fS|r�|
jdu
r�|
jdu
r�tjj|j|
j|d�}
z|�d�
\}}t|�
}t|�
}Wnty�


t�d|�
tj
|
fYSw|
j|kr�tj
|
fS|
j|kr�|
j|kr�tj
|
fStjdfS)a�
Check all contract affordances to vet current platform

        Affordances are a list of support constraints for the entitlement.
        Examples include a list of supported series, architectures for kernel
        revisions.

        :return:
            tuple of (ApplicabilityStatus, NamedMessage). APPLICABLE if
            platform passes all defined affordances, INAPPLICABLE if it doesn't
            meet all of the provided constraints.
        rr3�
architecturesN�archz, )r1r��supported_arches�series�version)r1r��
kernelFlavors�minKernelVersion)r1�kernel�supported_kernels)r1r��
min_kernel�
.z$Could not parse minKernelVersion: %s) r5r6r8r9r,r�
APPLICABLEr
�"NO_ENTITLEMENT_AFFORDANCES_CHECKEDrGr�r�get_platform_infor�deduplicate_arches�INAPPLICABLE_ARCHr{r1�join�INAPPLICABLE_SERIES�get_kernel_info�flavor�INAPPLICABLE_KERNEL�
uname_release�major�minor�INAPPLICABLE_KERNEL_VER�split�int�
ValueErrorr��warning)r!�entitlement_cfg�
error_message�functor�expected_resultr3�platform�affordance_arches�deduplicated_arches�affordance_series�kernel_info�affordance_kernels�affordance_min_kernel�invalid_msg�kernel_major�kernel_minor�min_kern_major�min_kern_minorr"r"r#r�
s�

�
�


�

�
�




���
�


��









��	���


�






��


��


z"UAEntitlement.applicability_statusc
Cr*)a\

        Disable specific entitlement. This should be implemented by subclasses.
        This method does the actual disable, and does not check can_disable
        or handle pre_disable or post_disable messaging.

        @param silent: Boolean set True to silence print/log of messages

        @return: True on success, False otherwise.
        Nr"rtr"r"r#�_perform_disablelszUAEntitlement._perform_disablecCs�|jD]m}||j
d
d�}|��dtjk}|rptjj|j|jd�}tj	j|j|jd�}t
j||jd�s9d|f
S|
sFt
�tjj|jd�
�

|jd
d	�
\}}|spd
}	|ra|jra|jjrad|jj}	tjj|	|jd�}
d|
f
Sqd
S)ay

        Disable dependent services

        When performing a disable operation, we might have
        other services that depend on the original services.
        If that is true, we will alert the user about this
        and prompt for confirmation to disable these services
        as well.

        @param silent: Boolean set True to silence print/log of messages
        T)r5rRr
)�dependent_service�service_being_disabled)r�r�r�F)
r�rar<r�)rpr�rc)rPr5rxrr�r
�DEPENDENT_SERVICEr{r1�DEPENDENT_SERVICE_STOPS_DISABLErr�rRr�r��DISABLING_DEPENDENT_SERVICEr�rir��"FAILED_DISABLING_DEPENDENT_SERVICE)r!r]r�r��is_service_enabledr�r�rrrnr�r�r"r"r#�_disable_dependent_servicesysD

�


�

�
�


��




��z)UAEntitlement._disable_dependent_servicesc

Cst�
�S)
z%Check if system needs to be rebooted.)r�
should_rebootr+r"r"r#�_check_for_reboot�szUAEntitlement._check_for_reboot�	operationcCs,|��r|st
�tjj|
d
�
�

dSdSdS)z�Check if user should be alerted that a reboot must be performed.

        @param operation: The operation being executed.
        @param silent: Boolean set True to silence print/log of messages
        )
r�N)r�r�r�r
�ENABLE_REBOOT_REQUIRED_TMPLr{)r!r�r]r"r"r#�_check_for_reboot_msg�s


���z#UAEntitlement._check_for_reboot_msgcCs�|j�
d
g�}t�|�
sdS|��\}}|s8|durdS|jtjkr4|j|
d�
\}}|s3||_	d|fSnd|fS|j
|
d�
s@dS|j�
dg�}t�|�
sNdS|jd|
d�
d	S)
a�
Disable specific entitlement

        @param silent: Boolean set True to silence print/log of messages

        @return: tuple of (success, optional reason)
            (True, None) on success.
            (False, reason) otherwise. reason is only non-None if it is a
                populated CanDisableFailure reason. This may expand to
                include other types of reasons in the future.
        �pre_disabler_NraF�post_disablezdisable operation)r�r]rc)rQr9rrdrrfrr}r�rir�r�)r!r]rmrrnrrr�r"r"r#r��s4





��


�




�zUAEntitlement.disablec
Cs@|jj
stjS|jjj�|ji�}
|
r|
d
�d�
rtjStjS)z=Return whether the user is entitled to the entitlement or notr�entitled)	r5�is_attachedrr�r6r8r9r,r�)r!r�r"r"r#r��s



�

zUAEntitlement.contract_statusc
CsF|jj
j�|ji�}
|
�d
�
}|sdSt�|d�}|t��kr!dSdS)z<Return entitlement access info as stale and needing refresh.�expiresFz%Y-%m-%dT%H:%M:%S.%fZT)r5r6r8r9r,r�strptime�utcnow)r!�entitlement_contract�
expire_str�expiryr"r"r#r��s

�






zUAEntitlement.is_access_expiredc
Csl|j�
d
�
}
|
dur
tjS|
�dg�}|D]}|�d�
|jkr2|�d�
}|dkr-tj
Stj
SqtjS)z6Check on the state of application on the status cache.�status-cacheN�servicesr,�status�enabled)r5�
read_cacherryr9r,r�)r!�status_cache�services_status_listr��service_statusr"r"r#�"_check_application_status_on_caches






�z0UAEntitlement._check_application_status_on_cache�orig_access�deltas�allow_enablecCs�
|sd
S|�di�}|�di�}|j
�d�
}t|tjk�
}|s9|r*t�|�

|d}|
r9d|vr9|ddtjfv}|rr|rD|rD|��}n|�	�\}}	|t
jkrf|��r_|�
�
t�d|j�
nt�d|j�
|j
�d	�|j�
�

d
S|
�d
�
}
|
s~|�d
�
}
|�di�}t|�d�
o�|
�
}|r�d
|_|��\}
}	|
r�|r�|r�tjj|jd
�
}tj|tjd�
|��
d
Stjj|jd
�
}tj|tjd�
d
SdS)avProcess any contract access deltas for this entitlement.

        :param orig_access: Dictionary containing the original
            resourceEntitlement access details.
        :param deltas: Dictionary which contains only the changed access keys
        and values.
        :param allow_enable: Boolean set True if allowed to perform the enable
            operation. When False, a message will be logged to inform the user
            about the recommended enabled service.

        :return: True when delta operations are processed; False when noop.
        :raise: UserFacingError when auto-enable fails unexpectedly.
        Tr�
directivesr�r�Fz.Due to contract refresh, '%s' is now disabled.zhUnable to disable '%s' as recommended during contract refresh. Service is still active. See `pro status`zmachine-access-{}�
resourceToken�obligations�enableByDefault)
r,)
�	file_type)r9r5r��boolr�DROPPED_KEYr�apply_contract_overridesr�rxrryrr�r�r�r,r��delete_cache_keyr{rSrer
�ENABLE_BY_DEFAULT_TMPLr��sys�stderrrs�ENABLE_BY_DEFAULT_MANUAL_TMPL)r!r�r�r��delta_entitlement�delta_directivesr��transition_to_unentitledrxr~r

�delta_obligations�enable_by_defaultrer�r"r"r#�process_contract_deltas sl











�








�
�	







�




�
�
z%UAEntitlement.process_contract_deltasc
Cs�|��\}
}|
t
jkrtj|fS|jjj�|j	�
}|s&tj
tjj
|jd
�
fS|d�dd�dur;tj
tjj
|jd
�
fS|��\}}tjtjtjtji|}||fS)z4Return (user-facing status, details) for entitlementrvrr�F)r�rr�rr�r5r6r8r9r,�UNAVAILABLEr
�SERVICE_NOT_ENTITLEDr{r1rxrr��ACTIVEry�INACTIVE)r!�
applicabilityr�r�rx�explanation�user_facing_statusr"r"r#r
ys*






�
�
�
��z UAEntitlement.user_facing_statusc


Cr*)z�
        The current status of application of this entitlement

        :return:
            A tuple of (ApplicationStatus, human-friendly reason)
        Nr"r+r"r"r#rx�s
z UAEntitlement.application_status)NFFr<F)
F)Gr%r&r'�help_doc_urlrRr[r�r=rJrMrO�property�abc�abstractmethod�strr,rr0r1r2r.rFrrrGrrKrrNrPrrQrr
rXr
r$r\r	rrsrlrrrer|r�r�r�r
r(rhrkrr�r�r�r�r�r�rr�r�rr�rrr
rr
rxr"r"r"r#r&s�










	
	





������
�

��
�7
�
�
�M

�5
�/
�_

�
�9�
�
�
��
�
�.�
�
��
�Y
�
�r)
�	metaclass)*r
r�r>r

r�typingrrrrrrr	rB�uaclientr
rrr
rr�uaclient.defaultsr�(uaclient.entitlements.entitlement_statusrrrrrrrr�uaclient.typesrr�
uaclient.utilr�get_event_loggerr�r�ABCMetarr"r"r"r#�<module>
s



$
 
(