Added commands to display Business Profile Accounts. #1807

src/GamCommands.txt

@@ -3436,6 +3436,13 @@ gam print guardian|guardians [todrive <ToDriveAttribute>*] [accepted|invitations
         [showstudentemails]
         [formatjson [quotechar <Character>]]
 
+# Business Profile Accounts
+
+gam show businessprofileaccounts
+        [type locationgroup|organization|personal|usergroup]
+gam print businessprofileaccounts [todrive <ToDriveAttribute>*]
+        [type locationgroup|organization|personal|usergroup]
+
 # Classroom User Profiles
 
 gam <UserTypeEntity> print classroomprofile [todrive <ToDriveAttribute>*]
@@ -6597,6 +6604,7 @@ gam <UserTypeEntity> print chatemojis [todrive <ToDriveAttribute>*]
         (folderColorRgb <ColorValue>)|
         (indexabletext <String>)|
         (inheritedpermissionsdisabled [<Boolean>])|
+        (itemdownloadrestriction restrictedforreaders|restrictedforwriters [<Boolean>])|
         (keeprevisionforever|pinned)|
         (lastviewedbyme <Time>)|
         (mimetype <MimeType>)|
@@ -7071,6 +7079,10 @@ gam <UserTypeEntity> collect orphans
         contentrestrictions.restrictiontime|
         contentrestrictions.type
 
+<DriveDownloadRestrictionsSubfieldName> ::=
+  downloadrestrictions.itemdownloadrestriction|
+  downloadrestrictions.effectivedownloadrestrictionwithcontext
+
 <ClassificationLabelInfoSubfieldName> ::=
         labels.id|              # modifiedByMe
         labels.revisionid|      # copyRequiresWriterPermission
@@ -7164,6 +7176,8 @@ gam <UserTypeEntity> collect orphans
         copyrequireswriterpermission|
         createddate|createdtime|
         description|
+        downloadrestictions|
+        <DriveDownloadRestrictionsSubfieldName>|
         driveid|
         drivename|
         editable|
@@ -8696,3 +8710,11 @@ gam <UserTypeEntity> print youtubechannels [todrive <ToDriveAttribute>*]
 gam create|add verify|verification <DomainName>
 gam update verify|verification <DomainName> cname|txt|text|site|file
 gam info verify|verification
+
+# Web Resourses and Sites
+
+gam <UserTypeEntity> show webresources
+gam <UserTypeEntity> print webresources [todrive <ToDriveAttribute>*]
+gam <UserTypeEntity> show webmastersites
+gam <UserTypeEntity> print webmastersites [todrive <ToDriveAttribute>*]
+```

src/GamUpdate.txt

@@ -1,3 +1,62 @@
+7.18.00
+
+Added commands to display Business Profile Accounts.
+These are special purpose commands and will not generally be used.
+```
+gam show businessprofileaccounts
+gam print businessprofileaccounts [todrive <ToDriveAttribute>*]
+```
+
+7.17.03
+
+Fixed bug in `gam <UserItem> print|show chatspaces asadmin fields <ChatSpaceFieldNameList>` that caused a trap
+when `displayname` was not in `<ChatSpaceFieldNameList>`.
+
+7.17.02
+
+Updated `gam <UserTypeEntity> print|show webmastersites` to handle the following error
+that occurs if you haven't updated your project to include the Google Search Console API.
+```
+ERROR: 403: permissionDenied - Google Search Console API has not been used in project 111055363999 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/searchconsole.googleapis.com/overview?project=111055363999 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
+```
+
+7.17.01
+
+Fixed bug in `gam <UserTypeEntity> show webmastersites` that caused a trap.
+
+7.17.00
+
+Added commands to discover Sites and WebResources that managed users (previously unmanaged) may have access to for better governance and visibility.
+These are special purpose commands and will not generally be used.
+```
+gam <UserTypeEntity> show webresources
+gam <UserTypeEntity> print webresources [todrive <ToDriveAttribute>*]
+gam <UserTypeEntity> show webmastersites
+gam <UserTypeEntity> print webmastersites [todrive <ToDriveAttribute>*]
+```
+
+7.16.01
+
+The Drive API now supports setting download restrictions on individual files.
+
+Added `downloadrestictions` and `<DriveDownloadRestrictionsSubfieldName>` to `<DriveFieldName>`.
+```
+<DriveDownloadRestrictionsSubfieldName> ::=
+  downloadrestrictions.itemdownloadrestriction|
+  downloadrestrictions.effectivedownloadrestrictionwithcontext
+```
+
+Added `itemdownloadrestriction restrictedforreaders|restrictedforwriters [<Boolean>]`
+to `<DriveFileAttribute>`.
+
+From the Drive API documentation:
+```
+itemDownloadRestriction - The download restriction of the file applied directly by the owner or organizer. This does not take into account shared drive settings or DLP rules.
+effectiveDownloadRestrictionWithContext - Output only. The effective download restriction applied to this file. This considers all restriction settings and DLP rules.
+restrictedForReaders - Whether download and copy is restricted for readers.
+restrictedForWriters - Whether download and copy is restricted for writers. If true, download is also restricted for readers.
+```
+
 7.16.00
 
 Removed `drive_v3_native_names` from `gam.cfg`; GAM now only uses Drive API v3 fields names on output.

src/gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.16.00'
+__version__ = '7.18.00'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -5579,7 +5579,12 @@ def buildGAPIObject(api, credentials=None):
     try:
       API_Scopes = set(list(service._rootDesc['auth']['oauth2']['scopes']))
     except KeyError:
-      API_Scopes = set(API.VAULT_SCOPES) if api == API.VAULT else set()
+      if api == API.VAULT:
+        API_Scopes = set(API.VAULT_SCOPES)
+      elif api == API.BUSINESSACCOUNTMANAGEMENT:
+        API_Scopes = {API.BUSINESSACCOUNTMANAGEMENT_SCOPE}
+      else:
+        API_Scopes = set()
     GM.Globals[GM.CURRENT_CLIENT_API] = api
     GM.Globals[GM.CURRENT_CLIENT_API_SCOPES] = API_Scopes.intersection(GM.Globals[GM.CREDENTIALS_SCOPES])
     if api not in API.SCOPELESS_APIS and not GM.Globals[GM.CURRENT_CLIENT_API_SCOPES]:
@@ -5688,19 +5693,22 @@ def getUserEmailFromID(uid, cd):
   try:
     result = callGAPI(cd.users(), 'get',
                       throwReasons=GAPI.USER_GET_THROW_REASONS,
+                      retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                       userKey=uid, fields='primaryEmail')
     return result.get('primaryEmail')
   except (GAPI.userNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden,
-          GAPI.badRequest, GAPI.backendError, GAPI.systemError):
+          GAPI.badRequest, GAPI.backendError, GAPI.systemError, GAPI.serviceNotAvailable):
     return None
 
 def getGroupEmailFromID(uid, cd):
   try:
     result = callGAPI(cd.groups(), 'get',
                       throwReasons=GAPI.GROUP_GET_THROW_REASONS,
+                      retryReasons=GAPI.SERVICE_NOT_AVAILABLE_RETRY_REASONS,
                       groupKey=uid, fields='email')
     return result.get('email')
-  except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden, GAPI.badRequest):
+  except (GAPI.groupNotFound, GAPI.domainNotFound, GAPI.domainCannotUseApis, GAPI.forbidden,
+          GAPI.badRequest, GAPI.serviceNotAvailable):
     return None
 
 def getServiceAccountEmailFromID(account_id, sal=None):
@@ -26937,7 +26945,7 @@ def printShowChatSpaces(users):
     substituteQueryTimes(queries, queryTimes)
     pfilter = kwargsCS['query'] = queries[0]
     kwargsCS['useAdminAccess'] = True
-    sortName = 'displayName'
+    sortName = 'displayName' if 'displayName' in fieldsList else 'name'
   else:
     sortName = 'name'
   for user in users:
@@ -46963,8 +46971,8 @@ def doCreateSiteVerification():
   printKeyValueList(['Meta HTML Header Data', webserver_meta_record['token']])
   printBlankLine()
 
-def _showSiteVerificationInfo(site):
-  printKeyValueList(['Site', site['site']['identifier']])
+def _showSiteVerificationInfo(site, i=0, count=0):
+  printKeyValueListWithCount(['Site', site['site']['identifier']], i, count)
   Ind.Increment()
   printKeyValueList(['ID', unquote(site['id'])])
   printKeyValueList(['Type', site['site']['type']])
@@ -47066,17 +47074,138 @@ def doUpdateSiteVerification():
   _showSiteVerificationInfo(verify_result)
   printKeyValueList([Msg.YOU_CAN_ADD_DOMAIN_TO_ACCOUNT.format(a_domain, GC.Values[GC.DOMAIN])])
 
+PROFILE_ACCOUNT_TYPE_MAP = {
+  'locationgroup': 'LOCATION_GROUP',
+  'organization': 'ORGANIZATION',
+  'personal': 'PERSONAL',
+  'usergroup': 'USER_GROUP',
+  }
+
+# gam show businessprofileaccounts
+#	[type locationgroup|organization|personal|usergroup]
+# gam print businessprofileaccounts [todrive <ToDriveAttribute>*]
+#	[type locationgroup|organization|personal|usergroup]
+def doPrintShowBusinessProfileAccounts():
+  bp = buildGAPIObject(API.BUSINESSACCOUNTMANAGEMENT)
+  csvPF = CSVPrintFile(['name', 'accountName']) if Act.csvFormat() else None
+  kwargs = {}
+  while Cmd.ArgumentsRemaining():
+    myarg = getArgument()
+    if csvPF and myarg == 'todrive':
+      csvPF.GetTodriveParameters()
+    elif myarg == 'type':
+      kwargs['filter'] = f'type={getChoice(PROFILE_ACCOUNT_TYPE_MAP, mapChoice=True)}'
+    else:
+      unknownArgumentExit()
+  try:
+    accounts = callGAPIpages(bp.accounts(), 'list', 'accounts',
+                             throwReasons=[GAPI.PERMISSION_DENIED],
+                             **kwargs)
+  except GAPI.permissionDenied as e:
+    accessErrorExitNonDirectory(API.BUSINESSACCOUNTMANAGEMENT, str(e))
+  if not csvPF:
+    count = len(accounts)
+    i = 0
+    for account in sorted(accounts, key=lambda k: k['name']):
+      i += 1
+      printKeyValueListWithCount(['Account', account['name']], i, count)
+      Ind.Increment()
+      showJSON(None, account)
+      Ind.Decrement()
+  else:
+    for account in accounts:
+      row = flattenJSON(account, flattened={'name': account['name'], 'accountName': account['accountName']})
+      csvPF.WriteRowTitles(row)
+  if csvPF:
+    csvPF.writeCSVfile('Business Profile Accounts')
+
 # gam info verify|verification
 def doInfoSiteVerification():
   verif = buildGAPIObject(API.SITEVERIFICATION)
   checkForExtraneousArguments()
   sites = callGAPIitems(verif.webResource(), 'list', 'items')
   if sites:
+    count = len(sites)
+    i = 0
     for site in sorted(sites, key=lambda k: (k['site']['type'], k['site']['identifier'])):
-      _showSiteVerificationInfo(site)
+      i += 1
+      _showSiteVerificationInfo(site, i, count)
   else:
     printKeyValueList(['No Sites Verified.'])
 
+# gam <UserTypeEntity> show webresources
+# gam <UserTypeEntity> print webresources [todrive <ToDriveAttribute>*]
+def printShowWebResources(users):
+  csvPF = CSVPrintFile(['User', 'site.identifier']) if Act.csvFormat() else None
+  while Cmd.ArgumentsRemaining():
+    myarg = getArgument()
+    if csvPF and myarg == 'todrive':
+      csvPF.GetTodriveParameters()
+    else:
+      unknownArgumentExit()
+  i, count, users = getEntityArgument(users)
+  for user in users:
+    i += 1
+    user, verif = buildGAPIServiceObject(API.SITEVERIFICATION, user, i, count)
+    if not verif:
+      continue
+    sites = callGAPIitems(verif.webResource(), 'list', 'items')
+    jcount = len(sites)
+    if not csvPF:
+      entityPerformActionNumItems([Ent.USER, user], jcount, Ent.WEB_RESOURCE, i, count)
+      Ind.Increment()
+      j = 0
+      for site in sorted(sites, key=lambda k: (k['site']['type'], k['site']['identifier'])):
+        j += 1
+        _showSiteVerificationInfo(site, j, jcount)
+      Ind.Decrement()
+    else:
+      for site in sites:
+        row = flattenJSON(site, flattened={'User': user})
+        csvPF.WriteRowTitles(row)
+  if csvPF:
+    csvPF.writeCSVfile('Web Resources')
+
+# gam <UserTypeEntity> show webmastersites
+# gam <UserTypeEntity> print webmastersites [todrive <ToDriveAttribute>*]
+def printShowWebMasterSites(users):
+  csvPF = CSVPrintFile(['User', 'siteUrl']) if Act.csvFormat() else None
+  while Cmd.ArgumentsRemaining():
+    myarg = getArgument()
+    if csvPF and myarg == 'todrive':
+      csvPF.GetTodriveParameters()
+    else:
+      unknownArgumentExit()
+  i, count, users = getEntityArgument(users)
+  for user in users:
+    i += 1
+    user, searchconsole = buildGAPIServiceObject(API.SEARCHCONSOLE, user, i, count)
+    if not searchconsole:
+      continue
+    try:
+      sites = callGAPIitems(searchconsole.sites(), 'list', 'siteEntry',
+                            throwReasons=[GAPI.PERMISSION_DENIED])
+    except GAPI.permissionDenied as e:
+      accessErrorExitNonDirectory(API.SEARCHCONSOLE, str(e))
+    jcount = len(sites)
+    if not csvPF:
+      entityPerformActionNumItems([Ent.USER, user], jcount, Ent.WEB_MASTERSITE, i, count)
+      Ind.Increment()
+      j = 0
+      for site in sorted(sites, key=lambda k: k['siteUrl']):
+        j += 1
+        printKeyValueListWithCount(['Site', site['siteUrl']], j, jcount)
+        Ind.Increment()
+        printKeyValueList(['permissionLevel', site['permissionLevel']])
+        Ind.Decrement()
+      Ind.Decrement()
+    else:
+      for site in sites:
+        row = flattenJSON(site, flattened={'User': user})
+        csvPF.WriteRowTitles(row)
+  if csvPF:
+    csvPF.writeCSVfile('Web Master Sites')
+
 def checkCourseExists(croom, courseId, i=0, count=0, entityType=Ent.COURSE):
   courseId = addCourseIdScope(courseId)
   try:
@@ -53817,6 +53946,13 @@ DRIVE_FILE_CONTENT_RESTRICTIONS_CHOICE_MAP = {
   'ownerrestricted': 'ownerRestricted',
   }
 
+DRIVE_FILE_ITEM_DOWNLOAD_RESTRICTION_CHOICE_MAP = {
+  'downloadrestrictedforreaders': 'restrictedForReaders',
+  'downloadrestrictedforwriters': 'restrictedForWriters',
+  'restrictedforreaders': 'restrictedForReaders',
+  'restrictedforwriters': 'restrictedForWriters',
+  }
+
 def getDriveFileProperty(visibility=None):
   key = getString(Cmd.OB_PROPERTY_KEY)
   value = getString(Cmd.OB_PROPERTY_VALUE, minLen=0) or None
@@ -53868,6 +54004,20 @@ def getDriveFileAddRemoveParentAttribute(myarg, parameters):
     return False
   return True
 
+def _getDriveFileDownloadRestrictions(myarg, body):
+  subField = myarg
+  if subField.startswith('downloadrestrictions.'):
+    _, subField = subField.split('.', 1)
+  if subField.startswith('itemdownloadrestriction.'):
+    _, subField = subField.split('.', 1)
+  if subField == 'itemdownloadrestriction':
+    subField = getChoice(DRIVE_FILE_ITEM_DOWNLOAD_RESTRICTION_CHOICE_MAP)
+  if subField in DRIVE_FILE_ITEM_DOWNLOAD_RESTRICTION_CHOICE_MAP:
+    body.setdefault('downloadRestrictions', {'itemDownloadRestriction': {}})
+    body['downloadRestrictions']['itemDownloadRestriction'][DRIVE_FILE_ITEM_DOWNLOAD_RESTRICTION_CHOICE_MAP[subField]] = getBoolean()
+    return True
+  return False
+
 def getDriveFileCopyAttribute(myarg, body, parameters):
   if myarg == 'ignoredefaultvisibility':
     parameters[DFA_IGNORE_DEFAULT_VISIBILITY] = getBoolean()
@@ -53903,6 +54053,8 @@ def getDriveFileCopyAttribute(myarg, body, parameters):
           else:
             Cmd.Backup()
             usageErrorExit(Msg.REASON_ONLY_VALID_WITH_CONTENTRESTRICTIONS_READONLY_TRUE)
+  elif _getDriveFileDownloadRestrictions(myarg, body):
+    pass
   elif myarg == 'inheritedpermissionsdisabled':
     body['inheritedPermissionsDisabled'] = getBoolean()
   elif myarg == 'property':
@@ -54657,6 +54809,7 @@ DRIVE_FIELDS_CHOICE_MAP = {
   'createddate': 'createdTime',
   'createdtime': 'createdTime',
   'description': 'description',
+  'downloadrestrictions': 'downloadRestrictions',
   'driveid': 'driveId',
   'drivename': 'driveId',
   'editable': 'capabilities.canEdit',
@@ -54803,6 +54956,11 @@ DRIVE_CONTENT_RESTRICTIONS_SUBFIELDS_CHOICE_MAP = {
   'type': 'type',
   }
 
+DRIVE_DOWNLOAD_RESTRICTIONS_SUBFIELDS_CHOICE_MAP = {
+  'itemdownloadrestriction': 'itemDownloadRestriction',
+  'effectivedownloadrestrictionwithcontext': 'effectiveDownloadRestrictionWithContext',
+  }
+
 DRIVE_LABELINFO_SUBFIELDS_CHOICE_MAP = {
   'id': 'labels(id)',
   'fields': 'labels(fields)',
@@ -54867,6 +55025,7 @@ DRIVE_SHORTCUTDETAILS_SUBFIELDS_CHOICE_MAP = {
 DRIVE_SUBFIELDS_CHOICE_MAP = {
   'capabilities': DRIVE_CAPABILITIES_SUBFIELDS_CHOICE_MAP,
   'contentrestrictions': DRIVE_CONTENT_RESTRICTIONS_SUBFIELDS_CHOICE_MAP,
+  'downloadrestrictions': DRIVE_DOWNLOAD_RESTRICTIONS_SUBFIELDS_CHOICE_MAP,
   'labelinfo': DRIVE_LABELINFO_SUBFIELDS_CHOICE_MAP,
   'labels': DRIVE_LABEL_CHOICE_MAP,
   'lastmodifyinguser': DRIVE_SHARINGUSER_SUBFIELDS_CHOICE_MAP,
@@ -77128,6 +77287,7 @@ MAIN_COMMANDS_WITH_OBJECTS = {
       Cmd.ARG_BROWSER:		doPrintShowBrowsers,
       Cmd.ARG_BROWSERTOKEN:	doPrintShowBrowserTokens,
       Cmd.ARG_BUILDING:		doPrintShowBuildings,
+      Cmd.ARG_BUSINESSPROFILEACCOUNT:	doPrintShowBusinessProfileAccounts,
       Cmd.ARG_CAALEVEL:		doPrintShowCAALevels,
       Cmd.ARG_CHANNELCUSTOMER:	doPrintShowChannelCustomers,
       Cmd.ARG_CHANNELCUSTOMERENTITLEMENT:	doPrintShowChannelCustomerEntitlements,
@@ -77261,6 +77421,7 @@ MAIN_COMMANDS_WITH_OBJECTS = {
       Cmd.ARG_BROWSER:		doPrintShowBrowsers,
       Cmd.ARG_BROWSERTOKEN:	doPrintShowBrowserTokens,
       Cmd.ARG_BUILDING:		doPrintShowBuildings,
+      Cmd.ARG_BUSINESSPROFILEACCOUNT:	doPrintShowBusinessProfileAccounts,
       Cmd.ARG_CAALEVEL:		doPrintShowCAALevels,
       Cmd.ARG_CHANNELCUSTOMER:	doPrintShowChannelCustomers,
       Cmd.ARG_CHANNELCUSTOMERENTITLEMENT:	doPrintShowChannelCustomerEntitlements,
@@ -77447,6 +77608,7 @@ MAIN_COMMANDS_OBJ_ALIASES = {
   Cmd.ARG_BUCKET:		Cmd.ARG_STORAGEBUCKET,
   Cmd.ARG_BUCKETS:		Cmd.ARG_STORAGEBUCKET,
   Cmd.ARG_BUILDINGS:		Cmd.ARG_BUILDING,
+  Cmd.ARG_BUSINESSPROFILEACCOUNTS:	Cmd.ARG_BUSINESSPROFILEACCOUNT,
   Cmd.ARG_CAALEVELS:		Cmd.ARG_CAALEVEL,
   Cmd.ARG_CHATMEMBERS:		Cmd.ARG_CHATMEMBER,
   Cmd.ARG_CHANNELCUSTOMERS:	Cmd.ARG_CHANNELCUSTOMER,
@@ -78268,6 +78430,8 @@ USER_COMMANDS_WITH_OBJECTS = {
       Cmd.ARG_USERLIST:		doPrintUserList,
       Cmd.ARG_VACATION:		printShowVacation,
       Cmd.ARG_VAULTHOLD:	printShowUserVaultHolds,
+      Cmd.ARG_WEBMASTERSITE:	printShowWebMasterSites,
+      Cmd.ARG_WEBRESOURCE:	printShowWebResources,
       Cmd.ARG_WORKINGLOCATION:	printShowWorkingLocation,
       Cmd.ARG_YOUTUBECHANNEL:	printShowYouTubeChannel,
      }
@@ -78378,6 +78542,8 @@ USER_COMMANDS_WITH_OBJECTS = {
       Cmd.ARG_TOKEN:		printShowTokens,
       Cmd.ARG_VAULTHOLD:	printShowUserVaultHolds,
       Cmd.ARG_VACATION:		printShowVacation,
+      Cmd.ARG_WEBMASTERSITE:	printShowWebMasterSites,
+      Cmd.ARG_WEBRESOURCE:	printShowWebResources,
       Cmd.ARG_WORKINGLOCATION:	printShowWorkingLocation,
       Cmd.ARG_YOUTUBECHANNEL:	printShowYouTubeChannel,
      }
@@ -78629,6 +78795,8 @@ USER_COMMANDS_OBJ_ALIASES = {
   Cmd.ARG_USERS:		Cmd.ARG_USER,
   Cmd.ARG_VAULTHOLDS:		Cmd.ARG_VAULTHOLD,
   Cmd.ARG_VERIFICATIONCODES:	Cmd.ARG_BACKUPCODE,
+  Cmd.ARG_WEBMASTERSITES:	Cmd.ARG_WEBMASTERSITE,
+  Cmd.ARG_WEBRESOURCES: 	Cmd.ARG_WEBRESOURCE,
   Cmd.ARG_WORKINGLOCATIONS:	Cmd.ARG_WORKINGLOCATION,
   Cmd.ARG_YOUTUBECHANNELS:	Cmd.ARG_YOUTUBECHANNEL,
   }

src/gam/gamlib/glapi.py

@@ -24,6 +24,7 @@ ACCESSCONTEXTMANAGER = 'accesscontextmanager'
 ALERTCENTER = 'alertcenter'
 ANALYTICS_ADMIN = 'analyticsadmin'
 CALENDAR = 'calendar'
+BUSINESSACCOUNTMANAGEMENT = 'mybusinessaccountmanagement'
 CBCM = 'cbcm'
 CHAT = 'chat'
 CHAT_CUSTOM_EMOJIS = 'chatcustomemojis'
@@ -85,6 +86,7 @@ PRINTERS = 'printers'
 PUBSUB = 'pubsub'
 REPORTS = 'reports'
 RESELLER = 'reseller'
+SEARCHCONSOLE = 'searchconsole'
 SERVICEACCOUNTLOOKUP = 'serviceaccountlookup'
 SERVICEMANAGEMENT = 'servicemanagement'
 SERVICEUSAGE = 'serviceusage'
@@ -100,6 +102,7 @@ TASKS = 'tasks'
 VAULT = 'vault'
 YOUTUBE = 'youtube'
 #
+BUSINESSACCOUNTMANAGEMENT_SCOPE = 'https://www.googleapis.com/auth/business.manage'
 CHROMEVERSIONHISTORY_URL = 'https://versionhistory.googleapis.com/v1/chrome/platforms'
 DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive'
 GMAIL_SEND_SCOPE = 'https://www.googleapis.com/auth/gmail.send'
@@ -173,6 +176,7 @@ PROJECT_APIS = [
   'alertcenter.googleapis.com',
   'analyticsadmin.googleapis.com',
 #  'audit.googleapis.com',
+  'mybusinessaccountmanagement.googleapis.com',
   'calendar-json.googleapis.com',
   'chat.googleapis.com',
   'chromemanagement.googleapis.com',
@@ -198,6 +202,7 @@ PROJECT_APIS = [
   'people.googleapis.com',
   'pubsub.googleapis.com',
   'reseller.googleapis.com',
+  'searchconsole.googleapis.com',
   'sheets.googleapis.com',
   'siteverification.googleapis.com',
   'storage-api.googleapis.com',
@@ -211,6 +216,7 @@ _INFO = {
   ACCESSCONTEXTMANAGER: {'name': 'Access Context Manager API', 'version': 'v1', 'v2discovery': True},
   ALERTCENTER: {'name': 'AlertCenter API', 'version': 'v1beta1', 'v2discovery': True},
   ANALYTICS_ADMIN: {'name': 'Analytics Admin API', 'version': 'v1beta', 'v2discovery': True},
+  BUSINESSACCOUNTMANAGEMENT: {'name': 'Business Account Management API', 'version': 'v1', 'v2discovery': True},
   CALENDAR: {'name': 'Calendar API', 'version': 'v3', 'v2discovery': True, 'mappedAPI': 'calendar-json'},
   CBCM: {'name': 'Chrome Browser Cloud Management API', 'version': 'v1.1beta1', 'v2discovery': True, 'localjson': True},
   CHAT: {'name': 'Chat API', 'version': 'v1', 'v2discovery': True},
@@ -271,6 +277,7 @@ _INFO = {
   PUBSUB: {'name': 'Pub / Sub API', 'version': 'v1', 'v2discovery': True},
   REPORTS: {'name': 'Reports API', 'version': 'reports_v1', 'v2discovery': True, 'mappedAPI': 'admin'},
   RESELLER: {'name': 'Reseller API', 'version': 'v1', 'v2discovery': True},
+  SEARCHCONSOLE: {'name': 'Search Console API', 'version': 'v1', 'v2discovery': True},
   SERVICEACCOUNTLOOKUP: {'name': 'Service Account Lookup pseudo-API', 'version': 'v1', 'v2discovery': True, 'localjson': True},
   SERVICEMANAGEMENT: {'name': 'Service Management API', 'version': 'v1', 'v2discovery': True},
   SERVICEUSAGE: {'name': 'Service Usage API', 'version': 'v1', 'v2discovery': True},
@@ -290,6 +297,11 @@ _INFO = {
 READONLY = ['readonly',]
 
 _CLIENT_SCOPES = [
+  {'name': 'Business Account Management API',
+   'api': BUSINESSACCOUNTMANAGEMENT,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': BUSINESSACCOUNTMANAGEMENT_SCOPE},
   {'name': 'Calendar API',
    'api': CALENDAR,
    'subscopes': READONLY,
@@ -697,10 +709,20 @@ _SVCACCT_SCOPES = [
    'api': PEOPLE_OTHERCONTACTS,
    'subscopes': [],
    'scope': 'https://www.googleapis.com/auth/contacts.other.readonly'},
+  {'name': 'Search Console  API - read only',
+   'api': SEARCHCONSOLE,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/webmasters.readonly'},
   {'name': 'Sheets API',
    'api': SHEETS,
    'subscopes': READONLY,
    'scope': 'https://www.googleapis.com/auth/spreadsheets'},
+  {'name': 'Site Verification API',
+   'api': SITEVERIFICATION,
+   'subscopes': [],
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/siteverification'},
   {'name': 'Tag Manager API - Accounts, Containers, Workspaces, Tags - read only',
    'api': TAGMANAGER,
    'subscopes': [],

src/gam/gamlib/glclargs.py

@@ -441,6 +441,8 @@ class GamCLArgs():
   ARG_BUCKETS = 'buckets'
   ARG_BUILDING = 'building'
   ARG_BUILDINGS = 'buildings'
+  ARG_BUSINESSPROFILEACCOUNT = 'businessprofileaccount'
+  ARG_BUSINESSPROFILEACCOUNTS = 'businessprofileaccounts'
   ARG_CAALEVEL = 'caalevel'
   ARG_CAALEVELS = 'caalevels'
   ARG_CALATTENDEES = 'calattendees'
@@ -830,6 +832,10 @@ class GamCLArgs():
   ARG_VERIFICATION = 'verification'
   ARG_VERIFICATIONCODES = 'verificationcodes'
   ARG_VERIFY = 'verify'
+  ARG_WEBMASTERSITE = 'webmastersite'
+  ARG_WEBMASTERSITES = 'webmastersites'
+  ARG_WEBRESOURCE = 'webresource'
+  ARG_WEBRESOURCES = 'webresources'
   ARG_WORKINGLOCATION = 'workinglocation'
   ARG_WORKINGLOCATIONS = 'workinglocations'
   ARG_YOUTUBECHANNEL = 'youtubechannel'

src/gam/gamlib/glentity.py

@@ -75,6 +75,7 @@ class GamEntity():
   BACKUP_VERIFICATION_CODES = 'buvc'
   BUILDING = 'bldg'
   BUILDING_ID = 'bldi'
+  BUSINESS_PROFILE_ACCOUNT = 'bpac'
   CAA_LEVEL = 'calv'
   CALENDAR = 'cale'
   CALENDAR_ACL = 'cacl'
@@ -394,6 +395,8 @@ class GamEntity():
   VAULT_MATTER_ID = 'vlmi'
   VAULT_OPERATION = 'vlto'
   VAULT_QUERY = 'vltq'
+  WEB_MASTERSITE = 'wems'
+  WEB_RESOURCE = 'were'
   WEBCLIPS_ENABLED = 'webc'
   YOUTUBE_CHANNEL = 'ytch'
   # _NAMES[0] is plural, _NAMES[1] is singular unless the item name is explicitly plural (Calendar Settings)
@@ -432,6 +435,7 @@ class GamEntity():
     BACKUP_VERIFICATION_CODES: ['Backup Verification Codes', 'Backup Verification Codes'],
     BUILDING: ['Buildings', 'Building'],
     BUILDING_ID: ['Building IDs', 'Building ID'],
+    BUSINESS_PROFILE_ACCOUNT: ['Business Profile Accounts', 'Business Profile Account'],
     CAA_LEVEL: ['CAA Levels', 'CAA Level'],
     CALENDAR: ['Calendars', 'Calendar'],
     CALENDAR_ACL: ['Calendar ACLs', 'Calendar ACL'],
@@ -752,6 +756,8 @@ class GamEntity():
     VAULT_OPERATION: ['Vault Operations', 'Vault Operation'],
     VAULT_QUERY: ['Vault Queries', 'Vault Query'],
     WEBCLIPS_ENABLED: ['Web Clips Enabled', 'Web Clips Enabled'],
+    WEB_MASTERSITE: ['Web Master Sites', 'Web Master Site'],
+    WEB_RESOURCE: ['Web Resources', 'Web Resource'],
     YOUTUBE_CHANNEL: ['YouTube Channels', 'YouTube Channel'],
     ROLE_MANAGER: ['Managers', 'Manager'],
     ROLE_MEMBER: ['Members', 'Member'],

wiki/Drive-REST-API-v3.md

@@ -1,15 +1,13 @@
-!All Google Drive API calls have been converted from v2 to v3, see: https://developers.google.com/drive/v3/web/migration
-Many of the changes are internal to Gam and have no visible effect. Google has modified/renamed many field names and these will affect scripts that parse the output from `gam print/show drivesettings/drivefileacls/fileinfo/filelist/filerevisions`. Additionally, Google has dropped some fields and their values are no longer available. On input, Gam accepts both the old and new field names.
+Legacy GAM used Drive API v2, GAM7 uses  Drive API v3. See: https://developers.google.com/drive/v3/web/migration
+Many of the changes are internal to GAM7 and have no visible effect.
+Google has modified/renamed many field names and these will affect scripts that parse the output from `gam print/show drivesettings/drivefileacls/fileinfo/filelist/filerevisions`.
+Additionally, Google has dropped some fields and their values are no longer available. On input, GAM7 accepts both the old and new field names where applicable.
 
-A variable, `drive_v3_native_names` (default value is True), has been added to `gam.cfg` to control the field names on output: when True, the v3 native field names are used; when False, the v3 native field names are mapped to the v2 field names.
-
-If you have scripts that process the output from these print commands, you may have to make modifications to your scripts.
-Run your print/show commands with a version of Legacy Gam and save the output.
-With drive_v3_native_names = False, run your print/show commands with this version of Gam and compare the output to that saved in the previous run;
+If you use Legacy GAM and have scripts that process the output from these print commands, you may have to make modifications to your scripts when you upgrade to GAM7.
+Run your print/show commands with a version of Legacy GAM and save the output.
+Run your print/show commands with GAM7 and compare the output to that saved in the previous run;
 modify your scripts that process the output as appropriate.
 
-There is a cost to mapping the v3 field names back to the v2 field names; you can avoid this cost by setting drive_v3_native_names = True,
-running your print/show commands, comparing the output and making the appropriate script modifications.
 ```
 print/show drivesettings
 Dropped fields:
@@ -30,7 +28,7 @@ Dropped fields:
         authKey
 Renamed fields (Old->New):
         name->displayName
-        withLink->allowFileDiscovery
+        withLink->allowFileDiscovery - value is complemented
 
 print/show fileinfo/filelist
 Dropped fields:
@@ -40,19 +38,20 @@ Dropped fields:
         labels(hidden)
         markedViewedByMeDate
         openWithLinks
-        selfLink
+        ownerNames
         parents(isRoot)
         parents(parentLink)
         parents(selfLink)
         permissions(selfLink)
         selfLink
-        userPermission(selfLink)
+        userPermission
 Renamed fields (Old->New):
         alternateLink->webViewLink
         capabilities(canChangeRestrictedDownload)->capabilities(canChangeViewersCanCopyContent)
         createdDate->createdTime
         expirationDate->expirationTime
         fileSize->size
+        lastModifyingUserName->lastModifyingUser(displayName)
         lastViewedByMeDate->viewedByMeTime
         modified->modifiedByMe
         modifiedByMeDate->modifiedByMeTime
@@ -76,18 +75,3 @@ Renamed fields (Old->New):
         picture.url->photoLink
         pinned->keepForever
 ```
-The parents field of a file has undergone the most change. In Drive v2 it was a list of compound items with three sub-fields per item: id, isRoot, parentLink.
-In Drive v3 the parents field is a list of simple items, the parent ids. The following examples show how the parents field is output in a CSV file for a file with two parents.
-```
-Previous versions of Gam:
-Owner,title,parents,parents.0.isRoot,parents.0.id,parents.0.parentLink,parents.1.isRoot,parents.1.id,parents.1.parentLink
-testuser@domain.com,TestFile,2,True,PPPP1111,https://www.googleapis.com/drive/v2/files/PPPP1111,False,PPPP2222,https://www.googleapis.com/drive/v2/files/PPPP2222
-
-Current version of Gam with drive_v3_name_names = false
-Owner,title,parents,parents.0.id,parents.1.id
-testuser@domain.com,TestFile,2,PPPP1111,PPPP2222
-
-Current version of Gam with drive_v3_name_names = true
-Owner,name,parents
-testuser@domain.com,TestFile,PPPP1111 PPPP2222
-```

wiki/GamUpdates.md

@@ -10,6 +10,63 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.17.03
+
+Fixed bug in `gam <UserItem> print|show chatspaces asadmin fields <ChatSpaceFieldNameList>` that caused a trap
+when `displayname` was not in `<ChatSpaceFieldNameList>`.
+
+### 7.17.02
+
+Updated `gam <UserTypeEntity> print|show webmastersites` to handle the following error
+that occurs if you haven't updated your project to include the Google Search Console API.
+```
+ERROR: 403: permissionDenied - Google Search Console API has not been used in project 111055363999 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/searchconsole.googleapis.com/overview?project=111055363999 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
+```
+
+### 7.17.01
+
+Fixed bug in `gam <UserTypeEntity> show webmastersites` that caused a trap.
+
+### 7.17.00
+
+Added commands to discover Sites and WebResources that managed users (previously unmanaged) may have access to for better governance and visibility.
+These are special purpose commands and will not generally be used.
+```
+gam <UserTypeEntity> show webresources
+gam <UserTypeEntity> print webresources [todrive <ToDriveAttribute>*]
+gam <UserTypeEntity> show webmastersites
+gam <UserTypeEntity> print webmastersites [todrive <ToDriveAttribute>*]
+```
+
+### 7.16.01
+
+The Drive API now supports setting download restrictions on individual files.
+
+Added `downloadrestictions` and `<DriveDownloadRestrictionsSubfieldName>` to `<DriveFieldName>`.
+```
+<DriveDownloadRestrictionsSubfieldName> ::=
+  downloadrestrictions.itemdownloadrestriction|
+  downloadrestrictions.effectivedownloadrestrictionwithcontext
+```
+
+Added `itemdownloadrestriction (restrictedforreaders [<Boolean>]) (restrictedforwriters [<Boolean>])`
+to `<DriveFileAttribute>`.
+
+From the Drive API documentation:
+```
+itemDownloadRestriction - The download restriction of the file applied directly by the owner or organizer. This does not take into account shared drive settings or DLP rules.
+effectiveDownloadRestrictionWithContext - Output only. The effective download restriction applied to this file. This considers all restriction settings and DLP rules.
+restrictedForReaders - Whether download and copy is restricted for readers.
+restrictedForWriters - Whether download and copy is restricted for writers. If true, download is also restricted for readers.
+```
+
+### 7.16.00
+
+Removed `drive_v3_native_names` from `gam.cfg`; GAM now only uses Drive API v3 fields names on output.
+If you had `drive_v3_native_names = False` in `gam.cfg` or are updating from Legacy GAM:
+
+* See: https://github.com/GAM-team/GAM/wiki/Drive-REST-API-v3
+
 ### 7.15.01
 
 Added `downloadrestrictions.restrictedforreaders` and `downloadrestrictions.restrictedforwriters`

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -2,6 +2,7 @@
 Use these steps if you have used any version of GAM in your domain. They will update your GAM project
 and all necessary authentications.
 
+- [Drive API v2 to Drive API v3](Drive-REST-v3)
 - [Downloads-Installs](Downloads-Installs)
 - [Linux and MacOS and Google Cloud Shell](#linux-and-mac-os-and-google-cloud-shell)
 - [Windows](#windows)
@@ -251,7 +252,7 @@ writes the credentials into the file oauth2.txt.
 admin@server:/Users/admin$ rm -f /Users/admin/GAMConfig/oauth2.txt
 admin@server:/Users/admin$ gam version
 WARNING: Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: /Users/admin/GAMConfig/oauth2.txt, Not Found
-GAM 7.15.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.17.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -989,7 +990,7 @@ writes the credentials into the file oauth2.txt.
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
 WARNING: Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, Item: oauth2_txt, Value: C:\GAMConfig\oauth2.txt, Not Found
-GAM 7.15.01 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.17.03 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 Windows-10-10.0.17134 AMD64

wiki/Users-Drive-Files-Display.md

@@ -157,12 +157,16 @@
         contentrestrictions.restrictiontime|
         contentrestrictions.type
 
-<DriveLabelInfoSubfieldName> ::=
+<DriveDownloadRestrictionsSubfieldName> ::=
+  downloadrestrictions.itemdownloadrestriction|
+  downloadrestrictions.effectivedownloadrestrictionwithcontext
+
+<ClassificationLabelInfoSubfieldName> ::=
         labels.id|              # modifiedByMe
         labels.revisionid|      # copyRequiresWriterPermission
         labels.fields           # viewedByMe
 
-<DriveLabelsSubfieldName> ::=
+<ClassificationLabelsSubfieldName~> ::=
         labels.modified|        # modifiedByMe
         labels.restricted|      # copyRequiresWriterPermission
         labels.starred|         # starred
@@ -251,6 +255,8 @@
         copyrequireswriterpermission|
         createddate|createdtime|
         description|
+        downloadrestictions|
+        <DriveDownloadRestrictionsSubfieldName>|
         driveid|
         drivename|
         editable|
@@ -269,9 +275,9 @@
         inheritedpermissionsdisabled|
         isappauthorized|
         labelinfo|
-        <DriveLabelInfoSubfieldName>|
+        <ClassificationLabelInfoSubfieldName>|
         labels|
-        <DriveLabelsSubfieldName>|
+        <ClassificationLabelsSubfieldName>|
         lastmodifyinguser|
         <DriveLastModifyingUserSubfieldName>|
         lastmodifyingusername|

wiki/Users-Drive-Files-Manage.md

@@ -125,6 +125,7 @@
         (folderColorRgb <ColorValue>)|
         (indexabletext <String>)|
         (inheritedpermissionsdisabled [<Boolean>])|
+        (itemdownloadrestriction restrictedforreaders|restrictedforwriters [<Boolean>])|
         (keeprevisionforever|pinned)|
         (lastviewedbyme <Time>)|
         (mimetype <MimeType>)|

wiki/Users-Web-Resources-and-Sites.md

@@ -0,0 +1,48 @@
+# Users - Web Resources and Sites
+- [API documentation](#api-documentation)
+- [Introduction](#introduction)
+- [Definitions](#definitions)
+- [Display Web Resources](#display-web-resources)
+- [Display Web Master Sites](#display-web-master-sites)
+
+## API documentation
+* [Web Resources](https://developers.google.com/site-verification/v1/webResource/list)
+* [Web Sites](https://developers.google.com/webmaster-tools/v1/sites/list)
+
+
+## Introduction
+These features were added in version 7.17.00.
+
+To use these commands you add the 'Search Console API' to your project and update your service account authorization.
+```
+gam update project
+gam user user@domain.com update serviceaccount
+...
+[*] 39)  Search Console  API - read only
+[*] 42)  Site Verification API
+
+```
+## Definitions
+* [`<UserTypeEntity>`](Collections-of-Users)
+
+## Display Web Resources
+```
+gam <UserItem> show webresources
+```
+Gam displays the information as an indented list of keys and values.
+
+```
+gam <UserItem> print webresources [todrive <ToDriveAttribute>*]
+```
+Gam displays the information as columns of fields.
+
+## Display Web Master Sites
+```
+gam <UserItem> show webmastersites
+```
+Gam displays the information as an indented list of keys and values.
+
+```
+gam <UserItem> print webmastersites [todrive <ToDriveAttribute>*]
+```
+Gam displays the information as columns of fields.

wiki/Version-and-Help.md

@@ -1,10 +1,9 @@
-k
 # Version and Help
 
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.15.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.17.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -16,7 +15,7 @@ Time: 2023-06-02T21:10:00-07:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.15.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.17.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -28,7 +27,7 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.15.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.17.03 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64
@@ -65,7 +64,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/Admin/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.15.01
+   Latest: 7.17.03
 echo $?
 1
 ```
@@ -73,7 +72,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.15.01
+7.17.03
 ```
 In Linux/MacOS you can do:
 ```
@@ -83,7 +82,7 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.15.01 - https://github.com/GAM-team/GAM
+GAM 7.17.03 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.13.5 64-bit final
 MacOS Sequoia 15.5 x86_64

wiki/_Sidebar.md

@@ -174,6 +174,7 @@ Service Account Access
 * [Users - Tag Manager](Users-Tag-Manager)
 * [Users - Tasks](Users-Tasks)
 * [Users - YouTube](Users-YouTube)
+* [Users - Web Resources and Sites](Users-Web-Resources-and-Sites)
 
 GAM Tutorials
 * [Account Auditing](l-ExamplesAccountAuditing)