// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt

/// Authority encodes how Google will recognize identities from this Membership.
/// See the workload identity documentation for more details:
/// https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
public struct Authority: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with
  /// `https://` and be a valid URL with length <2000 characters.
  ///
  /// If set, then Google will allow valid OIDC tokens from this issuer to
  /// authenticate within the workload_identity_pool. OIDC discovery will be
  /// performed on this URI to validate tokens from the issuer.
  ///
  /// Clearing `issuer` disables Workload Identity. `issuer` cannot be directly
  /// modified; it must be cleared (and Workload Identity disabled) before using
  /// a new issuer (and re-enabling Workload Identity).
  public var issuer: Swift.String = Swift.String()

  /// Output only. The name of the workload identity pool in which `issuer` will
  /// be recognized.
  ///
  /// There is a single Workload Identity Pool per Hub that is shared
  /// between all Memberships that belong to that Hub. For a Hub hosted in
  /// {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`,
  /// although this is subject to change in newer versions of this API.
  public var workloadIdentityPool: Swift.String = Swift.String()

  /// Output only. An identity provider that reflects the `issuer` in the
  /// workload identity pool.
  public var identityProvider: Swift.String = Swift.String()

  /// Optional. OIDC verification keys for this Membership in JWKS format (RFC
  /// 7517).
  ///
  /// When this field is set, OIDC discovery will NOT be performed on `issuer`,
  /// and instead OIDC tokens will be validated using this field.
  public var oidcJwks: Foundation.Data = Foundation.Data()

  /// Initialize a new instance of `Authority`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = Authority().with { $0.issuer = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.cloud.gkehub.v1.Authority"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
