// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt
import GoogleType

/// IAM policy binding resource.
public struct PolicyBinding: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Identifier. The name of the policy binding, in the format
  /// `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`.
  /// The binding parent is the closest Resource Manager resource (project,
  /// folder, or organization) to the binding target.
  ///
  /// Format:
  ///
  /// * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}`
  /// * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}`
  /// * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}`
  /// * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`
  public var name: Swift.String = Swift.String()

  /// Output only. The globally unique ID of the policy binding. Assigned when
  /// the policy binding is created.
  public var uid: Swift.String = Swift.String()

  /// Optional. The etag for the policy binding.
  /// If this is provided on update, it must match the server's etag.
  public var etag: Swift.String = Swift.String()

  /// Optional. The description of the policy binding. Must be less than or equal
  /// to 63 characters.
  public var displayName: Swift.String = Swift.String()

  /// Optional. User-defined annotations. See
  /// https://google.aip.dev/148#annotations for more details such as format and
  /// size limitations
  public var annotations: [Swift.String: Swift.String] = [:]

  /// Required. Immutable. The full resource name of the resource to which the
  /// policy will be bound. Immutable once set.
  public var target: PolicyBinding.Target? = nil

  /// Immutable. The kind of the policy to attach in this binding. This field
  /// must be one of the following:
  ///
  /// - Left empty (will be automatically set to the policy kind)
  /// - The input policy kind
  public var policyKind: PolicyBinding.PolicyKind = PolicyBinding.PolicyKind()

  /// Required. Immutable. The resource name of the policy to be bound. The
  /// binding parent and policy must belong to the same organization.
  public var policy: Swift.String = Swift.String()

  /// Output only. The globally unique ID of the policy to be bound.
  public var policyUid: Swift.String = Swift.String()

  /// Optional. The condition to apply to the policy binding. When set, the
  /// `expression` field in the `Expr` must include from 1 to 10 subexpressions,
  /// joined by the
  /// "||"(Logical OR), "&&"(Logical AND) or "!"(Logical NOT) operators and
  /// cannot contain more than 250 characters.
  ///
  /// The condition is currently only supported when bound to policies of kind
  /// principal access boundary.
  ///
  /// When the bound policy is a principal access boundary policy, the only
  /// supported attributes in any subexpression are `principal.type` and
  /// `principal.subject`. An example expression is: "principal.type ==
  /// 'iam.googleapis.com/ServiceAccount'" or "principal.subject ==
  /// 'bob@example.com'".
  ///
  /// Allowed operations for `principal.subject`:
  ///
  /// - `principal.subject == <principal subject string>`
  /// - `principal.subject != <principal subject string>`
  /// - `principal.subject in [<list of principal subjects>]`
  /// - `principal.subject.startsWith(<string>)`
  /// - `principal.subject.endsWith(<string>)`
  ///
  /// Allowed operations for `principal.type`:
  ///
  /// - `principal.type == <principal type string>`
  /// - `principal.type != <principal type string>`
  /// - `principal.type in [<list of principal types>]`
  ///
  /// Supported principal types are workspace, workforce pool, workload pool,
  /// service account, and agent identity. Allowed string must be one of:
  ///
  /// - `iam.googleapis.com/WorkspaceIdentity`
  /// - `iam.googleapis.com/WorkforcePoolIdentity`
  /// - `iam.googleapis.com/WorkloadPoolIdentity`
  /// - `iam.googleapis.com/ServiceAccount`
  /// - `iam.googleapis.com/AgentPoolIdentity` (available in Preview)
  public var condition: GoogleType.Expr? = nil

  /// Output only. The time when the policy binding was created.
  public var createTime: GoogleCloudWkt.Timestamp? = nil

  /// Output only. The time when the policy binding was most recently updated.
  public var updateTime: GoogleCloudWkt.Timestamp? = nil

  /// Initialize a new instance of `PolicyBinding`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = PolicyBinding().with { $0.name = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  /// The full resource name of the resource to which the policy will
  /// be bound. Immutable once set.
  public struct Target: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// The different types of targets that can be bound to a policy.
    public var target: OneOf_Target? = nil

    /// Initialize a new instance of `Target`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = Target().with { $0.principalSet = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    private enum CodingKeys: Swift.String, CodingKey {
      case principalSet = "principalSet"
      case resource = "resource"
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.container(keyedBy: CodingKeys.self)

      var target: OneOf_Target? = nil
      let targetCheckAndSet = {
        if target != nil {
          throw DecodingError.dataCorrupted(
            DecodingError.Context(
              codingPath: decoder.codingPath,
              debugDescription: "Multiple values set for oneof 'target'"))
        }
        target = $0
      }
      if let principalSet = try container.decodeIfPresent(Swift.String.self, forKey: .principalSet)
      {
        try targetCheckAndSet(.principalSet(principalSet))
      }
      if let resource = try container.decodeIfPresent(Swift.String.self, forKey: .resource) {
        try targetCheckAndSet(.resource(resource))
      }
      self.target = target
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.container(keyedBy: CodingKeys.self)

      if let choice = self.target {
        switch choice {
        case .principalSet(let value):
          try container.encode(value, forKey: .principalSet)
        case .resource(let value):
          try container.encode(value, forKey: .resource)
        }
      }
    }

    /// The different types of targets that can be bound to a policy.
    public enum OneOf_Target: Codable, Equatable, Sendable {
      /// Immutable. The full resource name that's used for principal access
      /// boundary policy bindings. The principal set must be directly parented
      /// by the policy binding's parent or same as the parent if the target is a
      /// project, folder, or organization.
      ///
      /// Examples:
      ///
      /// * For bindings parented by an organization:
      ///     * Organization:
      ///     `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID`
      ///     * Workforce Identity:
      ///     `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID`
      ///     * Workspace Identity:
      ///     `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID`
      /// * For bindings parented by a folder:
      ///     * Folder:
      ///       `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID`
      /// * For bindings parented by a project:
      ///     * Project:
      ///         * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER`
      ///         * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
      ///     * Workload Identity Pool:
      ///     `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/LOCATION/workloadIdentityPools/WORKLOAD_POOL_ID`
      case principalSet(Swift.String)
      /// Immutable. The full resource name that's used for access policy
      /// bindings.
      ///
      /// Examples:
      ///
      /// * Organization:
      /// `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID`
      /// * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID`
      /// * Project:
      ///     * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER`
      ///     * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
      case resource(Swift.String)
    }

    public static var _anyTypeUrl: Swift.String {
      return "type.googleapis.com/google.iam.v3.PolicyBinding.Target"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// The different policy kinds supported in this binding.
  public enum PolicyKind: Codable, Equatable, Sendable {
    /// Unspecified policy kind; Not a valid state
    case unspecified
    /// Principal access boundary policy kind
    case principalAccessBoundary
    /// Access policy kind.
    case access
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .principalAccessBoundary: return 1
      case .access: return 2
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "POLICY_KIND_UNSPECIFIED"
      case .principalAccessBoundary: return "PRINCIPAL_ACCESS_BOUNDARY"
      case .access: return "ACCESS"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:PolicyKind/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "POLICY_KIND_UNSPECIFIED": self = .unspecified
      case "PRINCIPAL_ACCESS_BOUNDARY": self = .principalAccessBoundary
      case "ACCESS": self = .access
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:PolicyKind/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .principalAccessBoundary
      case 2: self = .access
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .principalAccessBoundary: return try container.encode(1)
      case .access: return try container.encode(2)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.iam.v3.PolicyBinding"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
