Struct CodeModeConfig 

pub struct CodeModeConfig {

    pub enabled: bool,
    pub allow_mutations: bool,
    pub allowed_mutations: HashSet<String>,
    pub blocked_mutations: HashSet<String>,
    pub allow_introspection: bool,
    pub blocked_fields: HashSet<String>,
    pub allowed_queries: HashSet<String>,
    pub blocked_queries: HashSet<String>,
    pub openapi_reads_enabled: bool,
    pub openapi_allow_writes: bool,
    pub openapi_allowed_writes: HashSet<String>,
    pub openapi_blocked_writes: HashSet<String>,
    pub openapi_allow_deletes: bool,
    pub openapi_allowed_deletes: HashSet<String>,
    pub openapi_blocked_paths: HashSet<String>,
    pub openapi_internal_blocked_fields: HashSet<String>,
    pub openapi_output_blocked_fields: HashSet<String>,
    pub openapi_require_output_declaration: bool,
    pub action_tags: HashMap<String, String>,
    pub max_depth: u32,
    pub max_field_count: u32,
    pub max_cost: u32,
    pub allowed_sensitive_categories: HashSet<String>,
    pub token_ttl_seconds: i64,
    pub auto_approve_levels: Vec<RiskLevel>,
    pub max_query_length: usize,
    pub max_result_rows: usize,
    pub query_timeout_seconds: u32,
    pub server_id: Option<String>,
    pub sdk_operations: HashSet<String>,
    pub operations: Vec<OperationEntry>,
}

Configuration for Code Mode.

Fields

enabled: bool

Whether Code Mode is enabled for this server

allow_mutations: bool

Whether to allow mutations (MVP: false)

allowed_mutations: HashSet<String>

Allowed mutation names (whitelist). If empty and allow_mutations=true, all are allowed.

blocked_mutations: HashSet<String>

Blocked mutation names (blacklist). Always blocked even if allow_mutations=true.

allow_introspection: bool

Whether to allow introspection queries

blocked_fields: HashSet<String>

Fields that should never be returned (Type.field format) - GraphQL

allowed_queries: HashSet<String>

Allowed query names (whitelist). If empty and mode is allowlist, none are allowed.

blocked_queries: HashSet<String>

Blocked query names (blocklist). Always blocked even if reads enabled.

openapi_reads_enabled: bool

Whether read operations (GET) are enabled (default: true)

openapi_allow_writes: bool

Whether write operations (POST, PUT, PATCH) are allowed globally

openapi_allowed_writes: HashSet<String>

Allowed write operations (operationId or “METHOD /path”)

openapi_blocked_writes: HashSet<String>

Blocked write operations

openapi_allow_deletes: bool

Whether delete operations (DELETE) are allowed globally

openapi_allowed_deletes: HashSet<String>

Allowed delete operations (operationId or “METHOD /path”)

openapi_blocked_paths: HashSet<String>

Blocked paths (glob patterns like “/admin/*”)

openapi_internal_blocked_fields: HashSet<String>

Fields that are stripped from API responses entirely (no access)

openapi_output_blocked_fields: HashSet<String>

Fields that can be used internally but not in script output

openapi_require_output_declaration: bool

Whether scripts must declare their return type with @returns

action_tags: HashMap<String, String>

Action tags to override inferred actions for specific operations.

max_depth: u32

Maximum query depth

max_field_count: u32

Maximum field count per query

max_cost: u32

Maximum estimated query cost

allowed_sensitive_categories: HashSet<String>

Allowed sensitive data categories

token_ttl_seconds: i64

Token time-to-live in seconds

auto_approve_levels: Vec<RiskLevel>

Risk levels that can be auto-approved without human confirmation

max_query_length: usize

Maximum query length in characters

max_result_rows: usize

Maximum result rows to return

query_timeout_seconds: u32

Query execution timeout in seconds

server_id: Option<String>

Server ID for token generation

sdk_operations: HashSet<String>

Allowed SDK operation names for SDK-backed Code Mode. When non-empty, Code Mode uses SDK dispatch instead of HTTP. Operations are validated at compile time — unlisted names are rejected.

operations: Vec<OperationEntry>

Declared operations for plain-name ID mapping in Cedar entities. Parsed from [[code_mode.operations]] TOML sections. When non-empty, ScriptEntity calledOperations uses IDs from the registry built from these entries. Unregistered paths fall back to METHOD:/path.

Implementations

impl CodeModeConfig

pub fn from_toml(toml_str: &str) -> Result<Self, Error>

Parse CodeModeConfig from a full TOML config string.

Extracts the [code_mode] section (including [[code_mode.operations]]) and ignores all other sections. This is the recommended way for external servers to build their config from config.toml:

const CONFIG_TOML: &str = include_str!("../../config.toml");

let config = CodeModeConfig::from_toml(CONFIG_TOML)
    .expect("Invalid code_mode section in config.toml");

If the TOML has no [code_mode] section, returns CodeModeConfig::default().

pub fn enabled() -> Self

Create a new config with Code Mode enabled.

pub fn is_sdk_mode(&self) -> bool

Returns true if this config enables SDK-backed Code Mode.

pub fn should_auto_approve(&self, risk_level: RiskLevel) -> bool

Check if a risk level should be auto-approved.

pub fn server_id(&self) -> &str

Get the server ID, falling back to a default.

pub fn to_server_config_entity(&self) -> ServerConfigEntity

Convert to ServerConfigEntity for policy evaluation.

pub fn to_openapi_server_entity(&self) -> OpenAPIServerEntity

Convert to OpenAPIServerEntity for policy evaluation (OpenAPI Code Mode).

Trait Implementations

impl Clone for CodeModeConfig

fn clone(&self) -> CodeModeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CodeModeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CodeModeConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CodeModeConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CodeModeConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.