nautobot 3.0.0rc1__py3-none-any.whl → 3.0.1__py3-none-any.whl

nautobot/core/jobs/bulk_actions.py

@@ -31,11 +31,14 @@ class BulkEditObjects(Job):
         model=ContentType,
         description="Type of objects to update",
     )
+    # The names of the job inputs must match the parameters of `key_params` and get_bulk_queryset_from_view
+    # This may be confusing for the saved_view_id since the job input is an ObjectVar but the key_param is a PK
+    # But it is the lesser of two evils.
     form_data = JSONVar(description="BulkEditForm data")
     pk_list = JSONVar(description="List of objects pks to edit", required=False)
     edit_all = BooleanVar(description="Bulk Edit all object / all filtered objects", required=False)
     filter_query_params = JSONVar(label="Filter Query Params", required=False)
-    saved_view = ObjectVar(model=SavedView, required=False)
+    saved_view_id = ObjectVar(model=SavedView, required=False)
 
     class Meta:
         name = "Bulk Edit Objects"
@@ -127,9 +130,9 @@ class BulkEditObjects(Job):
         raise RunJobTaskFailed("Bulk Edit not fully successful, see logs")
 
     def run(  # pylint: disable=arguments-differ
-        self, *, content_type, form_data, pk_list=None, edit_all=False, filter_query_params=None, saved_view=None
+        self, *, content_type, form_data, pk_list=None, edit_all=False, filter_query_params=None, saved_view_id=None
     ):
-        saved_view_id = saved_view.pk if saved_view is not None else None
+        saved_view_id = saved_view_id.pk if saved_view_id is not None else None
         if not filter_query_params:
             filter_query_params = {}
 
@@ -186,10 +189,13 @@ class BulkDeleteObjects(Job):
         model=ContentType,
         description="Type of objects to delete",
     )
+    # The names of the job inputs must match the parameters of `key_params` and get_bulk_queryset_from_view
+    # This may be confusing for the saved_view_id since the job input is an ObjectVar but the key_param is a PK
+    # But it is the lesser of two evils.
     pk_list = JSONVar(description="List of objects pks to delete", required=False)
     delete_all = BooleanVar(description="Delete all (filtered) objects instead of a list of PKs", required=False)
     filter_query_params = JSONVar(label="Filter Query Params", required=False)
-    saved_view = ObjectVar(model=SavedView, required=False)
+    saved_view_id = ObjectVar(model=SavedView, required=False)
 
     class Meta:
         name = "Bulk Delete Objects"
@@ -200,9 +206,9 @@ class BulkDeleteObjects(Job):
         hidden = True
 
     def run(  # pylint: disable=arguments-differ
-        self, *, content_type, pk_list=None, delete_all=False, filter_query_params=None, saved_view=None
+        self, *, content_type, pk_list=None, delete_all=False, filter_query_params=None, saved_view_id=None
     ):
-        saved_view_id = saved_view.pk if saved_view is not None else None
+        saved_view_id = saved_view_id.pk if saved_view_id is not None else None
         if not filter_query_params:
             filter_query_params = {}
         if not self.user.has_perm(f"{content_type.app_label}.delete_{content_type.model}"):

nautobot/core/jobs/cleanup.py

@@ -1,7 +1,7 @@
 from datetime import timedelta
 
 from django.core.exceptions import PermissionDenied
-from django.db.models import CASCADE
+from django.db.models import CASCADE, PROTECT
 from django.db.models.signals import pre_delete
 from django.utils import timezone
 
@@ -67,6 +67,18 @@ class LogsCleanup(Job):
                 cascade_queryset = related_model.objects.filter(**{f"{related_field_name}__id__in": queryset})
                 if cascade_queryset.exists():
                     self.recursive_delete_with_cascade(cascade_queryset, deletion_summary)
+            elif related_object.on_delete is PROTECT:
+                self.logger.warning(
+                    "Skipping %s records with a protected relationship to %s."
+                    " You must delete the related object(s) first.",
+                    queryset.model._meta.label,
+                    related_object.related_model._meta.label,
+                )
+                items_to_exclude = related_object.related_model.objects.values_list(
+                    related_object.field.name, flat=True
+                )
+                queryset = queryset.exclude(id__in=items_to_exclude)
+                deletion_summary.update({related_object.related_model._meta.label: 0})
 
         genericrelation_related_fields = [
             field for field in queryset.model._meta.private_fields if hasattr(field, "bulk_related_objects")

nautobot/core/settings.py

@@ -959,6 +959,19 @@ CELERY_BEAT_HEARTBEAT_FILE = os.getenv(
     os.path.join(tempfile.gettempdir(), "nautobot_celery_beat_heartbeat"),
 )
 
+# Celery Worker heartbeat file path - will be touched by each worker process as a proof-of-health.
+CELERY_WORKER_HEARTBEAT_FILE = os.getenv(
+    "NAUTOBOT_CELERY_WORKER_HEARTBEAT_FILE", os.path.join(tempfile.gettempdir(), "nautobot_celery_worker_heartbeat")
+)
+
+# Celery Worker readiness file path - will be created by each worker process once it's ready to accept tasks.
+CELERY_WORKER_READINESS_FILE = os.getenv(
+    "NAUTOBOT_CELERY_WORKER_READINESS_FILE", os.path.join(tempfile.gettempdir(), "nautobot_celery_worker_ready")
+)
+
+# Celery health probes as files - if enabled, Celery worker health probes will be implemented as files
+CELERY_HEALTH_PROBES_AS_FILES = is_truthy(os.getenv("NAUTOBOT_CELERY_HEALTH_PROBES_AS_FILES", "False"))
+
 # Celery broker URL used to tell workers where queues are located
 CELERY_BROKER_URL = os.getenv("NAUTOBOT_CELERY_BROKER_URL", parse_redis_connection(redis_database=0))
 

nautobot/core/settings.yaml

@@ -383,6 +383,14 @@ properties:
     see_also:
       "Celery documentation": "https://docs.celeryq.dev/en/stable/userguide/configuration.html#std-setting-broker_use_ssl"
     type: "object"
+  CELERY_HEALTH_PROBES_AS_FILES:
+    default: false
+    description: "Optional configuration for Celery workers to use file-based health probes."
+    environment_variable: "NAUTOBOT_CELERY_HEALTH_PROBES_AS_FILES"
+    see_also:
+      "`CELERY_WORKER_HEARTBEAT_FILE`": "#celery_worker_heartbeat_file"
+      "`CELERY_WORKER_READINESS_FILE`": "#celery_worker_readiness_file"
+    type: "boolean"
   CELERY_REDIS_BACKEND_USE_SSL:
     default: false
     description: "Optional configuration for Celery to use custom SSL certificates to connect to Redis."
@@ -425,6 +433,13 @@ properties:
     see_also:
       "`CELERY_TASK_SOFT_TIME_LIMIT`": "#celery_task_soft_time_limit"
     type: "integer"
+  CELERY_WORKER_HEARTBEAT_FILE:
+    default: "/tmp/nautobot_celery_worker_heartbeat"
+    description: "A file touched by the Celery worker every second while it is alive, suitable for health checks."
+    environment_variable: "NAUTOBOT_CELERY_WORKER_HEARTBEAT_FILE"
+    see_also:
+      "`CELERY_HEALTH_PROBES_AS_FILES`": "#celery_health_probes_as_files"
+    type: "string"
   CELERY_WORKER_PREFETCH_MULTIPLIER:
     default: 4
     description: "How many tasks a worker is allowed to reserve for its own consumption and execution."
@@ -453,6 +468,13 @@ properties:
       type: "integer"
     type: "array"
     version_added: "1.5.10"
+  CELERY_WORKER_READINESS_FILE:
+    default: "/tmp/nautobot_celery_worker_ready"
+    description: "A file touched by the Celery worker when it starts and is ready to accept tasks."
+    environment_variable: "NAUTOBOT_CELERY_WORKER_READINESS_FILE"
+    see_also:
+      "`CELERY_HEALTH_PROBES_AS_FILES`": "#celery_health_probes_as_files"
+    type: "string"
   CELERY_WORKER_REDIRECT_STDOUTS:
     default: true
     description: "If enabled stdout and stderr of running jobs will be redirected to the task logger."

nautobot/core/settings_funcs.py

@@ -123,7 +123,17 @@ def setup_structlog_logging(
         return
 
     django_apps.append("django_structlog")
-    django_middleware.append("django_structlog.middlewares.RequestMiddleware")
+
+    # Insert the middleware ahead of django_prometheus.middleware.PrometheusAfterMiddleware, which consumes the request.
+    # If that middleware is not present, append it at the end.
+    django_structlog_middleware = "django_structlog.middlewares.RequestMiddleware"
+    try:
+        index_of_prometheus_after_middleware = django_middleware.index(
+            "django_prometheus.middleware.PrometheusAfterMiddleware"
+        )
+        django_middleware.insert(index_of_prometheus_after_middleware, django_structlog_middleware)
+    except ValueError:
+        django_middleware.append(django_structlog_middleware)
 
     processors = (
         # Add the log level to the event dict under the level key.

nautobot/core/tables.py

@@ -496,7 +496,7 @@ class ApprovalButtonsColumn(django_tables2.TemplateColumn):
         return_url_extra (Optional[str]): String to append to the return URL (e.g. for specifying a tab)
     """
 
-    buttons = ("detail", "changelog", "approve", "deny")
+    buttons = ("detail", "changelog", "comment", "approve", "deny")
     attrs = {"td": {"class": "d-print-none text-end text-nowrap"}}
     template_name = "extras/inc/approval_buttons_column.html"
 
@@ -511,6 +511,7 @@ class ApprovalButtonsColumn(django_tables2.TemplateColumn):
         app_label = model._meta.app_label
         changelog_route = get_route_for_model(model, "changelog")
         approval_route = "extras:approvalworkflowstage_approve"
+        comment_route = "extras:approvalworkflowstage_comment"
         deny_route = "extras:approvalworkflowstage_deny"
 
         super().__init__(template_name=self.template_name, *args, **kwargs)
@@ -521,11 +522,28 @@ class ApprovalButtonsColumn(django_tables2.TemplateColumn):
                 "return_url_extra": return_url_extra,
                 "changelog_route": changelog_route,
                 "approval_route": approval_route,
+                "comment_route": comment_route,
                 "deny_route": deny_route,
                 "have_permission": f"perms.{app_label}.change_{model._meta.model_name}",
             }
         )
 
+    def render(self, record, table, value, bound_column, **kwargs):
+        active_buttons = self.extra_context.get("buttons", self.buttons)
+        needs_approval_check = "approve" in active_buttons or "deny" in active_buttons
+
+        can_approve = False
+
+        request = table.context.get("request")
+        if needs_approval_check and request and request.user:
+            can_approve = (
+                request.user.is_superuser
+                or record.approval_workflow_stage_definition.approver_group.user_set.filter(id=request.user.id).exists()
+            )
+
+        self.extra_context["can_approve"] = can_approve
+        return super().render(record, table, value, bound_column, **kwargs)
+
     def header(self):  # pylint: disable=invalid-overridden-method
         return ""
 

nautobot/core/templates/components/panel/body_wrapper_generic_table.html

@@ -1,3 +1,3 @@
-<table class="collapse show table table-hover card-body"{% if body_id %} id="{{ body_id }}"{% endif %}>
+<table class="collapse show table table-hover"{% if body_id %} id="{{ body_id }}"{% endif %}>
     {{ body_content }}
 </table>

nautobot/core/templates/components/panel/header_extra_content_table.html

@@ -2,10 +2,16 @@
 
 <strong>{{ body_content_table_verbose_name_plural|bettertitle }}</strong>
 {% if body_content_table_list_url %}
-    <a href="{{ body_content_table_list_url }}" class="badge bg-primary">{% if badge_count_override %}{{ badge_count_override }}{% else %}{{ body_content_table.rows|length }}{% endif %}</a>
-{% elif body_content_table or badge_count_override %}
+    <a href="{{ body_content_table_list_url }}" class="badge bg-primary">
+        {% if badge_count_override is not none %}
+            {{ badge_count_override }}
+        {% else %}
+            {{ body_content_table.rows|length }}
+        {% endif %}
+    </a>
+{% elif body_content_table or badge_count_override is not none %}
     <span class="badge bg-secondary">
-        {% if badge_count_override %}
+        {% if badge_count_override is not none %}
             {{ badge_count_override }}
         {% else %}
             {{ body_content_table.rows|length }}

nautobot/core/templates/generic/object_create.html

@@ -5,7 +5,7 @@
 {% block title %}{% if editing %}Editing {{ obj_type }} {{ obj }}{% else %}Add a new {{ obj_type }}{% endif %}{% endblock %}
 
 {% block content %}
-    <form action="" method="post" enctype="multipart/form-data" class="h-100 vstack">
+    <form id="nb-create-form" action="" method="post" enctype="multipart/form-data" class="h-100 vstack">
         {% csrf_token %}
         {% for field in form.hidden_fields %}
             {{ field }}

nautobot/core/templates/inc/header.html

@@ -36,11 +36,18 @@
                         class="align-items-center d-inline-flex gap-4 text-nowrap{% if not request.GET.q %} text-secondary{% endif %}"
                     >
                         {% if not request.GET.q %}
-                            Press <kbd>{% if is_apple_os %}⌘{% else %}Ctrl+{% endif %}K</kbd> to search
+                            Press <kbd class="mt-n1">{% if is_apple_os %}⌘{% else %}Ctrl+{% endif %}K</kbd> to search
                         {% else %}
                             {{ request.GET.q }}
                         {% endif %}
                     </span>
+                    <a class="align-items-center d-inline-flex ms-auto pe-auto"
+                       href="{% static 'docs/user-guide/platform-functionality/user-interface/search.html' %}"
+                       target="_blank"
+                       rel="noopener"
+                    >
+                        <span aria-hidden="true" class="mdi mdi-help-circle-outline text-secondary"></span>
+                    </a>
                 </span>
             </label>
         </form>
@@ -49,15 +56,7 @@
     <div class="col-4 text-end">
         <div class="dropdown">
             <button class="btn dropdown-toggle align-items-center d-inline-flex gap-6" type="button" data-bs-toggle="dropdown" aria-expanded="false">
-                <span class="align-items-center bg-primary d-inline-flex justify-content-center rounded nb-text-body-bg" style="height: 1.5rem; width: 1.5rem;">
-                    {% if request.user.get_full_name %}
-                        {% for name in request.user.get_full_name|split:" " %}<!--
-                            -->{{ name|first|upper }}<!--
-                        -->{% endfor %}
-                    {% else %}
-                        {{ request.user.username|first|upper }}
-                    {% endif %}
-                </span>
+                <span aria-hidden="true" class="mdi mdi-account text-secondary"></span>
                 {% firstof request.user.get_full_name request.user.username %}
             </button>
             <ul class="dropdown-menu dropdown-menu-end">

nautobot/core/templates/login.html

@@ -2,7 +2,22 @@
 {% load helpers %}
 {% load form_helpers %}
 
-{% block title %}Home{% endblock title %}
+{% block title %}Log In{% endblock title %}
+
+{% block extra_styles %}
+    {{ block.super }}
+
+    <style>
+        /* This is a wrapper element containing page title, breadcrumbs, search bar, and user profile dropdown. */
+        #header :nth-child(2) {
+            display: none;
+        }
+
+        #header .alert:last-child {
+            margin-bottom: 0;
+        }
+    </style>
+{% endblock %}
 
 {% block content %}
     <div class="row justify-content-center" style="margin-block-start: {% if 'BANNER_LOGIN'|settings_or_config %}6.25{% else %}9.375{% endif %}rem;">

nautobot/core/templates/nautobot_config.py.j2

@@ -43,6 +43,19 @@ from nautobot.core.settings_funcs import is_truthy, parse_redis_connection
 #     os.path.join(tempfile.gettempdir(), "nautobot_celery_beat_heartbeat"),
 # )
 
+# Celery Worker heartbeat file path - will be touched by each worker process as a proof-of-health.
+# CELERY_WORKER_HEARTBEAT_FILE = os.getenv(
+#     "NAUTOBOT_CELERY_BEAT_READINESS_FILE", os.path.join(tempfile.gettempdir(), "nautobot_celery_worker_heartbeat")
+# )
+
+# Celery Worker readiness file path - will be created by each worker process once it's ready to accept tasks.
+# CELERY_WORKER_READINESS_FILE = os.getenv(
+#     "NAUTOBOT_CELERY_WORKER_READINESS_FILE", os.path.join(tempfile.gettempdir(), "nautobot_celery_worker_ready")
+# )
+
+# Celery health probes as files - if enabled, Celery worker health probes will be implemented as files
+# CELERY_HEALTH_PROBES_AS_FILES = is_truthy(os.getenv("NAUTOBOT_CELERY_HEALTH_PROBES_AS_FILES", "False"))
+
 # Celery broker URL used to tell workers where queues are located
 #
 # CELERY_BROKER_URL = os.getenv("NAUTOBOT_CELERY_BROKER_URL", parse_redis_connection(redis_database=0))
@@ -94,7 +107,7 @@ SECRET_KEY = os.getenv("NAUTOBOT_SECRET_KEY", "{{ secret_key }}")
 # FQDNs that are considered trusted origins for secure, cross-domain, requests such as HTTPS POST.
 # If running Nautobot under a single domain, you may not need to set this variable;
 # if running on multiple domains, you *may* need to set this variable to more or less the same as ALLOWED_HOSTS above.
-# You also want to set this variable if you are facing CSRF validation issues such as 
+# You also want to set this variable if you are facing CSRF validation issues such as
 # 'CSRF failure has occured' or 'Origin checking failed - https://subdomain.example.com does not match any trusted origins.'
 # https://docs.djangoproject.com/en/stable/ref/settings/#csrf-trusted-origins
 #

nautobot/core/templates/redoc_ui.html

@@ -58,6 +58,9 @@
         [data-bs-theme="dark"] .redoc-wrap .menu-content .operation-type {
             filter: hue-rotate(180deg) invert(1);
         }
+
+        {# Revert default Nautobot `<code>` element styles in `<div class="redoc-json">` blocks. #}
+        div.redoc-json code { background: none; color: inherit; border-radius: 0; padding: 0; }
     </style>
 {% endblock extra_styles %}
 

nautobot/core/templatetags/helpers.py

@@ -824,7 +824,7 @@ def render_button_class(value):
         value (str): A string representing the button class (e.g., 'primary').
 
     Returns:
-        str: HTML string for a button with the given class.
+        (str): HTML string for a button with the given class.
 
     Example:
         >>> render_button_class("primary")
@@ -848,7 +848,7 @@ def render_job_run_link(value):
         value (Job): The job object.
 
     Returns:
-        str: HTML anchor tag linking to the job's run view.
+        (str): HTML anchor tag linking to the job's run view.
     """
     if hasattr(value, "class_path"):
         url = reverse("extras:job_run_by_class_path", kwargs={"class_path": value.class_path})
@@ -1313,7 +1313,7 @@ def tree_hierarchy_ui_representation(tree_depth, hide_hierarchy_ui, base_depth=0
         base_depth (int, optional): Starting depth (number of dots to skip rendering).
 
     Returns:
-        str: A string containing dots (representing hierarchy levels) if `hide_hierarchy_ui` is False,
+        (str): A string containing dots (representing hierarchy levels) if `hide_hierarchy_ui` is False,
              otherwise an empty string.
     """
     if hide_hierarchy_ui or tree_depth == 0:

nautobot/core/testing/views.py

@@ -402,7 +402,7 @@ class ViewTestCases:
                             self.assertHttpStatus(self.client.get(url), [403, 404])
 
                         self.add_permissions(required_permissions[-1])
-                        self.assertHttpStatus(self.client.get(url), 200)
+                        self.assertHttpStatus(self.client.get(url, follow=True), 200)
                     finally:
                         # delete the permissions here so that we start from a clean slate on the next loop
                         self.remove_permissions(*required_permissions)
@@ -1558,6 +1558,7 @@ class ViewTestCases:
 
             response = self.client.post(self._get_url("bulk_delete"), data)
             job_result = JobResult.objects.filter(name="Bulk Delete Objects").first()
+            self.assertIsNotNone(job_result)
             self.assertRedirects(
                 response,
                 reverse("extras:jobresult", args=[job_result.pk]),
@@ -1647,6 +1648,7 @@ class ViewTestCases:
             self.add_permissions("extras.view_jobresult")
             response = self.client.post(self._get_url("bulk_delete"), data)
             job_result = JobResult.objects.filter(name="Bulk Delete Objects").first()
+            self.assertIsNotNone(job_result)
             self.assertRedirects(
                 response,
                 reverse("extras:jobresult", args=[job_result.pk]),

nautobot/core/tests/test_graphql.py

@@ -2263,6 +2263,19 @@ query {
         result_2 = self.execute_query(query_all)
         self.assertEqual(len(result_2.data.get("interfaces", [])), Interface.objects.count())
 
+    def test_query_pagination_with_restricted_permissions(self):
+        # Test for https://github.com/nautobot/nautobot/issues/8155
+        self.user.is_superuser = False
+        self.user.save()
+        try:
+            self.add_permissions("dcim.view_manufacturer")
+            result = self.execute_query("query { manufacturers (limit: 1) { name } }")
+            self.assertIsNone(result.errors)
+            self.assertEqual(len(result.data.get("manufacturers", [])), 1)
+        finally:
+            self.user.is_superuser = True
+            self.user.save()
+
     @override_settings(EXEMPT_VIEW_PERMISSIONS=["*"])
     def test_query_power_feeds_cable_peer(self):
         """Test querying power feeds for their cable peers"""

nautobot/core/tests/test_jobs.py

@@ -1060,6 +1060,70 @@ class BulkEditTestCase(TransactionTestCase):
         )
         self.assertEqual(IPAddress.objects.all().count(), IPAddress.objects.filter(status=active_status).count())
 
+    def test_bulk_edit_objects_with_saved_view(self):
+        """
+        Bulk edit Status objects using a SavedView filter.
+        """
+        self.add_permissions("extras.change_status", "extras.view_status")
+        saved_view = SavedView.objects.create(
+            name="Save View for Statuses",
+            owner=self.user,
+            view="extras:status_list",
+            config={"filter_params": {"name__isw": ["A"]}},
+        )
+
+        # Confirm the SavedView filter matches some but not all Statuses
+        self.assertTrue(
+            0 < saved_view.get_filtered_queryset(self.user).count() < Status.objects.exclude(color="aa1409").count()
+        )
+        delta_count = (
+            Status.objects.exclude(color="aa1409").count() - saved_view.get_filtered_queryset(self.user).count()
+        )
+
+        create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkEditObjects",
+            username=self.user.username,
+            content_type=self.status_ct.id,
+            edit_all=True,
+            filter_query_params={},
+            pk_list=[],
+            saved_view_id=saved_view.id,
+            form_data={"color": "aa1409", "_all": "True"},
+        )
+
+        self.assertEqual(delta_count, Status.objects.exclude(color="aa1409").count())
+
+    def test_bulk_edit_objects_with_saved_view_with_all_filters_removed(self):
+        """
+        Bulk edit Status objects using a SavedView filter but overwriting the saved field.
+        """
+        self.add_permissions("extras.change_status", "extras.view_status")
+        saved_view = SavedView.objects.create(
+            name="Save View for Statuses",
+            owner=self.user,
+            view="extras:status_list",
+            config={"filter_params": {"name__isw": ["A"]}},
+        )
+
+        self.assertTrue(
+            0 < saved_view.get_filtered_queryset(self.user).count() < Status.objects.exclude(color="aa1409").count()
+        )
+
+        create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkEditObjects",
+            username=self.user.username,
+            content_type=self.status_ct.id,
+            edit_all=True,
+            filter_query_params={"all_filters_removed": [True]},
+            pk_list=[],
+            saved_view_id=saved_view.id,
+            form_data={"color": "aa1409", "_all": "True"},
+        )
+
+        self.assertEqual(0, Status.objects.exclude(color="aa1409").count())
+
 
 class BulkDeleteTestCase(TransactionTestCase):
     """
@@ -1099,6 +1163,19 @@ class BulkDeleteTestCase(TransactionTestCase):
             circuit_type=circuit_type,
             status=statuses[0],
         )
+        Circuit.objects.create(
+            cid="Not Circuit",
+            provider=provider,
+            circuit_type=circuit_type,
+            status=statuses[0],
+        )
+
+        self.saved_view = SavedView.objects.create(
+            name="Save View for Circuits",
+            owner=self.user,
+            view="circuits:circuit_list",
+            config={"filter_params": {"cid__isw": "Circuit "}},
+        )
 
     def _common_no_error_test_assertion(self, model, job_result, **filter_params):
         self.assertJobResultStatus(job_result)
@@ -1250,6 +1327,47 @@ class BulkDeleteTestCase(TransactionTestCase):
         )
         self._common_no_error_test_assertion(Role, job_result, name__istartswith="Example Status")
 
+    def test_bulk_delete_objects_with_saved_view(self):
+        """
+        Delete objects using a SavedView filter.
+        """
+        self.add_permissions("circuits.delete_circuit", "circuits.view_circuit")
+
+        # we assert that the saved view filter actually filters some circuits and there are others not filtered out
+        self.assertTrue(0 < self.saved_view.get_filtered_queryset(self.user).count() < Circuit.objects.all().count())
+        create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkDeleteObjects",
+            username=self.user.username,
+            content_type=ContentType.objects.get_for_model(Circuit).id,
+            delete_all=True,
+            filter_query_params={},
+            pk_list=[],
+            saved_view_id=self.saved_view.id,
+        )
+        self.assertTrue(Circuit.objects.exists())
+        self.assertFalse(self.saved_view.get_filtered_queryset(self.user).exists())
+
+    def test_bulk_delete_objects_with_saved_view_with_all_filters_removed(self):
+        """
+        Delete Objects using a SavedView filter, but ignore the filter if all_filters_removed is set.
+        """
+        self.add_permissions("circuits.delete_circuit", "circuits.view_circuit")
+
+        # we assert that the saved view filter actually filters some circuits and there are others not filtered out
+        self.assertTrue(0 < self.saved_view.get_filtered_queryset(self.user).count() < Circuit.objects.all().count())
+        create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkDeleteObjects",
+            username=self.user.username,
+            content_type=ContentType.objects.get_for_model(Circuit).id,
+            delete_all=True,
+            filter_query_params={"all_filters_removed": [True]},
+            pk_list=[],
+            saved_view_id=self.saved_view.id,
+        )
+        self.assertFalse(Circuit.objects.all().exists())
+
 
 class RefreshDynamicGroupCacheJobButtonReceiverTestCase(TransactionTestCase):
     job_module = "nautobot.core.jobs.groups"

nautobot/core/tests/test_views.py

@@ -997,3 +997,27 @@ class SearchRobotsTestCase(TestCase):
         url = reverse("home")
         response = self.client.get(url)
         self.assertNotContains(response, '<meta name="robots" content="noindex, nofollow">', html=True)
+
+
+@tag("example_app")
+class ViewSetCustomActionsTestCase(TestCase):
+    """Tests for NautobotUIViewSet custom actions."""
+
+    def test_custom_view_base_action(self):
+        """Assert that all of the permissions in a custom action's custom_view_base_action are enforced."""
+        from example_app.models import AnotherExampleModel
+
+        self.add_permissions("example_app.view_anotherexamplemodel", "dcim.view_location")
+        self.remove_permissions("dcim.add_location", "dcim.change_location")
+
+        example_model = AnotherExampleModel.objects.create(name="test")
+        url = reverse(
+            "plugins:example_app:anotherexamplemodel_custom-action-permissions-test",
+            kwargs={"pk": example_model.pk},
+        )
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 403)
+
+        self.add_permissions("dcim.add_location", "dcim.change_location")
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)

nautobot/core/ui/bulk_buttons.py

@@ -1,5 +1,6 @@
 from nautobot.core.choices import ButtonActionColorChoices
 from nautobot.core.ui import object_detail
+from nautobot.core.utils.lookup import get_route_for_model
 
 
 class BaseBulkButton(object_detail.FormButton):
@@ -12,9 +13,7 @@ class BaseBulkButton(object_detail.FormButton):
     weight = None
 
     def __init__(self, *, form_id: str, model, **kwargs):
-        model_name = model.__name__.lower()
-        app_label = model._meta.app_label
-        link_name = f"{app_label}:{model_name}_bulk_{self.action}"
+        link_name = get_route_for_model(model, f"bulk_{self.action}")
 
         super().__init__(
             link_name=link_name,

nautobot/core/utils/lookup.py

@@ -391,11 +391,10 @@ def get_table_class_string_from_view_name(view_name):
 def get_created_and_last_updated_usernames_for_model(instance):
     """
     Args:
-        instance: A model class instance
+        instance (Model): A model class instance
 
     Returns:
-        created_by: Username of the user that created the instance
-        last_updated_by: Username of the user that last modified the instance
+        (str, str): Usernames of the users that created the instance and last modified the instance.
     """
     from nautobot.extras.choices import ObjectChangeActionChoices
     from nautobot.extras.models import ObjectChange

nautobot/core/utils/permissions.py

@@ -82,7 +82,7 @@ def qs_filter_from_constraints(constraints, tokens=None):
         tokens (dict, optional): user tokens. Defaults to a None.
 
     Returns:
-        QuerySet object: A QuerySet of tuples or, an empty QuerySet if constraints are null.
+        (Q): QuerySet filter constructed from the given constraints, possibly empty.
     """
     if tokens is None:
         tokens = {}

nautobot/core/views/generic.py

@@ -227,6 +227,7 @@ class ObjectListView(UIComponentsMixin, ObjectPermissionRequiredMixin, View):
         hide_hierarchy_ui = False
         clear_view = request.GET.get("clear_view", False)
         resolved_path = resolve(request.path)
+        # Note that `resolved_path.app_name` does work even for nested paths like `plugins:example_app:...`
         list_url = f"{resolved_path.app_name}:{resolved_path.url_name}"
 
         skip_user_and_global_default_saved_view = False