# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

from __future__ import annotations

from typing import List, Union
from typing_extensions import Literal, Required, TypeAlias, TypedDict

from .ip_rule_param import IPRuleParam
from .email_rule_param import EmailRuleParam
from .group_rule_param import GroupRuleParam
from .domain_rule_param import DomainRuleParam
from .country_rule_param import CountryRuleParam
from .ip_list_rule_param import IPListRuleParam
from .everyone_rule_param import EveryoneRuleParam
from .email_list_rule_param import EmailListRuleParam
from .okta_group_rule_param import OktaGroupRuleParam
from .saml_group_rule_param import SAMLGroupRuleParam
from .azure_group_rule_param import AzureGroupRuleParam
from .certificate_rule_param import CertificateRuleParam
from .gsuite_group_rule_param import GSuiteGroupRuleParam
from .service_token_rule_param import ServiceTokenRuleParam
from .external_evaluation_rule_param import ExternalEvaluationRuleParam
from .github_organization_rule_param import GitHubOrganizationRuleParam
from .access_device_posture_rule_param import AccessDevicePostureRuleParam
from .authentication_method_rule_param import AuthenticationMethodRuleParam
from .any_valid_service_token_rule_param import AnyValidServiceTokenRuleParam

__all__ = [
    "AccessRuleParam",
    "AccessAuthContextRule",
    "AccessAuthContextRuleAuthContext",
    "AccessCommonNameRule",
    "AccessCommonNameRuleCommonName",
    "AccessLoginMethodRule",
    "AccessLoginMethodRuleLoginMethod",
    "AccessOIDCClaimRule",
    "AccessOIDCClaimRuleOIDC",
    "AccessLinkedAppTokenRule",
    "AccessLinkedAppTokenRuleLinkedAppToken",
    "AccessUserRiskScoreRule",
    "AccessUserRiskScoreRuleUserRiskScore",
    "AccessCloudflareAccountMemberRule",
    "AccessCloudflareAccountMemberRuleCloudflareAccountMember",
]


class AccessAuthContextRuleAuthContext(TypedDict, total=False):
    id: Required[str]
    """The ID of an Authentication context."""

    ac_id: Required[str]
    """The ACID of an Authentication context."""

    identity_provider_id: Required[str]
    """The ID of your Azure identity provider."""


class AccessAuthContextRule(TypedDict, total=False):
    """
    Matches an Azure Authentication Context.
    Requires an Azure identity provider.
    """

    auth_context: Required[AccessAuthContextRuleAuthContext]


class AccessCommonNameRuleCommonName(TypedDict, total=False):
    common_name: Required[str]
    """The common name to match."""


class AccessCommonNameRule(TypedDict, total=False):
    """Matches a specific common name."""

    common_name: Required[AccessCommonNameRuleCommonName]


class AccessLoginMethodRuleLoginMethod(TypedDict, total=False):
    id: Required[str]
    """The ID of an identity provider."""


class AccessLoginMethodRule(TypedDict, total=False):
    """Matches a specific identity provider id."""

    login_method: Required[AccessLoginMethodRuleLoginMethod]


class AccessOIDCClaimRuleOIDC(TypedDict, total=False):
    claim_name: Required[str]
    """The name of the OIDC claim."""

    claim_value: Required[str]
    """The OIDC claim value to look for."""

    identity_provider_id: Required[str]
    """The ID of your OIDC identity provider."""


class AccessOIDCClaimRule(TypedDict, total=False):
    """
    Matches an OIDC claim.
    Requires an OIDC identity provider.
    """

    oidc: Required[AccessOIDCClaimRuleOIDC]


class AccessLinkedAppTokenRuleLinkedAppToken(TypedDict, total=False):
    app_uid: Required[str]
    """The ID of an Access OIDC SaaS application"""


class AccessLinkedAppTokenRule(TypedDict, total=False):
    """
    Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
    """

    linked_app_token: Required[AccessLinkedAppTokenRuleLinkedAppToken]


class AccessUserRiskScoreRuleUserRiskScore(TypedDict, total=False):
    user_risk_score: Required[List[Literal["low", "medium", "high", "unscored"]]]
    """A list of risk score levels to match.

    Values can be low, medium, high, or unscored.
    """


class AccessUserRiskScoreRule(TypedDict, total=False):
    """Matches a user's risk score."""

    user_risk_score: Required[AccessUserRiskScoreRuleUserRiskScore]


class AccessCloudflareAccountMemberRuleCloudflareAccountMember(TypedDict, total=False):
    account_id: str
    """Identifier."""


class AccessCloudflareAccountMemberRule(TypedDict, total=False):
    """
    Matches users who are members of a specific Cloudflare account.
    Requires a Cloudflare identity provider.
    """

    cloudflare_account_member: Required[AccessCloudflareAccountMemberRuleCloudflareAccountMember]


AccessRuleParam: TypeAlias = Union[
    GroupRuleParam,
    AnyValidServiceTokenRuleParam,
    AccessAuthContextRule,
    AuthenticationMethodRuleParam,
    AzureGroupRuleParam,
    CertificateRuleParam,
    AccessCommonNameRule,
    CountryRuleParam,
    AccessDevicePostureRuleParam,
    DomainRuleParam,
    EmailListRuleParam,
    EmailRuleParam,
    EveryoneRuleParam,
    ExternalEvaluationRuleParam,
    GitHubOrganizationRuleParam,
    GSuiteGroupRuleParam,
    AccessLoginMethodRule,
    IPListRuleParam,
    IPRuleParam,
    OktaGroupRuleParam,
    SAMLGroupRuleParam,
    AccessOIDCClaimRule,
    ServiceTokenRuleParam,
    AccessLinkedAppTokenRule,
    AccessUserRiskScoreRule,
    AccessCloudflareAccountMemberRule,
]
