nautobot 2.4.10__py3-none-any.whl → 2.4.11__py3-none-any.whl

nautobot/core/tests/test_utils.py

@@ -1,3 +1,7 @@
+import os
+import os.path
+import sys
+import tempfile
 from unittest import mock
 import uuid
 
@@ -17,6 +21,11 @@ from nautobot.core.models import fields as core_fields, utils as models_utils, v
 from nautobot.core.testing import TestCase
 from nautobot.core.utils import data as data_utils, filtering, lookup, querysets, requests
 from nautobot.core.utils.migrations import update_object_change_ct_for_replaced_models
+from nautobot.core.utils.module_loading import (
+    check_name_safe_to_import_privately,
+    clear_module_from_sys_modules,
+    import_modules_privately,
+)
 from nautobot.dcim import filters as dcim_filters, forms as dcim_forms, models as dcim_models, tables
 from nautobot.extras import models as extras_models, utils as extras_utils
 from nautobot.extras.choices import ObjectChangeActionChoices, RelationshipTypeChoices
@@ -959,6 +968,190 @@ class TestMigrationUtils(TestCase):
             self.assertEqual(ObjectChange.objects.get(request_id=request_id).related_object_type, location_ct)
 
 
+class TestModuleLoadingUtils(TestCase):
+    def test_check_name_safe_to_import_privately(self):
+        for invalid in (
+            "foo.bar",  # not a valid identifier
+            "😂",  # not a valid identifier
+            "from",  # reserved keyword
+            "sys",  # Python builtin
+            "nautobot",  # installed package
+            "tkinter",  # system library
+        ):
+            with self.subTest(f"Invalid name: {invalid}"):
+                permitted, reason = check_name_safe_to_import_privately(invalid)
+                self.assertFalse(permitted)
+                self.assertIsInstance(reason, str)
+
+    def _create_test_files(self, root_directory: str, contents: dict):
+        """Helper function to create arbitrary text files in a given directory."""
+        for relative_path, file_contents in contents.items():
+            os.makedirs(os.path.dirname(os.path.join(root_directory, relative_path)), exist_ok=True)
+            with open(os.path.join(root_directory, relative_path), "wt") as fd:
+                fd.write(file_contents)
+
+    def test_import_modules_privately_jobs_root_case(self):
+        with tempfile.TemporaryDirectory() as tempdir:
+            try:
+                contents = {
+                    # Job file treated as a standalone module
+                    "some_jobs.py": 'name = "some_jobs"',
+                    # Job subdirectory treated as a package
+                    "my_jobs/__init__.py": '''\
+import my_jobs.some_submodule
+from . import relative_submodule
+name = "my_jobs"''',
+                    "my_jobs/some_submodule/__init__.py": 'name = "my_jobs.some_submodule"',
+                    "my_jobs/relative_submodule/__init__.py": 'name = "my_jobs.relative_submodule"',
+                    # Job file that shouldn't be loaded as it conflicts
+                    "tkinter.py": 'name = "tkinter"',
+                    # Job submodule that shouldn't be loaded as it conflicts
+                    "turtle/__init__.py": 'name = "turtle"',
+                }
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, ignore_import_errors=False)
+                self.assertEqual(["my_jobs", "some_jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "some_jobs" not in sys.modules:
+                    self.fail("Valid module wasn't loaded from JOBS_ROOT")
+                if "my_jobs" not in sys.modules:
+                    self.fail("Valid package wasn't loaded from JOBS_ROOT")
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["some_jobs"].name, "some_jobs")
+                self.assertEqual(sys.modules["my_jobs"].name, "my_jobs")
+                self.assertEqual(sys.modules["my_jobs"].some_submodule.name, "my_jobs.some_submodule")
+                # self.assertEqual(sys.modules["my_jobs"].relative_submodule.name, "my_jobs.relative_submodule")
+
+            finally:
+                clear_module_from_sys_modules("some_jobs")
+                clear_module_from_sys_modules("my_jobs")
+
+                self.assertNotIn("some_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs.some_submodule", sys.modules.keys())
+
+            # Test reloading of modules after code changes
+            try:
+                contents["some_jobs.py"] = 'name = "some_jobs_new"'
+                contents["my_jobs/__init__.py"] = '''\
+import my_jobs.some_submodule
+from . import relative_submodule
+name = "my_jobs_new"'''
+                contents["my_jobs/some_submodule/__init__.py"] = 'name = "my_jobs.some_submodule_new"'
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, ignore_import_errors=False)
+                self.assertEqual(["my_jobs", "some_jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "some_jobs" not in sys.modules:
+                    self.fail("Valid module wasn't loaded from JOBS_ROOT")
+                if "my_jobs" not in sys.modules:
+                    self.fail("Valid package wasn't loaded from JOBS_ROOT")
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["some_jobs"].name, "some_jobs_new")
+                self.assertEqual(sys.modules["my_jobs"].name, "my_jobs_new")
+                self.assertEqual(sys.modules["my_jobs"].some_submodule.name, "my_jobs.some_submodule_new")
+
+            finally:
+                clear_module_from_sys_modules("some_jobs")
+                clear_module_from_sys_modules("my_jobs")
+
+                self.assertNotIn("some_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs.some_submodule", sys.modules.keys())
+
+    def test_import_modules_privately_git_repo_jobs_case(self):
+        with tempfile.TemporaryDirectory() as tempdir:
+            try:
+                contents = {
+                    # Repo that we intend to load
+                    "my_repo/__init__.py": 'name = "my_repo"',
+                    "my_repo/jobs/__init__.py": '''\
+import my_repo.jobs.some_jobs
+from . import some_other_jobs
+name = "my_repo.jobs"''',
+                    "my_repo/jobs/some_jobs.py": 'name = "my_repo.jobs.some_jobs"',
+                    "my_repo/jobs/some_other_jobs.py": 'name = "my_repo.jobs.some_other_jobs"',
+                    # A separate repo, not intended to be loaded
+                    "other_repo/__init__.py": "",
+                    # File that shouldn't be loaded as it conflicts
+                    "tkinter.py": "",
+                    # Package that shouldn't be loaded as it conflicts
+                    "turtle/__init__.py": "",
+                }
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, module_path=["my_repo", "jobs"], ignore_import_errors=False)
+                self.assertEqual(["my_repo", "my_repo.jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "my_repo" not in sys.modules:
+                    self.fail("Valid repo wasn't loaded from GIT_ROOT")
+                if "my_repo.jobs" not in sys.modules:
+                    self.fail("Valid repo subdirectory wasn't loaded from GIT_ROOT")
+                with self.assertRaises(KeyError, msg="unexpected repo was loaded from GIT_ROOT"):
+                    sys.modules["other_repo"]
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["my_repo"].name, "my_repo")
+                self.assertEqual(sys.modules["my_repo.jobs"].name, "my_repo.jobs")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_jobs.name, "my_repo.jobs.some_jobs")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_other_jobs.name, "my_repo.jobs.some_other_jobs")
+
+            finally:
+                clear_module_from_sys_modules("my_repo")
+
+                self.assertNotIn("my_repo", sys.modules.keys())
+                self.assertNotIn("my_repo.jobs", sys.modules.keys())
+
+            # Test reloading of modules after code changes
+            try:
+                contents["my_repo/__init__.py"] = 'name = "my_repo_new"'
+                contents["my_repo/jobs/__init__.py"] = '''\
+import my_repo.jobs.some_jobs
+from . import some_other_jobs
+name = "my_repo.jobs_new"'''
+                contents["my_repo/jobs/some_jobs.py"] = 'name = "my_repo.jobs.some_jobs_new"'
+                contents["my_repo/jobs/some_other_jobs.py"] = 'name = "my_repo.jobs.some_other_jobs_new"'
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, module_path=["my_repo", "jobs"], ignore_import_errors=False)
+                self.assertEqual(["my_repo", "my_repo.jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "my_repo" not in sys.modules:
+                    self.fail("Valid repo wasn't loaded from GIT_ROOT")
+                if "my_repo.jobs" not in sys.modules:
+                    self.fail("Valid repo subdirectory wasn't loaded from GIT_ROOT")
+                with self.assertRaises(KeyError, msg="unexpected repo was loaded from GIT_ROOT"):
+                    sys.modules["other_repo"]
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["my_repo"].name, "my_repo_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].name, "my_repo.jobs_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_jobs.name, "my_repo.jobs.some_jobs_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_other_jobs.name, "my_repo.jobs.some_other_jobs_new")
+
+            finally:
+                clear_module_from_sys_modules("my_repo")
+
+                self.assertNotIn("my_repo", sys.modules.keys())
+                self.assertNotIn("my_repo.jobs", sys.modules.keys())
+
+
 class TestQuerySetUtils(TestCase):
     def test_maybe_select_related(self):
         # If possible, select_related should be called

nautobot/core/tests/test_views_utils.py

@@ -1,13 +1,16 @@
 import urllib.parse
 
+from django.contrib.auth.models import AnonymousUser
 from django.db import ProgrammingError
 from django.test import TestCase
 
 from nautobot.core.models.querysets import count_related
-from nautobot.core.views.utils import check_filter_for_display, prepare_cloned_fields
+from nautobot.core.testing import TransactionTestCase
+from nautobot.core.views.utils import check_filter_for_display, get_saved_views_for_user, prepare_cloned_fields
 from nautobot.dcim.filters import DeviceFilterSet
 from nautobot.dcim.models import Device, DeviceRedundancyGroup, DeviceType, InventoryItem, Location, Manufacturer
-from nautobot.extras.models import Role, Status
+from nautobot.extras.models import Role, SavedView, Status
+from nautobot.users.models import User
 
 
 class CheckFilterForDisplayTest(TestCase):
@@ -168,3 +171,51 @@ class CheckPrepareClonedFields(TestCase):
                 self.assertTrue(isinstance(query_params["description"], list))
                 self.assertTrue(len(query_params["description"]) == 1)
                 self.assertTrue(query_params["description"][0] == description)
+
+
+class GetSavedViewsForUserTestCase(TransactionTestCase):
+    """
+    Class to test `get_saved_views_for_user`.
+    """
+
+    def create_saved_view(self, name, owner=None, is_shared=False):
+        """Helper to create a SavedView."""
+        return SavedView.objects.create(
+            name=name, owner=owner or self.user, view="dcim:device_list", is_shared=is_shared
+        )
+
+    def setUp(self):
+        super().setUp()
+        self.user2 = User.objects.create_user(username="second_user")
+        self.create_saved_view(name="saved_view")
+        self.create_saved_view(name="saved_view_shared", is_shared=True)
+        self.create_saved_view(name="saved_view_different_owner", owner=self.user2)
+        self.create_saved_view(name="saved_view_shared_different_owner", is_shared=True, owner=self.user2)
+
+    def test_user_with_permissions_get_all_saved_views(self):
+        """Test if for user with permissions method will return all saved views."""
+        self.add_permissions("extras.view_savedview")
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 4)
+        expected_names = [
+            "saved_view",
+            "saved_view_different_owner",
+            "saved_view_shared",
+            "saved_view_shared_different_owner",
+        ]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_user_without_permissions_get_shared_views_and_own_views_only(self):
+        """Test if user without permissions can see shared views and own views."""
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 3)
+        expected_names = ["saved_view", "saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_anonymous_user_get_shared_views_only(self):
+        """Test if method is working with anonymous users and return only shared views."""
+        user = AnonymousUser()
+        saved_views = get_saved_views_for_user(user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 2)
+        expected_names = ["saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)

nautobot/core/ui/object_detail.py

@@ -1266,6 +1266,10 @@ class ObjectFieldsPanel(KeyValueTablePanel):
 
             data[field_name] = field_value
 
+        # Ensuring the `name` field is displayed first, if present.
+        if "name" in data:
+            data = {"name": data["name"], **{k: v for k, v in data.items() if k != "name"}}
+
         return data
 
     def render_key(self, key, value, context: Context):

nautobot/core/utils/lookup.py

@@ -314,13 +314,15 @@ def get_created_and_last_updated_usernames_for_model(instance):
     created_by = None
     last_updated_by = None
     try:
-        created_by_record = object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).first()
+        created_by_record = (
+            object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).only("user_name").first()
+        )
         if created_by_record is not None:
             created_by = created_by_record.user_name
     except ObjectChange.DoesNotExist:
         pass
 
-    last_updated_by_record = object_change_records.first()
+    last_updated_by_record = object_change_records.only("user_name").first()
     if last_updated_by_record:
         last_updated_by = last_updated_by_record.user_name
 

nautobot/core/utils/module_loading.py

@@ -1,29 +1,13 @@
-from contextlib import contextmanager
-import importlib
-from importlib.util import find_spec, module_from_spec
+from importlib.machinery import FileFinder, SOURCE_SUFFIXES, SourceFileLoader
+from importlib.util import module_from_spec
+from keyword import iskeyword
 import logging
-import os
 import pkgutil
 import sys
 
 logger = logging.getLogger(__name__)
 
 
-@contextmanager
-def _temporarily_add_to_sys_path(path):
-    """
-    Allow loading of modules and packages from within the provided directory by temporarily modifying `sys.path`.
-
-    On exit, it restores the original `sys.path` value.
-    """
-    old_sys_path = sys.path.copy()
-    sys.path.insert(0, path)
-    try:
-        yield
-    finally:
-        sys.path = old_sys_path
-
-
 def clear_module_from_sys_modules(module_name):
     """
     Remove the module and all its submodules from sys.modules.
@@ -33,7 +17,29 @@ def clear_module_from_sys_modules(module_name):
             del sys.modules[name]
 
 
-def import_modules_privately(path, module_path=None, ignore_import_errors=True):
+def check_name_safe_to_import_privately(name: str) -> tuple[bool, str]:
+    """
+    Make sure the given package/module name is "safe" to import from the filesystem.
+
+    In other words, make sure it's:
+    - a valid Python identifier and not a reserved keyword
+    - not the name of an existing "real" Python package or builtin
+
+    Returns:
+        (bool, str): Whether safe to load, and an explanatory string fragment for logging/exception messages.
+    """
+    if not name.isidentifier():
+        return False, "not a valid identifier"
+    if iskeyword(name):
+        return False, "a reserved keyword"
+    if name in sys.builtin_module_names:
+        return False, "a Python builtin"
+    if any(module_info.name == name for module_info in pkgutil.iter_modules()):
+        return False, "the name of an installed Python package"
+    return True, "a valid and non-conflicting module name"
+
+
+def import_modules_privately(path, module_path=None, module_prefix="", ignore_import_errors=True):
     """
     Import modules from the filesystem without adding the path permanently to `sys.path`.
 
@@ -49,49 +55,71 @@ def import_modules_privately(path, module_path=None, ignore_import_errors=True):
         ignore_import_errors (bool): Exceptions raised while importing modules will be caught and logged.
             If this is set as False, they will then be re-raised to be handled by the caller of this function.
     """
-    if module_path is None:
-        module_path = []
-        module_prefix = None
+    loaded_modules = []
+    # We formerly used pkgutil.walk_packages() here to handle submodule loading with a multi-entry module_path,
+    # but that has the downside (and risk!) of automatically importing all packages that it finds in the given path,
+    # whether or not we actually want to do so. So instead, for the case where a module_path is provided, we need to
+    # iteratively import each submodule ourselves.
+    if module_path:
+        # Git repository case - e.g. import_modules_privately(settings.GIT_ROOT, module_path=[repository_slug, "jobs"])
+        # Here we want to ONLY auto-load the module sequence identified by module_path.
+        permitted, reason = check_name_safe_to_import_privately(module_path[0])
+        if not permitted:
+            logger.error("Unable to load module %r from %s as it is %s", module_path[0], path, reason)
+        else:
+            module = None
+            module_name = module_path.pop(0)
+            submodule_name = module_name
+            try:
+                while True:
+                    finder = FileFinder(path, (SourceFileLoader, SOURCE_SUFFIXES))
+                    finder.invalidate_caches()
+                    spec = finder.find_spec(module_name)
+                    if spec is None or spec.loader is None:
+                        logger.error("Unable to find module spec and/or loader for %r", submodule_name)
+                        break
+                    spec.name = submodule_name
+                    spec.loader.name = submodule_name
+                    submodule = module_from_spec(spec)
+                    sys.modules[submodule_name] = submodule
+                    spec.loader.exec_module(submodule)
+                    if module is not None:
+                        setattr(module, module_name, submodule)
+                    module = submodule
+                    loaded_modules.append(module)
+                    if module_path:
+                        submodule_name = f"{module_name}.{module_path[0]}"
+                        module_name = module_path.pop(0)
+                        path = module.__path__[0]
+                    else:
+                        break
+            except Exception as exc:
+                logger.error("Unable to load module %s from %s: %s", module_name, path, exc)
+                if not ignore_import_errors:
+                    raise
     else:
-        module_prefix = ".".join(module_path)
-    with _temporarily_add_to_sys_path(path):
-        for finder, discovered_module_name, is_package in pkgutil.walk_packages([path], onerror=logger.error):
-            if module_prefix and not (
-                module_prefix.startswith(f"{discovered_module_name}.")  # my_repo/__init__.py
-                or discovered_module_name == module_prefix  # my_repo/jobs.py
-                or discovered_module_name.startswith(f"{module_prefix}.")  # my_repo/jobs/foobar.py
-            ):
+        # JOBS_ROOT case - import ALL top-level modules/packages that we can find in the given path;
+        # they can implement and import submodules as desired by themselves, but we only autoimport top-level ones.
+        for finder, discovered_module_name, _ in pkgutil.iter_modules([path]):
+            permitted, reason = check_name_safe_to_import_privately(discovered_module_name)
+            if not permitted:
+                logger.error("Unable to load module %r from %s as it is %s", discovered_module_name, path, reason)
                 continue
-            try:
-                existing_module = find_spec(discovered_module_name)
-            except (ModuleNotFoundError, ValueError):
-                existing_module = None
-            if existing_module is not None:
-                existing_module_path = os.path.realpath(existing_module.origin)
-                if not existing_module_path.startswith(path):
-                    logger.error(
-                        "Unable to load module %s from %s as it conflicts with existing module %s",
-                        discovered_module_name,
-                        path,
-                        existing_module_path,
-                    )
-                    continue
-
-            if discovered_module_name in sys.modules:
-                clear_module_from_sys_modules(discovered_module_name)
+            module_name = discovered_module_name
+            if module_name in sys.modules:
+                clear_module_from_sys_modules(module_name)
 
             try:
-                if not is_package:
-                    spec = finder.find_spec(discovered_module_name)
-                    if spec is None:
-                        raise ValueError("Unable to find module spec")
-                    module = module_from_spec(spec)
-                    sys.modules[discovered_module_name] = module
-                    spec.loader.exec_module(module)
-                else:
-                    module = importlib.import_module(discovered_module_name)
-                importlib.reload(module)
+                spec = finder.find_spec(discovered_module_name)
+                if spec is None or spec.loader is None:
+                    logger.error("Unable to find module spec and/or loader for %r", discovered_module_name)
+                    continue
+                module = module_from_spec(spec)
+                sys.modules[module_name] = module
+                spec.loader.exec_module(module)
+                loaded_modules.append(module)
             except Exception as exc:
                 logger.error("Unable to load module %s from %s: %s", discovered_module_name, path, exc)
                 if not ignore_import_errors:
                     raise
+    return loaded_modules

nautobot/core/views/generic.py

@@ -54,6 +54,7 @@ from nautobot.core.views.utils import (
     check_filter_for_display,
     common_detail_view_context,
     get_csv_form_fields_from_serializer_class,
+    get_saved_views_for_user,
     handle_protectederror,
     import_csv_helper,
     prepare_cloned_fields,
@@ -315,18 +316,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
         table_config_form = None
         current_saved_view = None
         current_saved_view_pk = self.request.GET.get("saved_view", None)
-        # We are not using .restrict(request.user, "view") here
-        # User should be able to see any saved view that he has the list view access to.
-        if user.has_perms(["extras.view_savedview"]):
-            saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
-        else:
-            shared_saved_views = (
-                SavedView.objects.filter(view=list_url, is_shared=True).order_by("name").only("pk", "name")
-            )
-            user_owned_saved_views = (
-                SavedView.objects.filter(view=list_url, owner=user).order_by("name").only("pk", "name")
-            )
-            saved_views = shared_saved_views | user_owned_saved_views
+        saved_views = get_saved_views_for_user(user, list_url)
 
         if current_saved_view_pk:
             try:

nautobot/core/views/mixins.py

@@ -239,6 +239,9 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
     table_class = None
     notes_form_class = NoteForm
     permission_classes = []
+    # custom view attributes used for permission checks and handling
+    custom_view_base_action = None
+    custom_view_additional_permissions = None
 
     def get_permissions_for_model(self, model, actions):
         """
@@ -249,6 +252,10 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
         """
         model_permissions = []
         for action in actions:
+            # Append additional object permissions if specified.
+            if self.custom_view_additional_permissions:
+                model_permissions.append(*self.custom_view_additional_permissions)
+            # Append the model-level permissions for the action.
             model_permissions.append(f"{model._meta.app_label}.{action}_{model._meta.model_name}")
         return model_permissions
 
@@ -501,7 +508,13 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
 
     def get_action(self):
         """Helper method for retrieving action and if action not set defaulting to action name."""
-        return PERMISSIONS_ACTION_MAP.get(self.action, self.action)
+        if self.custom_view_base_action:
+            return self.custom_view_base_action
+        if self.action in PERMISSIONS_ACTION_MAP:
+            # If the action is in the action_map, return the mapped permission
+            return PERMISSIONS_ACTION_MAP[self.action]
+
+        return self.action
 
     def get_extra_context(self, request, instance=None):
         """
@@ -1032,6 +1045,11 @@ class BulkEditAndBulkDeleteModelMixin:
 
         filter_query_params = new_filter_query_params
 
+        if nullified_fields := request.POST.getlist("_nullify"):
+            form_data["_nullify"] = nullified_fields
+        else:
+            form_data["_nullify"] = []
+
         job_form = BulkEditObjects.as_form(
             data={
                 "form_data": form_data,

nautobot/core/views/renderers.py

@@ -28,6 +28,7 @@ from nautobot.core.views.utils import (
     check_filter_for_display,
     common_detail_view_context,
     get_csv_form_fields_from_serializer_class,
+    get_saved_views_for_user,
     view_changes_not_saved,
 )
 from nautobot.extras.models import SavedView
@@ -235,7 +236,8 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
                     if view.filterset_form_class is not None:
                         filter_form = view.filterset_form_class(view.filter_params, label_suffix="")
                 table = self.construct_table(view, request=request, permissions=permissions)
-                search_form = SearchForm(data=view.filter_params)
+                q_placeholder = "Search " + bettertitle(model._meta.verbose_name_plural)
+                search_form = SearchForm(data=view.filter_params, q_placeholder=q_placeholder)
             elif view.action == "destroy":
                 form = form_class(initial=request.GET)
             elif view.action in ["create", "update"]:
@@ -309,18 +311,7 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
             list_url = f"{resolved_path.app_name}:{resolved_path.url_name}"
             saved_views = None
             if model.is_saved_view_model:
-                # We are not using .restrict(request.user, "view") here
-                # User should be able to see any saved view that he has the list view access to.
-                if request.user.has_perms(["extras.view_savedview"]):
-                    saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
-                else:
-                    shared_saved_views = (
-                        SavedView.objects.filter(view=list_url, is_shared=True).order_by("name").only("pk", "name")
-                    )
-                    user_owned_saved_views = (
-                        SavedView.objects.filter(view=list_url, owner=request.user).order_by("name").only("pk", "name")
-                    )
-                    saved_views = shared_saved_views | user_owned_saved_views
+                saved_views = get_saved_views_for_user(request.user, list_url)
 
             new_changes_not_applied = view_changes_not_saved(request, view, self.saved_view)
             context.update(

nautobot/core/views/utils.py

@@ -17,6 +17,7 @@ from nautobot.core.utils.data import is_uuid
 from nautobot.core.utils.filtering import get_filter_field_label
 from nautobot.core.utils.lookup import get_created_and_last_updated_usernames_for_model, get_form_for_model
 from nautobot.core.views.paginator import EnhancedPaginator, get_paginate_count
+from nautobot.extras.models import SavedView
 from nautobot.extras.tables import AssociatedContactsTable, DynamicGroupTable, ObjectMetadataTable
 
 
@@ -382,3 +383,18 @@ def common_detail_view_context(request, instance):
         context["associated_object_metadata_table"] = None
 
     return context
+
+
+def get_saved_views_for_user(user, list_url):
+    # We are not using .restrict(request.user, "view") here
+    # User should be able to see any saved view that he has the list view access to.
+    saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
+    if user.has_perms(["extras.view_savedview"]):
+        return saved_views
+
+    shared_saved_views = saved_views.filter(is_shared=True)
+    if user.is_authenticated:
+        user_owned_saved_views = SavedView.objects.filter(view=list_url, owner=user).order_by("name").only("pk", "name")
+        return shared_saved_views | user_owned_saved_views
+
+    return shared_saved_views

nautobot/dcim/api/serializers.py

@@ -79,6 +79,7 @@ from nautobot.dcim.models import (
     Module,
     ModuleBay,
     ModuleBayTemplate,
+    ModuleFamily,
     ModuleType,
     PathEndpoint,
     Platform,
@@ -1124,3 +1125,15 @@ class InterfaceVDCAssignmentSerializer(ValidatedModelSerializer):
     class Meta:
         model = InterfaceVDCAssignment
         fields = "__all__"
+
+
+class ModuleFamilySerializer(NautobotModelSerializer):
+    """API serializer for ModuleFamily objects."""
+
+    url = serializers.HyperlinkedIdentityField(view_name="dcim-api:modulefamily-detail")
+    module_type_count = serializers.IntegerField(read_only=True)
+    module_bay_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = ModuleFamily
+        fields = "__all__"