execute-sql now implies can view instance/database, closes #2169

simonw · Aug 31, 2023 · 98ffad9 · 98ffad9
1 parent 9cead33
commit 98ffad9
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/datasette/default_permissions.py b/datasette/default_permissions.py
@@ -59,6 +59,7 @@ def register_permissions():
             takes_database=True,
             takes_resource=False,
             default=True,
+            implies_can_view=True,
         ),
         Permission(
             name="permissions-debug",

diff --git a/tests/test_permissions.py b/tests/test_permissions.py
@@ -1183,6 +1183,10 @@ async def test_actor_restrictions(
         ({"a": ["update-row"]}, "view-instance", None, False),
         # view-table on a resource implies view-instance
         ({"r": {"db1": {"t1": ["view-table"]}}}, "view-instance", None, True),
+        # execute-sql on a database implies view-instance, view-database
+        ({"d": {"db1": ["es"]}}, "view-instance", None, True),
+        ({"d": {"db1": ["es"]}}, "view-database", "db1", True),
+        ({"d": {"db1": ["es"]}}, "view-database", "db2", False),
         # update-row on a resource does not imply view-instance
         ({"r": {"db1": {"t1": ["update-row"]}}}, "view-instance", None, False),
         # view-database on a resource implies view-instance