feat: OBS-406 - [Netbox Diode Plugin] Secure NetBox diode plugin API endpoints

[Julio-Oliveira-Encora]

Added the permission classes IsAuthenticated and IsDiodeViewer] for ObjectStateView.
It checks if the user is authenticated and if the user has permissions according to the "object_type" parameter.
Also, check if the request is GET.

[linear]

OBS-406 Secure NetBox diode plugin API endpoints

NetBox Diode plugin API endpoints need to be secured.

We should consider setting dedicated permissions per API endpoint/view, so we can decide if NetBox user can perform specific operations.

Example use of custom permissions per view: https://github.com/netbox-community/netbox/blob/develop/netbox/virtualization/views.py#L651-L652

[mfiedorowicz]

Alternative to avoid the need to check for individual objects permissions:

1. Create netbox_diode_plugin/models.py:

#!/usr/bin/env python
# Copyright 2024 NetBox Labs Inc
"""Diode Netbox Plugin - Models."""

from django.db import models


class ObjectState(models.Model):
    """
    Dummy model used to generate permissions for Diode NetBox Plugin. Does not exist in the database.
    """

    class Meta:
        managed = False

        default_permissions = ()
        
        permissions = (
            ("view_objectstate", "Can view ObjectState"),
        )

2. In your permissions.py:

#!/usr/bin/env python
# Copyright 2024 NetBox Labs Inc
"""Diode Netbox Plugin - API Permissions."""

from rest_framework.permissions import SAFE_METHODS, BasePermission


class IsDiodeViewer(BasePermission):
    """
    Custom permission to allow users that has permissions to view the object type.

    For example, if the request contains "object_type=dcim.site" and the user has this permission, he can see the object.
    """

    def has_permission(self, request, view):
        """Check if the request is in SAFE_METHODS and user has netbox_diode_plugin.view_objectstate permission."""

        return request.method in SAFE_METHODS and request.user.has_perm(f'netbox_diode_plugin.view_objectstate')

NetBox permission with our ObjectState object based on dummy model:

What do you think?