# The Okta software accompanied by this notice is provided pursuant to the following terms:
# Copyright © 2025-Present, Okta, Inc.
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the
# License.
# You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS
# IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.
# coding: utf-8

"""
Okta Admin Management

Allows customers to easily access the Okta Management APIs

The version of the OpenAPI document: 5.1.0
Contact: devex-public@okta.com
Generated by OpenAPI Generator (https://openapi-generator.tech)

Do not edit the class manually.
"""  # noqa: E501

from __future__ import annotations

import json
import pprint
import re  # noqa: F401
from typing import Any, ClassVar, Dict, List
from typing import Optional, Set

from pydantic import BaseModel, ConfigDict, Field, StrictInt, StrictStr
from typing_extensions import Annotated
from typing_extensions import Self

from okta.models.digest_algorithm import DigestAlgorithm
from okta.models.password_credential_hash_algorithm import (
    PasswordCredentialHashAlgorithm,
)


class PasswordCredentialHash(BaseModel):
    """
    Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from
    some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.
     A hashed password may be specified in a password object when creating or updating a user, but not for other operations.
      See the [Create user with imported hashed password](
      https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed
      -password) description. When you update a user with a hashed password, the user must be in the `STAGED` status.
    """  # noqa: E501

    algorithm: Optional[PasswordCredentialHashAlgorithm] = None
    digest_algorithm: Optional[DigestAlgorithm] = Field(
        default=None, alias="digestAlgorithm"
    )
    iteration_count: Optional[StrictInt] = Field(
        default=None,
        description="The number of iterations used when hashing passwords using PBKDF2. Must be >= 4096. Only required for "
        "PBKDF2 algorithm.",
        alias="iterationCount",
    )
    key_size: Optional[StrictInt] = Field(
        default=None,
        description="Size of the derived key in bytes. Only required for PBKDF2 algorithm.",
        alias="keySize",
    )
    salt: Optional[StrictStr] = Field(
        default=None,
        description="Only required for salted hashes. For BCRYPT, this specifies Radix-64 as the encoded salt used to "
        "generate the hash, which must be 22 characters long. For other salted hashes, this specifies the "
        "Base64-encoded salt used to generate the hash.",
    )
    salt_order: Optional[StrictStr] = Field(
        default=None,
        description="Specifies whether salt was pre- or postfixed to the password before hashing. Only required for salted "
        "algorithms.",
        alias="saltOrder",
    )
    value: Optional[StrictStr] = Field(
        default=None,
        description="For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual base64-encoded hash of the password ("
        "and salt, if used). This is the Base64-encoded `value` of the SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest "
        "that was computed by either pre-fixing or post-fixing the `salt` to the `password`, depending on the "
        "`saltOrder`. If a `salt` was not used in the `source` system, then this should just be the "
        "Base64-encoded `value` of the password's SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, "
        "this is the actual Radix-64 encoded hashed password.",
    )
    work_factor: Optional[Annotated[int, Field(le=20, strict=True, ge=1)]] = Field(
        default=None,
        description="Governs the strength of the hash and the time required to compute it. Only required for BCRYPT "
        "algorithm.",
        alias="workFactor",
    )
    __properties: ClassVar[List[str]] = [
        "algorithm",
        "digestAlgorithm",
        "iterationCount",
        "keySize",
        "salt",
        "saltOrder",
        "value",
        "workFactor",
    ]

    model_config = ConfigDict(
        populate_by_name=True,
        validate_assignment=True,
        protected_namespaces=(),
    )

    def to_str(self) -> str:
        """Returns the string representation of the model using alias"""
        return pprint.pformat(self.model_dump(by_alias=True))

    def to_json(self) -> str:
        """Returns the JSON representation of the model using alias"""
        # TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
        return json.dumps(self.to_dict())

    @classmethod
    def from_json(cls, json_str: str) -> Optional[Self]:
        """Create an instance of PasswordCredentialHash from a JSON string"""
        return cls.from_dict(json.loads(json_str))

    def to_dict(self) -> Dict[str, Any]:
        """Return the dictionary representation of the model using alias.

        This has the following differences from calling pydantic's
        `self.model_dump(by_alias=True)`:

        * `None` is only added to the output dict for nullable fields that
          were set at model initialization. Other fields with value `None`
          are ignored.
        """
        excluded_fields: Set[str] = set([])

        _dict = self.model_dump(
            by_alias=True,
            exclude=excluded_fields,
            exclude_none=True,
        )
        return _dict

    @classmethod
    def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
        """Create an instance of PasswordCredentialHash from a dict"""
        if obj is None:
            return None

        if not isinstance(obj, dict):
            return cls.model_validate(obj)

        _obj = cls.model_validate(
            {
                "algorithm": obj.get("algorithm"),
                "digestAlgorithm": obj.get("digestAlgorithm"),
                "iterationCount": obj.get("iterationCount"),
                "keySize": obj.get("keySize"),
                "salt": obj.get("salt"),
                "saltOrder": obj.get("saltOrder"),
                "value": obj.get("value"),
                "workFactor": obj.get("workFactor"),
            }
        )
        return _obj
