NoneType' object has no attribute 'actor'

[simonw]

  File "/usr/local/lib/python3.10/site-packages/datasette/templates/_crumbs.html", line 3, in template
    {% set items=crumb_items(request=request, database=database, table=table) %}
  File "jinja2/async_utils.py", line 65, in auto_await
    return await t.cast("t.Awaitable[V]", value)
  File "datasette/app.py", line 638, in _crumb_items
    actor=request.actor, action="view-instance", default=True

From Sentry.

[simonw]

Looks like the new breadcrumbs code can't handle the case where request is None.

Need a test that demonstrates this too.

[simonw]

Refs:

• If user can see table but NOT database/instance nav links should not display #1831

[simonw]

This was a hit to an authenticated page where the incoming user WAS logged in but did not have permission to view that specific page.

Code in question:

datasette/datasette/app.py

Lines 634 to 640 in c7dd76c

	async def _crumb_items(self, request, table=None, database=None):
	crumbs = []
	# Top-level link
	if await self.permission_allowed(
	actor=request.actor, action="view-instance", default=True
	):
	crumbs.append({"href": self.urls.instance(), "label": "home"})

[simonw]

From the stack trace in Sentry:

So this happened because a custom plugin tried to render forbidden.html without passing in the request.

[simonw]

Generally though we should expect that people might try to use render_template(...) without passing a request, so Datasette core should be able to handle this.