{"html_url": "https://github.com/simonw/sqlite-utils/issues/358#issuecomment-1255332217", "issue_url": "https://api.github.com/repos/simonw/sqlite-utils/issues/358", "id": 1255332217, "node_id": "IC_kwDOCGYnMM5K0tl5", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-09-22T17:27:34Z", "updated_at": "2022-09-22T17:27:34Z", "author_association": "OWNER", "body": "I've been thinking about this more recently.\r\n\r\nI think the first place to explore these will be in the `create-table` command (and underlying APIs).\r\n\r\nRelevant docs: https://www.sqlite.org/lang_createtable.html#check_constraints\r\n\r\n> A CHECK constraint may be attached to a column definition or specified as a table constraint. In practice it makes no difference. Each time a new row is inserted into the table or an existing row is updated, the expression associated with each CHECK constraint is evaluated and cast to a NUMERIC value in the same way as a [CAST expression](https://www.sqlite.org/lang_expr.html#castexpr). If the result is zero (integer value 0 or real value 0.0), then a constraint violation has occurred. If the CHECK expression evaluates to NULL, or any other non-zero value, it is not a constraint violation. The expression of a CHECK constraint may not contain a subquery.\r\n\r\nSomething like this:\r\n\r\n    sqlite-utils create-table data.db entries id integer title text tags text --pk id --check tags:json\r\n\r\nWhere `--check tags:json` uses a pre-baked recipe for using the SQLite JSON function to check that the content is valid JSON and reject it otherwise.\r\n\r\nThen can bundle a bunch of other pre-baked recipes, but also support the following:\r\n\r\n    --check 'x > 3' --check 'length(phone) >= 10'\r\n\r\nThe besign reason for the `column:recipe` format here is to reuse `--check` for both pre-defined recipes that affect a single column AND for freeform expressions that get added to the end of the table.\r\n\r\nDetecting `column name:recipe` with a regex feels safe to me.", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1082651698, "label": "Support for CHECK constraints"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/sqlite-utils/issues/358#issuecomment-1255333969", "issue_url": "https://api.github.com/repos/simonw/sqlite-utils/issues/358", "id": 1255333969, "node_id": "IC_kwDOCGYnMM5K0uBR", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-09-22T17:29:09Z", "updated_at": "2022-09-22T17:29:09Z", "author_association": "OWNER", "body": "Quick demo of a check constraint for JSON validation:\r\n```\r\nsqlite> create table test (id integer primary key, tags text, check (json(tags) is not null));\r\nsqlite> sqlite> insert into test (tags ('[\"one\", \"two\"]');\r\nsqlite> insert into test (tags) values ('[\"one\", \"two\"');\r\nError: stepping, malformed JSON (1)\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1082651698, "label": "Support for CHECK constraints"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/sqlite-utils/issues/358#issuecomment-1255340974", "issue_url": "https://api.github.com/repos/simonw/sqlite-utils/issues/358", "id": 1255340974, "node_id": "IC_kwDOCGYnMM5K0vuu", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-09-22T17:34:45Z", "updated_at": "2022-09-22T17:34:45Z", "author_association": "OWNER", "body": "A few other recipes off the top of my head:\r\n\r\n- `title:maxlength:20` - set a max length, `length(title) <= 20`\r\n- `created:date` - check for `yyyy-mm-dd` date, `select :date == date(:date) is not null` ([demo](https://latest.datasette.io/_memory?sql=select+%3Adate+%3D%3D+date%28%3Adate%29+is+not+null&date=2022-01-01))\r\n- `age:positiveint` - check `age` is a positive integer, `printf('%', age) = age and age > 0` (untested)", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1082651698, "label": "Support for CHECK constraints"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/sqlite-utils/issues/358#issuecomment-1255341690", "issue_url": "https://api.github.com/repos/simonw/sqlite-utils/issues/358", "id": 1255341690, "node_id": "IC_kwDOCGYnMM5K0v56", "user": {"value": 9599, "label": "simonw"}, "created_at": "2022-09-22T17:35:23Z", "updated_at": "2022-09-22T17:35:23Z", "author_association": "OWNER", "body": "Make me think also that `sqlite-utils create-table` should have an option to dump out the SQL without actually creating the table.", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 1082651698, "label": "Support for CHECK constraints"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1415#issuecomment-1255603780", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1415", "id": 1255603780, "node_id": "IC_kwDOBm6k_c5K1v5E", "user": {"value": 17532695, "label": "bendnorman"}, "created_at": "2022-09-22T22:06:10Z", "updated_at": "2022-09-22T22:06:10Z", "author_association": "NONE", "body": "This would be great! I just went through the process of figuring out the minimum permissions for a service account to run `datasette publish cloudrun` for [PUDL](https://github.com/catalyst-cooperative/pudl)'s [datasette deployment](https://data.catalyst.coop/). These are the roles I gave the service account (disclaim: I'm not sure these are the minimum permissions):\r\n\r\n- Cloud Build Service Account: The SA needs this role to publish the build on Cloud Build. \r\n- Cloud Run Admin for the Cloud Run datasette service so the SA can deploy the build.\r\n- I gave the SA the Storage Admin role on the bucket Cloud Build creates to store the build tar files. \r\n- The Viewer Role is [required for storing build logs in the default bucket](https://cloud.google.com/build/docs/running-builds/submit-build-via-cli-api#permissions). More on this below!\r\n\r\nThe Viewer Role is a Basic IAM role that [Google does not recommend using](https://cloud.google.com/build/docs/running-builds/submit-build-via-cli-api#permissions):\r\n\r\n> Caution: Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited [predefined roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles) or [custom roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that meet your needs.\r\n\r\nIf you don't grant the Viewer role the `gcloud builds submit` command will successfully create a build but returns exit code 1, preventing the script from getting to the cloud run step:\r\n\r\n```\r\nERROR: (gcloud.builds.submit)\r\nThe build is running, and logs are being written to the default logs bucket.\r\nThis tool can only stream logs if you are Viewer/Owner of the project and, if applicable, allowed by your VPC-SC security policy.\r\n\r\nThe default logs bucket is always outside any VPC-SC security perimeter.\r\nIf you want your logs saved inside your VPC-SC perimeter, use your own bucket.\r\nSee https://cloud.google.com/build/docs/securing-builds/store-manage-build-logs.\r\n```\r\nlong stack trace...\r\n```\r\nCalledProcessError: Command 'gcloud builds submit --tag gcr.io/catalyst-cooperative-pudl/datasette' returned non-zero exit status 1.\r\n```\r\n\r\nYou can store Cloud Build logs in a [user-created bucket](https://cloud.google.com/build/docs/securing-builds/store-manage-build-logs#store-custom-bucket) which only requires the Storage Admin role. However, you have to pass a config file to `gcloud builds submit`, which isn't possible with the current options for `datasette publish cloudrun`. \r\n\r\nI propose we add an additional CLI option to `datasette publish cloudrun` called `--build-config` that allows users to pass a [config file](https://cloud.google.com/build/docs/running-builds/submit-build-via-cli-api#running_builds) specifying a user create Cloud Build log bucket. ", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 959137143, "label": "feature request: document minimum permissions for service account for cloudrun"}, "performed_via_github_app": null}