// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#if FirewallPolicies || Instances || NetworkFirewallPolicies || Networks || RegionNetworkFirewallPolicies
  import Foundation
  import GoogleCloudWkt

  /// Represents a rule that describes one or more match conditions along with
  /// the action to be taken when traffic matches this condition (allow or deny).
  public struct FirewallPolicyRule: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// The Action to perform when the client connection triggers the rule.
    /// Valid actions for firewall rules are: "allow", "deny",
    /// "apply_security_profile_group" and "goto_next" (
    /// "apply_security_profile_group" can be specified only for global
    /// network firewall policies or hierarchical firewall policies).
    /// Valid actions for packet mirroring rules are: "mirror", "do_not_mirror"
    /// and "goto_next".
    public var action: Swift.String? = nil

    /// An optional description for this resource.
    public var description: Swift.String? = nil

    /// The direction in which this rule applies.
    public var direction: FirewallPolicyRule.Direction? = nil

    /// Denotes whether the firewall policy rule is disabled. When set to true,
    /// the firewall policy rule is not enforced and traffic behaves as if it did
    /// not exist. If this is unspecified, the firewall policy rule will be
    /// enabled.
    public var disabled: Swift.Bool? = nil

    /// Denotes whether to enable logging for a particular rule. If logging is
    /// enabled, logs will be exported to the configured export destination in
    /// Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you
    /// cannot enable logging on "goto_next" rules.
    public var enableLogging: Swift.Bool? = nil

    /// Output only. [Output only] Type of the resource. Returnscompute#firewallPolicyRule for firewall rules andcompute#packetMirroringRule for packet mirroring rules.
    public var kind: Swift.String? = nil

    /// A match condition that incoming traffic is evaluated against.
    /// If it evaluates to true, the corresponding 'action' is enforced.
    public var match: FirewallPolicyRuleMatcher? = nil

    /// An integer indicating the priority of a rule in the list. The priority
    /// must be a positive value between 0 and 2147483647.
    /// Rules are evaluated from highest to lowest priority where 0 is the
    /// highest priority and 2147483647 is the lowest priority.
    public var priority: Swift.Int32? = nil

    /// An optional name for the rule. This field is not a unique identifier
    /// and can be updated.
    public var ruleName: Swift.String? = nil

    /// Output only. [Output Only] Calculation of the complexity of a single firewall policy
    /// rule.
    public var ruleTupleCount: Swift.Int32? = nil

    /// A fully-qualified URL of a SecurityProfileGroup resource instance.
    /// Example:
    /// https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group
    /// Must be specified if action is one of 'apply_security_profile_group' or
    /// 'mirror'. Cannot be specified for other actions. Can be specified only
    /// for global network firewall policies or hierarchical firewall policies.
    public var securityProfileGroup: Swift.String? = nil

    /// A list of forwarding rules to which this rule applies.
    /// This field allows you to control which load balancers get this rule.
    /// For example, the following are valid values:
    ///
    ///
    ///      - https://www.googleapis.com/compute/v1/projects/project/global/forwardingRules/forwardingRule
    ///      - https://www.googleapis.com/compute/v1/projects/project/regions/region/forwardingRules/forwardingRule
    ///      - projects/project/global/
    ///      forwardingRules/forwardingRule
    ///      - projects/project/regions/region/forwardingRules/
    ///      forwardingRule
    public var targetForwardingRules: [Swift.String] = []

    /// A list of network resource URLs to which this rule applies.  This field
    /// allows you to control which network's VMs get this rule.  If this field
    /// is left blank, all VMs within the organization will receive the rule.
    public var targetResources: [Swift.String] = []

    /// A list of secure tags that controls which instances the firewall rule
    /// applies to. If targetSecureTag are specified, then the
    /// firewall rule applies only to instances in the VPC network that have one
    /// of those EFFECTIVE secure tags, if all the target_secure_tag are in
    /// INEFFECTIVE state, then this rule will be ignored.targetSecureTag may not be set at the same time astargetServiceAccounts.
    /// If neither targetServiceAccounts nortargetSecureTag are specified, the firewall rule applies
    /// to all instances on the specified network.
    /// Maximum number of target label tags allowed is 256.
    public var targetSecureTags: [FirewallPolicyRuleSecureTag] = []

    /// A list of service accounts indicating the sets of instances that are
    /// applied with this rule.
    public var targetServiceAccounts: [Swift.String] = []

    /// Target types of the firewall policy rule.
    /// Default value is INSTANCES.
    public var targetType: FirewallPolicyRule.TargetType? = nil

    /// Boolean flag indicating if the traffic should be TLS decrypted.
    /// Can be set only if action = 'apply_security_profile_group' and cannot
    /// be set for other actions.
    public var tlsInspect: Swift.Bool? = nil

    /// Initialize a new instance of `FirewallPolicyRule`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = FirewallPolicyRule().with { $0.action = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    /// The enumerated type for the [direction][google.cloud.compute.v1.FirewallPolicyRule.direction] field.
    ///
    /// [google.cloud.compute.v1.FirewallPolicyRule.direction]: <doc:FirewallPolicyRule/Direction>
    public enum Direction: Codable, Equatable, Sendable {
      case egress
      case ingress
      /// Encodes an unknown integer value.
      ///
      /// The most common cause for an unknown values is for the service to send
      /// a value unknown to the library. We recommend you update your library to
      /// the latest version.
      case unknownIntValue(Int)
      /// Encodes an unknown string value.
      ///
      /// The most common cause for an unknown values is for the service to send
      /// a value unknown to the library. We recommend you update your library to
      /// the latest version.
      case unknownStringValue(String)

      public init() {
        self = .egress
      }

      /// Returns the integer value associated with the enumeration.
      ///
      /// If the enumeration was initialized with an unknown string value, this returns `nil`.
      public var intValue: Int? {
        switch self {
        case .egress: return 0
        case .ingress: return 1
        case .unknownIntValue(let v): return v
        case .unknownStringValue: return nil
        }
      }

      /// Returns the string value (or name) associated with the enumeration.
      ///
      /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
      public var stringValue: Swift.String? {
        switch self {
        case .egress: return "EGRESS"
        case .ingress: return "INGRESS"
        case .unknownIntValue: return nil
        case .unknownStringValue(let v): return v
        }
      }

      /// Initialize from a string value.
      ///
      /// If the value is unknown, this initializes to [`unknownStringValue`](doc:Direction/unknownStringValue(_:)).
      public init(stringValue: Swift.String) {
        switch stringValue {
        case "EGRESS": self = .egress
        case "INGRESS": self = .ingress
        default: self = .unknownStringValue(stringValue)
        }
      }

      /// Initialize from an integer value.
      ///
      /// If the value is unknown, this initializes to [`unknownIntValue`](doc:Direction/unknownIntValue(_:)).
      public init(intValue: Int) {
        switch intValue {
        case 0: self = .egress
        case 1: self = .ingress
        default: self = .unknownIntValue(intValue)
        }
      }

      public init(from decoder: Decoder) throws {
        let container = try decoder.singleValueContainer()
        if let v = try? container.decode(Int.self) {
          self.init(intValue: v)
          return
        }
        if let s = try? container.decode(String.self) {
          if let v = Int(s) {
            self.init(intValue: v)
          } else {
            self.init(stringValue: s)
          }
          return
        }
        throw DecodingError.dataCorruptedError(
          in: container, debugDescription: "Expected enum value, must be integer or string.")
      }

      public func encode(to encoder: Encoder) throws {
        var container = encoder.singleValueContainer()
        switch self {
        case .egress: return try container.encode(0)
        case .ingress: return try container.encode(1)
        case .unknownIntValue(let v): return try container.encode(v)
        case .unknownStringValue(let v): return try container.encode(v)
        }
      }
    }

    /// The enumerated type for the [targetType][google.cloud.compute.v1.FirewallPolicyRule.targetType] field.
    ///
    /// [google.cloud.compute.v1.FirewallPolicyRule.targetType]: <doc:FirewallPolicyRule/TargetType>
    public enum TargetType: Codable, Equatable, Sendable {
      case instances
      case internalManagedLb
      /// Encodes an unknown integer value.
      ///
      /// The most common cause for an unknown values is for the service to send
      /// a value unknown to the library. We recommend you update your library to
      /// the latest version.
      case unknownIntValue(Int)
      /// Encodes an unknown string value.
      ///
      /// The most common cause for an unknown values is for the service to send
      /// a value unknown to the library. We recommend you update your library to
      /// the latest version.
      case unknownStringValue(String)

      public init() {
        self = .instances
      }

      /// Returns the integer value associated with the enumeration.
      ///
      /// If the enumeration was initialized with an unknown string value, this returns `nil`.
      public var intValue: Int? {
        switch self {
        case .instances: return 0
        case .internalManagedLb: return 1
        case .unknownIntValue(let v): return v
        case .unknownStringValue: return nil
        }
      }

      /// Returns the string value (or name) associated with the enumeration.
      ///
      /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
      public var stringValue: Swift.String? {
        switch self {
        case .instances: return "INSTANCES"
        case .internalManagedLb: return "INTERNAL_MANAGED_LB"
        case .unknownIntValue: return nil
        case .unknownStringValue(let v): return v
        }
      }

      /// Initialize from a string value.
      ///
      /// If the value is unknown, this initializes to [`unknownStringValue`](doc:TargetType/unknownStringValue(_:)).
      public init(stringValue: Swift.String) {
        switch stringValue {
        case "INSTANCES": self = .instances
        case "INTERNAL_MANAGED_LB": self = .internalManagedLb
        default: self = .unknownStringValue(stringValue)
        }
      }

      /// Initialize from an integer value.
      ///
      /// If the value is unknown, this initializes to [`unknownIntValue`](doc:TargetType/unknownIntValue(_:)).
      public init(intValue: Int) {
        switch intValue {
        case 0: self = .instances
        case 1: self = .internalManagedLb
        default: self = .unknownIntValue(intValue)
        }
      }

      public init(from decoder: Decoder) throws {
        let container = try decoder.singleValueContainer()
        if let v = try? container.decode(Int.self) {
          self.init(intValue: v)
          return
        }
        if let s = try? container.decode(String.self) {
          if let v = Int(s) {
            self.init(intValue: v)
          } else {
            self.init(stringValue: s)
          }
          return
        }
        throw DecodingError.dataCorruptedError(
          in: container, debugDescription: "Expected enum value, must be integer or string.")
      }

      public func encode(to encoder: Encoder) throws {
        var container = encoder.singleValueContainer()
        switch self {
        case .instances: return try container.encode(0)
        case .internalManagedLb: return try container.encode(1)
        case .unknownIntValue(let v): return try container.encode(v)
        case .unknownStringValue(let v): return try container.encode(v)
        }
      }
    }

    public static var _anyTypeUrl: Swift.String {
      return "type.googleapis.com/google.cloud.compute.v1.FirewallPolicyRule"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }
#endif
