Private database page should show padlock on every table

[simonw]

Following:

• Table/database that is private due to inherited permissions does not show padlock #1829

https://latest.datasette.io/_internal looks like this:

But those queries and tables are private too, and should also show the padlock icon.

[simonw]

Here's the code at fault:

datasette/datasette/views/database.py

Lines 67 to 116 in 78dad23

	views = []
	for view_name in await db.view_names():
	view_visible, view_private = await self.ds.check_visibility(
	request.actor,
	"view-table",
	(database, view_name),
	)
	if view_visible:
	views.append(
	{
	"name": view_name,
	"private": view_private,
	}
	)
	tables = []
	for table in table_counts:
	table_visible, table_private = await self.ds.check_visibility(
	request.actor,
	"view-table",
	(database, table),
	)
	if not table_visible:
	continue
	table_columns = await db.table_columns(table)
	tables.append(
	{
	"name": table,
	"columns": table_columns,
	"primary_keys": await db.primary_keys(table),
	"count": table_counts[table],
	"hidden": table in hidden_table_names,
	"fts_table": await db.fts_table(table),
	"foreign_keys": all_foreign_keys[table],
	"private": table_private,
	}
	)
	tables.sort(key=lambda t: (t["hidden"], t["name"]))
	canned_queries = []
	for query in (
	await self.ds.get_canned_queries(database, request.actor)
	).values():
	query_visible, query_private = await self.ds.check_visibility(
	request.actor,
	"view-query",
	(database, query["name"]),
	)
	if query_visible:
	canned_queries.append(dict(query, private=query_private))

Those checks aren't doing the new cascading permissions thing added in #1829 which means they can't tell that an anonymous user would not be able to se those tbles and queries and views.

Should do something like this instead:

view_visible, view_private = await self.ds.check_visibility(
    request.actor,
    permissions=[
        ("view-table", (database, view_name)),
        ("view-database", database),
        "view-instance",
    ],
)

[simonw]

Tested my fix with this metadata.yml:

databases:
  fixtures:
   allow:
     id: root
   tables:
     123_starts_with_digits:
       allow: true

Signed in as root I saw this - showing that the 123_starts_with_digits table is public:

[simonw]

https://latest.datasette.io/_internal now looks like this: