Require update-row to use insert replace, closes #2279

tests/test_api_write.py

@@ -221,6 +221,14 @@ async def test_insert_rows(ds_write, return_rows):
             400,
             ['Cannot use "ignore" and "replace" at the same time'],
         ),
+        (
+            # Replace is not allowed if you don't have update-row
+            "/data/docs/-/insert",
+            {"rows": [{"title": "Test"}], "replace": True},
+            "insert-but-not-update",
+            403,
+            ['Permission denied: need update-row to use "replace"'],
+        ),
         (
             "/data/docs/-/insert",
             {"rows": [{"title": "Test"}], "invalid_param": True},