# This file was auto-generated by Fern from our API Definition.

import datetime as dt
import typing

import pydantic
from ..core.pydantic_utilities import IS_PYDANTIC_V2, UniversalBaseModel
from .event_stream_cloud_event_connection_updated_object_6_options_federated_connections_access_tokens import (
    EventStreamCloudEventConnectionUpdatedObject6OptionsFederatedConnectionsAccessTokens,
)
from .event_stream_cloud_event_connection_updated_object_6_options_set_user_root_attributes_enum import (
    EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum,
)
from .event_stream_cloud_event_connection_updated_object_6_options_upstream_params import (
    EventStreamCloudEventConnectionUpdatedObject6OptionsUpstreamParams,
)


class EventStreamCloudEventConnectionUpdatedObject6Options(UniversalBaseModel):
    """
    Options for the 'google-apps' connection
    """

    admin_access_token_expiresin: typing.Optional[dt.datetime] = pydantic.Field(default=None)
    """
    Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.
    """

    allow_setting_login_scopes: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.
    """

    api_enable_groups: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false.
    """

    api_enable_users: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.
    """

    client_id: str = pydantic.Field()
    """
    Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.
    """

    domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    Primary Google Workspace domain name that users must belong to.
    """

    domain_aliases: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.
    """

    email: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Whether the OAuth flow requests the `email` scope.
    """

    ext_agreed_terms: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Fetches the `agreedToTerms` flag from the Google Directory profile.
    """

    ext_groups: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Enables enrichment with Google group memberships (required for `ext_groups_extended`).
    """

    ext_groups_extended: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.
    """

    ext_is_admin: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Fetches the Google Directory admin flag for the signing-in user.
    """

    ext_is_suspended: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Fetches the Google Directory suspended flag for the signing-in user.
    """

    federated_connections_access_tokens: typing.Optional[
        EventStreamCloudEventConnectionUpdatedObject6OptionsFederatedConnectionsAccessTokens
    ] = None
    handle_login_from_social: typing.Optional[bool] = pydantic.Field(default=None)
    """
    When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.
    """

    icon_url: typing.Optional[str] = pydantic.Field(default=None)
    """
    URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.
    """

    map_user_id_to_id: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.
    """

    non_persistent_attrs: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)
    """

    profile: typing.Optional[bool] = pydantic.Field(default=None)
    """
    Whether the OAuth flow requests the `profile` scope.
    """

    scope: typing.Optional[typing.List[str]] = pydantic.Field(default=None)
    """
    Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.
    """

    set_user_root_attributes: typing.Optional[
        EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum
    ] = None
    tenant_domain: typing.Optional[str] = pydantic.Field(default=None)
    """
    The Google Workspace primary domain used to identify the organization during authentication.
    """

    upstream_params: typing.Optional[EventStreamCloudEventConnectionUpdatedObject6OptionsUpstreamParams] = None

    if IS_PYDANTIC_V2:
        model_config: typing.ClassVar[pydantic.ConfigDict] = pydantic.ConfigDict(extra="allow", frozen=True)  # type: ignore # Pydantic v2
    else:

        class Config:
            frozen = True
            smart_union = True
            extra = pydantic.Extra.allow
