https://github.com/simonw/datasette/milestone/27?closed=1

https://github.com/simonw/datasette/compare/1.0a1...9ad76d279e2c3874ca5070626a25458ce129f126

See also: - #1924

It turns out I want to be able to call /db/-/create multiple times with the rows argument, so that I don't have to worry about creating the table first.

As such I find myself wanting support for the "insert": true and "replace": true options as well.

Still TODO:

• [x] A test for the case where you call /-/create twice with rows without using these options
• [x] pk should be required if you are using these options
• [x] Error if you pass pk and the table exists already but has a different pk
• [x] Documentation for insert and replace - and what happens if you repeat a /-/create with rows generally
• [x] Documentation should explain that you are allowed to call /-/create more than once using rows.

Otherwise someone with create-table but noinsert-rows permission could abuse it to insert data.

This code currently assumes abbreviations are:

pyton action_initials = "".join([word[0] for word in action.split("-")])

https://github.com/simonw/datasette/blob/1a3dcf494376e32f7cff110c86a88e5b0a3f3924/datasette/default_permissions.py#L182-L208

That's no longer correct, they are now registered by the new plugin hook: - #1939

Split from: - #1855

I need this for: - #1947

And I can refactor this to use it too: - #1855

By making this a documented internal API it can be used by other plugins too. It's also going to be really useful for writing tests.

Initial design ideas: https://github.com/simonw/datasette/issues/1852#issuecomment-1289733483

Token design concept:

json { "t": { "a": ["ir", "ur", "dr"], "d": { "fixtures": ["ir", "ur", "dr"] }, "t": { "fixtures": { "searchable": ["ir"] } } } }

That JSON would be minified and signed.

Minified version of the above looks like this (101 characters):

{"t":{"a":["ir","ur","dr"],"d":{"fixtures":["ir","ur","dr"]},"t":{"fixtures":{"searchable":["ir"]}}}}

The "t" key shows this is a token that as a default API key.

"a" means "all" - these are permissions that have been granted on all tables and databases.

"d" means "databases" - this is a way to set permissions for all tables in a specific database.

"t" means "tables" - this lets you set permissions at a finely grained table level.

Then the permissions themselves are two character codes which are shortened versions - so:

• ir = insert-row
• ur = update-row
• dr = delete-row

Remaining tasks

• [x] Add these options to the datasette create-token command
• [x] Tests for datasette create-token options
• [x] Documentation for those options at https://docs.datasette.io/en/latest/authentication.html#datasette-create-token
• [x] A way to handle permissions that don't have known abbreviations (permissions added by plugins). Probably need to solve the plugin permission registration problem as part of that
• [x] Stop hard-coding names of actions in the permission_allowed_actor_restrictions function

For the tests for datasette create-token it would be useful if datasette --get had a mechanism for sending an Authorization: Bearer X header.

Originally posted by @simonw in https://github.com/simonw/datasette/issues/1855#issuecomment-1347731288

Spotted this while testing:

• 1855

  export TOKEN=$(datasette create-token root --secret s -a foo) curl -H "Authorization: Bearer $TOKEN" http://localhost:8002/-/actor.json Returned a Forbidden error (and not in JSON either).

The "allow" block mechanism can already be used to configure various default permissions. When adding permissions to datasette-tiddlywiki I realized it would be good to be able to configure arbitrary permissions such as edit-tiddlywiki there too.

A plugin hook that adds more named permissions to the list which is initially populated here:

https://github.com/simonw/datasette/blob/e539c1c024bc62d88df91d9107cbe37e7f0fe55f/datasette/permissions.py#L1-L19

Originally imagined this hook in this comment:

• https://github.com/simonw/datasette/issues/1881#issuecomment-1301639370

I need this for a few reasons:

• https://github.com/simonw/datasette/issues/1636
• Needs it in order to validate that permissions defined in metadata.json are set in the right place (don't set an instance permissions at table level for example)
• https://github.com/simonw/datasette/issues/1855
• Needs it to be able to register additional abbreviations for use in signed cookies
• And for validation when you use datasette create-token and pass in extra permissions
• The https://latest.datasette.io/-/permissions debug interface needs it to add extra debug options to the <select>

Equivalent to sqlite-utils upsert: https://sqlite-utils.datasette.io/en/stable/python-api.html#upserting-data