issue_comments

Table actions

33 rows where "updated_at" is on date 2020-06-08

✎ View and edit SQL

This data as json, CSV (advanced)

Suggested facets: issue_url, issue

updated_at (date) 1 ✖

  • 2020-06-08 · 33 ✖

created_at (date) 1 ✖

id ▼ html_url issue_url node_id user created_at updated_at author_association body reactions issue performed_via_github_app
640337951 https://github.com/simonw/datasette/issues/811#issuecomment-640337951 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDMzNzk1MQ== simonw 9599 2020-06-08T03:11:58Z 2020-06-08T03:11:58Z OWNER I'd like to be able to apply permissions for the ability to run a SQL query - but I'm not sure where the best place for that `"allow"` block to live would be. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640338151 https://github.com/simonw/datasette/issues/811#issuecomment-640338151 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDMzODE1MQ== simonw 9599 2020-06-08T03:12:41Z 2020-06-08T03:12:41Z OWNER Also need to expand the docs on https://datasette.readthedocs.io/en/latest/authentication.html to explain where you can put `allow` blocks to control access to the instance, database or table. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640338347 https://github.com/simonw/datasette/issues/811#issuecomment-640338347 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDMzODM0Nw== simonw 9599 2020-06-08T03:13:23Z 2020-06-08T03:13:23Z OWNER Do row-level permissions even make sense? Might be a good idea to remove those until I have a good use-case for them. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640339117 https://github.com/simonw/datasette/issues/801#issuecomment-640339117 https://api.github.com/repos/simonw/datasette/issues/801 MDEyOklzc3VlQ29tbWVudDY0MDMzOTExNw== simonw 9599 2020-06-08T03:16:16Z 2020-06-08T03:16:16Z OWNER I'm going to call this key `"allow_by_query"` - I think I need `allow_sql` for something else (for configuring if users are allowed to execute arbitrary SQL queries). {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} allow_by_query setting for configuring permissions with a SQL statement 631932926  
640339674 https://github.com/simonw/datasette/issues/811#issuecomment-640339674 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDMzOTY3NA== simonw 9599 2020-06-08T03:18:15Z 2020-06-08T03:18:15Z OWNER I should take these permissions into account when displaying a list of tables or a list of databases (like I do right now when displaying a list of queries). {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640339828 https://github.com/simonw/datasette/issues/801#issuecomment-640339828 https://api.github.com/repos/simonw/datasette/issues/801 MDEyOklzc3VlQ29tbWVudDY0MDMzOTgyOA== simonw 9599 2020-06-08T03:18:47Z 2020-06-08T03:18:47Z OWNER Example. This will only allow users to access the `fixtures` database if the logged-in actor's ID value appears for a record in the `users` table which has `admin` = 1. ```json { "databases": { "fixtures": { "allow_by_query": "select * from users where id = :id and admin = 1" } } } ``` {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} allow_by_query setting for configuring permissions with a SQL statement 631932926  
640344950 https://github.com/simonw/datasette/issues/811#issuecomment-640344950 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM0NDk1MA== simonw 9599 2020-06-08T03:36:49Z 2020-06-08T03:36:49Z OWNER Oh this is a bit awkward - should I be running per-table permission checks for every table that might be shown on the index page? <img width="841" alt="Datasette__fixtures__data" src="https://user-images.githubusercontent.com/9599/83990459-9862e900-a8fe-11ea-8a42-60cc3d6f7693.png"> {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640345115 https://github.com/simonw/datasette/issues/811#issuecomment-640345115 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM0NTExNQ== simonw 9599 2020-06-08T03:37:33Z 2020-06-08T03:37:33Z OWNER Per-table permissions is pretty interesting for large installations though - an organization might have hundreds of CSV files imported into Datasette and then allow users to specify which exact users within that organization are allowed to see which CSV. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640348785 https://github.com/simonw/datasette/issues/811#issuecomment-640348785 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM0ODc4NQ== simonw 9599 2020-06-08T03:51:50Z 2020-06-08T03:51:50Z OWNER New convention: the 🔒 icon is now shown next to resources that are private - that are visible to you now, but would not be visible to the anonymous user. <img width="823" alt="Datasette__fixtures__data" src="https://user-images.githubusercontent.com/9599/83991127-b3cef380-a900-11ea-9df3-8fcd4c10cc42.png"> {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640362879 https://github.com/simonw/datasette/issues/811#issuecomment-640362879 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM2Mjg3OQ== simonw 9599 2020-06-08T04:42:28Z 2020-06-08T13:39:46Z OWNER I'm finding myself repeating this pattern a lot: ```python for table in table_counts: allowed = await self.ds.permission_allowed( request.scope.get("actor"), "view-table", resource_type="table", resource_identifier=(database, table), default=True, ) if not allowed: continue private = not await self.ds.permission_allowed( None, "view-table", resource_type="table", resource_identifier=(database, table), ) ``` I use a similar pattern for lists of databases and lists of queries, and I'll be doing the same thing for lists of SQL views too. An abstraction around this would be useful. Idea: ```python visible, private = await check_visibility( self.ds, actor, "view-table", "table", (database, table) ) ``` {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640365512 https://github.com/simonw/datasette/issues/811#issuecomment-640365512 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM2NTUxMg== simonw 9599 2020-06-08T04:53:49Z 2020-06-08T04:53:49Z OWNER I really like the padlocks. I should include a screenshot in the documentation that illustrates them. <img width="620" alt="data" src="https://user-images.githubusercontent.com/9599/83993771-483d5400-a909-11ea-8e7b-85b54e40f900.png"> Maybe I should figure out a way to have the https://latest.datasette.io/ demo illustrate both a logged-in and a logged-out state. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640367128 https://github.com/simonw/datasette/issues/811#issuecomment-640367128 https://api.github.com/repos/simonw/datasette/issues/811 MDEyOklzc3VlQ29tbWVudDY0MDM2NzEyOA== simonw 9599 2020-06-08T05:00:13Z 2020-06-08T05:00:49Z OWNER Should the padlock show up on tables that are private only because they inherited their privacy from their parent database or even the parent instance? Interesting question. If an instance is private, I'm not sure it makes sense to show padlocks on absolutely everything. Likewise, a list of tables shown on the database table with a padlock next to every single table (when the database itself is private) doesn't seem to add any useful information. I think "Show 🔒 in header on private database page" will resolve this for me. I'll always show the padlock in the header of a database/table page even if that privacy is inherited - but I won't do that for padlocks shown in the list of tables or list of databases. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Support "allow" block on root, databases and tables, not just queries 633578769  
640638057 https://github.com/simonw/datasette/issues/814#issuecomment-640638057 https://api.github.com/repos/simonw/datasette/issues/814 MDEyOklzc3VlQ29tbWVudDY0MDYzODA1Nw== simonw 9599 2020-06-08T14:11:51Z 2020-06-08T14:12:12Z OWNER The only impact it has at all is on this code here: https://github.com/simonw/datasette/blob/cc218fa9be55842656d030545c308392e3736053/datasette/views/base.py#L515-L527 That `ds.cache_headers` property looks like it needs rethinking too. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Remove --debug option from datasette serve 634651079  
640656143 https://github.com/simonw/datasette/issues/815#issuecomment-640656143 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY1NjE0Mw== simonw 9599 2020-06-08T14:25:48Z 2020-06-08T14:26:45Z OWNER Will we need a request correlation ID for this? Multiple asyncio threads can write things to the `ds._permission_checks` deque at the same time. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640671241 https://github.com/simonw/datasette/issues/815#issuecomment-640671241 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY3MTI0MQ== simonw 9599 2020-06-08T14:38:04Z 2020-06-08T14:38:04Z OWNER Alternative to a correlation ID would be to use the existing `AsgiTracer` / `capture_traces` mechanism. That's probably smarter. It could even start logging SQL queries to an in-memory deque too, so a debug tool could show you queries executed by other requests! {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640671398 https://github.com/simonw/datasette/issues/815#issuecomment-640671398 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY3MTM5OA== simonw 9599 2020-06-08T14:38:20Z 2020-06-08T14:38:20Z OWNER But `ds._permission_checks` is also used for unit tests. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640672540 https://github.com/simonw/datasette/issues/815#issuecomment-640672540 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY3MjU0MA== simonw 9599 2020-06-08T14:40:22Z 2020-06-08T14:40:22Z OWNER Here's the current tracer mechanism. Note that it captures a stacktrace (which is expensive) - but only if the tracer system has been enabled for a request. https://github.com/simonw/datasette/blob/1c063fae9dba70f70244db010d55a18846640f07/datasette/tracer.py#L27-L51 For permissions checks I want to ALWAYS track those calls, not just on requests that have opted in. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640673138 https://github.com/simonw/datasette/issues/815#issuecomment-640673138 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY3MzEzOA== simonw 9599 2020-06-08T14:41:24Z 2020-06-08T14:41:24Z OWNER I could reuse that `get_task_id()` function though (I can move it to utils). {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640673405 https://github.com/simonw/datasette/issues/815#issuecomment-640673405 https://api.github.com/repos/simonw/datasette/issues/815 MDEyOklzc3VlQ29tbWVudDY0MDY3MzQwNQ== simonw 9599 2020-06-08T14:41:55Z 2020-06-08T14:41:55Z OWNER I want to be able to display the HTTP path and verb - `GET /fixtures`, `POST /fixtures/myquery` etc. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Group permission checks by request on /-/permissions debug page 634663505  
640763899 https://github.com/simonw/datasette/issues/816#issuecomment-640763899 https://api.github.com/repos/simonw/datasette/issues/816 MDEyOklzc3VlQ29tbWVudDY0MDc2Mzg5OQ== simonw 9599 2020-06-08T17:21:59Z 2020-06-08T17:21:59Z OWNER I'm going to show how to display the current user's user-agent. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Come up with a new example for extra_template_vars plugin 634783573  
640808161 https://github.com/simonw/datasette/issues/817#issuecomment-640808161 https://api.github.com/repos/simonw/datasette/issues/817 MDEyOklzc3VlQ29tbWVudDY0MDgwODE2MQ== simonw 9599 2020-06-08T18:51:42Z 2020-06-08T18:54:37Z OWNER I'm also going to rename `resource_identifier` to just `resource`. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Drop resource_type from permission_allowed system 634844634  
640815550 https://github.com/simonw/datasette/issues/816#issuecomment-640815550 https://api.github.com/repos/simonw/datasette/issues/816 MDEyOklzc3VlQ29tbWVudDY0MDgxNTU1MA== simonw 9599 2020-06-08T19:06:44Z 2020-06-08T19:06:44Z OWNER https://github.com/simonw/datasette/blob/c7d145e016522dd6ee229d4d0b3ba79a7a8877c1/docs/plugins.rst#extra_template_varstemplate-database-table-view_name-request-datasette {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Come up with a new example for extra_template_vars plugin 634783573  
640830088 https://github.com/simonw/datasette/issues/813#issuecomment-640830088 https://api.github.com/repos/simonw/datasette/issues/813 MDEyOklzc3VlQ29tbWVudDY0MDgzMDA4OA== simonw 9599 2020-06-08T19:26:15Z 2020-06-08T19:26:15Z OWNER This needs to affect the `?_where=` parameter on table pages as well. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Mechanism for specifying allow_sql permission in metadata.json 634139848  
640831842 https://github.com/simonw/datasette/issues/813#issuecomment-640831842 https://api.github.com/repos/simonw/datasette/issues/813 MDEyOklzc3VlQ29tbWVudDY0MDgzMTg0Mg== simonw 9599 2020-06-08T19:27:47Z 2020-06-08T19:27:47Z OWNER This needs to be ready for Datasette 0.44 because without it the "view-table" permission is useless - it will protect the https://latest.datasette.io/fixtures/facetable page but will not prevent users from executing https://latest.datasette.io/fixtures?sql=select+*+from+facetable {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Mechanism for specifying allow_sql permission in metadata.json 634139848  
640837908 https://github.com/simonw/datasette/issues/813#issuecomment-640837908 https://api.github.com/repos/simonw/datasette/issues/813 MDEyOklzc3VlQ29tbWVudDY0MDgzNzkwOA== simonw 9599 2020-06-08T19:33:03Z 2020-06-08T19:33:03Z OWNER Don't forget to link to the `allow_sql` docs from the warning block here: https://github.com/simonw/datasette/blob/54370853828bdf87ca844fd0fc00900e0e2e659d/docs/authentication.rst#controlling-access-to-specific-tables-and-views {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Mechanism for specifying allow_sql permission in metadata.json 634139848  
640905609 https://github.com/simonw/datasette/issues/801#issuecomment-640905609 https://api.github.com/repos/simonw/datasette/issues/801 MDEyOklzc3VlQ29tbWVudDY0MDkwNTYwOQ== simonw 9599 2020-06-08T21:48:44Z 2020-06-08T21:48:44Z OWNER Dropping this out of Datasette 0.44 again - I have enough other stuff to finish, this can wait. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} allow_by_query setting for configuring permissions with a SQL statement 631932926  
640916290 https://github.com/simonw/datasette/issues/813#issuecomment-640916290 https://api.github.com/repos/simonw/datasette/issues/813 MDEyOklzc3VlQ29tbWVudDY0MDkxNjI5MA== simonw 9599 2020-06-08T22:16:39Z 2020-06-08T22:17:32Z OWNER Naming problem: Datasette already has a config option with this name: $ datasette serve data.db --config allow_sql:1 https://datasette.readthedocs.io/en/stable/config.html#allow-sql It's confusing to have two things called `allow_sql` that do slightly different things. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Mechanism for specifying allow_sql permission in metadata.json 634139848  
640916807 https://github.com/simonw/datasette/issues/813#issuecomment-640916807 https://api.github.com/repos/simonw/datasette/issues/813 MDEyOklzc3VlQ29tbWVudDY0MDkxNjgwNw== simonw 9599 2020-06-08T22:18:09Z 2020-06-08T22:18:09Z OWNER I could retire the `--config allow_sql:0` option entirely, since the new `metadata.json` mechanism can be used to achieve the exact same thing. I'm going to do that. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Mechanism for specifying allow_sql permission in metadata.json 634139848  
640916991 https://github.com/simonw/datasette/issues/806#issuecomment-640916991 https://api.github.com/repos/simonw/datasette/issues/806 MDEyOklzc3VlQ29tbWVudDY0MDkxNjk5MQ== simonw 9599 2020-06-08T22:18:45Z 2020-06-08T22:18:45Z OWNER Reminder for release notes: I removed `--config allow_sql:0` - see https://github.com/simonw/datasette/issues/813#issuecomment-640916807 {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Release Datasette 0.44 632753851  
640924482 https://github.com/simonw/datasette/issues/493#issuecomment-640924482 https://api.github.com/repos/simonw/datasette/issues/493 MDEyOklzc3VlQ29tbWVudDY0MDkyNDQ4Mg== simonw 9599 2020-06-08T22:39:45Z 2020-06-08T22:39:45Z OWNER I'm definitely doing this rename, now that `metadata.json` is used for `allow` permissions configuration as well as-of #811. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Rename metadata.json to config.json 449886319  
640924558 https://github.com/simonw/datasette/issues/493#issuecomment-640924558 https://api.github.com/repos/simonw/datasette/issues/493 MDEyOklzc3VlQ29tbWVudDY0MDkyNDU1OA== simonw 9599 2020-06-08T22:40:01Z 2020-06-08T22:40:01Z OWNER I'll also rename `--config` to `--setting`. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Rename metadata.json to config.json 449886319  
640925018 https://github.com/simonw/datasette/issues/777#issuecomment-640925018 https://api.github.com/repos/simonw/datasette/issues/777 MDEyOklzc3VlQ29tbWVudDY0MDkyNTAxOA== simonw 9599 2020-06-08T22:41:42Z 2020-06-08T22:41:42Z OWNER This is particularly worth fixing now that 403 forbidden pages are much more likely due to #811. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Error pages not correctly loading CSS 626171242  
640929693 https://github.com/simonw/datasette/issues/818#issuecomment-640929693 https://api.github.com/repos/simonw/datasette/issues/818 MDEyOklzc3VlQ29tbWVudDY0MDkyOTY5Mw== simonw 9599 2020-06-08T22:56:38Z 2020-06-08T22:56:38Z OWNER https://datasette.readthedocs.io/en/latest/plugins.html#permission-allowed-datasette-actor-action-resource has a couple of examples now. {"total_count": 0, "+1": 0, "-1": 0, "laugh": 0, "hooray": 0, "confused": 0, "heart": 0, "rocket": 0, "eyes": 0} Example permissions plugin 634917088  

Advanced export

JSON shape: default, array, newline-delimited, object

CSV options: 

CREATE TABLE [issue_comments] (
   [html_url] TEXT,
   [issue_url] TEXT,
   [id] INTEGER PRIMARY KEY,
   [node_id] TEXT,
   [user] INTEGER REFERENCES [users]([id]),
   [created_at] TEXT,
   [updated_at] TEXT,
   [author_association] TEXT,
   [body] TEXT,
   [reactions] TEXT,
   [issue] INTEGER REFERENCES [issues]([id])
, [performed_via_github_app] TEXT);
CREATE INDEX [idx_issue_comments_issue]
                ON [issue_comments] ([issue]);
CREATE INDEX [idx_issue_comments_user]
                ON [issue_comments] ([user]);