id,page,ref,title,content,breadcrumbs,references
authentication:authentication-permissions-allow,authentication,authentication-permissions-allow,"Defining permissions with ""allow"" blocks","The standard way to define permissions in Datasette is to use an  ""allow""  block  in the datasette.yaml file . This is a JSON document describing which actors are allowed to perform a permission. 
                 The most basic form of allow block is this ( allow demo ,  deny demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      id: root
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 This will match any actors with an  ""id""  property of  ""root""  - for example, an actor that looks like this: 
                 {
    ""id"": ""root"",
    ""name"": ""Root User""
} 
                 An allow block can specify ""deny all"" using  false  ( demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow: false
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 An  ""allow""  of  true  allows all access ( demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow: true
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 Allow keys can provide a list of values. These will match any actor that has any of those values ( allow demo ,  deny demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      id:
      - simon
      - cleopaws
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 This will match any actor with an  ""id""  of either  ""simon""  or  ""cleopaws"" . 
                 Actors can have properties that feature a list of values. These will be matched against the list of values in an allow block. Consider the following actor: 
                 {
    ""id"": ""simon"",
    ""roles"": [""staff"", ""developer""]
} 
                 This allow block will provide access to any actor that has  ""developer""  as one of their roles ( allow demo ,  deny demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      roles:
      - developer
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 Note that ""roles"" is not a concept that is baked into Datasette - it's a convention that plugins can choose to implement and act on. 
                 If you want to provide access to any actor with a value for a specific key, use  ""*"" . For example, to match any logged-in user specify the following ( allow demo ,  deny demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      id: ""*""
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 You can specify that only unauthenticated actors (from anonymous HTTP requests) should be allowed access using the special  ""unauthenticated"": true  key in an allow block ( allow demo ,  deny demo ): 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      unauthenticated: true
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 Allow keys act as an ""or"" mechanism. An actor will be able to execute the query if any of their JSON properties match any of the values in the corresponding lists in the  allow  block. The following block will allow users with either a  role  of  ""ops""  OR users who have an  id  of  ""simon""  or  ""cleopaws"" : 
                 [[[cog
from metadata_doc import config_example
import textwrap
config_example(cog, textwrap.dedent(
  """"""
    allow:
      id:
      - simon
      - cleopaws
      role: ops
    """""").strip(),
    ""YAML"", ""JSON""
  ) 
                 ]]] 
                 [[[end]]] 
                 Demo for cleopaws ,  demo for ops role ,  demo for an actor matching neither rule .","[""Authentication and permissions"", ""Permissions""]","[{""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%22id%22%3A+%22root%22%7D&allow=%7B%0D%0A++++++++%22id%22%3A+%22root%22%0D%0A++++%7D"", ""label"": ""allow demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%22id%22%3A+%22trevor%22%7D&allow=%7B%0D%0A++++++++%22id%22%3A+%22root%22%0D%0A++++%7D"", ""label"": ""deny demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22root%22%0D%0A%7D&allow=false"", ""label"": ""demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22root%22%0D%0A%7D&allow=true"", ""label"": ""demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22cleopaws%22%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%5B%0D%0A++++++++%22simon%22%2C%0D%0A++++++++%22cleopaws%22%0D%0A++++%5D%0D%0A%7D"", ""label"": ""allow demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22pancakes%22%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%5B%0D%0A++++++++%22simon%22%2C%0D%0A++++++++%22cleopaws%22%0D%0A++++%5D%0D%0A%7D"", ""label"": ""deny demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22simon%22%2C%0D%0A++++%22roles%22%3A+%5B%0D%0A++++++++%22staff%22%2C%0D%0A++++++++%22developer%22%0D%0A++++%5D%0D%0A%7D&allow=%7B%0D%0A++++%22roles%22%3A+%5B%0D%0A++++++++%22developer%22%0D%0A++++%5D%0D%0A%7D"", ""label"": ""allow demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22cleopaws%22%2C%0D%0A++++%22roles%22%3A+%5B%22dog%22%5D%0D%0A%7D&allow=%7B%0D%0A++++%22roles%22%3A+%5B%0D%0A++++++++%22developer%22%0D%0A++++%5D%0D%0A%7D"", ""label"": ""deny demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22simon%22%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%22*%22%0D%0A%7D"", ""label"": ""allow demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22bot%22%3A+%22readme-bot%22%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%22*%22%0D%0A%7D"", ""label"": ""deny demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=null&allow=%7B%0D%0A++++%22unauthenticated%22%3A+true%0D%0A%7D"", ""label"": ""allow demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22hello%22%0D%0A%7D&allow=%7B%0D%0A++++%22unauthenticated%22%3A+true%0D%0A%7D"", ""label"": ""deny demo""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22cleopaws%22%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%5B%0D%0A++++++++%22simon%22%2C%0D%0A++++++++%22cleopaws%22%0D%0A++++%5D%2C%0D%0A++++%22role%22%3A+%22ops%22%0D%0A%7D"", ""label"": ""Demo for cleopaws""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22trevor%22%2C%0D%0A++++%22role%22%3A+%5B%0D%0A++++++++%22ops%22%2C%0D%0A++++++++%22staff%22%0D%0A++++%5D%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%5B%0D%0A++++++++%22simon%22%2C%0D%0A++++++++%22cleopaws%22%0D%0A++++%5D%2C%0D%0A++++%22role%22%3A+%22ops%22%0D%0A%7D"", ""label"": ""demo for ops role""}, {""href"": ""https://latest.datasette.io/-/allow-debug?actor=%7B%0D%0A++++%22id%22%3A+%22percy%22%2C%0D%0A++++%22role%22%3A+%5B%0D%0A++++++++%22staff%22%0D%0A++++%5D%0D%0A%7D&allow=%7B%0D%0A++++%22id%22%3A+%5B%0D%0A++++++++%22simon%22%2C%0D%0A++++++++%22cleopaws%22%0D%0A++++%5D%2C%0D%0A++++%22role%22%3A+%22ops%22%0D%0A%7D"", ""label"": ""demo for an actor matching neither rule""}]"