netbox-sqlquery 0.1.0__py3-none-any.whl

netbox_sqlquery/api/views.py

@@ -0,0 +1,15 @@
+from rest_framework.viewsets import ModelViewSet
+
+from netbox_sqlquery.models import SavedQuery
+
+from .serializers import SavedQuerySerializer
+
+
+class SavedQueryViewSet(ModelViewSet):
+    serializer_class = SavedQuerySerializer
+
+    def get_queryset(self):
+        return SavedQuery.visible_to(self.request.user)
+
+    def perform_create(self, serializer):
+        serializer.save(owner=self.request.user)

netbox_sqlquery/filtersets.py

@@ -0,0 +1,12 @@
+import django_filters
+
+from .models import SavedQuery
+
+
+class SavedQueryFilterSet(django_filters.FilterSet):
+    name = django_filters.CharFilter(lookup_expr="icontains")
+    visibility = django_filters.ChoiceFilter(choices=SavedQuery.VISIBILITY_CHOICES)
+
+    class Meta:
+        model = SavedQuery
+        fields = ["name", "visibility"]

netbox_sqlquery/forms.py

@@ -0,0 +1,20 @@
+from django import forms
+
+from .models import SavedQuery
+
+
+class SavedQueryForm(forms.ModelForm):
+    class Meta:
+        model = SavedQuery
+        fields = ["name", "description", "sql", "visibility", "tags"]
+        widgets = {
+            "sql": forms.Textarea(attrs={"rows": 10}),
+        }
+
+
+class SavedQueryFilterForm(forms.Form):
+    name = forms.CharField(required=False)
+    visibility = forms.ChoiceField(
+        choices=[("", "---------")] + SavedQuery.VISIBILITY_CHOICES,
+        required=False,
+    )

netbox_sqlquery/management/commands/sqlquery_create_views.py

@@ -0,0 +1,39 @@
+from django.core.management.base import BaseCommand
+
+from netbox_sqlquery.abstract_schema import drop_views, ensure_views
+
+
+class Command(BaseCommand):
+    help = "Create or replace abstract SQL views for the netbox-sqlquery plugin"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Print the SQL without executing",
+        )
+        parser.add_argument(
+            "--drop",
+            action="store_true",
+            help="Drop all nb_* views instead of creating them",
+        )
+
+    def handle(self, *args, **options):
+        if options["drop"]:
+            dropped = drop_views()
+            for name in dropped:
+                self.stdout.write(f"Dropped {name}")
+            self.stdout.write(self.style.SUCCESS(f"Dropped {len(dropped)} views"))
+            return
+
+        results = ensure_views(dry_run=options["dry_run"])
+
+        for view_name, sql in results:
+            if options["dry_run"]:
+                self.stdout.write(f"\n-- {view_name}")
+                self.stdout.write(sql)
+            else:
+                self.stdout.write(f"Created {view_name}")
+
+        action = "Generated" if options["dry_run"] else "Created"
+        self.stdout.write(self.style.SUCCESS(f"{action} {len(results)} views"))

netbox_sqlquery/migrations/0001_initial.py

@@ -0,0 +1,95 @@
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ("auth", "0012_alter_user_first_name_max_length"),
+        ("extras", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="SavedQuery",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("name", models.CharField(max_length=100)),
+                ("description", models.CharField(blank=True, max_length=256)),
+                ("sql", models.TextField()),
+                (
+                    "visibility",
+                    models.CharField(
+                        choices=[
+                            ("private", "Private"),
+                            ("global", "Global (read-only)"),
+                            ("global_editable", "Global (editable by staff)"),
+                        ],
+                        default="private",
+                        max_length=20,
+                    ),
+                ),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("last_run", models.DateTimeField(null=True, blank=True)),
+                ("run_count", models.PositiveIntegerField(default=0)),
+                (
+                    "owner",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="saved_queries",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                ("tags", models.ManyToManyField(blank=True, to="extras.tag")),
+            ],
+            options={
+                "ordering": ["name"],
+                "verbose_name_plural": "saved queries",
+            },
+        ),
+        migrations.CreateModel(
+            name="TablePermission",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("pattern", models.CharField(max_length=100)),
+                (
+                    "scope",
+                    models.CharField(
+                        choices=[
+                            ("exact", "Exact table name"),
+                            ("prefix", "Table prefix (e.g. dcim_)"),
+                        ],
+                        default="exact",
+                        max_length=10,
+                    ),
+                ),
+                ("require_staff", models.BooleanField(default=False)),
+                ("require_superuser", models.BooleanField(default=False)),
+                ("allow", models.BooleanField(default=True)),
+                ("groups", models.ManyToManyField(blank=True, to="auth.group")),
+            ],
+            options={
+                "ordering": ["-require_superuser", "-require_staff", "pattern"],
+            },
+        ),
+    ]

netbox_sqlquery/migrations/0002_query_permissions.py

@@ -0,0 +1,21 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("netbox_sqlquery", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="QueryPermission",
+            fields=[],
+            options={
+                "managed": False,
+                "default_permissions": ("view", "change"),
+                "verbose_name": "SQL query permission",
+                "verbose_name_plural": "SQL query permissions",
+            },
+        ),
+    ]

netbox_sqlquery/migrations/0003_tablepermission_groups_to_users_group.py

@@ -0,0 +1,17 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("netbox_sqlquery", "0002_query_permissions"),
+        ("users", "0001_squashed_0011"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="tablepermission",
+            name="groups",
+            field=models.ManyToManyField(blank=True, to="users.group"),
+        ),
+    ]

netbox_sqlquery/models.py

@@ -0,0 +1,106 @@
+
+from django.conf import settings
+from django.core.validators import RegexValidator
+from django.db import models
+from utilities.querysets import RestrictedQuerySet
+
+SAFE_NAME_VALIDATOR = RegexValidator(
+    regex=r'^[a-zA-Z0-9][a-zA-Z0-9 _\-\.]*$',
+    message=(
+        "Name must start with a letter or number and contain only"
+        " letters, numbers, spaces, hyphens, underscores, and periods."
+    ),
+)
+
+
+class SavedQuery(models.Model):
+    VISIBILITY_PRIVATE = "private"
+    VISIBILITY_GLOBAL = "global"
+    VISIBILITY_GLOBAL_EDITABLE = "global_editable"
+
+    VISIBILITY_CHOICES = [
+        (VISIBILITY_PRIVATE, "Private"),
+        (VISIBILITY_GLOBAL, "Global (read-only)"),
+        (VISIBILITY_GLOBAL_EDITABLE, "Global (editable by staff)"),
+    ]
+
+    name = models.CharField(max_length=100, validators=[SAFE_NAME_VALIDATOR])
+    description = models.CharField(max_length=256, blank=True)
+    sql = models.TextField()
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="saved_queries",
+    )
+    visibility = models.CharField(
+        max_length=20,
+        choices=VISIBILITY_CHOICES,
+        default=VISIBILITY_PRIVATE,
+    )
+    created = models.DateTimeField(auto_now_add=True)
+    last_run = models.DateTimeField(null=True, blank=True)
+    run_count = models.PositiveIntegerField(default=0)
+    tags = models.ManyToManyField("extras.Tag", blank=True)
+
+    objects = RestrictedQuerySet.as_manager()
+
+    class Meta:
+        ordering = ["name"]
+        verbose_name_plural = "saved queries"
+
+    def __str__(self):
+        return self.name
+
+    def get_absolute_url(self):
+        from django.urls import reverse
+        return reverse("plugins:netbox_sqlquery:savedquery", kwargs={"pk": self.pk})
+
+    @staticmethod
+    def visible_to(user):
+        return SavedQuery.objects.filter(
+            models.Q(owner=user) | ~models.Q(visibility=SavedQuery.VISIBILITY_PRIVATE)
+        )
+
+
+class TablePermission(models.Model):
+    SCOPE_EXACT = "exact"
+    SCOPE_PREFIX = "prefix"
+
+    SCOPE_CHOICES = [
+        (SCOPE_EXACT, "Exact table name"),
+        (SCOPE_PREFIX, "Table prefix (e.g. dcim_)"),
+    ]
+
+    pattern = models.CharField(max_length=100)
+    scope = models.CharField(max_length=10, choices=SCOPE_CHOICES, default=SCOPE_EXACT)
+    groups = models.ManyToManyField("users.Group", blank=True)
+    require_staff = models.BooleanField(default=False)
+    require_superuser = models.BooleanField(default=False)
+    allow = models.BooleanField(default=True)
+
+    class Meta:
+        ordering = ["-require_superuser", "-require_staff", "pattern"]
+
+    def __str__(self):
+        action = "Allow" if self.allow else "Deny"
+        return f"{action} {self.get_scope_display()}: {self.pattern}"
+
+    def matches(self, table_name):
+        if self.scope == self.SCOPE_EXACT:
+            return self.pattern == table_name
+        return table_name.startswith(self.pattern)
+
+
+class QueryPermission(models.Model):
+    """Proxy model to register plugin permissions with NetBox's ObjectPermission system.
+
+    Admins assign permissions on this object type:
+    - view: Can access the SQL query editor
+    - change: Can execute write queries (INSERT/UPDATE/DELETE)
+    """
+
+    class Meta:
+        managed = False
+        default_permissions = ("view", "change")
+        verbose_name = "SQL query permission"
+        verbose_name_plural = "SQL query permissions"

netbox_sqlquery/navigation.py

@@ -0,0 +1,44 @@
+from netbox.plugins import PluginMenu, PluginMenuItem
+
+QUERY_PERMS = ["netbox_sqlquery.view_querypermission"]
+
+
+def get_menu():
+    """Return a top-level PluginMenu for the nav bar."""
+    return PluginMenu(
+        label="SQL Query",
+        groups=(
+            (
+                "Queries",
+                (
+                    PluginMenuItem(
+                        link="plugins:netbox_sqlquery:query",
+                        link_text="SQL Console",
+                        permissions=QUERY_PERMS,
+                    ),
+                    PluginMenuItem(
+                        link="plugins:netbox_sqlquery:savedquery_list",
+                        link_text="Saved Queries",
+                        permissions=QUERY_PERMS,
+                    ),
+                ),
+            ),
+        ),
+        icon_class="mdi mdi-database-search",
+    )
+
+
+def get_menu_items():
+    """Return menu items for the shared Plugins dropdown."""
+    return (
+        PluginMenuItem(
+            link="plugins:netbox_sqlquery:query",
+            link_text="SQL Console",
+            permissions=QUERY_PERMS,
+        ),
+        PluginMenuItem(
+            link="plugins:netbox_sqlquery:savedquery_list",
+            link_text="Saved Queries",
+            permissions=QUERY_PERMS,
+        ),
+    )

netbox_sqlquery/preferences.py

@@ -0,0 +1,64 @@
+from netbox.choices import ColorChoices
+from users.preferences import UserPreference
+
+COLOR_CHOICES = ColorChoices.CHOICES
+
+preferences = {
+    "highlight_enabled": UserPreference(
+        label="SQL Query: Syntax highlighting",
+        choices=(
+            ("on", "On"),
+            ("off", "Off"),
+        ),
+        default="on",
+        description="Enable SQL syntax highlighting and auto-uppercase in the query editor.",
+    ),
+    "color_keyword": UserPreference(
+        label="SQL Query: Keyword color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_BLUE,
+        description="Color for SQL keywords (SELECT, FROM, WHERE, etc.).",
+    ),
+    "color_function": UserPreference(
+        label="SQL Query: Function color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_PURPLE,
+        description="Color for SQL functions (COUNT, SUM, AVG, etc.).",
+    ),
+    "color_string": UserPreference(
+        label="SQL Query: String color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_DARK_GREEN,
+        description="Color for string literals ('active', 'test', etc.).",
+    ),
+    "color_number": UserPreference(
+        label="SQL Query: Number color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_DARK_ORANGE,
+        description="Color for numeric literals (42, 3.14, etc.).",
+    ),
+    "color_operator": UserPreference(
+        label="SQL Query: Operator color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_DARK_RED,
+        description="Color for operators (=, <>, >=, etc.).",
+    ),
+    "color_comment": UserPreference(
+        label="SQL Query: Comment color",
+        choices=COLOR_CHOICES,
+        default=ColorChoices.COLOR_GREY,
+        description="Color for SQL comments (-- line comments).",
+    ),
+    "skip_write_confirm": UserPreference(
+        label="SQL Query: Skip write confirmation",
+        choices=(
+            ("off", "Off (always confirm)"),
+            ("on", "On (skip confirmation)"),
+        ),
+        default="off",
+        description=(
+            "Skip the confirmation dialog when running"
+            " INSERT, UPDATE, or DELETE queries."
+        ),
+    ),
+}

netbox_sqlquery/schema.py

@@ -0,0 +1,52 @@
+from django.core.cache import cache
+from django.db import connection
+
+SCHEMA_CACHE_KEY = "netbox_sqlquery_schema"
+ABSTRACT_SCHEMA_CACHE_KEY = "netbox_sqlquery_abstract_schema"
+SCHEMA_CACHE_TTL = 300
+
+
+def get_schema():
+    cached = cache.get(SCHEMA_CACHE_KEY)
+    if cached is not None:
+        return cached
+
+    with connection.cursor() as cursor:
+        cursor.execute("""
+            SELECT t.table_name, c.column_name, c.data_type
+            FROM information_schema.tables t
+            JOIN information_schema.columns c
+              ON t.table_name = c.table_name
+             AND t.table_schema = c.table_schema
+            WHERE t.table_schema = 'public'
+              AND t.table_type = 'BASE TABLE'
+            ORDER BY t.table_name, c.ordinal_position
+        """)
+        schema = {}
+        for table, column, dtype in cursor.fetchall():
+            schema.setdefault(table, []).append((column, dtype))
+
+    cache.set(SCHEMA_CACHE_KEY, schema, SCHEMA_CACHE_TTL)
+    return schema
+
+
+def get_abstract_schema():
+    """Return schema for abstract (nb_*) views only."""
+    cached = cache.get(ABSTRACT_SCHEMA_CACHE_KEY)
+    if cached is not None:
+        return cached
+
+    with connection.cursor() as cursor:
+        cursor.execute(r"""
+            SELECT c.table_name, c.column_name, c.data_type
+            FROM information_schema.columns c
+            WHERE c.table_schema = 'public'
+              AND c.table_name LIKE 'nb\_%'
+            ORDER BY c.table_name, c.ordinal_position
+        """)
+        schema = {}
+        for table, column, dtype in cursor.fetchall():
+            schema.setdefault(table, []).append((column, dtype))
+
+    cache.set(ABSTRACT_SCHEMA_CACHE_KEY, schema, SCHEMA_CACHE_TTL)
+    return schema

netbox_sqlquery/tables.py

@@ -0,0 +1,18 @@
+import django_tables2 as tables
+from netbox.tables import NetBoxTable, columns
+
+from .models import SavedQuery
+
+
+class SavedQueryTable(NetBoxTable):
+    name = tables.Column(linkify=True)
+    owner = tables.Column()
+    visibility = tables.Column()
+    run_count = tables.Column()
+    last_run = tables.DateTimeColumn()
+    actions = columns.ActionsColumn(actions=("edit", "delete"))
+
+    class Meta(NetBoxTable.Meta):
+        model = SavedQuery
+        fields = ("pk", "name", "owner", "visibility", "run_count", "last_run", "actions")
+        default_columns = ("name", "owner", "visibility", "run_count", "last_run", "actions")

netbox_sqlquery/tests/test_access.py

@@ -0,0 +1,96 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase, override_settings
+from users.models import Group
+
+from netbox_sqlquery.access import ALL_TABLES, SHARED_TABLES, _allowed_tables, check_access, extract_tables
+from netbox_sqlquery.models import TablePermission
+
+User = get_user_model()
+
+PLUGIN_CONFIG = {
+    "netbox_sqlquery": {
+        "deny_tables": ["auth_user", "users_token", "users_userconfig"],
+    }
+}
+
+
+class ExtractTablesTest(TestCase):
+
+    def test_extract_tables_finds_from_clause(self):
+        sql = "SELECT * FROM dcim_device WHERE id = 1"
+        self.assertEqual(extract_tables(sql), {"dcim_device"})
+
+    def test_extract_tables_finds_join_clause(self):
+        sql = "SELECT * FROM dcim_device JOIN dcim_site ON dcim_device.site_id = dcim_site.id"
+        self.assertEqual(extract_tables(sql), {"dcim_device", "dcim_site"})
+
+    def test_extract_tables_handles_cte(self):
+        sql = "WITH cte AS (SELECT * FROM dcim_device) SELECT * FROM cte"
+        tables = extract_tables(sql)
+        self.assertIn("dcim_device", tables)
+        self.assertIn("cte", tables)
+
+
+@override_settings(PLUGINS_CONFIG=PLUGIN_CONFIG)
+class CheckAccessTest(TestCase):
+
+    def setUp(self):
+        self.superuser = User.objects.create_user(
+            "superuser", password="test", is_superuser=True,
+        )
+        self.staff_user = User.objects.create_user(
+            "staffuser", password="test",
+        )
+        self.regular_user = User.objects.create_user(
+            "regular", password="test",
+        )
+        self.group = Group.objects.create(name="network_team")
+
+    def test_superuser_can_access_all_tables(self):
+        result = _allowed_tables(self.superuser)
+        self.assertIs(result, ALL_TABLES)
+
+    def test_hard_deny_blocks_superuser(self):
+        denied = check_access(self.superuser, {"auth_user", "dcim_device"})
+        self.assertEqual(denied, {"auth_user"})
+
+    def test_staff_tier_default_allows_dcim_tables(self):
+        TablePermission.objects.create(
+            pattern="dcim_", scope=TablePermission.SCOPE_PREFIX,
+            require_staff=True, allow=True,
+        )
+        allowed = _allowed_tables(self.staff_user)
+        self.assertIn("dcim_", allowed)
+
+    def test_regular_user_gets_only_shared_tables(self):
+        allowed = _allowed_tables(self.regular_user)
+        self.assertEqual(allowed, SHARED_TABLES)
+
+    def test_group_override_expands_access_for_group_member(self):
+        self.regular_user.groups.add(self.group)
+        perm = TablePermission.objects.create(
+            pattern="ipam_", scope=TablePermission.SCOPE_PREFIX, allow=True,
+        )
+        perm.groups.add(self.group)
+        allowed = _allowed_tables(self.regular_user)
+        self.assertIn("ipam_", allowed)
+
+    def test_explicit_deny_in_table_permission_overrides_allow(self):
+        self.staff_user.groups.add(self.group)
+        TablePermission.objects.create(
+            pattern="dcim_", scope=TablePermission.SCOPE_PREFIX,
+            require_staff=True, allow=True,
+        )
+        deny_perm = TablePermission.objects.create(
+            pattern="dcim_", scope=TablePermission.SCOPE_PREFIX,
+            allow=False,
+        )
+        deny_perm.groups.add(self.group)
+        allowed = _allowed_tables(self.staff_user)
+        self.assertNotIn("dcim_", allowed)
+
+    def test_wildcard_prefix_matches_all_prefixed_tables(self):
+        perm = TablePermission(pattern="dcim_", scope=TablePermission.SCOPE_PREFIX)
+        self.assertTrue(perm.matches("dcim_device"))
+        self.assertTrue(perm.matches("dcim_site"))
+        self.assertFalse(perm.matches("ipam_ipaddress"))

netbox_sqlquery/tests/test_api.py

@@ -0,0 +1,41 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+
+from netbox_sqlquery.models import SavedQuery
+
+User = get_user_model()
+
+
+class SavedQueryModelAPITest(TestCase):
+    """Test SavedQuery visibility logic at the model level."""
+
+    def setUp(self):
+        self.user1 = User.objects.create_user("user1", password="test")
+        self.user2 = User.objects.create_user("user2", password="test")
+
+        self.private_query = SavedQuery.objects.create(
+            name="Private", sql="SELECT 1", owner=self.user1,
+            visibility=SavedQuery.VISIBILITY_PRIVATE,
+        )
+        self.global_query = SavedQuery.objects.create(
+            name="Global", sql="SELECT 2", owner=self.user1,
+            visibility=SavedQuery.VISIBILITY_GLOBAL,
+        )
+
+    def test_list_returns_only_owned_and_global_queries(self):
+        visible = SavedQuery.visible_to(self.user2)
+        names = list(visible.values_list("name", flat=True))
+        self.assertIn("Global", names)
+        self.assertNotIn("Private", names)
+
+    def test_owner_sees_own_private_queries(self):
+        visible = SavedQuery.visible_to(self.user1)
+        names = list(visible.values_list("name", flat=True))
+        self.assertIn("Private", names)
+        self.assertIn("Global", names)
+
+    def test_visibility_choices_are_valid(self):
+        valid = dict(SavedQuery.VISIBILITY_CHOICES).keys()
+        self.assertIn(SavedQuery.VISIBILITY_PRIVATE, valid)
+        self.assertIn(SavedQuery.VISIBILITY_GLOBAL, valid)
+        self.assertIn(SavedQuery.VISIBILITY_GLOBAL_EDITABLE, valid)