{"action":"created","issue":{"url":"https://api.github.com/repos/datajoint/datajoint-python/issues/268","repository_url":"https://api.github.com/repos/datajoint/datajoint-python","labels_url":"https://api.github.com/repos/datajoint/datajoint-python/issues/268/labels{/name}","comments_url":"https://api.github.com/repos/datajoint/datajoint-python/issues/268/comments","events_url":"https://api.github.com/repos/datajoint/datajoint-python/issues/268/events","html_url":"https://github.com/datajoint/datajoint-python/issues/268","id":193802561,"number":268,"title":"Missing INSERT privileges for log table results in error","user":{"login":"aecker","id":1311920,"avatar_url":"https://avatars.githubusercontent.com/u/1311920?v=3","gravatar_id":"","url":"https://api.github.com/users/aecker","html_url":"https://github.com/aecker","followers_url":"https://api.github.com/users/aecker/followers","following_url":"https://api.github.com/users/aecker/following{/other_user}","gists_url":"https://api.github.com/users/aecker/gists{/gist_id}","starred_url":"https://api.github.com/users/aecker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aecker/subscriptions","organizations_url":"https://api.github.com/users/aecker/orgs","repos_url":"https://api.github.com/users/aecker/repos","events_url":"https://api.github.com/users/aecker/events{/privacy}","received_events_url":"https://api.github.com/users/aecker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-12-06T15:31:24Z","updated_at":"2016-12-06T19:21:08Z","closed_at":null,"body":"Due to the new log table users with only SELECT privileges on a schema cannot access this schema anymore. Instead, they get an error since entering the log entry fails.\r\n\r\nA possible workaround is to give the user access to only the log table via\r\n\r\n    GRANT INSERT ON `schema`.`~logs` TO 'user'\r\n\r\nHowever, this is cumbersome, since it needs to be done for every user and schema, and tools like e.g. MySQL Workbench do not show (or let you edit) per-table access rights, requiring the admin to do this via the command line.\r\n\r\nThe simplest solution would be to catch the error and skip logging in this case. Since the user has only SELECT privileges, there isn't anything (s)he can do that needs to be logged anyway (assuming that the user does not have additional per-table privileges declared for other tables in this schema).\r\n\r\nAlternatively, we could store the logs in a separate schema, simplifying the access privileges."},"comment":{"url":"https://api.github.com/repos/datajoint/datajoint-python/issues/comments/265245530","html_url":"https://github.com/datajoint/datajoint-python/issues/268#issuecomment-265245530","issue_url":"https://api.github.com/repos/datajoint/datajoint-python/issues/268","id":265245530,"user":{"login":"dimitri-yatsenko","id":1096169,"avatar_url":"https://avatars.githubusercontent.com/u/1096169?v=3","gravatar_id":"","url":"https://api.github.com/users/dimitri-yatsenko","html_url":"https://github.com/dimitri-yatsenko","followers_url":"https://api.github.com/users/dimitri-yatsenko/followers","following_url":"https://api.github.com/users/dimitri-yatsenko/following{/other_user}","gists_url":"https://api.github.com/users/dimitri-yatsenko/gists{/gist_id}","starred_url":"https://api.github.com/users/dimitri-yatsenko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dimitri-yatsenko/subscriptions","organizations_url":"https://api.github.com/users/dimitri-yatsenko/orgs","repos_url":"https://api.github.com/users/dimitri-yatsenko/repos","events_url":"https://api.github.com/users/dimitri-yatsenko/events{/privacy}","received_events_url":"https://api.github.com/users/dimitri-yatsenko/received_events","type":"User","site_admin":false},"created_at":"2016-12-06T19:21:08Z","updated_at":"2016-12-06T19:21:08Z","body":"It seems a bit insecure.  Users can view their logs.  They should not see other people's logs.  So we are still not avoiding the problem of table-level access control.  \r\n\r\nI vote for keeping the logs and the jobs and all the other auxiliary tables in the same schema that they describe."}}
{"actor":{"display_login":"dimitri-yatsenko"}}