mirror of
https://github.com/simonw/datasette.git
synced 2025-12-10 16:51:24 +01:00
parent
8bc9b1ee03
commit
a508fc4a8e
4 changed files with 10 additions and 76 deletions
|
|
@ -1314,72 +1314,6 @@ This example plugin causes 0 results to be returned if ``?_nothing=1`` is added
|
|||
|
||||
Example: `datasette-leaflet-freedraw <https://datasette.io/plugins/datasette-leaflet-freedraw>`_
|
||||
|
||||
.. _plugin_hook_permission_allowed:
|
||||
|
||||
permission_allowed(datasette, actor, action, resource)
|
||||
------------------------------------------------------
|
||||
|
||||
``datasette`` - :ref:`internals_datasette`
|
||||
You can use this to access plugin configuration options via ``datasette.plugin_config(your_plugin_name)``, or to execute SQL queries.
|
||||
|
||||
``actor`` - dictionary
|
||||
The current actor, as decided by :ref:`plugin_hook_actor_from_request`.
|
||||
|
||||
``action`` - string
|
||||
The action to be performed, e.g. ``"edit-table"``.
|
||||
|
||||
``resource`` - string or None
|
||||
An identifier for the individual resource, e.g. the name of the table.
|
||||
|
||||
Called to check that an actor has permission to perform an action on a resource. Can return ``True`` if the action is allowed, ``False`` if the action is not allowed or ``None`` if the plugin does not have an opinion one way or the other.
|
||||
|
||||
Here's an example plugin which randomly selects if a permission should be allowed or denied, except for ``view-instance`` which always uses the default permission scheme instead.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
from datasette import hookimpl
|
||||
import random
|
||||
|
||||
|
||||
@hookimpl
|
||||
def permission_allowed(action):
|
||||
if action != "view-instance":
|
||||
# Return True or False at random
|
||||
return random.random() > 0.5
|
||||
# Returning None falls back to default permissions
|
||||
|
||||
This function can alternatively return an awaitable function which itself returns ``True``, ``False`` or ``None``. You can use this option if you need to execute additional database queries using ``await datasette.execute(...)``.
|
||||
|
||||
Here's an example that allows users to view the ``admin_log`` table only if their actor ``id`` is present in the ``admin_users`` table. It aso disallows arbitrary SQL queries for the ``staff.db`` database for all users.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
@hookimpl
|
||||
def permission_allowed(datasette, actor, action, resource):
|
||||
async def inner():
|
||||
if action == "execute-sql" and resource == "staff":
|
||||
return False
|
||||
if action == "view-table" and resource == (
|
||||
"staff",
|
||||
"admin_log",
|
||||
):
|
||||
if not actor:
|
||||
return False
|
||||
user_id = actor["id"]
|
||||
result = await datasette.get_database(
|
||||
"staff"
|
||||
).execute(
|
||||
"select count(*) from admin_users where user_id = :user_id",
|
||||
{"user_id": user_id},
|
||||
)
|
||||
return result.first()[0] > 0
|
||||
|
||||
return inner
|
||||
|
||||
See :ref:`built-in permissions <authentication_permissions>` for a full list of permissions that are included in Datasette core.
|
||||
|
||||
Example: `datasette-permissions-sql <https://datasette.io/plugins/datasette-permissions-sql>`_
|
||||
|
||||
.. _plugin_hook_permission_resources_sql:
|
||||
|
||||
permission_resources_sql(datasette, actor, action)
|
||||
|
|
@ -1981,16 +1915,16 @@ This example adds a new database action for creating a table, if the user has th
|
|||
.. code-block:: python
|
||||
|
||||
from datasette import hookimpl
|
||||
from datasette.resources import DatabaseResource
|
||||
|
||||
|
||||
@hookimpl
|
||||
def database_actions(datasette, actor, database):
|
||||
async def inner():
|
||||
if not await datasette.permission_allowed(
|
||||
if not await datasette.allowed(
|
||||
actor,
|
||||
"edit-schema",
|
||||
resource=database,
|
||||
default=False,
|
||||
resource=DatabaseResource("database"),
|
||||
):
|
||||
return []
|
||||
return [
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue