Permission constraint on Journal Entries

[christianhennen]

Hi!

Currently I'm looking into using Netbox for a multi-tenant project, where tenants should be able to see "their" racks and edit their devices. I found the Journal to be useful when logging things that we notice about racks, e.g. "Rack contains packaging material left there after installation. Needs removal". I want these entries to be visible to the tenant of the rack, but not to other tenants.

The JournalEntry model of Netbox contains the fields assigned_object_type. assigned_object_id, assigned_object, created_by, kind, comments. None of which are related to the Tenancy models, except assigned_object_type.

However, when defining a persmission constraint like so: {"assigned_object_type": "Rack", "assigned_object__tenant_id": "4"}, I get the following error message:

Invalid filter for <class 'extras.models.models.JournalEntry'>: Field 'assigned_object' does not generate an automatic reverse relation and therefore cannot be used for reverse querying. If it is a GenericForeignKey, consider adding a GenericRelation.

The relevant line is found here:
https://github.com/netbox-community/netbox/blob/develop/netbox/extras/models/models.py#L528

I understand why the error message is shown and why it doesn't work. Is there any (other) way to achieve what I described above?

Greetings,
Chris

[heylix]

I basically want the same, but for everything instead of only Racks, leading me to this broader constraint:

{"assigned_object__tenant_id": 5}

And giving me the same error:

Invalid filter for <class 'extras.models.models.JournalEntry'>: Field 'assigned_object' does not generate an automatic reverse relation and therefore cannot be used for reverse querying. If it is a GenericForeignKey, consider adding a GenericRelation.

Maybe it's possible to add this reverse relation for the assigned_object field? @jeremystretch (tagged you because I didn't know whom else to ask "should I create an Issue for this or is it by design" in this case)

[jschewebbn]

Did anyone find a way around this yet? I realized that I have a need to allow users to see Journal entries for the objects in their tenant.

[maddin8]

I have the same problem, but would like to allow users to only create Journal entries for Devices and VMs, I feel like this should be possible with a constraint on assigned_object_type, but I get the same error as all of you do.

[Kani999]

I have the same problem, but with allowing access to IP addresses assigned to interfaces on specific devices by tag. I tried to solve it with no luck.

#15430