<?php
# Generated by the protocol buffer compiler.  DO NOT EDIT!
# source: google/cloud/security/privateca/v1/resources.proto

namespace Google\Cloud\Security\PrivateCA\V1\CaPool;

use Google\Protobuf\Internal\GPBType;
use Google\Protobuf\Internal\RepeatedField;
use Google\Protobuf\Internal\GPBUtil;

/**
 * Defines controls over all certificate issuance within a [CaPool][google.cloud.security.privateca.v1.CaPool].
 *
 * Generated from protobuf message <code>google.cloud.security.privateca.v1.CaPool.IssuancePolicy</code>
 */
class IssuancePolicy extends \Google\Protobuf\Internal\Message
{
    /**
     * Optional. If any [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType] is specified, then the certificate request's
     * public key must match one of the key types listed here. Otherwise,
     * any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $allowed_key_types;
    /**
     * Optional. The maximum lifetime allowed for issued [Certificates][google.cloud.security.privateca.v1.Certificate]. Note
     * that if the issuing [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority] expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested maximum_lifetime, the effective lifetime will
     * be explicitly truncated to match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $maximum_lifetime = null;
    /**
     * Optional. If specified, then only methods allowed in the [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes] may be
     * used to issue [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $allowed_issuance_modes = null;
    /**
     * Optional. A set of X.509 values that will be applied to all certificates issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request includes conflicting
     * values for the same properties, they will be overwritten by the values
     * defined here. If a certificate request uses a [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] for the same
     * properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $baseline_values = null;
    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If this is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $identity_constraints = null;
    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request
     * sets extensions that don't appear in the [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate] with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] that don't
     * appear here, the certificate issuance request will fail. If this is
     * omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's X.509 extensions. These constraints do not apply to X.509
     * extensions set in this [CaPool][google.cloud.security.privateca.v1.CaPool]'s [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $passthrough_extensions = null;

    /**
     * Constructor.
     *
     * @param array $data {
     *     Optional. Data for populating the Message object.
     *
     *     @type array<\Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType>|\Google\Protobuf\Internal\RepeatedField $allowed_key_types
     *           Optional. If any [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType] is specified, then the certificate request's
     *           public key must match one of the key types listed here. Otherwise,
     *           any key may be used.
     *     @type \Google\Protobuf\Duration $maximum_lifetime
     *           Optional. The maximum lifetime allowed for issued [Certificates][google.cloud.security.privateca.v1.Certificate]. Note
     *           that if the issuing [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority] expires before a
     *           [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested maximum_lifetime, the effective lifetime will
     *           be explicitly truncated to match it.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes $allowed_issuance_modes
     *           Optional. If specified, then only methods allowed in the [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes] may be
     *           used to issue [Certificates][google.cloud.security.privateca.v1.Certificate].
     *     @type \Google\Cloud\Security\PrivateCA\V1\X509Parameters $baseline_values
     *           Optional. A set of X.509 values that will be applied to all certificates issued
     *           through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request includes conflicting
     *           values for the same properties, they will be overwritten by the values
     *           defined here. If a certificate request uses a [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     *           that defines conflicting
     *           [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] for the same
     *           properties, the certificate issuance request will fail.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints $identity_constraints
     *           Optional. Describes constraints on identities that may appear in
     *           [Certificates][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     *           If this is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     *           certificate's identity.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints $passthrough_extensions
     *           Optional. Describes the set of X.509 extensions that may appear in a
     *           [Certificate][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request
     *           sets extensions that don't appear in the [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     *           those extensions will be dropped. If a certificate request uses a
     *           [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate] with
     *           [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] that don't
     *           appear here, the certificate issuance request will fail. If this is
     *           omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     *           certificate's X.509 extensions. These constraints do not apply to X.509
     *           extensions set in this [CaPool][google.cloud.security.privateca.v1.CaPool]'s [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     * }
     */
    public function __construct($data = NULL) {
        \GPBMetadata\Google\Cloud\Security\Privateca\V1\Resources::initOnce();
        parent::__construct($data);
    }

    /**
     * Optional. If any [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType] is specified, then the certificate request's
     * public key must match one of the key types listed here. Otherwise,
     * any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\RepeatedField
     */
    public function getAllowedKeyTypes()
    {
        return $this->allowed_key_types;
    }

    /**
     * Optional. If any [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType] is specified, then the certificate request's
     * public key must match one of the key types listed here. Otherwise,
     * any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array<\Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType>|\Google\Protobuf\Internal\RepeatedField $var
     * @return $this
     */
    public function setAllowedKeyTypes($var)
    {
        $arr = GPBUtil::checkRepeatedField($var, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType::class);
        $this->allowed_key_types = $arr;

        return $this;
    }

    /**
     * Optional. The maximum lifetime allowed for issued [Certificates][google.cloud.security.privateca.v1.Certificate]. Note
     * that if the issuing [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority] expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested maximum_lifetime, the effective lifetime will
     * be explicitly truncated to match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Duration|null
     */
    public function getMaximumLifetime()
    {
        return $this->maximum_lifetime;
    }

    public function hasMaximumLifetime()
    {
        return isset($this->maximum_lifetime);
    }

    public function clearMaximumLifetime()
    {
        unset($this->maximum_lifetime);
    }

    /**
     * Optional. The maximum lifetime allowed for issued [Certificates][google.cloud.security.privateca.v1.Certificate]. Note
     * that if the issuing [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority] expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested maximum_lifetime, the effective lifetime will
     * be explicitly truncated to match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Protobuf\Duration $var
     * @return $this
     */
    public function setMaximumLifetime($var)
    {
        GPBUtil::checkMessage($var, \Google\Protobuf\Duration::class);
        $this->maximum_lifetime = $var;

        return $this;
    }

    /**
     * Optional. If specified, then only methods allowed in the [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes] may be
     * used to issue [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes|null
     */
    public function getAllowedIssuanceModes()
    {
        return $this->allowed_issuance_modes;
    }

    public function hasAllowedIssuanceModes()
    {
        return isset($this->allowed_issuance_modes);
    }

    public function clearAllowedIssuanceModes()
    {
        unset($this->allowed_issuance_modes);
    }

    /**
     * Optional. If specified, then only methods allowed in the [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes] may be
     * used to issue [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes $var
     * @return $this
     */
    public function setAllowedIssuanceModes($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes::class);
        $this->allowed_issuance_modes = $var;

        return $this;
    }

    /**
     * Optional. A set of X.509 values that will be applied to all certificates issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request includes conflicting
     * values for the same properties, they will be overwritten by the values
     * defined here. If a certificate request uses a [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] for the same
     * properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\X509Parameters|null
     */
    public function getBaselineValues()
    {
        return $this->baseline_values;
    }

    public function hasBaselineValues()
    {
        return isset($this->baseline_values);
    }

    public function clearBaselineValues()
    {
        unset($this->baseline_values);
    }

    /**
     * Optional. A set of X.509 values that will be applied to all certificates issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request includes conflicting
     * values for the same properties, they will be overwritten by the values
     * defined here. If a certificate request uses a [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] for the same
     * properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\X509Parameters $var
     * @return $this
     */
    public function setBaselineValues($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\X509Parameters::class);
        $this->baseline_values = $var;

        return $this;
    }

    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If this is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints|null
     */
    public function getIdentityConstraints()
    {
        return $this->identity_constraints;
    }

    public function hasIdentityConstraints()
    {
        return isset($this->identity_constraints);
    }

    public function clearIdentityConstraints()
    {
        unset($this->identity_constraints);
    }

    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If this is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints $var
     * @return $this
     */
    public function setIdentityConstraints($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints::class);
        $this->identity_constraints = $var;

        return $this;
    }

    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request
     * sets extensions that don't appear in the [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate] with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] that don't
     * appear here, the certificate issuance request will fail. If this is
     * omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's X.509 extensions. These constraints do not apply to X.509
     * extensions set in this [CaPool][google.cloud.security.privateca.v1.CaPool]'s [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints|null
     */
    public function getPassthroughExtensions()
    {
        return $this->passthrough_extensions;
    }

    public function hasPassthroughExtensions()
    {
        return isset($this->passthrough_extensions);
    }

    public function clearPassthroughExtensions()
    {
        unset($this->passthrough_extensions);
    }

    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a certificate request
     * sets extensions that don't appear in the [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate] with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values] that don't
     * appear here, the certificate issuance request will fail. If this is
     * omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool] will not add restrictions on a
     * certificate's X.509 extensions. These constraints do not apply to X.509
     * extensions set in this [CaPool][google.cloud.security.privateca.v1.CaPool]'s [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints $var
     * @return $this
     */
    public function setPassthroughExtensions($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints::class);
        $this->passthrough_extensions = $var;

        return $this;
    }

}


