datasette-debug-gotham

A debugging utility for testing actor permissions/actions with DC Superheros (superman, Batman, Daily Planet, etc.)

It can be hard to test or debug Datasette plugins that use the new permissions system. This plugin offers a few builtin actors and a small widget for switching between actors:

Once you select an actor like "Clark Kent" or "Bruce Wayne", the page will refresh and Datasette will recognize the actor in request.actor. You can change actors however you like:

The pre-configured actors have some attributes you can use for debugging or "group permissions":

# https://github.com/datasette/datasette-debug-gotham/blob/main/datasette_debug_gotham/__init__.py#L8-L21
ACTORS = {
    ###### DAILY PLANET ######
    "clark": {
        "id": "clark",
        "name": "Clark Kent",
        "newsroom": "daily-planet",
        "profile_picture_url": pfp("C", bg="blue"),
    },
    "lois": {
        "id": "lois",
        "name": "Lois Lane",
        "newsroom": "daily-planet",
        "profile_picture_url": pfp("L", bg="red"),
    },
    ... # many more
}

Or access the actors with Python:

from dataseette_debug_gotham import ACTORS
print(ACTORS["clark"])

Personally I use this with uv for dynamic permissions testing:

uvx \
  --from 'datasette>=1a' \
  --with datasette-debug-gotham \
  datasette \
    --default-deny \
    -s permissions.view-instance.newsroom daily-planet \
    --memory

Here --default-deny means that by default everyone will see a Forbidden view-instance error when visiting dataset.

But, if you use the debug widget and select clark/lois/jimmy, since they have newsroom: daily-planet in their actor config, they will be able to see the instance!

And if you change to bruce/alfred/selina, who have newsroom: gotham-gazette, they will be blocked!