{-# LANGUAGE DataKinds #-}
{-# LANGUAGE DerivingStrategies #-}
{-# LANGUAGE DuplicateRecordFields #-}
{-# LANGUAGE ImportQualifiedPost #-}
{-# LANGUAGE LambdaCase #-}
{-# LANGUAGE OverloadedStrings #-}
{-# LANGUAGE PatternSynonyms #-}
{-# LANGUAGE RecordWildCards #-}
{-# LANGUAGE StrictData #-}
{-# LANGUAGE TypeFamilies #-}
{-# LANGUAGE NoImplicitPrelude #-}
{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
{-# OPTIONS_GHC -fno-warn-name-shadowing #-}
{-# OPTIONS_GHC -fno-warn-unused-binds #-}
{-# OPTIONS_GHC -fno-warn-unused-imports #-}
{-# OPTIONS_GHC -fno-warn-unused-matches #-}

-- |
-- Module      : Gogol.ServiceBroker.Internal.Product
-- Copyright   : (c) 2015-2025 Brendan Hay
-- License     : Mozilla Public License, v. 2.0.
-- Maintainer  : Brendan Hay <brendan.g.hay+gogol@gmail.com>
--               Toni Cebrián <toni@tonicebrian.com>
-- Stability   : auto-generated
-- Portability : non-portable (GHC extensions)
module Gogol.ServiceBroker.Internal.Product
  ( -- * GoogleIamV1__Binding
    GoogleIamV1__Binding (..),
    newGoogleIamV1__Binding,

    -- * GoogleIamV1__Policy
    GoogleIamV1__Policy (..),
    newGoogleIamV1__Policy,

    -- * GoogleIamV1__SetIamPolicyRequest
    GoogleIamV1__SetIamPolicyRequest (..),
    newGoogleIamV1__SetIamPolicyRequest,

    -- * GoogleIamV1__TestIamPermissionsRequest
    GoogleIamV1__TestIamPermissionsRequest (..),
    newGoogleIamV1__TestIamPermissionsRequest,

    -- * GoogleIamV1__TestIamPermissionsResponse
    GoogleIamV1__TestIamPermissionsResponse (..),
    newGoogleIamV1__TestIamPermissionsResponse,

    -- * GoogleType__Expr
    GoogleType__Expr (..),
    newGoogleType__Expr,
  )
where

import Gogol.Prelude qualified as Core
import Gogol.ServiceBroker.Internal.Sum

-- | Associates @members@ with a @role@.
--
-- /See:/ 'newGoogleIamV1__Binding' smart constructor.
data GoogleIamV1__Binding = GoogleIamV1__Binding
  { -- | The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.
    condition :: (Core.Maybe GoogleType__Expr),
    -- | Specifies the identities requesting access for a Cloud Platform resource. @members@ can have the following values:
    --
    -- -   @allUsers@: A special identifier that represents anyone who is on the internet; with or without a Google account.
    --
    -- -   @allAuthenticatedUsers@: A special identifier that represents anyone who is authenticated with a Google account or a service account.
    --
    -- -   @user:{emailid}@: An email address that represents a specific Google account. For example, @alice\@example.com@ .
    --
    -- -   @serviceAccount:{emailid}@: An email address that represents a service account. For example, @my-other-app\@appspot.gserviceaccount.com@.
    --
    -- -   @group:{emailid}@: An email address that represents a Google group. For example, @admins\@example.com@.
    --
    -- -   @deleted:user:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a user that has been recently deleted. For example, @alice\@example.com?uid=123456789012345678901@. If the user is recovered, this value reverts to @user:{emailid}@ and the recovered user retains the role in the binding.
    --
    -- -   @deleted:serviceAccount:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, @my-other-app\@appspot.gserviceaccount.com?uid=123456789012345678901@. If the service account is undeleted, this value reverts to @serviceAccount:{emailid}@ and the undeleted service account retains the role in the binding.
    --
    -- -   @deleted:group:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, @admins\@example.com?uid=123456789012345678901@. If the group is recovered, this value reverts to @group:{emailid}@ and the recovered group retains the role in the binding.
    --
    -- -   @domain:{domain}@: The G Suite domain (primary) that represents all the users of that domain. For example, @google.com@ or @example.com@.
    members :: (Core.Maybe [Core.Text]),
    -- | Role that is assigned to @members@. For example, @roles\/viewer@, @roles\/editor@, or @roles\/owner@.
    role' :: (Core.Maybe Core.Text)
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleIamV1__Binding' with the minimum fields required to make a request.
newGoogleIamV1__Binding ::
  GoogleIamV1__Binding
newGoogleIamV1__Binding =
  GoogleIamV1__Binding
    { condition = Core.Nothing,
      members = Core.Nothing,
      role' = Core.Nothing
    }

instance Core.FromJSON GoogleIamV1__Binding where
  parseJSON =
    Core.withObject
      "GoogleIamV1__Binding"
      ( \o ->
          GoogleIamV1__Binding
            Core.<$> (o Core..:? "condition")
            Core.<*> (o Core..:? "members")
            Core.<*> (o Core..:? "role")
      )

instance Core.ToJSON GoogleIamV1__Binding where
  toJSON GoogleIamV1__Binding {..} =
    Core.object
      ( Core.catMaybes
          [ ("condition" Core..=) Core.<$> condition,
            ("members" Core..=) Core.<$> members,
            ("role" Core..=) Core.<$> role'
          ]
      )

-- | An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.
--
-- A @Policy@ is a collection of @bindings@. A @binding@ binds one or more @members@ to a single @role@. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A @role@ is a named list of permissions; each @role@ can be an IAM predefined role or a user-created custom role.
--
-- Optionally, a @binding@ can specify a @condition@, which is a logical expression that allows access to a resource only if the expression evaluates to @true@. A condition can add constraints based on attributes of the request, the resource, or both.
--
-- __JSON example:__
--
-- > {
-- >   "bindings": [
-- >     {
-- >       "role": "roles/resourcemanager.organizationAdmin",
-- >       "members": [
-- >         "user:mike@example.com",
-- >         "group:admins@example.com",
-- >         "domain:google.com",
-- >         "serviceAccount:my-project-id@appspot.gserviceaccount.com"
-- >       ]
-- >     },
-- >     {
-- >       "role": "roles/resourcemanager.organizationViewer",
-- >       "members": ["user:eve@example.com"],
-- >       "condition": {
-- >         "title": "expirable access",
-- >         "description": "Does not grant access after Sep 2020",
-- >         "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
-- >       }
-- >     }
-- >   ],
-- >   "etag": "BwWWja0YfJA=",
-- >   "version": 3
-- > }
--
-- __YAML example:__
--
-- > bindings:
-- > - members:
-- >   - user:mike@example.com
-- >   - group:admins@example.com
-- >   - domain:google.com
-- >   - serviceAccount:my-project-id@appspot.gserviceaccount.com
-- >   role: roles/resourcemanager.organizationAdmin
-- > - members:
-- >   - user:eve@example.com
-- >   role: roles/resourcemanager.organizationViewer
-- >   condition:
-- >     title: expirable access
-- >     description: Does not grant access after Sep 2020
-- >     expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
-- > - etag: BwWWja0YfJA=
-- > - version: 3
--
-- For a description of IAM and its features, see the <https://cloud.google.com/iam/docs/ IAM documentation>.
--
-- /See:/ 'newGoogleIamV1__Policy' smart constructor.
data GoogleIamV1__Policy = GoogleIamV1__Policy
  { -- | Associates a list of @members@ to a @role@. Optionally, may specify a @condition@ that determines how and when the @bindings@ are applied. Each of the @bindings@ must contain at least one member.
    bindings :: (Core.Maybe [GoogleIamV1__Binding]),
    -- | @etag@ is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the @etag@ in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An @etag@ is returned in the response to @getIamPolicy@, and systems are expected to put that etag in the request to @setIamPolicy@ to ensure that their change will be applied to the same version of the policy.
    --
    -- __Important:__ If you use IAM Conditions, you must include the @etag@ field whenever you call @setIamPolicy@. If you omit this field, then IAM allows you to overwrite a version @3@ policy with a version @1@ policy, and all of the conditions in the version @3@ policy are lost.
    etag :: (Core.Maybe Core.Base64),
    -- | Specifies the format of the policy.
    --
    -- Valid values are @0@, @1@, and @3@. Requests that specify an invalid value are rejected.
    --
    -- Any operation that affects conditional role bindings must specify version @3@. This requirement applies to the following operations:
    --
    -- -   Getting a policy that includes a conditional role binding
    -- -   Adding a conditional role binding to a policy
    -- -   Changing a conditional role binding in a policy
    -- -   Removing any role binding, with or without a condition, from a policy that includes conditions
    --
    -- __Important:__ If you use IAM Conditions, you must include the @etag@ field whenever you call @setIamPolicy@. If you omit this field, then IAM allows you to overwrite a version @3@ policy with a version @1@ policy, and all of the conditions in the version @3@ policy are lost.
    --
    -- If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset.
    version :: (Core.Maybe Core.Int32)
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleIamV1__Policy' with the minimum fields required to make a request.
newGoogleIamV1__Policy ::
  GoogleIamV1__Policy
newGoogleIamV1__Policy =
  GoogleIamV1__Policy
    { bindings = Core.Nothing,
      etag = Core.Nothing,
      version = Core.Nothing
    }

instance Core.FromJSON GoogleIamV1__Policy where
  parseJSON =
    Core.withObject
      "GoogleIamV1__Policy"
      ( \o ->
          GoogleIamV1__Policy
            Core.<$> (o Core..:? "bindings")
            Core.<*> (o Core..:? "etag")
            Core.<*> (o Core..:? "version")
      )

instance Core.ToJSON GoogleIamV1__Policy where
  toJSON GoogleIamV1__Policy {..} =
    Core.object
      ( Core.catMaybes
          [ ("bindings" Core..=) Core.<$> bindings,
            ("etag" Core..=) Core.<$> etag,
            ("version" Core..=) Core.<$> version
          ]
      )

-- | Request message for @SetIamPolicy@ method.
--
-- /See:/ 'newGoogleIamV1__SetIamPolicyRequest' smart constructor.
newtype GoogleIamV1__SetIamPolicyRequest = GoogleIamV1__SetIamPolicyRequest
  { -- | REQUIRED: The complete policy to be applied to the @resource@. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
    policy :: (Core.Maybe GoogleIamV1__Policy)
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleIamV1__SetIamPolicyRequest' with the minimum fields required to make a request.
newGoogleIamV1__SetIamPolicyRequest ::
  GoogleIamV1__SetIamPolicyRequest
newGoogleIamV1__SetIamPolicyRequest =
  GoogleIamV1__SetIamPolicyRequest {policy = Core.Nothing}

instance Core.FromJSON GoogleIamV1__SetIamPolicyRequest where
  parseJSON =
    Core.withObject
      "GoogleIamV1__SetIamPolicyRequest"
      ( \o ->
          GoogleIamV1__SetIamPolicyRequest Core.<$> (o Core..:? "policy")
      )

instance Core.ToJSON GoogleIamV1__SetIamPolicyRequest where
  toJSON GoogleIamV1__SetIamPolicyRequest {..} =
    Core.object (Core.catMaybes [("policy" Core..=) Core.<$> policy])

-- | Request message for @TestIamPermissions@ method.
--
-- /See:/ 'newGoogleIamV1__TestIamPermissionsRequest' smart constructor.
newtype GoogleIamV1__TestIamPermissionsRequest = GoogleIamV1__TestIamPermissionsRequest
  { -- | The set of permissions to check for the @resource@. Permissions with wildcards (such as \'/\' or \'storage./\') are not allowed. For more information see <https://cloud.google.com/iam/docs/overview#permissions IAM Overview>.
    permissions :: (Core.Maybe [Core.Text])
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleIamV1__TestIamPermissionsRequest' with the minimum fields required to make a request.
newGoogleIamV1__TestIamPermissionsRequest ::
  GoogleIamV1__TestIamPermissionsRequest
newGoogleIamV1__TestIamPermissionsRequest =
  GoogleIamV1__TestIamPermissionsRequest
    { permissions =
        Core.Nothing
    }

instance Core.FromJSON GoogleIamV1__TestIamPermissionsRequest where
  parseJSON =
    Core.withObject
      "GoogleIamV1__TestIamPermissionsRequest"
      ( \o ->
          GoogleIamV1__TestIamPermissionsRequest
            Core.<$> (o Core..:? "permissions")
      )

instance Core.ToJSON GoogleIamV1__TestIamPermissionsRequest where
  toJSON GoogleIamV1__TestIamPermissionsRequest {..} =
    Core.object
      (Core.catMaybes [("permissions" Core..=) Core.<$> permissions])

-- | Response message for @TestIamPermissions@ method.
--
-- /See:/ 'newGoogleIamV1__TestIamPermissionsResponse' smart constructor.
newtype GoogleIamV1__TestIamPermissionsResponse = GoogleIamV1__TestIamPermissionsResponse
  { -- | A subset of @TestPermissionsRequest.permissions@ that the caller is allowed.
    permissions :: (Core.Maybe [Core.Text])
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleIamV1__TestIamPermissionsResponse' with the minimum fields required to make a request.
newGoogleIamV1__TestIamPermissionsResponse ::
  GoogleIamV1__TestIamPermissionsResponse
newGoogleIamV1__TestIamPermissionsResponse =
  GoogleIamV1__TestIamPermissionsResponse
    { permissions =
        Core.Nothing
    }

instance Core.FromJSON GoogleIamV1__TestIamPermissionsResponse where
  parseJSON =
    Core.withObject
      "GoogleIamV1__TestIamPermissionsResponse"
      ( \o ->
          GoogleIamV1__TestIamPermissionsResponse
            Core.<$> (o Core..:? "permissions")
      )

instance Core.ToJSON GoogleIamV1__TestIamPermissionsResponse where
  toJSON GoogleIamV1__TestIamPermissionsResponse {..} =
    Core.object
      (Core.catMaybes [("permissions" Core..=) Core.<$> permissions])

-- | Represents an expression text. Example:
--
-- > title: "User account presence"
-- > description: "Determines whether the request has a user account"
-- > expression: "size(request.user) > 0"
--
-- /See:/ 'newGoogleType__Expr' smart constructor.
data GoogleType__Expr = GoogleType__Expr
  { -- | An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
    description :: (Core.Maybe Core.Text),
    -- | Textual representation of an expression in Common Expression Language syntax.
    --
    -- The application context of the containing message determines which well-known feature set of CEL is supported.
    expression :: (Core.Maybe Core.Text),
    -- | An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
    location :: (Core.Maybe Core.Text),
    -- | An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
    title :: (Core.Maybe Core.Text)
  }
  deriving (Core.Eq, Core.Show, Core.Generic)

-- | Creates a value of 'GoogleType__Expr' with the minimum fields required to make a request.
newGoogleType__Expr ::
  GoogleType__Expr
newGoogleType__Expr =
  GoogleType__Expr
    { description = Core.Nothing,
      expression = Core.Nothing,
      location = Core.Nothing,
      title = Core.Nothing
    }

instance Core.FromJSON GoogleType__Expr where
  parseJSON =
    Core.withObject
      "GoogleType__Expr"
      ( \o ->
          GoogleType__Expr
            Core.<$> (o Core..:? "description")
            Core.<*> (o Core..:? "expression")
            Core.<*> (o Core..:? "location")
            Core.<*> (o Core..:? "title")
      )

instance Core.ToJSON GoogleType__Expr where
  toJSON GoogleType__Expr {..} =
    Core.object
      ( Core.catMaybes
          [ ("description" Core..=) Core.<$> description,
            ("expression" Core..=) Core.<$> expression,
            ("location" Core..=) Core.<$> location,
            ("title" Core..=) Core.<$> title
          ]
      )