remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-05-28 04:46:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Clarifying comments

Browse source
This commit is contained in:
Simon Willison 2026-05-26 12:46:18 -07:00
commit 866852eff6
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
datasette/default_permissions/defaults.py
View file

@ -80,6 +80,7 @@ async def default_query_permissions_sql(
if action in {"update-query", "delete-query"}:
if actor_id is None:
return None
# Query owner can update/delete query
return PermissionSQL(
sql="""
SELECT database_name AS parent, name AS child, 1 AS allow,
@ -97,15 +98,15 @@ async def default_query_permissions_sql(
params = {"query_owner_id": actor_id}
rule_sqls = []
if actor_id is not None:
rule_sqls.append(
"""
# Query owner can view-query
rule_sqls.append("""
SELECT database_name AS parent, name AS child, 1 AS allow,
'query owner' AS reason
FROM queries
WHERE owner_id = :query_owner_id
"""
)
""")
# restriction_sql enforces private queries ONLY visible to owner
return PermissionSQL(
sql="\nUNION ALL\n".join(rule_sqls) if rule_sqls else None,
restriction_sql="""