nautobot 2.4.12__py3-none-any.whl → 2.4.14__py3-none-any.whl

nautobot/extras/tests/test_views.py

@@ -1850,8 +1850,18 @@ class SecretTestCase(
         }
 
 
-class SecretsGroupTestCase(ViewTestCases.OrganizationalObjectViewTestCase):
+class SecretsGroupTestCase(
+    ViewTestCases.OrganizationalObjectViewTestCase,
+    ViewTestCases.BulkEditObjectsViewTestCase,
+):
     model = SecretsGroup
+    custom_test_permissions = [
+        "extras.view_secret",
+        "extras.add_secretsgroup",
+        "extras.view_secretsgroup",
+        "extras.add_secretsgroupassociation",
+        "extras.change_secretsgroupassociation",
+    ]
 
     @classmethod
     def setUpTestData(cls):
@@ -1895,6 +1905,108 @@ class SecretsGroupTestCase(ViewTestCases.OrganizationalObjectViewTestCase):
             "secrets_group_associations-MIN_NUM_FORMS": "0",
             "secrets_group_associations-MAX_NUM_FORMS": "1000",
         }
+        cls.bulk_edit_data = {
+            "description": "This is a very detailed new description",
+        }
+
+    def test_create_group_with_valid_secret_association(self):
+        """Test that a SecretsGroup with a valid Secret association saves correctly via the formset."""
+        self.add_permissions(*self.custom_test_permissions)
+        # Create a secret to associate
+        secret = Secret.objects.create(
+            name="AWS_Secret",
+            provider="text-file",
+            parameters={"path": "/tmp"},  # noqa: S108  # hardcoded-temp-file -- false positive
+        )
+
+        form_data = {
+            "name": "test",
+            "description": "test bulk edits",
+            "secrets_group_associations-TOTAL_FORMS": "1",
+            "secrets_group_associations-INITIAL_FORMS": "0",
+            "secrets_group_associations-MIN_NUM_FORMS": "0",
+            "secrets_group_associations-MAX_NUM_FORMS": "1000",
+            "secrets_group_associations-0-secret": secret.pk,
+            "secrets_group_associations-0-access_type": SecretsGroupAccessTypeChoices.TYPE_HTTP,
+            "secrets_group_associations-0-secret_type": SecretsGroupSecretTypeChoices.TYPE_PASSWORD,
+        }
+
+        # Submit the form to the "add SecretsGroup" view
+        response = self.client.post(reverse("extras:secretsgroup_add"), data=form_data, follow=True)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(SecretsGroup.objects.filter(name="test").exists())
+
+        # Checks that the association was created correctly
+        group = SecretsGroup.objects.get(name="test")
+        self.assertEqual(group.secrets_group_associations.count(), 1)
+
+        association = group.secrets_group_associations.first()
+        self.assertEqual(association.secret, secret)
+        self.assertEqual(association.access_type, SecretsGroupAccessTypeChoices.TYPE_HTTP)
+        self.assertEqual(association.secret_type, SecretsGroupSecretTypeChoices.TYPE_PASSWORD)
+
+    def test_create_group_with_invalid_secret_association(self):
+        """Test that invalid Secret association formset raises validation error and does not save."""
+        self.add_permissions(*self.custom_test_permissions)
+        url = reverse("extras:secretsgroup_add")
+
+        form_data = {
+            "name": "Invalid Secrets Group",
+            "description": "Missing required fields",
+            "secrets_group_associations-TOTAL_FORMS": "1",
+            "secrets_group_associations-INITIAL_FORMS": "0",
+            "secrets_group_associations-MIN_NUM_FORMS": "0",
+            "secrets_group_associations-MAX_NUM_FORMS": "1000",
+            "secrets_group_associations-0-secret": "",  # invalid
+            "secrets_group_associations-0-access_type": SecretsGroupAccessTypeChoices.TYPE_HTTP,
+            "secrets_group_associations-0-secret_type": "",  # invalid
+        }
+
+        response = self.client.post(url, data=form_data)
+
+        self.assertEqual(response.status_code, 200)
+
+        # Checks that no new SecretsGroup was created
+        self.assertFalse(SecretsGroup.objects.filter(name="Invalid Secrets Group").exists())
+
+        # Checks that formset errors are raised in the context
+        self.assertFormsetError(
+            response.context["secrets"], form_index=0, field="secret", errors=["This field is required."]
+        )
+
+    def test_create_group_with_deleted_secret_fails_cleanly(self):
+        """
+        Creating a SecretsGroup with a deleted Secret should fail with a formset error.
+        """
+        self.add_permissions(*self.custom_test_permissions)
+
+        secret = Secret.objects.create(name="TempSecret", provider="text-file", parameters={"path": "/tmp"})  # noqa: S108  # hardcoded-temp-file -- false positive
+        secret_pk = secret.pk
+        secret.delete()
+
+        form_data = {
+            "name": "Test Group",
+            "description": "This should not be created",
+            "secrets_group_associations-TOTAL_FORMS": "1",
+            "secrets_group_associations-INITIAL_FORMS": "0",
+            "secrets_group_associations-MIN_NUM_FORMS": "0",
+            "secrets_group_associations-MAX_NUM_FORMS": "1000",
+            "secrets_group_associations-0-secret": secret_pk,
+            "secrets_group_associations-0-access_type": SecretsGroupAccessTypeChoices.TYPE_HTTP,
+            "secrets_group_associations-0-secret_type": SecretsGroupSecretTypeChoices.TYPE_PASSWORD,
+        }
+
+        response = self.client.post(reverse("extras:secretsgroup_add"), data=form_data)
+        self.assertEqual(response.status_code, 200)
+
+        self.assertFormsetError(
+            response.context["secrets"],
+            form_index=0,
+            field="secret",
+            errors=["Select a valid choice. That choice is not one of the available choices."],
+        )
+        self.assertFalse(SecretsGroup.objects.filter(name="Test Group").exists())
 
 
 class GraphQLQueriesTestCase(

nautobot/extras/urls.py

@@ -6,11 +6,9 @@ from nautobot.extras.models import (
     CustomField,
     DynamicGroup,
     GitRepository,
-    GraphQLQuery,
     Job,
     Note,
     Relationship,
-    SecretsGroup,
 )
 
 app_name = "extras"
@@ -24,6 +22,7 @@ router.register("contact-associations", views.ContactAssociationUIViewSet)
 router.register("custom-links", views.CustomLinkUIViewSet)
 router.register("export-templates", views.ExportTemplateUIViewSet)
 router.register("external-integrations", views.ExternalIntegrationUIViewSet)
+router.register("graphql-queries", views.GraphQLQueryUIViewSet)
 router.register("job-buttons", views.JobButtonUIViewSet)
 router.register("job-hooks", views.JobHookUIViewSet)
 router.register("job-queues", views.JobQueueUIViewSet)
@@ -34,6 +33,7 @@ router.register("relationships", views.RelationshipUIViewSet)
 router.register("roles", views.RoleUIViewSet)
 router.register("saved-views", views.SavedViewUIViewSet)
 router.register("secrets", views.SecretUIViewSet)
+router.register("secrets-groups", views.SecretsGroupUIViewSet)
 router.register("static-group-associations", views.StaticGroupAssociationUIViewSet)
 router.register("statuses", views.StatusUIViewSet)
 router.register("tags", views.TagUIViewSet)
@@ -181,37 +181,6 @@ urlpatterns = [
         views.GitRepositoryDryRunView.as_view(),
         name="gitrepository_dryrun",
     ),
-    # GraphQL Queries
-    path("graphql-queries/", views.GraphQLQueryListView.as_view(), name="graphqlquery_list"),
-    path("graphql-queries/add/", views.GraphQLQueryEditView.as_view(), name="graphqlquery_add"),
-    path(
-        "graphql-queries/delete/",
-        views.GraphQLQueryBulkDeleteView.as_view(),
-        name="GraphQLQuery_bulk_delete",
-    ),
-    path("graphql-queries/<uuid:pk>/", views.GraphQLQueryView.as_view(), name="graphqlquery"),
-    path(
-        "graphql-queries/<uuid:pk>/edit/",
-        views.GraphQLQueryEditView.as_view(),
-        name="graphqlquery_edit",
-    ),
-    path(
-        "graphql-queries/<uuid:pk>/delete/",
-        views.GraphQLQueryDeleteView.as_view(),
-        name="graphqlquery_delete",
-    ),
-    path(
-        "graphql-queries/<uuid:pk>/changelog/",
-        views.ObjectChangeLogView.as_view(),
-        name="graphqlquery_changelog",
-        kwargs={"model": GraphQLQuery},
-    ),
-    path(
-        "graphql-queries/<uuid:pk>/notes/",
-        views.ObjectNotesView.as_view(),
-        name="graphqlquery_notes",
-        kwargs={"model": GraphQLQuery},
-    ),
     # Image attachments
     path(
         "image-attachments/<uuid:pk>/edit/",
@@ -311,24 +280,6 @@ urlpatterns = [
         views.SecretProviderParametersFormView.as_view(),
         name="secret_provider_parameters_form",
     ),
-    path("secrets-groups/", views.SecretsGroupListView.as_view(), name="secretsgroup_list"),
-    path("secrets-groups/add/", views.SecretsGroupEditView.as_view(), name="secretsgroup_add"),
-    path("secrets-groups/delete/", views.SecretsGroupBulkDeleteView.as_view(), name="secretsgroup_bulk_delete"),
-    path("secrets-groups/<uuid:pk>/", views.SecretsGroupView.as_view(), name="secretsgroup"),
-    path("secrets-groups/<uuid:pk>/edit/", views.SecretsGroupEditView.as_view(), name="secretsgroup_edit"),
-    path("secrets-groups/<uuid:pk>/delete/", views.SecretsGroupDeleteView.as_view(), name="secretsgroup_delete"),
-    path(
-        "secrets-groups/<uuid:pk>/changelog/",
-        views.ObjectChangeLogView.as_view(),
-        name="secretsgroup_changelog",
-        kwargs={"model": SecretsGroup},
-    ),
-    path(
-        "secrets-groups/<uuid:pk>/notes/",
-        views.ObjectNotesView.as_view(),
-        name="secretsgroup_notes",
-        kwargs={"model": SecretsGroup},
-    ),
 ]
 
 urlpatterns += router.urls

nautobot/extras/utils.py

@@ -275,11 +275,14 @@ def extras_features(*features):
     """
 
     def wrapper(model_class):
-        # Initialize the model_features store if not already defined
+        # Initialize the model_features and feature_models stores if not already defined
         if "model_features" not in registry:
             registry["model_features"] = {f: collections.defaultdict(list) for f in EXTRAS_FEATURES}
+        if "feature_models" not in registry:
+            registry["feature_models"] = {f: [] for f in EXTRAS_FEATURES}
         for feature in features:
             if feature in EXTRAS_FEATURES:
+                registry["feature_models"][feature].append(model_class)
                 app_label, model_name = model_class._meta.label_lower.split(".")
                 registry["model_features"][feature][app_label].append(model_name)
             else:

nautobot/extras/views.py

@@ -945,11 +945,13 @@ class DynamicGroupBulkDeleteView(generic.BulkDeleteView):
     filterset = filters.DynamicGroupFilterSet
 
 
-# 3.0 TODO: remove, deprecated since 2.3 (#5845)
 class ObjectDynamicGroupsView(generic.GenericView):
     """
     Present a list of dynamic groups associated to a particular object.
 
+    Note that this isn't currently widely used, as most object detail views currently render the table inline
+    rather than using this separate view. This may change in the future.
+
     base_template: Specify to explicitly identify the base object detail template to render.
         If not provided, "<app>/<model>.html", "<app>/<model>_retrieve.html", or "generic/object_retrieve.html"
         will be used, as per `get_base_template()`.
@@ -969,7 +971,6 @@ class ObjectDynamicGroupsView(generic.GenericView):
             data=obj.dynamic_groups.restrict(request.user, "view"), orderable=False
         )
         dynamicgroups_table.columns.hide("content_type")
-        dynamicgroups_table.columns.hide("members")
 
         # Apply the request context
         paginate = {
@@ -1229,32 +1230,24 @@ class GitRepositoryResultView(generic.ObjectView):
 #
 
 
-class GraphQLQueryListView(generic.ObjectListView):
+class GraphQLQueryUIViewSet(
+    ObjectDetailViewMixin,
+    ObjectListViewMixin,
+    ObjectEditViewMixin,
+    ObjectDestroyViewMixin,
+    ObjectBulkDestroyViewMixin,
+    ObjectChangeLogViewMixin,
+    ObjectNotesViewMixin,
+):
+    filterset_form_class = forms.GraphQLQueryFilterForm
     queryset = GraphQLQuery.objects.all()
-    table = tables.GraphQLQueryTable
-    filterset = filters.GraphQLQueryFilterSet
-    filterset_form = forms.GraphQLQueryFilterForm
+    form_class = forms.GraphQLQueryForm
+    filterset_class = filters.GraphQLQueryFilterSet
+    serializer_class = serializers.GraphQLQuerySerializer
+    table_class = tables.GraphQLQueryTable
     action_buttons = ("add",)
 
 
-class GraphQLQueryView(generic.ObjectView):
-    queryset = GraphQLQuery.objects.all()
-
-
-class GraphQLQueryEditView(generic.ObjectEditView):
-    queryset = GraphQLQuery.objects.all()
-    model_form = forms.GraphQLQueryForm
-
-
-class GraphQLQueryDeleteView(generic.ObjectDeleteView):
-    queryset = GraphQLQuery.objects.all()
-
-
-class GraphQLQueryBulkDeleteView(generic.BulkDeleteView):
-    queryset = GraphQLQuery.objects.all()
-    table = tables.GraphQLQueryTable
-
-
 #
 # Image attachments
 #
@@ -2744,123 +2737,37 @@ class SecretProviderParametersFormView(generic.GenericView):
         )
 
 
-class SecretsGroupListView(generic.ObjectListView):
-    queryset = SecretsGroup.objects.all()
-    filterset = filters.SecretsGroupFilterSet
-    filterset_form = forms.SecretsGroupFilterForm
-    table = tables.SecretsGroupTable
-    action_buttons = ("add",)
-
-
-class SecretsGroupView(generic.ObjectView):
-    queryset = SecretsGroup.objects.all()
-
-    def get_extra_context(self, request, instance):
-        return {"secrets_group_associations": SecretsGroupAssociation.objects.filter(secrets_group=instance)}
-
-
-class SecretsGroupEditView(generic.ObjectEditView):
+class SecretsGroupUIViewSet(NautobotUIViewSet):
+    bulk_update_form_class = forms.SecretsGroupBulkEditForm
+    filterset_class = filters.SecretsGroupFilterSet
+    filterset_form_class = forms.SecretsGroupFilterForm
+    form_class = forms.SecretsGroupForm
+    serializer_class = serializers.SecretsGroupSerializer
+    table_class = tables.SecretsGroupTable
+    template_name = "extras/secretsgroup_update.html"
     queryset = SecretsGroup.objects.all()
-    model_form = forms.SecretsGroupForm
-    template_name = "extras/secretsgroup_edit.html"
-
-    def get_extra_context(self, request, instance):
-        ctx = super().get_extra_context(request, instance)
-
-        if request.POST:
-            ctx["secrets"] = forms.SecretsGroupAssociationFormSet(data=request.POST, instance=instance)
-        else:
-            ctx["secrets"] = forms.SecretsGroupAssociationFormSet(instance=instance)
-
-        return ctx
-
-    def post(self, request, *args, **kwargs):
-        obj = self.alter_obj(self.get_object(kwargs), request, args, kwargs)
-        form = self.model_form(data=request.POST, files=request.FILES, instance=obj)
-        restrict_form_fields(form, request.user)
-
-        if form.is_valid():
-            logger.debug("Form validation was successful")
-
-            try:
-                with transaction.atomic():
-                    object_created = not form.instance.present_in_database
-                    obj = form.save()
-
-                    # Check that the new object conforms with any assigned object-level permissions
-                    self.queryset.get(pk=obj.pk)
-
-                    # Process the formsets for secrets
-                    ctx = self.get_extra_context(request, obj)
-                    secrets = ctx["secrets"]
-                    if secrets.is_valid():
-                        secrets.save()
-                    else:
-                        raise RuntimeError(secrets.errors)
-                verb = "Created" if object_created else "Modified"
-                msg = f"{verb} {self.queryset.model._meta.verbose_name}"
-                logger.info(f"{msg} {obj} (PK: {obj.pk})")
-                try:
-                    msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
-                except AttributeError:
-                    msg = format_html("{} {}", msg, obj)
-                messages.success(request, msg)
 
-                if "_addanother" in request.POST:
-                    # If the object has clone_fields, pre-populate a new instance of the form
-                    if hasattr(obj, "clone_fields"):
-                        url = f"{request.path}?{prepare_cloned_fields(obj)}"
-                        return redirect(url)
-
-                    return redirect(request.get_full_path())
-
-                return_url = form.cleaned_data.get("return_url")
-                if url_has_allowed_host_and_scheme(url=return_url, allowed_hosts=request.get_host()):
-                    return redirect(iri_to_uri(return_url))
-                else:
-                    return redirect(self.get_return_url(request, obj))
+    def get_extra_context(self, request, instance=None):
+        context = super().get_extra_context(request, instance)
+        if self.action == "retrieve" and instance:
+            context["secrets_group_associations"] = SecretsGroupAssociation.objects.filter(secrets_group=instance)
+        if self.action in ("create", "update"):
+            if request.method == "POST":
+                context["secrets"] = forms.SecretsGroupAssociationFormSet(data=request.POST, instance=instance)
+            else:
+                context["secrets"] = forms.SecretsGroupAssociationFormSet(instance=instance)
+        return context
 
-            except ObjectDoesNotExist:
-                msg = "Object save failed due to object-level permissions violation."
-                logger.debug(msg)
-                form.add_error(None, msg)
-            except RuntimeError:
-                msg = "Errors encountered when saving secrets group associations. See below."
-                logger.debug(msg)
-                form.add_error(None, msg)
-            except ProtectedError as err:
-                # e.g. Trying to delete a choice that is in use.
-                err_msg = err.args[0]
-                protected_obj = err.protected_objects[0]
-                msg = f"{protected_obj.value}: {err_msg} Please cancel this edit and start again."
-                logger.debug(msg)
-                form.add_error(None, msg)
+    def form_save(self, form, **kwargs):
+        obj = super().form_save(form, **kwargs)
+        secrets = forms.SecretsGroupAssociationFormSet(data=self.request.POST, instance=form.instance)
 
+        if secrets.is_valid():
+            secrets.save()
         else:
-            logger.debug("Form validation failed")
+            raise ValidationError(secrets.errors)
 
-        return render(
-            request,
-            self.template_name,
-            {
-                "obj": obj,
-                "obj_type": self.queryset.model._meta.verbose_name,
-                "form": form,
-                "return_url": self.get_return_url(request, obj),
-                "editing": obj.present_in_database,
-                **self.get_extra_context(request, obj),
-            },
-        )
-
-
-class SecretsGroupDeleteView(generic.ObjectDeleteView):
-    queryset = SecretsGroup.objects.all()
-
-
-class SecretsGroupBulkDeleteView(generic.BulkDeleteView):
-    queryset = SecretsGroup.objects.all()
-    filterset = filters.SecretsGroupFilterSet
-    table = tables.SecretsGroupTable
+        return obj
 
 
 #

nautobot/ipam/api/views.py

@@ -1,7 +1,8 @@
 from django.conf import settings
 from django.core.cache import cache
 from django.shortcuts import get_object_or_404
-from drf_spectacular.utils import extend_schema, extend_schema_view
+from drf_spectacular.utils import extend_schema, extend_schema_view, OpenApiParameter
+import netaddr
 from rest_framework import status
 from rest_framework.decorators import action
 from rest_framework.exceptions import APIException
@@ -123,6 +124,26 @@ class PrefixViewSet(NautobotModelViewSet):
             return serializers.PrefixLegacySerializer
         return super().get_serializer_class()
 
+    @staticmethod
+    def get_ipaddress_param(request, name, default):
+        """Extract IP address parameter from request.
+        :param request: django-rest request object
+        :param name: name of the query parameter which contains the IP address string
+        :param default: fallback IP address string in case no value is present in the query parameter
+        :return: tuple of mutually exclusive (Response|None, netaddr.IPAddress object|None).
+                 Will return a Response in case the client sent incorrectly formatted IP Address in
+                 the parameter. It is up to the caller to return the Response.
+        """
+        response, result = None, None
+        try:
+            result = netaddr.IPAddress(request.query_params.get(name, default))
+        except (netaddr.core.AddrFormatError, ValueError, TypeError) as e:
+            response = Response(
+                {"detail": (f"Incorrectly formatted address in parameter {name}: {e}")},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+        return response, result
+
     class LocationIncompatibleLegacyBehavior(APIException):
         status_code = 412
         default_detail = (
@@ -225,6 +246,33 @@ class PrefixViewSet(NautobotModelViewSet):
 
             return Response(serializer.data)
 
+    @extend_schema(
+        methods=["get", "post"],
+        parameters=[
+            OpenApiParameter(
+                name="range_start",
+                location="query",
+                description="IP from which enumeration/allocation should start.",
+                type={
+                    "oneOf": [
+                        {"type": "string", "format": "ipv6"},
+                        {"type": "string", "format": "ipv4"},
+                    ]
+                },
+            ),
+            OpenApiParameter(
+                name="range_end",
+                location="query",
+                description="IP from which enumeration/allocation should stop.",
+                type={
+                    "oneOf": [
+                        {"type": "string", "format": "ipv6"},
+                        {"type": "string", "format": "ipv4"},
+                    ]
+                },
+            ),
+        ],
+    )
     @extend_schema(methods=["get"], responses={200: serializers.AvailableIPSerializer(many=True)})
     @extend_schema(
         methods=["post"],
@@ -251,6 +299,21 @@ class PrefixViewSet(NautobotModelViewSet):
         """
         prefix = get_object_or_404(Prefix.objects.restrict(request.user), pk=pk)
 
+        default_first, default_last = netaddr.IPAddress(prefix.prefix.first), netaddr.IPAddress(prefix.prefix.last)
+        ((error_response_start, range_start), (error_response_end, range_end)) = (
+            self.get_ipaddress_param(request, "range_start", default_first),
+            self.get_ipaddress_param(request, "range_end", default_last),
+        )
+        if response := error_response_start or error_response_end:
+            return response
+
+        available_ips = prefix.get_available_ips()
+        # range_start and range_end are inclusive
+        if range_start > default_first:
+            available_ips.remove(netaddr.IPRange(default_first, range_start - 1))
+        if range_end < default_last:
+            available_ips.remove(netaddr.IPRange(range_end + 1, default_last))
+
         # Create the next available IP within the prefix
         if request.method == "POST":
             with cache.lock(
@@ -260,23 +323,23 @@ class PrefixViewSet(NautobotModelViewSet):
                 requested_ips = request.data if isinstance(request.data, list) else [request.data]
 
                 # Determine if the requested number of IPs is available
-                available_ips = prefix.get_available_ips()
                 if available_ips.size < len(requested_ips):
                     return Response(
                         {
                             "detail": (
                                 f"An insufficient number of IP addresses are available within the prefix {prefix} "
-                                f"({len(requested_ips)} requested, {len(available_ips)} available)"
+                                f"({len(requested_ips)} requested, {available_ips.size} available between "
+                                f"{range_start} and {range_end})."
                             )
                         },
                         status=status.HTTP_204_NO_CONTENT,
                     )
 
                 # Assign addresses from the list of available IPs and copy Namespace assignment from the parent Prefix
-                available_ips = iter(available_ips)
                 prefix_length = prefix.prefix.prefixlen
+                available_ips_iter = iter(available_ips)
                 for requested_ip in requested_ips:
-                    requested_ip["address"] = f"{next(available_ips)}/{prefix_length}"
+                    requested_ip["address"] = f"{next(available_ips_iter)}/{prefix_length}"
                     requested_ip["namespace"] = prefix.namespace
 
                 # Initialize the serializer with a list or a single object depending on what was requested
@@ -307,7 +370,7 @@ class PrefixViewSet(NautobotModelViewSet):
 
             # Calculate available IPs within the prefix
             ip_list = []
-            for index, ip in enumerate(prefix.get_available_ips(), start=1):
+            for index, ip in enumerate(available_ips, start=1):
                 ip_list.append(ip)
                 if index == limit:
                     break

nautobot/ipam/migrations/0052_alter_ipaddress_index_together_and_more.py

@@ -0,0 +1,28 @@
+# Generated by Django 4.2.20 on 2025-07-17 16:10
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("ipam", "0051_added_optional_vrf_relationship_to_vdc"),
+    ]
+
+    operations = [
+        migrations.AlterIndexTogether(
+            name="ipaddress",
+            index_together={("ip_version", "host", "mask_length")},
+        ),
+        migrations.AlterIndexTogether(
+            name="prefix",
+            index_together={
+                ("namespace", "ip_version", "network", "prefix_length"),
+                ("namespace", "network", "broadcast", "prefix_length"),
+                ("network", "broadcast", "prefix_length"),
+            },
+        ),
+        migrations.AlterIndexTogether(
+            name="vrf",
+            index_together={("namespace", "name", "rd")},
+        ),
+    ]

nautobot/ipam/models.py

@@ -170,6 +170,9 @@ class VRF(PrimaryModel):
             #       where multiple different-RD VRFs with the same name may already exist.
             # ["namespace", "name"],
         ]
+        index_together = [
+            ["namespace", "name", "rd"],
+        ]
         verbose_name = "VRF"
         verbose_name_plural = "VRFs"
 
@@ -409,7 +412,12 @@ class VRFPrefixAssignment(BaseModel):
         super().clean()
 
         if self.prefix.namespace != self.vrf.namespace:
-            raise ValidationError({"prefix": "Prefix must be in same namespace as VRF"})
+            raise ValidationError(
+                {
+                    "prefix": f"Prefix (namespace {self.prefix.namespace}) must be in same namespace as "
+                    "VRF (namespace {self.vrf.namespace})"
+                }
+            )
 
 
 @extras_features(
@@ -589,6 +597,7 @@ class Prefix(PrimaryModel):
         index_together = [
             ["network", "broadcast", "prefix_length"],
             ["namespace", "network", "broadcast", "prefix_length"],
+            ["namespace", "ip_version", "network", "prefix_length"],
         ]
         unique_together = ["namespace", "network", "prefix_length"]
         verbose_name_plural = "prefixes"
@@ -1250,6 +1259,9 @@ class IPAddress(PrimaryModel):
         verbose_name = "IP address"
         verbose_name_plural = "IP addresses"
         unique_together = ["parent", "host"]
+        index_together = [
+            ["ip_version", "host", "mask_length"],
+        ]
 
     def __init__(self, *args, address=None, namespace=None, **kwargs):
         super().__init__(*args, **kwargs)