remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-27 04:14:25 +02:00
Code Issues Projects Releases Packages Wiki Activity

Limit derived-table permissions to one source hop

Browse source 
Simplify the solution to 5de0c1724e - avoid contextvar.
This commit is contained in:
Simon Willison 2026-09-10 15:46:12 -07:00
commit 92c7d4b608
9 changed files with 235 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tests/test_api.py
View file

@ -102,14 +102,11 @@ async def test_database_page(ds_client):
"tags",
}
# Expected hidden tables
# The external-content index is visible, but its shadow tables need a
# second dependency hop and are excluded by the one-hop permission policy.
expected_hidden_tables = {
"no_primary_key",
"searchable_fts",
"searchable_fts_config",
"searchable_fts_data",
"searchable_fts_docsize",
"searchable_fts_idx",
}
# Verify all expected tables exist