/*
* Windmill API
*
* No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
*
* The version of the OpenAPI document: 1.780.0
* Contact: contact@windmill.dev
* Generated by: https://openapi-generator.tech
*/
use crate::models;
use serde::{Deserialize, Serialize};
#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
pub struct Policy {
#[serde(rename = "triggerables", skip_serializing_if = "Option::is_none")]
pub triggerables: Option<std::collections::HashMap<String, serde_json::Value>>,
#[serde(rename = "triggerables_v2", skip_serializing_if = "Option::is_none")]
pub triggerables_v2: Option<std::collections::HashMap<String, serde_json::Value>>,
#[serde(rename = "s3_inputs", skip_serializing_if = "Option::is_none")]
pub s3_inputs: Option<Vec<serde_json::Value>>,
#[serde(rename = "allowed_s3_keys", skip_serializing_if = "Option::is_none")]
pub allowed_s3_keys: Option<Vec<models::PolicyAllowedS3KeysInner>>,
#[serde(rename = "execution_mode", skip_serializing_if = "Option::is_none")]
pub execution_mode: Option<ExecutionMode>,
#[serde(rename = "on_behalf_of", skip_serializing_if = "Option::is_none")]
pub on_behalf_of: Option<String>,
#[serde(rename = "on_behalf_of_email", skip_serializing_if = "Option::is_none")]
pub on_behalf_of_email: Option<String>,
/// Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior).
#[serde(rename = "sandbox", skip_serializing_if = "Option::is_none")]
pub sandbox: Option<bool>,
/// Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).
#[serde(rename = "frontend_sdk_scopes", skip_serializing_if = "Option::is_none")]
pub frontend_sdk_scopes: Option<Vec<String>>,
}
impl Policy {
pub fn new() -> Policy {
Policy {
triggerables: None,
triggerables_v2: None,
s3_inputs: None,
allowed_s3_keys: None,
execution_mode: None,
on_behalf_of: None,
on_behalf_of_email: None,
sandbox: None,
frontend_sdk_scopes: None,
}
}
}
///
#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize)]
pub enum ExecutionMode {
#[serde(rename = "viewer")]
Viewer,
#[serde(rename = "publisher")]
Publisher,
#[serde(rename = "anonymous")]
Anonymous,
}
impl Default for ExecutionMode {
fn default() -> ExecutionMode {
Self::Viewer
}
}