remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-10-08 02:17:01 +02:00
Code Issues Projects Releases Packages Wiki Activity

Viewing derived table requires permission for both table and its source

Browse source 
Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-08 18:09:23 -07:00 • committed by GitHub
commit 5de0c1724e
5 changed files with 650 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

41
tests/test_utils.py
View file

@ -16,6 +16,7 @@ from datasette.app import Datasette
from datasette.utils.asgi import Request
from datasette.utils.sqlite import (
sqlite3,
sqlite_derived_table_dependencies,
sqlite_hidden_table_names,
sqlite_table_type,
supports_returning,
@ -369,6 +370,46 @@ def test_sqlite_hidden_table_names_hides_multiline_content_fts_table():
conn.close()
def test_sqlite_derived_table_dependencies():
conn = utils.sqlite3.connect(":memory:")
try:
conn.executescript("""
create table docs(id integer primary key, body text);
create virtual table external_fts5 using fts5(
body, content='docs', content_rowid='id'
);
create virtual table internal_fts5 using fts5(body);
create virtual table contentless_fts5 using fts5(body, content='');
create virtual table external_fts4 using fts4(body, content="docs");
create virtual table internal_fts4 using fts4(body);
create virtual table contentless_fts4 using fts4(body, content="");
create table [docs, archive](body text);
create virtual table commented_fts5 using fts5(
body, tokenize='porter unicode61',
/* Comments and commas in quoted values must not confuse parsing. */
content='docs, archive'
);
create virtual table boxes using rtree(id, minx, maxx, miny, maxy);
""")
dependencies = sqlite_derived_table_dependencies(conn)
assert dependencies["external_fts5"] == "docs"
assert dependencies["external_fts4"] == "docs"
assert dependencies["commented_fts5"] == "docs, archive"
assert "contentless_fts5" not in dependencies
assert "contentless_fts4" not in dependencies
assert dependencies["internal_fts5_content"] == "internal_fts5"
assert dependencies["internal_fts4_content"] == "internal_fts4"
assert dependencies["external_fts5_data"] == "external_fts5"
assert dependencies["external_fts4_segments"] == "external_fts4"
assert dependencies["boxes_node"] == "boxes"
assert dependencies["boxes_parent"] == "boxes"
assert dependencies["boxes_rowid"] == "boxes"
finally:
conn.close()
@pytest.mark.parametrize(
"url,expected",
[