github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

API explorer: respect immutability, closes #1888

Browse source
This commit is contained in:
Simon Willison 2022-11-13 22:01:56 -08:00
commit 575a29c424
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
datasette/views/special.py
View file

@ -281,8 +281,6 @@ class ApiExplorerView(BaseView):
for name, db in self.ds.databases.items(): for name, db in self.ds.databases.items():
if name == "_internal": if name == "_internal":
continue continue
if not db.is_mutable:
continue
database_visible, _ = await self.ds.check_visibility( database_visible, _ = await self.ds.check_visibility(
request.actor, request.actor,
"view-database", "view-database",
@ -301,6 +299,7 @@ class ApiExplorerView(BaseView):
if not visible: if not visible:
continue continue
table_links = [] table_links = []
tables.append({"name": table, "links": table_links})
table_links.append( table_links.append(
{ {
"label": "Get rows for {}".format(table), "label": "Get rows for {}".format(table),
@ -309,6 +308,10 @@ class ApiExplorerView(BaseView):
+ "?_shape=objects".format(name, table), + "?_shape=objects".format(name, table),
} }
) )
# If not mutable don't show any write APIs
if not db.is_mutable:
continue
if await self.ds.permission_allowed( if await self.ds.permission_allowed(
request.actor, "insert-row", (name, table) request.actor, "insert-row", (name, table)
): ):
@ -340,9 +343,11 @@ class ApiExplorerView(BaseView):
"method": "POST", "method": "POST",
} }
) )
tables.append({"name": table, "links": table_links})
database_links = [] database_links = []
if await self.ds.permission_allowed(request.actor, "create-table", name): if (
await self.ds.permission_allowed(request.actor, "create-table", name)
and db.is_mutable
):
database_links.append( database_links.append(
{ {
"path": self.ds.urls.database(name) + "/-/create", "path": self.ds.urls.database(name) + "/-/create",