netbox-windows-dhcp-plugin 0.1.0__py3-none-any.whl

netbox_windows_dhcp_plugin/__init__.py

@@ -0,0 +1,44 @@
+from .version import __version__
+
+try:
+    from netbox.plugins import PluginConfig
+except ImportError:  # imported outside NetBox (pure unit tests, build tools)
+    PluginConfig = None
+
+if PluginConfig is not None:
+    from .conf import DEFAULTS
+
+    class WindowsDHCPConfig(PluginConfig):
+        name = "netbox_windows_dhcp_plugin"
+        verbose_name = "Windows DHCP"
+        description = "Sync netbox-plugin-dhcp data with Microsoft Windows DHCP servers"
+        version = __version__
+        author = "Thomas Christory"
+        author_email = "9317624+thomaschristory@users.noreply.github.com"
+        base_url = "windows-dhcp"
+        min_version = "4.7.0"
+        max_version = "4.7.99"
+        required_settings = []
+        default_settings = DEFAULTS
+
+        def ready(self):
+            super().ready()
+            import logging
+
+            from . import (
+                jobs,  # noqa: F401 - registers the import scheduler system job
+                signals,
+                views,  # noqa: F401 - the Leases tab on subnets, registered before netbox-plugin-dhcp builds its URLs
+            )
+            from .conf import profiles_without_allowed_hosts
+            from .integrations import branching
+
+            branching.register()
+            signals.connect()
+            unrestricted = profiles_without_allowed_hosts()
+            if unrestricted:
+                logging.getLogger(__name__).warning(
+                    "credential profiles without allowed_hosts can be sent to any host: %s", ", ".join(unrestricted)
+                )
+
+    config = WindowsDHCPConfig

netbox_windows_dhcp_plugin/api/serializers.py

@@ -0,0 +1,362 @@
+from core.api.serializers_.jobs import JobSerializer
+from django.contrib.contenttypes.models import ContentType
+from drf_spectacular.utils import extend_schema_field
+from ipam.api.serializers import VRFSerializer
+from netbox.api.fields import ChoiceField, ContentTypeField
+from netbox.api.serializers import NetBoxModelSerializer, PrimaryModelSerializer
+from netbox_dhcp.api.serializers import (
+    DHCPServerSerializer,
+    HostReservationSerializer,
+    OptionDefinitionSerializer,
+    OptionSerializer,
+    SubnetSerializer,
+)
+from rest_framework import serializers
+from utilities.api import get_serializer_for_model
+
+from ..choices import (
+    ClassTypeChoices,
+    FailoverModeChoices,
+    FailoverServerRoleChoices,
+    ImportDestinationChoices,
+    MacFilterListChoices,
+    PolicyConditionChoices,
+    ProposalItemActionChoices,
+    ProposalItemStatusChoices,
+    ProposalStatusChoices,
+    ReservationTypeChoices,
+    ScopeStateChoices,
+    ScopeTypeChoices,
+    SyncKindChoices,
+    SyncStatusChoices,
+    TransportChoices,
+    WinRMAuthChoices,
+)
+from ..models import (
+    ExclusionRange,
+    FailoverRelationship,
+    ImportProposal,
+    ImportProposalItem,
+    MacFilter,
+    MacFilterLists,
+    SyncRun,
+    WindowsClass,
+    WindowsOptionDefinition,
+    WindowsOptionQualifier,
+    WindowsPolicy,
+    WindowsReservation,
+    WindowsScope,
+    WindowsServer,
+    WindowsVendorOption,
+    WindowsVendorOptionDefinition,
+)
+from ..models.dhcp import VENDOR_OPTION_PARENTS
+
+API = "plugins-api:netbox_windows_dhcp_plugin-api"
+COMMON = ("id", "url", "display_url", "display")
+TAIL = ("tags", "custom_fields", "created", "last_updated")
+PRIMARY_TAIL = ("description", "comments", "owner", *TAIL)
+
+
+def _url(model_name):
+    return serializers.HyperlinkedIdentityField(view_name=f"{API}:{model_name}-detail")
+
+
+class WindowsServerSerializer(PrimaryModelSerializer):
+    url = _url("windowsserver")
+    dhcp_server = DHCPServerSerializer(nested=True)
+    transport = ChoiceField(choices=TransportChoices, required=False)
+    winrm_auth = ChoiceField(choices=WinRMAuthChoices, required=False)
+    import_vrf = VRFSerializer(nested=True, required=False, allow_null=True)
+
+    class Meta:
+        model = WindowsServer
+        fields = (
+            *COMMON,
+            "dhcp_server",
+            "host",
+            "transport",
+            "port",
+            "credential_profile",
+            "winrm_auth",
+            "winrm_https",
+            "verify_tls",
+            "kerberos_realm",
+            "kerberos_spn",
+            "ssh_host_key",
+            "computer_name",
+            "reported_names",
+            "import_vrf",
+            "sync_enabled",
+            "import_interval",
+            *PRIMARY_TAIL,
+        )
+        brief_fields = ("id", "url", "display", "host", "description")
+
+
+class WindowsScopeSerializer(NetBoxModelSerializer):
+    url = _url("windowsscope")
+    subnet = SubnetSerializer(nested=True)
+    state = ChoiceField(choices=ScopeStateChoices, required=False)
+    scope_type = ChoiceField(choices=ScopeTypeChoices, required=False)
+
+    class Meta:
+        model = WindowsScope
+        fields = (
+            *COMMON,
+            "subnet",
+            "state",
+            "scope_type",
+            "delay_ms",
+            "max_bootp_clients",
+            "activate_policies",
+            "preference",
+            *TAIL,
+        )
+        brief_fields = ("id", "url", "display", "state")
+
+
+class WindowsReservationSerializer(NetBoxModelSerializer):
+    url = _url("windowsreservation")
+    host_reservation = HostReservationSerializer(nested=True)
+    reservation_type = ChoiceField(choices=ReservationTypeChoices, required=False)
+
+    class Meta:
+        model = WindowsReservation
+        fields = (*COMMON, "host_reservation", "reservation_type", "iaid", *TAIL)
+        brief_fields = ("id", "url", "display", "reservation_type")
+
+
+class ExclusionRangeSerializer(PrimaryModelSerializer):
+    url = _url("exclusionrange")
+    subnet = SubnetSerializer(nested=True)
+
+    class Meta:
+        model = ExclusionRange
+        fields = (*COMMON, "subnet", "start_address", "end_address", *PRIMARY_TAIL)
+        brief_fields = ("id", "url", "display", "start_address", "end_address", "description")
+
+
+class WindowsClassSerializer(PrimaryModelSerializer):
+    url = _url("windowsclass")
+    dhcp_server = DHCPServerSerializer(nested=True)
+    class_type = ChoiceField(choices=ClassTypeChoices)
+
+    class Meta:
+        model = WindowsClass
+        fields = (*COMMON, "dhcp_server", "name", "class_type", "family", "data", *PRIMARY_TAIL)
+        brief_fields = ("id", "url", "display", "name", "class_type", "description")
+
+
+class WindowsOptionDefinitionSerializer(NetBoxModelSerializer):
+    url = _url("windowsoptiondefinition")
+    option_definition = OptionDefinitionSerializer(nested=True)
+
+    class Meta:
+        model = WindowsOptionDefinition
+        fields = (*COMMON, "option_definition", "windows_type", "default_value", *TAIL)
+        brief_fields = ("id", "url", "display")
+
+
+class WindowsPolicySerializer(PrimaryModelSerializer):
+    url = _url("windowspolicy")
+    dhcp_server = DHCPServerSerializer(nested=True)
+    subnet = SubnetSerializer(nested=True, required=False, allow_null=True)
+    condition = ChoiceField(choices=PolicyConditionChoices, required=False)
+
+    class Meta:
+        model = WindowsPolicy
+        fields = (
+            *COMMON,
+            "dhcp_server",
+            "subnet",
+            "name",
+            "processing_order",
+            "enabled",
+            "condition",
+            "criteria",
+            "lease_duration",
+            "ip_ranges",
+            *PRIMARY_TAIL,
+        )
+        brief_fields = ("id", "url", "display", "name", "description")
+
+
+class WindowsOptionQualifierSerializer(NetBoxModelSerializer):
+    url = _url("windowsoptionqualifier")
+    option = OptionSerializer(nested=True)
+    user_class = WindowsClassSerializer(nested=True, required=False, allow_null=True)
+    policy = WindowsPolicySerializer(nested=True, required=False, allow_null=True)
+
+    class Meta:
+        model = WindowsOptionQualifier
+        fields = (*COMMON, "option", "user_class", "policy", *TAIL)
+        brief_fields = ("id", "url", "display")
+
+
+class FailoverRelationshipSerializer(PrimaryModelSerializer):
+    url = _url("failoverrelationship")
+    primary_server = DHCPServerSerializer(nested=True)
+    partner_server = DHCPServerSerializer(nested=True)
+    mode = ChoiceField(choices=FailoverModeChoices, required=False)
+    server_role = ChoiceField(choices=FailoverServerRoleChoices, required=False, allow_blank=True)
+    subnets = SubnetSerializer(nested=True, many=True, required=False)
+
+    class Meta:
+        model = FailoverRelationship
+        fields = (
+            *COMMON,
+            "name",
+            "primary_server",
+            "partner_server",
+            "mode",
+            "max_client_lead_time",
+            "load_balance_percent",
+            "reserve_percent",
+            "server_role",
+            "state_switch_interval",
+            "shared_secret_profile",
+            "subnets",
+            *PRIMARY_TAIL,
+        )
+        brief_fields = ("id", "url", "display", "name", "mode", "description")
+
+
+class MacFilterSerializer(PrimaryModelSerializer):
+    url = _url("macfilter")
+    dhcp_server = DHCPServerSerializer(nested=True)
+    list = ChoiceField(choices=MacFilterListChoices)
+
+    class Meta:
+        model = MacFilter
+        fields = (*COMMON, "dhcp_server", "mac_address", "list", *PRIMARY_TAIL)
+        brief_fields = ("id", "url", "display", "mac_address", "list", "description")
+
+
+class MacFilterListsSerializer(NetBoxModelSerializer):
+    url = _url("macfilterlists")
+    dhcp_server = DHCPServerSerializer(nested=True)
+
+    class Meta:
+        model = MacFilterLists
+        fields = (*COMMON, "dhcp_server", "allow_list_enabled", "deny_list_enabled", *TAIL)
+        brief_fields = ("id", "url", "display", "allow_list_enabled", "deny_list_enabled")
+
+
+class WindowsVendorOptionDefinitionSerializer(PrimaryModelSerializer):
+    url = _url("windowsvendoroptiondefinition")
+    vendor_class = WindowsClassSerializer(nested=True)
+
+    class Meta:
+        model = WindowsVendorOptionDefinition
+        fields = (
+            *COMMON,
+            "vendor_class",
+            "code",
+            "name",
+            "windows_type",
+            "multi_valued",
+            "default_value",
+            *PRIMARY_TAIL,
+        )
+        brief_fields = ("id", "url", "display", "code", "name", "description")
+
+
+class WindowsVendorOptionSerializer(NetBoxModelSerializer):
+    url = _url("windowsvendoroption")
+    definition = WindowsVendorOptionDefinitionSerializer(nested=True)
+    # Written as "app_label.model" plus assigned_object_id, read back with the parent nested, like netbox-plugin-dhcp
+    # options.
+    assigned_object_type = ContentTypeField(queryset=ContentType.objects.filter(VENDOR_OPTION_PARENTS))
+    assigned_object = serializers.SerializerMethodField(read_only=True)
+    user_class = WindowsClassSerializer(nested=True, required=False, allow_null=True)
+    policy = WindowsPolicySerializer(nested=True, required=False, allow_null=True)
+
+    class Meta:
+        model = WindowsVendorOption
+        fields = (
+            *COMMON,
+            "definition",
+            "assigned_object_type",
+            "assigned_object_id",
+            "assigned_object",
+            "user_class",
+            "policy",
+            "value",
+            *TAIL,
+        )
+        brief_fields = ("id", "url", "display", "value")
+
+    @extend_schema_field(serializers.JSONField(allow_null=True))
+    def get_assigned_object(self, instance):
+        if instance.assigned_object is None:
+            return None
+        serializer = get_serializer_for_model(instance.assigned_object)
+        return serializer(instance.assigned_object, nested=True, context={"request": self.context["request"]}).data
+
+
+class SyncRunSerializer(NetBoxModelSerializer):
+    url = _url("syncrun")
+    windows_server = WindowsServerSerializer(nested=True, read_only=True)
+    kind = ChoiceField(choices=SyncKindChoices, read_only=True)
+    status = ChoiceField(choices=SyncStatusChoices, read_only=True)
+    destination = ChoiceField(choices=ImportDestinationChoices, read_only=True)
+    job = JobSerializer(nested=True, read_only=True)
+
+    class Meta:
+        model = SyncRun
+        fields = (
+            *COMMON,
+            "windows_server",
+            "kind",
+            "status",
+            "job",
+            "started",
+            "completed",
+            "destination",
+            "branch_name",
+            "summary",
+            "error",
+            *TAIL,
+        )
+        read_only_fields = ("started", "completed", "branch_name", "summary", "error")
+        brief_fields = ("id", "url", "display", "kind", "status")
+
+
+class ImportProposalSerializer(NetBoxModelSerializer):
+    url = _url("importproposal")
+    windows_server = WindowsServerSerializer(nested=True, read_only=True)
+    sync_run = SyncRunSerializer(nested=True, read_only=True)
+    status = ChoiceField(choices=ProposalStatusChoices, read_only=True)
+
+    class Meta:
+        model = ImportProposal
+        fields = (*COMMON, "windows_server", "sync_run", "status", *TAIL)
+        brief_fields = ("id", "url", "display", "status")
+
+
+class ImportProposalItemSerializer(NetBoxModelSerializer):
+    url = _url("importproposalitem")
+    proposal = ImportProposalSerializer(nested=True, read_only=True)
+    action = ChoiceField(choices=ProposalItemActionChoices, read_only=True)
+    status = ChoiceField(choices=ProposalItemStatusChoices, read_only=True)
+    object_type = ContentTypeField(read_only=True)
+
+    class Meta:
+        model = ImportProposalItem
+        fields = (
+            *COMMON,
+            "proposal",
+            "action",
+            "status",
+            "kind",
+            "key",
+            "object_type",
+            "object_id",
+            "before",
+            "after",
+            "error",
+            *TAIL,
+        )
+        read_only_fields = ("kind", "key", "object_id", "before", "after", "error")
+        brief_fields = ("id", "url", "display", "action", "status")

netbox_windows_dhcp_plugin/api/urls.py

@@ -0,0 +1,25 @@
+from netbox.api.routers import NetBoxRouter
+
+from . import views
+
+app_name = "netbox_windows_dhcp_plugin"
+
+router = NetBoxRouter()
+router.register("windows-servers", views.WindowsServerViewSet)
+router.register("windows-scopes", views.WindowsScopeViewSet)
+router.register("windows-reservations", views.WindowsReservationViewSet)
+router.register("exclusion-ranges", views.ExclusionRangeViewSet)
+router.register("windows-classes", views.WindowsClassViewSet)
+router.register("windows-option-definitions", views.WindowsOptionDefinitionViewSet)
+router.register("windows-policies", views.WindowsPolicyViewSet)
+router.register("windows-option-qualifiers", views.WindowsOptionQualifierViewSet)
+router.register("failover-relationships", views.FailoverRelationshipViewSet)
+router.register("mac-filters", views.MacFilterViewSet)
+router.register("mac-filter-lists", views.MacFilterListsViewSet)
+router.register("vendor-option-definitions", views.WindowsVendorOptionDefinitionViewSet)
+router.register("vendor-options", views.WindowsVendorOptionViewSet)
+router.register("sync-runs", views.SyncRunViewSet)
+router.register("import-proposals", views.ImportProposalViewSet)
+router.register("import-proposal-items", views.ImportProposalItemViewSet)
+
+urlpatterns = router.urls

netbox_windows_dhcp_plugin/api/views.py

@@ -0,0 +1,196 @@
+from core.api.serializers import JobSerializer
+from django.db.models import Count
+from netbox.api.authentication import TokenWritePermission
+from netbox.api.viewsets import NetBoxModelViewSet, NetBoxReadOnlyModelViewSet
+from rest_framework.decorators import action
+from rest_framework.exceptions import PermissionDenied, ValidationError
+from rest_framework.response import Response
+
+from .. import filtersets, models, review
+from . import serializers
+
+
+def _viewset(model, queryset, base=NetBoxModelViewSet):
+    name = model.__name__
+    return type(
+        f"{name}ViewSet",
+        (base,),
+        {
+            "queryset": queryset,
+            "serializer_class": getattr(serializers, f"{name}Serializer"),
+            "filterset_class": getattr(filtersets, f"{name}FilterSet"),
+        },
+    )
+
+
+class WindowsServerViewSet(_viewset(models.WindowsServer, models.WindowsServer.objects.select_related("dhcp_server"))):
+    def get_permissions(self):
+        # NetBox maps POST to the "add" permission. A connection test needs "change" on the server instead,
+        # enforced below; here only check that the token may write (as NetBox does for render-config).
+        if self.action in ("test_connection", "run_import", "push", "dry_run"):
+            return [TokenWritePermission()]
+        return super().get_permissions()
+
+    def _changeable_server(self, request):
+        # A server the user may not change is reported as not found, like any restricted object.
+        self.queryset = models.WindowsServer.objects.restrict(request.user, "change").restrict(request.user, "view")
+        return self.get_object()
+
+    @action(detail=True, methods=["post"], url_path="test-connection")
+    def test_connection(self, request, pk):
+        """Queue a connection test and return the job."""
+        from ..jobs import TestConnectionJob
+
+        job = TestConnectionJob.enqueue(instance=self._changeable_server(request), user=request.user)
+        return Response(JobSerializer(job, context={"request": request}).data, status=202)
+
+    @action(detail=True, methods=["post"], url_path="import")
+    def run_import(self, request, pk):
+        """
+        Queue an import from the server and return the job (409 if one is already queued or running).
+
+        ``destination`` chooses where it writes: "branch" (a new or open import branch, the default with
+        netbox-branching), "current" (the branch named in ``branch``, or the request's active branch) or "main" with
+        it, "proposal" without it. A destination that is unknown here is a 400; one the user may not use is a 403.
+        """
+        from ..integrations import branching
+        from ..jobs import ImportRefused, enqueue_import, import_refusal
+
+        server = self._changeable_server(request)
+        data = request.data if hasattr(request.data, "get") else {}
+        destination = data.get("destination") or branching.import_destinations()[0]
+        if destination not in branching.import_destinations():
+            raise ValidationError({"destination": f"choose one of: {', '.join(branching.import_destinations())}"})
+        branch = ""
+        if destination == "current":
+            branch = data.get("branch") or branching.active_branch_name() or ""
+            if not branch:
+                raise ValidationError({"branch": "name the branch to import into, or send the request in a branch"})
+        missing = branching.missing_import_permissions(request.user, destination)
+        if missing:
+            raise PermissionDenied(f"importing needs the permission: {', '.join(missing)}")
+        refusal = import_refusal(destination, request.user, branch)
+        if refusal:
+            raise PermissionDenied(refusal)
+        try:
+            job = enqueue_import(server, request.user, destination, branch)
+        except ImportRefused:
+            # Allowed a moment ago (a setting or permission changed in between): the next try says why.
+            raise PermissionDenied("the import was refused; try again") from None
+        if job is None:
+            return Response({"detail": "an import from this server is already queued or running"}, status=409)
+        return Response(JobSerializer(job, context={"request": request}).data, status=202)
+
+    def _push(self, request, dry_run):
+        from ..jobs import enqueue_push
+
+        server = self._changeable_server(request)
+        if not dry_run and not server.sync_enabled:
+            return Response({"detail": "sync is disabled for this server"}, status=409)
+        job = enqueue_push(server, request.user, dry_run=dry_run)
+        if job is None:
+            what = "a dry run" if dry_run else "a push"
+            return Response({"detail": f"{what} for this server is already queued"}, status=409)
+        return Response(JobSerializer(job, context={"request": request}).data, status=202)
+
+    @action(detail=True, methods=["post"])
+    def push(self, request, pk):
+        """Queue a push to the server and return the job (409 if one is already waiting to run)."""
+        return self._push(request, dry_run=False)
+
+    @action(detail=True, methods=["post"], url_path="dry-run")
+    def dry_run(self, request, pk):
+        """Queue a dry run (plan a push without writing) and return the job."""
+        return self._push(request, dry_run=True)
+
+
+WindowsScopeViewSet = _viewset(models.WindowsScope, models.WindowsScope.objects.select_related("subnet"))
+WindowsReservationViewSet = _viewset(
+    models.WindowsReservation, models.WindowsReservation.objects.select_related("host_reservation")
+)
+ExclusionRangeViewSet = _viewset(models.ExclusionRange, models.ExclusionRange.objects.select_related("subnet"))
+WindowsClassViewSet = _viewset(models.WindowsClass, models.WindowsClass.objects.select_related("dhcp_server"))
+WindowsOptionDefinitionViewSet = _viewset(models.WindowsOptionDefinition, models.WindowsOptionDefinition.objects.all())
+WindowsPolicyViewSet = _viewset(models.WindowsPolicy, models.WindowsPolicy.objects.select_related("dhcp_server"))
+WindowsOptionQualifierViewSet = _viewset(models.WindowsOptionQualifier, models.WindowsOptionQualifier.objects.all())
+FailoverRelationshipViewSet = _viewset(
+    models.FailoverRelationship, models.FailoverRelationship.objects.prefetch_related("subnets")
+)
+MacFilterViewSet = _viewset(models.MacFilter, models.MacFilter.objects.select_related("dhcp_server"))
+MacFilterListsViewSet = _viewset(models.MacFilterLists, models.MacFilterLists.objects.select_related("dhcp_server"))
+WindowsVendorOptionDefinitionViewSet = _viewset(
+    models.WindowsVendorOptionDefinition, models.WindowsVendorOptionDefinition.objects.select_related("vendor_class")
+)
+WindowsVendorOptionViewSet = _viewset(
+    models.WindowsVendorOption,
+    models.WindowsVendorOption.objects.select_related(
+        "definition__vendor_class", "assigned_object_type", "user_class", "policy"
+    ).prefetch_related("assigned_object"),
+)
+SyncRunViewSet = _viewset(models.SyncRun, models.SyncRun.objects.all(), base=NetBoxReadOnlyModelViewSet)
+
+
+class _ReviewActionsMixin:
+    """Apply or dismiss proposal items as the requesting user (see review.py for the permission rules)."""
+
+    def get_permissions(self):
+        # POST would map to "add"; these actions need "change", enforced through the restricted querysets below.
+        if self.action in ("apply", "dismiss"):
+            return [TokenWritePermission()]
+        return super().get_permissions()
+
+    def _review(self, request, items, dismiss):
+        items = review.open_items(items)
+        if dismiss:
+            return Response({"dismissed": review.dismiss(request.user, items)})
+        applied, failed, denied = review.apply(request.user, items)
+        return Response({"applied": applied, "failed": failed, "missing_permissions": denied})
+
+
+# The item count is an aggregate, and Django drops Meta.ordering on aggregate queries, so order explicitly
+# (the API paginator rejects an unordered queryset).
+class ImportProposalViewSet(
+    _ReviewActionsMixin,
+    _viewset(
+        models.ImportProposal,
+        models.ImportProposal.objects.annotate(item_count=Count("items")).order_by("-created"),
+        base=NetBoxReadOnlyModelViewSet,
+    ),
+):
+    def _proposal(self, request):
+        # NetBox has already restricted the queryset to "add" (what POST maps to); start again from "change".
+        self.queryset = models.ImportProposal.objects.restrict(request.user, "change").restrict(request.user, "view")
+        return self.get_object()
+
+    @action(detail=True, methods=["post"])
+    def apply(self, request, pk):
+        """Apply every pending item of the proposal."""
+        items = self._proposal(request).items.restrict(request.user, "change")
+        return self._review(request, items, dismiss=False)
+
+    @action(detail=True, methods=["post"])
+    def dismiss(self, request, pk):
+        """Dismiss every pending item of the proposal."""
+        items = self._proposal(request).items.restrict(request.user, "change")
+        return self._review(request, items, dismiss=True)
+
+
+class ImportProposalItemViewSet(
+    _ReviewActionsMixin,
+    _viewset(models.ImportProposalItem, models.ImportProposalItem.objects.all(), base=NetBoxReadOnlyModelViewSet),
+):
+    def _selected(self, request):
+        ids = request.data.get("ids") if isinstance(request.data, dict) else None
+        if not isinstance(ids, list) or not all(isinstance(i, int) for i in ids):
+            raise ValidationError({"ids": "a list of item IDs is required"})
+        return models.ImportProposalItem.objects.restrict(request.user, "change").filter(pk__in=ids)
+
+    @action(detail=False, methods=["post"])
+    def apply(self, request):
+        """Apply the items listed in {"ids": [...]}."""
+        return self._review(request, self._selected(request), dismiss=False)
+
+    @action(detail=False, methods=["post"])
+    def dismiss(self, request):
+        """Dismiss the items listed in {"ids": [...]}."""
+        return self._review(request, self._selected(request), dismiss=True)