windmill_api/models/
policy.rs

1/*
2 * Windmill API
3 *
4 * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
5 *
6 * The version of the OpenAPI document: 1.792.0
7 * Contact: contact@windmill.dev
8 * Generated by: https://openapi-generator.tech
9 */
10
11use crate::models;
12use serde::{Deserialize, Serialize};
13
14#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
15pub struct Policy {
16    #[serde(rename = "triggerables", skip_serializing_if = "Option::is_none")]
17    pub triggerables: Option<std::collections::HashMap<String, serde_json::Value>>,
18    #[serde(rename = "triggerables_v2", skip_serializing_if = "Option::is_none")]
19    pub triggerables_v2: Option<std::collections::HashMap<String, serde_json::Value>>,
20    #[serde(rename = "s3_inputs", skip_serializing_if = "Option::is_none")]
21    pub s3_inputs: Option<Vec<serde_json::Value>>,
22    #[serde(rename = "allowed_s3_keys", skip_serializing_if = "Option::is_none")]
23    pub allowed_s3_keys: Option<Vec<models::PolicyAllowedS3KeysInner>>,
24    /// Who the app's runnables execute as. Optional, and what omitting it means depends on the operation: creating an app defaults it to `publisher` (runs on behalf of the app's publisher and requires an authenticated viewer), while updating one keeps the mode the app is already deployed under. Either way `anonymous`, which makes the app publicly executable, is never assumed
25    #[serde(rename = "execution_mode", skip_serializing_if = "Option::is_none")]
26    pub execution_mode: Option<ExecutionMode>,
27    #[serde(rename = "on_behalf_of", skip_serializing_if = "Option::is_none")]
28    pub on_behalf_of: Option<String>,
29    #[serde(rename = "on_behalf_of_email", skip_serializing_if = "Option::is_none")]
30    pub on_behalf_of_email: Option<String>,
31    /// Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior). 
32    #[serde(rename = "sandbox", skip_serializing_if = "Option::is_none")]
33    pub sandbox: Option<bool>,
34    /// Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read). 
35    #[serde(rename = "frontend_sdk_scopes", skip_serializing_if = "Option::is_none")]
36    pub frontend_sdk_scopes: Option<Vec<String>>,
37}
38
39impl Policy {
40    pub fn new() -> Policy {
41        Policy {
42            triggerables: None,
43            triggerables_v2: None,
44            s3_inputs: None,
45            allowed_s3_keys: None,
46            execution_mode: None,
47            on_behalf_of: None,
48            on_behalf_of_email: None,
49            sandbox: None,
50            frontend_sdk_scopes: None,
51        }
52    }
53}
54/// Who the app's runnables execute as. Optional, and what omitting it means depends on the operation: creating an app defaults it to `publisher` (runs on behalf of the app's publisher and requires an authenticated viewer), while updating one keeps the mode the app is already deployed under. Either way `anonymous`, which makes the app publicly executable, is never assumed
55#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize)]
56pub enum ExecutionMode {
57    #[serde(rename = "viewer")]
58    Viewer,
59    #[serde(rename = "publisher")]
60    Publisher,
61    #[serde(rename = "anonymous")]
62    Anonymous,
63}
64
65impl Default for ExecutionMode {
66    fn default() -> ExecutionMode {
67        Self::Viewer
68    }
69}
70
windmill_api/models/policy.rs

windmill_api/models/
policy.rs
