# This file was auto-generated by Fern from our API Definition.

import datetime as dt
import typing

import pydantic
import typing_extensions
from ..core.pydantic_utilities import IS_PYDANTIC_V2, UniversalBaseModel
from ..core.serialization import FieldMetadata
from .event_stream_cloud_event_connection_created_object_3_options_assertion_decryption_settings import (
    EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettings,
)
from .event_stream_cloud_event_connection_created_object_3_options_digest_algorithm_enum import (
    EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum,
)
from .event_stream_cloud_event_connection_created_object_3_options_idpinitiated import (
    EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiated,
)
from .event_stream_cloud_event_connection_created_object_3_options_protocol_binding_enum import (
    EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum,
)
from .event_stream_cloud_event_connection_created_object_3_options_set_user_root_attributes_enum import (
    EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum,
)
from .event_stream_cloud_event_connection_created_object_3_options_signature_algorithm_enum import (
    EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum,
)
from .event_stream_cloud_event_connection_created_object_3_options_subject import (
    EventStreamCloudEventConnectionCreatedObject3OptionsSubject,
)
from .event_stream_cloud_event_connection_created_object_3_options_upstream_params import (
    EventStreamCloudEventConnectionCreatedObject3OptionsUpstreamParams,
)


class EventStreamCloudEventConnectionCreatedObject3Options(UniversalBaseModel):
    """
    Options for the 'pingfederate' connection
    """

    assertion_decryption_settings: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettings
    ] = None
    cert: typing.Optional[str] = pydantic.Field(default=None)
    """
    X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.
    """

    cert_rollover_notification: typing.Optional[dt.datetime] = pydantic.Field(default=None)
    """
    Timestamp of the last certificate expiring soon notification.
    """

    digest_algorithm: typing_extensions.Annotated[
        typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum],
        FieldMetadata(alias="digestAlgorithm"),
        pydantic.Field(alias="digestAlgorithm"),
    ] = None
    domain_aliases: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Domain aliases for the connection
    """

    entity_id: typing_extensions.Annotated[
        typing.Optional[str],
        FieldMetadata(alias="entityId"),
        pydantic.Field(
            alias="entityId",
            description="The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.",
        ),
    ] = None
    """
    The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.
    """

    expires: typing.Optional[dt.datetime] = pydantic.Field(default=None)
    """
    ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.
    """

    icon_url: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.
    """

    idpinitiated: typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiated] = None
    non_persistent_attrs: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)
    """

    protocol_binding: typing_extensions.Annotated[
        typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum],
        FieldMetadata(alias="protocolBinding"),
        pydantic.Field(alias="protocolBinding"),
    ] = None
    set_user_root_attributes: typing.Optional[
        EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum
    ] = None
    signature_algorithm: typing_extensions.Annotated[
        typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum],
        FieldMetadata(alias="signatureAlgorithm"),
        pydantic.Field(alias="signatureAlgorithm"),
    ] = None
    sign_in_endpoint: typing_extensions.Annotated[
        typing.Optional[str],
        FieldMetadata(alias="signInEndpoint"),
        pydantic.Field(
            alias="signInEndpoint",
            description="Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.",
        ),
    ] = None
    """
    Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.
    """

    signing_cert: typing_extensions.Annotated[
        typing.Optional[str],
        FieldMetadata(alias="signingCert"),
        pydantic.Field(
            alias="signingCert",
            description="Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.",
        ),
    ] = None
    """
    Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.
    """

    sign_saml_request: typing_extensions.Annotated[
        typing.Optional[bool],
        FieldMetadata(alias="signSAMLRequest"),
        pydantic.Field(
            alias="signSAMLRequest",
            description="When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).",
        ),
    ] = None
    """
    When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).
    """

    subject: typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsSubject] = None
    tenant_domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.
    """

    thumbprints: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.
    """

    upstream_params: typing.Optional[EventStreamCloudEventConnectionCreatedObject3OptionsUpstreamParams] = None
    ping_federate_base_url: typing_extensions.Annotated[
        str,
        FieldMetadata(alias="pingFederateBaseUrl"),
        pydantic.Field(
            alias="pingFederateBaseUrl",
            description="URL provided by PingFederate which returns information used for creating the connection",
        ),
    ]
    """
    URL provided by PingFederate which returns information used for creating the connection
    """

    if IS_PYDANTIC_V2:
        model_config: typing.ClassVar[pydantic.ConfigDict] = pydantic.ConfigDict(extra="allow", frozen=True)  # type: ignore # Pydantic v2
    else:

        class Config:
            frozen = True
            smart_union = True
            extra = pydantic.Extra.allow
