content: {-# LANGUAGE DataKinds #-}
  {-# LANGUAGE DerivingStrategies #-}
  {-# LANGUAGE DuplicateRecordFields #-}
  {-# LANGUAGE ImportQualifiedPost #-}
  {-# LANGUAGE LambdaCase #-}
  {-# LANGUAGE OverloadedStrings #-}
  {-# LANGUAGE PatternSynonyms #-}
  {-# LANGUAGE RecordWildCards #-}
  {-# LANGUAGE StrictData #-}
  {-# LANGUAGE TypeFamilies #-}
  {-# LANGUAGE NoImplicitPrelude #-}
  {-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
  {-# OPTIONS_GHC -fno-warn-name-shadowing #-}
  {-# OPTIONS_GHC -fno-warn-unused-binds #-}
  {-# OPTIONS_GHC -fno-warn-unused-imports #-}
  {-# OPTIONS_GHC -fno-warn-unused-matches #-}
  
  -- |
  -- Module      : Gogol.IAP.Internal.Product
  -- Copyright   : (c) 2015-2025 Brendan Hay
  -- License     : Mozilla Public License, v. 2.0.
  -- Maintainer  : Brendan Hay <brendan.g.hay+gogol@gmail.com>
  --               Toni Cebrián <toni@tonicebrian.com>
  -- Stability   : auto-generated
  -- Portability : non-portable (GHC extensions)
  module Gogol.IAP.Internal.Product
    ( -- * AccessDeniedPageSettings
      AccessDeniedPageSettings (..),
      newAccessDeniedPageSettings,
  
      -- * AccessSettings
      AccessSettings (..),
      newAccessSettings,
  
      -- * AllowedDomainsSettings
      AllowedDomainsSettings (..),
      newAllowedDomainsSettings,
  
      -- * ApplicationSettings
      ApplicationSettings (..),
      newApplicationSettings,
  
      -- * AttributePropagationSettings
      AttributePropagationSettings (..),
      newAttributePropagationSettings,
  
      -- * Binding
      Binding (..),
      newBinding,
  
      -- * Brand
      Brand (..),
      newBrand,
  
      -- * CorsSettings
      CorsSettings (..),
      newCorsSettings,
  
      -- * CsmSettings
      CsmSettings (..),
      newCsmSettings,
  
      -- * Empty
      Empty (..),
      newEmpty,
  
      -- * Expr
      Expr (..),
      newExpr,
  
      -- * GcipSettings
      GcipSettings (..),
      newGcipSettings,
  
      -- * GetIamPolicyRequest
      GetIamPolicyRequest (..),
      newGetIamPolicyRequest,
  
      -- * GetPolicyOptions
      GetPolicyOptions (..),
      newGetPolicyOptions,
  
      -- * IapSettings
      IapSettings (..),
      newIapSettings,
  
      -- * IdentityAwareProxyClient
      IdentityAwareProxyClient (..),
      newIdentityAwareProxyClient,
  
      -- * ListBrandsResponse
      ListBrandsResponse (..),
      newListBrandsResponse,
  
      -- * ListIdentityAwareProxyClientsResponse
      ListIdentityAwareProxyClientsResponse (..),
      newListIdentityAwareProxyClientsResponse,
  
      -- * ListTunnelDestGroupsResponse
      ListTunnelDestGroupsResponse (..),
      newListTunnelDestGroupsResponse,
  
      -- * NextStateOfTags
      NextStateOfTags (..),
      newNextStateOfTags,
  
      -- * OAuth2
      OAuth2 (..),
      newOAuth2,
  
      -- * OAuthSettings
      OAuthSettings (..),
      newOAuthSettings,
  
      -- * Policy
      Policy (..),
      newPolicy,
  
      -- * PolicyDelegationSettings
      PolicyDelegationSettings (..),
      newPolicyDelegationSettings,
  
      -- * PolicyName
      PolicyName (..),
      newPolicyName,
  
      -- * ReauthSettings
      ReauthSettings (..),
      newReauthSettings,
  
      -- * ResetIdentityAwareProxyClientSecretRequest
      ResetIdentityAwareProxyClientSecretRequest (..),
      newResetIdentityAwareProxyClientSecretRequest,
  
      -- * Resource
      Resource (..),
      newResource,
  
      -- * Resource_ExpectedNextState
      Resource_ExpectedNextState (..),
      newResource_ExpectedNextState,
  
      -- * Resource_Labels
      Resource_Labels (..),
      newResource_Labels,
  
      -- * SetIamPolicyRequest
      SetIamPolicyRequest (..),
      newSetIamPolicyRequest,
  
      -- * TagsFullState
      TagsFullState (..),
      newTagsFullState,
  
      -- * TagsFullState_Tags
      TagsFullState_Tags (..),
      newTagsFullState_Tags,
  
      -- * TagsFullStateForChildResource
      TagsFullStateForChildResource (..),
      newTagsFullStateForChildResource,
  
      -- * TagsFullStateForChildResource_Tags
      TagsFullStateForChildResource_Tags (..),
      newTagsFullStateForChildResource_Tags,
  
      -- * TagsPartialState
      TagsPartialState (..),
      newTagsPartialState,
  
      -- * TagsPartialState_TagsToUpsert
      TagsPartialState_TagsToUpsert (..),
      newTagsPartialState_TagsToUpsert,
  
      -- * TestIamPermissionsRequest
      TestIamPermissionsRequest (..),
      newTestIamPermissionsRequest,
  
      -- * TestIamPermissionsResponse
      TestIamPermissionsResponse (..),
      newTestIamPermissionsResponse,
  
      -- * TunnelDestGroup
      TunnelDestGroup (..),
      newTunnelDestGroup,
  
      -- * ValidateIapAttributeExpressionResponse
      ValidateIapAttributeExpressionResponse (..),
      newValidateIapAttributeExpressionResponse,
  
      -- * WorkforceIdentitySettings
      WorkforceIdentitySettings (..),
      newWorkforceIdentitySettings,
    )
  where
  
  import Gogol.IAP.Internal.Sum
  import Gogol.Prelude qualified as Core
  
  -- | Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.
  --
  -- /See:/ 'newAccessDeniedPageSettings' smart constructor.
  data AccessDeniedPageSettings = AccessDeniedPageSettings
    { -- | The URI to be redirected to when access is denied.
      accessDeniedPageUri :: (Core.Maybe Core.Text),
      -- | Whether to generate a troubleshooting URL on access denied events to this application.
      generateTroubleshootingUri :: (Core.Maybe Core.Bool),
      -- | Whether to generate remediation token on access denied events to this application.
      remediationTokenGenerationEnabled :: (Core.Maybe Core.Bool)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'AccessDeniedPageSettings' with the minimum fields required to make a request.
  newAccessDeniedPageSettings ::
    AccessDeniedPageSettings
  newAccessDeniedPageSettings =
    AccessDeniedPageSettings
      { accessDeniedPageUri = Core.Nothing,
        generateTroubleshootingUri = Core.Nothing,
        remediationTokenGenerationEnabled = Core.Nothing
      }
  
  instance Core.FromJSON AccessDeniedPageSettings where
    parseJSON =
      Core.withObject
        "AccessDeniedPageSettings"
        ( \o ->
            AccessDeniedPageSettings
              Core.<$> (o Core..:? "accessDeniedPageUri")
              Core.<*> (o Core..:? "generateTroubleshootingUri")
              Core.<*> (o Core..:? "remediationTokenGenerationEnabled")
        )
  
  instance Core.ToJSON AccessDeniedPageSettings where
    toJSON AccessDeniedPageSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("accessDeniedPageUri" Core..=) Core.<$> accessDeniedPageUri,
              ("generateTroubleshootingUri" Core..=)
                Core.<$> generateTroubleshootingUri,
              ("remediationTokenGenerationEnabled" Core..=)
                Core.<$> remediationTokenGenerationEnabled
            ]
        )
  
  -- | Access related settings for IAP protected apps.
  --
  -- /See:/ 'newAccessSettings' smart constructor.
  data AccessSettings = AccessSettings
    { -- | Optional. Settings to configure and enable allowed domains.
      allowedDomainsSettings :: (Core.Maybe AllowedDomainsSettings),
      -- | Optional. Configuration to allow cross-origin requests via IAP.
      corsSettings :: (Core.Maybe CorsSettings),
      -- | Optional. GCIP claims and endpoint configurations for 3p identity providers.
      gcipSettings :: (Core.Maybe GcipSettings),
      -- | Optional. Identity sources that IAP can use to authenticate the end user. Only one identity source can be configured.
      identitySources :: (Core.Maybe [AccessSettings_IdentitySourcesItem]),
      -- | Optional. Settings to configure IAP\'s OAuth behavior.
      oauthSettings :: (Core.Maybe OAuthSettings),
      -- | Optional. Settings to allow google-internal teams to use IAP for apps hosted in a tenant project.
      policyDelegationSettings :: (Core.Maybe PolicyDelegationSettings),
      -- | Optional. Settings to configure reauthentication policies in IAP.
      reauthSettings :: (Core.Maybe ReauthSettings),
      -- | Optional. Settings to configure the workforce identity federation, including workforce pools and OAuth 2.0 settings.
      workforceIdentitySettings :: (Core.Maybe WorkforceIdentitySettings)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'AccessSettings' with the minimum fields required to make a request.
  newAccessSettings ::
    AccessSettings
  newAccessSettings =
    AccessSettings
      { allowedDomainsSettings = Core.Nothing,
        corsSettings = Core.Nothing,
        gcipSettings = Core.Nothing,
        identitySources = Core.Nothing,
        oauthSettings = Core.Nothing,
        policyDelegationSettings = Core.Nothing,
        reauthSettings = Core.Nothing,
        workforceIdentitySettings = Core.Nothing
      }
  
  instance Core.FromJSON AccessSettings where
    parseJSON =
      Core.withObject
        "AccessSettings"
        ( \o ->
            AccessSettings
              Core.<$> (o Core..:? "allowedDomainsSettings")
              Core.<*> (o Core..:? "corsSettings")
              Core.<*> (o Core..:? "gcipSettings")
              Core.<*> (o Core..:? "identitySources")
              Core.<*> (o Core..:? "oauthSettings")
              Core.<*> (o Core..:? "policyDelegationSettings")
              Core.<*> (o Core..:? "reauthSettings")
              Core.<*> (o Core..:? "workforceIdentitySettings")
        )
  
  instance Core.ToJSON AccessSettings where
    toJSON AccessSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("allowedDomainsSettings" Core..=)
                Core.<$> allowedDomainsSettings,
              ("corsSettings" Core..=) Core.<$> corsSettings,
              ("gcipSettings" Core..=) Core.<$> gcipSettings,
              ("identitySources" Core..=) Core.<$> identitySources,
              ("oauthSettings" Core..=) Core.<$> oauthSettings,
              ("policyDelegationSettings" Core..=)
                Core.<$> policyDelegationSettings,
              ("reauthSettings" Core..=) Core.<$> reauthSettings,
              ("workforceIdentitySettings" Core..=)
                Core.<$> workforceIdentitySettings
            ]
        )
  
  -- | Configuration for IAP allowed domains. Lets you to restrict access to an app and allow access to only the domains that you list.
  --
  -- /See:/ 'newAllowedDomainsSettings' smart constructor.
  data AllowedDomainsSettings = AllowedDomainsSettings
    { -- | Optional. List of trusted domains.
      domains :: (Core.Maybe [Core.Text]),
      -- | Optional. Configuration for customers to opt in for the feature.
      enable :: (Core.Maybe Core.Bool)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'AllowedDomainsSettings' with the minimum fields required to make a request.
  newAllowedDomainsSettings ::
    AllowedDomainsSettings
  newAllowedDomainsSettings =
    AllowedDomainsSettings
      { domains = Core.Nothing,
        enable = Core.Nothing
      }
  
  instance Core.FromJSON AllowedDomainsSettings where
    parseJSON =
      Core.withObject
        "AllowedDomainsSettings"
        ( \o ->
            AllowedDomainsSettings
              Core.<$> (o Core..:? "domains")
              Core.<*> (o Core..:? "enable")
        )
  
  instance Core.ToJSON AllowedDomainsSettings where
    toJSON AllowedDomainsSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("domains" Core..=) Core.<$> domains,
              ("enable" Core..=) Core.<$> enable
            ]
        )
  
  -- | Wrapper over application specific settings for IAP.
  --
  -- /See:/ 'newApplicationSettings' smart constructor.
  data ApplicationSettings = ApplicationSettings
    { -- | Optional. Customization for Access Denied page.
      accessDeniedPageSettings :: (Core.Maybe AccessDeniedPageSettings),
      -- | Optional. Settings to configure attribute propagation.
      attributePropagationSettings :: (Core.Maybe AttributePropagationSettings),
      -- | The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid.
      cookieDomain :: (Core.Maybe Core.Text),
      -- | Optional. Settings to configure IAP\'s behavior for a service mesh.
      csmSettings :: (Core.Maybe CsmSettings)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ApplicationSettings' with the minimum fields required to make a request.
  newApplicationSettings ::
    ApplicationSettings
  newApplicationSettings =
    ApplicationSettings
      { accessDeniedPageSettings = Core.Nothing,
        attributePropagationSettings = Core.Nothing,
        cookieDomain = Core.Nothing,
        csmSettings = Core.Nothing
      }
  
  instance Core.FromJSON ApplicationSettings where
    parseJSON =
      Core.withObject
        "ApplicationSettings"
        ( \o ->
            ApplicationSettings
              Core.<$> (o Core..:? "accessDeniedPageSettings")
              Core.<*> (o Core..:? "attributePropagationSettings")
              Core.<*> (o Core..:? "cookieDomain")
              Core.<*> (o Core..:? "csmSettings")
        )
  
  instance Core.ToJSON ApplicationSettings where
    toJSON ApplicationSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("accessDeniedPageSettings" Core..=)
                Core.<$> accessDeniedPageSettings,
              ("attributePropagationSettings" Core..=)
                Core.<$> attributePropagationSettings,
              ("cookieDomain" Core..=) Core.<$> cookieDomain,
              ("csmSettings" Core..=) Core.<$> csmSettings
            ]
        )
  
  -- | Configuration for propagating attributes to applications protected by IAP.
  --
  -- /See:/ 'newAttributePropagationSettings' smart constructor.
  data AttributePropagationSettings = AttributePropagationSettings
    { -- | Optional. Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials.
      enable :: (Core.Maybe Core.Bool),
      -- | Optional. Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from @attributes@: @attributes.saml_attributes@, @attributes.iap_attributes@. The following functions are supported: - filter @.filter(, )@: Returns a subset of @where@ is true for every item. - in @in@: Returns true if @contains@. - selectByName @.selectByName()@: Returns the attribute in @with the given@ name, otherwise returns empty. - emitAs @.emitAs()@: Sets the @name field to the given@ for propagation in selected output credentials. - strict @.strict()@: Ignores the @x-goog-iap-attr-@ prefix for the provided @when propagating with the \`HEADER\` output credential, such as request headers. - append \`.append()\` OR \`.append()\`: Appends the provided@ or @to the end of@. Example expression: @attributes.saml_attributes.filter(x, x.name in [\'test\']).append(attributes.iap_attributes.selectByName(\'exact\').emitAs(\'custom\').strict())@
      expression :: (Core.Maybe Core.Text),
      -- | Optional. Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential.
      outputCredentials :: (Core.Maybe [AttributePropagationSettings_OutputCredentialsItem])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'AttributePropagationSettings' with the minimum fields required to make a request.
  newAttributePropagationSettings ::
    AttributePropagationSettings
  newAttributePropagationSettings =
    AttributePropagationSettings
      { enable = Core.Nothing,
        expression = Core.Nothing,
        outputCredentials = Core.Nothing
      }
  
  instance Core.FromJSON AttributePropagationSettings where
    parseJSON =
      Core.withObject
        "AttributePropagationSettings"
        ( \o ->
            AttributePropagationSettings
              Core.<$> (o Core..:? "enable")
              Core.<*> (o Core..:? "expression")
              Core.<*> (o Core..:? "outputCredentials")
        )
  
  instance Core.ToJSON AttributePropagationSettings where
    toJSON AttributePropagationSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("enable" Core..=) Core.<$> enable,
              ("expression" Core..=) Core.<$> expression,
              ("outputCredentials" Core..=) Core.<$> outputCredentials
            ]
        )
  
  -- | Associates @members@, or principals, with a @role@.
  --
  -- /See:/ 'newBinding' smart constructor.
  data Binding = Binding
    { -- | The condition that is associated with this binding. If the condition evaluates to @true@, then this binding applies to the current request. If the condition evaluates to @false@, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the <https://cloud.google.com/iam/help/conditions/resource-policies IAM documentation>.
      condition :: (Core.Maybe Expr),
      -- | Specifies the principals requesting access for a Google Cloud resource. @members@ can have the following values: * @allUsers@: A special identifier that represents anyone who is on the internet; with or without a Google account. * @allAuthenticatedUsers@: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * @user:{emailid}@: An email address that represents a specific Google account. For example, @alice\@example.com@ . * @serviceAccount:{emailid}@: An email address that represents a Google service account. For example, @my-other-app\@appspot.gserviceaccount.com@. * @serviceAccount:{projectid}.svc.id.goog[{namespace}\/{kubernetes-sa}]@: An identifier for a <https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts Kubernetes service account>. For example, @my-project.svc.id.goog[my-namespace\/my-kubernetes-sa]@. *
      -- @group:{emailid}@: An email address that represents a Google group. For example, @admins\@example.com@. * @domain:{domain}@: The G Suite domain (primary) that represents all the users of that domain. For example, @google.com@ or @example.com@. * @principal:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/{pool_id}\/subject\/{subject_attribute_value}@: A single identity in a workforce identity pool. * @principalSet:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/{pool_id}\/group\/{group_id}@: All workforce identities in a group. * @principalSet:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/{pool_id}\/attribute.{attribute_name}\/{attribute_value}@: All workforce identities with a specific attribute value. * @principalSet:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/{pool_id}\/*@: All identities in a workforce identity pool. *
      -- @principal:\/\/iam.googleapis.com\/projects\/{project_number}\/locations\/global\/workloadIdentityPools\/{pool_id}\/subject\/{subject_attribute_value}@: A single identity in a workload identity pool. * @principalSet:\/\/iam.googleapis.com\/projects\/{project_number}\/locations\/global\/workloadIdentityPools\/{pool_id}\/group\/{group_id}@: A workload identity pool group. * @principalSet:\/\/iam.googleapis.com\/projects\/{project_number}\/locations\/global\/workloadIdentityPools\/{pool_id}\/attribute.{attribute_name}\/{attribute_value}@: All identities in a workload identity pool with a certain attribute. * @principalSet:\/\/iam.googleapis.com\/projects\/{project_number}\/locations\/global\/workloadIdentityPools\/{pool_id}\/*@: All identities in a workload identity pool. * @deleted:user:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a user that has been recently deleted. For example, @alice\@example.com?uid=123456789012345678901@. If the user is recovered, this value reverts
      -- to @user:{emailid}@ and the recovered user retains the role in the binding. * @deleted:serviceAccount:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, @my-other-app\@appspot.gserviceaccount.com?uid=123456789012345678901@. If the service account is undeleted, this value reverts to @serviceAccount:{emailid}@ and the undeleted service account retains the role in the binding. * @deleted:group:{emailid}?uid={uniqueid}@: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, @admins\@example.com?uid=123456789012345678901@. If the group is recovered, this value reverts to @group:{emailid}@ and the recovered group retains the role in the binding. * @deleted:principal:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/{pool_id}\/subject\/{subject_attribute_value}@: Deleted single identity in a workforce identity pool. For example,
      -- @deleted:principal:\/\/iam.googleapis.com\/locations\/global\/workforcePools\/my-pool-id\/subject\/my-subject-attribute-value@.
      members :: (Core.Maybe [Core.Text]),
      -- | Role that is assigned to the list of @members@, or principals. For example, @roles\/viewer@, @roles\/editor@, or @roles\/owner@. For an overview of the IAM roles and permissions, see the <https://cloud.google.com/iam/docs/roles-overview IAM documentation>. For a list of the available pre-defined roles, see <https://cloud.google.com/iam/docs/understanding-roles here>.
      role' :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Binding' with the minimum fields required to make a request.
  newBinding ::
    Binding
  newBinding =
    Binding
      { condition = Core.Nothing,
        members = Core.Nothing,
        role' = Core.Nothing
      }
  
  instance Core.FromJSON Binding where
    parseJSON =
      Core.withObject
        "Binding"
        ( \o ->
            Binding
              Core.<$> (o Core..:? "condition")
              Core.<*> (o Core..:? "members")
              Core.<*> (o Core..:? "role")
        )
  
  instance Core.ToJSON Binding where
    toJSON Binding {..} =
      Core.object
        ( Core.catMaybes
            [ ("condition" Core..=) Core.<$> condition,
              ("members" Core..=) Core.<$> members,
              ("role" Core..=) Core.<$> role'
            ]
        )
  
  -- | OAuth brand data. NOTE: Only contains a portion of the data that describes a brand.
  --
  -- /See:/ 'newBrand' smart constructor.
  data Brand = Brand
    { -- | Application name displayed on OAuth consent screen.
      applicationTitle :: (Core.Maybe Core.Text),
      -- | Output only. Identifier of the brand. NOTE: GCP project number achieves the same brand identification purpose as only one brand per project can be created.
      name :: (Core.Maybe Core.Text),
      -- | Output only. Whether the brand is only intended for usage inside the G Suite organization only.
      orgInternalOnly :: (Core.Maybe Core.Bool),
      -- | Support email displayed on the OAuth consent screen.
      supportEmail :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Brand' with the minimum fields required to make a request.
  newBrand ::
    Brand
  newBrand =
    Brand
      { applicationTitle = Core.Nothing,
        name = Core.Nothing,
        orgInternalOnly = Core.Nothing,
        supportEmail = Core.Nothing
      }
  
  instance Core.FromJSON Brand where
    parseJSON =
      Core.withObject
        "Brand"
        ( \o ->
            Brand
              Core.<$> (o Core..:? "applicationTitle")
              Core.<*> (o Core..:? "name")
              Core.<*> (o Core..:? "orgInternalOnly")
              Core.<*> (o Core..:? "supportEmail")
        )
  
  instance Core.ToJSON Brand where
    toJSON Brand {..} =
      Core.object
        ( Core.catMaybes
            [ ("applicationTitle" Core..=) Core.<$> applicationTitle,
              ("name" Core..=) Core.<$> name,
              ("orgInternalOnly" Core..=) Core.<$> orgInternalOnly,
              ("supportEmail" Core..=) Core.<$> supportEmail
            ]
        )
  
  -- | Allows customers to configure HTTP request paths that\'ll allow HTTP OPTIONS call to bypass authentication and authorization.
  --
  -- /See:/ 'newCorsSettings' smart constructor.
  newtype CorsSettings = CorsSettings
    { -- | Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests.
      allowHttpOptions :: (Core.Maybe Core.Bool)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'CorsSettings' with the minimum fields required to make a request.
  newCorsSettings ::
    CorsSettings
  newCorsSettings = CorsSettings {allowHttpOptions = Core.Nothing}
  
  instance Core.FromJSON CorsSettings where
    parseJSON =
      Core.withObject
        "CorsSettings"
        (\o -> CorsSettings Core.<$> (o Core..:? "allowHttpOptions"))
  
  instance Core.ToJSON CorsSettings where
    toJSON CorsSettings {..} =
      Core.object
        ( Core.catMaybes
            [("allowHttpOptions" Core..=) Core.<$> allowHttpOptions]
        )
  
  -- | Configuration for RCToken generated for service mesh workloads protected by IAP. RCToken are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for service mesh deployments, and can be scoped to a single mesh by configuring the audience field accordingly.
  --
  -- /See:/ 'newCsmSettings' smart constructor.
  newtype CsmSettings = CsmSettings
    { -- | Audience claim set in the generated RCToken. This value is not validated by IAP.
      rctokenAud :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'CsmSettings' with the minimum fields required to make a request.
  newCsmSettings ::
    CsmSettings
  newCsmSettings = CsmSettings {rctokenAud = Core.Nothing}
  
  instance Core.FromJSON CsmSettings where
    parseJSON =
      Core.withObject
        "CsmSettings"
        (\o -> CsmSettings Core.<$> (o Core..:? "rctokenAud"))
  
  instance Core.ToJSON CsmSettings where
    toJSON CsmSettings {..} =
      Core.object
        (Core.catMaybes [("rctokenAud" Core..=) Core.<$> rctokenAud])
  
  -- | A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
  --
  -- /See:/ 'newEmpty' smart constructor.
  data Empty = Empty
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Empty' with the minimum fields required to make a request.
  newEmpty ::
    Empty
  newEmpty = Empty
  
  instance Core.FromJSON Empty where
    parseJSON = Core.withObject "Empty" (\o -> Core.pure Empty)
  
  instance Core.ToJSON Empty where
    toJSON = Core.const Core.emptyObject
  
  -- | Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https:\/\/github.com\/google\/cel-spec. Example (Comparison): title: \"Summary size limit\" description: \"Determines if a summary is less than 100 chars\" expression: \"document.summary.size() \< 100\" Example (Equality): title: \"Requestor is owner\" description: \"Determines if requestor is the document owner\" expression: \"document.owner == request.auth.claims.email\" Example (Logic): title: \"Public documents\" description: \"Determine whether the document should be publicly visible\" expression: \"document.type != \'private\' && document.type != \'internal\'\" Example (Data Manipulation): title: \"Notification string\" description: \"Create a notification string with a timestamp.\" expression: \"\'New message received at \' + string(document.create_time)\" The exact variables and functions that may be referenced within an expression are
  -- determined by the service that evaluates it. See the service documentation for additional information.
  --
  -- /See:/ 'newExpr' smart constructor.
  data Expr = Expr
    { -- | Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
      description :: (Core.Maybe Core.Text),
      -- | Textual representation of an expression in Common Expression Language syntax.
      expression :: (Core.Maybe Core.Text),
      -- | Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
      location :: (Core.Maybe Core.Text),
      -- | Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
      title :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Expr' with the minimum fields required to make a request.
  newExpr ::
    Expr
  newExpr =
    Expr
      { description = Core.Nothing,
        expression = Core.Nothing,
        location = Core.Nothing,
        title = Core.Nothing
      }
  
  instance Core.FromJSON Expr where
    parseJSON =
      Core.withObject
        "Expr"
        ( \o ->
            Expr
              Core.<$> (o Core..:? "description")
              Core.<*> (o Core..:? "expression")
              Core.<*> (o Core..:? "location")
              Core.<*> (o Core..:? "title")
        )
  
  instance Core.ToJSON Expr where
    toJSON Expr {..} =
      Core.object
        ( Core.catMaybes
            [ ("description" Core..=) Core.<$> description,
              ("expression" Core..=) Core.<$> expression,
              ("location" Core..=) Core.<$> location,
              ("title" Core..=) Core.<$> title
            ]
        )
  
  -- | Allows customers to configure tenant_id for GCIP instance per-app.
  --
  -- /See:/ 'newGcipSettings' smart constructor.
  data GcipSettings = GcipSettings
    { -- | Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level.
      loginPageUri :: (Core.Maybe Core.Text),
      -- | Optional. GCIP tenant ids that are linked to the IAP resource. tenant/ids could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of / to indicate authenticating with GCIP agent flow. If agent flow is used, tenant/ids should only contain one single element, while for tenant flow, tenant/ids can contain multiple elements.
      tenantIds :: (Core.Maybe [Core.Text])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'GcipSettings' with the minimum fields required to make a request.
  newGcipSettings ::
    GcipSettings
  newGcipSettings =
    GcipSettings
      { loginPageUri = Core.Nothing,
        tenantIds = Core.Nothing
      }
  
  instance Core.FromJSON GcipSettings where
    parseJSON =
      Core.withObject
        "GcipSettings"
        ( \o ->
            GcipSettings
              Core.<$> (o Core..:? "loginPageUri")
              Core.<*> (o Core..:? "tenantIds")
        )
  
  instance Core.ToJSON GcipSettings where
    toJSON GcipSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("loginPageUri" Core..=) Core.<$> loginPageUri,
              ("tenantIds" Core..=) Core.<$> tenantIds
            ]
        )
  
  -- | Request message for @GetIamPolicy@ method.
  --
  -- /See:/ 'newGetIamPolicyRequest' smart constructor.
  newtype GetIamPolicyRequest = GetIamPolicyRequest
    { -- | OPTIONAL: A @GetPolicyOptions@ object for specifying options to @GetIamPolicy@.
      options :: (Core.Maybe GetPolicyOptions)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'GetIamPolicyRequest' with the minimum fields required to make a request.
  newGetIamPolicyRequest ::
    GetIamPolicyRequest
  newGetIamPolicyRequest =
    GetIamPolicyRequest {options = Core.Nothing}
  
  instance Core.FromJSON GetIamPolicyRequest where
    parseJSON =
      Core.withObject
        "GetIamPolicyRequest"
        (\o -> GetIamPolicyRequest Core.<$> (o Core..:? "options"))
  
  instance Core.ToJSON GetIamPolicyRequest where
    toJSON GetIamPolicyRequest {..} =
      Core.object
        (Core.catMaybes [("options" Core..=) Core.<$> options])
  
  -- | Encapsulates settings provided to GetIamPolicy.
  --
  -- /See:/ 'newGetPolicyOptions' smart constructor.
  newtype GetPolicyOptions = GetPolicyOptions
    { -- | Optional. The maximum policy version that will be used to format the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional role bindings must specify version 3. Policies with no conditional role bindings may specify any valid value or leave the field unset. The policy in the response might use the policy version that you specified, or it might use a lower policy version. For example, if you specify version 3, but the policy has no conditional role bindings, the response uses version 1. To learn which resources support conditions in their IAM policies, see the <https://cloud.google.com/iam/help/conditions/resource-policies IAM documentation>.
      requestedPolicyVersion :: (Core.Maybe Core.Int32)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'GetPolicyOptions' with the minimum fields required to make a request.
  newGetPolicyOptions ::
    GetPolicyOptions
  newGetPolicyOptions =
    GetPolicyOptions {requestedPolicyVersion = Core.Nothing}
  
  instance Core.FromJSON GetPolicyOptions where
    parseJSON =
      Core.withObject
        "GetPolicyOptions"
        ( \o ->
            GetPolicyOptions Core.<$> (o Core..:? "requestedPolicyVersion")
        )
  
  instance Core.ToJSON GetPolicyOptions where
    toJSON GetPolicyOptions {..} =
      Core.object
        ( Core.catMaybes
            [ ("requestedPolicyVersion" Core..=)
                Core.<$> requestedPolicyVersion
            ]
        )
  
  -- | The IAP configurable settings.
  --
  -- /See:/ 'newIapSettings' smart constructor.
  data IapSettings = IapSettings
    { -- | Optional. Top level wrapper for all access related setting in IAP
      accessSettings :: (Core.Maybe AccessSettings),
      -- | Optional. Top level wrapper for all application related settings in IAP
      applicationSettings :: (Core.Maybe ApplicationSettings),
      -- | Required. The resource name of the IAP protected resource.
      name :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'IapSettings' with the minimum fields required to make a request.
  newIapSettings ::
    IapSettings
  newIapSettings =
    IapSettings
      { accessSettings = Core.Nothing,
        applicationSettings = Core.Nothing,
        name = Core.Nothing
      }
  
  instance Core.FromJSON IapSettings where
    parseJSON =
      Core.withObject
        "IapSettings"
        ( \o ->
            IapSettings
              Core.<$> (o Core..:? "accessSettings")
              Core.<*> (o Core..:? "applicationSettings")
              Core.<*> (o Core..:? "name")
        )
  
  instance Core.ToJSON IapSettings where
    toJSON IapSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("accessSettings" Core..=) Core.<$> accessSettings,
              ("applicationSettings" Core..=) Core.<$> applicationSettings,
              ("name" Core..=) Core.<$> name
            ]
        )
  
  -- | Contains the data that describes an Identity Aware Proxy owned client.
  --
  -- /See:/ 'newIdentityAwareProxyClient' smart constructor.
  data IdentityAwareProxyClient = IdentityAwareProxyClient
    { -- | Human-friendly name given to the OAuth client.
      displayName :: (Core.Maybe Core.Text),
      -- | Output only. Unique identifier of the OAuth client.
      name :: (Core.Maybe Core.Text),
      -- | Output only. Client secret of the OAuth client.
      secret :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'IdentityAwareProxyClient' with the minimum fields required to make a request.
  newIdentityAwareProxyClient ::
    IdentityAwareProxyClient
  newIdentityAwareProxyClient =
    IdentityAwareProxyClient
      { displayName = Core.Nothing,
        name = Core.Nothing,
        secret = Core.Nothing
      }
  
  instance Core.FromJSON IdentityAwareProxyClient where
    parseJSON =
      Core.withObject
        "IdentityAwareProxyClient"
        ( \o ->
            IdentityAwareProxyClient
              Core.<$> (o Core..:? "displayName")
              Core.<*> (o Core..:? "name")
              Core.<*> (o Core..:? "secret")
        )
  
  instance Core.ToJSON IdentityAwareProxyClient where
    toJSON IdentityAwareProxyClient {..} =
      Core.object
        ( Core.catMaybes
            [ ("displayName" Core..=) Core.<$> displayName,
              ("name" Core..=) Core.<$> name,
              ("secret" Core..=) Core.<$> secret
            ]
        )
  
  -- | Response message for ListBrands.
  --
  -- /See:/ 'newListBrandsResponse' smart constructor.
  newtype ListBrandsResponse = ListBrandsResponse
    { -- | Brands existing in the project.
      brands :: (Core.Maybe [Brand])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ListBrandsResponse' with the minimum fields required to make a request.
  newListBrandsResponse ::
    ListBrandsResponse
  newListBrandsResponse = ListBrandsResponse {brands = Core.Nothing}
  
  instance Core.FromJSON ListBrandsResponse where
    parseJSON =
      Core.withObject
        "ListBrandsResponse"
        (\o -> ListBrandsResponse Core.<$> (o Core..:? "brands"))
  
  instance Core.ToJSON ListBrandsResponse where
    toJSON ListBrandsResponse {..} =
      Core.object (Core.catMaybes [("brands" Core..=) Core.<$> brands])
  
  -- | Response message for ListIdentityAwareProxyClients.
  --
  -- /See:/ 'newListIdentityAwareProxyClientsResponse' smart constructor.
  data ListIdentityAwareProxyClientsResponse = ListIdentityAwareProxyClientsResponse
    { -- | Clients existing in the brand.
      identityAwareProxyClients :: (Core.Maybe [IdentityAwareProxyClient]),
      -- | A token, which can be send as @page_token@ to retrieve the next page. If this field is omitted, there are no subsequent pages.
      nextPageToken :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ListIdentityAwareProxyClientsResponse' with the minimum fields required to make a request.
  newListIdentityAwareProxyClientsResponse ::
    ListIdentityAwareProxyClientsResponse
  newListIdentityAwareProxyClientsResponse =
    ListIdentityAwareProxyClientsResponse
      { identityAwareProxyClients =
          Core.Nothing,
        nextPageToken = Core.Nothing
      }
  
  instance Core.FromJSON ListIdentityAwareProxyClientsResponse where
    parseJSON =
      Core.withObject
        "ListIdentityAwareProxyClientsResponse"
        ( \o ->
            ListIdentityAwareProxyClientsResponse
              Core.<$> (o Core..:? "identityAwareProxyClients")
              Core.<*> (o Core..:? "nextPageToken")
        )
  
  instance Core.ToJSON ListIdentityAwareProxyClientsResponse where
    toJSON ListIdentityAwareProxyClientsResponse {..} =
      Core.object
        ( Core.catMaybes
            [ ("identityAwareProxyClients" Core..=)
                Core.<$> identityAwareProxyClients,
              ("nextPageToken" Core..=) Core.<$> nextPageToken
            ]
        )
  
  -- | The response from ListTunnelDestGroups.
  --
  -- /See:/ 'newListTunnelDestGroupsResponse' smart constructor.
  data ListTunnelDestGroupsResponse = ListTunnelDestGroupsResponse
    { -- | A token that you can send as @page_token@ to retrieve the next page. If this field is omitted, there are no subsequent pages.
      nextPageToken :: (Core.Maybe Core.Text),
      -- | TunnelDestGroup existing in the project.
      tunnelDestGroups :: (Core.Maybe [TunnelDestGroup])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ListTunnelDestGroupsResponse' with the minimum fields required to make a request.
  newListTunnelDestGroupsResponse ::
    ListTunnelDestGroupsResponse
  newListTunnelDestGroupsResponse =
    ListTunnelDestGroupsResponse
      { nextPageToken = Core.Nothing,
        tunnelDestGroups = Core.Nothing
      }
  
  instance Core.FromJSON ListTunnelDestGroupsResponse where
    parseJSON =
      Core.withObject
        "ListTunnelDestGroupsResponse"
        ( \o ->
            ListTunnelDestGroupsResponse
              Core.<$> (o Core..:? "nextPageToken")
              Core.<*> (o Core..:? "tunnelDestGroups")
        )
  
  instance Core.ToJSON ListTunnelDestGroupsResponse where
    toJSON ListTunnelDestGroupsResponse {..} =
      Core.object
        ( Core.catMaybes
            [ ("nextPageToken" Core..=) Core.<$> nextPageToken,
              ("tunnelDestGroups" Core..=) Core.<$> tunnelDestGroups
            ]
        )
  
  -- | Used for calculating the next state of tags on the resource being passed for the CheckCustomConstraints RPC call. The detail evaluation of each field is described in go\/op-create-update-time-tags and go\/tags-in-orgpolicy-requests.
  --
  -- /See:/ 'newNextStateOfTags' smart constructor.
  data NextStateOfTags = NextStateOfTags
    { tagsFullState :: (Core.Maybe TagsFullState),
      tagsFullStateForChildResource :: (Core.Maybe TagsFullStateForChildResource),
      tagsPartialState :: (Core.Maybe TagsPartialState)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'NextStateOfTags' with the minimum fields required to make a request.
  newNextStateOfTags ::
    NextStateOfTags
  newNextStateOfTags =
    NextStateOfTags
      { tagsFullState = Core.Nothing,
        tagsFullStateForChildResource = Core.Nothing,
        tagsPartialState = Core.Nothing
      }
  
  instance Core.FromJSON NextStateOfTags where
    parseJSON =
      Core.withObject
        "NextStateOfTags"
        ( \o ->
            NextStateOfTags
              Core.<$> (o Core..:? "tagsFullState")
              Core.<*> (o Core..:? "tagsFullStateForChildResource")
              Core.<*> (o Core..:? "tagsPartialState")
        )
  
  instance Core.ToJSON NextStateOfTags where
    toJSON NextStateOfTags {..} =
      Core.object
        ( Core.catMaybes
            [ ("tagsFullState" Core..=) Core.<$> tagsFullState,
              ("tagsFullStateForChildResource" Core..=)
                Core.<$> tagsFullStateForChildResource,
              ("tagsPartialState" Core..=) Core.<$> tagsPartialState
            ]
        )
  
  -- | The OAuth 2.0 Settings
  --
  -- /See:/ 'newOAuth2' smart constructor.
  data OAuth2 = OAuth2
    { -- | The OAuth 2.0 client ID registered in the workforce identity federation OAuth 2.0 Server.
      clientId :: (Core.Maybe Core.Text),
      -- | Input only. The OAuth 2.0 client secret created while registering the client ID.
      clientSecret :: (Core.Maybe Core.Text),
      -- | Output only. SHA256 hash value for the client secret. This field is returned by IAP when the settings are retrieved.
      clientSecretSha256 :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'OAuth2' with the minimum fields required to make a request.
  newOAuth2 ::
    OAuth2
  newOAuth2 =
    OAuth2
      { clientId = Core.Nothing,
        clientSecret = Core.Nothing,
        clientSecretSha256 = Core.Nothing
      }
  
  instance Core.FromJSON OAuth2 where
    parseJSON =
      Core.withObject
        "OAuth2"
        ( \o ->
            OAuth2
              Core.<$> (o Core..:? "clientId")
              Core.<*> (o Core..:? "clientSecret")
              Core.<*> (o Core..:? "clientSecretSha256")
        )
  
  instance Core.ToJSON OAuth2 where
    toJSON OAuth2 {..} =
      Core.object
        ( Core.catMaybes
            [ ("clientId" Core..=) Core.<$> clientId,
              ("clientSecret" Core..=) Core.<$> clientSecret,
              ("clientSecretSha256" Core..=) Core.<$> clientSecretSha256
            ]
        )
  
  -- | Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.
  --
  -- /See:/ 'newOAuthSettings' smart constructor.
  data OAuthSettings = OAuthSettings
    { -- | Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google\'s login screen. https:\/\/developers.google.com\/identity\/protocols\/OpenIDConnect#hd-param Note: IAP does not verify that the id token\'s hd claim matches this value since access behavior is managed by IAM policies.
      loginHint :: (Core.Maybe Core.Text),
      -- | Optional. List of client ids allowed to use IAP programmatically.
      programmaticClients :: (Core.Maybe [Core.Text])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'OAuthSettings' with the minimum fields required to make a request.
  newOAuthSettings ::
    OAuthSettings
  newOAuthSettings =
    OAuthSettings
      { loginHint = Core.Nothing,
        programmaticClients = Core.Nothing
      }
  
  instance Core.FromJSON OAuthSettings where
    parseJSON =
      Core.withObject
        "OAuthSettings"
        ( \o ->
            OAuthSettings
              Core.<$> (o Core..:? "loginHint")
              Core.<*> (o Core..:? "programmaticClients")
        )
  
  instance Core.ToJSON OAuthSettings where
    toJSON OAuthSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("loginHint" Core..=) Core.<$> loginHint,
              ("programmaticClients" Core..=) Core.<$> programmaticClients
            ]
        )
  
  -- | An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A @Policy@ is a collection of @bindings@. A @binding@ binds one or more @members@, or principals, to a single @role@. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A @role@ is a named list of permissions; each @role@ can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a @binding@ can also specify a @condition@, which is a logical expression that allows access to a resource only if the expression evaluates to @true@. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the <https://cloud.google.com/iam/help/conditions/resource-policies IAM documentation>. __JSON example:__
  -- @{ \"bindings\": [ { \"role\": \"roles\/resourcemanager.organizationAdmin\", \"members\": [ \"user:mike\@example.com\", \"group:admins\@example.com\", \"domain:google.com\", \"serviceAccount:my-project-id\@appspot.gserviceaccount.com\" ] }, { \"role\": \"roles\/resourcemanager.organizationViewer\", \"members\": [ \"user:eve\@example.com\" ], \"condition\": { \"title\": \"expirable access\", \"description\": \"Does not grant access after Sep 2020\", \"expression\": \"request.time \< timestamp(\'2020-10-01T00:00:00.000Z\')\", } } ], \"etag\": \"BwWWja0YfJA=\", \"version\": 3 }@ __YAML example:__
  -- @bindings: - members: - user:mike\@example.com - group:admins\@example.com - domain:google.com - serviceAccount:my-project-id\@appspot.gserviceaccount.com role: roles\/resourcemanager.organizationAdmin - members: - user:eve\@example.com role: roles\/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time \< timestamp(\'2020-10-01T00:00:00.000Z\') etag: BwWWja0YfJA= version: 3@ For a description of IAM and its features, see the <https://cloud.google.com/iam/docs/ IAM documentation>.
  --
  -- /See:/ 'newPolicy' smart constructor.
  data Policy = Policy
    { -- | Associates a list of @members@, or principals, with a @role@. Optionally, may specify a @condition@ that determines how and when the @bindings@ are applied. Each of the @bindings@ must contain at least one principal. The @bindings@ in a @Policy@ can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the @bindings@ grant 50 different roles to @user:alice\@example.com@, and not to any other principal, then you can add another 1,450 principals to the @bindings@ in the @Policy@.
      bindings :: (Core.Maybe [Binding]),
      -- | @etag@ is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the @etag@ in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An @etag@ is returned in the response to @getIamPolicy@, and systems are expected to put that etag in the request to @setIamPolicy@ to ensure that their change will be applied to the same version of the policy. __Important:__ If you use IAM Conditions, you must include the @etag@ field whenever you call @setIamPolicy@. If you omit this field, then IAM allows you to overwrite a version @3@ policy with a version @1@ policy, and all of the conditions in the version @3@ policy are lost.
      etag :: (Core.Maybe Core.Base64),
      -- | Specifies the format of the policy. Valid values are @0@, @1@, and @3@. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version @3@. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions __Important:__ If you use IAM Conditions, you must include the @etag@ field whenever you call @setIamPolicy@. If you omit this field, then IAM allows you to overwrite a version @3@ policy with a version @1@ policy, and all of the conditions in the version @3@ policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the
      -- <https://cloud.google.com/iam/help/conditions/resource-policies IAM documentation>.
      version :: (Core.Maybe Core.Int32)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Policy' with the minimum fields required to make a request.
  newPolicy ::
    Policy
  newPolicy =
    Policy
      { bindings = Core.Nothing,
        etag = Core.Nothing,
        version = Core.Nothing
      }
  
  instance Core.FromJSON Policy where
    parseJSON =
      Core.withObject
        "Policy"
        ( \o ->
            Policy
              Core.<$> (o Core..:? "bindings")
              Core.<*> (o Core..:? "etag")
              Core.<*> (o Core..:? "version")
        )
  
  instance Core.ToJSON Policy where
    toJSON Policy {..} =
      Core.object
        ( Core.catMaybes
            [ ("bindings" Core..=) Core.<$> bindings,
              ("etag" Core..=) Core.<$> etag,
              ("version" Core..=) Core.<$> version
            ]
        )
  
  -- | PolicyDelegationConfig allows google-internal teams to use IAP for apps hosted in a tenant project. Using these settings, the app can delegate permission check to happen against the linked customer project. This is only ever supposed to be used by google internal teams, hence the restriction on the proto.
  --
  -- /See:/ 'newPolicyDelegationSettings' smart constructor.
  data PolicyDelegationSettings = PolicyDelegationSettings
    { -- | Permission to check in IAM.
      iamPermission :: (Core.Maybe Core.Text),
      -- | The DNS name of the service (e.g. \"resourcemanager.googleapis.com\"). This should be the domain name part of the full resource names (see https:\/\/aip.dev\/122#full-resource-names), which is usually the same as IamServiceSpec.service of the service where the resource type is defined.
      iamServiceName :: (Core.Maybe Core.Text),
      -- | Policy name to be checked
      policyName :: (Core.Maybe PolicyName),
      -- | IAM resource to check permission on
      resource :: (Core.Maybe Resource)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'PolicyDelegationSettings' with the minimum fields required to make a request.
  newPolicyDelegationSettings ::
    PolicyDelegationSettings
  newPolicyDelegationSettings =
    PolicyDelegationSettings
      { iamPermission = Core.Nothing,
        iamServiceName = Core.Nothing,
        policyName = Core.Nothing,
        resource = Core.Nothing
      }
  
  instance Core.FromJSON PolicyDelegationSettings where
    parseJSON =
      Core.withObject
        "PolicyDelegationSettings"
        ( \o ->
            PolicyDelegationSettings
              Core.<$> (o Core..:? "iamPermission")
              Core.<*> (o Core..:? "iamServiceName")
              Core.<*> (o Core..:? "policyName")
              Core.<*> (o Core..:? "resource")
        )
  
  instance Core.ToJSON PolicyDelegationSettings where
    toJSON PolicyDelegationSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("iamPermission" Core..=) Core.<$> iamPermission,
              ("iamServiceName" Core..=) Core.<$> iamServiceName,
              ("policyName" Core..=) Core.<$> policyName,
              ("resource" Core..=) Core.<$> resource
            ]
        )
  
  -- | An internal name for an IAM policy, based on the resource to which the policy applies. Not to be confused with a resource\'s external full resource name. For more information on this distinction, see go\/iam-full-resource-names.
  --
  -- /See:/ 'newPolicyName' smart constructor.
  data PolicyName = PolicyName
    { -- | Identifies an instance of the type. ID format varies by type. The ID format is defined in the IAM .service file that defines the type, either in path_mapping or in a comment.
      id :: (Core.Maybe Core.Text),
      -- | For Cloud IAM: The location of the Policy. Must be empty or \"global\" for Policies owned by global IAM. Must name a region from prodspec\/cloud-iam-cloudspec for Regional IAM Policies, see go\/iam-faq#where-is-iam-currently-deployed. For Local IAM: This field should be set to \"local\".
      region :: (Core.Maybe Core.Text),
      -- | Resource type. Types are defined in IAM\'s .service files. Valid values for type might be \'storage/buckets\', \'compute/instances\', \'resourcemanager/customers\', \'billing/accounts\', etc.
      type' :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'PolicyName' with the minimum fields required to make a request.
  newPolicyName ::
    PolicyName
  newPolicyName =
    PolicyName
      { id = Core.Nothing,
        region = Core.Nothing,
        type' = Core.Nothing
      }
  
  instance Core.FromJSON PolicyName where
    parseJSON =
      Core.withObject
        "PolicyName"
        ( \o ->
            PolicyName
              Core.<$> (o Core..:? "id")
              Core.<*> (o Core..:? "region")
              Core.<*> (o Core..:? "type")
        )
  
  instance Core.ToJSON PolicyName where
    toJSON PolicyName {..} =
      Core.object
        ( Core.catMaybes
            [ ("id" Core..=) Core.<$> id,
              ("region" Core..=) Core.<$> region,
              ("type" Core..=) Core.<$> type'
            ]
        )
  
  -- | Configuration for IAP reauthentication policies.
  --
  -- /See:/ 'newReauthSettings' smart constructor.
  data ReauthSettings = ReauthSettings
    { -- | Optional. Reauth session lifetime, how long before a user has to reauthenticate again.
      maxAge :: (Core.Maybe Core.Duration),
      -- | Optional. Reauth method requested.
      method :: (Core.Maybe ReauthSettings_Method),
      -- | Optional. How IAP determines the effective policy in cases of hierarchical policies. Policies are merged from higher in the hierarchy to lower in the hierarchy.
      policyType :: (Core.Maybe ReauthSettings_PolicyType)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ReauthSettings' with the minimum fields required to make a request.
  newReauthSettings ::
    ReauthSettings
  newReauthSettings =
    ReauthSettings
      { maxAge = Core.Nothing,
        method = Core.Nothing,
        policyType = Core.Nothing
      }
  
  instance Core.FromJSON ReauthSettings where
    parseJSON =
      Core.withObject
        "ReauthSettings"
        ( \o ->
            ReauthSettings
              Core.<$> (o Core..:? "maxAge")
              Core.<*> (o Core..:? "method")
              Core.<*> (o Core..:? "policyType")
        )
  
  instance Core.ToJSON ReauthSettings where
    toJSON ReauthSettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("maxAge" Core..=) Core.<$> maxAge,
              ("method" Core..=) Core.<$> method,
              ("policyType" Core..=) Core.<$> policyType
            ]
        )
  
  -- | The request sent to ResetIdentityAwareProxyClientSecret.
  --
  -- /See:/ 'newResetIdentityAwareProxyClientSecretRequest' smart constructor.
  data ResetIdentityAwareProxyClientSecretRequest = ResetIdentityAwareProxyClientSecretRequest
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ResetIdentityAwareProxyClientSecretRequest' with the minimum fields required to make a request.
  newResetIdentityAwareProxyClientSecretRequest ::
    ResetIdentityAwareProxyClientSecretRequest
  newResetIdentityAwareProxyClientSecretRequest =
    ResetIdentityAwareProxyClientSecretRequest
  
  instance Core.FromJSON ResetIdentityAwareProxyClientSecretRequest where
    parseJSON =
      Core.withObject
        "ResetIdentityAwareProxyClientSecretRequest"
        (\o -> Core.pure ResetIdentityAwareProxyClientSecretRequest)
  
  instance Core.ToJSON ResetIdentityAwareProxyClientSecretRequest where
    toJSON = Core.const Core.emptyObject
  
  --
  -- /See:/ 'newResource' smart constructor.
  data Resource = Resource
    { -- | The proto or JSON formatted expected next state of the resource, wrapped in a google.protobuf.Any proto, against which the policy rules are evaluated. Services not integrated with custom org policy can omit this field. Services integrated with custom org policy must populate this field for all requests where the API call changes the state of the resource. Custom org policy backend uses these attributes to enforce custom org policies. For create operations, GCP service is expected to pass resource from customer request as is. For update\/patch operations, GCP service is expected to compute the next state with the patch provided by the user. See go\/custom-constraints-org-policy-integration-guide for additional details.
      expectedNextState :: (Core.Maybe Resource_ExpectedNextState),
      -- | The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a @resource.labels[foo]@ construct, IAM consults with this map to retrieve the values associated with @foo@ key for Conditions evaluation. If the provided key is not found in the labels map, the condition would evaluate to false. This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go\/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng\@ about your use case.
      labels :: (Core.Maybe Resource_Labels),
      -- | The __relative__ name of the resource, which is the URI path of the resource without the leading \"\/\". See https:\/\/cloud.google.com\/iam\/docs\/conditions-resource-attributes#resource-name for examples used by other GCP Services. This field is __required__ for services integrated with resource-attribute-based IAM conditions and\/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as @create@ and @list@. See the document linked below for further details. See go\/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field.
      name :: (Core.Maybe Core.Text),
      -- | Used for calculating the next state of tags on the resource being passed for Custom Org Policy enforcement. NOTE: Only one of the tags representations (i.e. numeric or namespaced) should be populated. The input tags will be converted to the same representation before the calculation. This behavior intentionally may differ from other tags related fields in CheckPolicy request, which may require both formats to be passed in. IMPORTANT: If tags are unchanged, this field should not be set.
      nextStateOfTags :: (Core.Maybe NextStateOfTags),
      -- | The name of the service this resource belongs to. It is configured using the official/service/name of the Service as defined in service configurations under \/\/configs\/cloud\/resourcetypes. For example, the official/service/name of cloud resource manager service is set as \'cloudresourcemanager.googleapis.com\' according to \/\/configs\/cloud\/resourcetypes\/google\/cloud\/resourcemanager\/prod.yaml This field is __required__ for services integrated with resource-attribute-based IAM conditions and\/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as @create@ and @list@. See the document linked below for further details. See go\/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field.
      service :: (Core.Maybe Core.Text),
      -- | The public resource type name of the resource. It is configured using the official/name of the ResourceType as defined in service configurations under \/\/configs\/cloud\/resourcetypes. For example, the official/name for GCP projects is set as \'cloudresourcemanager.googleapis.com\/Project\' according to \/\/configs\/cloud\/resourcetypes\/google\/cloud\/resourcemanager\/prod.yaml This field is __required__ for services integrated with resource-attribute-based IAM conditions and\/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as @create@ and @list@. See the document linked below for further details. See go\/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field.
      type' :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Resource' with the minimum fields required to make a request.
  newResource ::
    Resource
  newResource =
    Resource
      { expectedNextState = Core.Nothing,
        labels = Core.Nothing,
        name = Core.Nothing,
        nextStateOfTags = Core.Nothing,
        service = Core.Nothing,
        type' = Core.Nothing
      }
  
  instance Core.FromJSON Resource where
    parseJSON =
      Core.withObject
        "Resource"
        ( \o ->
            Resource
              Core.<$> (o Core..:? "expectedNextState")
              Core.<*> (o Core..:? "labels")
              Core.<*> (o Core..:? "name")
              Core.<*> (o Core..:? "nextStateOfTags")
              Core.<*> (o Core..:? "service")
              Core.<*> (o Core..:? "type")
        )
  
  instance Core.ToJSON Resource where
    toJSON Resource {..} =
      Core.object
        ( Core.catMaybes
            [ ("expectedNextState" Core..=) Core.<$> expectedNextState,
              ("labels" Core..=) Core.<$> labels,
              ("name" Core..=) Core.<$> name,
              ("nextStateOfTags" Core..=) Core.<$> nextStateOfTags,
              ("service" Core..=) Core.<$> service,
              ("type" Core..=) Core.<$> type'
            ]
        )
  
  -- | The proto or JSON formatted expected next state of the resource, wrapped in a google.protobuf.Any proto, against which the policy rules are evaluated. Services not integrated with custom org policy can omit this field. Services integrated with custom org policy must populate this field for all requests where the API call changes the state of the resource. Custom org policy backend uses these attributes to enforce custom org policies. For create operations, GCP service is expected to pass resource from customer request as is. For update\/patch operations, GCP service is expected to compute the next state with the patch provided by the user. See go\/custom-constraints-org-policy-integration-guide for additional details.
  --
  -- /See:/ 'newResource_ExpectedNextState' smart constructor.
  newtype Resource_ExpectedNextState = Resource_ExpectedNextState
    { -- | Properties of the object. Contains field \@type with type URL.
      additional :: (Core.HashMap Core.Text Core.Value)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Resource_ExpectedNextState' with the minimum fields required to make a request.
  newResource_ExpectedNextState ::
    -- |  Properties of the object. Contains field \@type with type URL. See 'additional'.
    Core.HashMap Core.Text Core.Value ->
    Resource_ExpectedNextState
  newResource_ExpectedNextState additional =
    Resource_ExpectedNextState {additional = additional}
  
  instance Core.FromJSON Resource_ExpectedNextState where
    parseJSON =
      Core.withObject
        "Resource_ExpectedNextState"
        ( \o ->
            Resource_ExpectedNextState Core.<$> (Core.parseJSONObject o)
        )
  
  instance Core.ToJSON Resource_ExpectedNextState where
    toJSON Resource_ExpectedNextState {..} = Core.toJSON additional
  
  -- | The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a @resource.labels[foo]@ construct, IAM consults with this map to retrieve the values associated with @foo@ key for Conditions evaluation. If the provided key is not found in the labels map, the condition would evaluate to false. This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go\/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng\@ about your use case.
  --
  -- /See:/ 'newResource_Labels' smart constructor.
  newtype Resource_Labels = Resource_Labels
    { additional :: (Core.HashMap Core.Text Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'Resource_Labels' with the minimum fields required to make a request.
  newResource_Labels ::
    -- |  See 'additional'.
    Core.HashMap Core.Text Core.Text ->
    Resource_Labels
  newResource_Labels additional =
    Resource_Labels {additional = additional}
  
  instance Core.FromJSON Resource_Labels where
    parseJSON =
      Core.withObject
        "Resource_Labels"
        (\o -> Resource_Labels Core.<$> (Core.parseJSONObject o))
  
  instance Core.ToJSON Resource_Labels where
    toJSON Resource_Labels {..} = Core.toJSON additional
  
  -- | Request message for @SetIamPolicy@ method.
  --
  -- /See:/ 'newSetIamPolicyRequest' smart constructor.
  newtype SetIamPolicyRequest = SetIamPolicyRequest
    { -- | REQUIRED: The complete policy to be applied to the @resource@. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Google Cloud services (such as Projects) might reject them.
      policy :: (Core.Maybe Policy)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'SetIamPolicyRequest' with the minimum fields required to make a request.
  newSetIamPolicyRequest ::
    SetIamPolicyRequest
  newSetIamPolicyRequest = SetIamPolicyRequest {policy = Core.Nothing}
  
  instance Core.FromJSON SetIamPolicyRequest where
    parseJSON =
      Core.withObject
        "SetIamPolicyRequest"
        (\o -> SetIamPolicyRequest Core.<$> (o Core..:? "policy"))
  
  instance Core.ToJSON SetIamPolicyRequest where
    toJSON SetIamPolicyRequest {..} =
      Core.object (Core.catMaybes [("policy" Core..=) Core.<$> policy])
  
  --
  -- /See:/ 'newTagsFullState' smart constructor.
  newtype TagsFullState = TagsFullState
    { -- | If TagsFullState is initialized, the values in this field fully represent all the tags in the next state (the current tag values are not used). If tags.size() == 0, the next state of tags would be no tags for evaluation purposes. Only one type of tags reference (numeric or namespace) is required to be passed.
      tags :: (Core.Maybe TagsFullState_Tags)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsFullState' with the minimum fields required to make a request.
  newTagsFullState ::
    TagsFullState
  newTagsFullState = TagsFullState {tags = Core.Nothing}
  
  instance Core.FromJSON TagsFullState where
    parseJSON =
      Core.withObject
        "TagsFullState"
        (\o -> TagsFullState Core.<$> (o Core..:? "tags"))
  
  instance Core.ToJSON TagsFullState where
    toJSON TagsFullState {..} =
      Core.object (Core.catMaybes [("tags" Core..=) Core.<$> tags])
  
  -- | If TagsFullState is initialized, the values in this field fully represent all the tags in the next state (the current tag values are not used). If tags.size() == 0, the next state of tags would be no tags for evaluation purposes. Only one type of tags reference (numeric or namespace) is required to be passed.
  --
  -- /See:/ 'newTagsFullState_Tags' smart constructor.
  newtype TagsFullState_Tags = TagsFullState_Tags
    { additional :: (Core.HashMap Core.Text Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsFullState_Tags' with the minimum fields required to make a request.
  newTagsFullState_Tags ::
    -- |  See 'additional'.
    Core.HashMap Core.Text Core.Text ->
    TagsFullState_Tags
  newTagsFullState_Tags additional =
    TagsFullState_Tags {additional = additional}
  
  instance Core.FromJSON TagsFullState_Tags where
    parseJSON =
      Core.withObject
        "TagsFullState_Tags"
        (\o -> TagsFullState_Tags Core.<$> (Core.parseJSONObject o))
  
  instance Core.ToJSON TagsFullState_Tags where
    toJSON TagsFullState_Tags {..} = Core.toJSON additional
  
  --
  -- /See:/ 'newTagsFullStateForChildResource' smart constructor.
  newtype TagsFullStateForChildResource = TagsFullStateForChildResource
    { -- | If TagsFullStateForChildResource is initialized, the values in this field represent all the tags in the next state for the child resource. Only one type of tags reference (numeric or namespace) is required to be passed. IMPORTANT: This field should only be used when the target resource IAM policy name is UNKNOWN and the resource\'s parent IAM policy name is being passed in the request.
      tags :: (Core.Maybe TagsFullStateForChildResource_Tags)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsFullStateForChildResource' with the minimum fields required to make a request.
  newTagsFullStateForChildResource ::
    TagsFullStateForChildResource
  newTagsFullStateForChildResource =
    TagsFullStateForChildResource {tags = Core.Nothing}
  
  instance Core.FromJSON TagsFullStateForChildResource where
    parseJSON =
      Core.withObject
        "TagsFullStateForChildResource"
        (\o -> TagsFullStateForChildResource Core.<$> (o Core..:? "tags"))
  
  instance Core.ToJSON TagsFullStateForChildResource where
    toJSON TagsFullStateForChildResource {..} =
      Core.object (Core.catMaybes [("tags" Core..=) Core.<$> tags])
  
  -- | If TagsFullStateForChildResource is initialized, the values in this field represent all the tags in the next state for the child resource. Only one type of tags reference (numeric or namespace) is required to be passed. IMPORTANT: This field should only be used when the target resource IAM policy name is UNKNOWN and the resource\'s parent IAM policy name is being passed in the request.
  --
  -- /See:/ 'newTagsFullStateForChildResource_Tags' smart constructor.
  newtype TagsFullStateForChildResource_Tags = TagsFullStateForChildResource_Tags
    { additional :: (Core.HashMap Core.Text Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsFullStateForChildResource_Tags' with the minimum fields required to make a request.
  newTagsFullStateForChildResource_Tags ::
    -- |  See 'additional'.
    Core.HashMap Core.Text Core.Text ->
    TagsFullStateForChildResource_Tags
  newTagsFullStateForChildResource_Tags additional =
    TagsFullStateForChildResource_Tags {additional = additional}
  
  instance Core.FromJSON TagsFullStateForChildResource_Tags where
    parseJSON =
      Core.withObject
        "TagsFullStateForChildResource_Tags"
        ( \o ->
            TagsFullStateForChildResource_Tags
              Core.<$> (Core.parseJSONObject o)
        )
  
  instance Core.ToJSON TagsFullStateForChildResource_Tags where
    toJSON TagsFullStateForChildResource_Tags {..} =
      Core.toJSON additional
  
  --
  -- /See:/ 'newTagsPartialState' smart constructor.
  data TagsPartialState = TagsPartialState
    { -- | Keys of the tags that should be removed for evaluation purposes. IMPORTANT: Currently only numeric references are supported. Once support for namespace references is added, both the tag references (numeric and namespace) will be removed.
      tagKeysToRemove :: (Core.Maybe [Core.Text]),
      -- | Tags that’ll be updated or added to the current state of tags for evaluation purposes. If a key exists in both \"tags/to/upsert\" and \"tag/keys/to/remove\", the one in \"tag/keys/to/remove\" is ignored. Only one type of tags reference (numeric or namespace) is required to be passed.
      tagsToUpsert :: (Core.Maybe TagsPartialState_TagsToUpsert)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsPartialState' with the minimum fields required to make a request.
  newTagsPartialState ::
    TagsPartialState
  newTagsPartialState =
    TagsPartialState
      { tagKeysToRemove = Core.Nothing,
        tagsToUpsert = Core.Nothing
      }
  
  instance Core.FromJSON TagsPartialState where
    parseJSON =
      Core.withObject
        "TagsPartialState"
        ( \o ->
            TagsPartialState
              Core.<$> (o Core..:? "tagKeysToRemove")
              Core.<*> (o Core..:? "tagsToUpsert")
        )
  
  instance Core.ToJSON TagsPartialState where
    toJSON TagsPartialState {..} =
      Core.object
        ( Core.catMaybes
            [ ("tagKeysToRemove" Core..=) Core.<$> tagKeysToRemove,
              ("tagsToUpsert" Core..=) Core.<$> tagsToUpsert
            ]
        )
  
  -- | Tags that’ll be updated or added to the current state of tags for evaluation purposes. If a key exists in both \"tags/to/upsert\" and \"tag/keys/to/remove\", the one in \"tag/keys/to/remove\" is ignored. Only one type of tags reference (numeric or namespace) is required to be passed.
  --
  -- /See:/ 'newTagsPartialState_TagsToUpsert' smart constructor.
  newtype TagsPartialState_TagsToUpsert = TagsPartialState_TagsToUpsert
    { additional :: (Core.HashMap Core.Text Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TagsPartialState_TagsToUpsert' with the minimum fields required to make a request.
  newTagsPartialState_TagsToUpsert ::
    -- |  See 'additional'.
    Core.HashMap Core.Text Core.Text ->
    TagsPartialState_TagsToUpsert
  newTagsPartialState_TagsToUpsert additional =
    TagsPartialState_TagsToUpsert {additional = additional}
  
  instance Core.FromJSON TagsPartialState_TagsToUpsert where
    parseJSON =
      Core.withObject
        "TagsPartialState_TagsToUpsert"
        ( \o ->
            TagsPartialState_TagsToUpsert Core.<$> (Core.parseJSONObject o)
        )
  
  instance Core.ToJSON TagsPartialState_TagsToUpsert where
    toJSON TagsPartialState_TagsToUpsert {..} = Core.toJSON additional
  
  -- | Request message for @TestIamPermissions@ method.
  --
  -- /See:/ 'newTestIamPermissionsRequest' smart constructor.
  newtype TestIamPermissionsRequest = TestIamPermissionsRequest
    { -- | The set of permissions to check for the @resource@. Permissions with wildcards (such as @*@ or @storage.*@) are not allowed. For more information see <https://cloud.google.com/iam/docs/overview#permissions IAM Overview>.
      permissions :: (Core.Maybe [Core.Text])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TestIamPermissionsRequest' with the minimum fields required to make a request.
  newTestIamPermissionsRequest ::
    TestIamPermissionsRequest
  newTestIamPermissionsRequest =
    TestIamPermissionsRequest {permissions = Core.Nothing}
  
  instance Core.FromJSON TestIamPermissionsRequest where
    parseJSON =
      Core.withObject
        "TestIamPermissionsRequest"
        ( \o ->
            TestIamPermissionsRequest Core.<$> (o Core..:? "permissions")
        )
  
  instance Core.ToJSON TestIamPermissionsRequest where
    toJSON TestIamPermissionsRequest {..} =
      Core.object
        (Core.catMaybes [("permissions" Core..=) Core.<$> permissions])
  
  -- | Response message for @TestIamPermissions@ method.
  --
  -- /See:/ 'newTestIamPermissionsResponse' smart constructor.
  newtype TestIamPermissionsResponse = TestIamPermissionsResponse
    { -- | A subset of @TestPermissionsRequest.permissions@ that the caller is allowed.
      permissions :: (Core.Maybe [Core.Text])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TestIamPermissionsResponse' with the minimum fields required to make a request.
  newTestIamPermissionsResponse ::
    TestIamPermissionsResponse
  newTestIamPermissionsResponse =
    TestIamPermissionsResponse {permissions = Core.Nothing}
  
  instance Core.FromJSON TestIamPermissionsResponse where
    parseJSON =
      Core.withObject
        "TestIamPermissionsResponse"
        ( \o ->
            TestIamPermissionsResponse Core.<$> (o Core..:? "permissions")
        )
  
  instance Core.ToJSON TestIamPermissionsResponse where
    toJSON TestIamPermissionsResponse {..} =
      Core.object
        (Core.catMaybes [("permissions" Core..=) Core.<$> permissions])
  
  -- | A TunnelDestGroup.
  --
  -- /See:/ 'newTunnelDestGroup' smart constructor.
  data TunnelDestGroup = TunnelDestGroup
    { -- | Optional. Unordered list. List of CIDRs that this group applies to.
      cidrs :: (Core.Maybe [Core.Text]),
      -- | Optional. Unordered list. List of FQDNs that this group applies to.
      fqdns :: (Core.Maybe [Core.Text]),
      -- | Identifier. Identifier for the TunnelDestGroup. Must be unique within the project and contain only lower case letters (a-z) and dashes (-).
      name :: (Core.Maybe Core.Text)
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'TunnelDestGroup' with the minimum fields required to make a request.
  newTunnelDestGroup ::
    TunnelDestGroup
  newTunnelDestGroup =
    TunnelDestGroup
      { cidrs = Core.Nothing,
        fqdns = Core.Nothing,
        name = Core.Nothing
      }
  
  instance Core.FromJSON TunnelDestGroup where
    parseJSON =
      Core.withObject
        "TunnelDestGroup"
        ( \o ->
            TunnelDestGroup
              Core.<$> (o Core..:? "cidrs")
              Core.<*> (o Core..:? "fqdns")
              Core.<*> (o Core..:? "name")
        )
  
  instance Core.ToJSON TunnelDestGroup where
    toJSON TunnelDestGroup {..} =
      Core.object
        ( Core.catMaybes
            [ ("cidrs" Core..=) Core.<$> cidrs,
              ("fqdns" Core..=) Core.<$> fqdns,
              ("name" Core..=) Core.<$> name
            ]
        )
  
  -- | IAP Expression Linter endpoint returns empty response body.
  --
  -- /See:/ 'newValidateIapAttributeExpressionResponse' smart constructor.
  data ValidateIapAttributeExpressionResponse = ValidateIapAttributeExpressionResponse
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'ValidateIapAttributeExpressionResponse' with the minimum fields required to make a request.
  newValidateIapAttributeExpressionResponse ::
    ValidateIapAttributeExpressionResponse
  newValidateIapAttributeExpressionResponse =
    ValidateIapAttributeExpressionResponse
  
  instance Core.FromJSON ValidateIapAttributeExpressionResponse where
    parseJSON =
      Core.withObject
        "ValidateIapAttributeExpressionResponse"
        (\o -> Core.pure ValidateIapAttributeExpressionResponse)
  
  instance Core.ToJSON ValidateIapAttributeExpressionResponse where
    toJSON = Core.const Core.emptyObject
  
  -- | WorkforceIdentitySettings allows customers to configure workforce pools and OAuth 2.0 settings to gate their applications using a third-party IdP with access control.
  --
  -- /See:/ 'newWorkforceIdentitySettings' smart constructor.
  data WorkforceIdentitySettings = WorkforceIdentitySettings
    { -- | OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity federation services.
      oauth2 :: (Core.Maybe OAuth2),
      -- | The workforce pool resources. Only one workforce pool is accepted.
      workforcePools :: (Core.Maybe [Core.Text])
    }
    deriving (Core.Eq, Core.Show, Core.Generic)
  
  -- | Creates a value of 'WorkforceIdentitySettings' with the minimum fields required to make a request.
  newWorkforceIdentitySettings ::
    WorkforceIdentitySettings
  newWorkforceIdentitySettings =
    WorkforceIdentitySettings
      { oauth2 = Core.Nothing,
        workforcePools = Core.Nothing
      }
  
  instance Core.FromJSON WorkforceIdentitySettings where
    parseJSON =
      Core.withObject
        "WorkforceIdentitySettings"
        ( \o ->
            WorkforceIdentitySettings
              Core.<$> (o Core..:? "oauth2")
              Core.<*> (o Core..:? "workforcePools")
        )
  
  instance Core.ToJSON WorkforceIdentitySettings where
    toJSON WorkforceIdentitySettings {..} =
      Core.object
        ( Core.catMaybes
            [ ("oauth2" Core..=) Core.<$> oauth2,
              ("workforcePools" Core..=) Core.<$> workforcePools
            ]
        )
  