CSV appends: permissions checks

[calherries]

This PR will merge into the feature branch for Merge 1 of Milestone 0 (PR)

Epic: Allow appending more data to CSV uploads
product doc
eng doc

This PR implements the permissions checks required for appending CSV data to an existing upload table via the endpoint.

It corresponds to the following section of the eng doc (block link):

Permissions errors (status: 403):

• Message: “You don’t have permissions to do that.”
• Same permissions checks as uploading a CSV (POST /api/card/from-csv) and unrestricted data permissions on the table
• Test: if user has block permissions: native query editing is required to upload CSV
• Test: if user doesn’t have unrestricted data permissions then upload fails
• Test: if the user does have unrestricted data permissions but no native query editing permissions then upload succeeds
• Test: if user is sandboxed then upload fails

[calherries]

This docstring was just wrong before

[calherries]

I had this wrong before. You can read more about table permissions here:

metabase/src/metabase/models/table.clj

Lines 70 to 79 in 1bc1857

	;; To read (e.g., fetch metadata) a Table you must have either self-service data permissions for the Table, or write
	;; permissions for the Table (detailed below). `can-read?` checks the former, while `can-write?` checks the latter;
	;; the permission-checking function to call when reading a Table depends on the context of the request. When reading
	;; Tables to power the admin data model page; `can-write?` should be called; in other contexts, `can-read?` should
	;; be called. (TODO: is there a way to clear up the semantics here?)
	;;
	;; To write a Table (e.g. update its metadata):
	;; * If Enterprise Edition code is available and the :advanced-permissions feature is enabled, you must have
	;; data-model permissions for othe table
	;; * Else, you must be an admin

[qnkhuat]

from the doc

unrestricted data permissions on the table

could you explain how can-write resonates with that?

[calherries]

It doesn't. That's why I changed it from can-write? to can-read?.

And from the comments on table permissions I linked above:
1bc1857/src/metabase/models/table.clj#L70-L79

  ;; To read (e.g., fetch metadata) a Table you must have either self-service data permissions for the Table, or write
  ;; permissions for the Table (detailed below). `can-read?` checks the former, while `can-write?` checks the latter;

"self-service data permissions" is the same thing as "unrestricted data permissions" as I wrote in the eng doc.

[qnkhuat]

nice tests!