How to map permissions constraints to branches?

[dakotah-hurda]

Hi all,

I see the plugin has permissions for CRUD actions on branches themselves, but that is not necessarily in-scope of what I'm asking for.

I'm looking for a way to restrict my technicians to only being able to update objects on non-Main branches. For example, techs can add/update/delete any Devices on ANY branch except 'Main'.

It seems to me the way to do this is to use Permissions Constraints and give access on all relevant objects, with a constraint that identifies "only objects on non-Main" branches.

I started playing around with the nbshell utility to try identifying the specific Django queryset(s) needed, but am coming up short.

Can anyone provide guidance on how to restrict users in this capacity?

[mrmrcoleman]

Hey @dakotah-hurda

CRUD actions are global across main and branches. You may be able to solve this with Permission Constraints but that's not something we've spent time on.

One approach we have seen is to allow users to write any changes to a branch, but limit who can merge branches, so the contents of the branch can be checked first. I believe these are the correct settings:

Please note that this will mean that the users will not be able to change the description of the branch either.

[dakotah-hurda]

Thanks @mrmrcoleman !

Unless I misunderstand, this doesn't solve the objective - I don't want these restricted users to be able to write to 'Main' at all. Only privileged users should be able to.

I guess the closest analog I can think of is 'branch protection rules' here on GitHub. For example, Restricted Users can open branches and PRs, but only Code Owners/Admins can approve the PRs/merges.

A follow-up question for you - How can I find a list of 'additional actions' like the sync action you have in your example?

[mrmrcoleman]

Hey @dakotah-hurda you're right, my suggestion doesn't fully solve your problem.

The ability to protect main fully ("protected main") is possible in NetBox Change Management, when used along side NetBox Branching. Change Management is going into preview this week (I don't have the exact day yet) so keep an eye out of that.

A follow-up question for you - How can I find a list of 'additional actions' like the sync action you have in your example?

That's a very good question. I'll come back to you.

[mrmrcoleman]

Ok, so finding the list of available Additional Actions requires a bit of sleuthing. Check the documentation here for the general idea:

https://netboxlabs.com/docs/netbox/en/stable/administration/permissions/

In the case of the branching plugin you can check in the API Views:

netbox-branching/netbox_branching/api/views.py

Line 34 in c09c862

def sync(self, request, pk):

[dakotah-hurda]

@mrmrcoleman I wasn't aware of Change Management coming out soon, glad to hear! I look forward to it.

& thanks for linking the source code, I do get a little lost in the nuances sometime. I've started learning Django framework to understand the app as a whole, and while it helps, I'm still pretty new and prone to getting lost.

Thanks again for your help!