starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Standard Create, Update, and Delete permissions for the Token model #2040

New Issue
Closed
opened 2025-12-29 17:21:41 +01:00 by adam · 1 comment
adam commented 2025-12-29 17:21:41 +01:00
Owner
Copy Link

Originally created by @lampwins on GitHub (Oct 2, 2018).

Environment

  • Python version: 3.6
  • NetBox version: 2.4.5

Proposed Functionality

Currently, there are no django permission controls on the user Token model. The Token model represents API tokens which users use to interact with the API. This means users are free to create their own tokens at any time.

The proposal is to add the standard Django create, update, and delete permissions to this model.

It should be made clear that this has nothing to do with API access. If a user has a valid token assigned to them (by either themselves in the past or by an administrator at any point), they may still access the API with said token. This feature is strictly about token CRUD permissions.

Use Case

In certain deployments, administrators may desire to limit API token creation for users who should only be using the web UI. Although the API uses the same permissions mechanisms as the web UI, it may make sense to an administrator to limit API token creation for some users.

It is important to note that this does not preclude any user from having a valid token assigned to them, regardless of them not being able to create it themselves. Administrators will still be able to create and assign user tokens in the admin portal, the same as they can today.

Database Changes

Remove this from the Token model:

class Meta:
        default_permissions = []

This will trigger a DB migration which will add the standard Django create, update, and delete permissions.

External Dependencies

None

Originally created by @lampwins on GitHub (Oct 2, 2018). <!-- NOTE: This form is only for proposing specific new features or enhancements. If you have a general idea or question, please post to our mailing list instead of opening an issue: https://groups.google.com/forum/#!forum/netbox-discuss NOTE: Due to an excessive backlog of feature requests, we are not currently accepting any proposals which significantly extend NetBox's feature scope. Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report. --> ### Environment * Python version: 3.6 * NetBox version: 2.4.5 <!-- Describe in detail the new functionality you are proposing. Include any specific changes to work flows, data models, or the user interface. --> ### Proposed Functionality Currently, there are no django permission controls on the user Token model. The Token model represents API tokens which users use to interact with the API. This means users are free to create their own tokens at any time. The proposal is to add the standard Django create, update, and delete permissions to this model. It should be made clear that this has nothing to do with API access. If a user has a valid token assigned to them (by either themselves in the past or by an administrator at any point), they may still access the API with said token. This feature is strictly about token CRUD permissions. <!-- Convey an example use case for your proposed feature. Write from the perspective of a NetBox user who would benefit from the proposed functionality and describe how. ---> ### Use Case In certain deployments, administrators may desire to limit API token creation for users who should only be using the web UI. Although the API uses the same permissions mechanisms as the web UI, it may make sense to an administrator to limit API token creation for some users. It is important to note that this does not preclude any user from having a valid token assigned to them, regardless of them not being able to create it themselves. Administrators will still be able to create and assign user tokens in the admin portal, the same as they can today. <!-- Note any changes to the database schema necessary to support the new feature. For example, does the proposal require adding a new model or field? (Not all new features require database changes.) ---> ### Database Changes Remove this from the Token model: ``` class Meta: default_permissions = [] ``` This will trigger a DB migration which will add the standard Django create, update, and delete permissions. <!-- List any new dependencies on external libraries or services that this new feature would introduce. For example, does the proposal require the installation of a new Python package? (Not all new features introduce new dependencies.) --> ### External Dependencies None
adam added the status: acceptedtype: feature labels 2025-12-29 17:21:41 +01:00
adam closed this issue 2025-12-29 17:21:41 +01:00
adam commented 2025-12-29 17:21:42 +01:00
Author
Owner
Copy Link

@a31amit commented on GitHub (Oct 3, 2018):

+1 that would be great to see in netbox

@a31amit commented on GitHub (Oct 3, 2018): +1 that would be great to see in netbox
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2040
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?