windmill-client 1.814.0 → 1.816.0

package/dist/services.gen.mjs

@@ -2734,6 +2734,131 @@ var WorkspaceService = class {
 		});
 	}
 	/**
+	* get who may connect to a data table as which role
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @returns DatatablePermissions the data table's roles and their tenants
+	* @throws ApiError
+	*/
+	static getDatatablePermissions(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_permissions/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			}
+		});
+	}
+	/**
+	* set who may connect to a data table as which role
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns string status
+	* @throws ApiError
+	*/
+	static setDatatablePermissions(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_permissions/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* read the owner and grants of an instance data table's database, schema or table
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.kind
+	* @param data.schema
+	* @param data.table
+	* @returns DatatableAclInfo owner and grants
+	* @throws ApiError
+	*/
+	static getDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			query: {
+				kind: data.kind,
+				schema: data.schema,
+				table: data.table
+			}
+		});
+	}
+	/**
+	* preview the SQL an ownership or grant change would run (data table administrators only)
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns AclPlan statements that would run, in a single transaction
+	* @throws ApiError
+	*/
+	static planDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}/plan",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* run an ownership or grant change exactly as planned (data table administrators only)
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns string change applied
+	* @throws ApiError
+	*/
+	static applyDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}/apply",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* list the data table roles the caller may connect as
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @returns unknown usable roles
+	* @throws ApiError
+	*/
+	static listUsableDatatableRoles(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			}
+		});
+	}
+	/**
 	* list schemas of all connected Datatables
 	* @param data The data for the request.
 	* @param data.workspace
@@ -2769,6 +2894,9 @@ var WorkspaceService = class {
 	* list tables of all connected Datatables
 	* @param data The data for the request.
 	* @param data.workspace
+	* @param data.datatableName list only this data table; each listed data table opens a connection to its database
+	* @param data.roleFor the data table `role` applies to; every other one is listed as its default role
+	* @param data.role the role to list `role_for` as; refused, in that entry's `error`, if the caller may not use it
 	* @returns DataTableTables table metadata of all datatables
 	* @throws ApiError
 	*/
@@ -2776,7 +2904,12 @@ var WorkspaceService = class {
 		return request(OpenAPI, {
 			method: "GET",
 			url: "/w/{workspace}/workspaces/list_datatable_tables",
-			path: { workspace: data.workspace }
+			path: { workspace: data.workspace },
+			query: {
+				datatable_name: data.datatableName,
+				role_for: data.roleFor,
+				role: data.role
+			}
 		});
 	}
 	/**
@@ -2786,6 +2919,7 @@ var WorkspaceService = class {
 	* @param data.datatableName
 	* @param data.schemaName
 	* @param data.tableName
+	* @param data.role the data table role to read the table as; defaults to the data table's default role
 	* @returns DataTableTableSchema schema of one datatable table
 	* @throws ApiError
 	*/
@@ -2797,7 +2931,8 @@ var WorkspaceService = class {
 			query: {
 				datatable_name: data.datatableName,
 				schema_name: data.schemaName,
-				table_name: data.tableName
+				table_name: data.tableName,
+				role: data.role
 			}
 		});
 	}
@@ -3260,6 +3395,24 @@ var WorkspaceService = class {
 		});
 	}
 	/**
+	* choose whether new forks of this workspace start with its admins and developers
+	* When on, every fork created from this workspace gets the workspace's admins and developers as members, with the role they hold here; operators, disabled users and service accounts are left out. The setting is copied into each fork, so forks of a fork follow it too. Off by default. Workspace-admin gated.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.requestBody Whether new forks start with this workspace's admins and developers
+	* @returns string status
+	* @throws ApiError
+	*/
+	static editAddAdminsAndDevelopersToForks(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks",
+			path: { workspace: data.workspace },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* set the key guest JWTs are verified against for this workspace
 	* A guest JWT (`jwt_guest_`) is minted by the embedding customer's own backend and verified against this key: a PEM public key (RS/ES family, HS* refused) or a JWKS URL, at most one. Both empty clears the workspace key; off cloud, verification then falls back to the instance issuer (`JWT_EXT_JWKS_URL`) if one is set, else no guest JWT is accepted (`guest_access_enabled` is the on/off switch). Workspace-admin gated. The key is validated before it is stored. Setting a key is refused with a 400 where guests are unavailable (the shared cloud); clearing one always works.
 	* @param data The data for the request.
@@ -3778,6 +3931,63 @@ var SettingService = class {
 		});
 	}
 	/**
+	* list the instance's data table roles
+	* @returns InstanceDatatableRole the instance role catalog
+	* @throws ApiError
+	*/
+	static listInstanceDatatableRoles() {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/settings/datatable_roles"
+		});
+	}
+	/**
+	* create a data table role on the instance's Postgres cluster
+	* @param data The data for the request.
+	* @param data.requestBody
+	* @returns InstanceDatatableRole the created role
+	* @throws ApiError
+	*/
+	static createInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/settings/datatable_roles",
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* rename a data table role or turn its login on and off
+	* @param data The data for the request.
+	* @param data.id
+	* @param data.requestBody
+	* @returns InstanceDatatableRole the updated role
+	* @throws ApiError
+	*/
+	static updateInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/settings/datatable_roles/{id}",
+			path: { id: data.id },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* drop a data table role from the cluster and from every workspace that named it
+	* @param data The data for the request.
+	* @param data.id
+	* @returns unknown deleted
+	* @throws ApiError
+	*/
+	static deleteInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "DELETE",
+			url: "/settings/datatable_roles/{id}",
+			path: { id: data.id }
+		});
+	}
+	/**
 	* Runs CREATE DATABASE on the Windmill Postgres and grants access to the custom_instance_user
 	* @param data The data for the request.
 	* @param data.name The name of the database to create
@@ -5883,6 +6093,8 @@ var FlowService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns FlowVersion Flow history
 	* @throws ApiError
 	*/
@@ -5893,6 +6105,10 @@ var FlowService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -6492,6 +6708,8 @@ var AppService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns AppHistory app history
 	* @throws ApiError
 	*/
@@ -6502,6 +6720,10 @@ var AppService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -6720,7 +6942,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.requestBody update app
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateApp(data) {
@@ -6758,7 +6980,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.requestBody raw app sources to bundle and deploy
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateAppRawSource(data) {
@@ -6779,7 +7001,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.formData update app
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateAppRaw(data) {
@@ -7539,6 +7761,8 @@ var ScriptService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns ScriptHistory script history
 	* @throws ApiError
 	*/
@@ -7549,6 +7773,10 @@ var ScriptService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -7985,6 +8213,30 @@ var DraftService = class {
 		});
 	}
 	/**
+	* move the current user's draft-only item to another path
+	* Relocates the authed user's own draft row, along with both path keys inside its value (the typed path and the mirror the editors keep beside it). Only for draft-only items — a deployed item must be moved through its own deploy endpoint, which carries every draft with it. Restricted to script, flow, app and raw_app; any other kind is rejected with 400, because only these keep their deploy target where this endpoint rewrites it.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.kind script, flow, app or raw_app only.
+	* @param data.path
+	* @param data.requestBody
+	* @returns string move result
+	* @throws ApiError
+	*/
+	static moveDraft(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/drafts/move/{kind}/{path}",
+			path: {
+				workspace: data.workspace,
+				kind: data.kind,
+				path: data.path
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* resolve a legacy (workspace-level) draft (admin only)
 	* Delete a legacy draft (email NULL) or assign it to the authed admin as a per-user draft. Workspace admins / superadmins only.
 	* @param data The data for the request.

package/dist/sqlUtils.d.ts

@@ -55,9 +55,15 @@ export interface SqlTemplateFunction {
 export interface DatatableSqlTemplateFunction extends SqlTemplateFunction {
     query<T = any>(sql: string, ...params: any[]): SqlStatement<T>;
 }
+export interface DatatableOptions {
+    /** The data table role to connect as. Omit to get the data table's default role. */
+    role?: string;
+}
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -67,8 +73,11 @@ export interface DatatableSqlTemplateFunction extends SqlTemplateFunction {
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-export declare function datatable(name?: string): DatatableSqlTemplateFunction;
+export declare function datatable(name?: string, opts?: DatatableOptions): DatatableSqlTemplateFunction;
 /**
  * Create a SQL template function for DuckDB/ducklake queries
  * @param name - DuckDB database name, optionally with a schema as `name:schema` (default: "main")

package/dist/sqlUtils.mjs

@@ -13,11 +13,14 @@ var RawSql = class {
 		this.value = value;
 	}
 };
-function datatableProvider(name, schema) {
+const ROLE_NAME_RE = /^[A-Za-z0-9_-]{1,63}$/;
+function datatableProvider(name, schema, role) {
+	if (role !== void 0 && !ROLE_NAME_RE.test(role)) throw new Error(`Invalid data table role '${role}': only letters, digits, '_' and '-' are allowed`);
 	return {
 		providerName: "datatable",
 		language: "postgresql",
 		extraArgs: { database: `datatable://${name}` },
+		annotations: () => role !== void 0 ? `-- role ${role}\n` : "",
 		formatArgDecl: (argNum) => `-- $${argNum} arg${argNum}`,
 		formatArgUsage: (argNum, explicitType, inferredType) => explicitType !== void 0 ? `$${argNum}` : `$${argNum}::${inferredType}`,
 		preamble: () => schema ? `SET search_path TO "${schema}";\n` : ""
@@ -28,6 +31,7 @@ function ducklakeProvider(name, schema) {
 		providerName: "ducklake",
 		language: "duckdb",
 		extraArgs: {},
+		annotations: () => "",
 		formatArgDecl: (argNum, argType) => `-- $arg${argNum} (${argType})`,
 		formatArgUsage: (argNum) => `$arg${argNum}`,
 		preamble: () => `ATTACH 'ducklake://${name}' AS dl;USE dl${schema ? `."${schema}"` : ""};\n`
@@ -115,7 +119,8 @@ function buildSqlTemplateFunction(provider) {
 			let argType = parseTypeAnnotation(strings[info.originalIndex], strings[info.originalIndex + 1]) || inferSqlType(info.value);
 			return provider.formatArgDecl(info.argNum, argType);
 		});
-		let content = argDecls.length ? argDecls.join("\n") + "\n" : "";
+		let content = provider.annotations();
+		content += argDecls.length ? argDecls.join("\n") + "\n" : "";
 		content += provider.preamble();
 		let contentBody = "";
 		for (let i = 0; i < strings.length; i++) {
@@ -143,6 +148,8 @@ function buildSqlTemplateFunction(provider) {
 /**
 * Create a SQL template function for PostgreSQL/datatable queries
 * @param name - Database/datatable name (default: "main")
+* @param opts.role - Connect as this data table role instead of the data table's default one.
+*   Only meaningful on a data table under roles, and only for a role you are a tenant of.
 * @returns SQL template function for building parameterized queries
 * @example
 * let sql = wmill.datatable()
@@ -152,15 +159,18 @@ function buildSqlTemplateFunction(provider) {
 *   SELECT * FROM friends
 *     WHERE name = ${name} AND age = ${age}::int
 * `.fetch()
+* @example
+* // Read through a restricted role
+* let sql = wmill.datatable("main", { role: "analytics" })
 */
-function datatable(name = "main") {
+function datatable(name = "main", opts) {
 	let { name: n, schema } = parseName(name);
-	let provider = datatableProvider(n, schema);
+	let provider = datatableProvider(n, schema, opts?.role);
 	let sqlFn = buildSqlTemplateFunction(provider);
 	sqlFn.query = (sqlString, ...params) => {
 		let argDecls = params.map((v, i) => `-- $${i + 1} arg${i + 1} (${inferSqlType(v)})`).join("\n");
 		let contentBody = sqlString;
-		let content = (argDecls ? argDecls + "\n" : "") + provider.preamble() + sqlString;
+		let content = provider.annotations() + (argDecls ? argDecls + "\n" : "") + provider.preamble() + sqlString;
 		let args = {
 			...Object.fromEntries(params.map((v, i) => [`arg${i + 1}`, serializeArgValue(v)])),
 			...provider.extraArgs