// This file is @generated by prost-build.
/// Request message for `CheckOnboardingStatus` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CheckOnboardingStatusRequest {
    /// Required. The resource for which the onboarding status should be checked.
    /// Should be in one of the following formats:
    ///
    /// * `projects/{project-number|project-id}/locations/{region}`
    /// * `folders/{folder-number}/locations/{region}`
    /// * `organizations/{organization-number}/locations/{region}`
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
}
/// Response message for `CheckOnboardingStatus` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CheckOnboardingStatusResponse {
    /// The service account that PAM uses to act on this resource.
    #[prost(string, tag = "1")]
    pub service_account: ::prost::alloc::string::String,
    /// List of issues that are preventing PAM from functioning for this resource
    /// and need to be fixed to complete onboarding. Some issues might not be
    /// detected or reported.
    #[prost(message, repeated, tag = "2")]
    pub findings: ::prost::alloc::vec::Vec<check_onboarding_status_response::Finding>,
}
/// Nested message and enum types in `CheckOnboardingStatusResponse`.
pub mod check_onboarding_status_response {
    /// Finding represents an issue which prevents PAM from functioning properly
    /// for this resource.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct Finding {
        #[prost(oneof = "finding::FindingType", tags = "1")]
        pub finding_type: ::core::option::Option<finding::FindingType>,
    }
    /// Nested message and enum types in `Finding`.
    pub mod finding {
        /// PAM's service account is being denied access by Cloud IAM.
        /// This can be fixed by granting a role that contains the missing
        /// permissions to the service account or exempting it from deny policies if
        /// they are blocking the access.
        #[derive(Clone, PartialEq, ::prost::Message)]
        pub struct IamAccessDenied {
            /// List of permissions that are being denied.
            #[prost(string, repeated, tag = "1")]
            pub missing_permissions: ::prost::alloc::vec::Vec<
                ::prost::alloc::string::String,
            >,
        }
        #[derive(Clone, PartialEq, ::prost::Oneof)]
        pub enum FindingType {
            /// PAM's service account is being denied access by Cloud IAM.
            #[prost(message, tag = "1")]
            IamAccessDenied(IamAccessDenied),
        }
    }
}
/// An entitlement defines the eligibility of a set of users to obtain
/// predefined access for some time possibly after going through an approval
/// workflow.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Entitlement {
    /// Identifier. Name of the entitlement.
    /// Possible formats:
    ///
    /// * `organizations/{organization-number}/locations/{region}/entitlements/{entitlement-id}`
    /// * `folders/{folder-number}/locations/{region}/entitlements/{entitlement-id}`
    /// * `projects/{project-id|project-number}/locations/{region}/entitlements/{entitlement-id}`
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. Create time stamp.
    #[prost(message, optional, tag = "2")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. Update time stamp.
    #[prost(message, optional, tag = "3")]
    pub update_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Optional. Who can create grants using this entitlement. This list should
    /// contain at most one entry.
    #[prost(message, repeated, tag = "5")]
    pub eligible_users: ::prost::alloc::vec::Vec<AccessControlEntry>,
    /// Optional. The approvals needed before access are granted to a requester. No
    /// approvals are needed if this field is null.
    #[prost(message, optional, tag = "6")]
    pub approval_workflow: ::core::option::Option<ApprovalWorkflow>,
    /// The access granted to a requester on successful approval.
    #[prost(message, optional, tag = "7")]
    pub privileged_access: ::core::option::Option<PrivilegedAccess>,
    /// Required. The maximum amount of time that access is granted for a request.
    /// A requester can ask for a duration less than this, but never more.
    #[prost(message, optional, tag = "8")]
    pub max_request_duration: ::core::option::Option<::prost_types::Duration>,
    /// Output only. Current state of this entitlement.
    #[prost(enumeration = "entitlement::State", tag = "9")]
    pub state: i32,
    /// Required. The manner in which the requester should provide a justification
    /// for requesting access.
    #[prost(message, optional, tag = "10")]
    pub requester_justification_config: ::core::option::Option<
        entitlement::RequesterJustificationConfig,
    >,
    /// Optional. Additional email addresses to be notified based on actions taken.
    #[prost(message, optional, tag = "11")]
    pub additional_notification_targets: ::core::option::Option<
        entitlement::AdditionalNotificationTargets,
    >,
    /// An `etag` is used for optimistic concurrency control as a way to prevent
    /// simultaneous updates to the same entitlement. An `etag` is returned in the
    /// response to `GetEntitlement` and the caller should put the `etag` in the
    /// request to `UpdateEntitlement` so that their change is applied on
    /// the same version. If this field is omitted or if there is a mismatch while
    /// updating an entitlement, then the server rejects the request.
    #[prost(string, tag = "12")]
    pub etag: ::prost::alloc::string::String,
}
/// Nested message and enum types in `Entitlement`.
pub mod entitlement {
    /// Defines how a requester must provide a justification when requesting
    /// access.
    #[derive(Clone, Copy, PartialEq, ::prost::Message)]
    pub struct RequesterJustificationConfig {
        /// This is a required field and the user must explicitly opt out if a
        /// justification from the requester isn't mandatory.
        #[prost(
            oneof = "requester_justification_config::JustificationType",
            tags = "1, 2"
        )]
        pub justification_type: ::core::option::Option<
            requester_justification_config::JustificationType,
        >,
    }
    /// Nested message and enum types in `RequesterJustificationConfig`.
    pub mod requester_justification_config {
        /// The justification is not mandatory but can be provided in any of the
        /// supported formats.
        #[derive(Clone, Copy, PartialEq, ::prost::Message)]
        pub struct NotMandatory {}
        /// The requester has to provide a justification in the form of a string.
        #[derive(Clone, Copy, PartialEq, ::prost::Message)]
        pub struct Unstructured {}
        /// This is a required field and the user must explicitly opt out if a
        /// justification from the requester isn't mandatory.
        #[derive(Clone, Copy, PartialEq, ::prost::Oneof)]
        pub enum JustificationType {
            /// This option means the requester isn't required to provide a
            /// justification.
            #[prost(message, tag = "1")]
            NotMandatory(NotMandatory),
            /// This option means the requester must provide a string as
            /// justification. If this is selected, the server allows the requester
            /// to provide a justification but doesn't validate it.
            #[prost(message, tag = "2")]
            Unstructured(Unstructured),
        }
    }
    /// AdditionalNotificationTargets includes email addresses to be notified.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct AdditionalNotificationTargets {
        /// Optional. Additional email addresses to be notified when a principal
        /// (requester) is granted access.
        #[prost(string, repeated, tag = "1")]
        pub admin_email_recipients: ::prost::alloc::vec::Vec<
            ::prost::alloc::string::String,
        >,
        /// Optional. Additional email address to be notified about an eligible
        /// entitlement.
        #[prost(string, repeated, tag = "2")]
        pub requester_email_recipients: ::prost::alloc::vec::Vec<
            ::prost::alloc::string::String,
        >,
    }
    /// Different states an entitlement can be in.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum State {
        /// Unspecified state. This value is never returned by the server.
        Unspecified = 0,
        /// The entitlement is being created.
        Creating = 1,
        /// The entitlement is available for requesting access.
        Available = 2,
        /// The entitlement is being deleted.
        Deleting = 3,
        /// The entitlement has been deleted.
        Deleted = 4,
        /// The entitlement is being updated.
        Updating = 5,
    }
    impl State {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                State::Unspecified => "STATE_UNSPECIFIED",
                State::Creating => "CREATING",
                State::Available => "AVAILABLE",
                State::Deleting => "DELETING",
                State::Deleted => "DELETED",
                State::Updating => "UPDATING",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "CREATING" => Some(Self::Creating),
                "AVAILABLE" => Some(Self::Available),
                "DELETING" => Some(Self::Deleting),
                "DELETED" => Some(Self::Deleted),
                "UPDATING" => Some(Self::Updating),
                _ => None,
            }
        }
    }
}
/// AccessControlEntry is used to control who can do some operation.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct AccessControlEntry {
    /// Optional. Users who are allowed for the operation. Each entry should be a
    /// valid v1 IAM principal identifier. The format for these is documented at:
    /// <https://cloud.google.com/iam/docs/principal-identifiers#v1>
    #[prost(string, repeated, tag = "1")]
    pub principals: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Different types of approval workflows that can be used to gate privileged
/// access granting.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ApprovalWorkflow {
    #[prost(oneof = "approval_workflow::ApprovalWorkflow", tags = "1")]
    pub approval_workflow: ::core::option::Option<approval_workflow::ApprovalWorkflow>,
}
/// Nested message and enum types in `ApprovalWorkflow`.
pub mod approval_workflow {
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum ApprovalWorkflow {
        /// An approval workflow where users designated as approvers review and act
        /// on the grants.
        #[prost(message, tag = "1")]
        ManualApprovals(super::ManualApprovals),
    }
}
/// A manual approval workflow where users who are designated as approvers
/// need to call the `ApproveGrant`/`DenyGrant` APIs for a grant. The workflow
/// can consist of multiple serial steps where each step defines who can act as
/// approver in that step and how many of those users should approve before the
/// workflow moves to the next step.
///
/// This can be used to create approval workflows such as:
///
/// * Require an approval from any user in a group G.
/// * Require an approval from any k number of users from a Group G.
/// * Require an approval from any user in a group G and then from a user U.
///
/// A single user might be part of the `approvers` ACL for multiple steps in this
/// workflow, but they can only approve once and that approval is only considered
/// to satisfy the approval step at which it was granted.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ManualApprovals {
    /// Optional. Do the approvers need to provide a justification for their
    /// actions?
    #[prost(bool, tag = "1")]
    pub require_approver_justification: bool,
    /// Optional. List of approval steps in this workflow. These steps are followed
    /// in the specified order sequentially. Only 1 step is supported.
    #[prost(message, repeated, tag = "2")]
    pub steps: ::prost::alloc::vec::Vec<manual_approvals::Step>,
}
/// Nested message and enum types in `ManualApprovals`.
pub mod manual_approvals {
    /// Step represents a logical step in a manual approval workflow.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct Step {
        /// Optional. The potential set of approvers in this step. This list must
        /// contain at most one entry.
        #[prost(message, repeated, tag = "1")]
        pub approvers: ::prost::alloc::vec::Vec<super::AccessControlEntry>,
        /// Required. How many users from the above list need to approve. If there
        /// aren't enough distinct users in the list, then the workflow indefinitely
        /// blocks. Should always be greater than 0. 1 is the only supported value.
        #[prost(int32, tag = "2")]
        pub approvals_needed: i32,
        /// Optional. Additional email addresses to be notified when a grant is
        /// pending approval.
        #[prost(string, repeated, tag = "3")]
        pub approver_email_recipients: ::prost::alloc::vec::Vec<
            ::prost::alloc::string::String,
        >,
    }
}
/// Privileged access that this service can be used to gate.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct PrivilegedAccess {
    #[prost(oneof = "privileged_access::AccessType", tags = "1")]
    pub access_type: ::core::option::Option<privileged_access::AccessType>,
}
/// Nested message and enum types in `PrivilegedAccess`.
pub mod privileged_access {
    /// GcpIamAccess represents IAM based access control on a Google Cloud
    /// resource. Refer to <https://cloud.google.com/iam/docs> to understand more
    /// about IAM.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct GcpIamAccess {
        /// Required. The type of this resource.
        #[prost(string, tag = "1")]
        pub resource_type: ::prost::alloc::string::String,
        /// Required. Name of the resource.
        #[prost(string, tag = "2")]
        pub resource: ::prost::alloc::string::String,
        /// Required. Role bindings that are created on successful grant.
        #[prost(message, repeated, tag = "4")]
        pub role_bindings: ::prost::alloc::vec::Vec<gcp_iam_access::RoleBinding>,
    }
    /// Nested message and enum types in `GcpIamAccess`.
    pub mod gcp_iam_access {
        /// IAM Role bindings that are created after a successful grant.
        #[derive(Clone, PartialEq, ::prost::Message)]
        pub struct RoleBinding {
            /// Required. IAM role to be granted.
            /// <https://cloud.google.com/iam/docs/roles-overview.>
            #[prost(string, tag = "1")]
            pub role: ::prost::alloc::string::String,
            /// Optional. The expression field of the IAM condition to be associated
            /// with the role. If specified, a user with an active grant for this
            /// entitlement is able to access the resource only if this condition
            /// evaluates to true for their request.
            ///
            /// This field uses the same CEL format as IAM and supports all attributes
            /// that IAM supports, except tags.
            /// <https://cloud.google.com/iam/docs/conditions-overview#attributes.>
            #[prost(string, tag = "2")]
            pub condition_expression: ::prost::alloc::string::String,
        }
    }
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum AccessType {
        /// Access to a Google Cloud resource through IAM.
        #[prost(message, tag = "1")]
        GcpIamAccess(GcpIamAccess),
    }
}
/// Message for requesting list of entitlements.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListEntitlementsRequest {
    /// Required. The parent which owns the entitlement resources.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Requested page size. Server may return fewer items than
    /// requested. If unspecified, the server picks an appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. A token identifying a page of results the server should return.
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Filtering results.
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Hint for how to order the results.
    #[prost(string, tag = "5")]
    pub order_by: ::prost::alloc::string::String,
}
/// Message for response to listing entitlements.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListEntitlementsResponse {
    /// The list of entitlements.
    #[prost(message, repeated, tag = "1")]
    pub entitlements: ::prost::alloc::vec::Vec<Entitlement>,
    /// A token identifying a page of results the server should return.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// Locations that could not be reached.
    #[prost(string, repeated, tag = "3")]
    pub unreachable: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Request message for `SearchEntitlements` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SearchEntitlementsRequest {
    /// Required. The parent which owns the entitlement resources.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. Only entitlements where the calling user has this access are
    /// returned.
    #[prost(enumeration = "search_entitlements_request::CallerAccessType", tag = "2")]
    pub caller_access_type: i32,
    /// Optional. Only entitlements matching this filter are returned in the
    /// response.
    #[prost(string, tag = "3")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Requested page size. The server may return fewer items than
    /// requested. If unspecified, the server picks an appropriate default.
    #[prost(int32, tag = "4")]
    pub page_size: i32,
    /// Optional. A token identifying a page of results the server should return.
    #[prost(string, tag = "5")]
    pub page_token: ::prost::alloc::string::String,
}
/// Nested message and enum types in `SearchEntitlementsRequest`.
pub mod search_entitlements_request {
    /// Different types of access a user can have on the entitlement resource.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CallerAccessType {
        /// Unspecified access type.
        Unspecified = 0,
        /// The user has access to create grants using this entitlement.
        GrantRequester = 1,
        /// The user has access to approve/deny grants created under this
        /// entitlement.
        GrantApprover = 2,
    }
    impl CallerAccessType {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                CallerAccessType::Unspecified => "CALLER_ACCESS_TYPE_UNSPECIFIED",
                CallerAccessType::GrantRequester => "GRANT_REQUESTER",
                CallerAccessType::GrantApprover => "GRANT_APPROVER",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CALLER_ACCESS_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
                "GRANT_REQUESTER" => Some(Self::GrantRequester),
                "GRANT_APPROVER" => Some(Self::GrantApprover),
                _ => None,
            }
        }
    }
}
/// Response message for `SearchEntitlements` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SearchEntitlementsResponse {
    /// The list of entitlements.
    #[prost(message, repeated, tag = "1")]
    pub entitlements: ::prost::alloc::vec::Vec<Entitlement>,
    /// A token identifying a page of results the server should return.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// Message for getting an entitlement.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetEntitlementRequest {
    /// Required. Name of the resource.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Message for creating an entitlement.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateEntitlementRequest {
    /// Required. Name of the parent resource for the entitlement.
    /// Possible formats:
    ///
    /// * `organizations/{organization-number}/locations/{region}`
    /// * `folders/{folder-number}/locations/{region}`
    /// * `projects/{project-id|project-number}/locations/{region}`
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. The ID to use for this entitlement. This becomes the last part of
    /// the resource name.
    ///
    /// This value should be 4-63 characters in length, and valid characters are
    /// "\[a-z\]", "\[0-9\]", and "-". The first character should be from \[a-z\].
    ///
    /// This value should be unique among all other entitlements under the
    /// specified `parent`.
    #[prost(string, tag = "2")]
    pub entitlement_id: ::prost::alloc::string::String,
    /// Required. The resource being created
    #[prost(message, optional, tag = "3")]
    pub entitlement: ::core::option::Option<Entitlement>,
    /// Optional. An optional request ID to identify requests. Specify a unique
    /// request ID so that if you must retry your request, the server knows to
    /// ignore the request if it has already been completed. The server guarantees
    /// this for at least 60 minutes after the first request.
    ///
    /// For example, consider a situation where you make an initial request and the
    /// request times out. If you make the request again with the same request
    /// ID, the server can check if original operation with the same request ID
    /// was received, and if so, ignores the second request and returns the
    /// previous operation's response. This prevents clients from accidentally
    /// creating duplicate commitments.
    ///
    /// The request ID must be a valid UUID with the exception that zero UUID is
    /// not supported (00000000-0000-0000-0000-000000000000).
    #[prost(string, tag = "4")]
    pub request_id: ::prost::alloc::string::String,
}
/// Message for deleting an entitlement.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct DeleteEntitlementRequest {
    /// Required. Name of the resource.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. An optional request ID to identify requests. Specify a unique
    /// request ID so that if you must retry your request, the server knows to
    /// ignore the request if it has already been completed. The server guarantees
    /// this for at least 60 minutes after the first request.
    ///
    /// For example, consider a situation where you make an initial request and the
    /// request times out. If you make the request again with the same request
    /// ID, the server can check if original operation with the same request ID
    /// was received, and if so, ignores the second request. This prevents
    /// clients from accidentally creating duplicate commitments.
    ///
    /// The request ID must be a valid UUID with the exception that zero UUID is
    /// not supported (00000000-0000-0000-0000-000000000000).
    #[prost(string, tag = "2")]
    pub request_id: ::prost::alloc::string::String,
    /// Optional. If set to true, any child grant under this entitlement is also
    /// deleted. (Otherwise, the request only works if the entitlement has no child
    /// grant.)
    #[prost(bool, tag = "3")]
    pub force: bool,
}
/// Message for updating an entitlement.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdateEntitlementRequest {
    /// Required. The entitlement resource that is updated.
    #[prost(message, optional, tag = "1")]
    pub entitlement: ::core::option::Option<Entitlement>,
    /// Required. The list of fields to update. A field is overwritten if, and only
    /// if, it is in the mask. Any immutable fields set in the mask are ignored by
    /// the server. Repeated fields and map fields are only allowed in the last
    /// position of a `paths` string and overwrite the existing values. Hence an
    /// update to a repeated field or a map should contain the entire list of
    /// values. The fields specified in the update_mask are relative to the
    /// resource and not to the request.
    /// (e.g. `MaxRequestDuration`; *not* `entitlement.MaxRequestDuration`)
    /// A value of '*' for this field refers to full replacement of the resource.
    #[prost(message, optional, tag = "2")]
    pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
}
/// This is to ensure that the `Grants` and `ProducerGrants` proto are byte
/// compatible.
/// A grant represents a request from a user for obtaining the access specified
/// in an entitlement they are eligible for.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Grant {
    /// Identifier. Name of this grant.
    /// Possible formats:
    ///
    /// * `organizations/{organization-number}/locations/{region}/entitlements/{entitlement-id}/grants/{grant-id}`
    /// * `folders/{folder-number}/locations/{region}/entitlements/{entitlement-id}/grants/{grant-id}`
    /// * `projects/{project-id|project-number}/locations/{region}/entitlements/{entitlement-id}/grants/{grant-id}`
    ///
    /// The last segment of this name (`{grant-id}`) is autogenerated.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. Create time stamp.
    #[prost(message, optional, tag = "2")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. Update time stamp.
    #[prost(message, optional, tag = "3")]
    pub update_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. Username of the user who created this grant.
    #[prost(string, tag = "4")]
    pub requester: ::prost::alloc::string::String,
    /// Required. The amount of time access is needed for. This value should be
    /// less than the `max_request_duration` value of the entitlement.
    #[prost(message, optional, tag = "5")]
    pub requested_duration: ::core::option::Option<::prost_types::Duration>,
    /// Optional. Justification of why this access is needed.
    #[prost(message, optional, tag = "6")]
    pub justification: ::core::option::Option<Justification>,
    /// Output only. Current state of this grant.
    #[prost(enumeration = "grant::State", tag = "7")]
    pub state: i32,
    /// Output only. Timeline of this grant.
    #[prost(message, optional, tag = "8")]
    pub timeline: ::core::option::Option<grant::Timeline>,
    /// Output only. The access that would be granted by this grant.
    #[prost(message, optional, tag = "9")]
    pub privileged_access: ::core::option::Option<PrivilegedAccess>,
    /// Output only. Audit trail of access provided by this grant. If unspecified
    /// then access was never granted.
    #[prost(message, optional, tag = "10")]
    pub audit_trail: ::core::option::Option<grant::AuditTrail>,
    /// Optional. Additional email addresses to notify for all the actions
    /// performed on the grant.
    #[prost(string, repeated, tag = "11")]
    pub additional_email_recipients: ::prost::alloc::vec::Vec<
        ::prost::alloc::string::String,
    >,
    /// Output only. Flag set by the PAM system to indicate that policy bindings
    /// made by this grant have been modified from outside PAM.
    ///
    /// After it is set, this flag remains set forever irrespective of the grant
    /// state. A `true` value here indicates that PAM no longer has any certainty
    /// on the access a user has because of this grant.
    #[prost(bool, tag = "12")]
    pub externally_modified: bool,
}
/// Nested message and enum types in `Grant`.
pub mod grant {
    /// Timeline of a grant describing what happened to it and when.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct Timeline {
        /// Output only. The events that have occurred on this grant. This list
        /// contains entries in the same order as they occurred. The first entry is
        /// always be of type `Requested` and there is always at least one entry in
        /// this array.
        #[prost(message, repeated, tag = "1")]
        pub events: ::prost::alloc::vec::Vec<timeline::Event>,
    }
    /// Nested message and enum types in `Timeline`.
    pub mod timeline {
        /// A single operation on the grant.
        #[derive(Clone, PartialEq, ::prost::Message)]
        pub struct Event {
            /// Output only. The time (as recorded at server) when this event occurred.
            #[prost(message, optional, tag = "1")]
            pub event_time: ::core::option::Option<::prost_types::Timestamp>,
            #[prost(oneof = "event::Event", tags = "2, 3, 4, 5, 6, 7, 8, 10, 11, 12")]
            pub event: ::core::option::Option<event::Event>,
        }
        /// Nested message and enum types in `Event`.
        pub mod event {
            /// An event representing that a grant was requested.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct Requested {
                /// Output only. The time at which this grant expires unless the approval
                /// workflow completes. If omitted, then the request never expires.
                #[prost(message, optional, tag = "1")]
                pub expire_time: ::core::option::Option<::prost_types::Timestamp>,
            }
            /// An event representing that the grant was approved.
            #[derive(Clone, PartialEq, ::prost::Message)]
            pub struct Approved {
                /// Output only. The reason provided by the approver for approving the
                /// grant.
                #[prost(string, tag = "1")]
                pub reason: ::prost::alloc::string::String,
                /// Output only. Username of the user who approved the grant.
                #[prost(string, tag = "2")]
                pub actor: ::prost::alloc::string::String,
            }
            /// An event representing that the grant was denied.
            #[derive(Clone, PartialEq, ::prost::Message)]
            pub struct Denied {
                /// Output only. The reason provided by the approver for denying the
                /// grant.
                #[prost(string, tag = "1")]
                pub reason: ::prost::alloc::string::String,
                /// Output only. Username of the user who denied the grant.
                #[prost(string, tag = "2")]
                pub actor: ::prost::alloc::string::String,
            }
            /// An event representing that the grant was revoked.
            #[derive(Clone, PartialEq, ::prost::Message)]
            pub struct Revoked {
                /// Output only. The reason provided by the user for revoking the grant.
                #[prost(string, tag = "1")]
                pub reason: ::prost::alloc::string::String,
                /// Output only. Username of the user who revoked the grant.
                #[prost(string, tag = "2")]
                pub actor: ::prost::alloc::string::String,
            }
            /// An event representing that the grant has been scheduled to be
            /// activated later.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct Scheduled {
                /// Output only. The time at which the access is granted.
                #[prost(message, optional, tag = "1")]
                pub scheduled_activation_time: ::core::option::Option<
                    ::prost_types::Timestamp,
                >,
            }
            /// An event representing that the grant was successfully
            /// activated.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct Activated {}
            /// An event representing that the grant activation failed.
            #[derive(Clone, PartialEq, ::prost::Message)]
            pub struct ActivationFailed {
                /// Output only. The error that occurred while activating the grant.
                #[prost(message, optional, tag = "1")]
                pub error: ::core::option::Option<
                    super::super::super::super::super::super::rpc::Status,
                >,
            }
            /// An event representing that the grant was expired.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct Expired {}
            /// An event representing that the grant has ended.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct Ended {}
            /// An event representing that the policy bindings made by this grant were
            /// modified externally.
            #[derive(Clone, Copy, PartialEq, ::prost::Message)]
            pub struct ExternallyModified {}
            #[derive(Clone, PartialEq, ::prost::Oneof)]
            pub enum Event {
                /// The grant was requested.
                #[prost(message, tag = "2")]
                Requested(Requested),
                /// The grant was approved.
                #[prost(message, tag = "3")]
                Approved(Approved),
                /// The grant was denied.
                #[prost(message, tag = "4")]
                Denied(Denied),
                /// The grant was revoked.
                #[prost(message, tag = "5")]
                Revoked(Revoked),
                /// The grant has been scheduled to give access.
                #[prost(message, tag = "6")]
                Scheduled(Scheduled),
                /// The grant was successfully activated to give access.
                #[prost(message, tag = "7")]
                Activated(Activated),
                /// There was a non-retriable error while trying to give access.
                #[prost(message, tag = "8")]
                ActivationFailed(ActivationFailed),
                /// The approval workflow did not complete in the necessary duration,
                /// and so the grant is expired.
                #[prost(message, tag = "10")]
                Expired(Expired),
                /// Access given by the grant ended automatically as the approved
                /// duration was over.
                #[prost(message, tag = "11")]
                Ended(Ended),
                /// The policy bindings made by grant have been modified outside of PAM.
                #[prost(message, tag = "12")]
                ExternallyModified(ExternallyModified),
            }
        }
    }
    /// Audit trail for the access provided by this grant.
    #[derive(Clone, Copy, PartialEq, ::prost::Message)]
    pub struct AuditTrail {
        /// Output only. The time at which access was given.
        #[prost(message, optional, tag = "1")]
        pub access_grant_time: ::core::option::Option<::prost_types::Timestamp>,
        /// Output only. The time at which the system removed access. This could be
        /// because of an automatic expiry or because of a revocation.
        ///
        /// If unspecified, then access hasn't been removed yet.
        #[prost(message, optional, tag = "2")]
        pub access_remove_time: ::core::option::Option<::prost_types::Timestamp>,
    }
    /// Different states a grant can be in.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum State {
        /// Unspecified state. This value is never returned by the server.
        Unspecified = 0,
        /// The entitlement had an approval workflow configured and this grant is
        /// waiting for the workflow to complete.
        ApprovalAwaited = 1,
        /// The approval workflow completed with a denied result. No access is
        /// granted for this grant. This is a terminal state.
        Denied = 3,
        /// The approval workflow completed successfully with an approved result or
        /// none was configured. Access is provided at an appropriate time.
        Scheduled = 4,
        /// Access is being given.
        Activating = 5,
        /// Access was successfully given and is currently active.
        Active = 6,
        /// The system could not give access due to a non-retriable error. This is a
        /// terminal state.
        ActivationFailed = 7,
        /// Expired after waiting for the approval workflow to complete. This is a
        /// terminal state.
        Expired = 8,
        /// Access is being revoked.
        Revoking = 9,
        /// Access was revoked by a user. This is a terminal state.
        Revoked = 10,
        /// System took back access as the requested duration was over. This is a
        /// terminal state.
        Ended = 11,
    }
    impl State {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                State::Unspecified => "STATE_UNSPECIFIED",
                State::ApprovalAwaited => "APPROVAL_AWAITED",
                State::Denied => "DENIED",
                State::Scheduled => "SCHEDULED",
                State::Activating => "ACTIVATING",
                State::Active => "ACTIVE",
                State::ActivationFailed => "ACTIVATION_FAILED",
                State::Expired => "EXPIRED",
                State::Revoking => "REVOKING",
                State::Revoked => "REVOKED",
                State::Ended => "ENDED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "APPROVAL_AWAITED" => Some(Self::ApprovalAwaited),
                "DENIED" => Some(Self::Denied),
                "SCHEDULED" => Some(Self::Scheduled),
                "ACTIVATING" => Some(Self::Activating),
                "ACTIVE" => Some(Self::Active),
                "ACTIVATION_FAILED" => Some(Self::ActivationFailed),
                "EXPIRED" => Some(Self::Expired),
                "REVOKING" => Some(Self::Revoking),
                "REVOKED" => Some(Self::Revoked),
                "ENDED" => Some(Self::Ended),
                _ => None,
            }
        }
    }
}
/// Justification represents a justification for requesting access.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Justification {
    #[prost(oneof = "justification::Justification", tags = "1")]
    pub justification: ::core::option::Option<justification::Justification>,
}
/// Nested message and enum types in `Justification`.
pub mod justification {
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum Justification {
        /// A free form textual justification. The system only ensures that this
        /// is not empty. No other kind of validation is performed on the string.
        #[prost(string, tag = "1")]
        UnstructuredJustification(::prost::alloc::string::String),
    }
}
/// Message for requesting list of grants.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListGrantsRequest {
    /// Required. The parent resource which owns the grants.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Optional. Requested page size. The server may return fewer items than
    /// requested. If unspecified, the server picks an appropriate default.
    #[prost(int32, tag = "2")]
    pub page_size: i32,
    /// Optional. A token identifying a page of results the server should return.
    #[prost(string, tag = "3")]
    pub page_token: ::prost::alloc::string::String,
    /// Optional. Filtering results.
    #[prost(string, tag = "4")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Hint for how to order the results
    #[prost(string, tag = "5")]
    pub order_by: ::prost::alloc::string::String,
}
/// Message for response to listing grants.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListGrantsResponse {
    /// The list of grants.
    #[prost(message, repeated, tag = "1")]
    pub grants: ::prost::alloc::vec::Vec<Grant>,
    /// A token identifying a page of results the server should return.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
    /// Locations that could not be reached.
    #[prost(string, repeated, tag = "3")]
    pub unreachable: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Request message for `SearchGrants` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SearchGrantsRequest {
    /// Required. The parent which owns the grant resources.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. Only grants which the caller is related to by this relationship
    /// are returned in the response.
    #[prost(enumeration = "search_grants_request::CallerRelationshipType", tag = "2")]
    pub caller_relationship: i32,
    /// Optional. Only grants matching this filter are returned in the response.
    #[prost(string, tag = "3")]
    pub filter: ::prost::alloc::string::String,
    /// Optional. Requested page size. The server may return fewer items than
    /// requested. If unspecified, server picks an appropriate default.
    #[prost(int32, tag = "4")]
    pub page_size: i32,
    /// Optional. A token identifying a page of results the server should return.
    #[prost(string, tag = "5")]
    pub page_token: ::prost::alloc::string::String,
}
/// Nested message and enum types in `SearchGrantsRequest`.
pub mod search_grants_request {
    /// Different types of relationships a user can have with a grant.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum CallerRelationshipType {
        /// Unspecified caller relationship type.
        Unspecified = 0,
        /// The user created this grant by calling `CreateGrant` earlier.
        HadCreated = 1,
        /// The user is an approver for the entitlement that this grant is parented
        /// under and can currently approve/deny it.
        CanApprove = 2,
        /// The caller had successfully approved/denied this grant earlier.
        HadApproved = 3,
    }
    impl CallerRelationshipType {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                CallerRelationshipType::Unspecified => {
                    "CALLER_RELATIONSHIP_TYPE_UNSPECIFIED"
                }
                CallerRelationshipType::HadCreated => "HAD_CREATED",
                CallerRelationshipType::CanApprove => "CAN_APPROVE",
                CallerRelationshipType::HadApproved => "HAD_APPROVED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "CALLER_RELATIONSHIP_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
                "HAD_CREATED" => Some(Self::HadCreated),
                "CAN_APPROVE" => Some(Self::CanApprove),
                "HAD_APPROVED" => Some(Self::HadApproved),
                _ => None,
            }
        }
    }
}
/// Response message for `SearchGrants` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SearchGrantsResponse {
    /// The list of grants.
    #[prost(message, repeated, tag = "1")]
    pub grants: ::prost::alloc::vec::Vec<Grant>,
    /// A token identifying a page of results the server should return.
    #[prost(string, tag = "2")]
    pub next_page_token: ::prost::alloc::string::String,
}
/// Message for getting a grant.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GetGrantRequest {
    /// Required. Name of the resource.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
}
/// Request message for `ApproveGrant` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ApproveGrantRequest {
    /// Required. Name of the grant resource which is being approved.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. The reason for approving this grant. This is required if the
    /// `require_approver_justification` field of the `ManualApprovals` workflow
    /// used in this grant is true.
    #[prost(string, tag = "2")]
    pub reason: ::prost::alloc::string::String,
}
/// Request message for `DenyGrant` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct DenyGrantRequest {
    /// Required. Name of the grant resource which is being denied.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. The reason for denying this grant. This is required if
    /// `require_approver_justification` field of the `ManualApprovals` workflow
    /// used in this grant is true.
    #[prost(string, tag = "2")]
    pub reason: ::prost::alloc::string::String,
}
/// Request message for `RevokeGrant` method.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct RevokeGrantRequest {
    /// Required. Name of the grant resource which is being revoked.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Optional. The reason for revoking this grant.
    #[prost(string, tag = "2")]
    pub reason: ::prost::alloc::string::String,
}
/// Message for creating a grant
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreateGrantRequest {
    /// Required. Name of the parent entitlement for which this grant is being
    /// requested.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. The resource being created.
    #[prost(message, optional, tag = "2")]
    pub grant: ::core::option::Option<Grant>,
    /// Optional. An optional request ID to identify requests. Specify a unique
    /// request ID so that if you must retry your request, the server knows to
    /// ignore the request if it has already been completed. The server guarantees
    /// this for at least 60 minutes after the first request.
    ///
    /// For example, consider a situation where you make an initial request and the
    /// request times out. If you make the request again with the same request
    /// ID, the server can check if original operation with the same request ID
    /// was received, and if so, ignores the second request. This prevents
    /// clients from accidentally creating duplicate commitments.
    ///
    /// The request ID must be a valid UUID with the exception that zero UUID is
    /// not supported (00000000-0000-0000-0000-000000000000).
    #[prost(string, tag = "3")]
    pub request_id: ::prost::alloc::string::String,
}
/// Represents the metadata of the long-running operation.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct OperationMetadata {
    /// Output only. The time the operation was created.
    #[prost(message, optional, tag = "1")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time the operation finished running.
    #[prost(message, optional, tag = "2")]
    pub end_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. Server-defined resource path for the target of the operation.
    #[prost(string, tag = "3")]
    pub target: ::prost::alloc::string::String,
    /// Output only. Name of the verb executed by the operation.
    #[prost(string, tag = "4")]
    pub verb: ::prost::alloc::string::String,
    /// Output only. Human-readable status of the operation, if any.
    #[prost(string, tag = "5")]
    pub status_message: ::prost::alloc::string::String,
    /// Output only. Identifies whether the user has requested cancellation
    /// of the operation. Operations that have been cancelled successfully
    /// have [Operation.error][] value with a
    /// [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
    /// `Code.CANCELLED`.
    #[prost(bool, tag = "6")]
    pub requested_cancellation: bool,
    /// Output only. API version used to start the operation.
    #[prost(string, tag = "7")]
    pub api_version: ::prost::alloc::string::String,
}
/// Generated client implementations.
pub mod privileged_access_manager_client {
    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// This API allows customers to manage temporary, request based privileged
    /// access to their resources.
    ///
    /// It defines the following resource model:
    ///
    /// * A collection of `Entitlement` resources. An entitlement allows configuring
    ///   (among other things):
    ///
    ///   * Some kind of privileged access that users can request.
    ///   * A set of users called _requesters_ who can request this access.
    ///   * A maximum duration for which the access can be requested.
    ///   * An optional approval workflow which must be satisfied before access is
    ///     granted.
    ///
    /// * A collection of `Grant` resources. A grant is a request by a requester to
    ///   get the privileged access specified in an entitlement for some duration.
    ///
    ///   After the approval workflow as specified in the entitlement is satisfied,
    ///   the specified access is given to the requester. The access is automatically
    ///   taken back after the requested duration is over.
    #[derive(Debug, Clone)]
    pub struct PrivilegedAccessManagerClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl<T> PrivilegedAccessManagerClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::BoxBody>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> PrivilegedAccessManagerClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::BoxBody>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::BoxBody>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::BoxBody>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            PrivilegedAccessManagerClient::new(
                InterceptedService::new(inner, interceptor),
            )
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// CheckOnboardingStatus reports the onboarding status for a
        /// project/folder/organization. Any findings reported by this API need to be
        /// fixed before PAM can be used on the resource.
        pub async fn check_onboarding_status(
            &mut self,
            request: impl tonic::IntoRequest<super::CheckOnboardingStatusRequest>,
        ) -> std::result::Result<
            tonic::Response<super::CheckOnboardingStatusResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/CheckOnboardingStatus",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "CheckOnboardingStatus",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Lists entitlements in a given project/folder/organization and location.
        pub async fn list_entitlements(
            &mut self,
            request: impl tonic::IntoRequest<super::ListEntitlementsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListEntitlementsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/ListEntitlements",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "ListEntitlements",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// `SearchEntitlements` returns entitlements on which the caller has the
        /// specified access.
        pub async fn search_entitlements(
            &mut self,
            request: impl tonic::IntoRequest<super::SearchEntitlementsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::SearchEntitlementsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/SearchEntitlements",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "SearchEntitlements",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Gets details of a single entitlement.
        pub async fn get_entitlement(
            &mut self,
            request: impl tonic::IntoRequest<super::GetEntitlementRequest>,
        ) -> std::result::Result<tonic::Response<super::Entitlement>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/GetEntitlement",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "GetEntitlement",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Creates a new entitlement in a given project/folder/organization and
        /// location.
        pub async fn create_entitlement(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateEntitlementRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/CreateEntitlement",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "CreateEntitlement",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Deletes a single entitlement. This method can only be called when there
        /// are no in-progress (ACTIVE/ACTIVATING/REVOKING) grants under the
        /// entitlement.
        pub async fn delete_entitlement(
            &mut self,
            request: impl tonic::IntoRequest<super::DeleteEntitlementRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/DeleteEntitlement",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "DeleteEntitlement",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Updates the entitlement specified in the request. Updated fields in the
        /// entitlement need to be specified in an update mask. The changes made to an
        /// entitlement are applicable only on future grants of the entitlement.
        /// However, if new approvers are added or existing approvers are removed from
        /// the approval workflow, the changes are effective on existing grants.
        ///
        /// The following fields are not supported for updates:
        ///
        ///  * All immutable fields
        ///  * Entitlement name
        ///  * Resource name
        ///  * Resource type
        ///  * Adding an approval workflow in an entitlement which previously had no
        ///    approval workflow.
        ///  * Deleting the approval workflow from an entitlement.
        ///  * Adding or deleting a step in the approval workflow (only one step is
        ///    supported)
        ///
        /// Note that updates are allowed on the list of approvers in an approval
        /// workflow step.
        pub async fn update_entitlement(
            &mut self,
            request: impl tonic::IntoRequest<super::UpdateEntitlementRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/UpdateEntitlement",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "UpdateEntitlement",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Lists grants for a given entitlement.
        pub async fn list_grants(
            &mut self,
            request: impl tonic::IntoRequest<super::ListGrantsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::ListGrantsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/ListGrants",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "ListGrants",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// `SearchGrants` returns grants that are related to the calling user in the
        /// specified way.
        pub async fn search_grants(
            &mut self,
            request: impl tonic::IntoRequest<super::SearchGrantsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::SearchGrantsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/SearchGrants",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "SearchGrants",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Get details of a single grant.
        pub async fn get_grant(
            &mut self,
            request: impl tonic::IntoRequest<super::GetGrantRequest>,
        ) -> std::result::Result<tonic::Response<super::Grant>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/GetGrant",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "GetGrant",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Creates a new grant in a given project and location.
        pub async fn create_grant(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateGrantRequest>,
        ) -> std::result::Result<tonic::Response<super::Grant>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/CreateGrant",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "CreateGrant",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// `ApproveGrant` is used to approve a grant. This method can only be called
        /// on a grant when it's in the `APPROVAL_AWAITED` state. This operation can't
        /// be undone.
        pub async fn approve_grant(
            &mut self,
            request: impl tonic::IntoRequest<super::ApproveGrantRequest>,
        ) -> std::result::Result<tonic::Response<super::Grant>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/ApproveGrant",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "ApproveGrant",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// `DenyGrant` is used to deny a grant. This method can only be called on a
        /// grant when it's in the `APPROVAL_AWAITED` state. This operation can't be
        /// undone.
        pub async fn deny_grant(
            &mut self,
            request: impl tonic::IntoRequest<super::DenyGrantRequest>,
        ) -> std::result::Result<tonic::Response<super::Grant>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/DenyGrant",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "DenyGrant",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// `RevokeGrant` is used to immediately revoke access for a grant. This method
        /// can be called when the grant is in a non-terminal state.
        pub async fn revoke_grant(
            &mut self,
            request: impl tonic::IntoRequest<super::RevokeGrantRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::new(
                        tonic::Code::Unknown,
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic::codec::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager/RevokeGrant",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManager",
                        "RevokeGrant",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}