datasette-write-ui: Upgrade for Datasette 1.0a21

Refshttps://github.com/simonw/datasette/issues/2577

Author: simonw

datasette_write_ui/__init__.py

@@ -1,4 +1,5 @@
 from datasette import hookimpl
+from datasette.resources import TableResource
 from . import routes
 
 
@@ -12,7 +13,13 @@ def register_routes():
 
 @hookimpl
 def extra_template_vars(datasette, database, table):
+    table_resource = TableResource(database=database, table=table)
+
     async def permission_allowed(actor, permission):
-        return await datasette.permission_allowed(actor, permission, (database, table))
+        return await datasette.allowed(
+            actor=actor,
+            action=permission,
+            resource=table_resource,
+        )
 
     return {"permission_allowed": permission_allowed}

datasette_write_ui/routes.py

@@ -1,4 +1,5 @@
 from datasette import Response, Forbidden
+from datasette.resources import TableResource
 from datasette.utils import escape_sqlite, tilde_decode
 from typing import Any, TypedDict
 
@@ -41,11 +42,6 @@ async def edit_row_details(scope, receive, datasette, request):
     table_name = request.args.get("table")
     pks = request.args.get("primaryKeys")
 
-    if not await datasette.permission_allowed(
-        request.actor, "update-row", (db_name, table_name), default=False
-    ):
-        raise Forbidden("update-row permissions required")
-
     if db_name is None:
         return Response.json(
             {"ok": False, "message": "db parameter is required"}, status=400
@@ -56,6 +52,15 @@ async def edit_row_details(scope, receive, datasette, request):
             {"ok": False, "message": "table parameter is required"}, status=400
         )
 
+    table_resource = TableResource(database=db_name, table=table_name)
+
+    if not await datasette.allowed(
+        actor=request.actor,
+        action="update-row",
+        resource=table_resource,
+    ):
+        raise Forbidden("update-row permissions required")
+
     if pks is None:
         return Response.json(
             {"ok": False, "message": "primaryKeys parameter is required"}, status=400
@@ -134,8 +139,22 @@ async def insert_row_details(scope, receive, datasette, request):
     db_name = request.args.get("db")
     table_name = request.args.get("table")
 
-    if not await datasette.permission_allowed(
-        request.actor, "insert-row", (db_name, table_name)
+    if db_name is None:
+        return Response.json(
+            {"ok": False, "message": "db parameter is required"}, status=400
+        )
+
+    if table_name is None:
+        return Response.json(
+            {"ok": False, "message": "table parameter is required"}, status=400
+        )
+
+    table_resource = TableResource(database=db_name, table=table_name)
+
+    if not await datasette.allowed(
+        actor=request.actor,
+        action="insert-row",
+        resource=table_resource,
     ):
         raise Forbidden("insert-row permissions required")
 
@@ -151,8 +170,4 @@ async def insert_row_details(scope, receive, datasette, request):
             InsertRowDetailField(name=name, affinity=affinity_from_type(type))
         )
 
-    return Response.json(
-        {
-            "fields": insertable_columns,
-        }
-    )
+    return Response.json({"fields": insertable_columns})

pyproject.toml

@@ -4,13 +4,13 @@ version = "0.0.1a13"
 description = "Datasette UI plugin for editing and inserting rows"
 readme = "README.md"
 authors = [{name = "Alex Garcia"}]
-license = {file = "LICENSE"}
+license = "Apache-2.0"
 classifiers=[
     "Framework :: Datasette",
 ]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 dependencies = [
-    "datasette==1.0a19",
+    "datasette>=1.0a21",
     "sqlite-utils>=3.38",
 ]
 

tests/test_datasette_write_ui.py

@@ -39,7 +39,9 @@ def students_db_path(tmpdir):
 students_metadata = {
     "databases": {
         "students": {
-            "tables": {"students": {"permissions": {"insert-row": {"id": "apollo"}}}}
+            "tables": {
+                "students": {"permissions": {"insert-row": {"id": ["apollo", "root"]}}}
+            }
         }
     }
 }
@@ -63,6 +65,7 @@ async def test_permissions(students_db_path):
         [students_db_path],
         config=students_metadata,
     )
+    datasette.root_enabled = True
     response = await datasette.client.get("/students/students")
     permissions = get_permission_from_table_html(response.text)
     assert permissions["can_delete"] == False
@@ -100,6 +103,7 @@ async def test_permissions(students_db_path):
 @pytest.mark.asyncio
 async def test_insert_row_details_route(students_db_path):
     datasette = Datasette([students_db_path])
+    datasette.root_enabled = True
 
     response = await datasette.client.get(
         "/-/datasette-write-ui/insert-row-details?db=students&table=students",
@@ -123,6 +127,7 @@ async def test_insert_row_details_route(students_db_path):
 @pytest.mark.asyncio
 async def test_update_row_details_route(students_db_path):
     datasette = Datasette([students_db_path])
+    datasette.root_enabled = True
 
     response = await datasette.client.get(
         "/-/datasette-write-ui/edit-row-details?db=students&table=students",