issue_comments

First draft of documentation: https://datasette--1938.org.readthedocs.build/en/1938/authentication.html#other-permissions-in-metadata

Docs: https://datasette--1938.org.readthedocs.build/en/1938/authentication.html#other-permissions-in-metadata

What if you want to grant insert-row to a user for ALL tables in a database, or even for all tables in all databases?

You should be able to do that by putting that in the root permissions: block. Need to figure out how the implementation will handle that.

Also: there are some permissions like view-instance or debug-menu for which putting them at the database or table or query level doesn't actually make any sense.

Ideally the implementation would spot those on startup and refuse to start the server, with a helpful error message.

Thanks!

Basic version of this allows you to rename a table:

POST /db/table/-/rename { "name": "new_table_name" } If a table with that new name already exists you will get an error - unless you pass "replace": true in which case that table will be dropped and replaced by the new one.

POST /db/table/-/rename { "name": "new_table_name", "replace": true }

This is useful because it allows for that atomic replacement operation: upload brand new data into a _tmp_name table, then atomic rename and replace after the upload has completed.

I'm going to write the documentation for this first.

Running that twice produced this:

Related bug: you can send "id": null and it works (it should throw an error):

Check should go somewhere around here: https://github.com/simonw/datasette/blob/dee18ed8ce7af2ab8699bcb5a51a99f48301bc42/datasette/views/database.py#L625-L631

I broke this test: ``` ds_write = <datasette.app.Datasette object at 0x7f0965858700>

@pytest.mark.asyncio
async def test_insert_row(ds_write):
    token = write_token(ds_write)
    response = await ds_write.client.post(
        "/data/docs/-/insert",
        json={"row": {"title": "Test", "score": 1.2, "age": 5}},
        headers={
            "Authorization": "***".format(token),
            "Content-Type": "application/json",
        },
    )
    expected_row = {"id": 1, "title": "Test", "score": 1.2, "age": 5}

  assert response.status_code == 201

E assert 500 == 201 E + where 500 = <Response [500 Internal Server Error]>.status_code

/home/runner/work/datasette/datasette/tests/test_api_write.py:43: AssertionError ----------------------------- Captured stderr call ----------------------------- Traceback (most recent call last): File "/home/runner/work/datasette/datasette/datasette/app.py", line 1447, in route_path response = await view(request, send) File "/home/runner/work/datasette/datasette/datasette/views/base.py", line 151, in view return await self.dispatch_request(request) File "/home/runner/work/datasette/datasette/datasette/views/base.py", line 105, in dispatch_request response = await handler(request) File "/home/runner/work/datasette/datasette/datasette/views/table.py", line 1228, in post row_pk_values_for_later = [tuple(row[pk] for pk in pks) for row in rows] File "/home/runner/work/datasette/datasette/datasette/views/table.py", line 1228, in <listcomp> row_pk_values_for_later = [tuple(row[pk] for pk in pks) for row in rows] File "/home/runner/work/datasette/datasette/datasette/views/table.py", line 1228, in <genexpr> row_pk_values_for_later = [tuple(row[pk] for pk in pks) for row in rows] KeyError: 'id' ```

In the interests of shipping, I'm going to punt the API explorer to a later issue.