search

datasette / datasette-acl

Advanced permission management for Datasette
Apache License 2.0
1 stars 0 forks source link

Dynamic groups feature #2

Closed simonw closed 2 months ago

simonw commented 2 months ago

If there's no special mechanism for matching JSON on actors we could instead have code that dynamically adds or removes the actor from a group based on their JSON, matched against something in config? Then you could configure the plugin like this:

plugins:
  datasette-acl:
    dynamic-groups:
      admin:
        is_admin: true

Now any time we're about to run a permission check on an actor we first confirm that they are a member or NOT a member of the admin group based on matching them against that rule.

We can use actor_matches_allow(actor, allow) for that: https://github.com/simonw/datasette/blob/dc288056b81a3635bdb02a6d0121887db2720e5e/datasette/utils/__init__.py#L1025C5-L1026C1

Originally posted by @simonw in https://github.com/datasette/datasette-acl/issues/1#issuecomment-2320112976