swift-sdk/Sources/Hanzo/Models/IamRegistration.swift

//
// IamRegistration.swift
//
// Generated by openapi-generator
// https://openapi-generator.tech
//

import Foundation

public struct IamRegistration: Sendable, Codable, ParameterConvertible, Hashable {

    public var cert: String?
    public var clientId: String?
    public var clientSecret: String?
    public var displayName: String?
    /** EnableCodeSignin offers sign-in by an emailed or texted one-time code beside the password. A POINTER for the same reason as IsShared: a plain bool reads as false on every reconcile that says nothing and would switch the method off for every app whose caller never mentioned it. */
    public var enableCodeSignin: Bool?
    /** ExpireInHours and RefreshExpireInHours are the application's token lifetimes. They are the ONLY declarative way to say that a refresh token must OUTLIVE its access token: with neither stated, oidc.refreshTTL clamps the refresh lifetime to the access lifetime, so the refresh_token grant the registration advertises expires at the same instant as the token it was meant to renew and can never be exercised. `hanzo-cli` sat in exactly that state — a browser re-login every hour, and a live refresh returning 401.  POINTERS, for the same reason as IsShared: a plain float would read as 0 on every reconcile that says nothing and reset a deliberate lifetime back to the default. Nil means \"not stated, leave it\". */
    public var expireInHours: Double?
    public var grantTypes: [String]?
    /** IsShared declares that this application serves EVERY organization, not only the one named in Organization. It is the honest description of a brand app — hanzo-id, hanzo-chat, a brand console — whose customers each live in their own tenant: self-service onboarding moves a founder OUT of the brand org, so `user.Owner != app.Organization` is the steady state and the app really does serve every org. Application.ServesOrg reads it as one of the three ways to say yes.  A POINTER because omission must PRESERVE. This upsert is the operator's steady-state reconcile and most callers say nothing about sharing; a plain bool would read as false on every one of them and silently un-share an app — the same shape of accident that de-secreted apps through update-application. Nil means \"not stated, leave it\"; only an explicit true or false moves it. */
    public var isShared: Bool?
    public var name: String?
    public var organization: String?
    /** Public declares a client that CANNOT hold a credential — a browser SPA, a CLI, a desktop app. It proves itself with PKCE instead, and the token endpoint treats \"no stored secret\" as exactly that (token.go: a secret is verified only when one is stored). Without this flag every upsert minted a secret, so a public client could never be registered at all and its browser code->token exchange 401'd `invalid_client` forever. */
    public var _public: Bool?
    public var redirectUris: [String]?
    public var refreshExpireInHours: Double?

    public init(cert: String? = nil, clientId: String? = nil, clientSecret: String? = nil, displayName: String? = nil, enableCodeSignin: Bool? = nil, expireInHours: Double? = nil, grantTypes: [String]? = nil, isShared: Bool? = nil, name: String? = nil, organization: String? = nil, _public: Bool? = nil, redirectUris: [String]? = nil, refreshExpireInHours: Double? = nil) {
        self.cert = cert
        self.clientId = clientId
        self.clientSecret = clientSecret
        self.displayName = displayName
        self.enableCodeSignin = enableCodeSignin
        self.expireInHours = expireInHours
        self.grantTypes = grantTypes
        self.isShared = isShared
        self.name = name
        self.organization = organization
        self._public = _public
        self.redirectUris = redirectUris
        self.refreshExpireInHours = refreshExpireInHours
    }

    public enum CodingKeys: String, CodingKey, CaseIterable {
        case cert
        case clientId
        case clientSecret
        case displayName
        case enableCodeSignin
        case expireInHours
        case grantTypes
        case isShared
        case name
        case organization
        case _public = "public"
        case redirectUris
        case refreshExpireInHours
    }

    // Encodable protocol methods

    public func encode(to encoder: Encoder) throws {
        var container = encoder.container(keyedBy: CodingKeys.self)
        try container.encodeIfPresent(cert, forKey: .cert)
        try container.encodeIfPresent(clientId, forKey: .clientId)
        try container.encodeIfPresent(clientSecret, forKey: .clientSecret)
        try container.encodeIfPresent(displayName, forKey: .displayName)
        try container.encodeIfPresent(enableCodeSignin, forKey: .enableCodeSignin)
        try container.encodeIfPresent(expireInHours, forKey: .expireInHours)
        try container.encodeIfPresent(grantTypes, forKey: .grantTypes)
        try container.encodeIfPresent(isShared, forKey: .isShared)
        try container.encodeIfPresent(name, forKey: .name)
        try container.encodeIfPresent(organization, forKey: .organization)
        try container.encodeIfPresent(_public, forKey: ._public)
        try container.encodeIfPresent(redirectUris, forKey: .redirectUris)
        try container.encodeIfPresent(refreshExpireInHours, forKey: .refreshExpireInHours)
    }
}