// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

import { APIResource } from '../../core/resource';
import { APIPromise } from '../../core/api-promise';
import { RequestOptions } from '../../internal/request-options';
import { path } from '../../internal/utils/path';

export class BaseTemporaryCredentials extends APIResource {
  static override readonly _key: readonly ['r2', 'temporaryCredentials'] = Object.freeze([
    'r2',
    'temporaryCredentials',
  ] as const);

  /**
   * Creates temporary access credentials on a bucket that can be optionally scoped
   * to prefixes or objects.
   *
   * @example
   * ```ts
   * const temporaryCredential =
   *   await client.r2.temporaryCredentials.create({
   *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
   *     bucket: 'example-bucket',
   *     parentAccessKeyId: 'example-access-key-id',
   *     permission: 'object-read-write',
   *     ttlSeconds: 3600,
   *   });
   * ```
   */
  create(
    params: TemporaryCredentialCreateParams,
    options?: RequestOptions,
  ): APIPromise<TemporaryCredentialCreateResponse> {
    const { account_id, ...body } = params;
    return (
      this._client.post(path`/accounts/${account_id}/r2/temp-access-credentials`, {
        body,
        ...options,
      }) as APIPromise<{ result: TemporaryCredentialCreateResponse }>
    )._thenUnwrap((obj) => obj.result);
  }
}
export class TemporaryCredentials extends BaseTemporaryCredentials {}

export interface TemporaryCredential {
  /**
   * Name of the R2 bucket.
   */
  bucket: string;

  /**
   * Access key ID of the parent R2 API token. The temporary credentials cannot
   * exceed this token's permissions.
   */
  parentAccessKeyId: string;

  /**
   * Permissions allowed on the credentials.
   */
  permission: 'admin-read-write' | 'admin-read-only' | 'object-read-write' | 'object-read-only';

  /**
   * Lifetime of the temporary credentials in seconds, up to 604800 seconds (7 days).
   */
  ttlSeconds: number;

  /**
   * Optional object paths to scope the credentials to.
   */
  objects?: Array<string>;

  /**
   * Optional prefix paths to scope the credentials to.
   */
  prefixes?: Array<string>;
}

export interface TemporaryCredentialCreateResponse {
  /**
   * ID for new access key.
   */
  accessKeyId?: string;

  /**
   * Secret access key.
   */
  secretAccessKey?: string;

  /**
   * Security token.
   */
  sessionToken?: string;
}

export interface TemporaryCredentialCreateParams {
  /**
   * Path param: Cloudflare account ID that owns the R2 resource.
   */
  account_id: string;

  /**
   * Body param: Name of the R2 bucket.
   */
  bucket: string;

  /**
   * Body param: Access key ID of the parent R2 API token. The temporary credentials
   * cannot exceed this token's permissions.
   */
  parentAccessKeyId: string;

  /**
   * Body param: Permissions allowed on the credentials.
   */
  permission: 'admin-read-write' | 'admin-read-only' | 'object-read-write' | 'object-read-only';

  /**
   * Body param: Lifetime of the temporary credentials in seconds, up to 604800
   * seconds (7 days).
   */
  ttlSeconds: number;

  /**
   * Body param: Optional object paths to scope the credentials to.
   */
  objects?: Array<string>;

  /**
   * Body param: Optional prefix paths to scope the credentials to.
   */
  prefixes?: Array<string>;
}

export declare namespace TemporaryCredentials {
  export {
    type TemporaryCredential as TemporaryCredential,
    type TemporaryCredentialCreateResponse as TemporaryCredentialCreateResponse,
    type TemporaryCredentialCreateParams as TemporaryCredentialCreateParams,
  };
}