$user token in permissions constraint not behaving according to documentation #11099

New Issue

adam · 2025-12-29T21:40:18+01:00

adam commented

2025-12-29 21:40:18 +01:00

Originally created by @Padnezz on GitHub (Apr 29, 2025).

Deployment Type

Self-hosted

NetBox Version

v4.0.10

Python Version

3.11

Steps to Reproduce

New netbox instance with empty db
Create user u1 with default privileges, active user
Create permissions structure p1 with the following settings:
--Can view
--Can edit
--Object type: Tenancy: Contact assignments
--User: u1
--Constraint: {"contact__name": "$user"}
-With default values in all other choices
Create site s1, with default values in all other choices
Create device role dr1, with default values in all other choices
Create manufacutrer m1, with default values in all other choices
Create device type dv1, using manufacturer m1, with default values in all other choices
Create device d1, using device role dr1, manufacturer m1, device type dv1, with default values in all other choices
Create contact role cr1
Create contact with same name as user u1
Create API key for user u1,
Run API call to assign contact u1 with contact role cr1 to device d1 (All IDs are 1 as we don't expect to have anything else beforehand)
curl -X 'POST' "${NB_HOST}/api/tenancy/contact-assignments/" -H 'accept: application/json' -H 'Content-Type: application/json' -H "Authorization: Token ${NB_KEY}" -d '{ "object_type": "dcim.device", "object_id": 1,"contact": {"id" : 1},"role": {"id": 1}}'

Expected Behavior

Contact u1 with contact role cr1 is assigned on device d1, using the API key from user u1. This is because the permissions constraint should pass, because the name of contact u1 string equals the username of u1. This happens up until Netbox version v4.0.9.
According to the documentation in https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/ > User Token, we understand that we can use $user as a string value. Our prod instance (Netbox version v3.7.8) is built upon this behavior using contacts and users in the Netbox instance.

Observed Behavior

API instead returns {"detail":"You do not have permission to perform this action."} and no action is performed on the device d1. This happens in Netbox version v4.0.10 and beyond. Setting the string u1 in the permissions constraint instead of $user works though.
We were unable to test the example constraint according to documentation https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/ > User Token as the API does not return a created_by object on dcim.device GET requests.

Is this PR the reason for this? https://github.com/netbox-community/netbox/pull/17268
Should we be using $user another way?

Originally created by @Padnezz on GitHub (Apr 29, 2025). ### Deployment Type Self-hosted ### NetBox Version v4.0.10 ### Python Version 3.11 ### Steps to Reproduce 1. New netbox instance with empty db 2. Create user `u1` with default privileges, active user 3. Create permissions structure `p1` with the following settings: --Can view --Can edit --Object type: Tenancy: Contact assignments --User: u1 --Constraint: `{"contact__name": "$user"}` -With default values in all other choices 4. Create site `s1`, with default values in all other choices 5. Create device role `dr1`, with default values in all other choices 6. Create manufacutrer `m1`, with default values in all other choices 7. Create device type `dv1`, using manufacturer `m1`, with default values in all other choices 8. Create device `d1`, using device role `dr1`, manufacturer `m1`, device type `dv1`, with default values in all other choices 9. Create contact role `cr1` 10. Create contact with same name as user `u1` 11. Create API key for user `u1`, 12. Run API call to assign contact `u1` with contact role `cr1` to device `d1` (All IDs are `1` as we don't expect to have anything else beforehand) `curl -X 'POST' "${NB_HOST}/api/tenancy/contact-assignments/" -H 'accept: application/json' -H 'Content-Type: application/json' -H "Authorization: Token ${NB_KEY}" -d '{ "object_type": "dcim.device", "object_id": 1,"contact": {"id" : 1},"role": {"id": 1}}'` ### Expected Behavior Contact `u1` with contact role `cr1` is assigned on device `d1`, using the API key from user `u1`. This is because the permissions constraint should pass, because the name of contact `u1` string equals the username of `u1`. This happens up until Netbox version `v4.0.9`. According to the documentation in https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/ > _**User Token**_, we understand that we can use `$user` as a string value. Our prod instance (Netbox version `v3.7.8`) is built upon this behavior using contacts and users in the Netbox instance. ### Observed Behavior API instead returns `{"detail":"You do not have permission to perform this action."}` and no action is performed on the device `d1`. This happens in Netbox version `v4.0.10` and beyond. Setting the string `u1` in the permissions constraint instead of `$user` works though. We were unable to test the example constraint according to documentation https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/ > _**User Token**_ as the API does not return a `created_by` object on `dcim.device` GET requests. Is this PR the reason for this? https://github.com/netbox-community/netbox/pull/17268 Should we be using `$user` another way?

adam added the type: bug label 2025-12-29 21:40:18 +01:00

adam closed this issue

2025-12-29 21:40:19 +01:00

adam commented

2025-12-29 21:40:20 +01:00

@jeremystretch commented on GitHub (Apr 29, 2025):

The $user token resolves to the current user's numeric ID, not it's username, so attempting to bind a user to a contact in this manner won't work.

You could instead instead add a custom field on the Contact model to establish a relationship to the User model, and assign the contact u1 with the user u1. The update the permission constraint to:

{
    "contact__custom_field_data__user": "$user"
}

Hope that helps. I'm going to close this out as the ability to match on the name of the current user is not supported.

@jeremystretch commented on GitHub (Apr 29, 2025): The `$user` token resolves to the current user's numeric ID, not it's username, so attempting to bind a user to a contact in this manner won't work. You could instead instead add a custom field on the Contact model to establish a relationship to the User model, and assign the contact `u1` with the user `u1`. The update the permission constraint to: ``` { "contact__custom_field_data__user": "$user" } ``` Hope that helps. I'm going to close this out as the ability to match on the name of the current user is not supported.

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#11099