# This file was auto-generated by Fern from our API Definition.

import datetime as dt
import typing

import pydantic
import typing_extensions
from ..core.pydantic_utilities import IS_PYDANTIC_V2, UniversalBaseModel
from ..core.serialization import FieldMetadata
from .event_stream_cloud_event_connection_updated_object_7_options_federated_connections_access_tokens import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsFederatedConnectionsAccessTokens,
)
from .event_stream_cloud_event_connection_updated_object_7_options_identity_api_enum import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum,
)
from .event_stream_cloud_event_connection_updated_object_7_options_set_user_root_attributes_enum import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum,
)
from .event_stream_cloud_event_connection_updated_object_7_options_should_trust_email_verified_connection_enum import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum,
)
from .event_stream_cloud_event_connection_updated_object_7_options_tenant_domain_one import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsTenantDomainOne,
)
from .event_stream_cloud_event_connection_updated_object_7_options_upstream_params import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsUpstreamParams,
)
from .event_stream_cloud_event_connection_updated_object_7_options_userid_attribute_enum import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum,
)
from .event_stream_cloud_event_connection_updated_object_7_options_waad_protocol_enum import (
    EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum,
)


class EventStreamCloudEventConnectionUpdatedObject7Options(UniversalBaseModel):
    """
    Options for the 'waad' connection
    """

    api_enable_users: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Enable users API
    """

    app_domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.
    """

    app_id: typing.Optional[str] = pydantic.Field(default=None)
    """
    The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.
    """

    basic_profile: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.
    """

    cert_rollover_notification: typing.Optional[dt.datetime] = pydantic.Field(default=None)
    """
    Timestamp of the last certificate expiring soon notification.
    """

    client_id: str = pydantic.Field()
    """
    OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.
    """

    domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').
    """

    domain_aliases: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.
    """

    ext_groups: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.
    """

    ext_nested_groups: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.
    """

    ext_profile: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.
    """

    federated_connections_access_tokens: typing.Optional[
        EventStreamCloudEventConnectionUpdatedObject7OptionsFederatedConnectionsAccessTokens
    ] = None
    granted: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.
    """

    icon_url: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.
    """

    identity_api: typing.Optional[EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum] = None
    max_groups_to_retrieve: typing.Optional[str] = pydantic.Field(default=None)
    """
    Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.
    """

    non_persistent_attrs: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)
    """

    scope: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.
    """

    set_user_root_attributes: typing.Optional[
        EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum
    ] = None
    should_trust_email_verified_connection: typing.Optional[
        EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum
    ] = None
    tenant_domain: typing.Optional[EventStreamCloudEventConnectionUpdatedObject7OptionsTenantDomainOne] = None
    tenant_id: typing_extensions.Annotated[
        typing.Optional[str],
        FieldMetadata(alias="tenantId"),
        pydantic.Field(
            alias="tenantId",
            description="The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.",
        ),
    ] = None
    """
    The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.
    """

    thumbprints: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.
    """

    upstream_params: typing.Optional[EventStreamCloudEventConnectionUpdatedObject7OptionsUpstreamParams] = None
    use_wsfed: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.
    """

    use_common_endpoint: typing_extensions.Annotated[
        typing.Optional[bool],
        FieldMetadata(alias="useCommonEndpoint"),
        pydantic.Field(
            alias="useCommonEndpoint",
            description="When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.",
        ),
    ] = None
    """
    When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.
    """

    userid_attribute: typing.Optional[EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum] = None
    waad_protocol: typing.Optional[EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum] = None

    if IS_PYDANTIC_V2:
        model_config: typing.ClassVar[pydantic.ConfigDict] = pydantic.ConfigDict(extra="allow", frozen=True)  # type: ignore # Pydantic v2
    else:

        class Config:
            frozen = True
            smart_union = True
            extra = pydantic.Extra.allow
