GraphQL permissions don't match Rest API #10509

New Issue

adam · 2025-12-29T21:32:24+01:00

adam commented

2025-12-29 21:32:24 +01:00

Originally created by @llamafilm on GitHub (Nov 24, 2024).

Deployment Type

NetBox Enterprise

Triage priority

I'm a NetBox Labs customer

NetBox Version

v4.1.7

Python Version

3.12

Steps to Reproduce

Create a user with permission to view Devices only
Run a GraphQL query to retrieve the site name for a Device

Expected Behavior

Since this information is visible in the webpage and via Rest API, I expect it to be visible via GraphQL too.

Observed Behavior

The GraphQL query fails:

{'data': None, 'errors': [{'message': 'Cannot return null for non-nullable field DeviceType.site.', 'locations': [{'line': 8, 'column': 5}], 'path': ['device', 'site']}]}

It's not a big issue; it works fine if I grant permission to view Locations and Sites. But it seems weird that the permissions are inconsistent between the two APIs.

import requests

NETBOX_HOST = 'http://127.0.0.1'
NETBOX_TOKEN = ''

headers = {
    "Authorization": f"Token {NETBOX_TOKEN}",
    "Accept": "application/json"
}

query = r"""
query {
  device(id: 14476) {
    serial
    location {
      name
    }
    site {
      name
    }
  }
}"""
req = requests.post(f"{NETBOX_HOST}/graphql/", headers=headers, json={'query': query})
print(req.json())

### Rest API works
url = f"{NETBOX_HOST}/api/dcim/devices/14476/"
req = requests.get(url, headers=headers)
print(req.json())

Originally created by @llamafilm on GitHub (Nov 24, 2024). ### Deployment Type NetBox Enterprise ### Triage priority I'm a NetBox Labs customer ### NetBox Version v4.1.7 ### Python Version 3.12 ### Steps to Reproduce 1. Create a user with permission to view Devices only 2. Run a GraphQL query to retrieve the site name for a Device ### Expected Behavior Since this information is visible in the webpage and via Rest API, I expect it to be visible via GraphQL too. ### Observed Behavior The GraphQL query fails: > {'data': None, 'errors': [{'message': 'Cannot return null for non-nullable field DeviceType.site.', 'locations': [{'line': 8, 'column': 5}], 'path': ['device', 'site']}]} It's not a big issue; it works fine if I grant permission to view Locations and Sites. But it seems weird that the permissions are inconsistent between the two APIs. ```python import requests NETBOX_HOST = 'http://127.0.0.1' NETBOX_TOKEN = '' headers = { "Authorization": f"Token {NETBOX_TOKEN}", "Accept": "application/json" } query = r""" query { device(id: 14476) { serial location { name } site { name } } }""" req = requests.post(f"{NETBOX_HOST}/graphql/", headers=headers, json={'query': query}) print(req.json()) ### Rest API works url = f"{NETBOX_HOST}/api/dcim/devices/14476/" req = requests.get(url, headers=headers) print(req.json()) ```

adam added the type: bug topic: GraphQL severity: low labels 2025-12-29 21:32:24 +01:00

adam closed this issue

2025-12-29 21:32:24 +01:00

adam commented

2025-12-29 21:32:25 +01:00

@arthanson commented on GitHub (Dec 3, 2024):

I'm not sure this is a bug as the issue looks like it is permissions when querying the sub-objects, but it is different then the REST API so leaving it open as it will require more debugging. It may be a won't fix after investigation.

@arthanson commented on GitHub (Dec 3, 2024): I'm not sure this is a bug as the issue looks like it is permissions when querying the sub-objects, but it is different then the REST API so leaving it open as it will require more debugging. It may be a won't fix after investigation.

adam commented

2025-12-29 21:32:25 +01:00

@jeremypng commented on GitHub (Jan 23, 2025):

The REST API permissions are leaky. The GraphQL permissions are correct. The user has permission to the device, not the site object, so you can't query the site name since it is not on the device object.

I would suggest not fixing this.

EDIT: To make this fail smoother when permissions are lacking the strawberry types could be relaxed so all the fields are nullable. Since they are only used for response queries and there is no mutation support, it would allow the model to not fail if there is missing data because of a lack of permissions.

@jeremypng commented on GitHub (Jan 23, 2025): The REST API permissions are leaky. The GraphQL permissions are correct. The user has permission to the device, not the site object, so you can't query the site name since it is not on the device object. I would suggest not fixing this. EDIT: To make this fail smoother when permissions are lacking the strawberry types could be relaxed so all the fields are nullable. Since they are only used for response queries and there is no mutation support, it would allow the model to not fail if there is missing data because of a lack of permissions.

adam commented

2025-12-29 21:32:25 +01:00

@arthanson commented on GitHub (Apr 22, 2025):

Agree with not fixing as per comment above.

@arthanson commented on GitHub (Apr 22, 2025): Agree with not fixing as per comment above.

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#10509