# coding: utf-8

"""
    Mixpeek API

    This is the Mixpeek API, providing access to various endpoints for data processing and retrieval.

    The version of the OpenAPI document: 1.3.0
    Contact: info@mixpeek.com
    Generated by OpenAPI Generator (https://openapi-generator.tech)

    Do not edit the class manually.
"""  # noqa: E501


from __future__ import annotations
import pprint
import re  # noqa: F401
import json

from pydantic import BaseModel, ConfigDict, Field, StrictStr, field_validator
from typing import Any, ClassVar, Dict, List, Optional
from typing_extensions import Annotated
from typing import Optional, Set
from typing_extensions import Self

class S3RoleCredentials(BaseModel):
    """
    AWS S3 IAM role assumption credentials (RECOMMENDED for production).  IAM role assumption provides secure, temporary credentials for accessing customer S3 buckets without sharing long-lived access keys. This is the recommended authentication method for production deployments.  How It Works:     1. Customer creates an IAM role in their AWS account     2. Role trust policy allows Mixpeek AWS account to assume the role     3. External ID provides additional security against confused deputy attacks     4. Mixpeek assumes the role and receives temporary credentials (auto-renewed)     5. Temporary credentials are used to access the customer's S3 bucket  Prerequisites:     1. Create IAM role in customer AWS account     2. Attach policy granting s3:GetObject, s3:ListBucket permissions     3. Configure trust relationship to allow Mixpeek account     4. Use organization-specific external_id for security     5. Share role ARN with Mixpeek  Security Advantages:     - No long-lived credentials shared with third parties     - Temporary credentials automatically rotate (1-hour sessions by default)     - Customer retains full control and can revoke access anytime     - External ID prevents confused deputy attacks     - Audit trail in CloudTrail for all access  Use Cases:     - Production deployments accessing customer S3 buckets     - Enterprise integrations requiring strong security     - Multi-tenant environments with customer-owned storage     - Compliance-sensitive workloads (HIPAA, SOC 2, etc.)
    """ # noqa: E501
    type: Optional[StrictStr] = 'iam_role'
    role_arn: Annotated[str, Field(strict=True)] = Field(description="REQUIRED. Amazon Resource Name (ARN) of the IAM role to assume. This role must exist in the customer's AWS account and have a trust relationship configured to allow Mixpeek to assume it. Format: arn:aws:iam::{account-id}:role/{role-name} Example trust policy should allow principal: arn:aws:iam::{mixpeek-account}:root Recommended role name: mixpeek-storage-sync-role")
    external_id: Annotated[str, Field(min_length=8, strict=True, max_length=128)] = Field(description="REQUIRED. External ID for secure role assumption (prevents confused deputy attacks). This value should be unique to your organization and kept confidential. Mixpeek provides this value during connection setup. Must match the ExternalId condition in the role's trust policy. Format: Recommended pattern is mixpeek-{organization_id} Security: Include this in the trust policy Condition statement")
    __properties: ClassVar[List[str]] = ["type", "role_arn", "external_id"]

    @field_validator('type')
    def type_validate_enum(cls, value):
        """Validates the enum"""
        if value is None:
            return value

        if value not in set(['iam_role']):
            raise ValueError("must be one of enum values ('iam_role')")
        return value

    @field_validator('role_arn')
    def role_arn_validate_regular_expression(cls, value):
        """Validates the regular expression"""
        if not re.match(r"^arn:aws:iam::\d{12}:role\/[\w+=,.@-]+$", value):
            raise ValueError(r"must validate the regular expression /^arn:aws:iam::\d{12}:role\/[\w+=,.@-]+$/")
        return value

    model_config = ConfigDict(
        populate_by_name=True,
        validate_assignment=True,
        protected_namespaces=(),
    )


    def to_str(self) -> str:
        """Returns the string representation of the model using alias"""
        return pprint.pformat(self.model_dump(by_alias=True))

    def to_json(self) -> str:
        """Returns the JSON representation of the model using alias"""
        # TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
        return json.dumps(self.to_dict())

    @classmethod
    def from_json(cls, json_str: str) -> Optional[Self]:
        """Create an instance of S3RoleCredentials from a JSON string"""
        return cls.from_dict(json.loads(json_str))

    def to_dict(self) -> Dict[str, Any]:
        """Return the dictionary representation of the model using alias.

        This has the following differences from calling pydantic's
        `self.model_dump(by_alias=True)`:

        * `None` is only added to the output dict for nullable fields that
          were set at model initialization. Other fields with value `None`
          are ignored.
        """
        excluded_fields: Set[str] = set([
        ])

        _dict = self.model_dump(
            by_alias=True,
            exclude=excluded_fields,
            exclude_none=True,
        )
        return _dict

    @classmethod
    def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
        """Create an instance of S3RoleCredentials from a dict"""
        if obj is None:
            return None

        if not isinstance(obj, dict):
            return cls.model_validate(obj)

        _obj = cls.model_validate({
            "type": obj.get("type") if obj.get("type") is not None else 'iam_role',
            "role_arn": obj.get("role_arn"),
            "external_id": obj.get("external_id")
        })
        return _obj


