nautobot 2.4.10__py3-none-any.whl → 2.4.12__py3-none-any.whl

nautobot/core/testing/views.py

@@ -1,7 +1,7 @@
 import contextlib
 import re
 from typing import Optional, Sequence
-from unittest import skipIf
+from unittest import mock, skipIf
 import uuid
 
 from django.apps import apps
@@ -9,6 +9,7 @@ from django.conf import settings
 from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import URLValidator
+from django.db.models import ManyToManyField, Model, QuerySet
 from django.test import override_settings, tag, TestCase as _TestCase
 from django.urls import NoReverseMatch, reverse
 from django.utils.html import escape
@@ -16,6 +17,7 @@ from django.utils.http import urlencode
 from django.utils.text import slugify
 from tree_queries.models import TreeNode
 
+from nautobot.core.jobs.bulk_actions import BulkEditObjects
 from nautobot.core.models.generics import PrimaryModel
 from nautobot.core.models.tree_queries import TreeModel
 from nautobot.core.templatetags import helpers
@@ -141,6 +143,8 @@ class ViewTestCases:
         Retrieve a single instance.
         """
 
+        custom_action_required_permissions = {}
+
         @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
         def test_get_object_anonymous(self):
             # Make the request as an unauthenticated user
@@ -246,6 +250,21 @@ class ViewTestCases:
             self.assertBodyContains(response, f"{instance.get_absolute_url()}#advanced")
             self.assertBodyContains(response, "Advanced")
 
+        @override_settings(EXEMPT_VIEW_PERMISSIONS=[])
+        def test_custom_actions(self):
+            instance = self._get_queryset().first()
+            for url_name, required_permissions in self.custom_action_required_permissions.items():
+                url = reverse(url_name, kwargs={"pk": instance.pk})
+                self.assertHttpStatus(self.client.get(url), 403)
+                for permission in required_permissions[:-1]:
+                    self.add_permissions(permission)
+                    self.assertHttpStatus(self.client.get(url), 403)
+
+                self.add_permissions(required_permissions[-1])
+                self.assertHttpStatus(self.client.get(url), 200)
+                # delete the permissions here so that repetitive calls to add_permissions do not create duplicate permissions.
+                self.remove_permissions(*required_permissions)
+
     class GetObjectChangelogViewTestCase(ModelViewTestCase):
         """
         View the changelog for an instance.
@@ -769,6 +788,17 @@ class ViewTestCases:
             response_body = response.content.decode(response.charset)
             self.assertIn("/login/?next=" + self._get_url("list"), response_body, msg=response_body)
 
+        def test_list_objects_anonymous_with_exempt_permission_for_one_view_only(self):
+            # Make the request as an unauthenticated user
+            self.client.logout()
+            # Test if AnonymousUser can properly render the whole list view
+            with override_settings(EXEMPT_VIEW_PERMISSIONS=[self.model._meta.label_lower]):
+                response = self.client.get(self._get_url("list"))
+                self.assertHttpStatus(response, 200)
+                # There should be some rows
+                self.assertBodyContains(response, '<tr class="even')
+                self.assertBodyContains(response, '<tr class="odd')
+
         @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
         def test_list_objects_filtered(self):
             instance1, instance2 = self._get_queryset().all()[:2]
@@ -1049,6 +1079,7 @@ class ViewTestCases:
         def validate_redirect_to_job_result(self, response):
             # Get the last Bulk Edit Objects JobResult created
             job_result = JobResult.objects.filter(name="Bulk Edit Objects").first()
+            self.assertIsNotNone(job_result, "No JobResult was created - likely the bulk_edit_data is invalid!")
             # Assert redirect to Job Results
             self.assertRedirects(
                 response,
@@ -1082,8 +1113,71 @@ class ViewTestCases:
             # Assign model-level permission
             self.add_permissions(f"{self.model._meta.app_label}.change_{self.model._meta.model_name}")
 
-            response = self.client.post(self._get_url("bulk_edit"), data)
-            self.validate_redirect_to_job_result(response)
+            with mock.patch.object(JobResult, "enqueue_job", wraps=JobResult.enqueue_job) as mock_enqueue_job:
+                response = self.client.post(self._get_url("bulk_edit"), data)
+                self.validate_redirect_to_job_result(response)
+                mock_enqueue_job.assert_called()
+
+                # Verify that the provided self.bulk_edit_data was passed through correctly to the job.
+                # The below is a bit gross because of multiple layers of data encoding and decoding involved. Sorry!
+                job_form = BulkEditObjects.as_form(BulkEditObjects.deserialize_data(mock_enqueue_job.call_args.kwargs))
+                job_form.is_valid()
+                job_kwargs = job_form.cleaned_data
+
+                bulk_edit_form_class = lookup.get_form_for_model(self.model, form_prefix="BulkEdit")
+                bulk_edit_form = bulk_edit_form_class(self.model, job_kwargs["form_data"])
+                bulk_edit_form.is_valid()
+                passed_bulk_edit_data = bulk_edit_form.cleaned_data
+
+                for key, value in self.bulk_edit_data.items():
+                    with self.subTest(key=key):
+                        if isinstance(passed_bulk_edit_data.get(key), Model):
+                            self.assertEqual(passed_bulk_edit_data.get(key).pk, value)
+                        elif isinstance(passed_bulk_edit_data.get(key), QuerySet):
+                            self.assertEqual(
+                                sorted(passed_bulk_edit_data.get(key).values_list("pk", flat=True)), sorted(value)
+                            )
+                        else:
+                            self.assertEqual(passed_bulk_edit_data.get(key), bulk_edit_form.fields[key].clean(value))
+
+        @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+        def test_bulk_edit_objects_nullable_fields(self):
+            """Assert that "set null" fields on the bulk-edit form are correctly passed through to the job."""
+            bulk_edit_form_class = lookup.get_form_for_model(self.model, form_prefix="BulkEdit")
+            bulk_edit_form = bulk_edit_form_class(self.model)
+            if not getattr(bulk_edit_form, "nullable_fields", ()):
+                self.skipTest(f"no nullable fields on {bulk_edit_form_class}")
+
+            for field_name in bulk_edit_form.nullable_fields:
+                with self.subTest(field_name=field_name):
+                    if field_name.startswith("cf_"):
+                        # TODO check whether customfield is nullable
+                        continue
+                    if field_name.startswith("cr_"):
+                        # TODO check whether relationship is required
+                        continue
+                    model_field = self.model._meta.get_field(field_name)
+                    if isinstance(model_field, ManyToManyField):
+                        # always nullable
+                        continue
+                    self.assertTrue(model_field.null or model_field.blank)
+
+            pk_list = list(self._get_queryset().values_list("pk", flat=True)[:3])
+            data = {
+                "pk": pk_list,
+                "_apply": True,  # Form button
+                "_nullify": list(bulk_edit_form.nullable_fields),
+            }
+
+            # Assign model-level permission
+            self.add_permissions(f"{self.model._meta.app_label}.change_{self.model._meta.model_name}")
+
+            with mock.patch.object(JobResult, "enqueue_job", wraps=JobResult.enqueue_job) as mock_enqueue_job:
+                response = self.client.post(self._get_url("bulk_edit"), data)
+                self.validate_redirect_to_job_result(response)
+                mock_enqueue_job.assert_called()
+
+                self.assertEqual(mock_enqueue_job.call_args.kwargs["form_data"].get("_nullify"), data["_nullify"])
 
         @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
         def test_bulk_edit_form_contains_all_pks(self):
@@ -1182,11 +1276,13 @@ class ViewTestCases:
             }
             data.update(utils.post_data(self.bulk_edit_data))
 
-            # Attempt to bulk edit permitted objects into a non-permitted state
-            response = self.client.post(self._get_url("bulk_edit"), data)
-            # NOTE: There is no way of testing constrained failure as bulk edit is a system Job;
-            # and can only be tested by checking JobLogs.
-            self.validate_redirect_to_job_result(response)
+            with mock.patch.object(JobResult, "enqueue_job", wraps=JobResult.enqueue_job) as mock_enqueue_job:
+                # Attempt to bulk edit permitted objects into a non-permitted state
+                response = self.client.post(self._get_url("bulk_edit"), data)
+                # NOTE: There is no way of testing constrained failure as bulk edit is a system Job;
+                # and can only be tested by checking JobLogs.
+                self.validate_redirect_to_job_result(response)
+                mock_enqueue_job.assert_called()
 
     class BulkDeleteObjectsViewTestCase(ModelViewTestCase):
         """

nautobot/core/tests/test_jobs.py

@@ -689,10 +689,10 @@ class LogsCleanupTestCase(TransactionTestCase):
                 cleanup_types=[CleanupTypes.JOB_RESULT],
                 max_age=60,
             )
-        self.assertFalse(JobResult.objects.filter(date_done__lt=cutoff).exists())
-        self.assertTrue(JobResult.objects.filter(date_done__gte=cutoff).exists())
-        self.assertTrue(ObjectChange.objects.filter(time__lt=cutoff).exists())
-        self.assertTrue(ObjectChange.objects.filter(time__gte=cutoff).exists())
+        self.assertFalse(JobResult.objects.filter(date_done__lt=cutoff).exists(), cm.output)
+        self.assertTrue(JobResult.objects.filter(date_done__gte=cutoff).exists(), cm.output)
+        self.assertTrue(ObjectChange.objects.filter(time__lt=cutoff).exists(), cm.output)
+        self.assertTrue(ObjectChange.objects.filter(time__gte=cutoff).exists(), cm.output)
 
         started_logs = {
             "job_result_id": str(job_result.id),
@@ -840,6 +840,22 @@ class BulkEditTestCase(TransactionTestCase):
         )
         self._common_no_error_test_assertion(Role, job_result, Role.objects.all().count(), color="aa1409")
 
+    def test_bulk_edit_objects_nullify(self):
+        """
+        Bulk edit Role instances to nullify their weight.
+        """
+        self.add_permissions("extras.change_role", "extras.view_role")
+        job_result = create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkEditObjects",
+            content_type=self.role_ct.id,
+            edit_all=True,
+            filter_query_params={},
+            form_data={"_nullify": ["weight"]},
+            username=self.user.username,
+        )
+        self._common_no_error_test_assertion(Role, job_result, Role.objects.all().count(), weight__isnull=True)
+
     def test_bulk_edit_select_some(self):
         """
         Bulk edit selected Namespace instances.

nautobot/core/tests/test_utils.py

@@ -17,6 +17,7 @@ from nautobot.core.models import fields as core_fields, utils as models_utils, v
 from nautobot.core.testing import TestCase
 from nautobot.core.utils import data as data_utils, filtering, lookup, querysets, requests
 from nautobot.core.utils.migrations import update_object_change_ct_for_replaced_models
+from nautobot.core.utils.module_loading import check_name_safe_to_import_privately
 from nautobot.dcim import filters as dcim_filters, forms as dcim_forms, models as dcim_models, tables
 from nautobot.extras import models as extras_models, utils as extras_utils
 from nautobot.extras.choices import ObjectChangeActionChoices, RelationshipTypeChoices
@@ -959,6 +960,22 @@ class TestMigrationUtils(TestCase):
             self.assertEqual(ObjectChange.objects.get(request_id=request_id).related_object_type, location_ct)
 
 
+class TestModuleLoadingUtils(TestCase):
+    def test_check_name_safe_to_import_privately(self):
+        for invalid in (
+            "foo.bar",  # not a valid identifier
+            "😂",  # not a valid identifier
+            "from",  # reserved keyword
+            "sys",  # Python builtin
+            "nautobot",  # installed package
+            "tkinter",  # system library
+        ):
+            with self.subTest(f"Invalid name: {invalid}"):
+                permitted, reason = check_name_safe_to_import_privately(invalid)
+                self.assertFalse(permitted)
+                self.assertIsInstance(reason, str)
+
+
 class TestQuerySetUtils(TestCase):
     def test_maybe_select_related(self):
         # If possible, select_related should be called

nautobot/core/tests/test_views.py

@@ -764,11 +764,11 @@ class TestObjectDetailView(TestCase):
         url = reverse("circuits:provider", args=(provider.pk,))
         response = self.client.get(f"{url}?tab=main")
         self.assertHttpStatus(response, 200)
-        response_data = response.content.decode(response.charset)
+        response_data = extract_page_body(response.content.decode(response.charset))
         view_move_url = reverse("circuits:circuit_list") + f"?provider={provider.id}"
 
         # Assert Badge Count in table panel header
-        panel_header = f"""<div class="panel-heading"><strong>Circuits</strong> <a href="{view_move_url}" class="badge badge-primary">10</a></div>"""
+        panel_header = f"""<strong>Circuits</strong> <a href="{view_move_url}" class="badge badge-primary">10</a>"""
         self.assertInHTML(panel_header, response_data)
 
         # Assert view X more btn

nautobot/core/tests/test_views_utils.py

@@ -1,13 +1,16 @@
 import urllib.parse
 
+from django.contrib.auth.models import AnonymousUser
 from django.db import ProgrammingError
 from django.test import TestCase
 
 from nautobot.core.models.querysets import count_related
-from nautobot.core.views.utils import check_filter_for_display, prepare_cloned_fields
+from nautobot.core.testing import TransactionTestCase
+from nautobot.core.views.utils import check_filter_for_display, get_saved_views_for_user, prepare_cloned_fields
 from nautobot.dcim.filters import DeviceFilterSet
 from nautobot.dcim.models import Device, DeviceRedundancyGroup, DeviceType, InventoryItem, Location, Manufacturer
-from nautobot.extras.models import Role, Status
+from nautobot.extras.models import Role, SavedView, Status
+from nautobot.users.models import User
 
 
 class CheckFilterForDisplayTest(TestCase):
@@ -168,3 +171,51 @@ class CheckPrepareClonedFields(TestCase):
                 self.assertTrue(isinstance(query_params["description"], list))
                 self.assertTrue(len(query_params["description"]) == 1)
                 self.assertTrue(query_params["description"][0] == description)
+
+
+class GetSavedViewsForUserTestCase(TransactionTestCase):
+    """
+    Class to test `get_saved_views_for_user`.
+    """
+
+    def create_saved_view(self, name, owner=None, is_shared=False):
+        """Helper to create a SavedView."""
+        return SavedView.objects.create(
+            name=name, owner=owner or self.user, view="dcim:device_list", is_shared=is_shared
+        )
+
+    def setUp(self):
+        super().setUp()
+        self.user2 = User.objects.create_user(username="second_user")
+        self.create_saved_view(name="saved_view")
+        self.create_saved_view(name="saved_view_shared", is_shared=True)
+        self.create_saved_view(name="saved_view_different_owner", owner=self.user2)
+        self.create_saved_view(name="saved_view_shared_different_owner", is_shared=True, owner=self.user2)
+
+    def test_user_with_permissions_get_all_saved_views(self):
+        """Test if for user with permissions method will return all saved views."""
+        self.add_permissions("extras.view_savedview")
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 4)
+        expected_names = [
+            "saved_view",
+            "saved_view_different_owner",
+            "saved_view_shared",
+            "saved_view_shared_different_owner",
+        ]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_user_without_permissions_get_shared_views_and_own_views_only(self):
+        """Test if user without permissions can see shared views and own views."""
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 3)
+        expected_names = ["saved_view", "saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_anonymous_user_get_shared_views_only(self):
+        """Test if method is working with anonymous users and return only shared views."""
+        user = AnonymousUser()
+        saved_views = get_saved_views_for_user(user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 2)
+        expected_names = ["saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)

nautobot/core/ui/object_detail.py

@@ -867,7 +867,7 @@ class ObjectsTablePanel(Panel):
                 body_content_table_queryset = body_content_table_queryset.order_by(*self.order_by_fields)
             body_content_table_queryset = body_content_table_queryset.distinct()
             body_content_table = body_content_table_class(
-                body_content_table_queryset, hide_hierarchy_ui=self.hide_hierarchy_ui
+                body_content_table_queryset, hide_hierarchy_ui=self.hide_hierarchy_ui, user=request.user
             )
             if self.tab_id and "actions" in body_content_table.columns:
                 # Use the `self.tab_id`, if it exists, to determine the correct return URL for the table
@@ -1266,6 +1266,10 @@ class ObjectFieldsPanel(KeyValueTablePanel):
 
             data[field_name] = field_value
 
+        # Ensuring the `name` field is displayed first, if present.
+        if "name" in data:
+            data = {"name": data["name"], **{k: v for k, v in data.items() if k != "name"}}
+
         return data
 
     def render_key(self, key, value, context: Context):

nautobot/core/utils/lookup.py

@@ -314,13 +314,15 @@ def get_created_and_last_updated_usernames_for_model(instance):
     created_by = None
     last_updated_by = None
     try:
-        created_by_record = object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).first()
+        created_by_record = (
+            object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).only("user_name").first()
+        )
         if created_by_record is not None:
             created_by = created_by_record.user_name
     except ObjectChange.DoesNotExist:
         pass
 
-    last_updated_by_record = object_change_records.first()
+    last_updated_by_record = object_change_records.only("user_name").first()
     if last_updated_by_record:
         last_updated_by = last_updated_by_record.user_name
 

nautobot/core/utils/module_loading.py

@@ -1,6 +1,7 @@
 from contextlib import contextmanager
 import importlib
 from importlib.util import find_spec, module_from_spec
+from keyword import iskeyword
 import logging
 import os
 import pkgutil
@@ -33,6 +34,28 @@ def clear_module_from_sys_modules(module_name):
             del sys.modules[name]
 
 
+def check_name_safe_to_import_privately(name: str) -> tuple[bool, str]:
+    """
+    Make sure the given package/module name is "safe" to import from the filesystem.
+
+    In other words, make sure it's:
+    - a valid Python identifier and not a reserved keyword
+    - not the name of an existing "real" Python package or builtin
+
+    Returns:
+        (bool, str): Whether safe to load, and an explanatory string fragment for logging/exception messages.
+    """
+    if not name.isidentifier():
+        return False, "not a valid identifier"
+    if iskeyword(name):
+        return False, "a reserved keyword"
+    if name in sys.builtin_module_names:
+        return False, "a Python builtin"
+    if any(module_info.name == name for module_info in pkgutil.iter_modules()):
+        return False, "the name of an installed Python package"
+    return True, "a valid and non-conflicting module name"
+
+
 def import_modules_privately(path, module_path=None, ignore_import_errors=True):
     """
     Import modules from the filesystem without adding the path permanently to `sys.path`.

nautobot/core/views/generic.py

@@ -54,6 +54,7 @@ from nautobot.core.views.utils import (
     check_filter_for_display,
     common_detail_view_context,
     get_csv_form_fields_from_serializer_class,
+    get_saved_views_for_user,
     handle_protectederror,
     import_csv_helper,
     prepare_cloned_fields,
@@ -315,18 +316,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
         table_config_form = None
         current_saved_view = None
         current_saved_view_pk = self.request.GET.get("saved_view", None)
-        # We are not using .restrict(request.user, "view") here
-        # User should be able to see any saved view that he has the list view access to.
-        if user.has_perms(["extras.view_savedview"]):
-            saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
-        else:
-            shared_saved_views = (
-                SavedView.objects.filter(view=list_url, is_shared=True).order_by("name").only("pk", "name")
-            )
-            user_owned_saved_views = (
-                SavedView.objects.filter(view=list_url, owner=user).order_by("name").only("pk", "name")
-            )
-            saved_views = shared_saved_views | user_owned_saved_views
+        saved_views = get_saved_views_for_user(user, list_url)
 
         if current_saved_view_pk:
             try:

nautobot/core/views/mixins.py

@@ -239,6 +239,9 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
     table_class = None
     notes_form_class = NoteForm
     permission_classes = []
+    # custom view attributes used for permission checks and handling
+    custom_view_base_action = None
+    custom_view_additional_permissions = None
 
     def get_permissions_for_model(self, model, actions):
         """
@@ -249,6 +252,10 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
         """
         model_permissions = []
         for action in actions:
+            # Append additional object permissions if specified.
+            if self.custom_view_additional_permissions:
+                model_permissions.append(*self.custom_view_additional_permissions)
+            # Append the model-level permissions for the action.
             model_permissions.append(f"{model._meta.app_label}.{action}_{model._meta.model_name}")
         return model_permissions
 
@@ -501,7 +508,13 @@ class NautobotViewSetMixin(GenericViewSet, AccessMixin, GetReturnURLMixin, FormV
 
     def get_action(self):
         """Helper method for retrieving action and if action not set defaulting to action name."""
-        return PERMISSIONS_ACTION_MAP.get(self.action, self.action)
+        if self.custom_view_base_action:
+            return self.custom_view_base_action
+        if self.action in PERMISSIONS_ACTION_MAP:
+            # If the action is in the action_map, return the mapped permission
+            return PERMISSIONS_ACTION_MAP[self.action]
+
+        return self.action
 
     def get_extra_context(self, request, instance=None):
         """
@@ -1032,6 +1045,11 @@ class BulkEditAndBulkDeleteModelMixin:
 
         filter_query_params = new_filter_query_params
 
+        if nullified_fields := request.POST.getlist("_nullify"):
+            form_data["_nullify"] = nullified_fields
+        else:
+            form_data["_nullify"] = []
+
         job_form = BulkEditObjects.as_form(
             data={
                 "form_data": form_data,

nautobot/core/views/renderers.py

@@ -28,6 +28,7 @@ from nautobot.core.views.utils import (
     check_filter_for_display,
     common_detail_view_context,
     get_csv_form_fields_from_serializer_class,
+    get_saved_views_for_user,
     view_changes_not_saved,
 )
 from nautobot.extras.models import SavedView
@@ -235,7 +236,8 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
                     if view.filterset_form_class is not None:
                         filter_form = view.filterset_form_class(view.filter_params, label_suffix="")
                 table = self.construct_table(view, request=request, permissions=permissions)
-                search_form = SearchForm(data=view.filter_params)
+                q_placeholder = "Search " + bettertitle(model._meta.verbose_name_plural)
+                search_form = SearchForm(data=view.filter_params, q_placeholder=q_placeholder)
             elif view.action == "destroy":
                 form = form_class(initial=request.GET)
             elif view.action in ["create", "update"]:
@@ -309,18 +311,7 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
             list_url = f"{resolved_path.app_name}:{resolved_path.url_name}"
             saved_views = None
             if model.is_saved_view_model:
-                # We are not using .restrict(request.user, "view") here
-                # User should be able to see any saved view that he has the list view access to.
-                if request.user.has_perms(["extras.view_savedview"]):
-                    saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
-                else:
-                    shared_saved_views = (
-                        SavedView.objects.filter(view=list_url, is_shared=True).order_by("name").only("pk", "name")
-                    )
-                    user_owned_saved_views = (
-                        SavedView.objects.filter(view=list_url, owner=request.user).order_by("name").only("pk", "name")
-                    )
-                    saved_views = shared_saved_views | user_owned_saved_views
+                saved_views = get_saved_views_for_user(request.user, list_url)
 
             new_changes_not_applied = view_changes_not_saved(request, view, self.saved_view)
             context.update(

nautobot/core/views/utils.py

@@ -17,6 +17,7 @@ from nautobot.core.utils.data import is_uuid
 from nautobot.core.utils.filtering import get_filter_field_label
 from nautobot.core.utils.lookup import get_created_and_last_updated_usernames_for_model, get_form_for_model
 from nautobot.core.views.paginator import EnhancedPaginator, get_paginate_count
+from nautobot.extras.models import SavedView
 from nautobot.extras.tables import AssociatedContactsTable, DynamicGroupTable, ObjectMetadataTable
 
 
@@ -382,3 +383,18 @@ def common_detail_view_context(request, instance):
         context["associated_object_metadata_table"] = None
 
     return context
+
+
+def get_saved_views_for_user(user, list_url):
+    # We are not using .restrict(request.user, "view") here
+    # User should be able to see any saved view that he has the list view access to.
+    saved_views = SavedView.objects.filter(view=list_url).order_by("name").only("pk", "name")
+    if user.has_perms(["extras.view_savedview"]):
+        return saved_views
+
+    shared_saved_views = saved_views.filter(is_shared=True)
+    if user.is_authenticated:
+        user_owned_saved_views = SavedView.objects.filter(view=list_url, owner=user).order_by("name").only("pk", "name")
+        return shared_saved_views | user_owned_saved_views
+
+    return shared_saved_views

nautobot/dcim/api/serializers.py

@@ -79,6 +79,7 @@ from nautobot.dcim.models import (
     Module,
     ModuleBay,
     ModuleBayTemplate,
+    ModuleFamily,
     ModuleType,
     PathEndpoint,
     Platform,
@@ -1124,3 +1125,15 @@ class InterfaceVDCAssignmentSerializer(ValidatedModelSerializer):
     class Meta:
         model = InterfaceVDCAssignment
         fields = "__all__"
+
+
+class ModuleFamilySerializer(NautobotModelSerializer):
+    """API serializer for ModuleFamily objects."""
+
+    url = serializers.HyperlinkedIdentityField(view_name="dcim-api:modulefamily-detail")
+    module_type_count = serializers.IntegerField(read_only=True)
+    module_bay_count = serializers.IntegerField(read_only=True)
+
+    class Meta:
+        model = ModuleFamily
+        fields = "__all__"

nautobot/dcim/api/urls.py

@@ -17,6 +17,7 @@ router.register("rack-reservations", views.RackReservationViewSet)
 router.register("manufacturers", views.ManufacturerViewSet)
 router.register("device-families", views.DeviceFamilyViewSet)
 router.register("device-types", views.DeviceTypeViewSet)
+router.register("module-families", views.ModuleFamilyViewSet)
 router.register("module-types", views.ModuleTypeViewSet)
 
 # Device type and Module type components

nautobot/dcim/api/views.py

@@ -54,6 +54,7 @@ from nautobot.dcim.models import (
     Module,
     ModuleBay,
     ModuleBayTemplate,
+    ModuleFamily,
     ModuleType,
     Platform,
     PowerFeed,
@@ -644,6 +645,14 @@ class CableViewSet(NautobotModelViewSet):
     serializer_class = serializers.CableSerializer
     filterset_class = filters.CableFilterSet
 
+    def get_queryset(self):
+        # 6933 fix: with prefetch related in queryset
+        # DeviceInterface is not properly cleared of _path_id
+        queryset = super().get_queryset()
+        if self.action == "destroy":
+            queryset = queryset.prefetch_related(None)
+        return queryset
+
 
 #
 # Virtual chassis
@@ -836,3 +845,14 @@ class InterfaceVDCAssignmentViewSet(ModelViewSet):
     queryset = InterfaceVDCAssignment.objects.all()
     serializer_class = serializers.InterfaceVDCAssignmentSerializer
     filterset_class = filters.InterfaceVDCAssignmentFilterSet
+
+
+class ModuleFamilyViewSet(NautobotModelViewSet):
+    """API viewset for interacting with ModuleFamily objects."""
+
+    queryset = ModuleFamily.objects.annotate(
+        module_type_count=count_related(ModuleType, "module_family"),
+        module_bay_count=count_related(ModuleBay, "module_family"),
+    )
+    serializer_class = serializers.ModuleFamilySerializer
+    filterset_class = filters.ModuleFamilyFilterSet

nautobot/dcim/apps.py

@@ -14,6 +14,7 @@ class DCIMConfig(NautobotConfig):
         "devicetype",
         "location",
         "module",
+        "modulefamily",
         "moduletype",
         "powerfeed",
         "rack",

nautobot/dcim/factory.py

@@ -49,6 +49,7 @@ from nautobot.dcim.models import (
     Module,
     ModuleBay,
     ModuleBayTemplate,
+    ModuleFamily,
     ModuleType,
     Platform,
     PowerOutletTemplate,
@@ -787,6 +788,7 @@ class ModuleTypeFactory(PrimaryModelFactory):
         exclude = ("has_part_number", "has_comments")
 
     manufacturer = random_instance(Manufacturer, allow_null=False)
+    module_family = random_instance(ModuleFamily, allow_null=True)
 
     has_part_number = NautobotBoolIterator()
     part_number = factory.Maybe("has_part_number", factory.Faker("ean", length=8), "")
@@ -970,6 +972,15 @@ class ModuleBayTemplateFactory(ModularDeviceComponentTemplateFactory):
         factory.LazyAttribute(lambda o: o.module_type.module_bay_templates.count() + 1),
     )
 
+    class Params:
+        has_module_family = NautobotBoolIterator()
+
+    module_family = factory.Maybe(
+        "has_module_family",
+        random_instance(ModuleFamily),
+        None,
+    )
+
 
 class VirtualDeviceContextFactory(PrimaryModelFactory):
     class Meta: