[Part 36] Allowing Reads and Managing File Export Separately

Viewing orders may be sufficient for a shipping check. I wanted file downloads authorized separately according to the task.

I first downloaded three orders, then disabled only Can Export on the same web SQL privilege and checked the result.

Allowing Reads and Exports Initially

I created Web Export Lab and privilege Lab - Web Export Control, selected SQL Select, and enabled Can Export. Can Import and Can Copy To Clipboard remained off.

Demo Developer received the privilege and connected in the web editor using the three fictional orders from earlier.

Checking the Downloaded CSV

Querying 27001–27003 returned status and amount, and Export was available.

In Export, I selected CSV File and included field names in the first row before exporting.

The ZIP’s export.csv contained order_id, status, total_amount and all three orders. Values, including 27002 SHIPPED 18500.00, matched the grid.

Disabling Only Can Export

I disconnected and reopened Lab - Web Export Control as administrator. I retained Select and cleared only Can Export, then saved without changing data scope or SQL privileges.

Demo Developer reconnected and ran the same SQL for IDs, statuses, and amounts.

Orders Remain Visible, Export Is Disabled

The same three orders returned, but both top-level Export and result-grid Export were greyed out and unusable.

Repeating the query still worked. Everyday checking continued while file downloads were governed by separate permissions.

Checking the Export Record

Query Audit for Demo Developer/Web Export Lab showed three reads and one export, four records total.

The download-time record was classified as Export Data. Details showed user, connection, Lab - Web Export Control, Web Editor route, target table, SQL, and success.

Necessary orders remained readable while web exports had their own permission and audit trail. That helps tailor the editor’s capabilities to the person’s job.

This lab used QueryPie Community 11.6.7/MySQL 8.0.42 web SQL editor and test orders. I revoked only this lab connection’s privilege afterward, keeping existing data and grants intact.

Reference: Privilege Type · Web SQL editor · Query Audit