mirror of
https://github.com/simonw/datasette.git
synced 2026-06-08 01:56:59 +02:00
7db754c284
This introduces a new hierarchical permission system that uses SQL queries
for efficient permission checking across resources. The system replaces the
older permission_allowed() pattern with a more flexible resource-based
approach.
Core changes:
- New Resource ABC and Action dataclass in datasette/permissions.py
* Resources represent hierarchical entities (instance, database, table)
* Each resource type implements resources_sql() to list all instances
* Actions define operations on resources with cascading rules
- New plugin hook: register_actions(datasette)
* Plugins register actions with their associated resource types
* Replaces register_permissions() and register_resource_types()
* See docs/plugin_hooks.rst for full documentation
- Three new Datasette methods for permission checks:
* allowed_resources(action, actor) - returns list[Resource]
* allowed_resources_with_reasons(action, actor) - for debugging
* allowed(action, resource, actor) - checks single resource
* All use SQL for filtering, never Python iteration
- New /-/tables endpoint (TablesView)
* Returns JSON list of tables user can view
* Supports ?q= parameter for regex filtering
* Format: {"matches": [{"name": "db/table", "url": "/db/table"}]}
* Respects all permission rules from configuration and plugins
- SQL-based permission evaluation (datasette/utils/actions_sql.py)
* Cascading rules: child-level → parent-level → global-level
* DENY beats ALLOW at same specificity
* Uses CTEs for efficient SQL-only filtering
* Combines permission_resources_sql() hook results
- Default actions in datasette/default_actions.py
* InstanceResource, DatabaseResource, TableResource, QueryResource
* Core actions: view-instance, view-database, view-table, etc.
- Fixed default_permissions.py to handle database-level allow blocks
* Now creates parent-level rules for view-table action
* Fixes: datasette ... -s databases.fixtures.allow.id root
Documentation:
- Comprehensive register_actions() hook documentation
- Detailed resources_sql() method explanation
- /-/tables endpoint documentation in docs/introspection.rst
- Deprecated register_permissions() with migration guide
Tests:
- tests/test_actions_sql.py: 7 tests for core permission API
- tests/test_tables_endpoint.py: 13 tests for /-/tables endpoint
- All 118 documentation tests pass
- Tests verify SQL does filtering (not Python)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
121 lines
4 KiB
Python
121 lines
4 KiB
Python
import importlib
|
|
import os
|
|
import pluggy
|
|
from pprint import pprint
|
|
import sys
|
|
from . import hookspecs
|
|
|
|
if sys.version_info >= (3, 9):
|
|
import importlib.resources as importlib_resources
|
|
else:
|
|
import importlib_resources
|
|
if sys.version_info >= (3, 10):
|
|
import importlib.metadata as importlib_metadata
|
|
else:
|
|
import importlib_metadata
|
|
|
|
|
|
DEFAULT_PLUGINS = (
|
|
"datasette.publish.heroku",
|
|
"datasette.publish.cloudrun",
|
|
"datasette.facets",
|
|
"datasette.filters",
|
|
"datasette.sql_functions",
|
|
"datasette.actor_auth_cookie",
|
|
"datasette.default_permissions",
|
|
"datasette.default_actions",
|
|
"datasette.default_magic_parameters",
|
|
"datasette.blob_renderer",
|
|
"datasette.default_menu_links",
|
|
"datasette.handle_exception",
|
|
"datasette.forbidden",
|
|
"datasette.events",
|
|
)
|
|
|
|
pm = pluggy.PluginManager("datasette")
|
|
pm.add_hookspecs(hookspecs)
|
|
|
|
DATASETTE_TRACE_PLUGINS = os.environ.get("DATASETTE_TRACE_PLUGINS", None)
|
|
|
|
|
|
def before(hook_name, hook_impls, kwargs):
|
|
print(file=sys.stderr)
|
|
print(f"{hook_name}:", file=sys.stderr)
|
|
pprint(kwargs, width=40, indent=4, stream=sys.stderr)
|
|
print("Hook implementations:", file=sys.stderr)
|
|
pprint(hook_impls, width=40, indent=4, stream=sys.stderr)
|
|
|
|
|
|
def after(outcome, hook_name, hook_impls, kwargs):
|
|
results = outcome.get_result()
|
|
if not isinstance(results, list):
|
|
results = [results]
|
|
print(f"Results:", file=sys.stderr)
|
|
pprint(results, width=40, indent=4, stream=sys.stderr)
|
|
|
|
|
|
if DATASETTE_TRACE_PLUGINS:
|
|
pm.add_hookcall_monitoring(before, after)
|
|
|
|
|
|
DATASETTE_LOAD_PLUGINS = os.environ.get("DATASETTE_LOAD_PLUGINS", None)
|
|
|
|
if not hasattr(sys, "_called_from_test") and DATASETTE_LOAD_PLUGINS is None:
|
|
# Only load plugins if not running tests
|
|
pm.load_setuptools_entrypoints("datasette")
|
|
|
|
# Load any plugins specified in DATASETTE_LOAD_PLUGINS")
|
|
if DATASETTE_LOAD_PLUGINS is not None:
|
|
for package_name in [
|
|
name for name in DATASETTE_LOAD_PLUGINS.split(",") if name.strip()
|
|
]:
|
|
try:
|
|
distribution = importlib_metadata.distribution(package_name)
|
|
entry_points = distribution.entry_points
|
|
for entry_point in entry_points:
|
|
if entry_point.group == "datasette":
|
|
mod = entry_point.load()
|
|
pm.register(mod, name=entry_point.name)
|
|
# Ensure name can be found in plugin_to_distinfo later:
|
|
pm._plugin_distinfo.append((mod, distribution))
|
|
except importlib_metadata.PackageNotFoundError:
|
|
sys.stderr.write("Plugin {} could not be found\n".format(package_name))
|
|
|
|
|
|
# Load default plugins
|
|
for plugin in DEFAULT_PLUGINS:
|
|
mod = importlib.import_module(plugin)
|
|
pm.register(mod, plugin)
|
|
|
|
|
|
def get_plugins():
|
|
plugins = []
|
|
plugin_to_distinfo = dict(pm.list_plugin_distinfo())
|
|
for plugin in pm.get_plugins():
|
|
static_path = None
|
|
templates_path = None
|
|
if plugin.__name__ not in DEFAULT_PLUGINS:
|
|
try:
|
|
if (importlib_resources.files(plugin.__name__) / "static").is_dir():
|
|
static_path = str(
|
|
importlib_resources.files(plugin.__name__) / "static"
|
|
)
|
|
if (importlib_resources.files(plugin.__name__) / "templates").is_dir():
|
|
templates_path = str(
|
|
importlib_resources.files(plugin.__name__) / "templates"
|
|
)
|
|
except (TypeError, ModuleNotFoundError):
|
|
# Caused by --plugins_dir= plugins
|
|
pass
|
|
plugin_info = {
|
|
"name": plugin.__name__,
|
|
"static_path": static_path,
|
|
"templates_path": templates_path,
|
|
"hooks": [h.name for h in pm.get_hookcallers(plugin)],
|
|
}
|
|
distinfo = plugin_to_distinfo.get(plugin)
|
|
if distinfo:
|
|
plugin_info["version"] = distinfo.version
|
|
plugin_info["name"] = distinfo.name or distinfo.project_name
|
|
plugins.append(plugin_info)
|
|
return plugins
|