# coding: utf-8

"""
    HashiCorp Vault API

    HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.

    The version of the OpenAPI document: 1.15.0
    Generated by OpenAPI Generator (https://openapi-generator.tech)

    Do not edit the class manually.
"""  # noqa: E501


from __future__ import annotations
import pprint
import re  # noqa: F401
import json

from pydantic import BaseModel, ConfigDict, Field, StrictBool, StrictInt, StrictStr, field_validator
from typing import Any, ClassVar, Dict, List, Optional
from typing import Optional, Set
from typing_extensions import Self

class SshWriteRoleRequest(BaseModel):
    """
    SshWriteRoleRequest
    """ # noqa: E501
    algorithm_signer: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a signing algorithm for the key. Possible values: ssh-rsa, rsa-sha2-256, rsa-sha2-512, default, or the empty string.")
    allow_bare_domains: Optional[StrictBool] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use the base domains listed in \"allowed_domains\", e.g. \"example.com\". This is a separate option as in some cases this can be considered a security threat.")
    allow_host_certificates: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'host'.")
    allow_subdomains: Optional[StrictBool] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use subdomains of those listed in \"allowed_domains\".")
    allow_user_certificates: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'user'.")
    allow_user_key_ids: Optional[StrictBool] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] If true, users can override the key ID for a signed certificate with the \"key_id\" field. When false, the key ID will always be the token display name. The key ID is logged by the SSH server and can be useful for auditing.")
    allowed_critical_options: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] A comma-separated list of critical options that certificates can have when signed. To allow any critical options, set this to an empty string.")
    allowed_domains: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] If this option is not specified, client can request for a signed certificate for any valid host. If only certain domains are allowed, then this list enforces it.")
    allowed_domains_template: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, Allowed domains can be specified using identity template policies. Non-templated domains are also permitted.")
    allowed_extensions: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] A comma-separated list of extensions that certificates can have when signed. An empty list means that no extension overrides are allowed by an end-user; explicitly specify '*' to allow any extensions to be set.")
    allowed_user_key_lengths: Optional[Dict[str, Any]] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] If set, allows the enforcement of key types and minimum key sizes to be signed.")
    allowed_users: Optional[StrictStr] = Field(default=None, description="[Optional for all types] [Works differently for CA type] If this option is not specified, or is '*', client can request a credential for any valid user at the remote host, including the admin user. If only certain usernames are to be allowed, then this list enforces it. If this field is set, then credentials can only be created for default_user and usernames present in this list. Setting this option will enable all the users with access to this role to fetch credentials for all other usernames in this list. Use with caution. N.B.: with the CA type, an empty list means that no users are allowed; explicitly specify '*' to allow any user.")
    allowed_users_template: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, Allowed users can be specified using identity template policies. Non-templated users are also permitted.")
    cidr_list: Optional[StrictStr] = Field(default=None, description="[Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks for which the role is applicable for. CIDR blocks can belong to more than one role.")
    default_critical_options: Optional[Dict[str, Any]] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] Critical options certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by \"allowed_critical_options\". Defaults to none.")
    default_extensions: Optional[Dict[str, Any]] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] Extensions certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by \"allowed_extensions\". Defaults to none.")
    default_extensions_template: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, Default extension values can be specified using identity template policies. Non-templated extension values are also permitted.")
    default_user: Optional[StrictStr] = Field(default=None, description="[Required for OTP type] [Optional for CA type] Default username for which a credential will be generated. When the endpoint 'creds/' is used without a username, this value will be used as default username.")
    default_user_template: Optional[StrictBool] = Field(default=False, description="[Not applicable for OTP type] [Optional for CA type] If set, Default user can be specified using identity template policies. Non-templated users are also permitted.")
    exclude_cidr_list: Optional[StrictStr] = Field(default=None, description="[Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks. IP addresses belonging to these blocks are not accepted by the role. This is particularly useful when big CIDR blocks are being used by the role and certain parts of it needs to be kept out.")
    key_id_format: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a custom format for the key id of a signed certificate. The following variables are available for use: '{{token_display_name}}' - The display name of the token used to make the request. '{{role_name}}' - The name of the role signing the request. '{{public_key_hash}}' - A SHA256 checksum of the public key that is being signed.")
    key_type: Optional[StrictStr] = Field(default=None, description="[Required for all types] Type of key used to login to hosts. It can be either 'otp' or 'ca'. 'otp' type requires agent to be installed in remote hosts.")
    max_ttl: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] The maximum allowed lease duration")
    not_before_duration: Optional[StrictStr] = Field(default='30', description="[Not applicable for OTP type] [Optional for CA type] The duration that the SSH certificate should be backdated by at issuance.")
    port: Optional[StrictInt] = Field(default=None, description="[Optional for OTP type] [Not applicable for CA type] Port number for SSH connection. Default is '22'. Port number does not play any role in creation of OTP. For 'otp' type, this is just a way to inform client about the port number to use. Port number will be returned to client by Vault server along with OTP.")
    ttl: Optional[StrictStr] = Field(default=None, description="[Not applicable for OTP type] [Optional for CA type] The lease duration if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the value of max_ttl.")
    __properties: ClassVar[List[str]] = ["algorithm_signer", "allow_bare_domains", "allow_host_certificates", "allow_subdomains", "allow_user_certificates", "allow_user_key_ids", "allowed_critical_options", "allowed_domains", "allowed_domains_template", "allowed_extensions", "allowed_user_key_lengths", "allowed_users", "allowed_users_template", "cidr_list", "default_critical_options", "default_extensions", "default_extensions_template", "default_user", "default_user_template", "exclude_cidr_list", "key_id_format", "key_type", "max_ttl", "not_before_duration", "port", "ttl"]

    @field_validator('algorithm_signer')
    def algorithm_signer_validate_enum(cls, value):
        """Validates the enum"""
        if value is None:
            return value

        if value not in set(['', 'default', 'ssh-rsa', 'rsa-sha2-256', 'rsa-sha2-512']):
            raise ValueError("must be one of enum values ('', 'default', 'ssh-rsa', 'rsa-sha2-256', 'rsa-sha2-512')")
        return value

    @field_validator('key_type')
    def key_type_validate_enum(cls, value):
        """Validates the enum"""
        if value is None:
            return value

        if value not in set(['otp', 'ca']):
            raise ValueError("must be one of enum values ('otp', 'ca')")
        return value

    model_config = ConfigDict(
        populate_by_name=True,
        validate_assignment=True,
        protected_namespaces=(),
    )


    def to_str(self) -> str:
        """Returns the string representation of the model using alias"""
        return pprint.pformat(self.model_dump(by_alias=True))

    def to_json(self) -> str:
        """Returns the JSON representation of the model using alias"""
        # TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
        return json.dumps(self.to_dict())

    @classmethod
    def from_json(cls, json_str: str) -> Optional[Self]:
        """Create an instance of SshWriteRoleRequest from a JSON string"""
        return cls.from_dict(json.loads(json_str))

    def to_dict(self) -> Dict[str, Any]:
        """Return the dictionary representation of the model using alias.

        This has the following differences from calling pydantic's
        `self.model_dump(by_alias=True)`:

        * `None` is only added to the output dict for nullable fields that
          were set at model initialization. Other fields with value `None`
          are ignored.
        """
        excluded_fields: Set[str] = set([
        ])

        _dict = self.model_dump(
            by_alias=True,
            exclude=excluded_fields,
            exclude_none=True,
        )
        return _dict

    @classmethod
    def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
        """Create an instance of SshWriteRoleRequest from a dict"""
        if obj is None:
            return None

        if not isinstance(obj, dict):
            return cls.model_validate(obj)

        _obj = cls.model_validate({
            "algorithm_signer": obj.get("algorithm_signer"),
            "allow_bare_domains": obj.get("allow_bare_domains"),
            "allow_host_certificates": obj.get("allow_host_certificates") if obj.get("allow_host_certificates") is not None else False,
            "allow_subdomains": obj.get("allow_subdomains"),
            "allow_user_certificates": obj.get("allow_user_certificates") if obj.get("allow_user_certificates") is not None else False,
            "allow_user_key_ids": obj.get("allow_user_key_ids"),
            "allowed_critical_options": obj.get("allowed_critical_options"),
            "allowed_domains": obj.get("allowed_domains"),
            "allowed_domains_template": obj.get("allowed_domains_template") if obj.get("allowed_domains_template") is not None else False,
            "allowed_extensions": obj.get("allowed_extensions"),
            "allowed_user_key_lengths": obj.get("allowed_user_key_lengths"),
            "allowed_users": obj.get("allowed_users"),
            "allowed_users_template": obj.get("allowed_users_template") if obj.get("allowed_users_template") is not None else False,
            "cidr_list": obj.get("cidr_list"),
            "default_critical_options": obj.get("default_critical_options"),
            "default_extensions": obj.get("default_extensions"),
            "default_extensions_template": obj.get("default_extensions_template") if obj.get("default_extensions_template") is not None else False,
            "default_user": obj.get("default_user"),
            "default_user_template": obj.get("default_user_template") if obj.get("default_user_template") is not None else False,
            "exclude_cidr_list": obj.get("exclude_cidr_list"),
            "key_id_format": obj.get("key_id_format"),
            "key_type": obj.get("key_type"),
            "max_ttl": obj.get("max_ttl"),
            "not_before_duration": obj.get("not_before_duration") if obj.get("not_before_duration") is not None else '30',
            "port": obj.get("port"),
            "ttl": obj.get("ttl")
        })
        return _obj


