Merge branch 'main' of https://github.com/GAM-team/GAM

src/GamUpdate.txt

@@ -1,3 +1,16 @@
+7.27.01
+
+Fixed bug in `gam <UserTypeEntity> claim ownership <DriveFileEntity> ... onlyUsers|skipusers <UserTypeEntity>`
+where the email addresses in `onlyUsers|skipusers <UserTypeEntity>` were not normalized.
+
+7.27.00
+
+Added `debug_redaction` Boolean variable to `gam.cfg`. When True, the default,
+sensitive data like access/refresh tokens, client secret and authorization codes
+are redacted from debug output. This allows you to post debug output without
+compromising your account information. Even with debug redaction,
+anything shared publicly should be double-checked for sensitive content. 
+
 7.25.01
 
 Fixed bug in `gam config timezone <String>` to handle timezone abbreviations correctly;

src/gam-install.sh

@@ -83,13 +83,8 @@ echo -e '\x1B[0m'
 
 version_gt()
 {
-# MacOS < 10.13 doesn't support sort -V
-echo "" | sort -V > /dev/null 2>&1
-vsort_failed=$?
 if [ "${1}" = "${2}" ]; then
   true
-elif (( $vsort_failed != 0 )); then
-  false
 else
   test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"
 fi

src/gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.25.01'
+__version__ = '7.27.01'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -375,27 +375,22 @@ YUBIKEY_VALUE_ERROR_RC = 85
 YUBIKEY_MULTIPLE_CONNECTED_RC = 86
 YUBIKEY_NOT_FOUND_RC = 87
 
-def redact_sensitive_google_text(text):
-    replace_patterns = [
+DEBUG_REDACTION_PATTERNS = [
+  # Positional patterns that redact sensitive credentials based on their location
+  (r'(Bearer\s+)\S+', r'\1*****'), # access tokens and JWTs in auth header
+  (r'([?&]refresh_token=)[^&]*', r'\1*****'), # refresh token URL parameter
+  (r'([?&]client_secret=)[^&]*', r'\1*****'), # client secret URL parameter
+  (r'([?&]key=)[^&]*', r'\1*****'), # API key URL parameter
+  (r'([?&]code=)[^&]*', r'\1*****'), # auth code URL parameter
 
-            # Positional patterns that redact sensitive credentials based on their location
-            (r'(Bearer\s+)\S+', r'\1*****'), # access tokens and JWTs in auth header
-            (r'([?&]refresh_token=)[^&]*', r'\1*****'), # refresh token URL parameter
-            (r'([?&]client_secret=)[^&]*', r'\1*****'), # client secret URL parameter
-            (r'([?&]key=)[^&]*', r'\1*****'), # API key URL parameter
-            (r'([?&]code=)[^&]*', r'\1*****'), # auth code URL parameter
-
-            # pattern match patterns that redact sensitive credentials based on known credential pattern
-            (r'ya29.[0-9A-Za-z-_]+', '*****'), # Access token
-            (r'1%2F%2F[0-9A-Za-z-_]{100}|1%2F%2F[0-9A-Za-z-_]{64}|1%2F%2F[0-9A-Za-z-_]{43}', '*****'), # Refresh token
-            (r'4/[0-9A-Za-z-_]+', '*****'), # Auth code
-            (r'GOCSPX-[0-9a-zA-Z-_]{28}', '*****'), # Client secret
-            (r'AIza[0-9A-Za-z-_]{35}', '*****'), # API key
-            (r'eyJ[a-zA-Z0-9\-_]+\.eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]*', '*****'), # JWT
-            ]
-    for pattern, replace in replace_patterns:
-      text = re.sub(pattern, replace, text)
-    return text
+  # Pattern match patterns that redact sensitive credentials based on known credential pattern
+  (r'ya29.[0-9A-Za-z-_]+', '*****'), # Access token
+  (r'1%2F%2F[0-9A-Za-z-_]{100}|1%2F%2F[0-9A-Za-z-_]{64}|1%2F%2F[0-9A-Za-z-_]{43}', '*****'), # Refresh token
+  (r'4/[0-9A-Za-z-_]+', '*****'), # Auth code
+  (r'GOCSPX-[0-9a-zA-Z-_]{28}', '*****'), # Client secret
+  (r'AIza[0-9A-Za-z-_]{35}', '*****'), # API key
+  (r'eyJ[a-zA-Z0-9\-_]+\.eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]*', '*****'), # JWT
+  ]
 
 def redactable_debug_print(*args):
   processed_args = []
@@ -406,7 +401,8 @@ def redactable_debug_print(*args):
       arg = sbytes.decode()
       arg = arg.replace('\\r\\n', "\n          ")
     if GC.Values[GC.DEBUG_REDACTION]:
-      arg = redact_sensitive_google_text(arg)
+      for pattern, replace in DEBUG_REDACTION_PATTERNS:
+        arg = re.sub(pattern, replace, arg)
     processed_args.append(arg)
   print(*processed_args)
 
@@ -64923,11 +64919,11 @@ def claimOwnership(users):
     elif myarg == 'onlyusers':
       _, userList = getEntityToModify(defaultEntityType=Cmd.ENTITY_USERS)
       checkOnly = True
-      onlyOwners = set(userList)
+      onlyOwners = {normalizeEmailAddressOrUID(user, noUid=True) for user in userList}
     elif myarg == 'skipusers':
       _, userList = getEntityToModify(defaultEntityType=Cmd.ENTITY_USERS)
       checkSkip = len(userList) > 0
-      skipOwners = set(userList)
+      skipOwners = {normalizeEmailAddressOrUID(user, noUid=True) for user in userList}
     elif myarg == 'subdomains':
       subdomains = getEntityList(Cmd.OB_DOMAIN_NAME_ENTITY)
     elif myarg == 'includetrashed':

wiki/Domain-SharedContacts.md

@@ -10,7 +10,7 @@
 - [Delete duplicate email addresses from contacts](#delete-duplicate-email-addresses-from-contacts)
 - [Manage domain contact photos](#manage-domain-contact-photos)
 - [Display domain shared contacts](#display-domain-shared-contacts)
-- [Display global address list](#Global-Address-List)
+- [Display global address list](Global-Address-List)
 
 ## API documentation
 * [Domain Shared Contacts API](https://developers.google.com/admin-sdk/domain-shared-contacts)

wiki/GamUpdates.md

@@ -10,6 +10,19 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.27.01
+
+Fixed bug in `gam <UserTypeEntity> claim ownership <DriveFileEntity> ... onlyUsers|skipusers <UserTypeEntity>`
+where the email addresses in `onlyUsers|skipusers <UserTypeEntity>` were not normalized.
+
+### 7.27.00
+
+Added `debug_redaction` Boolean variable to `gam.cfg`. When True, the default,
+sensitive data like access/refresh tokens, client secret and authorization codes
+are redacted from debug output. This allows you to post debug output without
+compromising your account information. Even with debug redaction,
+anything shared publicly should be double-checked for sensitive content. 
+
 ### 7.25.01
 
 Fixed bug in `gam config timezone <String>` to handle timezone abbreviations correctly;

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -252,7 +252,7 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.25.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.27.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 macOS Tahoe 26.0.1 x86_64
@@ -990,7 +990,7 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM 7.25.01 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.27.01 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 Windows-10-10.0.17134 AMD64

wiki/Version-and-Help.md

@@ -3,7 +3,7 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.25.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.27.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 macOS Tahoe 26.0.1 x86_64
@@ -15,7 +15,7 @@ Time: 2023-06-02T21:10:00-07:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.25.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.27.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 macOS Tahoe 26.0.1 x86_64
@@ -27,7 +27,7 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.25.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.27.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 macOS Tahoe 26.0.1 x86_64
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.25.01
+   Latest: 7.27.01
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.25.01
+7.27.01
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,7 +86,7 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.25.01 - https://github.com/GAM-team/GAM
+GAM 7.27.01 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.0 64-bit final
 macOS Tahoe 26.0.1 x86_64

wiki/gam.cfg.md

@@ -303,6 +303,9 @@ debug_level
         If debug_level > 0, turn on API debugging output.
         Default: 0
         Signal file: OldGamPath/debug.gam
+debug_redaction
+        Enable/disable redaction of sensitive data from API debugging output
+        Default: True
 device_max_results
         When retrieving lists of ChromeOS devices from API,
         how many should be retrieved in each API call