[Feature] Limit attachments to specific models

[llamafilm]

Hello! I'd like to allow attachments only on Device Types. I don't want users to be able to add attachments to Devices. My primary use case is datasheets, and I'm afraid that if users are able to add in both places, they will make mistakes.

[Kani999]

I'll take a look on how to extend the PLUGIN_CONFIG to support specifying certain models.

PLUGINS_CONFIG = {
    'netbox_attachments': {
        'apps': ['dcim', 'ipam', 'circuits', 'tenancy', 'virtualization', 'wireless', 'inventory_monitor'],
        'display_default': "right_page",
        'display_setting': {'ipam.vlan': "left_page", 'dcim.device': "full_width_page", 'dcim.devicerole': "full_width_page", 'inventory_monitor.probe': "additional_tab"}
    }
}

[matejv]

That would be a useful feature for us as well.

I have figured out a workaround: if you set display_setting to some unsupported value for models you want hidden, it won't show on GUI. This won't prevent adding attachments via some other methods (like from scripts or via API), but is good enough for us.

Example config:

PLUGINS_CONFIG = {
    'netbox_attachments': {
        'apps': ['dcim',],
        'display_setting': {
            'dcim.devicetype': "full_width_page",
            'dcim.device': "hidden",
        },
    },

You'll have to list all models under dcim you want to hide attachments from unfortunately.

[Omripresent]

This would be a real nice to have.

The way I see this implemented is repurposing the 'apps' config to match either apps or app.models going by the more permissive option. This line would change from https://github.com/Kani999/netbox-attachments/blob/af39413d26f46ed6d4fe8a276ed850cd4eea1ccb/netbox_attachments/template_content.py#L118 to

if app_label not in plugin_settings.get("apps") or app_model_name not in plugin_settings.get("apps"):

And I would also add some validation code here: https://github.com/Kani999/netbox-attachments/blob/af39413d26f46ed6d4fe8a276ed850cd4eea1ccb/netbox_attachments/views.py#L32-L40

o = ObjectType.objects.get(pk=request.GET.get("object_type"))
if o.app_label not in plugin_settings.get("apps") and f'{o.app_label}.{o.model}' not in plugin_settings.get("apps"):
    return SomeUnauthorizedResponse

[Kani999]

@Omripresent @llamafilm @matejv

Could you please review the changes in PR #78? I have added more configuration settings to switch between the permissive and restrictive modes for displaying the Attachment plugin.

I have not yet added the validations as suggested by @Omripresent.

[Omripresent]

That looks good for the WebUI and settings portion. You could make the config options more concise since depending on the mode you have one or the other config part ignored (between the apps vs allowed_models).

Refactoring the mode into something like applied_scope with values of (app|model) and merging apps and allowed_models into scope_filter that depending on the selected mode should be the list of apps or app.models.

[Kani999]

Hi @Omripresent,

Thank you for your suggestions. I have implemented the changes as you requested.

• Refactored mode into applied_scope with values of app or model.
• Merged apps and allowed_models into scope_filter that holds a list of apps or app.models depending on the selected mode.

You can see the changes in the commit 607d5e1.

[Kani999]

And I would also add some validation code here:

netbox-attachments/netbox_attachments/views.py

Lines 32 to 40 in af39413 def alter_object(self, instance, request, args, kwargs): if not instance.pk: # Assign the parent object based on URL kwargs instance.object_type = get_object_or_404( ObjectType, pk=request.GET.get("object_type") ) instance.object_id = request.GET.get("object_id")

 return instance 

o = ObjectType.objects.get(pk=request.GET.get("object_type")) if o.app_label not in plugin_settings.get("apps") and f'{o.app_label}.{o.model}' not in plugin_settings.get("apps"): return SomeUnauthorizedResponse

I have created a new issue #81 for the proposed changes to add validation for creating attachments.

[Omripresent]

First let me say thank you for working on this and taking input! I really appreciate it. The config changes look good and I think make sense from a admin/user perspective, I hope the other folk on this thread would agree or have input but I'm happy with the update.