// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt

/// Request message for
/// [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion].
///
/// [google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]: <doc:KeyManagementService/importCryptoKeyVersion(request:)>
public struct ImportCryptoKeyVersionRequest: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the
  /// [CryptoKey][google.cloud.kms.v1.CryptoKey] to be imported into.
  ///
  /// The create permission is only required on this key when creating a new
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
  ///
  /// [google.cloud.kms.v1.CryptoKey]: <doc:CryptoKey>
  /// [google.cloud.kms.v1.CryptoKey.name]: <doc:CryptoKey/name>
  /// [google.cloud.kms.v1.CryptoKeyVersion]: <doc:CryptoKeyVersion>
  public var parent: Swift.String = Swift.String()

  /// Optional. The optional [name][google.cloud.kms.v1.CryptoKeyVersion.name] of
  /// an existing [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to
  /// target for an import operation. If this field is not present, a new
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] containing the
  /// supplied key material is created.
  ///
  /// If this field is present, the supplied key material is imported into
  /// the existing [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. To
  /// import into an existing
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], the
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] must be a child of
  /// [ImportCryptoKeyVersionRequest.parent][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.parent],
  /// have been previously created via
  /// [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion],
  /// and be in
  /// [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]
  /// or
  /// [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED]
  /// state. The key material and algorithm must match the previous
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] exactly if the
  /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] has ever contained
  /// key material.
  ///
  /// [google.cloud.kms.v1.CryptoKeyVersion]: <doc:CryptoKeyVersion>
  /// [google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]: <doc:CryptoKeyVersion/CryptoKeyVersionState/destroyed>
  /// [google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED]: <doc:CryptoKeyVersion/CryptoKeyVersionState/importFailed>
  /// [google.cloud.kms.v1.CryptoKeyVersion.name]: <doc:CryptoKeyVersion/name>
  /// [google.cloud.kms.v1.ImportCryptoKeyVersionRequest.parent]: <doc:ImportCryptoKeyVersionRequest/parent>
  /// [google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]: <doc:KeyManagementService/importCryptoKeyVersion(request:)>
  public var cryptoKeyVersion: Swift.String = Swift.String()

  /// Required. The
  /// [algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
  /// of the key being imported. This does not need to match the
  /// [version_template][google.cloud.kms.v1.CryptoKey.version_template] of the
  /// [CryptoKey][google.cloud.kms.v1.CryptoKey] this version imports into.
  ///
  /// [google.cloud.kms.v1.CryptoKey]: <doc:CryptoKey>
  /// [google.cloud.kms.v1.CryptoKey.version_template]: <doc:CryptoKey/versionTemplate>
  /// [google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]: <doc:CryptoKeyVersion/CryptoKeyVersionAlgorithm>
  public var algorithm: CryptoKeyVersion.CryptoKeyVersionAlgorithm =
    CryptoKeyVersion.CryptoKeyVersionAlgorithm()

  /// Required. The [name][google.cloud.kms.v1.ImportJob.name] of the
  /// [ImportJob][google.cloud.kms.v1.ImportJob] that was used to wrap this key
  /// material.
  ///
  /// [google.cloud.kms.v1.ImportJob]: <doc:ImportJob>
  /// [google.cloud.kms.v1.ImportJob.name]: <doc:ImportJob/name>
  public var importJob: Swift.String = Swift.String()

  /// Optional. The wrapped key material to import.
  ///
  /// Before wrapping, key material must be formatted. If importing symmetric key
  /// material, the expected key material format is plain bytes. If importing
  /// asymmetric key material, the expected key material format is PKCS#8-encoded
  /// DER (the PrivateKeyInfo structure from RFC 5208).
  ///
  /// When wrapping with import methods
  /// ([RSA_OAEP_3072_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256]
  /// or
  /// [RSA_OAEP_4096_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256]
  /// or
  /// [RSA_OAEP_3072_SHA256_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256_AES_256]
  /// or
  /// [RSA_OAEP_4096_SHA256_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256_AES_256]),
  ///
  /// this field must contain the concatenation of:
  /// <ol>
  ///   <li>An ephemeral AES-256 wrapping key wrapped with the
  ///       [public_key][google.cloud.kms.v1.ImportJob.public_key] using
  ///       RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an empty
  ///       label.
  ///   </li>
  ///   <li>The formatted key to be imported, wrapped with the ephemeral AES-256
  ///       key using AES-KWP (RFC 5649).
  ///   </li>
  /// </ol>
  ///
  /// This format is the same as the format produced by PKCS#11 mechanism
  /// CKM_RSA_AES_KEY_WRAP.
  ///
  /// When wrapping with import methods
  /// ([RSA_OAEP_3072_SHA256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256]
  /// or
  /// [RSA_OAEP_4096_SHA256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256]),
  ///
  /// this field must contain the formatted key to be imported, wrapped with the
  /// [public_key][google.cloud.kms.v1.ImportJob.public_key] using RSAES-OAEP
  /// with SHA-256, MGF1 with SHA-256, and an empty label.
  ///
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256]: <doc:ImportJob/ImportMethod/rsaOaep3072Sha1Aes256>
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256]: <doc:ImportJob/ImportMethod/rsaOaep3072Sha256>
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA256_AES_256]: <doc:ImportJob/ImportMethod/rsaOaep3072Sha256Aes256>
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256]: <doc:ImportJob/ImportMethod/rsaOaep4096Sha1Aes256>
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256]: <doc:ImportJob/ImportMethod/rsaOaep4096Sha256>
  /// [google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA256_AES_256]: <doc:ImportJob/ImportMethod/rsaOaep4096Sha256Aes256>
  /// [google.cloud.kms.v1.ImportJob.public_key]: <doc:ImportJob/publicKey>
  public var wrappedKey: Foundation.Data = Foundation.Data()

  /// Optional. Whether trusted wrapping will be enabled on the imported
  /// [CryptoKeyVersion]. This field is only supported for keys with
  /// [CryptoKeyVersionTemplate.protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]
  /// [HSM_SINGLE_TENANT][google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT].
  /// This field is supported for all
  /// [CryptoKeyPurposes][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] besides
  /// [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
  ///
  /// [google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose]: <doc:CryptoKey/CryptoKeyPurpose>
  /// [google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]: <doc:CryptoKey/CryptoKeyPurpose/encryptDecrypt>
  /// [google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]: <doc:CryptoKeyVersionTemplate/protectionLevel>
  /// [google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT]: <doc:ProtectionLevel/hsmSingleTenant>
  public var trustedWrappingEnabled: Swift.Bool = Swift.Bool()

  /// This field is legacy. Use the field
  /// [wrapped_key][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]
  /// instead.
  ///
  /// [google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]: <doc:ImportCryptoKeyVersionRequest/wrappedKey>
  public var wrappedKeyMaterial: OneOf_WrappedKeyMaterial? = nil

  /// Initialize a new instance of `ImportCryptoKeyVersionRequest`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = ImportCryptoKeyVersionRequest().with { $0.parent = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  private enum CodingKeys: Swift.String, CodingKey {
    case parent = "parent"
    case cryptoKeyVersion = "cryptoKeyVersion"
    case algorithm = "algorithm"
    case importJob = "importJob"
    case wrappedKey = "wrappedKey"
    case rsaAesWrappedKey = "rsaAesWrappedKey"
    case trustedWrappingEnabled = "trustedWrappingEnabled"
  }

  public init(from decoder: Decoder) throws {
    let container = try decoder.container(keyedBy: CodingKeys.self)
    self.parent = try container.decode(Swift.String.self, forKey: .parent)
    self.cryptoKeyVersion = try container.decode(Swift.String.self, forKey: .cryptoKeyVersion)
    self.algorithm = try container.decode(
      CryptoKeyVersion.CryptoKeyVersionAlgorithm.self, forKey: .algorithm)
    self.importJob = try container.decode(Swift.String.self, forKey: .importJob)
    self.wrappedKey = try container.decode(Foundation.Data.self, forKey: .wrappedKey)
    self.trustedWrappingEnabled = try container.decode(
      Swift.Bool.self, forKey: .trustedWrappingEnabled)

    var wrappedKeyMaterial: OneOf_WrappedKeyMaterial? = nil
    let wrappedKeyMaterialCheckAndSet = {
      if wrappedKeyMaterial != nil {
        throw DecodingError.dataCorrupted(
          DecodingError.Context(
            codingPath: decoder.codingPath,
            debugDescription: "Multiple values set for oneof 'wrappedKeyMaterial'"))
      }
      wrappedKeyMaterial = $0
    }
    if let rsaAesWrappedKey = try container.decodeIfPresent(
      Foundation.Data.self, forKey: .rsaAesWrappedKey)
    {
      try wrappedKeyMaterialCheckAndSet(.rsaAesWrappedKey(rsaAesWrappedKey))
    }
    self.wrappedKeyMaterial = wrappedKeyMaterial
  }

  public func encode(to encoder: Encoder) throws {
    var container = encoder.container(keyedBy: CodingKeys.self)
    try container.encode(self.parent, forKey: .parent)
    try container.encode(self.cryptoKeyVersion, forKey: .cryptoKeyVersion)
    try container.encode(self.algorithm, forKey: .algorithm)
    try container.encode(self.importJob, forKey: .importJob)
    try container.encode(self.wrappedKey, forKey: .wrappedKey)
    try container.encode(self.trustedWrappingEnabled, forKey: .trustedWrappingEnabled)

    if let choice = self.wrappedKeyMaterial {
      switch choice {
      case .rsaAesWrappedKey(let value):
        try container.encode(value, forKey: .rsaAesWrappedKey)
      }
    }
  }

  /// This field is legacy. Use the field
  /// [wrapped_key][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]
  /// instead.
  ///
  /// [google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]: <doc:ImportCryptoKeyVersionRequest/wrappedKey>
  public enum OneOf_WrappedKeyMaterial: Codable, Equatable, Sendable {
    /// Optional. This field has the same meaning as
    /// [wrapped_key][google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key].
    /// Prefer to use that field in new work. Either that field or this field
    /// (but not both) must be specified.
    ///
    /// [google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key]: <doc:ImportCryptoKeyVersionRequest/wrappedKey>
    case rsaAesWrappedKey(Foundation.Data)
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.cloud.kms.v1.ImportCryptoKeyVersionRequest"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
