// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt
import GoogleType

/// Defines a Google Cloud policy specification which is used to specify
/// constraints for configurations of Google Cloud resources.
public struct PolicySpec: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// An opaque tag indicating the current version of the policySpec, used for
  /// concurrency control.
  ///
  /// This field is ignored if used in a `CreatePolicy` request.
  ///
  /// When the policy is returned from either a `GetPolicy` or a
  /// `ListPolicies` request, this `etag` indicates the version of the
  /// current policySpec to use when executing a read-modify-write loop.
  ///
  /// When the policy is returned from a `GetEffectivePolicy` request, the
  /// `etag` will be unset.
  public var etag: Swift.String = Swift.String()

  /// Output only. The time stamp this was previously updated. This
  /// represents the last time a call to `CreatePolicy` or `UpdatePolicy` was
  /// made for that policy.
  public var updateTime: GoogleCloudWkt.Timestamp? = nil

  /// In policies for boolean constraints, the following requirements apply:
  ///
  ///   - There must be one and only one policy rule where condition is unset.
  ///   - Boolean policy rules with conditions must set `enforced` to the
  ///     opposite of the policy rule without a condition.
  ///   - During policy evaluation, policy rules with conditions that are
  ///     true for a target resource take precedence.
  public var rules: [PolicySpec.PolicyRule] = []

  /// Determines the inheritance behavior for this policy.
  ///
  /// If `inherit_from_parent` is true, policy rules set higher up in the
  /// hierarchy (up to the closest root) are inherited and present in the
  /// effective policy. If it is false, then no rules are inherited, and this
  /// policy becomes the new root for evaluation.
  /// This field can be set only for policies which configure list constraints.
  public var inheritFromParent: Swift.Bool = Swift.Bool()

  /// Ignores policies set above this resource and restores the
  /// `constraint_default` enforcement behavior of the specific constraint at
  /// this resource.
  /// This field can be set in policies for either list or boolean
  /// constraints. If set, `rules` must be empty and `inherit_from_parent`
  /// must be set to false.
  public var reset: Swift.Bool = Swift.Bool()

  /// Initialize a new instance of `PolicySpec`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = PolicySpec().with { $0.etag = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  /// A rule used to express this policy.
  public struct PolicyRule: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// A condition which determines whether this rule is used
    /// in the evaluation of the policy. When set, the `expression` field in
    /// the `Expr' must include from 1 to 10 subexpressions, joined by the "||"
    /// or "&&" operators. Each subexpression must be of the form
    /// "resource.matchTag('<ORG_ID>/tag_key_short_name,
    /// 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id',
    /// 'tagValues/value_id')". where key_name and value_name are the resource
    /// names for Label Keys and Values. These names are available from the Tag
    /// Manager Service. An example expression is:
    /// "resource.matchTag('123456789/environment,
    /// 'prod')". or "resource.matchTagId('tagKeys/123',
    /// 'tagValues/456')".
    public var condition: GoogleType.Expr? = nil

    /// Optional. Required for managed constraints if parameters are defined.
    /// Passes parameter values when policy enforcement is enabled. Ensure that
    /// parameter value types match those defined in the constraint definition.
    /// For example:
    /// {
    ///   "allowedLocations" : ["us-east1", "us-west1"],
    ///   "allowAll" : true
    /// }
    public var parameters: GoogleCloudWkt.Struct? = nil

    public var kind: OneOf_Kind? = nil

    /// Initialize a new instance of `PolicyRule`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = PolicyRule().with { $0.values = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    private enum CodingKeys: Swift.String, CodingKey {
      case values = "values"
      case allowAll = "allowAll"
      case denyAll = "denyAll"
      case enforce = "enforce"
      case condition = "condition"
      case parameters = "parameters"
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.container(keyedBy: CodingKeys.self)
      self.condition = try container.decodeIfPresent(GoogleType.Expr.self, forKey: .condition)
      self.parameters = try container.decodeIfPresent(
        GoogleCloudWkt.Struct.self, forKey: .parameters)

      var kind: OneOf_Kind? = nil
      let kindCheckAndSet = {
        if kind != nil {
          throw DecodingError.dataCorrupted(
            DecodingError.Context(
              codingPath: decoder.codingPath,
              debugDescription: "Multiple values set for oneof 'kind'"))
        }
        kind = $0
      }
      if let values = try container.decodeIfPresent(
        PolicySpec.PolicyRule.StringValues?.self, forKey: .values)
      {
        try kindCheckAndSet(.values(values))
      }
      if let allowAll = try container.decodeIfPresent(Swift.Bool.self, forKey: .allowAll) {
        try kindCheckAndSet(.allowAll(allowAll))
      }
      if let denyAll = try container.decodeIfPresent(Swift.Bool.self, forKey: .denyAll) {
        try kindCheckAndSet(.denyAll(denyAll))
      }
      if let enforce = try container.decodeIfPresent(Swift.Bool.self, forKey: .enforce) {
        try kindCheckAndSet(.enforce(enforce))
      }
      self.kind = kind
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.container(keyedBy: CodingKeys.self)
      try container.encode(self.condition, forKey: .condition)
      try container.encode(self.parameters, forKey: .parameters)

      if let choice = self.kind {
        switch choice {
        case .values(let value):
          try container.encode(value, forKey: .values)
        case .allowAll(let value):
          try container.encode(value, forKey: .allowAll)
        case .denyAll(let value):
          try container.encode(value, forKey: .denyAll)
        case .enforce(let value):
          try container.encode(value, forKey: .enforce)
        }
      }
    }

    /// A message that holds specific allowed and denied values.
    /// This message can define specific values and subtrees of the Resource
    /// Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
    /// are allowed or denied. This is achieved by using the `under:` and
    /// optional `is:` prefixes.
    /// The `under:` prefix is used to denote resource subtree values.
    /// The `is:` prefix is used to denote specific values, and is required only
    /// if the value contains a ":". Values prefixed with "is:" are treated the
    /// same as values with no prefix.
    /// Ancestry subtrees must be in one of the following formats:
    ///
    /// - `projects/<project-id>` (for example, `projects/tokyo-rain-123`)
    /// - `folders/<folder-id>` (for example, `folders/1234`)
    /// - `organizations/<organization-id>` (for example, `organizations/1234`)
    ///
    /// The `supports_under` field of the associated `Constraint`  defines
    /// whether ancestry prefixes can be used.
    public struct StringValues: Codable, Equatable, GoogleCloudWkt._AnyPackable,
      Sendable
    {
      /// List of values allowed at this resource.
      public var allowedValues: [Swift.String] = []

      /// List of values denied at this resource.
      public var deniedValues: [Swift.String] = []

      /// Initialize a new instance of `StringValues`.
      public init() {}

      /// Use `config` to return a new instance of this object, with some fields updated.
      ///
      /// Commonly used to initialize the value, for example:
      ///
      /// ```
      /// let value = StringValues().with { $0.allowedValues = ... }
      /// ```
      public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
        var copy = self
        try config(&copy)
        return copy
      }

      public static var _anyTypeUrl: Swift.String {
        return "type.googleapis.com/google.cloud.orgpolicy.v2.PolicySpec.PolicyRule.StringValues"
      }
      public init(fromAny any: GoogleCloudWkt.`Any`) throws {
        self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
      }
      public func _pack() throws -> GoogleCloudWkt.Struct {
        return try GoogleCloudWkt._slowAnySerialize(message: self)
      }
    }

    public enum OneOf_Kind: Codable, Equatable, Sendable {
      /// List of values to be used for this policy rule. This field can be set
      /// only in policies for list constraints.
      indirect case values(PolicySpec.PolicyRule.StringValues?)
      /// Setting this to true means that all values are allowed. This field can
      /// be set only in policies for list constraints.
      case allowAll(Swift.Bool)
      /// Setting this to true means that all values are denied. This field can
      /// be set only in policies for list constraints.
      case denyAll(Swift.Bool)
      /// If `true`, then the policy is enforced. If `false`, then any
      /// configuration is acceptable.
      /// This field can be set only in policies for boolean constraints.
      case enforce(Swift.Bool)
    }

    public static var _anyTypeUrl: Swift.String {
      return "type.googleapis.com/google.cloud.orgpolicy.v2.PolicySpec.PolicyRule"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.cloud.orgpolicy.v2.PolicySpec"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
