Validate REST script input before enqueueing jobs. Resolve ObjectVar
IDs to model instances and MultiObjectVar IDs to querysets, returning
HTTP 400 with errors nested under data when validation fails.
Share form preparation between the API and UI, including multi-value
defaults, while keeping validation out of the job runner to preserve
other execution paths. Exclude only known execution fields from script
data and prevent _notifications from leaking into CLI script input.
Document the REST compatibility changes, including required-field
validation and discarded undeclared keys. Add regression coverage for
object resolution, defaults, validation errors, and execution options.
Co-authored-by: Martin Burggraf <martin.burggraf@netclusive.com>
Resolves all conflicts between main and feature for #22896. Notable
resolutions:
- dcim/signals.py, dcim/tests/test_signals.py: main's cache_presave_scope_fields
/ sync_cached_scope_fields addition is fully superseded by feature's
PostgreSQL-trigger-based denormalization (confirmed via feature's own
migration docstrings); dropped in favor of feature's existing approach.
Both files now match feature's originals exactly.
- netbox/tables/columns.py: combined main's generic get_ordering_annotation()
protocol with feature's nulls_first-aware order() override. These two
mechanisms cannot both apply to the same column (django-tables2 negates an
entire order_by tuple uniformly on direction toggle, so a fixed nulls_first
placement and multi-column sort composition are mutually exclusive for one
column) -- preserved nulls_first (existing, wired through forms/API/GraphQL)
and removed main's two composition-only tests for CustomFieldColumn. See the
comment on CustomFieldColumn.order() for full reasoning.
- extras/customfields.py, extras/graphql/mixins.py: combined main's
request-cache optimization and has_key-scoped batch updates with feature's
resolve_selection_value() (shared select-field label resolution between
REST and GraphQL).
- extras/events.py, extras/event_rules.py: main's "Honor Script defaults when
triggered by Event Rules" (#22852) fix was written against the old inline
action-type dispatch, which feature had already replaced with a pluggable
action-provider registry (#22770). Re-applied the same two-line fix
(notifications/job_timeout) inside ScriptAction.enqueue() in event_rules.py
instead.
- utilities/jinja2.py: fixed a config-attribute name mismatch the raw merge
would have introduced (main's JINJA2_FILTERS vs feature's renamed
JINJA_FILTERS) by updating the shared _jinja2_filters() helper.
- ipam/migrations/: renumbered main's 0094_ipaddress_host_index to 0096 and
added a merge migration, since main and feature had each independently
added a migration numbered 0094.
- dcim/tests/query_counts.json: regenerated via UPDATE_QUERY_COUNTS=1 against
the merged codebase rather than hand-merging counts.
Verified: manage.py check clean, full migration graph applies cleanly from
scratch, ruff clean, and full test suites pass for dcim, ipam, netbox, extras,
circuits, vpn, wireless, tenancy, virtualization, core, users, and account
(fresh databases, no state carried over between runs).
Scripts triggered by Event Rules now respect notifications_default and
job_timeout from script Meta class. Updates documentation to clarify
this behavior and adds regression test coverage.
Fixes#22852
Add PUT/PATCH support to ScriptModuleViewSet for replacing Script Module
content in place. Modules can be addressed by numeric ID or file name,
and the uploaded file name must match the existing file path.
The module's scripts are re-synchronized from the new content after
successful update.
Fixes#22544
Adds warning and examples for validating NetBox objects before saving
in Custom Scripts. Direct ORM writes bypass UI/API validation and can
introduce invalid data. Recommends calling `full_clean()` explicitly.
Fixes#22249
* #21701 allow upload script via API
* #21701 allow upload script via API
* add extra test
* change to use Script api endpoint
* ruff fix
* review feedback:
* review feedback:
* review feedback:
* Fix permission check, perform_create delegation, and test mock setup
- destroy() now checks extras.delete_script (queryset is Script.objects.all())
- create() delegates to self.perform_create() instead of calling serializer.save() directly
- Add comment explaining why update/partial_update intentionally return 405
- Fix test_upload_script_module: set mock_storage.save.return_value so file_path
receives a real string after the _save_upload return-value fix; add DB existence check
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Return 400 instead of 500 on duplicate script module upload
Catch IntegrityError from the unique (file_root, file_path) constraint
and re-raise as a ValidationError so the API returns a 400 with a clear
message rather than a 500.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Validate upload_file + data_source conflict for multipart requests
DRF 3.16 Serializer.get_value() uses parse_html_dict() or empty for all
HTML/multipart input. A flat key like data_source=2 produces an empty
dict ({}), which is falsy, so it falls back to empty and the nested
field is silently skipped. data.get('data_source') is therefore always
None in multipart requests, bypassing the conflict check.
Fix: also check self.initial_data for data_source and data_file in all
three guards in validate(), so the raw submitted value is detected even
when DRF's HTML parser drops the deserialized object.
Add test_upload_with_data_source_fails to cover the multipart conflict
path explicitly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Require data_file when data_source is specified
data_source alone is not a valid creation payload — a data_file must
also be provided to identify which file within the source to sync.
Add the corresponding validation error and a test to cover the case.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Align ManagedFileForm validation with API serializer rules
Add the missing checks to ManagedFileForm.clean():
- upload_file + data_source is rejected (matches API)
- data_source without data_file is rejected with a specific message
- Update the 'nothing provided' error to mention data source + data file
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Revert "Align ManagedFileForm validation with API serializer rules"
This reverts commit f0ac7c3bd2.
* Align API validation messages with UI; restore complete checks
- Match UI error messages for upload+data_file conflict and no-source case
- Keep API-only guards for upload+data_source and data_source-without-data_file
- Restore test_upload_with_data_source_fails
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Run source/file conflict checks before super().validate() / full_clean()
super().validate() calls full_clean() on the model instance, which raises
a unique-constraint error for (file_root, file_path) when file_path is
empty (e.g. data_source-only requests). Move the conflict guards above the
super() call so they produce clear, actionable error messages before
full_clean() has a chance to surface confusing database-level errors.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* destroy() deletes ScriptModule, not Script
DELETE /api/extras/scripts/<pk>/ now deletes the entire ScriptModule
(matching the UI's delete view), including modules with no Script
children (e.g. sync hasn't run yet). Permission check updated to
delete_scriptmodule. The queryset restriction for destroy is removed
since the module is deleted via script.module, not super().destroy().
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* review feedback:
* cleanup
* cleanup
* cleanup
* cleanup
* change to ScriptModule
* change to ScriptModule
* change to ScriptModule
* update docs
* cleanup
* restore file
* cleanup
* cleanup
* cleanup
* cleanup
* cleanup
* keep only upload functionality
* cleanup
* cleanup
* cleanup
* change to scripts/upload api
* cleanup
* cleanup
* cleanup
* cleanup
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* 16050 Show script python_class name and description
* 16050 change to use Meta.description
* 16050 change to use Meta.description
* 16050 remove module name customization from docs
* Fixes#15812: Add Date(Time)Var for scripts to allow much easier date input
* Extend tests for invalid data
---------
Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com>
* Initial work on #13283
* Enable passing TomSelect HTML template attibutes on DynamicModelChoiceField
* Merge disabled_indicator into option_attrs
* Add support for annotating a numeric count on dropdown options
* Annotate parent object on relevant fields
* Improve rendering of color options
* Improve rendering of color options
* Rename option_attrs to context
* Expose option context on ObjectVar for custom scripts
* Document dropdown context variables
Arthur Hanson
Jeremy Stretch
Brian Tiemann
bctiemann
Martin Hauser
Jason Satein
mburggraf
mburggraf
Jamie (Bear) Murphy
Grische
Martin Hauser
Kyer
mr1716
samk-acw
JCWasmx86