Permissions to add/delete/edit contact objects

[stideswell]

What is the permission required to allow authenticated users to add/delete/edit contact objects? I cannot see anything in the list of permissions that looks appropriate.

Is there a document that lists all of the object types and their associated permissions? Or is there a way to check this by looking at the code?

I am using Netbox 3.1.6 (planning to upgrade shortly, which is why I have changed from using contact fields on objects to contact objects themselves).

[stideswell]

Actually, I can see what look to be appropriate permissions in the auth_permission table.

netbox=# select * from auth_permission where name ~* '.*contact.*';
id | name | content_type_id | codename
-----+-------------------------------+-----------------+--------------------------
412 | Can add contact role | 104 | add_contactrole
413 | Can change contact role | 104 | change_contactrole
414 | Can delete contact role | 104 | delete_contactrole
415 | Can view contact role | 104 | view_contactrole
416 | Can add contact group | 105 | add_contactgroup
417 | Can change contact group | 105 | change_contactgroup
418 | Can delete contact group | 105 | delete_contactgroup
419 | Can view contact group | 105 | view_contactgroup
420 | Can add contact | 106 | add_contact
421 | Can change contact | 106 | change_contact
422 | Can delete contact | 106 | delete_contact
423 | Can view contact | 106 | view_contact
424 | Can add contact assignment | 107 | add_contactassignment
425 | Can change contact assignment | 107 | change_contactassignment
426 | Can delete contact assignment | 107 | delete_contactassignment
427 | Can view contact assignment | 107 | view_contactassignment
(16 rows)

But these are not visible in the "Netbox Administration" (DjDT) UI?

[candlerb]

It does exist in the GUI in 3.6.3:

So if you're planning to upgrade to this anyway, you shouldn't have a problem.

Aside: The permissions I create and use are in users_objectpermission and related tables. I'm not sure what the auth_permission table is used for these days, if anything. The only reference I can find to it in Netbox source code is in create_test_user here and here, and the only calls of that function don't pass any permission argument. I suspect this could be trimmed.

[stideswell]

Interestingly, I also have the users_objectpermission table, but there are no contact object entries within.

netbox=# select * from users_objectpermission where name ~* '.contact.';
id | name | description | enabled | constraints | actions
----+------+-------------+---------+-------------+---------
(0 rows)

[candlerb]

Sure. Those are the permissions you create yourself via the web interface, and then assign to users or groups. Each permission can refer to a group of object types, a set of contraints, and a set of allowed actions. (It's been like this since v2.9.0 I believe)

Documentation: https://docs.netbox.dev/en/stable/administration/permissions/

[stideswell]

I can confirm that once I upgraded from v3.1.6 to v3.6.4 the permissions are migrated from the Django admin UI to the Netbox UI itself and the full range of permission options (including contact objects) are available.