// File generated from our OpenAPI spec by Stainless.

import * as Core from 'cloudflare/core';
import { APIResource } from 'cloudflare/resource';
import * as DNSSECsAPI from 'cloudflare/resources/dnssecs';

export class DNSSECs extends APIResource {
  /**
   * Enable or disable DNSSEC.
   */
  update(
    zoneId: string,
    body: DNSSECUpdateParams,
    options?: Core.RequestOptions,
  ): Core.APIPromise<DNSSECUpdateResponse> {
    return (
      this._client.patch(`/zones/${zoneId}/dnssec`, { body, ...options }) as Core.APIPromise<{
        result: DNSSECUpdateResponse;
      }>
    )._thenUnwrap((obj) => obj.result);
  }

  /**
   * Details about DNSSEC status and configuration.
   */
  get(zoneId: string, options?: Core.RequestOptions): Core.APIPromise<DNSSECGetResponse> {
    return (
      this._client.get(`/zones/${zoneId}/dnssec`, options) as Core.APIPromise<{ result: DNSSECGetResponse }>
    )._thenUnwrap((obj) => obj.result);
  }
}

export interface DNSSECUpdateResponse {
  /**
   * Algorithm key code.
   */
  algorithm?: string | null;

  /**
   * Digest hash.
   */
  digest?: string | null;

  /**
   * Type of digest algorithm.
   */
  digest_algorithm?: string | null;

  /**
   * Coded type for digest algorithm.
   */
  digest_type?: string | null;

  /**
   * If true, multi-signer DNSSEC is enabled on the zone, allowing multiple providers
   * to serve a DNSSEC-signed zone at the same time. This is required for DNSKEY
   * records (except those automatically generated by Cloudflare) to be added to the
   * zone.
   *
   * See
   * [Multi-signer DNSSEC](https://developers.cloudflare.com/dns/dnssec/multi-signer-dnssec/)
   * for details.
   */
  dnssec_multi_signer?: boolean;

  /**
   * If true, allows Cloudflare to transfer in a DNSSEC-signed zone including
   * signatures from an external provider, without requiring Cloudflare to sign any
   * records on the fly.
   *
   * Note that this feature has some limitations. See
   * [Cloudflare as Secondary](https://developers.cloudflare.com/dns/zone-setups/zone-transfers/cloudflare-as-secondary/setup/#dnssec)
   * for details.
   */
  dnssec_presigned?: boolean;

  /**
   * Full DS record.
   */
  ds?: string | null;

  /**
   * Flag for DNSSEC record.
   */
  flags?: number | null;

  /**
   * Code for key tag.
   */
  key_tag?: number | null;

  /**
   * Algorithm key type.
   */
  key_type?: string | null;

  /**
   * When DNSSEC was last modified.
   */
  modified_on?: string | null;

  /**
   * Public key for DS record.
   */
  public_key?: string | null;

  /**
   * Status of DNSSEC, based on user-desired state and presence of necessary records.
   */
  status?: 'active' | 'pending' | 'disabled' | 'pending-disabled' | 'error';
}

export interface DNSSECGetResponse {
  /**
   * Algorithm key code.
   */
  algorithm?: string | null;

  /**
   * Digest hash.
   */
  digest?: string | null;

  /**
   * Type of digest algorithm.
   */
  digest_algorithm?: string | null;

  /**
   * Coded type for digest algorithm.
   */
  digest_type?: string | null;

  /**
   * If true, multi-signer DNSSEC is enabled on the zone, allowing multiple providers
   * to serve a DNSSEC-signed zone at the same time. This is required for DNSKEY
   * records (except those automatically generated by Cloudflare) to be added to the
   * zone.
   *
   * See
   * [Multi-signer DNSSEC](https://developers.cloudflare.com/dns/dnssec/multi-signer-dnssec/)
   * for details.
   */
  dnssec_multi_signer?: boolean;

  /**
   * If true, allows Cloudflare to transfer in a DNSSEC-signed zone including
   * signatures from an external provider, without requiring Cloudflare to sign any
   * records on the fly.
   *
   * Note that this feature has some limitations. See
   * [Cloudflare as Secondary](https://developers.cloudflare.com/dns/zone-setups/zone-transfers/cloudflare-as-secondary/setup/#dnssec)
   * for details.
   */
  dnssec_presigned?: boolean;

  /**
   * Full DS record.
   */
  ds?: string | null;

  /**
   * Flag for DNSSEC record.
   */
  flags?: number | null;

  /**
   * Code for key tag.
   */
  key_tag?: number | null;

  /**
   * Algorithm key type.
   */
  key_type?: string | null;

  /**
   * When DNSSEC was last modified.
   */
  modified_on?: string | null;

  /**
   * Public key for DS record.
   */
  public_key?: string | null;

  /**
   * Status of DNSSEC, based on user-desired state and presence of necessary records.
   */
  status?: 'active' | 'pending' | 'disabled' | 'pending-disabled' | 'error';
}

export interface DNSSECUpdateParams {
  /**
   * If true, multi-signer DNSSEC is enabled on the zone, allowing multiple providers
   * to serve a DNSSEC-signed zone at the same time. This is required for DNSKEY
   * records (except those automatically generated by Cloudflare) to be added to the
   * zone.
   *
   * See
   * [Multi-signer DNSSEC](https://developers.cloudflare.com/dns/dnssec/multi-signer-dnssec/)
   * for details.
   */
  dnssec_multi_signer?: boolean;

  /**
   * If true, allows Cloudflare to transfer in a DNSSEC-signed zone including
   * signatures from an external provider, without requiring Cloudflare to sign any
   * records on the fly.
   *
   * Note that this feature has some limitations. See
   * [Cloudflare as Secondary](https://developers.cloudflare.com/dns/zone-setups/zone-transfers/cloudflare-as-secondary/setup/#dnssec)
   * for details.
   */
  dnssec_presigned?: boolean;

  /**
   * Status of DNSSEC, based on user-desired state and presence of necessary records.
   */
  status?: 'active' | 'disabled';
}

export namespace DNSSECs {
  export import DNSSECUpdateResponse = DNSSECsAPI.DNSSECUpdateResponse;
  export import DNSSECGetResponse = DNSSECsAPI.DNSSECGetResponse;
  export import DNSSECUpdateParams = DNSSECsAPI.DNSSECUpdateParams;
}
