# This file was auto-generated by Fern from our API Definition.

import typing

import pydantic
from ..core.pydantic_utilities import IS_PYDANTIC_V2, UniversalBaseModel
from .event_stream_cloud_event_connection_created_object_1_options_attribute_map import (
    EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMap,
)
from .event_stream_cloud_event_connection_created_object_1_options_connection_settings import (
    EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettings,
)
from .event_stream_cloud_event_connection_created_object_1_options_dpop_signing_alg_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_federated_connections_access_tokens import (
    EventStreamCloudEventConnectionCreatedObject1OptionsFederatedConnectionsAccessTokens,
)
from .event_stream_cloud_event_connection_created_object_1_options_id_token_signed_response_algs_item_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_oidc_metadata import (
    EventStreamCloudEventConnectionCreatedObject1OptionsOidcMetadata,
)
from .event_stream_cloud_event_connection_created_object_1_options_schema_version_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_set_user_root_attributes_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_token_endpoint_auth_method_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_token_endpoint_auth_signing_alg_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_token_endpoint_jwtca_aud_format_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_type_enum import (
    EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum,
)
from .event_stream_cloud_event_connection_created_object_1_options_upstream_params import (
    EventStreamCloudEventConnectionCreatedObject1OptionsUpstreamParams,
)


class EventStreamCloudEventConnectionCreatedObject1Options(UniversalBaseModel):
    """
    Options for the 'okta' connection
    """

    authorization_endpoint: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.
    """

    client_id: str = pydantic.Field()
    """
    OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
    """

    connection_settings: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettings] = None
    domain_aliases: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.
    """

    dpop_signing_alg: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum] = None
    federated_connections_access_tokens: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject1OptionsFederatedConnectionsAccessTokens
    ] = None
    icon_url: typing.Optional[str] = pydantic.Field(default=None)
    """
    https url of the icon to be shown
    """

    id_token_session_expiry_supported: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.
    """

    id_token_signed_response_algs: typing.Optional[
        typing.List[EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum]
    ] = pydantic.Field(default=None)
    """
    List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.
    """

    issuer: typing.Optional[str] = pydantic.Field(default=None)
    """
    The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.
    """

    jwks_uri: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.
    """

    non_persistent_attrs: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)
    """

    oidc_metadata: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsOidcMetadata] = None
    schema_version: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum] = None
    scope: typing.Optional[str] = pydantic.Field(default=None)
    """
    Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.
    """

    send_back_channel_nonce: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.
    """

    set_user_root_attributes: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum
    ] = None
    tenant_domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    Tenant domain
    """

    token_endpoint: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.
    """

    token_endpoint_auth_method: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum
    ] = None
    token_endpoint_auth_signing_alg: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum
    ] = None
    token_endpoint_jwtca_aud_format: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum
    ] = None
    upstream_params: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsUpstreamParams] = None
    userinfo_endpoint: typing.Optional[str] = pydantic.Field(default=None)
    """
    Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.
    """

    attribute_map: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMap] = None
    domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided
    """

    type: typing.Optional[EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum] = None

    if IS_PYDANTIC_V2:
        model_config: typing.ClassVar[pydantic.ConfigDict] = pydantic.ConfigDict(extra="allow", frozen=True)  # type: ignore # Pydantic v2
    else:

        class Config:
            frozen = True
            smart_union = True
            extra = pydantic.Extra.allow
