mirror of
https://github.com/simonw/datasette.git
synced 2025-12-10 16:51:24 +01:00
b5f41772ca
Two fixes for database download permissions:
1. Added also_requires="view-database" to view-database-download action
- You should only be able to download a database if you can view it
2. Added view-database-download to default_allow_actions list
- This action should be allowed by default, like view-database
3. Implemented also_requires checking in allowed() method
- The allowed() method now checks action.also_requires before
checking the action itself
- This ensures execute-sql requires view-database, etc.
Fixes test_database_download_for_immutable and
test_database_download_disallowed_for_memory.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
133 lines
3.7 KiB
Python
133 lines
3.7 KiB
Python
from datasette import hookimpl
|
|
from datasette.permissions import Action
|
|
from datasette.resources import (
|
|
InstanceResource,
|
|
DatabaseResource,
|
|
TableResource,
|
|
QueryResource,
|
|
)
|
|
|
|
|
|
@hookimpl
|
|
def register_actions():
|
|
"""Register the core Datasette actions."""
|
|
return (
|
|
# View actions
|
|
Action(
|
|
name="view-instance",
|
|
abbr="vi",
|
|
description="View Datasette instance",
|
|
takes_parent=False,
|
|
takes_child=False,
|
|
resource_class=InstanceResource,
|
|
),
|
|
Action(
|
|
name="view-database",
|
|
abbr="vd",
|
|
description="View database",
|
|
takes_parent=True,
|
|
takes_child=False,
|
|
resource_class=DatabaseResource,
|
|
),
|
|
Action(
|
|
name="view-database-download",
|
|
abbr="vdd",
|
|
description="Download database file",
|
|
takes_parent=True,
|
|
takes_child=False,
|
|
resource_class=DatabaseResource,
|
|
also_requires="view-database",
|
|
),
|
|
Action(
|
|
name="view-table",
|
|
abbr="vt",
|
|
description="View table",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
Action(
|
|
name="view-query",
|
|
abbr="vq",
|
|
description="View named query results",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=QueryResource,
|
|
),
|
|
Action(
|
|
name="execute-sql",
|
|
abbr="es",
|
|
description="Execute read-only SQL queries",
|
|
takes_parent=True,
|
|
takes_child=False,
|
|
resource_class=DatabaseResource,
|
|
also_requires="view-database",
|
|
),
|
|
# Debug actions
|
|
Action(
|
|
name="permissions-debug",
|
|
abbr="pd",
|
|
description="Access permission debug tool",
|
|
takes_parent=False,
|
|
takes_child=False,
|
|
resource_class=InstanceResource,
|
|
),
|
|
Action(
|
|
name="debug-menu",
|
|
abbr="dm",
|
|
description="View debug menu items",
|
|
takes_parent=False,
|
|
takes_child=False,
|
|
resource_class=InstanceResource,
|
|
),
|
|
# Write actions on tables
|
|
Action(
|
|
name="insert-row",
|
|
abbr="ir",
|
|
description="Insert rows",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
Action(
|
|
name="delete-row",
|
|
abbr="dr",
|
|
description="Delete rows",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
Action(
|
|
name="update-row",
|
|
abbr="ur",
|
|
description="Update rows",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
Action(
|
|
name="alter-table",
|
|
abbr="at",
|
|
description="Alter tables",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
Action(
|
|
name="drop-table",
|
|
abbr="dt",
|
|
description="Drop tables",
|
|
takes_parent=True,
|
|
takes_child=True,
|
|
resource_class=TableResource,
|
|
),
|
|
# Schema actions on databases
|
|
Action(
|
|
name="create-table",
|
|
abbr="ct",
|
|
description="Create tables",
|
|
takes_parent=True,
|
|
takes_child=False,
|
|
resource_class=DatabaseResource,
|
|
),
|
|
)
|