github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

view-instance permission for debug URLs, closes #833

Browse source
This commit is contained in:
Simon Willison 2020-06-11 15:14:51 -07:00
commit 29c5ff493a
2 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

30
tests/test_permissions.py
View file

@ -316,3 +316,33 @@ def test_permissions_debug(app_client):
def test_allow_unauthenticated(allow, expected):
with make_app_client(metadata={"allow": allow}) as client:
assert expected == client.get("/").status
@pytest.fixture(scope="session")
def view_instance_client():
with make_app_client(metadata={"allow": {}}) as client:
yield client
@pytest.mark.parametrize(
"path",
[
"/",
"/fixtures",
"/fixtures/facetable",
"/-/metadata",
"/-/versions",
"/-/plugins",
"/-/config",
"/-/threads",
"/-/databases",
"/-/actor",
"/-/permissions",
"/-/messages",
"/-/patterns",
],
)
def test_view_instance(path, view_instance_client):
assert 403 == view_instance_client.get(path).status
if path not in ("/-/permissions", "/-/messages", "/-/patterns"):
assert 403 == view_instance_client.get(path + ".json").status