github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

View list respects view-table permission, refs #811

Browse source 
Also makes a small change to the /fixtures.json JSON:

    "views": ["view_name"]

Is now:

    "views": [{"name": "view_name", "private": true}]
This commit is contained in:
Simon Willison 2020-06-08 11:20:21 -07:00
commit dcec89270a
3 changed files with 24 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tests/test_permissions.py
View file

@ -107,19 +107,27 @@ def test_table_list_respects_view_table():
metadata={
"databases": {
"fixtures": {
"tables": {"compound_three_primary_keys": {"allow": {"id": "root"}}}
"tables": {
"compound_three_primary_keys": {"allow": {"id": "root"}},
# And a SQL view too:
"paginated_view": {"allow": {"id": "root"}},
}
}
}
}
) as client:
html_fragment = '<a href="/fixtures/compound_three_primary_keys">compound_three_primary_keys</a> 🔒'
html_fragments = [
">compound_three_primary_keys</a> 🔒",
">paginated_view</a> 🔒",
]
anon_response = client.get("/fixtures")
assert html_fragment not in anon_response.text
assert '"/fixtures/compound_three_primary_keys"' not in anon_response.text
for html_fragment in html_fragments:
assert html_fragment not in anon_response.text
auth_response = client.get(
"/fixtures", cookies={"ds_actor": client.ds.sign({"id": "root"}, "actor")}
)
assert html_fragment in auth_response.text
for html_fragment in html_fragments:
assert html_fragment in auth_response.text
@pytest.mark.parametrize(