{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://runninglake.com/schema/v1alpha1/sqlenginepolicy.json",
  "title": "SQLEnginePolicy",
  "description": "A SQLEnginePolicy as RunningLake's configuration repository declares it, at sql/engines.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "apiVersion",
    "kind",
    "metadata"
  ],
  "properties": {
    "apiVersion": {
      "type": "string",
      "const": "runninglake.io/v1alpha1",
      "description": "The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version)."
    },
    "kind": {
      "type": "string",
      "const": "SQLEnginePolicy",
      "description": "The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch)."
    },
    "metadata": {
      "required": [
        "name"
      ],
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "name": {
          "type": "string",
          "pattern": "^[a-z0-9_-]{1,63}$",
          "description": "The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch)."
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "annotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "spec": {
      "description": "SQLEnginePolicySpec says which engine each of your roles may run ad-hoc SQL on. A role that is not named keeps the engine the platform pins for it.",
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": false,
      "properties": {
        "roles": {
          "description": "Roles maps a role (owner, admin, engineer, analyst or viewer) to the engines it may run ad-hoc SQL on. The only engine is trino; DuckDB is not an engine ad-hoc SQL can be granted. A role listed with no engines, or not listed, has none. Giving a role an engine is held until an owner or admin confirms it; taking one away takes effect at the next sync. Required: write roles: {} to take every grant away.",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": {
            "type": [
              "array",
              "null"
            ],
            "items": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        },
        "limits": {
          "description": "Limits is the organisation's one limit on ad-hoc SQL. Optional: a file without it sets no limit, and so does a file that is gone.",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": false,
          "properties": {
            "maxWarmMinutes": {
              "description": "MaxWarmMinutes is the longest, in whole minutes from 1 to 1440, that any project may keep the engine warm after its last query. Optional: absent means no limit. Lowering it takes effect at the next sync; raising it, or removing it, is held until an owner or admin confirms it, because a longer warm time is spend. A project that already sets more keeps its own number and runs on the lesser of the two.",
              "type": [
                "integer",
                "null"
              ],
              "minimum": -9223372036854775808,
              "maximum": 9223372036854775807
            }
          }
        }
      }
    }
  }
}