nautobot 2.4.21__py3-none-any.whl → 3.0.0a3__py3-none-any.whl

nautobot/extras/tests/test_api.py

@@ -1,14 +1,16 @@
 from datetime import datetime, timedelta
 import tempfile
 from unittest import mock, skip
+from urllib.parse import urlencode
 import uuid
 from zoneinfo import ZoneInfo
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group
 from django.contrib.contenttypes.models import ContentType
 from django.core.files.uploadedfile import SimpleUploadedFile
-from django.test import override_settings
+from django.test import override_settings, tag
 from django.urls import reverse
 from django.utils.timezone import make_aware, now
 from rest_framework import status
@@ -33,6 +35,7 @@ from nautobot.dcim.models import (
 from nautobot.dcim.tests import test_views
 from nautobot.extras.api.serializers import ConfigContextSerializer, JobResultSerializer
 from nautobot.extras.choices import (
+    ApprovalWorkflowStateChoices,
     DynamicGroupOperatorChoices,
     DynamicGroupTypeChoices,
     JobExecutionType,
@@ -48,6 +51,11 @@ from nautobot.extras.choices import (
 )
 from nautobot.extras.jobs import get_job
 from nautobot.extras.models import (
+    ApprovalWorkflow,
+    ApprovalWorkflowDefinition,
+    ApprovalWorkflowStage,
+    ApprovalWorkflowStageDefinition,
+    ApprovalWorkflowStageResponse,
     ComputedField,
     ConfigContext,
     ConfigContextSchema,
@@ -107,6 +115,578 @@ class AppTest(APITestCase):
         self.assertEqual(response.status_code, 200)
 
 
+class ApprovalWorkflowStageTest(
+    APIViewTestCases.GetObjectViewTestCase,
+    APIViewTestCases.ListObjectsViewTestCase,
+):
+    model = ApprovalWorkflowStage
+
+    @classmethod
+    def setUpTestData(cls):
+        cls.user = User.objects.create(username="user1", is_active=True)
+        cls.approver_group_1 = Group.objects.create(name="Approver Group 1")
+        cls.job_model = Job.objects.get_for_class_path("pass_job.TestPassJob")
+        cls.job_model.enabled = True
+        cls.job_model.save()
+
+        cls.scheduled_jobs = [
+            ScheduledJob.objects.create(
+                name=f"TessPassJob Scheduled Job {i}",
+                task="pass_job.TestPassJob",
+                job_model=cls.job_model,
+                interval=JobExecutionType.TYPE_IMMEDIATELY,
+                user=cls.user,
+                start_time=now(),
+            )
+            for i in range(4)
+        ]
+        cls.scheduledjob_ct = ContentType.objects.get_for_model(ScheduledJob)
+
+        cls.approval_workflow_definitions = [
+            ApprovalWorkflowDefinition.objects.create(
+                name=f"Test Approval Workflow {i}", model_content_type=cls.scheduledjob_ct, weight=i
+            )
+            for i in range(4)
+        ]
+        cls.approval_workflows = [
+            ApprovalWorkflow.objects.create(
+                approval_workflow_definition=cls.approval_workflow_definitions[i],
+                object_under_review_content_type=cls.scheduledjob_ct,
+                object_under_review_object_id=cls.scheduled_jobs[i].pk,
+                current_state=ApprovalWorkflowStateChoices.PENDING,
+            )
+            for i in range(4)
+        ]
+        cls.approval_workflow_stage_definitions = [
+            ApprovalWorkflowStageDefinition.objects.create(
+                approval_workflow_definition=cls.approval_workflow_definitions[i],
+                sequence=i * 100,
+                name=f"Test Approval Workflow Stage {i} Definition",
+                min_approvers=1,
+                denial_message="Stage Denial Message",
+                approver_group=cls.approver_group_1,
+            )
+            for i in range(3)
+        ]
+        cls.approval_workflow_stages = [
+            ApprovalWorkflowStage.objects.create(
+                approval_workflow=cls.approval_workflows[i],
+                approval_workflow_stage_definition=cls.approval_workflow_stage_definitions[i],
+                state=ApprovalWorkflowStateChoices.PENDING,
+            )
+            for i in range(3)
+        ]
+
+        cls.approval_workflow_content_type_cases = [
+            {
+                "content_type": "ScheduledJob",
+                "object": cls.scheduled_jobs[0],
+                "workflow": cls.approval_workflows[0],
+                "stage": cls.approval_workflow_stages[0],
+            }
+        ]
+
+    def _test_workflow_stage_action_anonymous(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            with self.subTest(case=case["content_type"], action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                response = self.client.post(url)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertIn(response.data["detail"], "'Authentication credentials were not provided.'")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_anonymous(self):
+        self._test_workflow_stage_action_anonymous("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_anonymous(self):
+        self._test_workflow_stage_action_anonymous("deny")
+
+    def _test_approval_workflow_stage_action_without_permission(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            with self.subTest(case=case["content_type"], action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                with disable_warnings("django.request"):
+                    response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertIn(response.data["detail"], "You do not have permission to perform this action.")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_without_permission(self):
+        self._test_approval_workflow_stage_action_without_permission("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_without_permission(self):
+        self._test_approval_workflow_stage_action_without_permission("deny")
+
+    def _test_approval_workflow_stage_action_without_approvalworkflow_permission(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions(f"extras.change_{content_type.lower()}")
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertIn(response.data["detail"], "You do not have permission to perform this action.")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_without_approvalworkflow_permission(self):
+        self._test_approval_workflow_stage_action_without_approvalworkflow_permission("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_without_approvalworkflow_permission(self):
+        self._test_approval_workflow_stage_action_without_approvalworkflow_permission("deny")
+
+    def _test_approval_workflow_stage_action_without_change_content_type_permission(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            with self.subTest(case=case["content_type"], action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage")
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertIn(response.data["detail"], "You do not have 'change' permission on extras.scheduledjob.")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_without_change_content_type_permission(self):
+        self._test_approval_workflow_stage_action_without_change_content_type_permission("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_without_change_content_type_permission(self):
+        self._test_approval_workflow_stage_action_without_change_content_type_permission("deny")
+
+    def _test_approval_workflow_stage_action_without_approver_group_membership(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertIn(response.data["detail"], "You do not have permission to approve this stage.")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_without_approver_group_membership(self):
+        self._test_approval_workflow_stage_action_without_approver_group_membership("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_without_approver_group_membership(self):
+        self._test_approval_workflow_stage_action_without_approver_group_membership("deny")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def _test_approval_workflow_stage_with_dismatch_constraints(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions(
+                    "extras.change_approvalworkflowstage",
+                    f"extras.change_{content_type.lower()}",
+                    constraints={"pk": self.approval_workflow_stages[1].pk},
+                )
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_404_NOT_FOUND)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_with_dismatch_contraints(self):
+        self._test_approval_workflow_stage_with_dismatch_constraints("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_with_dismatch_contraints(self):
+        self._test_approval_workflow_stage_with_dismatch_constraints("deny")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def _test_approval_workflow_stage_with_match_constraints(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions(
+                    "extras.change_approvalworkflowstage",
+                    f"extras.change_{content_type.lower()}",
+                    constraints={"pk": case["stage"].pk},
+                )
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_with_match_contraints(self):
+        self._test_approval_workflow_stage_with_match_constraints("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_with_match_contraints(self):
+        self._test_approval_workflow_stage_with_match_constraints("deny")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def _test_approval_workflow_stage_with_dismatch_content_type_constraints(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions(
+                    "extras.change_approvalworkflowstage",
+                    f"extras.change_{content_type.lower()}",
+                    constraints={"approval_workflow__object_under_review_object_id": self.scheduled_jobs[1].pk},
+                )
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_404_NOT_FOUND)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_with_dismatch_content_type_contraints(self):
+        self._test_approval_workflow_stage_with_dismatch_content_type_constraints("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_with_dismatch_content_type_contraints(self):
+        self._test_approval_workflow_stage_with_dismatch_content_type_constraints("deny")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def _test_approval_workflow_stage_with_match_content_type_constraints(self, action):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type, action=action):
+                url = reverse(f"extras-api:approvalworkflowstage-{action}", kwargs={"pk": case["stage"].pk})
+                self.add_permissions(
+                    "extras.change_approvalworkflowstage",
+                    f"extras.change_{content_type.lower()}",
+                    constraints={"approval_workflow__object_under_review_object_id": self.scheduled_jobs[0].pk},
+                )
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_with_match_content_type_contraints(self):
+        self._test_approval_workflow_stage_with_match_content_type_constraints("approve")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_with_match_content_type_contraints(self):
+        self._test_approval_workflow_stage_with_match_content_type_constraints("deny")
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_in_approval_workflow_with_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-approve", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.first().comments, "")
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.APPROVED)
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.APPROVED)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertEqual(scheduled_job.decision_date, approval_workflow.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_approval_workflow_stage_in_approval_workflow_with_more_than_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-approve", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+
+                approval_workflow_stage_definition_2 = ApprovalWorkflowStageDefinition.objects.create(
+                    approval_workflow_definition=approval_workflow.approval_workflow_definition,
+                    sequence=200,
+                    name="Approval Workflow Stage Definition 2",
+                    min_approvers=1,
+                    denial_message="Stage 2 Denial Message",
+                    approver_group=self.approver_group_1,
+                )
+                approval_workflow_stage_2 = ApprovalWorkflowStage.objects.create(
+                    approval_workflow=approval_workflow,
+                    approval_workflow_stage_definition=approval_workflow_stage_definition_2,
+                    state=ApprovalWorkflowStateChoices.PENDING,
+                )
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.APPROVED)
+                self.assertEqual(approval_workflow_stage_2.approval_workflow_stage_responses.count(), 0)
+                self.assertEqual(approval_workflow_stage_2.state, ApprovalWorkflowStateChoices.PENDING)
+
+                # approval workflow should still be in pending state because user already approve 1 stage but are 2
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.PENDING)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertIsNone(scheduled_job.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approve_with_comment_approval_workflow_stage_in_approval_workflow_with_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-approve", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+
+                data = {"comments": "LGTM"}
+                response = self.client.post(url, data=data, format="json", **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(
+                    approval_workflow_stage.approval_workflow_stage_responses.first().comments, data["comments"]
+                )
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.APPROVED)
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.APPROVED)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertEqual(scheduled_job.decision_date, approval_workflow.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_in_approval_workflow_with_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-deny", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.first().comments, "")
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.DENIED)
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.DENIED)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertEqual(scheduled_job.decision_date, approval_workflow.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_approval_workflow_stage_in_approval_workflow_with_more_than_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-deny", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+
+                approval_workflow_stage_definition_2 = ApprovalWorkflowStageDefinition.objects.create(
+                    approval_workflow_definition=approval_workflow.approval_workflow_definition,
+                    sequence=200,
+                    name="Approval Workflow Stage Definition 2",
+                    min_approvers=1,
+                    denial_message="Stage 2 Denial Message",
+                    approver_group=self.approver_group_1,
+                )
+                approval_workflow_stage_2 = ApprovalWorkflowStage.objects.create(
+                    approval_workflow=approval_workflow,
+                    approval_workflow_stage_definition=approval_workflow_stage_definition_2,
+                    state=ApprovalWorkflowStateChoices.PENDING,
+                )
+                response = self.client.post(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.DENIED)
+                self.assertEqual(approval_workflow_stage_2.approval_workflow_stage_responses.count(), 0)
+                self.assertEqual(approval_workflow_stage_2.state, ApprovalWorkflowStateChoices.PENDING)
+
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.DENIED)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertEqual(scheduled_job.decision_date, approval_workflow.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_deny_with_approval_workflow_stage_in_approval_workflow_with_one_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                approval_workflow = case["workflow"]
+                approval_workflow_stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-deny", kwargs={"pk": case["stage"].pk})
+                self.add_permissions("extras.change_approvalworkflowstage", f"extras.change_{content_type.lower()}")
+                self.user.groups.add(self.approver_group_1)
+                data = {"comments": "Denied comment"}
+                response = self.client.post(url, data=data, format="json", **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                approval_workflow.refresh_from_db()
+                approval_workflow_stage.refresh_from_db()
+                self.assertEqual(approval_workflow_stage.approval_workflow_stage_responses.count(), 1)
+                self.assertEqual(
+                    approval_workflow_stage.approval_workflow_stage_responses.first().comments, data["comments"]
+                )
+                self.assertEqual(approval_workflow_stage.state, ApprovalWorkflowStateChoices.DENIED)
+                self.assertEqual(approval_workflow.current_state, ApprovalWorkflowStateChoices.DENIED)
+
+                scheduled_job = case["object"]
+                scheduled_job.refresh_from_db()
+                self.assertEqual(scheduled_job.decision_date, approval_workflow.decision_date)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approval_workflow_stage_comment_without_permission(self):
+        for case in self.approval_workflow_content_type_cases:
+            with self.subTest(case=case["content_type"]):
+                stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-comment", kwargs={"pk": stage.pk})
+                data = {"comments": "Test comment without permission."}
+                response = self.client.post(url, data=data, format="json", **self.header)
+                self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
+                self.assertEqual(stage.approval_workflow_stage_responses.count(), 0)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approval_workflow_stage_add_comment_missing_or_empty(self):
+        for case in self.approval_workflow_content_type_cases:
+            with self.subTest(case=case["content_type"]):
+                stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-comment", kwargs={"pk": stage.pk})
+                self.add_permissions("extras.change_approvalworkflowstage")
+
+                # Try both missing and empty comment values
+                for payload in [{}, {"comments": ""}]:
+                    response = self.client.post(url, data=payload, format="json", **self.header)
+                    self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
+                    self.assertIn("detail", response.data)
+                    self.assertEqual(response.data["detail"], "Comment cannot be empty.")
+                    self.assertEqual(stage.approval_workflow_stage_responses.count(), 0)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approval_workflow_stage_add_comment_to_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-comment", kwargs={"pk": stage.pk})
+                self.add_permissions("extras.change_approvalworkflowstage")
+                # remove user from approver group
+                self.user.groups.remove(self.approver_group_1)
+
+                data = {"comments": "This is a test comment."}
+                response = self.client.post(url, data=data, format="json", **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                stage.refresh_from_db()
+                self.assertEqual(stage.approval_workflow_stage_responses.count(), 1)
+
+                response_obj = stage.approval_workflow_stage_responses.first()
+                self.assertEqual(response_obj.comments, "This is a test comment.")
+                self.assertEqual(response_obj.user, self.user)
+                self.assertEqual(response_obj.state, stage.state)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approval_workflow_stage_add_more_comment_to_stage(self):
+        for case in self.approval_workflow_content_type_cases:
+            content_type = case["content_type"]
+            with self.subTest(case=content_type):
+                stage = case["stage"]
+                url = reverse("extras-api:approvalworkflowstage-comment", kwargs={"pk": stage.pk})
+                self.add_permissions("extras.change_approvalworkflowstage")
+                # Ensure user is not in approver group (just commenting)
+                self.user.groups.remove(self.approver_group_1)
+                ApprovalWorkflowStageResponse.objects.create(
+                    approval_workflow_stage=stage, user=self.user, state=stage.state, comments="First comment"
+                )
+                data = {"comments": "This is a test comment."}
+                response = self.client.post(url, data=data, format="json", **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+
+                stage.refresh_from_db()
+                self.assertEqual(stage.approval_workflow_stage_responses.count(), 2)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    def test_approval_workflow_stage_pending_my_approvals(self):
+        base_url = reverse("extras-api:approvalworkflowstage-list")
+        query_params = urlencode({"pending_my_approvals": "true"})
+        url = f"{base_url}?{query_params}"
+        self.add_permissions(
+            "extras.view_approvalworkflowstage",
+        )
+        self.user.groups.add(self.approver_group_1)
+
+        # Set all stages as approved except for the first one.
+        for stage in ApprovalWorkflowStage.objects.all():
+            if stage.approval_workflow != self.approval_workflows[0]:
+                ApprovalWorkflowStageResponse.objects.create(
+                    approval_workflow_stage=stage, user=self.user, state=ApprovalWorkflowStateChoices.APPROVED
+                )
+                stage.state = ApprovalWorkflowStateChoices.APPROVED
+                stage.save()
+
+        self.assertEqual(ApprovalWorkflowStage.objects.filter(state=ApprovalWorkflowStateChoices.APPROVED).count(), 2)
+
+        # Create 1 pending stage, but in different approver group
+        approver_group_2 = Group.objects.create(name="Approver Group 2")
+        approval_workflow_stage_definition_approver_group_2 = ApprovalWorkflowStageDefinition.objects.create(
+            approval_workflow_definition=self.approval_workflow_definitions[3],
+            sequence=100,
+            name="Test Approval Workflow Stage 1 Definition",
+            min_approvers=1,
+            denial_message="Stage Denial Message",
+            approver_group=approver_group_2,
+        )
+        ApprovalWorkflowStage.objects.create(
+            approval_workflow=self.approval_workflows[3],
+            approval_workflow_stage_definition=approval_workflow_stage_definition_approver_group_2,
+            state=ApprovalWorkflowStateChoices.PENDING,
+        )
+
+        # user is approver in 2 approval workflows, but second one is approved
+        self.assertTrue(self.approval_workflow_stage_definitions[1].approver_group in self.user.groups.all())
+        # user is not an approver
+        self.assertTrue(
+            approval_workflow_stage_definition_approver_group_2.approver_group not in self.user.groups.all()
+        )
+
+        test_cases = [
+            ("true", 1),  # Should list pending approvals for specific user in this case 1
+            ("false", 2),  # Should list done approvals for specific user
+            (None, 4),  # Should return all visible stages (no filter applied)
+        ]
+
+        for param_value, expected_count in test_cases:
+            with self.subTest(pending_my_approvals=param_value):
+                if param_value is not None:
+                    query_params = urlencode({"pending_my_approvals": param_value})
+                    url = f"{base_url}?{query_params}"
+                else:
+                    url = base_url  # no filter param
+
+                response = self.client.get(url, **self.header)
+                self.assertHttpStatus(response, status.HTTP_200_OK)
+                self.assertEqual(len(response.data["results"]), expected_count)
+
+                if param_value == "true":
+                    # Confirm correct object is returned
+                    self.assertEqual(response.data["results"][0]["id"], str(self.approval_workflow_stages[0].id))
+
+
 #
 #  Computed Fields
 #
@@ -406,6 +986,9 @@ class ContactTest(APIViewTestCases.APIViewTestCase):
     bulk_update_data = {
         "address": "Carnegie Hall, New York, NY",
     }
+    validation_excluded_fields = [
+        "teams",  # M2M field, excluded by default
+    ]
 
     @classmethod
     def setUpTestData(cls):
@@ -1213,6 +1796,7 @@ class GitRepositoryTest(APIViewTestCases.APIViewTestCase):
         self.assertEqual(response.data["message"], f"Repository {self.repos[0].name} sync job added to queue.")
         self.assertIsInstance(response.data["job_result"], dict)
 
+    @tag("example_app")
     def test_create_with_app_provided_contents(self):
         """Test that `provided_contents` published by an App works."""
         self.add_permissions("extras.add_gitrepository")
@@ -1278,12 +1862,12 @@ class GraphQLQueryTest(APIViewTestCases.APIViewTestCase):
         url = reverse("extras-api:graphqlquery-run", kwargs={"pk": self.graphqlqueries[0].pk})
         response = self.client.post(url, **self.header)
         self.assertHttpStatus(response, status.HTTP_200_OK)
-        self.assertEqual({"data": {"locations": []}}, response.data)
+        self.assertEqual({"data": {"locations": []}, "errors": None}, response.data)
 
         url = reverse("extras-api:graphqlquery-run", kwargs={"pk": self.graphqlqueries[2].pk})
         response = self.client.post(url, **self.header)
         self.assertHttpStatus(response, status.HTTP_200_OK)
-        self.assertEqual({"data": {"devices": []}}, response.data)
+        self.assertEqual({"data": {"devices": []}, "errors": None}, response.data)
 
 
 # TODO(Glenn): Standardize to APIViewTestCase (needs create & update tests)
@@ -1358,6 +1942,14 @@ class JobTest(
         self.job_model.enabled = True
         self.job_model.validated_save()
 
+        device_role = Role.objects.get_for_model(Device).first()
+        self.job_proper_data = {
+            "var1": "FooBar",
+            "var2": 123,
+            "var3": False,
+            "var4": device_role.pk,
+        }
+
     @classmethod
     def setUpTestData(cls):
         cls.update_data = {
@@ -1369,8 +1961,6 @@ class JobTest(
             "description_override": True,
             "description": "This is an overridden description.",
             "enabled": True,
-            "approval_required_override": True,
-            "approval_required": True,
             "dryrun_default_override": True,
             "dryrun_default": True,
             "hidden_override": True,
@@ -1384,8 +1974,6 @@ class JobTest(
         }
         cls.bulk_update_data = {
             "enabled": True,
-            "approval_required_override": True,
-            "approval_required": True,
             "has_sensitive_variables": False,
             "has_sensitive_variables_override": True,
         }
@@ -1460,50 +2048,6 @@ class JobTest(
             {"name": "var4", "type": "ObjectVar", "required": True, "model": "extras.role"},
         )
 
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_update_job_with_sensitive_variables_set_approval_required_to_true(self):
-        job_model = Job.objects.get_for_class_path("api_test_job.APITestJob")
-        job_model.has_sensitive_variables = True
-        job_model.has_sensitive_variables_override = True
-        job_model.validated_save()
-
-        url = self._get_detail_url(job_model)
-        data = {
-            "approval_required_override": True,
-            "approval_required": True,
-        }
-
-        self.add_permissions("extras.change_job")
-
-        response = self.client.patch(url, data, format="json", **self.header)
-        self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
-        self.assertEqual(
-            response.data["approval_required"][0],
-            "A job with sensitive variables cannot also be marked as requiring approval",
-        )
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_update_approval_required_job_set_has_sensitive_variables_to_true(self):
-        job_model = Job.objects.get_for_class_path("api_test_job.APITestJob")
-        job_model.approval_required = True
-        job_model.approval_required_override = True
-        job_model.validated_save()
-
-        url = self._get_detail_url(job_model)
-        data = {
-            "has_sensitive_variables": True,
-            "has_sensitive_variables_override": True,
-        }
-
-        self.add_permissions("extras.change_job")
-
-        response = self.client.patch(url, data, format="json", **self.header)
-        self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
-        self.assertEqual(
-            response.data["has_sensitive_variables"][0],
-            "A job with sensitive variables cannot also be marked as requiring approval",
-        )
-
     @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
     def test_run_job_anonymous_not_permitted(self):
         """The run_job endpoint should NOT allow anonymous users to submit jobs."""
@@ -1672,9 +2216,11 @@ class JobTest(
 
         Assert an immediate schedule that enforces it.
         """
-        # Set approval_required=True
-        self.job_model.approval_required = True
-        self.job_model.save()
+        ApprovalWorkflowDefinition.objects.create(
+            name="Test Approval Workflow Definition 1",
+            model_content_type=ContentType.objects.get_for_model(ScheduledJob),
+            weight=0,
+        )
 
         # Do the stuff.
         mock_get_worker_count.return_value = 1
@@ -1703,7 +2249,7 @@ class JobTest(
         schedule = ScheduledJob.objects.last()
         self.assertIsNotNone(schedule)
         self.assertEqual(schedule.interval, JobExecutionType.TYPE_FUTURE)
-        self.assertEqual(schedule.approval_required, self.job_model.approval_required)
+        self.assertTrue(schedule.approval_required)
         self.assertEqual(schedule.kwargs["var4"], str(device_role.pk))
 
     @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
@@ -1939,21 +2485,27 @@ class JobTest(
             "Unable to schedule job: Job may have sensitive input variables",
         )
 
+    @tag("example_app")
     @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
     @mock.patch("nautobot.extras.api.views.get_worker_count")
-    def test_run_a_job_with_sensitive_variables_and_requires_approval(self, mock_get_worker_count):
+    def test_run_a_job_with_sensitive_variables_when_approval_workflow_defined(self, mock_get_worker_count):
+        ApprovalWorkflowDefinition.objects.create(
+            name="Test Approval Workflow Definition 1",
+            model_content_type=ContentType.objects.get_for_model(ScheduledJob),
+            weight=0,
+        )
+
         mock_get_worker_count.return_value = 1
         self.add_permissions("extras.run_job")
 
         job_model = Job.objects.get(job_class_name="ExampleJob")
         job_model.enabled = True
         job_model.has_sensitive_variables = True
-        job_model.approval_required = True
         job_model.save()
 
         url = reverse("extras-api:job-run", kwargs={"pk": job_model.pk})
         data = {
-            "data": {},
+            "data": {"some_json_data": {"var1": "x"}},
             "schedule": {
                 "interval": "immediately",
                 "name": "test",
@@ -1965,8 +2517,8 @@ class JobTest(
         self.assertEqual(
             response.data[0],
             "Unable to run or schedule job: "
-            "This job is flagged as possibly having sensitive variables but is also flagged as requiring approval."
-            "One of these two flags must be removed before this job can be scheduled or run.",
+            "This job is flagged as possibly having sensitive variables but also has an applicable approval workflow definition."
+            "Modify or remove the approval workflow definition or modify the job to set `has_sensitive_variables` to False.",
         )
 
     @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
@@ -2148,6 +2700,169 @@ class JobTest(
         response = self.client.post(url, data, format="json", **self.header)
         self.assertHttpStatus(response, self.run_success_response_status)
 
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    @mock.patch("nautobot.extras.api.views.get_worker_count")
+    def test_run_job_with_approval_workflow_defined_triggers_approval_workflow(self, mock_get_worker_count):
+        """Test that jobs with approval workflow definition for both immediate and scheduled execution triggers approval workflow."""
+        ApprovalWorkflowDefinition.objects.create(
+            name="Test Approval Workflow Definition 1",
+            model_content_type=ContentType.objects.get_for_model(ScheduledJob),
+            weight=0,
+        )
+
+        mock_get_worker_count.return_value = 1
+        self.add_permissions("extras.run_job")
+        self.add_permissions("extras.view_scheduledjob")
+
+        url = self.get_run_url()
+
+        # Test scenarios
+        test_cases = [
+            {
+                "name": "immediate_execution",
+                "data": {
+                    "data": self.job_proper_data,
+                    # schedule is omitted - should create immediate schedule
+                },
+                "expected_interval": JobExecutionType.TYPE_FUTURE,
+                "expected_name": None,
+            },
+            {
+                "name": "scheduled_execution",
+                "data": {
+                    "data": self.job_proper_data,
+                    "schedule": {
+                        "interval": JobExecutionType.TYPE_FUTURE,
+                        "name": "test_scheduled_job",
+                        "start_time": (now() + timedelta(minutes=1)).isoformat(),
+                    },
+                },
+                "expected_interval": JobExecutionType.TYPE_FUTURE,
+                "expected_name": "test_scheduled_job",
+            },
+        ]
+
+        for test_case in test_cases:
+            with self.subTest(execution_type=test_case["name"]):
+                # Clear any existing scheduled jobs from previous subtest
+                ScheduledJob.objects.all().delete()
+                JobResult.objects.filter(name=self.job_model.name).delete()
+
+                response = self.client.post(url, test_case["data"], format="json", **self.header)
+                self.assertHttpStatus(response, self.run_success_response_status)
+
+                # Assert that a JobResult was NOT created (job is pending approval)
+                self.assertFalse(JobResult.objects.filter(name=self.job_model.name).exists())
+
+                # Assert that a ScheduledJob was created and has approval workflow
+                scheduled_job = ScheduledJob.objects.last()
+                self.assertIsNotNone(scheduled_job)
+                self.assertEqual(scheduled_job.interval, test_case["expected_interval"])
+
+                if test_case["expected_name"]:
+                    self.assertEqual(scheduled_job.name, test_case["expected_name"])
+
+                self.assertTrue(scheduled_job.associated_approval_workflows.exists())
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    @mock.patch("nautobot.extras.api.views.get_worker_count")
+    def test_run_immediate_job_with_no_approval_workflow_defined(self, mock_get_worker_count):
+        """
+        Run an immediate job with no approval workflow defined.
+        Should succeed and execute immediately.
+        """
+        mock_get_worker_count.return_value = 1
+        self.add_permissions("extras.run_job")
+        self.add_permissions("extras.view_jobresult")
+
+        data = {
+            "data": self.job_proper_data,
+            # schedule is omitted - should create immediate schedule
+        }
+
+        count_scheduled_job = ScheduledJob.objects.count()
+
+        url = self.get_run_url()
+        response = self.client.post(url, data, format="json", **self.header)
+        self.assertHttpStatus(response, self.run_success_response_status)
+
+        # Assert no ScheduledJob was created (job ran immediately)
+        self.assertEqual(ScheduledJob.objects.count(), count_scheduled_job)
+
+        # Assert JobResult was created
+        result = JobResult.objects.latest()
+        self.assertEqual(result.name, self.job_model.name)
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    @mock.patch("nautobot.extras.api.views.get_worker_count")
+    def test_scheduled_job_triggers_approval_workflow_if_defined(self, mock_get_worker_count):
+        """
+        Run a scheduled job with approval workflow defined.
+        Should trigger approval workflow for scheduled jobs.
+        """
+        mock_get_worker_count.return_value = 1
+        self.add_permissions("extras.run_job")
+        self.add_permissions("extras.view_scheduledjob")
+
+        ApprovalWorkflowDefinition.objects.create(
+            name="Approval Definition",
+            model_content_type=ContentType.objects.get_for_model(ScheduledJob),
+            weight=0,
+        )
+
+        start_time = now() + timedelta(minutes=1)
+        data = {
+            "data": self.job_proper_data,
+            "schedule": {
+                "interval": JobExecutionType.TYPE_FUTURE,
+                "name": "test_scheduled_job",
+                "start_time": start_time.isoformat(),
+            },
+        }
+
+        url = self.get_run_url()
+        response = self.client.post(url, data, format="json", **self.header)
+        self.assertHttpStatus(response, self.run_success_response_status)
+
+        # Assert that a ScheduledJob was created and has approval workflow
+        scheduled_job = ScheduledJob.objects.last()
+        self.assertIsNotNone(scheduled_job)
+        self.assertEqual(scheduled_job.interval, JobExecutionType.TYPE_FUTURE)
+        self.assertEqual(scheduled_job.name, "test_scheduled_job")
+        self.assertTrue(scheduled_job.associated_approval_workflows.exists())
+
+    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
+    @mock.patch("nautobot.extras.api.views.get_worker_count")
+    def test_run_scheduled_job_with_no_approval_workflow_defined(self, mock_get_worker_count):
+        """
+        Run a scheduled job with no approval workflow defined.
+        Should succeed and create scheduled job without approval workflow.
+        """
+        mock_get_worker_count.return_value = 1
+        self.add_permissions("extras.run_job")
+        self.add_permissions("extras.view_scheduledjob")
+
+        start_time = now() + timedelta(minutes=1)
+        data = {
+            "data": self.job_proper_data,
+            "schedule": {
+                "interval": JobExecutionType.TYPE_FUTURE,
+                "name": "test_scheduled_job",
+                "start_time": start_time.isoformat(),
+            },
+        }
+
+        url = self.get_run_url()
+        response = self.client.post(url, data, format="json", **self.header)
+        self.assertHttpStatus(response, self.run_success_response_status)
+
+        # Assert that a ScheduledJob was created without approval workflow
+        scheduled_job = ScheduledJob.objects.last()
+        self.assertIsNotNone(scheduled_job)
+        self.assertEqual(scheduled_job.interval, JobExecutionType.TYPE_FUTURE)
+        self.assertEqual(scheduled_job.name, "test_scheduled_job")
+        self.assertFalse(scheduled_job.associated_approval_workflows.exists())
+
     # TODO: Either improve test base or or write a more specific test for this model.
     @skip("Job has a `name` property but grouping is also used to sort Jobs")
     def test_list_objects_ascending_ordered(self):
@@ -2605,180 +3320,6 @@ class ScheduledJobTest(
         )
 
 
-class JobApprovalTest(APITestCase):
-    @classmethod
-    def setUpTestData(cls):
-        cls.additional_user = User.objects.create(username="user1", is_active=True)
-        cls.job_model = Job.objects.get_for_class_path("pass_job.TestPassJob")
-        cls.job_model.enabled = True
-        cls.job_model.save()
-        cls.scheduled_job = ScheduledJob.objects.create(
-            name="test pass",
-            task="pass_job.TestPassJob",
-            job_model=cls.job_model,
-            interval=JobExecutionType.TYPE_IMMEDIATELY,
-            user=cls.additional_user,
-            approval_required=True,
-            start_time=now(),
-        )
-        cls.dryrun_job_model = Job.objects.get_for_class_path("dry_run.TestDryRun")
-        cls.dryrun_job_model.enabled = True
-        cls.dryrun_job_model.save()
-        cls.dryrun_scheduled_job = ScheduledJob.objects.create(
-            name="test dryrun",
-            task="dry_run.TestDryRun",
-            job_model=cls.dryrun_job_model,
-            kwargs={"value": 1},
-            interval=JobExecutionType.TYPE_IMMEDIATELY,
-            user=cls.additional_user,
-            approval_required=True,
-            start_time=now(),
-        )
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_anonymous(self):
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_without_permission(self):
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": self.scheduled_job.pk})
-        with disable_warnings("django.request"):
-            response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_without_approve_job_permission(self):
-        self.add_permissions("extras.view_scheduledjob", "extras.change_scheduledjob")
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_without_change_scheduledjob_permission(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob")
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_same_user(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob", "extras.change_scheduledjob")
-        scheduled_job = ScheduledJob.objects.create(
-            name="test",
-            task="pass_job.TestPassJob",
-            job_model=self.job_model,
-            interval=JobExecutionType.TYPE_IMMEDIATELY,
-            user=self.user,
-            approval_required=True,
-            start_time=now(),
-        )
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob", "extras.change_scheduledjob")
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_in_past(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob", "extras.change_scheduledjob")
-        scheduled_job = ScheduledJob.objects.create(
-            name="test",
-            task="pass_job.TestPassJob",
-            job_model=self.job_model,
-            interval=JobExecutionType.TYPE_FUTURE,
-            one_off=True,
-            user=self.additional_user,
-            approval_required=True,
-            start_time=now(),
-        )
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_approve_job_in_past_force(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob", "extras.change_scheduledjob")
-        scheduled_job = ScheduledJob.objects.create(
-            name="test",
-            task="pass_job.TestPassJob",
-            job_model=self.job_model,
-            interval=JobExecutionType.TYPE_FUTURE,
-            one_off=True,
-            user=self.additional_user,
-            approval_required=True,
-            start_time=now(),
-        )
-        url = reverse("extras-api:scheduledjob-approve", kwargs={"pk": scheduled_job.pk})
-        response = self.client.post(url + "?force=true", **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_deny_job_without_permission(self):
-        url = reverse("extras-api:scheduledjob-deny", kwargs={"pk": self.scheduled_job.pk})
-        with disable_warnings("django.request"):
-            response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_deny_job_without_approve_job_permission(self):
-        self.add_permissions("extras.view_scheduledjob", "extras.delete_scheduledjob")
-        url = reverse("extras-api:scheduledjob-deny", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_deny_job_without_delete_scheduledjob_permission(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob")
-        url = reverse("extras-api:scheduledjob-deny", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_deny_job(self):
-        self.add_permissions("extras.approve_job", "extras.view_scheduledjob", "extras.delete_scheduledjob")
-        url = reverse("extras-api:scheduledjob-deny", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-        self.assertIsNone(ScheduledJob.objects.filter(pk=self.scheduled_job.pk).first())
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=[])
-    def test_dry_run_job_without_permission(self):
-        url = reverse("extras-api:scheduledjob-dry-run", kwargs={"pk": self.dryrun_scheduled_job.pk})
-        with disable_warnings("django.request"):
-            response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_dry_run_job_without_run_job_permission(self):
-        self.add_permissions("extras.view_scheduledjob")
-        url = reverse("extras-api:scheduledjob-dry-run", kwargs={"pk": self.dryrun_scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_403_FORBIDDEN)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_dry_run_job(self):
-        self.add_permissions("extras.run_job", "extras.view_scheduledjob")
-        url = reverse("extras-api:scheduledjob-dry-run", kwargs={"pk": self.dryrun_scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_200_OK)
-        # The below fails because JobResult.task_kwargs doesn't get set until *after* the task begins executing.
-        # self.assertEqual(response.data["task_kwargs"], {"dryrun": True, "value": 1}, response.data)
-
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
-    def test_dry_run_not_supported(self):
-        self.add_permissions("extras.run_job", "extras.view_scheduledjob")
-        url = reverse("extras-api:scheduledjob-dry-run", kwargs={"pk": self.scheduled_job.pk})
-        response = self.client.post(url, **self.header)
-        self.assertHttpStatus(response, status.HTTP_405_METHOD_NOT_ALLOWED)
-
-
 class MetadataTypeTest(APIViewTestCases.APIViewTestCase):
     model = MetadataType
     choices_fields = ["data_type"]
@@ -4209,9 +4750,9 @@ class TagTest(APIViewTestCases.APIViewTestCase):
         data = {**self.create_data[0], "content_types": [Manufacturer._meta.label_lower]}
         response = self.client.post(self._get_list_url(), data, format="json", **self.header)
 
-        tag = Tag.objects.filter(name=data["name"])
+        tags = Tag.objects.filter(name=data["name"])
         self.assertHttpStatus(response, 400)
-        self.assertFalse(tag.exists())
+        self.assertFalse(tags.exists())
         self.assertIn(f"Invalid content type: {Manufacturer._meta.label_lower}", response.data["content_types"])
 
     def test_create_tags_without_content_types(self):
@@ -4248,9 +4789,9 @@ class TagTest(APIViewTestCases.APIViewTestCase):
         """Test updating a tag without changing its content-types."""
         self.add_permissions("extras.change_tag")
 
-        tag = Tag.objects.exclude(content_types=ContentType.objects.get_for_model(Location)).first()
-        tag_content_types = list(tag.content_types.all())
-        url = self._get_detail_url(tag)
+        tag_instance = Tag.objects.exclude(content_types=ContentType.objects.get_for_model(Location)).first()
+        tag_content_types = list(tag_instance.content_types.all())
+        url = self._get_detail_url(tag_instance)
         data = {"color": ColorChoices.COLOR_LIME}
 
         response = self.client.patch(url, data, format="json", **self.header)
@@ -4260,9 +4801,9 @@ class TagTest(APIViewTestCases.APIViewTestCase):
             sorted(response.data["content_types"]), sorted([f"{ct.app_label}.{ct.model}" for ct in tag_content_types])
         )
 
-        tag.refresh_from_db()
-        self.assertEqual(tag.color, ColorChoices.COLOR_LIME)
-        self.assertEqual(list(tag.content_types.all()), tag_content_types)
+        tag_instance.refresh_from_db()
+        self.assertEqual(tag_instance.color, ColorChoices.COLOR_LIME)
+        self.assertEqual(list(tag_instance.content_types.all()), tag_content_types)
 
 
 #
@@ -4275,6 +4816,9 @@ class TeamTest(APIViewTestCases.APIViewTestCase):
     bulk_update_data = {
         "address": "Carnegie Hall, New York, NY",
     }
+    validation_excluded_fields = [
+        "contacts",  # M2M field, excluded by default
+    ]
 
     @classmethod
     def setUpTestData(cls):