catalystwan 0.41.2.dev9__py3-none-any.whl → 0.41.3__py3-none-any.whl

catalystwan/models/policy/policy_definition.py

@@ -1,47 +1,18 @@
 # Copyright 2023 Cisco Systems, Inc. and its affiliates
 
 import datetime
-from dataclasses import dataclass, field
 from functools import wraps
-from ipaddress import IPv4Address, IPv4Interface, IPv4Network, IPv6Address, IPv6Interface, IPv6Network
-from typing import Any, Dict, List, MutableSequence, Optional, Sequence, Set, Tuple, Union, overload
+from ipaddress import IPv4Address, IPv4Network, IPv6Network
+from typing import Any, Dict, List, MutableSequence, Optional, Protocol, Sequence, Set, Tuple, Union
 from uuid import UUID
 
-from pydantic import BaseModel, ConfigDict, Field, PlainSerializer, RootModel, field_validator, model_validator
+from pydantic import BaseModel, ConfigDict, Field, RootModel, model_validator
 from typing_extensions import Annotated, Literal
 
-from catalystwan.models.common import (
-    AcceptDropActionType,
-    AcceptRejectActionType,
-    CarrierType,
-    ControlPathType,
-    DestinationRegion,
-    DNSEntryType,
-    DNSTypeEntryType,
-    EncapType,
-    IcmpMsgType,
-    IntStr,
-    LossProtectionType,
-    MultiRegionRole,
-    OriginProtocol,
-    SequenceIpType,
-    ServiceChainNumber,
-    ServiceType,
-    SpaceSeparatedInterfaceStr,
-    SpaceSeparatedIPv4,
-    SpaceSeparatedIPv6,
-    SpaceSeparatedNonNegativeIntList,
-    SpaceSeparatedServiceAreaList,
-    SpaceSeparatedTLOCColorStr,
-    SpaceSeparatedUUIDList,
-    TLOCActionType,
-    TLOCColor,
-    TrafficCategory,
-    TrafficTargetType,
-    check_fields_exclusive,
-    str_as_str_list,
-)
+from catalystwan.models.common import ServiceChainNumber, TLOCColor, check_fields_exclusive
 from catalystwan.models.misc.application_protocols import ApplicationProtocol
+from catalystwan.models.policy.lists_entries import EncapType
+from catalystwan.typed_list import DataSequence
 
 
 def port_set_and_ranges_to_str(ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> str:
@@ -61,6 +32,47 @@ PLPEntryType = Literal[
     "high",
 ]
 
+DNSEntryType = Literal[
+    "request",
+    "response",
+]
+
+TrafficTargetType = Literal[
+    "access",
+    "core",
+    "service",
+]
+
+DestinationRegion = Literal[
+    "primary-region",
+    "secondary-region",
+    "other-region",
+]
+
+OriginProtocol = Literal[
+    "aggregate",
+    "bgp",
+    "bgp-external",
+    "bgp-internal",
+    "connected",
+    "eigrp",
+    "ospf",
+    "ospf-inter-area",
+    "ospf-intra-area",
+    "ospf-external1",
+    "ospf-external2",
+    "rip",
+    "static",
+    "eigrp-summary",
+    "eigrp-internal",
+    "eigrp-external",
+    "lisp",
+    "nat-dia",
+    "natpool",
+    "isis",
+    "isis-level1",
+    "isis-level2",
+]
 
 PathType = Literal[
     "hierarchical-path",
@@ -68,6 +80,19 @@ PathType = Literal[
     "transport-gateway-path",
 ]
 
+SequenceIpType = Literal[
+    "ipv4",
+    "ipv6",
+    "all",
+]
+
+PolicyActionType = Literal[
+    "drop",
+    "accept",
+    "pass",
+    "inspect",
+    "reject",
+]
 
 SequenceType = Literal[
     "applicationFirewall",
@@ -82,10 +107,6 @@ SequenceType = Literal[
     "aclv6",
     "deviceaccesspolicy",
     "deviceaccesspolicyv6",
-    "sslDecryption",
-    "vedgeRoute",
-    "vedgeroute",
-    "appRoute",
 ]
 
 
@@ -94,141 +115,65 @@ Optimized = Literal[
     "false",
 ]
 
-AdvancedCommunityMatchFlag = Literal["or", "and", "exact"]
-
-MetricType = Literal["type1", "type2"]
+DNSTypeEntryType = Literal[
+    "host",
+    "umbrella",
+]
 
-SlaNotMetAction = Literal["strict", "fallbackToBestPath"]
+LossProtectionType = Literal[
+    "fecAdaptive",
+    "fecAlways",
+    "packetDuplication",
+]
 
-VoicePortType = Literal[
-    "potsDialPeer",
-    "sipDialPeer",
-    "srstPhone",
-    "voicePort",
+MultiRegionRole = Literal[
+    "border-router",
+    "edge-router",
 ]
 
+ServiceType = Literal[
+    "FW",
+    "IDP",
+    "IDS",
+    "netsvc1",
+    "netsvc2",
+    "netsvc3",
+    "netsvc4",
+]
 
-class Reference(BaseModel):
-    ref: UUID
+TLOCActionType = Literal[
+    "strict",
+    "primary",
+    "backup",
+    "ecmp",
+]
 
+Carrier = Literal[
+    "default",
+    "carrier1",
+    "carrier2",
+    "carrier3",
+    "carrier4",
+    "carrier5",
+    "carrier6",
+    "carrier7",
+    "carrier8",
+]
 
-class ReferenceWithId(BaseModel):
-    field: Literal["id"] = "id"
-    ref: UUID
+DeviceAccessProtocol = Literal[22, 161]
 
 
-class ReferenceList(BaseModel):
-    ref: SpaceSeparatedUUIDList
+class Reference(BaseModel):
+    ref: UUID
 
 
 class VariableName(BaseModel):
     vip_variable_name: str = Field(serialization_alias="vipVariableName", validation_alias="vipVariableName")
 
 
-class CommonStation(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    name: str
-    number: str
-
-
-class MediaProfileRef(BaseModel):
-    name: int
-    ref: UUID
-
-
-class LineParams(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    gain: IntStr
-    attenuation: IntStr
-    echo_cancellor: bool = Field(validation_alias="echoCancellor", serialization_alias="echoCancellor")
-    vad: bool
-    compand_type: str = Field(serialization_alias="compandType", validation_alias="compandType")
-    cptone: str
-    impedance: Optional[str] = Field(default=None)
-
-
-class DidTimers(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    answer_winkwidth: IntStr = Field(
-        ge=110, le=290, serialization_alias="answerWinkwidth", validation_alias="answerWinkwidth"
-    )
-    clear_wait: IntStr = Field(ge=200, le=2000, serialization_alias="clearWait", validation_alias="clearWait")
-    wait_wink: IntStr = Field(ge=100, le=6500, serialization_alias="waitWink", validation_alias="waitWink")
-    wink_duration: IntStr = Field(ge=50, le=3000, serialization_alias="winkDuration", validation_alias="winkDuration")
-    dial_pulse_min_delay: IntStr = Field(
-        ge=0, le=5000, serialization_alias="dialPulseMinDelay", validation_alias="dialPulseMinDelay"
-    )
-
-
-class FxoTuningParams(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    pre_dial_delay: int = Field(ge=0, serialization_alias="preDialDelay", validation_alias="preDialDelay")
-    timing_sup_disc: IntStr = Field(serialization_alias="timingSupDisc", validation_alias="timingSupDisc")
-    supervisory_disconnect: str = Field(
-        serialization_alias="supervisoryDisconnect", validation_alias="supervisoryDisconnect"
-    )
-    dial_type: str = Field(serialization_alias="dialType", validation_alias="dialType")
-    timing_hookflash_out: IntStr = Field(
-        serialization_alias="timingHookflashOut", validation_alias="timingHookflashOut"
-    )
-    timing_guard_out: IntStr = Field(serialization_alias="timingGuardOut", validation_alias="timingGuardOut")
-    battery_reversal_det_delay: Optional[IntStr] = Field(
-        default=None, serialization_alias="batteryReversalDetDelay", validation_alias="batteryReversalDetDelay"
-    )
-
-
-class FxsTuningParams(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    timing_hookflash_in_min: IntStr = Field(
-        ge=0, le=400, serialization_alias="timingHookflashInMin", validation_alias="timingHookflashInMin"
-    )
-    timing_hookflash_in_max: IntStr = Field(
-        ge=50, le=1500, serialization_alias="timingHookflashInMax", validation_alias="timingHookflashInMax"
-    )
-    loop_length: str = Field(serialization_alias="loopLength", validation_alias="loopLength")
-    ring_frequency: IntStr = Field(serialization_alias="ringFrequency", validation_alias="ringFrequency")
-    ring_dc_offset: Optional[str] = Field(
-        default=None, serialization_alias="ringDcOffset", validation_alias="ringDcOffset"
-    )
-    pulse_digit_detection: bool = Field(
-        serialization_alias="pulseDigitDetection", validation_alias="pulseDigitDetection"
-    )
-    ren: IntStr = Field(ge=1, le=5)
-
-
-class TrunkGroupPreference(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    ref: UUID
-    preference: int
-
-
-class TranslationRuleEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    ref: UUID
-    name: str
-
-
-class TranslationProfileEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    ref: UUID
-    name: str
-    calling_translation_rule: Optional[TranslationRuleEntry] = Field(
-        default=None, serialization_alias="callingTranslationRule", validation_alias="callingTranslationRule"
-    )
-    called_translation_rule: Optional[TranslationRuleEntry] = Field(
-        default=None, serialization_alias="calledTranslationRule", validation_alias="calledTranslationRule"
-    )
-
-
-class SupervisoryDisconnectEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    ref: UUID
-    name: str
-
-
 class LocalTLOCListEntryValue(BaseModel):
-    color: SpaceSeparatedTLOCColorStr
-    encap: Optional[EncapType] = None
+    color: TLOCColor
+    encap: EncapType
     restrict: Optional[str] = None
 
 
@@ -281,36 +226,25 @@ class ProtocolEntry(BaseModel):
 
 class DSCPEntry(BaseModel):
     field: Literal["dscp"] = "dscp"
-    value: SpaceSeparatedNonNegativeIntList = Field(description="0-63 single numbers separate by space")
+    value: str = Field(description="0-63 single numbers separate by space")
 
 
 class SourceIPEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-
     field: Literal["sourceIp"] = "sourceIp"
-    value: Optional[SpaceSeparatedIPv4] = Field(default=None, description="IP network specifiers separate by space")
-    vip_variable_name: Optional[str] = Field(
-        default=None, serialization_alias="vipVariableName", validation_alias="vipVariableName"
-    )
+    value: str = Field(description="IP network specifiers separate by space")
 
     @staticmethod
     def from_ipv4_networks(networks: List[IPv4Network]) -> "SourceIPEntry":
-        return SourceIPEntry(value=[IPv4Interface(ip) for ip in networks])
-
-    def as_ipv4_networks(self) -> List[IPv4Network]:
-        return [] if not self.value else [IPv4Network(val) for val in self.value]
+        return SourceIPEntry(value=networks_to_str(networks))
 
 
 class SourceIPv6Entry(BaseModel):
     field: Literal["sourceIpv6"] = "sourceIpv6"
-    value: SpaceSeparatedIPv6
+    value: str = Field(description="IPv6 network specifiers separate by space")
 
     @staticmethod
     def from_ipv6_networks(networks: List[IPv6Network]) -> "SourceIPv6Entry":
-        return SourceIPv6Entry(value=[IPv6Interface(ip) for ip in networks])
-
-    def as_ipv6_networks(self) -> List[IPv6Network]:
-        return [] if not self.value else [IPv6Network(val) for val in self.value]
+        return SourceIPv6Entry(value=networks_to_str(networks))
 
 
 class IPAddressEntry(BaseModel):
@@ -328,32 +262,21 @@ class SourcePortEntry(BaseModel):
 
 
 class DestinationIPEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-
     field: Literal["destinationIp"] = "destinationIp"
-    value: Optional[SpaceSeparatedIPv4] = Field(default=None)
-    vip_variable_name: Optional[str] = Field(
-        default=None, serialization_alias="vipVariableName", validation_alias="vipVariableName"
-    )
+    value: str
 
     @staticmethod
     def from_ipv4_networks(networks: List[IPv4Network]) -> "DestinationIPEntry":
-        return DestinationIPEntry(value=[IPv4Interface(ip) for ip in networks])
-
-    def as_ipv4_networks(self) -> List[IPv4Network]:
-        return [] if not self.value else [IPv4Network(val) for val in self.value]
+        return DestinationIPEntry(value=networks_to_str(networks))
 
 
 class DestinationIPv6Entry(BaseModel):
     field: Literal["destinationIpv6"] = "destinationIpv6"
-    value: SpaceSeparatedIPv6
+    value: str
 
     @staticmethod
     def from_ipv6_networks(networks: List[IPv6Network]) -> "DestinationIPv6Entry":
-        return DestinationIPv6Entry(value=[IPv6Interface(ip) for ip in networks])
-
-    def as_ipv6_networks(self) -> List[IPv6Network]:
-        return [] if not self.value else [IPv6Network(val) for val in self.value]
+        return DestinationIPv6Entry(value=networks_to_str(networks))
 
 
 class DestinationPortEntry(BaseModel):
@@ -395,26 +318,6 @@ class DestinationRegionEntry(BaseModel):
     value: DestinationRegion
 
 
-class AddressEntry(BaseModel):
-    field: Literal["address"] = "address"
-    ref: UUID
-
-
-class AsPathListMatchEntry(BaseModel):
-    field: Literal["asPath"] = "asPath"
-    ref: UUID
-
-
-class AsPathActionEntryValue(BaseModel):
-    prepend: Optional[SpaceSeparatedNonNegativeIntList] = None
-    exclude: Optional[SpaceSeparatedNonNegativeIntList] = None
-
-
-class AsPathActionEntry(BaseModel):
-    field: Literal["asPath"] = "asPath"
-    value: AsPathActionEntryValue
-
-
 class SourceFQDNEntry(BaseModel):
     field: Literal["sourceFqdn"] = "sourceFqdn"
     value: str = Field(max_length=120)
@@ -461,55 +364,22 @@ class UseVPNEntry(BaseModel):
 
 class FallBackEntry(BaseModel):
     field: Literal["fallback"] = "fallback"
-    value: Literal["", "true"]
-
-    @property
-    def as_bool(self) -> bool:
-        return True if self.value == "true" else False
-
-
-class DiaPoolEntry(BaseModel):
-    field: Literal["diaPool"] = "diaPool"
-    value: SpaceSeparatedNonNegativeIntList
-
-
-class DiaInterfaceEntry(BaseModel):
-    field: Literal["diaInterface"] = "diaInterface"
-    value: SpaceSeparatedInterfaceStr
-
-
-class BypassEntry(BaseModel):
-    field: Literal["bypass"] = "bypass"
-    value: Literal["", "true"]
+    value: str = ""
 
-    @property
-    def as_bool(self) -> bool:
-        return True if self.value == "true" else False
 
-
-class NextHopActionEntry(BaseModel):
-    field: Literal["nextHop"] = "nextHop"
-    value: Union[IPv4Address, IPv6Address]
-
-
-class NextHopIpv6ActionEntry(BaseModel):
-    field: Literal["nextHopIpv6"] = "nextHopIpv6"
-    value: IPv6Address
-
-
-class NextHopMatchEntry(BaseModel):
+class NextHopEntry(BaseModel):
     field: Literal["nextHop"] = "nextHop"
-    ref: UUID
+    value: IPv4Address
 
 
 class NextHopLooseEntry(BaseModel):
     field: Literal["nextHopLoose"] = "nextHopLoose"
-    value: Annotated[bool, PlainSerializer(lambda x: str(x).lower(), return_type=str, when_used="json-unless-none")]
+    value: str
 
 
 class OMPTagEntry(BaseModel):
     field: Literal["ompTag"] = "ompTag"
-    value: IntStr = Field(description="Number in range 0-4294967295", ge=0, le=4294967295)
+    value: str = Field(description="Number in range 0-4294967295")
 
 
 class OriginEntry(BaseModel):
@@ -529,7 +399,7 @@ class PreferenceEntry(BaseModel):
 
 class PathTypeEntry(BaseModel):
     field: Literal["pathType"] = "pathType"
-    value: ControlPathType
+    value: PathType
 
 
 class RegionEntry(BaseModel):
@@ -573,17 +443,8 @@ class TLOCEntry(BaseModel):
 
 
 class CommunityEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
     field: Literal["community"] = "community"
-    value: Optional[str] = Field(
-        default=None, description="Example: 1000:10000 or internet or local-AS or no advertise or no-export"
-    )
-    vip_variable_name: Optional[str] = Field(
-        default=None,
-        serialization_alias="vipVariableName",
-        validation_alias="vipVariableName",
-        description="Example: 1000:10000 or internet or local-AS or no advertise or no-export",
-    )
+    value: str = Field(description="Example: 1000:10000 or internet or local-AS or no advertise or no-export")
 
 
 class CommunityAdditiveEntry(BaseModel):
@@ -593,7 +454,7 @@ class CommunityAdditiveEntry(BaseModel):
 
 class CarrierEntry(BaseModel):
     field: Literal["carrier"] = "carrier"
-    value: CarrierType
+    value: Carrier
 
 
 class DomainIDEntry(BaseModel):
@@ -611,175 +472,39 @@ class NextHeaderEntry(BaseModel):
     value: str = Field(description="0-63 single numbers separate by space")
 
 
-class AggregatorActionEntryValue(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-    aggregator: IntStr = Field(description="Number in range 1-4294967295", ge=0, le=4294967295)
-    ip_address: Union[IPv4Address, IPv6Address] = Field(serialization_alias="ipAddress", validation_alias="ipAddress")
-
-
-class AggregatorActionEntry(BaseModel):
-    field: Literal["aggregator"] = "aggregator"
-    value: AggregatorActionEntryValue
-
-
 class TrafficClassEntry(BaseModel):
     field: Literal["trafficClass"] = "trafficClass"
     value: str = Field(description="Number in range 0-63")
 
 
-class LocalPreferenceEntry(BaseModel):
-    field: Literal["localPreference"] = "localPreference"
-    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
-
-
-class MetricEntry(BaseModel):
-    field: Literal["metric"] = "metric"
-    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
-
-
-class MetricTypeEntry(BaseModel):
-    field: Literal["metricType"] = "metricType"
-    value: MetricType
-
-
-class OspfTagEntry(BaseModel):
-    field: Literal["ospfTag"] = "ospfTag"
-    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
-
-
-class PeerEntry(BaseModel):
-    field: Literal["peer"] = "peer"
-    value: Union[IPv4Address, IPv6Address]
-
-
-class AtomicAggregateActionEntry(BaseModel):
-    field: Literal["atomicAggregate"] = "atomicAggregate"
-    value: Literal["true"] = "true"
-
-
-class WeightEntry(BaseModel):
-    field: Literal["weight"] = "weight"
-    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
-
-
-class AdvancedCommunityEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-
-    field: Literal["advancedCommunity"] = "advancedCommunity"
-
-    match_flag: AdvancedCommunityMatchFlag = Field(
-        default="or",
-        serialization_alias="matchFlag",
-        validation_alias="matchFlag",
-        description="The 'and' and 'exact' conditions are applicable to only one community list",
-    )
-
-    refs: List[UUID] = []
-
-
-class ExpandedCommunityInLineEntry(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
-
-    field: Literal["expandedCommunityInline"] = "expandedCommunityInline"
-    vip_variable_name: str = Field(serialization_alias="vipVariableName", validation_alias="vipVariableName")
-
-
-class ExtendedCommunityEntry(BaseModel):
-    field: Literal["extCommunity"] = "extCommunity"
-    ref: UUID
-
-
-NATVPNEntries = Annotated[
-    Union[
-        BypassEntry,
-        DiaPoolEntry,
-        DiaInterfaceEntry,
-        FallBackEntry,
-        UseVPNEntry,
-    ],
-    Field(discriminator="field"),
-]
-
-
-@dataclass
-class NATVPNParams:
-    bypass: bool = False
-    dia_pool: List[int] = field(default_factory=list)
-    dia_interface: List[str] = field(default_factory=list)
-    fallback: bool = False
-    vpn: Optional[int] = None
-
-    def as_entry_list(self) -> List[NATVPNEntries]:
-        entries: List[NATVPNEntries] = []
-        if self.bypass:
-            entries.append(BypassEntry(value="true"))
-        if self.dia_pool:
-            entries.append(DiaPoolEntry(value=self.dia_pool))
-        if self.dia_interface:
-            entries.append(DiaInterfaceEntry(value=self.dia_interface))
-        if self.fallback:
-            entries.append(FallBackEntry(value="true"))
-        if self.vpn is not None:
-            entries.append(UseVPNEntry(value=str(self.vpn)))
-        return entries
-
-
 class NATVPNEntry(RootModel):
-    root: List[NATVPNEntries]
+    root: List[Union[UseVPNEntry, FallBackEntry]]
 
     @staticmethod
-    def from_params(params: NATVPNParams) -> "NATVPNEntry":
-        return NATVPNEntry(root=params.as_entry_list())
-
-    def get_params(self) -> NATVPNParams:
-        params = NATVPNParams()
-        for param in self.root:
-            if param.field == "bypass":
-                params.bypass = param.as_bool
-            elif param.field == "diaInterface":
-                params.dia_interface = param.value
-            elif param.field == "diaPool":
-                params.dia_pool = param.value
-            elif param.field == "fallback":
-                params.fallback = param.as_bool
-            elif param.field == "useVpn":
-                params.vpn = int(param.value)
-        return params
-
-
-class ICMPMessageEntry(BaseModel):
-    field: Literal["icmpMessage"] = "icmpMessage"
-    value: List[IcmpMsgType]
-
-    _value = field_validator("value", mode="before")(str_as_str_list)
+    def from_nat_vpn(fallback: bool, vpn: int = 0) -> "NATVPNEntry":
+        if fallback:
+            return NATVPNEntry(root=[UseVPNEntry(value=str(vpn)), FallBackEntry()])
+        return NATVPNEntry(root=[UseVPNEntry(value=str(vpn))])
 
 
 class SourceDataPrefixListEntry(BaseModel):
     field: Literal["sourceDataPrefixList"] = "sourceDataPrefixList"
-    ref: SpaceSeparatedUUIDList = Field(
-        description="usually single id but zone based firewall can use multiple ids separated by space"
-    )
+    ref: UUID
 
 
 class SourceDataIPv6PrefixListEntry(BaseModel):
     field: Literal["sourceDataIpv6PrefixList"] = "sourceDataIpv6PrefixList"
-    ref: SpaceSeparatedUUIDList = Field(
-        description="usually single id but zone based firewall can use multiple ids separated by space"
-    )
+    ref: UUID
 
 
 class DestinationDataPrefixListEntry(BaseModel):
     field: Literal["destinationDataPrefixList"] = "destinationDataPrefixList"
-    ref: SpaceSeparatedUUIDList = Field(
-        description="usually single id but zone based firewall can use multiple ids separated by space"
-    )
+    ref: UUID
 
 
 class DestinationDataIPv6PrefixListEntry(BaseModel):
     field: Literal["destinationDataIpv6PrefixList"] = "destinationDataIpv6PrefixList"
-    ref: SpaceSeparatedUUIDList = Field(
-        description="usually single id but zone based firewall can use multiple ids separated by space"
-    )
+    ref: UUID
 
 
 class DNSAppListEntry(BaseModel):
@@ -789,19 +514,9 @@ class DNSAppListEntry(BaseModel):
 
 class AppListEntry(BaseModel):
     field: Literal["appList"] = "appList"
-    ref: SpaceSeparatedUUIDList
-
-
-class SaaSAppListEntry(BaseModel):
-    field: Literal["saasAppList"] = "saasAppList"
     ref: UUID
 
 
-class AppListFlatEntry(BaseModel):
-    field: Literal["appListFlat"] = "appListFlat"
-    ref: SpaceSeparatedUUIDList
-
-
 class SourceFQDNListEntry(BaseModel):
     field: Literal["sourceFqdnList"] = "sourceFqdnList"
     ref: UUID
@@ -809,59 +524,41 @@ class SourceFQDNListEntry(BaseModel):
 
 class DestinationFQDNListEntry(BaseModel):
     field: Literal["destinationFqdnList"] = "destinationFqdnList"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class SourceGeoLocationListEntry(BaseModel):
     field: Literal["sourceGeoLocationList"] = "sourceGeoLocationList"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class DestinationGeoLocationListEntry(BaseModel):
     field: Literal["destinationGeoLocationList"] = "destinationGeoLocationList"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class ProtocolNameListEntry(BaseModel):
     field: Literal["protocolNameList"] = "protocolNameList"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class SourcePortListEntry(BaseModel):
     field: Literal["sourcePortList"] = "sourcePortList"
-    ref: SpaceSeparatedUUIDList
-
-
-class SourceScalableGroupTagListEntry(BaseModel):
-    field: Literal["sourceScalableGroupTagList"] = "sourceScalableGroupTagList"
-    ref: SpaceSeparatedUUIDList
-
-
-class SourceSecurityGroupEntry(BaseModel):
-    field: Literal["sourceSecurityGroup"] = "sourceSecurityGroup"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class DestinationPortListEntry(BaseModel):
     field: Literal["destinationPortList"] = "destinationPortList"
-    ref: SpaceSeparatedUUIDList = Field(
-        description="usually single id but zone based firewall can use multiple ids separated by space"
-    )
-
-
-class DestinationScalableGroupTagListEntry(BaseModel):
-    field: Literal["destinationScalableGroupTagList"] = "destinationScalableGroupTagList"
-    ref: SpaceSeparatedUUIDList
-
-
-class DestinationSecurityGroupEntry(BaseModel):
-    field: Literal["destinationSecurityGroup"] = "destinationSecurityGroup"
-    ref: SpaceSeparatedUUIDList
+    ref: UUID
 
 
 class RuleSetListEntry(BaseModel):
     field: Literal["ruleSetList"] = "ruleSetList"
-    ref: SpaceSeparatedUUIDList
+    ref: str
+
+    @staticmethod
+    def from_rule_set_ids(rule_set_ids: Set[UUID]) -> "RuleSetListEntry":
+        return RuleSetListEntry(ref=" ".join(str(rule_set_ids)))
 
 
 class PolicerListEntry(BaseModel):
@@ -874,16 +571,6 @@ class TLOCListEntry(BaseModel):
     ref: UUID
 
 
-class SourceVpnEntry(BaseModel):
-    field: Literal["sourceVpn"] = "sourceVpn"
-    value: str = Field(description="VPN ids numbers separated by space")
-
-
-class DestinationVpnEntry(BaseModel):
-    field: Literal["destinationVpn"] = "destinationVpn"
-    value: str = Field(description="VPN ids numbers separated by space")
-
-
 class PrefferedColorGroupListEntry(BaseModel):
     field: Literal["preferredColorGroup"] = "preferredColorGroup"
     ref: UUID
@@ -921,11 +608,6 @@ class PrefixListEntry(BaseModel):
     ref: UUID
 
 
-class Ipv6PrefixListEntry(BaseModel):
-    field: Literal["ipv6prefixList"] = "ipv6prefixList"
-    ref: UUID
-
-
 class RegionListEntry(BaseModel):
     field: Literal["regionList"] = "regionList"
     ref: UUID
@@ -939,17 +621,15 @@ class ClassMapListEntry(BaseModel):
 class ServiceEntryValue(BaseModel):
     model_config = ConfigDict(populate_by_name=True)
     type: ServiceType
-    vpn: Optional[IntStr] = None
+    vpn: str
     tloc: Optional[TLOCEntryValue] = None
     tloc_list: Optional[TLOCListEntry] = Field(
         default=None, validation_alias="tlocList", serialization_alias="tlocList"
     )
-    restrict: Optional[str] = None
-    local: Optional[str] = None
 
     @model_validator(mode="after")
     def tloc_xor_tloc_list(self):
-        check_fields_exclusive(self.__dict__, {"tloc", "tloc_list"}, False)
+        check_fields_exclusive(self.__dict__, {"tloc", "tloc_list"}, True)
         return self
 
 
@@ -971,16 +651,6 @@ class AffinityEntry(BaseModel):
 RedirectDNSActionEntry = Union[IPAddressEntry, DNSTypeEntry]
 
 
-class ServiceAreaEntry(BaseModel):
-    field: Literal["serviceArea"] = "serviceArea"
-    value: SpaceSeparatedServiceAreaList
-
-
-class TrafficCategoryEntry(BaseModel):
-    field: Literal["trafficCategory"] = "trafficCategory"
-    value: TrafficCategory
-
-
 class LogAction(BaseModel):
     type: Literal["log"] = "log"
     parameter: str = ""
@@ -1000,34 +670,8 @@ class NATAction(BaseModel):
         return NATAction(parameter=NATPoolEntry(value=str(nat_pool)))
 
     @staticmethod
-    def from_nat_vpn(
-        use_vpn: int = 0,
-        *,
-        fallback: bool = False,
-        bypass: bool = False,
-        dia_pool: List[int] = [],
-        dia_interface: List[str] = [],
-    ) -> "NATAction":
-        params = NATVPNParams(
-            bypass=bypass,
-            dia_pool=dia_pool,
-            dia_interface=dia_interface,
-            fallback=fallback,
-            vpn=use_vpn,
-        )
-        return NATAction(parameter=NATVPNEntry.from_params(params))
-
-    @property
-    def nat_pool(self) -> Optional[int]:
-        if isinstance(self.parameter, NATPoolEntry):
-            return int(self.parameter.value)
-        return None
-
-    @property
-    def nat_vpn(self) -> Optional[NATVPNParams]:
-        if isinstance(self.parameter, NATVPNEntry):
-            return self.parameter.get_params()
-        return None
+    def from_nat_vpn(fallback: bool, vpn: int = 0) -> "NATAction":
+        return NATAction(parameter=NATVPNEntry.from_nat_vpn(fallback=fallback, vpn=vpn))
 
 
 class CFlowDAction(BaseModel):
@@ -1046,16 +690,6 @@ class RedirectDNSAction(BaseModel):
     def from_dns_type(dns_type: DNSTypeEntryType = "host") -> "RedirectDNSAction":
         return RedirectDNSAction(parameter=DNSTypeEntry(value=dns_type))
 
-    def get_ip(self) -> Optional[IPv4Address]:
-        if self.parameter.field == "ipAddress":
-            return self.parameter.value
-        return None
-
-    def get_dns_type(self) -> Optional[DNSTypeEntryType]:
-        if self.parameter.field == "dnsType":
-            return self.parameter.value
-        return None
-
 
 class TCPOptimizationAction(BaseModel):
     type: Literal["tcpOptimization"] = "tcpOptimization"
@@ -1118,121 +752,17 @@ class PolicerAction(BaseModel):
     parameter: Reference
 
 
-class ConnectionEventsAction(BaseModel):
-    type: Literal["connectionEvents"] = "connectionEvents"
-    parameter: str = ""
-
-
-class AdvancedInspectionProfileAction(BaseModel):
-    type: Literal["advancedInspectionProfile"] = "advancedInspectionProfile"
-    parameter: ReferenceWithId
-
-
-class BackupSlaPrefferedColorAction(BaseModel):
-    type: Literal["backupSlaPreferredColor"] = "backupSlaPreferredColor"
-    parameter: SpaceSeparatedTLOCColorStr
-
-
-class SlaName(BaseModel):
-    field: Literal["name"] = "name"
-    ref: UUID
-
-
-class SlaPreferredColor(BaseModel):
-    field: Literal["preferredColor"] = "preferredColor"
-    value: SpaceSeparatedTLOCColorStr
-
-
-class SlaPreferredRemoteColor(BaseModel):
-    field: Literal["preferredRemoteColor"] = "preferredRemoteColor"
-    value: TLOCColor
-    remote_color_restrict: Optional[bool] = Field(
-        default=None, serialization_alias="remoteColorRestrict", validation_alias="remoteColorRestrict"
-    )
-
-
-class SlaPreferredColorGroup(BaseModel):
-    field: Literal["preferredColorGroup"] = "preferredColorGroup"
-    ref: UUID
-
-
-class SlaNotMet(BaseModel):
-    field: SlaNotMetAction
-
-
-SlaClassActionParam = Annotated[
-    Union[
-        SlaName,
-        SlaPreferredColor,
-        SlaPreferredColorGroup,
-        SlaPreferredRemoteColor,
-        SlaNotMet,
-    ],
-    Field(discriminator="field"),
-]
-
-
-class SlaClassAction(BaseModel):
-    type: Literal["slaClass"] = "slaClass"
-    parameter: List[SlaClassActionParam] = Field(default_factory=list)
-
-    @overload
-    @staticmethod
-    def from_params(
-        sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color: List[TLOCColor]
-    ) -> "SlaClassAction": ...
-
-    @overload
-    @staticmethod
-    def from_params(
-        sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color_group: UUID
-    ) -> "SlaClassAction": ...
-
-    @staticmethod
-    def from_params(
-        sla_class: UUID,
-        not_met_action: Optional[SlaNotMetAction] = None,
-        *,
-        preferred_color: Optional[List[TLOCColor]] = None,
-        preferred_color_group: Optional[UUID] = None,
-    ) -> "SlaClassAction":
-        action = SlaClassAction()
-        action.parameter.append(SlaName(ref=sla_class))
-        if not_met_action:
-            action.parameter.append(SlaNotMet(field=not_met_action))
-        if preferred_color:
-            action.parameter.append(SlaPreferredColor(value=preferred_color))
-        if preferred_color_group:
-            action.parameter.append(SlaPreferredColorGroup(ref=preferred_color_group))
-        return action
-
-
-class CloudSaaSAction(BaseModel):
-    type: Literal["cloudSaas"] = "cloudSaas"
-    parameter: str = Field(default="")
-
-
 ActionSetEntry = Annotated[
     Union[
         AffinityEntry,
-        AggregatorActionEntry,
-        AsPathActionEntry,
-        AtomicAggregateActionEntry,
         CommunityAdditiveEntry,
         CommunityEntry,
         DSCPEntry,
         ForwardingClassEntry,
-        LocalPreferenceEntry,
         LocalTLOCListEntry,
-        MetricEntry,
-        MetricTypeEntry,
-        NextHopActionEntry,
-        NextHopIpv6ActionEntry,
+        NextHopEntry,
         NextHopLooseEntry,
         OMPTagEntry,
-        OriginatorEntry,
-        OriginEntry,
-        OspfTagEntry,
         PolicerListEntry,
         PreferenceEntry,
         PrefferedColorGroupListEntry,
@@ -1243,7 +773,6 @@ ActionSetEntry = Annotated[
         TLOCListEntry,
         TrafficClassEntry,
         VPNEntry,
-        WeightEntry,
     ],
     Field(discriminator="field"),
 ]
@@ -1251,21 +780,16 @@ ActionSetEntry = Annotated[
 
 class ActionSet(BaseModel):
     type: Literal["set"] = "set"
-    parameter: List[ActionSetEntry] = Field(default_factory=list)
+    parameter: List[ActionSetEntry] = []
 
 
 ActionEntry = Annotated[
     Union[
         ActionSet,
-        AdvancedInspectionProfileAction,
-        BackupSlaPrefferedColorAction,
         CFlowDAction,
         ClassMapAction,
-        CloudSaaSAction,
-        ConnectionEventsAction,
         CountAction,
         DREOptimizationAction,
-        ExportToAction,
         FallBackToRoutingAction,
         LogAction,
         LossProtectionAction,
@@ -1277,19 +801,15 @@ ActionEntry = Annotated[
         RedirectDNSAction,
         SecureInternetGatewayAction,
         ServiceNodeGroupAction,
-        SlaClassAction,
         TCPOptimizationAction,
+        ExportToAction,
     ],
     Field(discriminator="type"),
 ]
 
 MatchEntry = Annotated[
     Union[
-        AddressEntry,
-        AdvancedCommunityEntry,
         AppListEntry,
-        AppListFlatEntry,
-        AsPathListMatchEntry,
         CarrierEntry,
         ClassMapListEntry,
         ColorListEntry,
@@ -1305,31 +825,18 @@ MatchEntry = Annotated[
         DestinationPortEntry,
         DestinationPortListEntry,
         DestinationRegionEntry,
-        DestinationScalableGroupTagListEntry,
-        DestinationSecurityGroupEntry,
-        DestinationVpnEntry,
         DNSAppListEntry,
         DNSEntry,
         DomainIDEntry,
         DSCPEntry,
-        ExpandedCommunityInLineEntry,
-        ExpandedCommunityListEntry,
         ExpandedCommunityListEntry,
-        ExtendedCommunityEntry,
         GroupIDEntry,
-        ICMPMessageEntry,
-        Ipv6PrefixListEntry,
-        LocalPreferenceEntry,
-        MetricEntry,
         NextHeaderEntry,
-        NextHopMatchEntry,
         OMPTagEntry,
         OriginatorEntry,
         OriginEntry,
-        OspfTagEntry,
         PacketLengthEntry,
         PathTypeEntry,
-        PeerEntry,
         PLPEntry,
         PreferenceEntry,
         PrefixListEntry,
@@ -1340,8 +847,6 @@ MatchEntry = Annotated[
         RegionListEntry,
         RoleEntry,
         RuleSetListEntry,
-        SaaSAppListEntry,
-        ServiceAreaEntry,
         SiteEntry,
         SiteListEntry,
         SiteListEntry,
@@ -1355,16 +860,11 @@ MatchEntry = Annotated[
         SourceIPv6Entry,
         SourcePortEntry,
         SourcePortListEntry,
-        SourceScalableGroupTagListEntry,
-        SourceSecurityGroupEntry,
-        SourceVpnEntry,
         TCPEntry,
         TLOCEntry,
         TLOCListEntry,
-        TrafficCategoryEntry,
         TrafficClassEntry,
         TrafficToEntry,
-        VPNEntry,
         VPNListEntry,
     ],
     Field(discriminator="field"),
@@ -1388,8 +888,8 @@ MUTUALLY_EXCLUSIVE_FIELDS = [
 def _generate_field_name_check_lookup(spec: Sequence[Set[str]]) -> Dict[str, List[str]]:
     lookup: Dict[str, List[str]] = {}
     for exclusive_set in spec:
-        for fieldname in exclusive_set:
-            lookup[fieldname] = list(exclusive_set - {fieldname})
+        for field in exclusive_set:
+            lookup[field] = list(exclusive_set - {field})
     return lookup
 
 
@@ -1406,17 +906,15 @@ class Action(BaseModel):
 
 class PolicyDefinitionSequenceBase(BaseModel):
     sequence_id: int = Field(default=0, serialization_alias="sequenceId", validation_alias="sequenceId")
-    sequence_name: Optional[str] = Field(
-        default=None, serialization_alias="sequenceName", validation_alias="sequenceName"
+    sequence_name: str = Field(serialization_alias="sequenceName", validation_alias="sequenceName")
+    base_action: PolicyActionType = Field(
+        default="drop", serialization_alias="baseAction", validation_alias="baseAction"
     )
-    base_action: Optional[str] = Field(default=None, serialization_alias="baseAction", validation_alias="baseAction")
     sequence_type: SequenceType = Field(serialization_alias="sequenceType", validation_alias="sequenceType")
-    sequence_ip_type: Optional[SequenceIpType] = Field(
-        default="ipv4", serialization_alias="sequenceIpType", validation_alias="sequenceIpType"
-    )
+    sequence_ip_type: SequenceIpType = Field(serialization_alias="sequenceIpType", validation_alias="sequenceIpType")
     ruleset: Optional[bool] = None
     match: Match
-    actions: Optional[Sequence[ActionEntry]] = None
+    actions: Sequence[ActionEntry]
 
     @staticmethod
     def _check_field_collision(field: str, fields: Sequence[str]) -> None:
@@ -1508,16 +1006,8 @@ def accept_action(method):
     return wrapper
 
 
-class PolicyActionBase(BaseModel):
-    type: str
-
-
-class PolicyAcceptRejectAction(PolicyActionBase):
-    type: AcceptRejectActionType
-
-
-class PolicyAcceptDropAction(PolicyActionBase):
-    type: AcceptDropActionType
+class DefaultAction(BaseModel):
+    type: PolicyActionType
 
 
 class InfoTag(BaseModel):
@@ -1525,7 +1015,6 @@ class InfoTag(BaseModel):
 
 
 class PolicyDefinitionId(BaseModel):
-    model_config = ConfigDict(populate_by_name=True)
     definition_id: UUID = Field(serialization_alias="definitionId", validation_alias="definitionId")
 
 
@@ -1535,8 +1024,8 @@ class PolicyReference(BaseModel):
 
 
 class DefinitionWithSequencesCommonBase(BaseModel):
-    default_action: Optional[PolicyActionBase] = Field(
-        default=None,
+    default_action: Optional[DefaultAction] = Field(
+        default=DefaultAction(type="drop"),
         serialization_alias="defaultAction",
         validation_alias="defaultAction",
     )
@@ -1590,9 +1079,8 @@ class DefinitionWithSequencesCommonBase(BaseModel):
 
 class PolicyDefinitionBase(BaseModel):
     name: str = Field(
-        pattern="^[a-zA-Z0-9._-]{1,128}$",
-        description="Can include only alpha-numeric characters, "
-        "dot '.' or hyphen '-' or underscore '_'; maximum 128 characters",
+        pattern="^[a-zA-Z0-9_-]{1,128}$",
+        description="Can include only alpha-numeric characters, hyphen '-' or underscore '_'; maximum 128 characters",
     )
     description: str = "default description"
     type: str
@@ -1615,9 +1103,21 @@ class PolicyDefinitionGetResponse(PolicyDefinitionInfo):
 
 class PolicyDefinitionEditResponse(BaseModel):
     master_templates_affected: List[str] = Field(
-        default_factory=list, serialization_alias="masterTemplatesAffected", validation_alias="masterTemplatesAffected"
+        default=[], serialization_alias="masterTemplatesAffected", validation_alias="masterTemplatesAffected"
     )
 
 
 class PolicyDefinitionPreview(BaseModel):
     preview: str
+
+
+class PolicyDefinitionEndpoints(Protocol):
+    def create_policy_definition(self, payload: BaseModel) -> PolicyDefinitionId: ...
+
+    def delete_policy_definition(self, id: UUID) -> None: ...
+
+    def edit_policy_definition(self, id: UUID, payload: BaseModel) -> PolicyDefinitionEditResponse: ...
+
+    def get_definitions(self) -> DataSequence[PolicyDefinitionInfo]: ...
+
+    def get_policy_definition(self, id: UUID) -> PolicyDefinitionGetResponse: ...