Restrict editing of IP addresses to specific prefix

[clerie]

I want to allow specific users editing IP address objects within some prefixes. So naturally I would add a permission with something like the following constraint:

{ "prefix__tenant__slug": "mycustomer" }

But there is no relationship between IP address objects and prefixes. How could I achieve such a behaviour instead?

[CTV-2023]

With specific tags on these IP maybe ?
Specific permission applied to the user/a group granting "change" on "ipam | IP address" with constraint
{"tags__name": "mycustomer"}

[clerie]

How would that read only custom field help restricting the creation of IP address objects within a specific prefix only?

[CTV-2023]

Forget customfields, settings permissions for them seems to be complicated.
I made another test with a tenant called "mycustomer". Assign the IP address to it
For my user profile, I chose a readonly permission for everything
And a custom permission applied on "ipam | IP address" allowing to "change" and with constraint {"tenant__slug": "mycustomer"}
Of course if you need your customer to be able to create IP addresses this is more complex

[clerie]

The mentioned constraint is fine for viewing IP address objects, but for write permission this would allow creating any IP address as long as it is referencing the tenant. This is bad because they could create IP addresses in our backbone range which is bad.

[CTV-2023]

Yes, that's why I didn't allow "create", only "change" existing IP addresses. I don't think your use case is currently possible in Netbox (pure RBAC)

[clerie]

As far as I know, permissions are per object. But you can change the IP address of the IP address object afterwards and it keeps the object id. That means you can't allow editing for IP addresses at all.

Do you have any idea how to implement this instead of adding an additional foreign key?