Restrict users permission to run specific scripts

[llamafilm]

NetBox version

v3.7.3

Feature type

Change to existing functionality

Proposed functionality

I would like to apply constraints to running scripts, so that each user can only run specific scripts.

Use case

We are starting to write a number of custom scripts, meant to be run via the WebUI, and want to enforce RBAC to scripts as we do for manual changes to the data (models).

For example, one script provides a customized form to create a new device, making it easier for our operators; this should be runnable by most users. Another script triggers a power cycle of a PDU outlet using an external API; this should be runnable only by admins.

Database changes

unsure

External dependencies

No response

[jeffgdotorg]

Thanks for your feature request. You're on to a good idea but we need some revisions before we'll be able to accept the issue.

Specifically:

• Please edit the original issue body to provide a more fully fleshed-out response for Use case.
• Have a look at Allow custom scripts to specify which users and/or groups are allowed to run them  #12050 as a potential source of ideas and an example of a more appropriately detailed use case.

[DanSheps]

You can restrict the display of scripts by using permission constraints around scriptmodule/managedfiles. I do this right now.

I don't know if this is strictly needed. I think what is needed is a common framework around scriptmodule/managedfiles or to simply allow performing checks directly on the scrirpt to see if it is allowed to be displayed.

[jeremystretch]

I believe this is directly possible on NetBox v4.0 as scripts are now represents as database objects. @llamafilm could you please confirm and note any changes that may be necessary to support your use case?

[github-actions]

This is a reminder that additional information is needed in order to further triage this issue. If the requested details are not provided, the issue will soon be closed automatically.

[ziggekatten]

As an workaround, we have been using permissions on class level in our scripts since 3.x. This is done by adding an variable in the Meta section with a permission name and a small function that validates towards permission model. Only drawback is that user see the script, can press run, but they will get an "not autorized" result back.

[llamafilm]

I will test in v4 as soon as I can, but I’m currently unable to upgrade because of #16218.

[jeremystretch]

Ok, I'll close this out as having been addressed. Once you're able to upgrade and test, please ask that it be re-opened if you find that what you're attempting to accomplish still is not possible.