// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

import { APIResource } from '../../../../core/resource';
import * as CustomAPI from './custom/custom';
import {
  BaseCustom,
  Custom,
  CustomCreateParams,
  CustomDeleteParams,
  CustomEditParams,
  CustomGetParams,
  CustomListParams,
} from './custom/custom';
import * as DefaultAPI from './default/default';
import {
  BaseDefault,
  Default,
  DefaultEditParams,
  DefaultEditResponse,
  DefaultGetParams,
  DefaultGetResponse,
} from './default/default';
import { SinglePage } from '../../../../core/pagination';

export class BasePolicies extends APIResource {
  static override readonly _key: readonly ['zeroTrust', 'devices', 'policies'] = Object.freeze([
    'zeroTrust',
    'devices',
    'policies',
  ] as const);
}
export class Policies extends BasePolicies {
  default: DefaultAPI.Default = new DefaultAPI.Default(this._client);
  custom: CustomAPI.Custom = new CustomAPI.Custom(this._client);
}

export type SplitTunnelExcludesSinglePage = SinglePage<SplitTunnelExclude>;

export type SplitTunnelIncludesSinglePage = SinglePage<SplitTunnelInclude>;

export type FallbackDomainsSinglePage = SinglePage<FallbackDomain>;

export type SettingsPoliciesSinglePage = SinglePage<SettingsPolicy>;

export interface DevicePolicyCertificates {
  /**
   * The current status of the device policy certificate provisioning feature for
   * WARP clients.
   */
  enabled: boolean;
}

export interface FallbackDomain {
  /**
   * The domain suffix to match when resolving locally.
   */
  suffix: string;

  /**
   * A description of the fallback domain, displayed in the client UI.
   */
  description?: string;

  /**
   * A list of IP addresses to handle domain resolution.
   */
  dns_server?: Array<string>;
}

export interface FallbackDomainParam {
  /**
   * The domain suffix to match when resolving locally.
   */
  suffix: string;

  /**
   * A description of the fallback domain, displayed in the client UI.
   */
  description?: string;

  /**
   * A list of IP addresses to handle domain resolution.
   */
  dns_server?: Array<string>;
}

export interface SettingsPolicy {
  /**
   * Whether to allow the user to switch WARP between modes.
   */
  allow_mode_switch?: boolean;

  /**
   * Whether to receive update notifications when a new version of the client is
   * available.
   */
  allow_updates?: boolean;

  /**
   * Whether to allow devices to leave the organization.
   */
  allowed_to_leave?: boolean;

  /**
   * The amount of time in seconds to reconnect after having been disabled.
   */
  auto_connect?: number;

  /**
   * Browser extension proxy settings. Required when profile_type is
   * browser_extension and invalid for WARP profiles.
   */
  browser_extension_config?: SettingsPolicy.BrowserExtensionConfig | null;

  /**
   * Turn on the captive portal after the specified amount of time.
   */
  captive_portal?: number;

  /**
   * Whether the policy is the account default. WARP group profiles cannot set this
   * field.
   */
  default?: boolean;

  /**
   * A description of the policy.
   */
  description?: string;

  /**
   * If the `dns_server` field of a fallback domain is not present, the client will
   * fall back to a best guess of the default/system DNS resolvers unless this policy
   * option is set to `true`.
   */
  disable_auto_fallback?: boolean;

  /**
   * List of DNS search suffixes to apply to clients. Suffixes are evaluated in
   * order. Use an empty array to clear.
   */
  dns_search_suffixes?: Array<SettingsPolicy.DNSSearchSuffix>;

  /**
   * Whether the policy will be applied to matching devices.
   */
  enabled?: boolean;

  /**
   * List of routes excluded in the WARP client's tunnel.
   */
  exclude?: Array<SplitTunnelExclude>;

  /**
   * Whether to add Microsoft IPs to Split Tunnel exclusions.
   */
  exclude_office_ips?: boolean;

  fallback_domains?: Array<FallbackDomain>;

  gateway_unique_id?: string;

  /**
   * Global Acceleration settings for China. When configured, WARP clients connect to
   * the Global Accelerator addresses instead of the default ones. Please contact
   * your account representative to enable this feature on your account. See
   * https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
   */
  global_acceleration?: SettingsPolicy.GlobalAcceleration | null;

  /**
   * List of routes included in the WARP client's tunnel.
   */
  include?: Array<SplitTunnelInclude>;

  /**
   * The amount of time in minutes a user is allowed access to their LAN. A value of
   * 0 will allow LAN access until the next WARP reconnection, such as a reboot or a
   * laptop waking from sleep. Note that this field is omitted from the response if
   * null or unset.
   */
  lan_allow_minutes?: number;

  /**
   * The size of the subnet for the local access network. Note that this field is
   * omitted from the response if null or unset.
   */
  lan_allow_subnet_size?: number;

  /**
   * The wirefilter expression to match devices. Available values: "identity.email",
   * "identity.groups.id", "identity.groups.name", "identity.groups.email",
   * "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name",
   * "os.version".
   */
  match?: string;

  /**
   * The name of the device settings profile.
   */
  name?: string;

  policy_id?: string;

  /**
   * The precedence of the policy. Lower values indicate higher precedence. Policies
   * will be evaluated in ascending order of this field.
   */
  precedence?: number;

  /**
   * The client type to which the device settings profile applies. This field is set
   * when the profile is created and cannot be changed.
   */
  profile_type?: 'warp' | 'browser_extension';

  /**
   * Determines if the operating system will register WARP's local interface IP with
   * your on-premises DNS server.
   */
  register_interface_ip_with_dns?: boolean;

  /**
   * Determines whether the WARP client indicates to SCCM that it is inside a VPN
   * boundary. (Windows only).
   */
  sccm_vpn_boundary_support?: boolean;

  service_mode_v2?: SettingsPolicy.ServiceModeV2;

  /**
   * The URL to launch when the Send Feedback button is clicked.
   */
  support_url?: string;

  /**
   * Whether to allow the user to turn off the WARP switch and disconnect the client.
   */
  switch_locked?: boolean;

  target_tests?: Array<SettingsPolicy.TargetTest>;

  /**
   * Determines which tunnel protocol to use.
   */
  tunnel_protocol?: string;

  /**
   * Determines whether uninstalling the WARP client requires an override code.
   * (Windows only).
   */
  uninstall_protection?: boolean;

  /**
   * Virtual network access settings for the device.
   */
  virtual_networks?: SettingsPolicy.VirtualNetworks | null;
}

export namespace SettingsPolicy {
  /**
   * Browser extension proxy settings. Required when profile_type is
   * browser_extension and invalid for WARP profiles.
   */
  export interface BrowserExtensionConfig {
    /**
     * Whether the user may disable the browser extension proxy.
     */
    proxy_control: 'unlocked' | 'locked';

    /**
     * Whether the browser extension proxy is active.
     */
    proxy_enabled: boolean;
  }

  export interface DNSSearchSuffix {
    /**
     * The DNS search suffix to append when resolving short hostnames.
     */
    suffix: string;

    /**
     * A description of the DNS search suffix.
     */
    description?: string;
  }

  /**
   * Global Acceleration settings for China. When configured, WARP clients connect to
   * the Global Accelerator addresses instead of the default ones. Please contact
   * your account representative to enable this feature on your account. See
   * https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
   */
  export interface GlobalAcceleration {
    /**
     * IP:port entries for the API endpoints.
     */
    api_endpoints: Array<string>;

    /**
     * Global acceleration settings are used only when "enabled".
     */
    enabled: boolean;

    /**
     * IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or
     * masque_endpoints must be provided.
     */
    masque_endpoints: Array<string>;

    /**
     * IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints
     * or masque_endpoints must be provided.
     */
    wireguard_endpoints: Array<string>;

    /**
     * Automatically switch Global Acceleration regions based on device location.
     * Defaults to false when not provided.
     */
    autoswitch?: boolean;
  }

  export interface ServiceModeV2 {
    /**
     * The mode to run the WARP client under.
     */
    mode?: string;

    /**
     * The port number when used with proxy mode.
     */
    port?: number;
  }

  export interface TargetTest {
    /**
     * The id of the DEX test targeting this policy.
     */
    id?: string;

    /**
     * The name of the DEX test targeting this policy.
     */
    name?: string;
  }

  /**
   * Virtual network access settings for the device.
   */
  export interface VirtualNetworks {
    /**
     * List of virtual network IDs the device is allowed to access. When
     * virtual_networks is set, at least one entry is required.
     */
    allowed: Array<string>;

    /**
     * The default virtual network ID. Must be included in the `allowed` list.
     */
    default: string;
  }
}

export type SplitTunnelExclude =
  | SplitTunnelExclude.TeamsDevicesExcludeSplitTunnelWithAddress
  | SplitTunnelExclude.TeamsDevicesExcludeSplitTunnelWithHost;

export namespace SplitTunnelExclude {
  export interface TeamsDevicesExcludeSplitTunnelWithAddress {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present,
     * `host` must not be present.
     */
    address: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }

  export interface TeamsDevicesExcludeSplitTunnelWithHost {
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must
     * not be present.
     */
    host: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }
}

export type SplitTunnelExcludeParam =
  | SplitTunnelExcludeParam.TeamsDevicesExcludeSplitTunnelWithAddress
  | SplitTunnelExcludeParam.TeamsDevicesExcludeSplitTunnelWithHost;

export namespace SplitTunnelExcludeParam {
  export interface TeamsDevicesExcludeSplitTunnelWithAddress {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present,
     * `host` must not be present.
     */
    address: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }

  export interface TeamsDevicesExcludeSplitTunnelWithHost {
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must
     * not be present.
     */
    host: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }
}

export type SplitTunnelInclude =
  | SplitTunnelInclude.TeamsDevicesIncludeSplitTunnelWithAddress
  | SplitTunnelInclude.TeamsDevicesIncludeSplitTunnelWithHost;

export namespace SplitTunnelInclude {
  export interface TeamsDevicesIncludeSplitTunnelWithAddress {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present,
     * `host` must not be present.
     */
    address: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }

  export interface TeamsDevicesIncludeSplitTunnelWithHost {
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must
     * not be present.
     */
    host: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }
}

export type SplitTunnelIncludeParam =
  | SplitTunnelIncludeParam.TeamsDevicesIncludeSplitTunnelWithAddress
  | SplitTunnelIncludeParam.TeamsDevicesIncludeSplitTunnelWithHost;

export namespace SplitTunnelIncludeParam {
  export interface TeamsDevicesIncludeSplitTunnelWithAddress {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present,
     * `host` must not be present.
     */
    address: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }

  export interface TeamsDevicesIncludeSplitTunnelWithHost {
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must
     * not be present.
     */
    host: string;

    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: string;
  }
}

Policies.Default = Default;
Policies.BaseDefault = BaseDefault;
Policies.Custom = Custom;
Policies.BaseCustom = BaseCustom;

export declare namespace Policies {
  export {
    type DevicePolicyCertificates as DevicePolicyCertificates,
    type FallbackDomain as FallbackDomain,
    type SettingsPolicy as SettingsPolicy,
    type SplitTunnelExclude as SplitTunnelExclude,
    type SplitTunnelInclude as SplitTunnelInclude,
  };

  export {
    Default as Default,
    BaseDefault as BaseDefault,
    type DefaultEditResponse as DefaultEditResponse,
    type DefaultGetResponse as DefaultGetResponse,
    type DefaultEditParams as DefaultEditParams,
    type DefaultGetParams as DefaultGetParams,
  };

  export {
    Custom as Custom,
    BaseCustom as BaseCustom,
    type CustomCreateParams as CustomCreateParams,
    type CustomListParams as CustomListParams,
    type CustomDeleteParams as CustomDeleteParams,
    type CustomEditParams as CustomEditParams,
    type CustomGetParams as CustomGetParams,
  };
}