Permission constraints for cable terminations based on rack

[ionoci]

Hi,
I got the mission to take an inventory of cables in one rack with an employee which isn't that clever. The employee should correct or add cables. That's why I want to give as less permissions as posible.
I got the permission reduced to view only devices, interfaces and frontports of the rack. But on the constraints for the cables I'm stuck.
I thought the rack name of the termination is the right filter, but it fails with:
Invalid filter for <class 'dcim.models.cables.Cable'>: Unsupported lookup 'rack' for ManyToOneRel or join on the field not permitted.
The constraint I used on "DCIM > Cable" is:
{"terminations__rack__name": "DV24"}

If I don't reduce the visible cables, the employee may view and modify all cables we got.

Any help would be appreciated

Cheers
Ionoci

[candlerb]

If this is for DCIM > Cable, try simply {"rack": "DV24"}. This is a guess based on the filters available in CableFilterSet:

class CableFilterSet(TenancyFilterSet, NetBoxModelFilterSet):
    termination_a_type = ContentTypeFilter(
        field_name='terminations__termination_type'
    )
    termination_a_id = MultiValueNumberFilter(
        method='filter_by_cable_end_a',
        field_name='terminations__termination_id'
    )
    termination_b_type = ContentTypeFilter(
        field_name='terminations__termination_type'
    )
    termination_b_id = MultiValueNumberFilter(
        method='filter_by_cable_end_b',
        field_name='terminations__termination_id'
    )
    unterminated = django_filters.BooleanFilter(
        method='_unterminated',
        label=_('Unterminated'),
    )
    type = django_filters.MultipleChoiceFilter(
        choices=CableTypeChoices
    )
    status = django_filters.MultipleChoiceFilter(
        choices=LinkStatusChoices
    )
    color = django_filters.MultipleChoiceFilter(
        choices=ColorChoices
    )
    device_id = MultiValueNumberFilter(
        method='filter_by_termination'
    )
    device = MultiValueCharFilter(
        method='filter_by_termination',
        field_name='device__name'
    )
    rack_id = MultiValueNumberFilter(
        method='filter_by_termination',
        field_name='rack_id'
    )
    rack = MultiValueCharFilter(
        method='filter_by_termination',
        field_name='rack__name'
    )
    location_id = MultiValueNumberFilter(
        method='filter_by_termination',
        field_name='location_id'
    )
    location = MultiValueCharFilter(
        method='filter_by_termination',
        field_name='location__name'
    )
    site_id = MultiValueNumberFilter(
        method='filter_by_termination',
        field_name='site_id'
    )
    site = MultiValueCharFilter(
        method='filter_by_termination',
        field_name='site__slug'
    )

    # Termination object filters
    consoleport_id = MultiValueNumberFilter(
        method='filter_by_consoleport'
    )
    consoleserverport_id = MultiValueNumberFilter(
        method='filter_by_consoleserverport'
    )
    powerport_id = MultiValueNumberFilter(
        method='filter_by_powerport'
    )
    poweroutlet_id = MultiValueNumberFilter(
        method='filter_by_poweroutlet'
    )
    interface_id = MultiValueNumberFilter(
        method='filter_by_interface'
    )
    frontport_id = MultiValueNumberFilter(
        method='filter_by_frontport'
    )
    rearport_id = MultiValueNumberFilter(
        method='filter_by_rearport'
    )
    powerfeed_id = MultiValueNumberFilter(
        method='filter_by_powerfeed'
    )
    circuittermination_id = MultiValueNumberFilter(
        method='filter_by_circuittermination'
    )

For comparison, there are hardly any options for filtering terminations directly:

class CableTerminationFilterSet(BaseFilterSet):
    termination_type = ContentTypeFilter()

[ionoci]

@candlerb thanks for your advice but it fails with:
Invalid filter for <class 'dcim.models.cables.Cable'>: Cannot resolve keyword 'rack' into field. Choices are: _abs_length, bookmarks, color, comments, created, custom_field_data, description, id, journal_entries, label, last_updated, length, length_unit, status, tagged_items, tags, tenant, tenant_id, terminations, type

[candlerb]

Netbox version? Otherwise, it seems like permissions constraints aren't as flexible as REST API filters.

[candlerb]

I see that _rack is provided as a cached attribute on CableTermination though. And I think I found a clue here.

Try terminations___rack__name (with three underscores after "terminations") or terminations___rack__name__in

However if this works, it's pretty hairy and undocumented, and I wouldn't be surprised if it broke in a future version.

[ionoci]

Yay, works like a charm with "terminations___rack__name__in" : "DV24" Thanks a lot @candlerb
How did you find this clue? Double underscore I know from documentation, but triple underscore I never saw. I also never had the idea to look into filtersets.py.
Where may I find more documentation how the expressions are set up? Now I'm searching how to get the six constraint permission sets I needed into less sets.

Thanks a lot
Ionoci

[candlerb]

How did you find this clue?

UTSL ("Use The Source, Luke!"). I was looking at how the REST API "filtersets" convert query parameters into Django ORM filters.

triple underscore I never saw

It's really a double-underscore, followed by a name that starts with underscore.

That's what concerns me for your use case: this is undocumented behaviour, using a Netbox internal attribute (_rack) that caches the rack object on the termination. That hidden attribute could change in future.

Having said that, anything can change in Netbox in the future - there are no API stability guarantees, and minimal backwards compatibility. REST API clients, plugins and scripts, all can and do have to be changed to from version to version. (If you asked me to write a list of the limitations of Netbox, that would be my number one).

Where may I find more documentation how the expressions are set up?

If it's not documented at https://docs.netbox.dev/en/stable/administration/permissions/#constraints then it's not documented. However, that section does refer to the Django query filter documentation, so it inherits the capabilities of that.

The Cable model is briefly documented here, but CableTermination is not documented at all AFAICS, as it is mostly invisible to web UI users.

[ionoci]

Thanks a lot, for your help and your hints.
As of API stability, I just will keep the current version until all Racks are inventoried ;-)