search

cldellow / datasette-ui-extras

Add editing UI and other power-user features to Datasette.
Apache License 2.0
12 stars 1 forks source link

edit UI is incorrectly shown to a user w/o update-row #52

Closed cldellow closed 1 year ago

cldellow commented 1 year ago

https://dux.fly.dev/cooking/badges/2?_dux_edit=1 shows the UI. Since the actor doesn't actually have the update-row permission, I would have expected https://github.com/cldellow/datasette-ui-extras/blob/7f4a0e7ff680e21bc5446c425395f2ff5c9006fd/datasette_ui_extras/utils.py#L32-L40 to prevent it from appearing

I'm pretty sure the actor doesn't have the update-row permission, as trying to submit an edit results in a failure, and that checks the same thing (see: https://github.com/simonw/datasette/blob/8b9d7fdbd8de7e74414cc29e3005382669a812dc/datasette/views/row.py#L204-L206)

~I don't see it locally if I write a permission_allowed hook that prevents update-row... so what's going on?~ I actually can see this locally -- I was testing with False, but if I test with None, it repros

cldellow commented 1 year ago

I think this is a bug in datasette: https://github.com/simonw/datasette/issues/2018

cldellow commented 1 year ago

I switched to using permission_allowed and checking for a truthy value