Skip to content

datasette --default-deny option #2592

New issue
New issue
Closed
Closed
datasette --default-deny option#2592
Labels
authentication-and-permissionsresearch
Milestone
Datasette 1.0a22
@simonw

Description

@simonw
simonw
opened on Nov 12, 2025

I'm going to try adding this feature to see how it feels:

datasette --default-deny data.db --root

The --default-deny option would be passed as a keyword argument to the Datasette(..., default_deny=True) constructor, and set as datasette.default_deny=True on the instance.

It would then affect this code here:

datasette/datasette/default_permissions.py

Lines 348 to 367 in 354d7a2

@hookimpl(specname="permission_resources_sql")
async def default_action_permissions_sql(datasette, actor, action):
"""Apply default allow rules for standard view/execute actions.
With the INTERSECT-based restriction approach, these defaults are always generated
and then filtered by restriction_sql if the actor has restrictions.
"""
default_allow_actions = {
"view-instance",
"view-database",
"view-database-download",
"view-table",
"view-query",
"execute-sql",
}
if action in default_allow_actions:
reason = f"default allow for {action}".replace("'", "''")
return PermissionSQL.allow(reason=reason)
return None

If default_deny is set then those default rules are NOT added by that plugin hook implementation.

The goal of this feature is to make it as easy as possible for people to run a locked-down Datasette instance where only users who are authenticated using whatever extra auth mechanisms they configure can view anything.

I need this for Datasette Cloud.

Metadata

Metadata

Assignees

No one assigned

    Labels

    authentication-and-permissionsresearch

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions