Restricting User Access by Location

[commanddotcom]

Hi,
I'm looking for some guidance.

I need to restrict access for users with limited permissions so that they can only view or interact with data related to their assigned locations. This seems like a basic and expected feature, but I don't see it currently implemented. Does such functionality exist?

If not, I'm considering implementing it myself. One approach is to define a relationship between users and stock locations (either many-to-many or one-to-many), and then enforce access control based on that.

My question is:

• Can this be done through a plugin (which would be preferable), or
• Do I need to modify the core code?

If there's a recommended way to achieve this using a plugin, I’d appreciate any pointers.

Thanks in advance!

[SchrodingersGat]

Our permissions system is not currently fine-grained enough to support this although there are multiple discussions and issue where we have considered something like this.

We would like to see supported via plugins (not mainline code) as the use cases are too specific and varied.

Here are some other outstanding issues where we have been discussing similar things.

• [FR] Add per Object permissions and orgs #2323
• [FR] Permissions system for pricing #4022
• Permissions Refactor - in Refinement #7466
• [FR] Inquiry Regarding Separate Customer Lists for Individual Users #9634
• Refactor pricing mechanics and move to plugins #8607
• [FR] Inquiry Regarding Separate Customer Lists for Individual Users #9634

Basically what we need to achieve is a major permissions refactoring which allows plugins to perform:

• per-object permission checks based on the user
• queryset filtering based on the user

Those two points will take a significant amount of work. But once they are done, it would be relatively easy to create a plugin which assigns permissions between a particular owner and a particular location.

We will not be doing this until after the 1.0.0 release which is our current focus point. However we can start a discussion and if you would like to assist either with code or financial support that would be appreciated 👍

[matmair]

Also see the assumed trust https://docs.inventree.org/en/latest/concepts/threat_model/#assumed-trust