import {z} from 'zod'

export type SecuritySettingAuthenticationMode = 'UNSET' | 'OPTIONAL' | 'REQUIRED';

export type AuthorizationSettingsMode = 'UNSET' | 'NAMESPACE' | 'GROUP' | 'WORKSPACE' | 'CLUSTER' | 'DISABLED' | 'CUSTOM' | 'RULES';

export type Authv2TLSMode = 'DISABLED' | 'SIMPLE' | 'MUTUAL';

export type V2TLSFileSource = {clientCertificate?: string | undefined, privateKey?: string | undefined, caCertificates?: string | undefined};

export type V2ClientTLSSettings = {mode?: Authv2TLSMode | undefined, files?: V2TLSFileSource | undefined, secretName?: string | undefined, subjectAltNames?: Array<string> | undefined};

export type Tsbauthv2AuthorizationExternalAuthzBackend = {uri?: string | undefined, includeRequestHeaders?: Array<string> | undefined, tls?: V2ClientTLSSettings | undefined};

export type Tsbauthv2SubjectJWTClaims = {iss?: string | undefined, sub?: string | undefined, other?: {[key: string]: string} | undefined};

export type Tsbauthv2Subject = {jwt?: Tsbauthv2SubjectJWTClaims | undefined};

export type Tsbauthv2LocalAuthzRuleHttpOperation = {paths?: Array<string> | undefined, methods?: Array<string> | undefined};

export type Tsbauthv2LocalAuthzRule = {name: string, from?: Array<Tsbauthv2Subject> | undefined, to?: Array<Tsbauthv2LocalAuthzRuleHttpOperation> | undefined};

export type Tsbauthv2AuthorizationLocalAuthz = {rules?: Array<Tsbauthv2LocalAuthzRule> | undefined};

export type Tsbauthv2Authorization = {external?: Tsbauthv2AuthorizationExternalAuthzBackend | undefined, local?: Tsbauthv2AuthorizationLocalAuthz | undefined};

export type RuleFrom = {fqn?: string | undefined};

export type RuleTo = {fqn?: string | undefined};

export type V2Rule = {from: RuleFrom, to: RuleTo};

export type V2AuthorizationRules = {allow?: Array<V2Rule> | undefined, denyAll?: boolean | undefined, deny?: Array<V2Rule> | undefined};

export type V2AuthorizationSettings = {mode?: AuthorizationSettingsMode | undefined, serviceAccounts?: Array<string> | undefined, http?: Tsbauthv2Authorization | undefined, rules?: V2AuthorizationRules | undefined};

export type JWTClaimToHeader = {header: string, claim: string};

export type JWTJWTHeader = {name: string, prefix?: string | undefined};

export type AuthenticationJWT = {issuer: string, audiences?: Array<string> | undefined, jwksUri?: string | undefined, jwks?: string | undefined, outputPayloadToHeader?: string | undefined, outputClaimToHeaders?: Array<JWTClaimToHeader> | undefined, fromHeaders?: Array<JWTJWTHeader> | undefined};

export type Tsbauthv2AuthenticationJWT = {issuer: string, audiences?: Array<string> | undefined, jwksUri?: string | undefined, jwks?: string | undefined, outputPayloadToHeader?: string | undefined, outputClaimToHeaders?: Array<JWTClaimToHeader> | undefined, fromHeaders?: Array<JWTJWTHeader> | undefined};

export type AuthenticationRules = {jwt?: Array<Tsbauthv2AuthenticationJWT> | undefined};

export type V2Authentication = {jwt?: AuthenticationJWT | undefined, rules?: AuthenticationRules | undefined};

export type V2AuthenticationSettings = {trafficMode?: SecuritySettingAuthenticationMode | undefined, http?: V2Authentication | undefined};

export type V2WAFSettings = {rules: Array<string>};

export type V2PropagationStrategy = 'REPLACE' | 'STRICTER';

export type V2WorkloadMode = 'UNDEFINED' | 'CLIENT' | 'SERVER' | 'CLIENT_AND_SERVER';

export type V2PortSelector = {number: number};

export type V2TrafficSelector = {mode?: V2WorkloadMode | undefined, ports?: Array<V2PortSelector> | undefined};

export type V2WasmExtensionAttachment = {fqn: string, config?: Record<string, never> | undefined, match?: Array<V2TrafficSelector> | undefined};

export type V2ConfigGenerationMetadata = {labels?: {[key: string]: string} | undefined, annotations?: {[key: string]: string} | undefined};

export type V2SecuritySetting = {fqn?: string | undefined, displayName?: string | undefined, etag?: string | undefined, description?: string | undefined, authentication?: SecuritySettingAuthenticationMode | undefined, authorization?: V2AuthorizationSettings | undefined, authenticationSettings?: V2AuthenticationSettings | undefined, waf?: V2WAFSettings | undefined, propagationStrategy?: V2PropagationStrategy | undefined, extension?: Array<V2WasmExtensionAttachment> | undefined, configGenerationMetadata?: V2ConfigGenerationMetadata | undefined};

export type ReachabilitySettingsMode = 'UNSET' | 'NAMESPACE' | 'GROUP' | 'WORKSPACE' | 'CLUSTER' | 'CUSTOM';

export type V2ReachabilitySettings = {mode?: ReachabilitySettingsMode | undefined, hosts?: Array<string> | undefined};

export type V2HTTPRetry = {attempts: number, perTryTimeout?: string | undefined, retryOn?: string | undefined};

export type TcpKeepAliveSettingsTcpKeepAlive = {probes?: number | undefined, idleTime?: number | undefined, interval?: number | undefined};

export type KeepAliveSettingsTcpKeepAliveSettings = {downstream?: TcpKeepAliveSettingsTcpKeepAlive | undefined, upstream?: TcpKeepAliveSettingsTcpKeepAlive | undefined};

export type V2KeepAliveSettings = {tcp?: KeepAliveSettingsTcpKeepAliveSettings | undefined};

export type ResilienceSettingsSensitivity = 'UNSET' | 'LOW' | 'MEDIUM' | 'HIGH';

export type V2ResilienceSettings = {httpRequestTimeout?: string | undefined, httpRetries?: V2HTTPRetry | undefined, tcpKeepalive?: boolean | undefined, keepAlive?: V2KeepAliveSettings | undefined, circuitBreakerSensitivity?: ResilienceSettingsSensitivity | undefined};

export type TrafficSettingEgressGateway = {host: string, port?: number | undefined};

export type V2RateLimitSettingsRateLimitDimensionRemoteAddress = {value: string};

export type V2StringMatch = {exact?: string | undefined, prefix?: string | undefined, regex?: string | undefined};

export type RateLimitDimensionHeader = {name: string, value?: V2StringMatch | undefined, dontMatch?: boolean | undefined};

export type V2RateLimitSettingsRateLimitDimension = {remoteAddress?: V2RateLimitSettingsRateLimitDimensionRemoteAddress | undefined, header?: RateLimitDimensionHeader | undefined};

export type RateLimitValueUnit = 'UNKNOWN' | 'SECOND' | 'MINUTE' | 'HOUR' | 'DAY';

export type RateLimitSettingsRateLimitValue = {requestsPerUnit: number, unit: RateLimitValueUnit};

export type V2RateLimitSettingsRateLimitRule = {dimensions: Array<V2RateLimitSettingsRateLimitDimension>, limit: RateLimitSettingsRateLimitValue};

export type V2RateLimitSettings = {rules: Array<V2RateLimitSettingsRateLimitRule>, failClosed?: boolean | undefined, timeout?: string | undefined};

export type RateLimitDimensionSourceCluster = Record<string, never>;

export type RateLimitDimensionDestinationCluster = Record<string, never>;

export type V2ExternalRateLimitServiceSettingsRateLimitDimensionRemoteAddress = Record<string, never>;

export type RateLimitDimensionRequestHeaders = {headerName: string, descriptorKey: string};

export type RateLimitDimensionHeaderValueMatch = {headers: {[key: string]: V2StringMatch}, descriptorValue: string, dontMatch?: boolean | undefined};

export type V2ExternalRateLimitServiceSettingsRateLimitDimension = {sourceCluster?: RateLimitDimensionSourceCluster | undefined, destinationCluster?: RateLimitDimensionDestinationCluster | undefined, remoteAddress?: V2ExternalRateLimitServiceSettingsRateLimitDimensionRemoteAddress | undefined, requestHeaders?: RateLimitDimensionRequestHeaders | undefined, headerValueMatch?: RateLimitDimensionHeaderValueMatch | undefined};

export type V2ExternalRateLimitServiceSettingsRateLimitRule = {dimensions: Array<V2ExternalRateLimitServiceSettingsRateLimitDimension>};

export type V2ExternalRateLimitServiceSettings = {domain: string, failClosed?: boolean | undefined, rateLimitServerUri: string, rules: Array<V2ExternalRateLimitServiceSettingsRateLimitRule>, timeout?: string | undefined, tls?: V2ClientTLSSettings | undefined};

export type V2RateLimiting = {settings?: V2RateLimitSettings | undefined, externalService?: V2ExternalRateLimitServiceSettings | undefined};

export type V2TrafficSetting = {fqn?: string | undefined, displayName?: string | undefined, etag?: string | undefined, description?: string | undefined, reachability?: V2ReachabilitySettings | undefined, resilience?: V2ResilienceSettings | undefined, egress?: TrafficSettingEgressGateway | undefined, rateLimiting?: V2RateLimiting | undefined, configGenerationMetadata?: V2ConfigGenerationMetadata | undefined};

export type OrganizationSettingNetworkSettings = {networkReachability?: {[key: string]: string} | undefined};

export type V2RegionalFailover = {from?: string | undefined, to?: string | undefined};

export type UpdateApiV2OrganizationsOrganizationSettingsSettingArgs = {organization: string, setting: string, body: {defaultSecuritySetting?: V2SecuritySetting | undefined, defaultTrafficSetting?: V2TrafficSetting | undefined, description?: string | undefined, displayName?: string | undefined, etag?: string | undefined, networkSettings?: OrganizationSettingNetworkSettings | undefined, regionalFailover?: Array<V2RegionalFailover> | undefined}};

export type UpdateApiV2OrganizationsOrganizationSettingsSettingOptions = {baseUrl: string, fetch?: typeof fetch | undefined};

export const organizationSettingNetworkSettings = z.object({networkReachability: z.record(z.string(), z.string()).optional()});

export const v2RegionalFailover = z.object({from: z.string().optional(), to: z.string().optional()});

export const securitySettingAuthenticationMode = z.enum(["UNSET", "OPTIONAL", "REQUIRED"]);

export const authorizationSettingsMode = z.enum(["UNSET", "NAMESPACE", "GROUP", "WORKSPACE", "CLUSTER", "DISABLED", "CUSTOM", "RULES"]);

export const authv2TLSMode = z.enum(["DISABLED", "SIMPLE", "MUTUAL"]);

export const v2TLSFileSource = z.object({clientCertificate: z.string().optional(), privateKey: z.string().optional(), caCertificates: z.string().optional()});

export const v2ClientTLSSettings = z.object({mode: authv2TLSMode.optional(), files: v2TLSFileSource.optional(), secretName: z.string().optional(), subjectAltNames: z.array(z.string()).optional()});

export const tsbauthv2AuthorizationExternalAuthzBackend = z.object({uri: z.string().optional(), includeRequestHeaders: z.array(z.string()).optional(), tls: v2ClientTLSSettings.optional()});

export const tsbauthv2SubjectJWTClaims = z.object({iss: z.string().optional(), sub: z.string().optional(), other: z.record(z.string(), z.string()).optional()});

export const tsbauthv2Subject = z.object({jwt: tsbauthv2SubjectJWTClaims.optional()});

export const tsbauthv2LocalAuthzRuleHttpOperation = z.object({paths: z.array(z.string()).optional(), methods: z.array(z.string()).optional()});

export const tsbauthv2LocalAuthzRule = z.object({name: z.string(), from: z.array(tsbauthv2Subject).optional(), to: z.array(tsbauthv2LocalAuthzRuleHttpOperation).optional()});

export const tsbauthv2AuthorizationLocalAuthz = z.object({rules: z.array(tsbauthv2LocalAuthzRule).optional()});

export const tsbauthv2Authorization = z.object({external: tsbauthv2AuthorizationExternalAuthzBackend.optional(), local: tsbauthv2AuthorizationLocalAuthz.optional()});

export const ruleFrom = z.object({fqn: z.string().optional()});

export const ruleTo = z.object({fqn: z.string().optional()});

export const v2Rule = z.object({from: ruleFrom, to: ruleTo});

export const v2AuthorizationRules = z.object({allow: z.array(v2Rule).optional(), denyAll: z.boolean().optional(), deny: z.array(v2Rule).optional()});

export const v2AuthorizationSettings = z.object({mode: authorizationSettingsMode.optional(), serviceAccounts: z.array(z.string()).optional(), http: tsbauthv2Authorization.optional(), rules: v2AuthorizationRules.optional()});

export const jWTClaimToHeader = z.object({header: z.string(), claim: z.string()});

export const jWTJWTHeader = z.object({name: z.string(), prefix: z.string().optional()});

export const authenticationJWT = z.object({issuer: z.string(), audiences: z.array(z.string()).optional(), jwksUri: z.string().optional(), jwks: z.string().optional(), outputPayloadToHeader: z.string().optional(), outputClaimToHeaders: z.array(jWTClaimToHeader).optional(), fromHeaders: z.array(jWTJWTHeader).optional()});

export const tsbauthv2AuthenticationJWT = z.object({issuer: z.string(), audiences: z.array(z.string()).optional(), jwksUri: z.string().optional(), jwks: z.string().optional(), outputPayloadToHeader: z.string().optional(), outputClaimToHeaders: z.array(jWTClaimToHeader).optional(), fromHeaders: z.array(jWTJWTHeader).optional()});

export const authenticationRules = z.object({jwt: z.array(tsbauthv2AuthenticationJWT).optional()});

export const v2Authentication = z.object({jwt: authenticationJWT.optional(), rules: authenticationRules.optional()});

export const v2AuthenticationSettings = z.object({trafficMode: securitySettingAuthenticationMode.optional(), http: v2Authentication.optional()});

export const v2WAFSettings = z.object({rules: z.array(z.string())});

export const v2PropagationStrategy = z.enum(["REPLACE", "STRICTER"]);

export const v2WorkloadMode = z.enum(["UNDEFINED", "CLIENT", "SERVER", "CLIENT_AND_SERVER"]);

export const v2PortSelector = z.object({number: z.number().int()});

export const v2TrafficSelector = z.object({mode: v2WorkloadMode.optional(), ports: z.array(v2PortSelector).optional()});

export const v2WasmExtensionAttachment = z.object({fqn: z.string(), config: z.object({}).optional(), match: z.array(v2TrafficSelector).optional()});

export const v2ConfigGenerationMetadata = z.object({labels: z.record(z.string(), z.string()).optional(), annotations: z.record(z.string(), z.string()).optional()});

export const v2SecuritySetting = z.object({fqn: z.string().optional(), displayName: z.string().optional(), etag: z.string().optional(), description: z.string().optional(), authentication: securitySettingAuthenticationMode.optional(), authorization: v2AuthorizationSettings.optional(), authenticationSettings: v2AuthenticationSettings.optional(), waf: v2WAFSettings.optional(), propagationStrategy: v2PropagationStrategy.optional(), extension: z.array(v2WasmExtensionAttachment).optional(), configGenerationMetadata: v2ConfigGenerationMetadata.optional()});

export const reachabilitySettingsMode = z.enum(["UNSET", "NAMESPACE", "GROUP", "WORKSPACE", "CLUSTER", "CUSTOM"]);

export const v2ReachabilitySettings = z.object({mode: reachabilitySettingsMode.optional(), hosts: z.array(z.string()).optional()});

export const v2HTTPRetry = z.object({attempts: z.number().int(), perTryTimeout: z.string().optional(), retryOn: z.string().optional()});

export const tcpKeepAliveSettingsTcpKeepAlive = z.object({probes: z.number().int().optional(), idleTime: z.number().int().optional(), interval: z.number().int().optional()});

export const keepAliveSettingsTcpKeepAliveSettings = z.object({downstream: tcpKeepAliveSettingsTcpKeepAlive.optional(), upstream: tcpKeepAliveSettingsTcpKeepAlive.optional()});

export const v2KeepAliveSettings = z.object({tcp: keepAliveSettingsTcpKeepAliveSettings.optional()});

export const resilienceSettingsSensitivity = z.enum(["UNSET", "LOW", "MEDIUM", "HIGH"]);

export const v2ResilienceSettings = z.object({httpRequestTimeout: z.string().optional(), httpRetries: v2HTTPRetry.optional(), tcpKeepalive: z.boolean().optional(), keepAlive: v2KeepAliveSettings.optional(), circuitBreakerSensitivity: resilienceSettingsSensitivity.optional()});

export const trafficSettingEgressGateway = z.object({host: z.string(), port: z.number().int().optional()});

export const v2RateLimitSettingsRateLimitDimensionRemoteAddress = z.object({value: z.string()});

export const v2StringMatch = z.object({exact: z.string().optional(), prefix: z.string().optional(), regex: z.string().optional()});

export const rateLimitDimensionHeader = z.object({name: z.string(), value: v2StringMatch.optional(), dontMatch: z.boolean().optional()});

export const v2RateLimitSettingsRateLimitDimension = z.object({remoteAddress: v2RateLimitSettingsRateLimitDimensionRemoteAddress.optional(), header: rateLimitDimensionHeader.optional()});

export const rateLimitValueUnit = z.enum(["UNKNOWN", "SECOND", "MINUTE", "HOUR", "DAY"]);

export const rateLimitSettingsRateLimitValue = z.object({requestsPerUnit: z.number().int(), unit: rateLimitValueUnit});

export const v2RateLimitSettingsRateLimitRule = z.object({dimensions: z.array(v2RateLimitSettingsRateLimitDimension), limit: rateLimitSettingsRateLimitValue});

export const v2RateLimitSettings = z.object({rules: z.array(v2RateLimitSettingsRateLimitRule), failClosed: z.boolean().optional(), timeout: z.string().optional()});

export const rateLimitDimensionSourceCluster = z.object({});

export const rateLimitDimensionDestinationCluster = z.object({});

export const v2ExternalRateLimitServiceSettingsRateLimitDimensionRemoteAddress = z.object({});

export const rateLimitDimensionRequestHeaders = z.object({headerName: z.string(), descriptorKey: z.string()});

export const rateLimitDimensionHeaderValueMatch = z.object({headers: z.record(z.string(), v2StringMatch), descriptorValue: z.string(), dontMatch: z.boolean().optional()});

export const v2ExternalRateLimitServiceSettingsRateLimitDimension = z.object({sourceCluster: rateLimitDimensionSourceCluster.optional(), destinationCluster: rateLimitDimensionDestinationCluster.optional(), remoteAddress: v2ExternalRateLimitServiceSettingsRateLimitDimensionRemoteAddress.optional(), requestHeaders: rateLimitDimensionRequestHeaders.optional(), headerValueMatch: rateLimitDimensionHeaderValueMatch.optional()});

export const v2ExternalRateLimitServiceSettingsRateLimitRule = z.object({dimensions: z.array(v2ExternalRateLimitServiceSettingsRateLimitDimension)});

export const v2ExternalRateLimitServiceSettings = z.object({domain: z.string(), failClosed: z.boolean().optional(), rateLimitServerUri: z.string(), rules: z.array(v2ExternalRateLimitServiceSettingsRateLimitRule), timeout: z.string().optional(), tls: v2ClientTLSSettings.optional()});

export const v2RateLimiting = z.object({settings: v2RateLimitSettings.optional(), externalService: v2ExternalRateLimitServiceSettings.optional()});

export const v2TrafficSetting = z.object({fqn: z.string().optional(), displayName: z.string().optional(), etag: z.string().optional(), description: z.string().optional(), reachability: v2ReachabilitySettings.optional(), resilience: v2ResilienceSettings.optional(), egress: trafficSettingEgressGateway.optional(), rateLimiting: v2RateLimiting.optional(), configGenerationMetadata: v2ConfigGenerationMetadata.optional()});

export const v2OrganizationSetting = z.object({fqn: z.string().optional(), displayName: z.string().optional(), etag: z.string().optional(), description: z.string().optional(), networkSettings: organizationSettingNetworkSettings.optional(), regionalFailover: z.array(v2RegionalFailover).optional(), defaultSecuritySetting: v2SecuritySetting.optional(), defaultTrafficSetting: v2TrafficSetting.optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Modify the given settings in the given Organization.
 * 
 * PUT /v2/organizations/{organization}/settings/{setting}
 */
export const updateApiV2OrganizationsOrganizationSettingsSetting = async (args: UpdateApiV2OrganizationsOrganizationSettingsSettingArgs, options: UpdateApiV2OrganizationsOrganizationSettingsSettingOptions) => {
const {baseUrl, fetch: fetchFn = fetch} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('content-type', "application/json")
headers.set('accept', "application/json")

const url = `${baseUrl.replace(/\/+$/, '')}/v2/organizations/${encodeURIComponent(String(args.organization))}/settings/${encodeURIComponent(String(args.setting))}${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "PUT", headers, body: JSON.stringify(args.body)})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(v2OrganizationSetting, await res.json())
};