POST to /-/insert with "replace": true should require update-row about datasette

[simonw]

Relevant code:

datasette/datasette/views/table.py

Lines 481 to 498 in 81629db

	ignore = extras.get("ignore")
	replace = extras.get("replace")
	alter = extras.get("alter")
	if upsert and (ignore or replace):
	return _error(["Upsert does not support ignore or replace"], 400)
	initial_schema = None
	if alter:
	# Must have alter-table permission
	if not await self.ds.permission_allowed(
	request.actor, "alter-table", resource=(database_name, table_name)
	):
	return _error(["Permission denied for alter-table"], 403)
	# Track initial schema to check if it changed later
	initial_schema = await db.execute_fn(
	lambda conn: sqlite_utils.Database(conn)[table_name].schema
	)

[simonw]

Just confirmed this through manual testing.

httpx.post(url, json={
    "row": {
        "rowid": 263,
        "session_id": 123,
        "session_title": "hello"
    },
    "replace": True,
}, headers={"Authorization": f"Bearer {token}"}
).json()

[simonw]

Looks like I did implement this for the replace option on create table:

datasette/tests/test_api_write.py

Lines 1328 to 1346 in 81629db

	# If you use replace: true you need update-row too:
	(
	["create-table", "insert-row"],
	{"table": "t", "rows": [{"id": 1}], "pk": "id", "replace": True},
	403,
	["Permission denied - need update-row"],
	),
	),
	)
	async def test_create_table_permissions(
	ds_write, permissions, body, expected_status, expected_errors
	):
	token = ds_write.create_token("root", restrict_all=["view-instance"] + permissions)
	response = await ds_write.client.post(
	"/data/-/create",
	json=body,
	headers=_headers(token),
	)
	assert response.status_code == expected_status

[simonw]

Just noticed that I use "Permission denied:" and "Permission denied -" inconsistently.

[simonw]

Tested this manually as well.