windmill_api/models/
policy.rs

1/*
2 * Windmill API
3 *
4 * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
5 *
6 * The version of the OpenAPI document: 1.778.0
7 * Contact: contact@windmill.dev
8 * Generated by: https://openapi-generator.tech
9 */
10
11use crate::models;
12use serde::{Deserialize, Serialize};
13
14#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
15pub struct Policy {
16    #[serde(rename = "triggerables", skip_serializing_if = "Option::is_none")]
17    pub triggerables: Option<std::collections::HashMap<String, serde_json::Value>>,
18    #[serde(rename = "triggerables_v2", skip_serializing_if = "Option::is_none")]
19    pub triggerables_v2: Option<std::collections::HashMap<String, serde_json::Value>>,
20    #[serde(rename = "s3_inputs", skip_serializing_if = "Option::is_none")]
21    pub s3_inputs: Option<Vec<serde_json::Value>>,
22    #[serde(rename = "allowed_s3_keys", skip_serializing_if = "Option::is_none")]
23    pub allowed_s3_keys: Option<Vec<models::PolicyAllowedS3KeysInner>>,
24    #[serde(rename = "execution_mode", skip_serializing_if = "Option::is_none")]
25    pub execution_mode: Option<ExecutionMode>,
26    #[serde(rename = "on_behalf_of", skip_serializing_if = "Option::is_none")]
27    pub on_behalf_of: Option<String>,
28    #[serde(rename = "on_behalf_of_email", skip_serializing_if = "Option::is_none")]
29    pub on_behalf_of_email: Option<String>,
30    /// Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior). 
31    #[serde(rename = "sandbox", skip_serializing_if = "Option::is_none")]
32    pub sandbox: Option<bool>,
33    /// Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read). 
34    #[serde(rename = "frontend_sdk_scopes", skip_serializing_if = "Option::is_none")]
35    pub frontend_sdk_scopes: Option<Vec<String>>,
36}
37
38impl Policy {
39    pub fn new() -> Policy {
40        Policy {
41            triggerables: None,
42            triggerables_v2: None,
43            s3_inputs: None,
44            allowed_s3_keys: None,
45            execution_mode: None,
46            on_behalf_of: None,
47            on_behalf_of_email: None,
48            sandbox: None,
49            frontend_sdk_scopes: None,
50        }
51    }
52}
53/// 
54#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize)]
55pub enum ExecutionMode {
56    #[serde(rename = "viewer")]
57    Viewer,
58    #[serde(rename = "publisher")]
59    Publisher,
60    #[serde(rename = "anonymous")]
61    Anonymous,
62}
63
64impl Default for ExecutionMode {
65    fn default() -> ExecutionMode {
66        Self::Viewer
67    }
68}
69
windmill_api/models/policy.rs

windmill_api/models/
policy.rs
