datasette/datasette
Simon Willison 82cc3d5c86 Migrate view-query permission to SQL-based system, refs #2510
This change integrates canned queries with Datasette's new SQL-based
permissions system by making the following changes:

1. **Default canned_queries plugin hook**: Added a new hookimpl in
   default_permissions.py that returns canned queries from datasette
   configuration. This extracts config-reading logic into a plugin hook,
   allowing QueryResource to discover all queries.

2. **Async resources_sql()**: Converted Resource.resources_sql() from a
   synchronous class method returning a string to an async method that
   receives the datasette instance. This allows QueryResource to call
   plugin hooks and query the database.

3. **QueryResource implementation**: Implemented QueryResource.resources_sql()
   to gather all canned queries by:
   - Querying catalog_databases for all databases
   - Calling canned_queries hooks for each database with actor=None
   - Building a UNION ALL SQL query of all (database, query_name) pairs
   - Properly escaping single quotes in resource names

4. **Simplified get_canned_queries()**: Removed config-reading logic since
   it's now handled by the default plugin hook.

5. **Added view-query to default allow**: Added "view-query" to the
   default_allow_actions set so canned queries are accessible by default.

6. **Removed xfail markers**: Removed test xfail markers from:
   - tests/test_canned_queries.py (entire module)
   - tests/test_html.py (2 tests)
   - tests/test_permissions.py (1 test)
   - tests/test_plugins.py (1 test)

All canned query tests now pass with the new permission system.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-25 15:38:07 -07:00
..
publish Use service-specific image ID for Cloud Run deploys, refs #2036 2023-03-08 12:25:55 -08:00
static Ran prettier 2025-10-25 15:38:07 -07:00
templates Add PermissionCheck dataclass with parent/child fields, refs #2528 2025-10-25 15:38:07 -07:00
utils Migrate view-query permission to SQL-based system, refs #2510 2025-10-25 15:38:07 -07:00
views Ran Black 2025-10-25 15:38:07 -07:00
__init__.py track_event() mechanism for analytics and plugins 2024-01-31 15:21:40 -08:00
__main__.py Add support for running datasette as a module (#556) 2019-07-11 09:07:44 -07:00
actor_auth_cookie.py Remove python-baseconv dependency, refs #1733, closes #1734 2022-05-02 12:39:06 -07:00
app.py Migrate view-query permission to SQL-based system, refs #2510 2025-10-25 15:38:07 -07:00
blob_renderer.py Rename route match groups for consistency, refs #1667, #1660 2022-03-19 09:52:08 -07:00
cli.py New --root mechanism with datasette.root_enabled, closes #2521 2025-10-24 10:32:18 -07:00
database.py Hide FTS tables that have content= 2025-04-16 21:44:09 -07:00
default_actions.py Fix view-database-download permission handling 2025-10-25 15:38:07 -07:00
default_magic_parameters.py Fix datetime.utcnow deprecation warning 2024-03-15 15:32:12 -07:00
default_menu_links.py Update permission hooks to include source_plugin column and simplify menu_links 2025-10-25 15:38:07 -07:00
default_permissions.py Migrate view-query permission to SQL-based system, refs #2510 2025-10-25 15:38:07 -07:00
events.py alter table support for /db/-/create API, refs #2101 2024-02-08 13:36:17 -08:00
facets.py Fix huge performance bug in DateFacet, refs #2407 2024-08-21 14:38:11 -07:00
filters.py Fix expand_foreign_keys and filters to use new check_visibility() and allowed() signatures 2025-10-25 15:38:07 -07:00
forbidden.py Fixed a bunch of unused imports spotted with ruff 2024-02-06 17:27:20 -08:00
handle_exception.py debugger: load 'ipdb' if present 2024-08-20 20:02:35 -07:00
hookspecs.py Remove permission_allowed hook entirely, refs #2528 2025-10-25 15:38:07 -07:00
inspect.py Modernize code to Python 3.6+ (#1158) 2020-12-23 09:04:32 -08:00
permissions.py Implement also_requires to enforce view-database for execute-sql 2025-10-24 12:14:52 -07:00
plugins.py Implement resource-based permission system with SQL-driven access control 2025-10-24 10:32:18 -07:00
renderer.py Move Metadata to --internal database 2024-06-11 09:33:23 -07:00
resources.py Migrate view-query permission to SQL-based system, refs #2510 2025-10-25 15:38:07 -07:00
sql_functions.py _search= queries now correctly escaped, fixes #651 2019-12-29 18:48:30 +00:00
tracer.py Tracer now catches errors, closes #2405 2024-08-21 12:19:18 -07:00
url_builder.py count all rows button on table page, refs #2408 2024-08-21 19:09:25 -07:00
version.py Release 1.0a19 2025-04-21 22:38:53 -07:00