DataGrip read-only data source enforcement in query consoles

Does the Read‑Only Flag Block DML in the Console?

In DataGrip the Read‑only checkbox is a client‑side safety net. It does not alter the underlying database user’s grants. When you turn it on, the IDE will:

• Disable direct cell edits in the Data Editor.
• Show a confirmation dialog in the Query Console before any DML/DDL statement is sent to the server.

So, an UPDATE or DELETE typed in the console is not silently blocked. The statement is executed if the database user actually has the rights to perform it. The warning dialog is the only enforcement level applied by the IDE.

Difference Between Editor and Console

The Data Editor is a transactional UI: it prevents you from clicking the Submit button when read‑only is enabled. The console, by contrast, treats the query as a script that may contain multiple statements; it only warns you, not forbids execution.

How to Verify the Behavior

1. Open a data source in DataGrip.
2. In the Data Source Properties dialog, check the Read‑only box.
3. Try editing a cell in the Data Editor – the cell should be locked and the Submit button disabled.
4. Open a Query Console for the same data source.
5. Run:

   UPDATE my_table SET col = 1 WHERE id = 42;

   The IDE will pop up a “You are about to run a DML statement on a read‑only data source” dialog. If you confirm, the statement is sent to the server.
6. Check the result. If you have UPDATE privileges, the row will change; if not, the database will return an error.

Key Takeaway

The read‑only flag is a convenience guard, not a security mechanism. Use proper database RBAC to enforce permissions.

Missing diagnostic detail: If you find that the confirmation dialog does not appear, please confirm the DataGrip version you are using, as the UI may differ slightly between releases.