Create permissions from python code on Netbox

[cloud-digitaltag]

Hi.
I'm trying create permissions for group from spython script that I attach as configmap from helm installation.
My script is for okta authorization, but idea is that I don't want create manualy groups and permissions for this group. Instead I add some code to my okta authorization and additional stanza in helm values.
My code:

    from netbox.authentication import Group
    from django.contrib.auth.models import Permission
    from django.contrib.contenttypes.models import ContentType
    import logging

    logger = logging.getLogger(__name__)

    # Define the superuser and staff groups from Helm values
    SUPERUSER_GROUPS = {{ .Values.remoteAuth.superuserGroups | toJson }}
    SUPERUSERS = {{ .Values.remoteAuth.superusers | toJson }}
    STAFF_GROUPS = {{ .Values.remoteAuth.staffGroups | toJson }}
    STAFF_USERS = {{ .Values.remoteAuth.staffUsers | toJson }}

    # Define local groups, permissions, and assignments from Helm values
    LOCAL_GROUPS = {{ .Values.localGroups | toJson }}
    LOCAL_PERMISSIONS = {{ .Values.localPermissions | toJson }}
    LOCAL_PERMISSIONS_ASSIGN = {{ .Values.localPermissionsAssign | toJson }}

    def create_local_groups_and_permissions():
        """
        Create local groups and permissions based on Helm configuration.
        """
        logger.warning("INFO Initializing local groups and permissions...")

        # Create groups
        for group_name in LOCAL_GROUPS:
            group, created = Group.objects.get_or_create(name=group_name)
            if created:
                logger.warning(f"INFO Group '{group_name}' created.")
            else:
                logger.warning(f"INFO Group '{group_name}' already exists.")

        # Create permissions
        for perm_config in LOCAL_PERMISSIONS:
            try:
                actions = perm_config.get("actions", [])
                app_label = perm_config["app_label"]
                model = perm_config["model"]

                for action in actions:
                    codename = f"{action}_{model}"

                    # Check if the permission already exists
                    if not Permission.objects.filter(codename=codename).exists():
                        permission, created = Permission.objects.get_or_create(
                            codename=codename,
                            name=f"{action.capitalize()} permission for {model}",
                            content_type=ContentType.objects.get(app_label=app_label, model=model),
                        )
                        if created:
                            logger.warning(f"INFO Permission '{codename}' created.")
                    else:
                        logger.warning(f"INFO Permission '{codename}' already exists.")
            except Exception as e:
                logger.error(f"ERROR Failed to create permission: {perm_config}. Error: {e}")

        # Assign permissions to groups
        for group_name, permissions in LOCAL_PERMISSIONS_ASSIGN.items():
            try:
                group = Group.objects.get(name=group_name)
                for perm_codename in permissions:
                    try:
                        permission = Permission.objects.get(codename=perm_codename)
                        group.permissions.add(permission)
                        logger.warning(f"INFO Assigned permission '{perm_codename}' to group '{group_name}'.")
                    except Permission.DoesNotExist:
                        logger.error(f"ERROR Permission '{perm_codename}' does not exist.")
            except Group.DoesNotExist:
                logger.error(f"ERROR Group '{group_name}' does not exist.")

    def map_groups(response, user, backend, *args, **kwargs):
        """
        Map user groups based on Okta (OIDC) groups to existing groups in NetBox,
        and assign the user to appropriate roles such as superuser or staff based on Okta groups.
        """
        # Initialize local groups and permissions
        create_local_groups_and_permissions()

        # Get groups from the OIDC response
        oidc_groups = response.get('groups', [])

        logger.warning(f"INFO OIDC groups received for user '{user.username}': {oidc_groups}")

        if not oidc_groups:
            logger.warning(f"INFO No groups found in OIDC response for user {user.username}.")
            return

        # Fetch all existing groups in NetBox that match the OIDC groups
        existing_groups = Group.objects.filter(name__in=oidc_groups)

        # Clear the user's existing group assignments
        user.groups.clear()

        # Add the user to the matched groups
        user.groups.add(*existing_groups)

        # Log which groups were assigned
        logger.warning(f"INFO User '{user.username}' assigned to groups: {[group.name for group in existing_groups]}")

        # Log any groups that were not found
        missing_groups = set(oidc_groups) - set(existing_groups.values_list('name', flat=True))
        if missing_groups:
            logger.warning(f"INFO Groups not found in NetBox and skipped: {missing_groups}")

        # Assign roles (superuser, staff)
        if any(group.name in SUPERUSER_GROUPS for group in existing_groups):
            user.is_superuser = True
            logger.warning(f"INFO User '{user.username}' is assigned as superuser.")

        if any(group.name in STAFF_GROUPS for group in existing_groups):
            user.is_staff = True
            logger.warning(f"INFO User '{user.username}' is assigned as staff.")

        # Save the user with the new roles (superuser, staff)
        user.save()

In helm values I have following additional stanza:

localGroups:
  - "test2"
  - "test1"

localPermissions:
  - name: "View Only"
    app_label: "contenttypes"
    model: "contenttype"
    actions: ["view"]

localPermissionsAssign: 
  test2: []
  test1:
    - "view_contenttype"

When I first login from okta, script creates group, assign users to this group and created permissions in database record in table users_group_permissions
But this permission not work, after login I don't see any objects in NetBox
When I created permissions from GUI it's wrote in different database tables:
users_objectpermission
users_objectpermission_object_types
users_objectpermission

I wonder is there some example how to add permissions from python. I'm using version 4.0.11
Regards

[cloud-digitaltag]

Resolved