# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
  - ALPHA
  auto_generated: true
  hidden: true
  help_text:
    brief: Create PolicyBinding instance.
    description: |
      Create PolicyBinding instance.
    examples: |-
      To create a policy binding instance called `my-binding` that references a principal
      access boundary policy run:

      $ {command} my-binding --organization=123 --location=global \
        --policy=organizations/123/locations/global/principalAccessBoundaryPolicies/my-policy \
        --target-principal-set=//cloudresourcemanager.googleapis.com/organizations/123
  arguments:
    params:
    - help_text: |-
        Identifier. The name of the policy binding, in the format
        `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`.
        The binding parent is the closest Resource Manager resource (project,
        folder, or organization) to the binding target.

        Format:

        * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}`
        * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}`
        * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}`
        * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`
      is_positional: true
      is_primary_resource: true
      request_id_field: policyBindingId
      resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_policy_bindings
      required: true
    - arg_name: etag
      api_field: googleIamV3alphaPolicyBinding.etag
      required: false
      repeated: false
      help_text: |-
        The etag for the policy binding.
        If this is provided on update, it must match the server's etag.
    - arg_name: display-name
      api_field: googleIamV3alphaPolicyBinding.displayName
      required: false
      repeated: false
      help_text: |-
        The description of the policy binding. Must be less than or equal to 63
        characters.
    - arg_name: annotations
      api_field: googleIamV3alphaPolicyBinding.annotations
      required: false
      repeated: true
      help_text: |-
        User-defined annotations. See https://google.aip.dev/148#annotations for
        more details such as format and size limitations
      spec:
      - api_field: key
      - api_field: value
    - group:
        api_field: googleIamV3alphaPolicyBinding.target
        required: true
        help_text: |-
          Target is the full resource name of the resource to which the policy will
          be bound. Immutable once set.
        params:
        - group:
            mutex: true
            help_text: |-
              Arguments for the target.
            params:
            - arg_name: target-principal-set
              api_field: googleIamV3alphaPolicyBinding.target.principalSet
              required: false
              repeated: false
              help_text: |-
                Full Resource Name used for principal access boundary policy bindings.
                The principal set must be directly parented by the policy binding's
                parent or same as the parent if the target is a
                project/folder/organization.

                Examples:
                * For binding's parented by an organization:
                  * Organization:
                  `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID`
                  * Workforce Identity:
                  `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID`
                  * Workspace Identity:
                  `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID`
                * For binding's parented by a folder:
                  * Folder:
                  `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID`
                * For binding's parented by a project:
                  * Project:
                    * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER`
                    * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
                  * Workload Identity Pool:
                  `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/LOCATION/workloadIdentityPools/WORKLOAD_POOL_ID`
            - arg_name: target-resource
              api_field: googleIamV3alphaPolicyBinding.target.resource
              required: false
              repeated: false
              help_text: |-
                Full Resource Name used for access policy bindings
                Examples:

                * Organization:
                `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID`
                * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID`
                * Project:
                    * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER`
                    * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
    - arg_name: policy-kind
      api_field: googleIamV3alphaPolicyBinding.policyKind
      required: false
      help_text: |-
        The kind of the policy to attach in this binding. This field must be one of
        the following:

        - Left empty (will be automatically set to the policy kind)
        - The input policy kind
      choices:
      - arg_value: principal-access-boundary
        enum_value: PRINCIPAL_ACCESS_BOUNDARY
        help_text: |-
          Principal access boundary policy kind
      - arg_value: access
        enum_value: ACCESS
        help_text: |-
          Access policy kind. Keep behind visibility label until Access Policy
          launch.
    - arg_name: policy
      api_field: googleIamV3alphaPolicyBinding.policy
      required: true
      repeated: false
      help_text: |-
        The resource name of the policy to be bound. The binding parent and policy
        must belong to the same organization.
    - group:
        api_field: googleIamV3alphaPolicyBinding.condition
        required: false
        help_text: |-
          Represents a textual expression in the Common Expression Language (CEL)
          syntax. CEL is a C-like expression language. The syntax and semantics of CEL
          are documented at https://github.com/google/cel-spec.

          Example (Comparison):

              title: "Summary size limit"
              description: "Determines if a summary is less than 100 chars"
              expression: "document.summary.size() < 100"

          Example (Equality):

              title: "Requestor is owner"
              description: "Determines if requestor is the document owner"
              expression: "document.owner == request.auth.claims.email"

          Example (Logic):

              title: "Public documents"
              description: "Determine whether the document should be publicly visible"
              expression: "document.type != 'private' && document.type != 'internal'"

          Example (Data Manipulation):

              title: "Notification string"
              description: "Create a notification string with a timestamp."
              expression: "'New message received at ' + string(document.create_time)"

          The exact variables and functions that may be referenced within an expression
          are determined by the service that evaluates it. See the service
          documentation for additional information.
        params:
        - arg_name: condition-expression
          api_field: googleIamV3alphaPolicyBinding.condition.expression
          required: false
          repeated: false
          help_text: |-
            Textual representation of an expression in Common Expression Language
            syntax.
        - arg_name: condition-title
          api_field: googleIamV3alphaPolicyBinding.condition.title
          required: false
          repeated: false
          help_text: |-
            Title for the expression, i.e. a short string describing
            its purpose. This can be used e.g. in UIs which allow to enter the
            expression.
        - arg_name: condition-description
          api_field: googleIamV3alphaPolicyBinding.condition.description
          required: false
          repeated: false
          help_text: |-
            Description of the expression. This is a longer text which
            describes the expression, e.g. when hovered over it in a UI.
        - arg_name: condition-location
          api_field: googleIamV3alphaPolicyBinding.condition.location
          required: false
          repeated: false
          help_text: |-
            String indicating the location of the expression for error
            reporting, e.g. a file name and a position in the file.
  request:
    api_version: v3alpha
    collection:
    - iam.folders.locations.policyBindings
    - iam.organizations.locations.policyBindings
    - iam.projects.locations.policyBindings
  async:
    collection:
    - iam.folders.locations.operations
    - iam.organizations.locations.operations
    - iam.projects.locations.operations
