I just spotted this while working on #2261:

That looks wrong to me. Note how the later check does this:

self.ds.permission_allowed(request.actor, "insert-row", resource=(database_name, table_name))

But the earlier checks do this:

self.ds.permission_allowed(request.actor, "insert-row", database_name, table_name)

From looking at the code I think that second example is incorrect, it's using table_name as the default value: