Permissions constraints

[wannagofast83]

I am trying to figure out how to do permissions constraints to limit a group of users to have full access to specific sites and/or locations and all the things within that site.

I created a group called eng and am trying to apply the permissions to that group.
There is one location that I want them to have full access to and then, eventually, I will probably have other sites.
The site ID is 396 and lets call the site SiteA
The other site is 331 and I'll call that one SiteB but I only want them to be able to access one location called SiteB-Loc1(id=67)

Can someone help me and point me in the right direction?

[pv2b]

This blog post does a pretty good job explaining how to do something similar to what you want: https://www.packetcoders.io/mastering-nextbox-user-access-with-permission-constraints/

You will also find this documentation useful: https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/

To summarize, there's no easy way to say "everything within a site". You'll have to create permissions for every object type, and then, depending on the object type, your constraints may be different.

For example, to allow access to the site objects themselves, you may put in a permission to site objects, with a constraint like:

{"id__in": [396,331]}

But this will of course only allow access to the site, i.e. entering its information about its address, which site group it's in, etc.

To allow access for objects within a site, e.g. devices or locations, you'd need something like:

{"site__id__in": [396,331]}

This can get complicated quickly. As far as I'm aware, there's no way to say "everything related to site X".

[candlerb]

I think that should be "site_id__in" not "site__id__in"

[vshmakov-vcl]

I try do do similar think, add some permissions to group: dcim/device, dcim/device_type, dcim/location, dcim/site, try to add contrains [{"device_site__in": ["SiteA"]}, {"site_name__in": ["SiteA"]}], but get error: Invalid filter for <class 'dcim.models.devices.Device'>: Cannot resolve keyword 'device_site' into field. <...>.
How to define contrains to object types?

[candlerb]

Field names on a model can contain underscore, so if you write device_site it means a field called device_site on the model itself. As the error message says, there is no field with this name.

If you want to refer to a linked model, then you need to separate the target model with double-underscore.

For example, for constraints on the Device model:

• id means the device's id field
• name means the device's name field
• site_id means the device's site_id field
• site__name means the name field stored on the linked site model (it will implictly follow the site_id field to find this linked model)

Then __in as a suffix adds the test for matching one value within a list.

You will need to create different permissions for different models. For example, site__name__in should work on a Device, because a Device has a "site" attribute. But it won't work on DeviceType, because a DeviceType doesn't have a "site" attribute. And it also won't work on a Site, because a site doesn't have a "site" attribute (but it does have a "name" attribute, so it would simply be name__in)

[uRhaineWork]

You will be better of with tags. #TAG every object You want someone to have access, and in permissions You just set allow to that specific TAG.