TypeDAL 4.8.7__tar.gz → 4.9.0__tar.gz

typedal-4.9.0/.crush/.gitignore

@@ -0,0 +1 @@
+*

typedal-4.9.0/.crush/logs/crush.log

@@ -0,0 +1,37 @@
+{"time":"2026-01-20T14:19:21.359487106+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":55},"msg":"Fetching providers from Catwalk"}
+{"time":"2026-01-20T14:19:21.518115889+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":63},"msg":"Catwalk providers not modified"}
+{"time":"2026-01-20T14:19:21.52626179+01:00","level":"INFO","msg":"OK   20250424200609_initial.sql (1.52ms)"}
+{"time":"2026-01-20T14:19:21.526651475+01:00","level":"INFO","msg":"OK   20250515105448_add_summary_message_id.sql (330.71µs)"}
+{"time":"2026-01-20T14:19:21.526995425+01:00","level":"INFO","msg":"OK   20250624000000_add_created_at_indexes.sql (325.29µs)"}
+{"time":"2026-01-20T14:19:21.527303588+01:00","level":"INFO","msg":"OK   20250627000000_add_provider_to_messages.sql (293.15µs)"}
+{"time":"2026-01-20T14:19:21.52790648+01:00","level":"INFO","msg":"OK   20250810000000_add_is_summary_message.sql (495.71µs)"}
+{"time":"2026-01-20T14:19:21.528316924+01:00","level":"INFO","msg":"OK   20250812000000_add_todos_to_sessions.sql (389.38µs)"}
+{"time":"2026-01-20T14:19:21.528324939+01:00","level":"INFO","msg":"goose: successfully migrated database to version: 20250812000000"}
+{"time":"2026-01-20T14:19:21.528356959+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.(*App).initLSPClients","file":"github.com/charmbracelet/crush/internal/app/lsp.go","line":21},"msg":"LSP clients initialization started in background"}
+{"time":"2026-01-20T14:19:21.52843831+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.New.func1","file":"github.com/charmbracelet/crush/internal/app/app.go","line":102},"msg":"Initializing MCP clients"}
+{"time":"2026-01-20T14:21:06.413595152+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:21:14.539289381+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:21:15.710688424+01:00","level":"WARN","source":{"function":"github.com/charmbracelet/crush/internal/agent/tools.init.func1","file":"github.com/charmbracelet/crush/internal/agent/tools/rg.go","line":18},"msg":"Ripgrep (rg) not found in $PATH. Some grep features might be limited or slower."}
+{"time":"2026-01-20T14:21:17.08089755+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:21:17.151106375+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:22:05.503761296+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:26:05.030425805+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:36:26.778665189+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T14:38:51.314473736+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T15:02:22.602405814+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.(*App).Shutdown.func1","file":"github.com/charmbracelet/crush/internal/app/app.go","line":403},"msg":"Shutdown took 6.62949ms"}
+{"time":"2026-01-20T15:02:23.719585648+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":55},"msg":"Fetching providers from Catwalk"}
+{"time":"2026-01-20T15:02:23.881789126+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":63},"msg":"Catwalk providers not modified"}
+{"time":"2026-01-20T15:02:23.884044691+01:00","level":"INFO","msg":"goose: no migrations to run. current version: 20250812000000"}
+{"time":"2026-01-20T15:02:23.884082792+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.(*App).initLSPClients","file":"github.com/charmbracelet/crush/internal/app/lsp.go","line":21},"msg":"LSP clients initialization started in background"}
+{"time":"2026-01-20T15:02:23.884273487+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.New.func1","file":"github.com/charmbracelet/crush/internal/app/app.go","line":102},"msg":"Initializing MCP clients"}
+{"time":"2026-01-20T15:04:13.024457515+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T15:04:14.232072885+01:00","level":"WARN","source":{"function":"github.com/charmbracelet/crush/internal/agent/tools.init.func1","file":"github.com/charmbracelet/crush/internal/agent/tools/rg.go","line":18},"msg":"Ripgrep (rg) not found in $PATH. Some grep features might be limited or slower."}
+{"time":"2026-01-20T15:11:24.612161916+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.(*App).Shutdown.func1","file":"github.com/charmbracelet/crush/internal/app/app.go","line":403},"msg":"Shutdown took 9.537141ms"}
+{"time":"2026-01-20T15:11:25.263960575+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":55},"msg":"Fetching providers from Catwalk"}
+{"time":"2026-01-20T15:11:25.431990051+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/config.(*catwalkSync).Get.func1","file":"github.com/charmbracelet/crush/internal/config/catwalk.go","line":63},"msg":"Catwalk providers not modified"}
+{"time":"2026-01-20T15:11:25.434282035+01:00","level":"INFO","msg":"goose: no migrations to run. current version: 20250812000000"}
+{"time":"2026-01-20T15:11:25.434366662+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.(*App).initLSPClients","file":"github.com/charmbracelet/crush/internal/app/lsp.go","line":21},"msg":"LSP clients initialization started in background"}
+{"time":"2026-01-20T15:11:25.434579879+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/app.New.func1","file":"github.com/charmbracelet/crush/internal/app/app.go","line":102},"msg":"Initializing MCP clients"}
+{"time":"2026-01-20T15:24:40.456010578+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).generateTitle","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":788},"msg":"generated title with small model"}
+{"time":"2026-01-20T15:24:51.673808433+01:00","level":"WARN","source":{"function":"github.com/charmbracelet/crush/internal/agent/tools.init.func1","file":"github.com/charmbracelet/crush/internal/agent/tools/rg.go","line":18},"msg":"Ripgrep (rg) not found in $PATH. Some grep features might be limited or slower."}
+{"time":"2026-01-20T15:26:03.868420566+01:00","level":"INFO","source":{"function":"github.com/charmbracelet/crush/internal/agent.(*sessionAgent).Cancel","file":"github.com/charmbracelet/crush/internal/agent/agent.go","line":907},"msg":"Request cancellation initiated","session_id":"4c2d1684-8db2-4ffd-83bb-9c08fe850f29"}

{typedal-4.8.7 → typedal-4.9.0}/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 <!--next-version-placeholder-->
 
+## v4.9.0 (2026-06-12)
+
+### Feature
+
+* **orm:** Add table and query builder permissions ([`e737666`](https://github.com/trialandsuccess/TypeDAL/commit/e737666b5f16a62a7c71ff1e0c21ed9d4f7418f5))
+
 ## v4.8.7 (2026-06-11)
 
 ### Fix

{typedal-4.8.7 → typedal-4.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: TypeDAL
-Version: 4.8.7
+Version: 4.9.0
 Summary: Typing support for PyDAL
 Project-URL: Documentation, https://typedal.readthedocs.io/
 Project-URL: Issues, https://github.com/trialandsuccess/TypeDAL/issues

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/__about__.py

@@ -5,4 +5,4 @@ This file contains the Version info for this package.
 # SPDX-FileCopyrightText: 2023-present Robin van der Noord <robinvandernoord@gmail.com>
 #
 # SPDX-License-Identifier: MIT
-__version__ = "4.8.7"
+__version__ = "4.9.0"

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/core.py

@@ -37,7 +37,7 @@ except ImportError:  # pragma: no cover
 if t.TYPE_CHECKING:
     from .fields import TypedField
     from .query_builder import QueryBuilder
-    from .types import AnyDict, Expression, Rows, Set, T_Query, Table
+    from .types import AnyDict, DefineKwargs, Expression, Rows, Set, T_Query, Table
 
 
 # note: these functions can not be moved to a different file,
@@ -304,7 +304,11 @@ class TypeDAL(_TypeDALBase):
     }
 
     @t.overload
-    def define[T: t.Any](self, maybe_cls: None = None, **kwargs: t.Any) -> t.Callable[[t.Type[T]], t.Type[T]]:
+    def define[T: t.Any](
+        self,
+        maybe_cls: None = None,
+        **kwargs: t.Unpack[DefineKwargs],
+    ) -> t.Callable[[t.Type[T]], t.Type[T]]:
         """
         Typing Overload for define without a class.
 
@@ -313,7 +317,7 @@ class TypeDAL(_TypeDALBase):
         """
 
     @t.overload
-    def define[T: t.Any](self, maybe_cls: t.Type[T], **kwargs: t.Any) -> t.Type[T]:
+    def define[T: t.Any](self, maybe_cls: t.Type[T], **kwargs: t.Unpack[DefineKwargs]) -> t.Type[T]:
         """
         Typing Overload for define with a class.
 
@@ -324,7 +328,7 @@ class TypeDAL(_TypeDALBase):
     def define[T: t.Any](
         self,
         maybe_cls: t.Type[T] | None = None,
-        **kwargs: t.Any,
+        **kwargs: t.Unpack[DefineKwargs],
     ) -> t.Type[T] | t.Callable[[t.Type[T]], t.Type[T]]:
         """
         Can be used as a decorator on a class that inherits `TypedTable`, \

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/define.py

@@ -30,7 +30,7 @@ from .helpers import (
 )
 from .relationships import Relationship, to_relationship
 from .tables import TypedTable
-from .types import Field, T_annotation, Table, _Types
+from .types import DefineKwargs, Field, Permissions, T_annotation, Table, _Types
 
 try:
     # python 3.14+
@@ -68,8 +68,9 @@ class TableDefinitionBuilder:
         self.db = db
         self.class_map: dict[str, t.Type["TypedTable"]] = {}
 
-    def define[T: t.Any](self, cls: t.Type[T], **kwargs: t.Any) -> t.Type[T]:
+    def define[T: t.Any](self, cls: t.Type[T], **kwargs: t.Unpack[DefineKwargs]) -> t.Type[T]:
         """Build and register a table from a TypedTable class."""
+        permissions: Permissions | None = kwargs.pop("permissions", None)
         full_dict = all_dict(cls)
         tablename = to_snake(cls.__name__)
         annotations = all_annotations(cls)
@@ -116,6 +117,7 @@ class TableDefinitionBuilder:
                 db=self.db,
                 table=table,
                 relationships=t.cast(dict[str, Relationship[t.Any]], relationships),
+                permissions=permissions,
             )
             self.class_map[str(table)] = cls  # tablename - pydal name
             self.class_map[cls.__name__] = cls  # TableName - typedal name

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/query_builder.py

@@ -33,12 +33,15 @@ from .types import (
     Metadata,
     OnQuery,
     OrderBy,
+    Permissions,
     Query,
     Row,
     Rows,
     SelectKwargs,
     T_MetaInstance,
     Table,
+    merge_permissions,
+    require_permission,
 )
 
 
@@ -53,6 +56,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
     select_kwargs: SelectKwargs
     relationships: dict[str, Relationship[t.Any]]
     metadata: Metadata
+    _permissions: Permissions
 
     def __init__(
         self,
@@ -62,6 +66,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         select_kwargs: t.Optional[SelectKwargs] = None,
         relationships: dict[str, Relationship[t.Any]] = None,
         metadata: Metadata = None,
+        permissions: Permissions | None = None,
     ):
         """
         Normally, you wouldn't manually initialize a QueryBuilder but start using a method on a TypedTable.
@@ -77,6 +82,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         self.select_kwargs = select_kwargs or {}
         self.relationships = relationships or {}
         self.metadata = metadata or {}
+        self._permissions = merge_permissions(getattr(model, "_permissions", None), permissions)
 
     def _ensure_table_defined(self) -> Table:
         model = self.model
@@ -130,6 +136,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         select_kwargs: t.Optional[SelectKwargs] = None,
         relationships: dict[str, Relationship[t.Any]] = None,
         metadata: Metadata = None,
+        permissions: Permissions | None = None,
     ) -> "QueryBuilder[T_MetaInstance]":
         return QueryBuilder(
             self.model,
@@ -138,8 +145,15 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
             (self.select_kwargs | select_kwargs) if select_kwargs else self.select_kwargs,
             (self.relationships | relationships) if relationships else self.relationships,
             (self.metadata | (metadata or {})) if metadata else self.metadata,
+            permissions=merge_permissions(self._permissions, permissions),
         )
 
+    def permissions(self, **permissions: t.Unpack[Permissions]) -> "QueryBuilder[T_MetaInstance]":
+        """
+        Return a clone of this builder with permission overrides merged in.
+        """
+        return self._extend(permissions=t.cast(Permissions, permissions))
+
     def select(self, *fields: t.Any, **options: t.Unpack[SelectKwargs]) -> "QueryBuilder[T_MetaInstance]":
         """
         Fields: database columns by name ('id'), by field reference (table.id) or other (e.g. table.ALL).
@@ -455,6 +469,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         """
         Based on the current query, delete rows and return a list of deleted IDs.
         """
+        require_permission(self._permissions, "delete")
         db = self._get_db()
         removed_ids = [_.id for _ in db(self.query).select("id")]
         if db(self.query).delete():
@@ -472,6 +487,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         Based on the current query, update `fields` and return a list of updated IDs.
         """
         # todo: limit?
+        require_permission(self._permissions, "update")
         db = self._get_db()
         updated_ids = db(self.query).select("id").column("id")
         if db(self.query).update(**fields):
@@ -553,6 +569,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         """
         Raw version of .collect which only executes the SQL, without performing t.Any magic afterwards.
         """
+        require_permission(self._permissions, "read")
         db = self._get_db()
         metadata: Metadata = self.metadata.copy()
 
@@ -579,6 +596,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         """
         Execute the built query and turn it into model instances, while handling relationships.
         """
+        require_permission(self._permissions, "read")
         if _to is None:
             _to = TypedRows
         into = _into or self.model
@@ -1092,6 +1110,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         """
         Return the amount of rows matching the current query.
         """
+        require_permission(self._permissions, "read")
         db = self._get_db()
         query = self.__count(db, distinct=distinct)
 
@@ -1115,6 +1134,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         Returns:
             bool: A boolean indicating whether t.Any records exist.
         """
+        require_permission(self._permissions, "read")
         return bool(self.count())
 
     def __paginate(
@@ -1146,6 +1166,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
         Note: when using relationships, this limit is only applied to the 'main' table and t.Any number of extra rows \
             can be loaded with relationship data!
         """
+        require_permission(self._permissions, "read")
         builder = self.__paginate(limit, page)
 
         rows = t.cast(PaginatedRows[T_MetaInstance], builder.collect(verbose=verbose, _to=PaginatedRows))
@@ -1176,6 +1197,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
                     pass
             ```
         """
+        require_permission(self._permissions, "read")
         page = 1
 
         while rows := self.__paginate(chunk_size, page).collect():
@@ -1188,6 +1210,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
 
         Also adds paginate, since it would be a waste to select more rows than needed.
         """
+        require_permission(self._permissions, "read")
         row = self.paginate(page=1, limit=1, verbose=verbose).first()
         if not row:
             return None
@@ -1207,6 +1230,7 @@ class QueryBuilder[T_MetaInstance: _TypedTable]:
 
         Basically unwraps t.Optional type.
         """
+        require_permission(self._permissions, "read")
         return self.first(verbose=verbose) or throw(exception or ValueError("Nothing found!"))
 
 

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/tables.py

@@ -28,6 +28,7 @@ from .types import (
     OnQuery,
     OpRow,
     OrderBy,
+    Permissions,
     Query,
     QueryLike,
     Reference,
@@ -37,6 +38,8 @@ from .types import (
     T_MetaInstance,
     T_Query,
     Table,
+    merge_permissions,
+    require_permission,
 )
 
 if t.TYPE_CHECKING:
@@ -97,18 +100,26 @@ class TableMeta(type):
     _db: TypeDAL | None = None
     _table: Table | None = None
     _relationships: dict[str, Relationship[t.Any]] | None = None
+    _permissions: Permissions | None = None
 
     #########################
     # TypeDAL custom logic: #
     #########################
 
-    def __set_internals__(self, db: pydal.DAL, table: Table, relationships: dict[str, Relationship[t.Any]]) -> None:
+    def __set_internals__(
+        self,
+        db: pydal.DAL,
+        table: Table,
+        relationships: dict[str, Relationship[t.Any]],
+        permissions: Permissions | None = None,
+    ) -> None:
         """
         Store the related database and pydal table for later usage.
         """
         self._db = db
         self._table = table
         self._relationships = relationships
+        self._permissions = merge_permissions(permissions)
 
     def __getattr__(self, col: str) -> t.Optional[Field]:
         """
@@ -186,6 +197,7 @@ class TableMeta(type):
 
         """
         table = self._ensure_table_defined()
+        require_permission(self._permissions, "insert")
 
         result = table.insert(**fields)
         # it already is an int but mypy doesn't understand that
@@ -201,6 +213,7 @@ class TableMeta(type):
         Insert multiple rows, returns a TypedRows set of new instances.
         """
         table = self._ensure_table_defined()
+        require_permission(self._permissions, "insert")
         result = table.bulk_insert(items)
         return self.where(lambda row: row.id.belongs(result)).collect()
 
@@ -239,6 +252,7 @@ class TableMeta(type):
         Returns a tuple of (the created instance, a dict of errors).
         """
         table = self._ensure_table_defined()
+        require_permission(self._permissions, "insert")
         result = table.validate_and_insert(**fields)
         if row_id := result.get("id"):
             return self(row_id), None
@@ -256,6 +270,7 @@ class TableMeta(type):
         Returns a tuple of (the updated instance, a dict of errors).
         """
         table = self._ensure_table_defined()
+        require_permission(self._permissions, "update")
 
         result = table.validate_and_update(query, **fields)
 
@@ -278,7 +293,14 @@ class TableMeta(type):
         Returns a tuple of (the updated/created instance, a dict of errors).
         """
         table = self._ensure_table_defined()
-        result = table.validate_and_update_or_insert(query, **fields)
+        record = table(query)
+
+        if record:
+            require_permission(self._permissions, "update")
+            result = table.validate_and_update(query, **fields)
+        else:
+            require_permission(self._permissions, "insert")
+            result = table.validate_and_insert(**fields)
 
         if errors := result.get("errors"):
             return None, errors
@@ -348,6 +370,12 @@ class TableMeta(type):
         """
         return QueryBuilder(self).cache(*deps, **kwargs)
 
+    def permissions(self: t.Type[T_MetaInstance], **permissions: bool) -> "QueryBuilder[T_MetaInstance]":
+        """
+        See QueryBuilder.permissions!
+        """
+        return QueryBuilder(self).permissions(**permissions)
+
     def count(self: t.Type[T_MetaInstance]) -> int:
         """
         See QueryBuilder.count!
@@ -1254,12 +1282,14 @@ class TypedTable(_TypedTable, metaclass=TableMeta):
             return None
 
     def _update(self: T_MetaInstance, **fields: t.Any) -> T_MetaInstance:
+        require_permission(getattr(self, "_permissions", None), "update")
         row = self._ensure_matching_row()
         row.update(**fields)
         self.__dict__.update(**fields)
         return self
 
     def _update_record(self: T_MetaInstance, **fields: t.Any) -> T_MetaInstance:
+        require_permission(getattr(self, "_permissions", None), "update")
         row = self._ensure_matching_row()
         new_row = row.update_record(**fields)
         self._update(**new_row)
@@ -1277,6 +1307,7 @@ class TypedTable(_TypedTable, metaclass=TableMeta):
         """
         Actual logic in `pydal.helpers.classes.RecordDeleter`.
         """
+        require_permission(getattr(self, "_permissions", None), "delete")
         row = self._ensure_matching_row()
         result = row.delete_record()
         self.__dict__ = {}  # empty self, since row is no more.

{typedal-4.8.7 → typedal-4.9.0}/src/typedal/types.py

@@ -44,6 +44,41 @@ Template: t.TypeAlias = TemplateAlias  # explicit export for mypy, NOT a `type`
 type AnyCallable = t.Callable[..., t.Any]
 type AnyDict = dict[str, t.Any]
 
+PermissionType = t.Literal["read", "insert", "update", "delete"]
+
+type Permissions = dict[PermissionType, bool]
+
+
+def merge_permissions(*permission_sets: Permissions | None) -> Permissions:
+    """
+    Merge zero or more permission mappings, keeping the most restrictive result.
+
+    Unspecified flags default to allowed.
+    """
+    permission_types = t.get_args(PermissionType)
+    merged: dict[str, bool] = {key: True for key in permission_types}
+
+    for permission_set in permission_sets:
+        if not permission_set:
+            continue
+
+        for key in permission_types:
+            if key in permission_set:
+                merged[key] = merged[key] and bool(permission_set[key])
+
+    return t.cast(Permissions, merged)
+
+
+def permission_allowed(permissions: Permissions | None, action: PermissionType) -> bool:
+    """Return whether the given permission flag is enabled."""
+    return merge_permissions(permissions).get(action, False)
+
+
+def require_permission(permissions: Permissions | None, action: PermissionType) -> None:
+    """Raise PermissionError when a permission flag is disabled."""
+    if not permission_allowed(permissions, action):
+        raise PermissionError(f"{action} is not allowed")
+
 
 # ---------------------------------------------------------------------------
 # Protocols
@@ -307,6 +342,35 @@ class FieldSettings(t.TypedDict, total=False):
     rname: str
 
 
+class DefineKwargs(t.TypedDict, total=False):
+    """
+    Keyword arguments accepted by `db.define()` and forwarded to `define_table()`.
+
+    `cache_dependency` is internal to TypeDAL and stripped before calling PyDAL.
+    """
+
+    # typedal-specific
+    cache_dependency: bool
+    permissions: Permissions
+
+    # common
+    fake_migrate: bool
+    migrate: bool
+    redefine: bool
+    rname: str
+    singular: str
+    plural: str
+    format: str
+
+    # pydal-internals
+    common_filter: t.Callable[..., t.Any]
+    on_define: t.Callable[["Table"], t.Any]
+    primarykey: list[str] | tuple[str, ...]
+    sequence_name: str
+    table_class: type[t.Any]
+    trigger_name: str
+
+
 # ---------------------------------------------------------------------------
 # Generics & Query Helpers
 # ---------------------------------------------------------------------------

{typedal-4.8.7 → typedal-4.9.0}/tests/test_helpers.py

@@ -26,7 +26,7 @@ from src.typedal.helpers import (
     to_snake,
     unwrap_type,
 )
-from src.typedal.types import Field
+from src.typedal.types import Field, merge_permissions
 
 
 def test_is_union():
@@ -273,3 +273,8 @@ def test_sql_expression_314():
     from .py314_tests import test_sql_expression_314
 
     test_sql_expression_314(database)
+
+def test_merge_permissions():
+    combined = merge_permissions({"read": True, "insert": False}, {"read": False, "insert": False})
+    assert len(combined) == 4
+    assert combined == {"read": False, "insert": False, "update": True, "delete": True}

{typedal-4.8.7 → typedal-4.9.0}/tests/test_main.py

@@ -187,6 +187,47 @@ def test_mixed_defines(capsys):
     assert db.find_model(SecondNewSyntax._rname) is SecondNewSyntax
 
 
+def test_disallow_insert():
+    @db.define(permissions={"insert": False})
+    class ReadOnlyTable(TypedTable):
+        name: str
+
+    with pytest.raises(PermissionError, match="insert"):
+        ReadOnlyTable.insert(name="blocked")
+
+    with pytest.raises(PermissionError, match="insert"):
+        ReadOnlyTable.bulk_insert([{"name": "blocked"}])
+
+    with pytest.raises(PermissionError, match="insert"):
+        ReadOnlyTable.validate_and_insert(name="blocked")
+
+    with pytest.raises(PermissionError, match="insert"):
+        ReadOnlyTable.update_or_insert(name="blocked")
+
+
+def test_disallow_update_and_delete():
+    @db.define(permissions={"update": False})
+    class ReadOnlyUpdateTable(TypedTable):
+        name: str
+
+    update_row = ReadOnlyUpdateTable.insert(name="seed")
+
+    with pytest.raises(PermissionError, match="update"):
+        update_row.update_record(name="changed")
+
+    with pytest.raises(PermissionError, match="update"):
+        ReadOnlyUpdateTable.update(ReadOnlyUpdateTable.id == update_row.id, name="changed")
+
+    @db.define(permissions={"delete": False})
+    class ReadOnlyDeleteTable(TypedTable):
+        name: str
+
+    delete_row = ReadOnlyDeleteTable.insert(name="seed")
+
+    with pytest.raises(PermissionError, match="delete"):
+        delete_row.delete_record()
+
+
 def test_dont_allow_bool_in_query():
     with pytest.raises(ValueError):
         db(True)

{typedal-4.8.7 → typedal-4.9.0}/tests/test_query_builder.py

@@ -627,6 +627,32 @@ def test_minimal_functionality_on_pydal_style_tables():
     assert first_or_fail.id == qb1.first().id
 
 
+def test_query_builder_permissions():
+    _setup_data()
+
+    read_restricted = TestQueryTable.permissions(read=False).where(number=2)
+
+    # to_sql stays available because it is an internal/debug helper, not a query execution path.
+    assert "select" in read_restricted.to_sql().lower()
+
+    with pytest.raises(PermissionError, match="read"):
+        read_restricted.collect()
+
+    update_only = TestQueryTable.permissions(read=False, update=True, delete=False).where(number=2)
+    assert update_only.update(number=20) == [3]
+    assert TestQueryTable(3).number == 20
+
+    delete_only = TestQueryTable.where(number=4).permissions(read=False, update=False, delete=True)
+    assert delete_only.delete() == [5]
+    assert TestQueryTable(5) is None
+
+    with pytest.raises(PermissionError, match="update"):
+        TestQueryTable.where(number=1).permissions(update=False).update(number=11)
+
+    with pytest.raises(PermissionError, match="delete"):
+        TestQueryTable.where(number=0).permissions(delete=False).delete()
+
+
 def test_before_after_collect(capsys):
     _setup_data()