Add support for object permissions on individual scripts #7003

New Issue

adam · 2025-12-29T19:47:41+01:00

adam commented

2025-12-29 19:47:41 +01:00

Originally created by @swoga on GitHub (Sep 20, 2022).

NetBox version

v3.3.4

Feature type

New functionality

Proposed functionality

Add support for object permissions of type Extras > script to match individual scripts by their id, as reported by the API.

example constraint:

{ "id": "ip_assign.IpAssign" }

should add a permission for the following script:

{
  "url": "https://netbox/api/extras/scripts/ip_assign.IpAssign/",
  "id": "ip_assign.IpAssign",
  "module": "ip_assign",
  ...
}

Was reported as a bug as I assumed this should be supported and the attempt caused an exception: #10306

Use case

Allow an Administrator to grant user rights on individual scripts.

Database changes

none

External dependencies

none

Originally created by @swoga on GitHub (Sep 20, 2022). ### NetBox version v3.3.4 ### Feature type New functionality ### Proposed functionality Add support for object permissions of type `Extras > script` to match individual scripts by their `id`, as reported by the API. example constraint: ```json { "id": "ip_assign.IpAssign" } ``` should add a permission for the following script: ```json { "url": "https://netbox/api/extras/scripts/ip_assign.IpAssign/", "id": "ip_assign.IpAssign", "module": "ip_assign", ... } ``` Was reported as a bug as I assumed this should be supported and the attempt caused an exception: #10306 ### Use case Allow an Administrator to grant user rights on individual scripts. ### Database changes none ### External dependencies none

adam added the type: feature status: under review labels 2025-12-29 19:47:41 +01:00

adam closed this issue

2025-12-29 19:47:41 +01:00

adam commented

2025-12-29 19:47:41 +01:00

@kkthxbye-code commented on GitHub (Sep 20, 2022):

Please extend the proposal to be more specific. What is id? Is that the name of the script as returned from the API? If so, that's not enough to identify a script uniquely, you need a module also. Should module also be available for constraints? What would a constraint look like.

The general issue here is that scripts are not database objects, they are loaded at runtime. The current constraints are just passed as QuerySet filters, so we would have to come up with some special casing for the Script content type. Even if we did that, we probably wouldn't support the extra filter modifiers (negation, startswith etc.).

Personally I think a better solution might be to allow the functionality to be part of the script/report itself. Something like allowed_groups and allowed_users that can be defined in the Meta class, that allow you to limit which users and groups can see and execute them.

@kkthxbye-code commented on GitHub (Sep 20, 2022): Please extend the proposal to be more specific. What is `id`? Is that the name of the script as returned from the API? If so, that's not enough to identify a script uniquely, you need a module also. Should module also be available for constraints? What would a constraint look like. The general issue here is that scripts are not database objects, they are loaded at runtime. The current constraints are just passed as QuerySet filters, so we would have to come up with some special casing for the Script content type. Even if we did that, we probably wouldn't support the extra filter modifiers (negation, startswith etc.). Personally I think a better solution might be to allow the functionality to be part of the script/report itself. Something like `allowed_groups` and `allowed_users` that can be defined in the Meta class, that allow you to limit which users and groups can see and execute them.

adam commented

2025-12-29 19:47:42 +01:00

@swoga commented on GitHub (Sep 20, 2022):

I have added an constraint and API response example.
The id as reported by the API should uniquely identify a script, since it already contains the module.

For my purposes, a check for equality would be sufficient, but it is quite possible that other Netbox users may want to use extra filter modifiers.

I understand that it would be easier to handle it via the Meta class, but I it would be nice to have a central place to manage all permissions than having to edit scripts separately.

@swoga commented on GitHub (Sep 20, 2022): I have added an constraint and API response example. The `id` as reported by the API should uniquely identify a script, since it already contains the module. For my purposes, a check for equality would be sufficient, but it is quite possible that other Netbox users may want to use extra filter modifiers. I understand that it would be easier to handle it via the Meta class, but I it would be nice to have a central place to manage all permissions than having to edit scripts separately.

adam commented

2025-12-29 19:47:42 +01:00

@ziggekatten commented on GitHub (Sep 21, 2022):

We have solved this by a common function in all our custom scripts that check for a permission that match the class name, and if user are in that permission, execution proceeds. First time script is run, it creates the permission if not exists. By this we have a central way of manage permissions on script at a class level.

@ziggekatten commented on GitHub (Sep 21, 2022): We have solved this by a common function in all our custom scripts that check for a permission that match the class name, and if user are in that permission, execution proceeds. First time script is run, it creates the permission if not exists. By this we have a central way of manage permissions on script at a class level.

adam commented

2025-12-29 19:47:47 +01:00

@jeremystretch commented on GitHub (Oct 3, 2022):

Add support for object permissions of type Extras > script to match individual scripts by their id, as reported by the API.

I'm afraid this isn't possible, because object permissions employ database filtering to evaluate permissions, and scripts/reports don't exist as database objects. As @ziggekatten suggests, the preferred way to solve this would be to perform an explicit permissions check in the script/report itself.

@jeremystretch commented on GitHub (Oct 3, 2022): > Add support for object permissions of type Extras > script to match individual scripts by their id, as reported by the API. I'm afraid this isn't possible, because object permissions employ database filtering to evaluate permissions, and scripts/reports don't exist as database objects. As @ziggekatten suggests, the preferred way to solve this would be to perform an explicit permissions check in the script/report itself.

adam referenced this issue

2025-12-29 22:26:39 +01:00

[PR #7978] [CLOSED] Fixes #7003: Order image attachments by newest uploaded #13304

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#7003