Skip to content

actions_sql: always emit the anon_rules CTE so empty-anon path doesn't 500#2722

Open
c-tonneslan wants to merge 2 commits into
simonw:mainfrom
c-tonneslan:fix/default-deny-no-config-500
Open

actions_sql: always emit the anon_rules CTE so empty-anon path doesn't 500#2722
c-tonneslan wants to merge 2 commits into
simonw:mainfrom
c-tonneslan:fix/default-deny-no-config-500

Conversation

@c-tonneslan
Copy link
Copy Markdown

Closes #2644.

anon_rules was only added when at least one anonymous permission rule came back from the hooks. With --default-deny and no config file the hooks all return nothing, but the downstream anon_child_lvl / anon_parent_lvl / anon_global_lvl CTEs LEFT JOIN anon_rules unconditionally, so the full query was invalid SQL and the index pages returned 500.

Emitting an empty CTE with the expected columns in the no-rules case keeps the LEFT JOINs happy without changing the result. Regression test under test_default_deny_no_config_index_pages_dont_500.

Closes simonw#2712.

Database.table_counts has a count_limit=10000 cap so the runtime UI
doesn't sit on huge tables. The datasette inspect CLI shared that
path, so the JSON it persists capped every row count at 10001. Add an
exact=True path that issues a plain SELECT COUNT(*) (the same query
inspect_tables in inspect.py uses) and have the CLI call that. The
result also doesn't get cached on the Database, since a precomputed
count is wrong if the file changes later.

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>
Closes simonw#2644.

anon_rules was only added when at least one anonymous permission rule
came back from the hooks. With --default-deny and no config file all
the hooks return nothing, but the downstream anon_child_lvl /
anon_parent_lvl / anon_global_lvl CTEs LEFT JOIN anon_rules
unconditionally, so the full query was invalid SQL and the index
pages returned 500. Emit an empty CTE with matching columns in the
no-rules case.

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

--default-deny returns 500 on index pages when no config file is present

1 participant