Ability to set permissions on a per-table and per-enrichment basis

[simonw]

I shipped a enrichments permission that can be coupled to a database.

There are actually two cases to consider here:

• What enrichments is the current user allowed to use?
• What databases and tables are they allowed to enrich?

We may have enrichments (e.g. ones with expensive API keys) that are restricted to some users, independent of which tables they are allowed to run them against.

Maybe enrichment is the permission for selecting which enrichments they can use and enrich-table is the one for specific tables?

Originally posted by @simonw in #12 (comment)

[simonw]

Here's the code that checks permissions:

datasette-enrichments/datasette_enrichments/views.py

Lines 13 to 17 in eeded41

	async def check_permissions(datasette, request, database):
	if not await datasette.permission_allowed(
	request.actor, "enrichments", resource=database, default=False
	):
	raise Forbidden("Permission denied for enrichments")

And:

datasette-enrichments/datasette_enrichments/__init__.py

Lines 305 to 326 in eeded41

	@hookimpl
	def table_actions(datasette, actor, database, table, request):
	async def inner():
	if await datasette.permission_allowed(
	actor, "enrichments", resource=database, default=False
	):
	return [
	{
	"href": datasette.urls.path(
	"/-/enrich/{}/{}{}".format(
	database,
	tilde_encode(table),
	"?{}".format(request.query_string)
	if request.query_string
	else "",
	)
	),
	"label": "Enrich selected data",
	}
	]
	return inner