Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Datasette Apps: Host custom HTML applications inside Datasette

simonwillison.net

Post reply on HN
Print view View original

51–60 of 76 posts

Re: Datasette Apps: Host custom HTML applications inside Datasette

#51

Post by simonw »

tuo-lei wrote: post #46

nice pattern with the stored queries for writes. but who defines them? if the app author can create their own stored queries, the write restriction is basically honor system.

There are actually two types of stored query: regular and "trusted".

Any query you save is a regular query. It operates under the permissions of the viewer, and checks that the viewer has the necessary permissions - read access to the database, or more finely grained write access which checks the individual tables they will be writing to.

The problem with that is that it means you can't build an app which other, signed out or unprivileged users, can use.

So there's a second category: "trusted" queries. These are current only configurable by the site administrator who controls the Datasette deployment, as they go straight in the configuration file: https://docs.datasette.io/en/latest/sql_queries.html#trusted...

I'm planning to add a way for trusted users to create these through the UI via another permission, with a very strong UI warning to only use this feature if you understand the implications.

Here's a demo of an app that runs against trusted stored queries: https://agent.datasette.io/-/apps/01ktw6fpag19dnnga85t2ced3p

Source code here, showing how those queries are called: https://gist.github.com/simonw/6e6a3760fa0528ceda1f65d789069...

It uses these queries: https://agent.datasette.io/content/timeline-filtered and https://agent.datasette.io/content/timeline-count

Re: Datasette Apps: Host custom HTML applications inside Datasette

#52

Post by potatoman22 »

euroderf wrote: post #22

I never understood why someone hasn't made a framework that makes it stupidly easy to fill an HTML page with SQLite database tables, with all the usual display controls, and with as much "liveness" as desired, and with a protocol (over HTTPS) to manage comms to a server-side instance. SQLite is robust, lightweight, bulletproof - a WASM build belongs on ALL the webpages !

It's not specific to SQLlite per se, but that's what most dashboard builders are

Re: Datasette Apps: Host custom HTML applications inside Datasette

#54

Post by simonw »

est wrote: post #53

I didn't quite get the CSP part. Why use and srcdoc and instead of a real server header? Static hosting?

If you host iframe apps at a fixed URL like:

  /-/apps/iframe-content/timeline.html
You can protect it with CSP headers, but you can't also protect it with the sandbox="" attribute (should a user visit it directly)

If you want both sandbox= restrictions and CSP headers at the same time the only way I've found that works cross all major borders is the iframe plus srcdoc="" with injected CSP meta headers patterns.

Note that a lot of sandbox implementations serve their iframe content from a separate domain, to ensure cookies and localStorage and other same origin things are robustly protected.

I can't do that easily for Datasette because it's open source software that people can run on their own laptops, so I didn't want to block people on "now register a domain/subdomain and set this up in DNS".

Re: Datasette Apps: Host custom HTML applications inside Datasette

#55

Post by simonw »

mpeg wrote: post #47
iLoveOncall wrote: post #28

Earlier quoted context omitted.

Because it's pretty much worthless. You almost never need just a basic list of all the data in your table, even if you're able to filter and sort it. There's no moat there at all. People need serious BI tools, and that throws simplicity out of the window (PowerBI, QuickSight, etc.).

I disagree, a lot of the time people buy "serious BI tools" precisely because they think they need all that power and complexity. In reality, what most people need is much simpler, a mini app with some curated datasets and simple filters, maybe some AI querying if we want to get fancy. There's some companies out there that work with big data, but for the rest of us small data is ok.

I think of Datasette as a "small data" platform, where small data is anything that would fit on my phone.

My phone has 1TB of storage.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#56

Post by est »

simonw wrote: post #54
est wrote: post #53

I didn't quite get the CSP part. Why use and srcdoc and instead of a real server header? Static hosting?

If you host iframe apps at a fixed URL like: /-/apps/iframe-content/timeline.html You can protect it with CSP headers, but you can't also protect it with the sandbox="" attribute (should a user visit it directly) If you want both sandbox= restrictions and CSP headers at the same time the only way I've found that works cross all major borders is the iframe plus srcdoc="" with injected CSP meta headers patterns. Note t…

[dead]

Re: Datasette Apps: Host custom HTML applications inside Datasette

#57

Post by simonw »

jumpkick wrote: post #41
uberex wrote: post #29

Earlier quoted context omitted.

Like MS Access on web?

Imagine if this were built into browsers and you only had to serve a SQLite file.

I have a version of Datasette that runs entirely in the browser (using Pyodide and WebAssembly) and it's smaller than a lot of modern React homepages (12.35MB):

https://lite.datasette.io/

My more recent prototype shrinks that to 10.47 MB transferred: https://simonw.github.io/research/pyodide-asgi-browser/datas...

Re: Datasette Apps: Host custom HTML applications inside Datasette

#58

Post by uberex »

mpeg wrote: post #47
iLoveOncall wrote: post #28

Earlier quoted context omitted.

Because it's pretty much worthless. You almost never need just a basic list of all the data in your table, even if you're able to filter and sort it. There's no moat there at all. People need serious BI tools, and that throws simplicity out of the window (PowerBI, QuickSight, etc.).

I disagree, a lot of the time people buy "serious BI tools" precisely because they think they need all that power and complexity. In reality, what most people need is much simpler, a mini app with some curated datasets and simple filters, maybe some AI querying if we want to get fancy. There's some companies out there that work with big data, but for the rest of us small data is ok.

duckdb -ui

Re: Datasette Apps: Host custom HTML applications inside Datasette

#59

Post by skeeter2020 »

lmeyerov wrote: post #45

Multiple projects are coming to the same point it seems. Motherduck has been marketing "dives" since the beginning of the year ( https://motherduck.com/blog/duck-dive-and-answer/ ) and in the Louie.ai team, we have been iterating on different patterns for similar needs. I'm getting the feeling that the answer to SaaS apps as fixed UIs over databases being dead because of coding agents means just the fixed dashboard p…

At the enterprise level this feels a lot like Snowflake buying StreamLit to try and have a similar experience, and keep you in the Snowflake ecosystem burning credits.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#60

Post by cxr »

simonw wrote: post #54
est wrote: post #53

I didn't quite get the CSP part. Why use and srcdoc and instead of a real server header? Static hosting?

If you host iframe apps at a fixed URL like: /-/apps/iframe-content/timeline.html You can protect it with CSP headers, but you can't also protect it with the sandbox="" attribute (should a user visit it directly) If you want both sandbox= restrictions and CSP headers at the same time the only way I've found that works cross all major borders is the iframe plus srcdoc="" with injected CSP meta headers patterns. Note t…

CSP is optional and designed to be one part of a defense-in-depth strategy (to extent that it was thoughtfully designed at all—it's an awful standard that should not have made it past proposal stage). It's not a solution for sandboxing untrusted content and should not be relied upon that way. Treating it like one is a great demonstration of how some uses of CSP make people more vulnerable.
Post reply on HN