From f2f9a628039b1d3b0d2306570b722c80d4a34d5b Mon Sep 17 00:00:00 2001 From: ZdenekSrotyr Date: Wed, 8 Apr 2026 12:29:27 +0200 Subject: [PATCH] fix: set enable_external_access=false AFTER ATTACHing extracts --- src/db.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/db.py b/src/db.py index b81f0d3..87cd328 100644 --- a/src/db.py +++ b/src/db.py @@ -222,11 +222,7 @@ def get_analytics_db_readonly() -> duckdb.DuckDBPyConnection: db_path.parent.mkdir(parents=True, exist_ok=True) return duckdb.connect(str(db_path), read_only=False) conn = duckdb.connect(str(db_path), read_only=True) - try: - conn.execute("SET enable_external_access = false") - except Exception: - pass - # ATTACH extract.duckdb files so views referencing them work + # ATTACH extract.duckdb files FIRST so views referencing them work extracts_dir = _get_data_dir() / "extracts" if extracts_dir.exists(): for ext_dir in sorted(extracts_dir.iterdir()): @@ -236,6 +232,11 @@ def get_analytics_db_readonly() -> duckdb.DuckDBPyConnection: conn.execute(f"ATTACH '{db_file}' AS {ext_dir.name} (READ_ONLY)") except Exception: pass + # Disable external access AFTER attaches (blocks user file reads but allows attached DBs) + try: + conn.execute("SET enable_external_access = false") + except Exception: + pass return conn