GoogleCloudPlatform · dpebot · Sep 1, 2016 · Aug 31, 2016 · Aug 31, 2016 · Sep 1, 2016
diff --git a/storage/cloud-client/acl.py b/storage/cloud-client/acl.py
@@ -0,0 +1,274 @@
+#!/usr/bin/env python
+
+# Copyright 2016 Google, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""This application demonstrates how to manage access control lists (acls) in
+Google Cloud Storage.
+
+For more information, see the README.md under /storage and the documentation
+at https://cloud.google.com/storage/docs/encryption.
+"""
+
+import argparse
+
+from gcloud import storage
+
+
+def print_bucket_acl(bucket_name):
+    """Prints out a bucket's access control list."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    for entry in bucket.acl:
+        print('{}: {}'.format(entry['role'], entry['entity']))
+
+
+def print_bucket_acl_for_user(bucket_name, user_email):
+    """Prints out a bucket's access control list for a given user."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    bucket.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # get the roles for different types of entities.
+    roles = bucket.acl.user(user_email).get_roles()
+
+    print(roles)
+
+
+def add_bucket_owner(bucket_name, user_email):
+    """Adds a user as an owner on the given bucket."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    bucket.acl.reload()
+
+    # You can also use `group()`, `domain()`, `all_authenticated()` and `all()`
+    # to grant access to different types of entities.
+    # You can also use `grant_read()` or `grant_write()` to grant different
+    # roles.
+    bucket.acl.user(user_email).grant_owner()
+    bucket.acl.save()
+
+    print('Added user {} as an owner on bucket {}.'.format(
+        user_email, bucket_name))
+
+
+def remove_bucket_owner(bucket_name, user_email):
+    """Removes a user from the access control list of the given bucket."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    bucket.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # remove access for different types of entities.
+    bucket.acl.user(user_email).revoke_read()
+    bucket.acl.user(user_email).revoke_write()
+    bucket.acl.user(user_email).revoke_owner()
+    bucket.acl.save()
+
+    print('Removed user {} from bucket {}.'.format(
+        user_email, bucket_name))
+
+
+def add_bucket_default_owner(bucket_name, user_email):
+    """Adds a user as an owner in the given bucket's default object access
+    control list."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    bucket.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # grant access to different types of entities. You can also use
+    # `grant_read` or `grant_write` to grant different roles.
+    bucket.default_object_acl.user(user_email).grant_owner()
+    bucket.default_object_acl.save()
+
+    print('Added user {} as an owner in the default acl on bucket {}.'.format(
+        user_email, bucket_name))
+
+
+def remove_bucket_default_owner(bucket_name, user_email):
+    """Removes a user from the access control list of the given bucket's
+    default object access control list."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    bucket.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # remove access for different types of entities.
+    bucket.default_object_acl.user(user_email).revoke_read()
+    bucket.default_object_acl.user(user_email).revoke_write()
+    bucket.default_object_acl.user(user_email).revoke_owner()
+    bucket.default_object_acl.save()
+
+    print('Removed user {} from the default acl of bucket {}.'.format(
+        user_email, bucket_name))
+
+
+def print_blob_acl(bucket_name, blob_name):
+    """Prints out a blob's access control list."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+    blob = bucket.blob(blob_name)
+
+    for entry in blob.acl:
+        print('{}: {}'.format(entry['role'], entry['entity']))
+
+
+def print_blob_acl_for_user(bucket_name, blob_name, user_email):
+    """Prints out a blob's access control list for a given user."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+    blob = bucket.blob(blob_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    blob.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # get the roles for different types of entities.
+    roles = blob.acl.user(user_email).get_roles()
+
+    print(roles)
+
+
+def add_blob_owner(bucket_name, blob_name, user_email):
+    """Adds a user as an owner on the given blob."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+    blob = bucket.blob(blob_name)
+
+    # Reload fetches the current ACL from Cloud Storage.
+    blob.acl.reload()
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # grant access to different types of entities. You can also use
+    # `grant_read` or `grant_write` to grant different roles.
+    blob.acl.user(user_email).grant_owner()
+    blob.acl.save()
+
+    print('Added user {} as an owner on blob {} in bucket {}.'.format(
+        user_email, blob_name, bucket_name))
+
+
+def remove_blob_owner(bucket_name, blob_name, user_email):
+    """Removes a user from the access control list of the given blob in the
+    given bucket."""
+    storage_client = storage.Client()
+    bucket = storage_client.bucket(bucket_name)
+    blob = bucket.blob(blob_name)
+
+    # You can also use `group`, `domain`, `all_authenticated` and `all` to
+    # remove access for different types of entities.
+    blob.acl.user(user_email).revoke_read()
+    blob.acl.user(user_email).revoke_write()
+    blob.acl.user(user_email).revoke_owner()
+    blob.acl.save()
+
+    print('Removed user {} from blob {} in bucket {}.'.format(
+        user_email, blob_name, bucket_name))
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    subparsers = parser.add_subparsers(dest='command')
+
+    print_bucket_acl_parser = subparsers.add_parser(
+        'print-bucket-acl', help=print_bucket_acl.__doc__)
+    print_bucket_acl_parser.add_argument('bucket_name')
+
+    print_bucket_acl_for_user_parser = subparsers.add_parser(
+        'print-bucket-acl-for-user', help=print_bucket_acl.__doc__)
+    print_bucket_acl_for_user_parser.add_argument('bucket_name')
+    print_bucket_acl_for_user_parser.add_argument('user_email')
+
+    add_bucket_owner_parser = subparsers.add_parser(
+        'add-bucket-owner', help=add_bucket_owner.__doc__)
+    add_bucket_owner_parser.add_argument('bucket_name')
+    add_bucket_owner_parser.add_argument('user_email')
+
+    remove_bucket_owner_parser = subparsers.add_parser(
+        'remove-bucket-owner', help=remove_bucket_owner.__doc__)
+    remove_bucket_owner_parser.add_argument('bucket_name')
+    remove_bucket_owner_parser.add_argument('user_email')
+
+    add_bucket_default_owner_parser = subparsers.add_parser(
+        'add-bucket-default-owner', help=add_bucket_default_owner.__doc__)
+    add_bucket_default_owner_parser.add_argument('bucket_name')
+    add_bucket_default_owner_parser.add_argument('user_email')
+
+    remove_bucket_default_owner_parser = subparsers.add_parser(
+        'remove-bucket-default-owner',
+        help=remove_bucket_default_owner.__doc__)
+    remove_bucket_default_owner_parser.add_argument('bucket_name')
+    remove_bucket_default_owner_parser.add_argument('user_email')
+
+    print_blob_acl_parser = subparsers.add_parser(
+        'print-blob-acl', help=print_blob_acl.__doc__)
+    print_blob_acl_parser.add_argument('bucket_name')
+    print_blob_acl_parser.add_argument('blob_name')
+
+    print_blob_acl_for_user_parser = subparsers.add_parser(
+        'print-blob-acl-for-user', help=print_blob_acl_for_user.__doc__)
+    print_blob_acl_for_user_parser.add_argument('bucket_name')
+    print_blob_acl_for_user_parser.add_argument('blob_name')
+    print_blob_acl_for_user_parser.add_argument('user_email')
+
+    add_blob_owner_parser = subparsers.add_parser(
+        'add-blob-owner', help=add_blob_owner.__doc__)
+    add_blob_owner_parser.add_argument('bucket_name')
+    add_blob_owner_parser.add_argument('blob_name')
+    add_blob_owner_parser.add_argument('user_email')
+
+    remove_blob_owner_parser = subparsers.add_parser(
+        'remove-blob-owner', help=remove_blob_owner.__doc__)
+    remove_blob_owner_parser.add_argument('bucket_name')
+    remove_blob_owner_parser.add_argument('blob_name')
+    remove_blob_owner_parser.add_argument('user_email')
+
+    args = parser.parse_args()
+
+    if args.command == 'print-bucket-acl':
+        print_bucket_acl(args.bucket_name)
+    elif args.command == 'print-bucket-acl-for-user':
+        print_bucket_acl_for_user(args.bucket_name, args.user_email)
+    elif args.command == 'add-bucket-owner':
+        add_bucket_owner(args.bucket_name, args.user_email)
+    elif args.command == 'remove-bucket-owner':
+        remove_bucket_owner(args.bucket_name, args.user_email)
+    elif args.command == 'add-bucket-default-owner':
+        add_bucket_default_owner(args.bucket_name, args.user_email)
+    elif args.command == 'remove-bucket-default-owner':
+        remove_bucket_default_owner(args.bucket_name, args.user_email)
+    elif args.command == 'print-blob-acl':
+        print_blob_acl(args.bucket_name, args.blob_name)
+    elif args.command == 'print-blob-acl-for-user':
+        print_blob_acl_for_user(
+            args.bucket_name, args.blob_name, args.user_email)
+    elif args.command == 'add-blob-owner':
+        add_blob_owner(args.bucket_name, args.blob_name, args.user_email)
+    elif args.command == 'remove-blob-owner':
+        remove_blob_owner(args.bucket_name, args.blob_name, args.user_email)