{"html_url": "https://github.com/simonw/datasette/issues/1848#issuecomment-1288340476", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1848", "id": 1288340476, "node_id": "IC_kwDOBm6k_c5MyoP8", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-10-24T02:50:29Z", "updated_at": "2022-10-24T02:50:29Z", "author_association": "OWNER", "body": "https://latest.datasette.io/_internal now looks like this:\r\n\r\n<img width=\"771\" alt=\"image\" src=\"https://user-images.githubusercontent.com/9599/197439086-25d02a4f-3831-42bc-8097-c487290d7c32.png\">\r\n", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1420090659, "label": "Private database page should show padlock on every table"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1848#issuecomment-1288330238", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1848", "id": 1288330238, "node_id": "IC_kwDOBm6k_c5Mylv-", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-10-24T02:34:41Z", "updated_at": "2022-10-24T02:34:41Z", "author_association": "OWNER", "body": "Tested my fix with this `metadata.yml`:\r\n```yaml\r\ndatabases:\r\n  fixtures:\r\n   allow:\r\n     id: root\r\n   tables:\r\n     123_starts_with_digits:\r\n       allow: true\r\n```\r\nSigned in as root I saw this - showing that the `123_starts_with_digits` table is public:\r\n\r\n<img width=\"730\" alt=\"image\" src=\"https://user-images.githubusercontent.com/9599/197437398-7397ce64-c4f5-41b9-93ec-f7e3623e39ad.png\">\r\n\r\n", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1420090659, "label": "Private database page should show padlock on every table"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1848#issuecomment-1288327467", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1848", "id": 1288327467, "node_id": "IC_kwDOBm6k_c5MylEr", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-10-24T02:30:48Z", "updated_at": "2022-10-24T02:31:04Z", "author_association": "OWNER", "body": "Here's the code at fault: https://github.com/simonw/datasette/blob/78dad236df730212aa7172f885fd8ec575f0d3ad/datasette/views/database.py#L67-L116\r\n\r\nThose checks aren't doing the new cascading permissions thing added in #1829 which means they can't tell that an anonymous user would not be able to se those tbles and queries and views.\r\n\r\nShould do something like this instead:\r\n\r\n```python\r\nview_visible, view_private = await self.ds.check_visibility(\r\n    request.actor,\r\n    permissions=[\r\n        (\"view-table\", (database, view_name)),\r\n        (\"view-database\", database),\r\n        \"view-instance\",\r\n    ],\r\n)\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1420090659, "label": "Private database page should show padlock on every table"}, "performed_via_github_app": null}