/-/config debug endpoint revealing datasette.yml about datasette

[simonw]

I can reuse /-/config which I setup to redirect to /-/settings a while ago:

datasette/datasette/app.py

Lines 1431 to 1442 in 85a1dfe

	add_route(
	JsonDataView.as_view(self, "settings.json", lambda: self._settings),
	r"/-/settings(\.(?P<format>json))?$",
	)
	add_route(
	permanent_redirect("/-/settings.json"),
	r"/-/config.json",
	)
	add_route(
	permanent_redirect("/-/settings"),
	r"/-/config",
	)

[simonw]

For /-/metadata I got so paranoid about accidentally leaking configured secrets that I invented that weird https://docs.datasette.io/en/stable/plugins.html#secret-configuration-values syntax:

{
    "plugins": {
        "datasette-auth-github": {
            "client_secret": {
                "$env": "GITHUB_CLIENT_SECRET"
            }
        }
    }
}

For /-/config I'm going to go with a simpler approach: I'm going to automatically redact any keys with _secret or _token or _key in them.

[simonw]

datasette-sentry has dsn which should be redacted too.

[simonw]

Now live:

• https://latest.datasette.io/-/config.json
• https://latest.datasette.io/-/config

[simonw]

I'm regretting using permanent_redirect() for the old /-/config page now - my Firefox STILL follows that redirect when I click on https://latest.datasette.io/-/config several hours after I shipped this change.

datasette/datasette/app.py

Lines 1868 to 1881 in 5d21057

	def permanent_redirect(path, forward_query_string=False, forward_rest=False):
	return wrap_view(
	lambda request, send: Response.redirect(
	path
	+ (request.url_vars["rest"] if forward_rest else "")
	+ (
	("?" + request.query_string)
	if forward_query_string and request.query_string
	else ""
	),
	status=301,
	),
	datasette=None,
	)