remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-20 15:34:05 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,503 commits 196 branches 183 tags 373 MiB
Commit graph

1,483 commits

Author SHA1 Message Date
Simon Willison
c82a98c88a Refactor the create table dialog to use the shared modal, refs #2790 2026-09-17 13:28:25 -07:00
Simon Willison
de37f1451f Refactor the column type dialog to use the shared modal, refs #2790 2026-09-17 13:28:24 -07:00
Simon Willison
17b19b4d27 Refactor mobile column actions to use the shared modal, refs #2790 2026-09-17 13:28:24 -07:00
Simon Willison
328b2e6c6f Refactor the column chooser to use the shared modal, refs #2790 2026-09-17 13:28:24 -07:00
Simon Willison
c410ed9555 Refactor navigation search to use the shared modal, refs #2790 2026-09-17 13:28:23 -07:00
Simon Willison
e1f89494f1 Add reusable modal component, documentation and lifecycle tests, refs #2790 2026-09-17 13:28:23 -07:00
Simon Willison
3239d10b9b Use cog to show default values in settings.rst 2026-09-17 12:30:47 -07:00
Simon Willison
9cdf95ac2c Show correct query timings, closes #2446 2026-09-16 21:23:54 -07:00
Simon Willison
caf238aac8 Fix for GHSA-h547-rmjf-5m2m 2026-09-16 16:43:34 -07:00
Simon Willison
d2098e9f84
 		Fix facet selection for explicit exact filters 
`colname__exact=value` is now treated the same as `colname=value` when determining which facets are selected.

Closes #1695
 2026-09-16 14:56:09 -07:00
Simon Willison
266eaddb73
 		Fix remaining pytest warnings (#2928) 
- Close in-memory database connections, including reads opened on threads
- Close completed and partial file upload file handles
- Close SQLite connections and file handles owned by tests
 2026-09-16 14:50:06 -07:00
Simon Willison
0d0bb5dd8c
 		Merge branch 'main' into codex/test-write-wrapper-alter-rollback 2026-09-16 14:42:20 -07:00
Simon Willison
6c119323d0 Keep alter-table changes rollbackable by write wrappers 2026-09-16 14:40:50 -07:00
Simon Willison
6dd5297b34
 		Allow extra_template_vars to resolve to None 
Closes #2005
 2026-09-16 10:30:11 -07:00
Simon Willison
df4c0fde0f
 		Make request header lookups case-insensitive 
Closes #1861
 2026-09-16 10:27:35 -07:00
Simon Willison
faff4c8820 Return CSV errors as plain text, closes #2129 2026-09-15 15:53:10 -07:00
Rami Abdelrazzaq
82ed8d47f9
 		Fix float coercion for numeric filter parameters (#2876) 
Closes #1681
 2026-09-15 13:14:29 -07:00
AnkitaAdvitot
920adc6880
 		Fix infinite loop when streaming CSV on SQL views, fixes #2902 (#2903) 
When streaming a view as CSV with ?_stream=on, _next was being
re-read from request.args, overwriting the kwarg passed by the
streaming loop with None. This caused the pagination offset to stay
stuck on page 1 forever.
 2026-09-15 12:57:09 -07:00
Simon Willison
b09976b924 Tests for table count endpoint, refs #2914 
Forgot to include these tests in commit 1538832830
 2026-09-15 12:21:36 -07:00
Alex Garcia
374b194ff5
 		Add /-/tasks introspection endpoint for supervised background tasks (#2892) 
Co-authored-by: Simon Willison <swillison@gmail.com>
 2026-09-15 11:56:53 -07:00
Alex Garcia
784695aea6 Ensure startup() runs before any plugin ASGI middleware (#2891) 2026-09-15 11:22:45 -07:00
Alex Garcia
cca08d2886 Add shutdown() plugin hook with ordered graceful teardown (#2890) 2026-09-15 11:09:57 -07:00
Alex Garcia
0c31778580 Add datasette.add_background_task() with supervised launch after startup (#2889) 2026-09-15 10:55:54 -07:00
Simon Willison
b0407867cc Tweak display of count all button, refs #2914 2026-09-15 10:16:16 -07:00
Simon Willison
1538832830 /db/table/-/count? endpoint, fixed 'count all' button 
Closes #2914
 2026-09-15 10:03:17 -07:00
Simon Willison
b338c6f5f6
 		Migrate from httpx to httpx2, closes #2879 
https://claude.ai/code/session_01Xdqoneq8ddvruVZETo6rFf
 2026-09-10 19:44:49 -07:00
Simon Willison
92c7d4b608 Limit derived-table permissions to one source hop 
Simplify the solution to 5de0c1724e - avoid contextvar.
 2026-09-10 16:52:52 -07:00
Simon Willison
f70edbfa60 Filter incoming foreign-key relationships by view permission 2026-09-10 16:52:52 -07:00
Simon Willison
b97bb5f016 Reconcile write-timeout regression with the per-call limit 2026-09-10 16:52:26 -07:00
Simon Willison
e036907fc3 Reject structured row writes to virtual and shadow tables 2026-09-10 16:52:25 -07:00
Simon Willison
3f8d8417f6 Inherit source permissions for FTS vocabulary tables 2026-09-10 16:52:25 -07:00
Simon Willison
d334539a1e Deny SQLite statistics table access through a default hook 2026-09-10 16:52:25 -07:00
Simon Willison
506c4bb522 Match table permission identities using SQLite case semantics 2026-09-09 08:39:03 -07:00
Alex Garcia
c6ba7b3298 Refuse API token creation from restricted actors 2026-09-09 08:38:40 -07:00
Simon Willison
ceef351622 Protect personalized dynamic responses from shared caching 2026-09-08 21:16:36 -07:00
Simon Willison
6aa58bf4e5 Authorize configured full-text search targets 2026-09-08 21:16:35 -07:00
Simon Willison
c01e95f3bd Filter foreign-key helper targets by view permission 2026-09-08 21:14:10 -07:00
Simon Willison
5de0c1724e Viewing derived table requires permission for both table and its source 
Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 18:09:23 -07:00
Simon Willison
d06737b6f4 Fix CREATE VIEW analysis on Python 3.10 2026-09-08 10:49:52 -07:00
Simon Willison
3ae092896d Only allow /db/name/-/schema against tables and views 
Refs GHSA-926p-cw2f-643h

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:20 -07:00
Simon Willison
5d9a74f370 Check view-table as part of /-/schema and /db/-/schema 
Refs GHSA-926p-cw2f-643h

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
01bf476d51 Require view-instance permission for /-/allowed 
Refs GHSA-hp2x-vx2r-6vxg

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
f8e8e65af7 actor cookie respects expire_after 
Refs GHSA-53fc-rhfg-h7qp

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
577aeb73f0 Disallow ?_through= if user lacks view-table permission 
Refs GHSA-53fc-rhfg-h7qp

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
c280c47424 POST /db/-/create checks table-level insert/update/alter permissions 
Refs GHSA-53fc-rhfg-h7qp

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
4d0a2f2e84 execute-write: Check view-table for every table in a CREATE VIEW 
Refs GHSA-53fc-rhfg-h7qp

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Simon Willison
bdaa8cc76c Disable extension loading once --load-extension extensions are loaded 
Refs GHSA-2mvv-ffvc-q5p6

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
 2026-09-08 10:48:19 -07:00
Zain Dana Harper
7403ae68bb Give each non-blocking write a distinct task id, refs #2860, #2859 
execute_write_fn(fn, block=False) is documented to return "a UUID representing
the queued task". Two things stopped that being true.

_send_to_write_thread() derived the id from uuid.uuid5(NAMESPACE_DNS,
"datasette.io"), which is deterministic, so every non-blocking write in every
database in every process returned 3f143baa-4e3d-5842-a36f-4fa2f683b72f. A
constant cannot identify a particular task. Now uuid4(). Refs #2860.

With num_sql_threads=0 there is no write thread, so execute_write_fn took the
synchronous branch and `result` was the write function's return value, normally
None. The block=False path then unpacked it unconditionally and raised
TypeError: cannot unpack non-iterable NoneType object. The non-threaded branch
now returns the same (task_id, reply_future) shape, with the future already
resolved because the write has finished, so both modes share one code path.
Refs #2859.

test_execute_write_fn_block_false only asserted isinstance(task_id, uuid.UUID),
which a constant satisfies. The new test is parametrized over threaded and
non-threaded and asserts two calls return different ids, so either regression
fails it.
 2026-09-08 10:03:52 -07:00
Alex Garcia
3e018bb1b5
 		Run startup via ASGI lifespan instead of waiting for the first request (#2887) 
* Run startup via ASGI lifespan instead of waiting for the first request
* Ensure immutable table counts still precompute when startup ran first
 2026-09-01 09:39:25 -07:00
Alex Garcia
e78b8a2e6a
 		Run datasette serve startup and uvicorn on a single event loop (#2886) 
* Run datasette serve startup and uvicorn on a single event loop
* Move the serve-subprocess test plumbing into a conftest fixture
* Fix datasette-litestream URL and trim marker-task test comments
* Explain why serve_with_plugins needs a subprocess and plugin files
* Apply ruff 0.16 and black fixes
* Tweaked some comments
 2026-09-01 09:32:37 -07:00