<?php
# Generated by the protocol buffer compiler.  DO NOT EDIT!
# source: google/cloud/security/privateca/v1/resources.proto

namespace Google\Cloud\Security\PrivateCA\V1\CaPool;

use Google\Protobuf\Internal\GPBType;
use Google\Protobuf\Internal\RepeatedField;
use Google\Protobuf\Internal\GPBUtil;

/**
 * Defines controls over all certificate issuance within a
 * [CaPool][google.cloud.security.privateca.v1.CaPool].
 *
 * Generated from protobuf message <code>google.cloud.security.privateca.v1.CaPool.IssuancePolicy</code>
 */
class IssuancePolicy extends \Google\Protobuf\Internal\Message
{
    /**
     * Optional. If any
     * [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType]
     * is specified, then the certificate request's public key must match one of
     * the key types listed here. Otherwise, any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $allowed_key_types;
    /**
     * Optional. The maximum lifetime allowed for issued
     * [Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
     * if the issuing
     * [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
     * expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested
     * maximum_lifetime, the effective lifetime will be explicitly truncated to
     * match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $maximum_lifetime = null;
    /**
     * Optional. If specified, then only methods allowed in the
     * [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes]
     * may be used to issue
     * [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $allowed_issuance_modes = null;
    /**
     * Optional. A set of X.509 values that will be applied to all certificates
     * issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If a certificate request includes conflicting values for the same
     * properties, they will be overwritten by the values defined here. If a
     * certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * for the same properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $baseline_values = null;
    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If this
     * is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool]
     * will not add restrictions on a certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $identity_constraints = null;
    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a
     * certificate request sets extensions that don't appear in the
     * [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * that don't appear here, the certificate issuance request will fail. If
     * this is omitted, then this
     * [CaPool][google.cloud.security.privateca.v1.CaPool] will not add
     * restrictions on a certificate's X.509 extensions. These constraints do
     * not apply to X.509 extensions set in this
     * [CaPool][google.cloud.security.privateca.v1.CaPool]'s
     * [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $passthrough_extensions = null;

    /**
     * Constructor.
     *
     * @param array $data {
     *     Optional. Data for populating the Message object.
     *
     *     @type array<\Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType>|\Google\Protobuf\Internal\RepeatedField $allowed_key_types
     *           Optional. If any
     *           [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType]
     *           is specified, then the certificate request's public key must match one of
     *           the key types listed here. Otherwise, any key may be used.
     *     @type \Google\Protobuf\Duration $maximum_lifetime
     *           Optional. The maximum lifetime allowed for issued
     *           [Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
     *           if the issuing
     *           [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
     *           expires before a
     *           [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested
     *           maximum_lifetime, the effective lifetime will be explicitly truncated to
     *           match it.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes $allowed_issuance_modes
     *           Optional. If specified, then only methods allowed in the
     *           [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes]
     *           may be used to issue
     *           [Certificates][google.cloud.security.privateca.v1.Certificate].
     *     @type \Google\Cloud\Security\PrivateCA\V1\X509Parameters $baseline_values
     *           Optional. A set of X.509 values that will be applied to all certificates
     *           issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     *           If a certificate request includes conflicting values for the same
     *           properties, they will be overwritten by the values defined here. If a
     *           certificate request uses a
     *           [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     *           that defines conflicting
     *           [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     *           for the same properties, the certificate issuance request will fail.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints $identity_constraints
     *           Optional. Describes constraints on identities that may appear in
     *           [Certificates][google.cloud.security.privateca.v1.Certificate] issued
     *           through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If this
     *           is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool]
     *           will not add restrictions on a certificate's identity.
     *     @type \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints $passthrough_extensions
     *           Optional. Describes the set of X.509 extensions that may appear in a
     *           [Certificate][google.cloud.security.privateca.v1.Certificate] issued
     *           through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a
     *           certificate request sets extensions that don't appear in the
     *           [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     *           those extensions will be dropped. If a certificate request uses a
     *           [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     *           with
     *           [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     *           that don't appear here, the certificate issuance request will fail. If
     *           this is omitted, then this
     *           [CaPool][google.cloud.security.privateca.v1.CaPool] will not add
     *           restrictions on a certificate's X.509 extensions. These constraints do
     *           not apply to X.509 extensions set in this
     *           [CaPool][google.cloud.security.privateca.v1.CaPool]'s
     *           [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     * }
     */
    public function __construct($data = NULL) {
        \GPBMetadata\Google\Cloud\Security\Privateca\V1\Resources::initOnce();
        parent::__construct($data);
    }

    /**
     * Optional. If any
     * [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType]
     * is specified, then the certificate request's public key must match one of
     * the key types listed here. Otherwise, any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\RepeatedField
     */
    public function getAllowedKeyTypes()
    {
        return $this->allowed_key_types;
    }

    /**
     * Optional. If any
     * [AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType]
     * is specified, then the certificate request's public key must match one of
     * the key types listed here. Otherwise, any key may be used.
     *
     * Generated from protobuf field <code>repeated .google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType allowed_key_types = 1 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array<\Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType>|\Google\Protobuf\Internal\RepeatedField $var
     * @return $this
     */
    public function setAllowedKeyTypes($var)
    {
        $arr = GPBUtil::checkRepeatedField($var, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\AllowedKeyType::class);
        $this->allowed_key_types = $arr;

        return $this;
    }

    /**
     * Optional. The maximum lifetime allowed for issued
     * [Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
     * if the issuing
     * [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
     * expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested
     * maximum_lifetime, the effective lifetime will be explicitly truncated to
     * match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Duration|null
     */
    public function getMaximumLifetime()
    {
        return $this->maximum_lifetime;
    }

    public function hasMaximumLifetime()
    {
        return isset($this->maximum_lifetime);
    }

    public function clearMaximumLifetime()
    {
        unset($this->maximum_lifetime);
    }

    /**
     * Optional. The maximum lifetime allowed for issued
     * [Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
     * if the issuing
     * [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
     * expires before a
     * [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested
     * maximum_lifetime, the effective lifetime will be explicitly truncated to
     * match it.
     *
     * Generated from protobuf field <code>.google.protobuf.Duration maximum_lifetime = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Protobuf\Duration $var
     * @return $this
     */
    public function setMaximumLifetime($var)
    {
        GPBUtil::checkMessage($var, \Google\Protobuf\Duration::class);
        $this->maximum_lifetime = $var;

        return $this;
    }

    /**
     * Optional. If specified, then only methods allowed in the
     * [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes]
     * may be used to issue
     * [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes|null
     */
    public function getAllowedIssuanceModes()
    {
        return $this->allowed_issuance_modes;
    }

    public function hasAllowedIssuanceModes()
    {
        return isset($this->allowed_issuance_modes);
    }

    public function clearAllowedIssuanceModes()
    {
        unset($this->allowed_issuance_modes);
    }

    /**
     * Optional. If specified, then only methods allowed in the
     * [IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes]
     * may be used to issue
     * [Certificates][google.cloud.security.privateca.v1.Certificate].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes allowed_issuance_modes = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes $var
     * @return $this
     */
    public function setAllowedIssuanceModes($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CaPool\IssuancePolicy\IssuanceModes::class);
        $this->allowed_issuance_modes = $var;

        return $this;
    }

    /**
     * Optional. A set of X.509 values that will be applied to all certificates
     * issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If a certificate request includes conflicting values for the same
     * properties, they will be overwritten by the values defined here. If a
     * certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * for the same properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\X509Parameters|null
     */
    public function getBaselineValues()
    {
        return $this->baseline_values;
    }

    public function hasBaselineValues()
    {
        return isset($this->baseline_values);
    }

    public function clearBaselineValues()
    {
        unset($this->baseline_values);
    }

    /**
     * Optional. A set of X.509 values that will be applied to all certificates
     * issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
     * If a certificate request includes conflicting values for the same
     * properties, they will be overwritten by the values defined here. If a
     * certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * that defines conflicting
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * for the same properties, the certificate issuance request will fail.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.X509Parameters baseline_values = 4 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\X509Parameters $var
     * @return $this
     */
    public function setBaselineValues($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\X509Parameters::class);
        $this->baseline_values = $var;

        return $this;
    }

    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If this
     * is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool]
     * will not add restrictions on a certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints|null
     */
    public function getIdentityConstraints()
    {
        return $this->identity_constraints;
    }

    public function hasIdentityConstraints()
    {
        return isset($this->identity_constraints);
    }

    public function clearIdentityConstraints()
    {
        unset($this->identity_constraints);
    }

    /**
     * Optional. Describes constraints on identities that may appear in
     * [Certificates][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If this
     * is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool]
     * will not add restrictions on a certificate's identity.
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateIdentityConstraints identity_constraints = 5 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints $var
     * @return $this
     */
    public function setIdentityConstraints($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CertificateIdentityConstraints::class);
        $this->identity_constraints = $var;

        return $this;
    }

    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a
     * certificate request sets extensions that don't appear in the
     * [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * that don't appear here, the certificate issuance request will fail. If
     * this is omitted, then this
     * [CaPool][google.cloud.security.privateca.v1.CaPool] will not add
     * restrictions on a certificate's X.509 extensions. These constraints do
     * not apply to X.509 extensions set in this
     * [CaPool][google.cloud.security.privateca.v1.CaPool]'s
     * [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints|null
     */
    public function getPassthroughExtensions()
    {
        return $this->passthrough_extensions;
    }

    public function hasPassthroughExtensions()
    {
        return isset($this->passthrough_extensions);
    }

    public function clearPassthroughExtensions()
    {
        unset($this->passthrough_extensions);
    }

    /**
     * Optional. Describes the set of X.509 extensions that may appear in a
     * [Certificate][google.cloud.security.privateca.v1.Certificate] issued
     * through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a
     * certificate request sets extensions that don't appear in the
     * [passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
     * those extensions will be dropped. If a certificate request uses a
     * [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
     * with
     * [predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
     * that don't appear here, the certificate issuance request will fail. If
     * this is omitted, then this
     * [CaPool][google.cloud.security.privateca.v1.CaPool] will not add
     * restrictions on a certificate's X.509 extensions. These constraints do
     * not apply to X.509 extensions set in this
     * [CaPool][google.cloud.security.privateca.v1.CaPool]'s
     * [baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
     *
     * Generated from protobuf field <code>.google.cloud.security.privateca.v1.CertificateExtensionConstraints passthrough_extensions = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints $var
     * @return $this
     */
    public function setPassthroughExtensions($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\Security\PrivateCA\V1\CertificateExtensionConstraints::class);
        $this->passthrough_extensions = $var;

        return $this;
    }

}