github
id | node_id | number | title | user | state | locked | assignee | milestone | comments | created_at | updated_at | closed_at | author_association | pull_request | body | repo | type | active_lock_reason | performed_via_github_app | reactions | draft | state_reason |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1497577017 | I_kwDOBm6k_c5ZQzY5 | 1957 | Reconsider row value truncation on query page | 9599 | open | 0 | 1 | 2022-12-14T23:49:47Z | 2022-12-14T23:50:50Z | OWNER | Consider this example: https://ripgrep.datasette.io/repos?sql=select+json_group_array%28full_name%29+from+repos ```sql select json_group_array(full_name) from repos ``` ![CleanShot 2022-12-14 at 15 48 32@2x](https://user-images.githubusercontent.com/9599/207739709-8177f683-f938-49a1-8225-42791fad88fe.png) My intention here was to get a string of JSON I can copy and paste elsewhere - see: https://til.simonwillison.net/sqlite/compare-before-after-json The truncation isn't helping here. | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1957/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
||||||||
855296937 | MDU6SXNzdWU4NTUyOTY5Mzc= | 1295 | Errors should have links to further information | 9599 | open | 0 | 2 | 2021-04-11T12:39:12Z | 2022-12-14T23:28:49Z | OWNER | Inspired by this tweet: https://twitter.com/willmcgugan/status/1381186384510255104 > While I am thinking about faqs. I’d also like to add short URLs to Rich exceptions. > > I loath cryptic error messages, and I’ve created a fair few myself. In Rich I’ve tried to make them as plain English as possible. But... > > would be great if every error message linked to a page that explains the error in detail and offers fixes. | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1295/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
||||||||
1483320357 | I_kwDOBm6k_c5Yaawl | 1937 | /db/-/create API should require insert-rows permission to use row: or rows: option | 9599 | closed | 0 | 8711695 | 2 | 2022-12-08T01:33:09Z | 2022-12-14T20:21:26Z | 2022-12-14T20:21:26Z | OWNER | Otherwise someone with `create-table` but no` insert-rows` permission could abuse it to insert data. | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1937/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
completed | |||||
1497288666 | I_kwDOBm6k_c5ZPs_a | 1956 | Handle abbreviations properly in permission_allowed_actor_restrictions | 9599 | closed | 0 | 8711695 | 2 | 2022-12-14T19:54:21Z | 2022-12-14T20:04:29Z | 2022-12-14T20:04:28Z | OWNER | This code currently assumes abbreviations are: ```pyton action_initials = "".join([word[0] for word in action.split("-")]) ``` https://github.com/simonw/datasette/blob/1a3dcf494376e32f7cff110c86a88e5b0a3f3924/datasette/default_permissions.py#L182-L208 That's no longer correct, they are now registered by the new plugin hook: - #1939 | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1956/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
completed | |||||
1495716243 | I_kwDOBm6k_c5ZJtGT | 1952 | Improvements to /-/create-token restrictions interface | 9599 | open | 0 | 8755003 | 1 | 2022-12-14T05:22:39Z | 2022-12-14T05:23:13Z | OWNER | > It would be neat not to show write permissions against immutable databases too - and not hard from a performance perspective since it doesn't involve hundreds more permission checks. > > That will need permissions to grow a flag for if they need a mutable database though, which is a bigger job. _Originally posted by @simonw in https://github.com/simonw/datasette/issues/1947#issuecomment-1350414402_ Also, DO show the `_memory` database there if Datasette was started in `--crossdb` mode. | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1952/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
|||||||
1493390939 | I_kwDOBm6k_c5ZA1Zb | 1947 | UI to create reduced scope tokens from the `/-/create-token` page | 9599 | closed | 0 | 8711695 | 22 | 2022-12-13T05:10:48Z | 2022-12-14T05:22:00Z | 2022-12-14T05:13:24Z | OWNER | Split from: - #1855 | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1947/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
completed | |||||
1495431932 | I_kwDOBm6k_c5ZInr8 | 1951 | `datasette.create_token(...)` method for creating signed API tokens | 9599 | closed | 0 | 8711695 | 6 | 2022-12-14T01:25:34Z | 2022-12-14T02:43:45Z | 2022-12-14T02:42:05Z | OWNER | I need this for: - #1947 And I can refactor this to use it too: - #1855 By making this a documented internal API it can be used by other plugins too. It's also going to be really useful for writing tests. | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1951/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
completed | |||||
1423336089 | I_kwDOBm6k_c5U1mKZ | 1855 | `datasette create-token` ability to create tokens with a reduced set of permissions | 9599 | closed | 0 | 8711695 | 19 | 2022-10-26T02:20:52Z | 2022-12-14T01:24:49Z | 2022-12-13T05:20:24Z | OWNER | Initial design ideas: https://github.com/simonw/datasette/issues/1852#issuecomment-1289733483 > Token design concept: > > ```json > { > "t": { > "a": ["ir", "ur", "dr"], > "d": { > "fixtures": ["ir", "ur", "dr"] > }, > "t": { > "fixtures": { > "searchable": ["ir"] > } > } > } > } > ``` > > That JSON would be minified and signed. > > Minified version of the above looks like this (101 characters): > > `{"t":{"a":["ir","ur","dr"],"d":{"fixtures":["ir","ur","dr"]},"t":{"fixtures":{"searchable":["ir"]}}}}` > > The `"t"` key shows this is a token that as a default API key. > > `"a"` means "all" - these are permissions that have been granted on all tables and databases. > > `"d"` means "databases" - this is a way to set permissions for all tables in a specific database. > > `"t"` means "tables" - this lets you set permissions at a finely grained table level. > > Then the permissions themselves are two character codes which are shortened versions - so: > > * `ir` = `insert-row` > * `ur` = `update-row` > * `dr` = `delete-row` ## Remaining tasks - [x] Add these options to the `datasette create-token` command - [x] Tests for `datasette create-token` options - [x] Documentation for those options at https://docs.datasette.io/en/latest/authentication.html#datasette-create-token - [x] A way to handle permissions that don't have known abbreviations (permissions added by plugins). Probably need to solve the plugin permission registration problem as part of that - [x] Stop hard-coding names of actions in the `permission_allowed_actor_restrictions` function | 107914493 | issue | { "url": "https://api.github.com/repos/simonw/datasette/issues/1855/reactions", "total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0 } |
completed |