// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt
import GoogleType

/// Access Policy Rule that determines the behavior of the policy.
public struct AccessPolicyRule: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Optional. Customer specified description of the rule. Must be less than or
  /// equal to 256 characters.
  public var description: Swift.String? = nil

  /// Required. The effect of the rule.
  public var effect: AccessPolicyRule.Effect? = nil

  /// Required. The identities for which this rule's effect governs using one or
  /// more permissions on Google Cloud resources. This field can contain the
  /// following values:
  ///
  /// * `principal://goog/subject/{email_id}`: A specific Google Account.
  /// Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
  /// example, `principal://goog/subject/alice@example.com`.
  ///
  /// * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
  /// A Google Cloud service account. For example,
  /// `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com`.
  ///
  /// * `principalSet://goog/group/{group_id}`: A Google group. For example,
  /// `principalSet://goog/group/admins@example.com`.
  ///
  /// * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
  /// principals associated with the specified Google Workspace or Cloud
  /// Identity customer ID. For example,
  /// `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
  ///
  ///
  /// If an identifier that was previously set on a policy is soft deleted, then
  /// calls to read that policy will return the identifier with a deleted
  /// prefix. Users cannot set identifiers with this syntax.
  ///
  /// * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
  /// Google Account that was deleted recently. For example,
  /// `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
  /// the Google Account is recovered, this identifier reverts to the standard
  /// identifier for a Google Account.
  ///
  /// * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
  /// that was deleted recently. For example,
  /// `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
  /// If the Google group is restored, this identifier reverts to the standard
  /// identifier for a Google group.
  ///
  /// * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
  /// A Google Cloud service account that was deleted recently. For example,
  /// `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
  /// If the service account is undeleted, this identifier reverts to the
  /// standard identifier for a service account.
  public var principals: [Swift.String] = []

  /// Optional. The identities that are excluded from the access policy rule,
  /// even if they are listed in the `principals`. For example, you could add a
  /// Google group to the `principals`, then exclude specific users who belong to
  /// that group.
  public var excludedPrincipals: [Swift.String] = []

  /// Required. Attributes that are used to determine whether this rule applies
  /// to a request.
  public var operation: AccessPolicyRule.Operation? = nil

  /// Optional. The conditions that determine whether this rule applies to a
  /// request. Conditions are identified by their key, which is the FQDN of the
  /// service that they are relevant to. For example:
  ///
  /// ```
  /// "conditions": {
  ///  "iam.googleapis.com": {
  ///   "expression": <cel expression>
  ///  }
  /// }
  /// ```
  ///
  /// Each rule is evaluated independently. If this rule does not apply
  /// to a request, other rules might still apply.
  /// Currently supported keys are as follows:
  ///
  ///
  /// * `eventarc.googleapis.com`: Can use `CEL` functions that evaluate
  ///   resource fields.
  ///
  /// * `iam.googleapis.com`: Can use `CEL` functions that evaluate
  ///   [resource
  ///   tags](https://cloud.google.com/iam/help/conditions/resource-tags) and
  ///   combine them using boolean and logical operators. Other functions and
  ///   operators are not supported.
  public var conditions: [Swift.String: GoogleType.Expr] = [:]

  /// Initialize a new instance of `AccessPolicyRule`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = AccessPolicyRule().with { $0.description = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  /// Attributes that are used to determine whether this rule applies to a
  /// request.
  public struct Operation: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// Optional. The permissions that are explicitly affected by this rule. Each
    /// permission uses the format `{service_fqdn}/{resource}.{verb}`, where
    /// `{service_fqdn}` is the fully qualified domain name for the service.
    /// Currently supported permissions are as follows:
    ///
    /// * `eventarc.googleapis.com/messageBuses.publish`.
    public var permissions: [Swift.String] = []

    /// Optional. Specifies the permissions that this rule excludes from the set
    /// of affected permissions given by `permissions`. If a permission appears
    /// in `permissions` _and_ in `excluded_permissions` then it will _not_ be
    /// subject to the policy effect.
    ///
    /// The excluded permissions can be specified using the same syntax as
    /// `permissions`.
    public var excludedPermissions: [Swift.String] = []

    /// Initialize a new instance of `Operation`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = Operation().with { $0.permissions = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    public static var _anyTypeUrl: Swift.String {
      return "type.googleapis.com/google.iam.v3.AccessPolicyRule.Operation"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// An effect to describe the access relationship.
  public enum Effect: Codable, Equatable, Sendable {
    /// The effect is unspecified.
    case unspecified
    /// The policy will deny access if it evaluates to true.
    case deny
    /// The policy will grant access if it evaluates to true.
    case allow
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .deny: return 1
      case .allow: return 2
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "EFFECT_UNSPECIFIED"
      case .deny: return "DENY"
      case .allow: return "ALLOW"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:Effect/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "EFFECT_UNSPECIFIED": self = .unspecified
      case "DENY": self = .deny
      case "ALLOW": self = .allow
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:Effect/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .deny
      case 2: self = .allow
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .deny: return try container.encode(1)
      case .allow: return try container.encode(2)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.iam.v3.AccessPolicyRule"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
