{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://runninglake.com/schema/v1alpha1/rowfilter.json",
  "title": "RowFilter",
  "description": "A RowFilter as RunningLake's configuration repository declares it, at policies/rowfilters/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "apiVersion",
    "kind",
    "metadata"
  ],
  "properties": {
    "apiVersion": {
      "type": "string",
      "const": "runninglake.io/v1alpha1",
      "description": "The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version)."
    },
    "kind": {
      "type": "string",
      "const": "RowFilter",
      "description": "The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch)."
    },
    "metadata": {
      "required": [
        "name"
      ],
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "name": {
          "type": "string",
          "pattern": "^[a-z0-9_-]{1,63}$",
          "description": "The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch)."
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "annotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "spec": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": false,
      "properties": {
        "on": {
          "description": "On is the table the filter is to cover, once something applies it, which nothing does yet: a layer, the schema in it when the table sits in one, and the table. Structured, never a dotted string, and the same names a Grant's target uses. A table nested deeper than a schema cannot be named yet.",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": false,
          "properties": {
            "layer": {
              "type": [
                "string",
                "null"
              ]
            },
            "schema": {
              "type": [
                "string",
                "null"
              ]
            },
            "table": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        },
        "predicate": {
          "description": "Predicate is a boolean expression over the table's own columns; a row is to be read only where it is true, once something applies it, which nothing does yet. It is recorded as written. A change set's SQL dialect check reads its form when it is committed (one expression over the table's own columns, inside the restricted dialect), and nothing yet reads its meaning, so a mistake in what it selects is found when a policy compiler first applies it.",
          "type": [
            "string",
            "null"
          ]
        },
        "exempt": {
          "description": "Exempt lists the principals the filter does NOT apply to, each user:<email>, role:<one of the five roles> or team:<name>; everyone else is to be filtered once something enforces it, which nothing does yet. A user is an email address and a team a name, in plain characters: no wildcard. A team: principal matches nobody until teams exist and then exempts that team's members. A service or an agent has no form here, so the filter applies to it. Leave it out to filter everyone.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": [
              "string",
              "null"
            ]
          }
        }
      }
    }
  }
}