Replace restrict_all/restrict_database/restrict_resource with TokenRestrictions dataclass

Consolidates the three separate restriction parameters into a single
TokenRestrictions dataclass in datasette.permissions. Updates all call
sites: Datasette.create_signed_token(), Datasette.create_token(),
build_token_restrictions(), the create_token hook spec, CreateTokenEvent,
the CLI, and the create-token view.

https://claude.ai/code/session_012TFFCamoYLTofV2vCgPrjV
This commit is contained in:
Claude 2026-02-25 03:21:29 +00:00
commit 4f89b77782
No known key found for this signature in database
9 changed files with 90 additions and 77 deletions

View file

@ -1,4 +1,5 @@
from datasette.app import Datasette
from datasette.permissions import TokenRestrictions
from datasette.utils import sqlite3
from .utils import last_event
import pytest
@ -1362,7 +1363,7 @@ async def test_create_table(
async def test_create_table_permissions(
ds_write, permissions, body, expected_status, expected_errors
):
token = ds_write.create_signed_token("root", restrict_all=["view-instance"] + permissions)
token = ds_write.create_signed_token("root", restrictions=TokenRestrictions(all=["view-instance"] + permissions, database={}, resource={}))
response = await ds_write.client.post(
"/data/-/create",
json=body,