fix: restrict license email notification settings

netbox_slm/__init__.py

@@ -17,7 +17,7 @@ limitations under the License.
 from netbox.plugins import PluginConfig
 from django.utils.translation import gettext_lazy as _
 
-__version__ = "1.12.0"
+__version__ = "1.12.1"
 
 
 class SLMConfig(PluginConfig):

netbox_slm/api/serializers.py

@@ -54,6 +54,16 @@ class SoftwareLicenseSerializer(NetBoxModelSerializer):
         return f"{obj}"
 
     def validate(self, attrs):
+        request = self.context.get("request")
+        if (
+            "email_notifications" in attrs
+            and request is not None
+            and not request.user.has_perm("netbox_slm.manage_softwarelicense_email_notifications")
+        ):
+            raise serializers.ValidationError(
+                {"email_notifications": _("You do not have permission to change email notifications.")}
+            )
+
         tenant_group = attrs.get("tenant_group", getattr(self.instance, "tenant_group", None))
         tenant = attrs.get("tenant", getattr(self.instance, "tenant", None))
         if tenant_group and tenant and tenant.group_id != tenant_group.pk:

netbox_slm/locale/de/LC_MESSAGES/django.po

@@ -408,3 +408,12 @@ msgstr "Lizenzen"
 
 msgid "Licence Management NetBox Plugin."
 msgstr "NetBox-Plugin zur Lizenzverwaltung."
+
+msgid "Can manage license email notifications"
+msgstr "Kann E-Mail-Benachrichtigungen für Lizenzen verwalten"
+
+msgid "You do not have permission to change email notifications."
+msgstr "Sie haben keine Berechtigung, E-Mail-Benachrichtigungen zu ändern."
+
+msgid "Only administrators or explicitly authorized users can change this setting."
+msgstr "Nur Administratoren oder ausdrücklich berechtigte Benutzer können diese Einstellung ändern."

netbox_slm/migrations/0014_softwarelicense_email_notification_permission.py

@@ -0,0 +1,23 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("netbox_slm", "0013_license_expiration_notifications"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="softwarelicense",
+            options={
+                "permissions": [
+                    (
+                        "manage_softwarelicense_email_notifications",
+                        "Can manage license email notifications",
+                    )
+                ],
+                "verbose_name": "software license",
+                "verbose_name_plural": "software licenses",
+            },
+        ),
+    ]

netbox_slm/models.py

@@ -267,6 +267,9 @@ class SoftwareLicense(NetBoxModel):
     class Meta:
         verbose_name = _("software license")
         verbose_name_plural = _("software licenses")
+        permissions = [
+            ("manage_softwarelicense_email_notifications", _("Can manage license email notifications")),
+        ]
 
     def __str__(self):
         return self.name

netbox_slm/views/software_license.py

@@ -1,9 +1,34 @@
 from netbox.views import generic
+from django.utils.translation import gettext_lazy as _
 from netbox_slm import filtersets, forms, tables
 from netbox_slm.models import SoftwareLicense
 from utilities.views import register_model_view
 
 
+class EmailNotificationPermissionMixin:
+    """Prevent users without the dedicated permission from changing SMTP delivery."""
+
+    email_permission = "netbox_slm.manage_softwarelicense_email_notifications"
+
+    def dispatch(self, request, *args, **kwargs):
+        form_attribute = "model_form" if hasattr(self, "model_form") else "form"
+        base_form = getattr(self, form_attribute)
+        can_manage_email = request.user.has_perm(self.email_permission)
+
+        class PermissionAwareForm(base_form):
+            def __init__(self, *form_args, **form_kwargs):
+                super().__init__(*form_args, **form_kwargs)
+                if not can_manage_email and "email_notifications" in self.fields:
+                    field = self.fields["email_notifications"]
+                    field.disabled = True
+                    field.help_text = _(
+                        "Only administrators or explicitly authorized users can change this setting."
+                    )
+
+        setattr(self, form_attribute, PermissionAwareForm)
+        return super().dispatch(request, *args, **kwargs)
+
+
 @register_model_view(SoftwareLicense, "list", path="", detail=False)
 class SoftwareLicenseListView(generic.ObjectListView):
     queryset = SoftwareLicense.objects.all()
@@ -19,7 +44,7 @@ class SoftwareLicenseView(generic.ObjectView):
 
 @register_model_view(SoftwareLicense, "add", detail=False)
 @register_model_view(SoftwareLicense, "edit")
-class SoftwareLicenseEditView(generic.ObjectEditView):
+class SoftwareLicenseEditView(EmailNotificationPermissionMixin, generic.ObjectEditView):
     queryset = SoftwareLicense.objects.all()
     form = forms.SoftwareLicenseForm
 
@@ -30,13 +55,13 @@ class SoftwareLicenseDeleteView(generic.ObjectDeleteView):
 
 
 @register_model_view(SoftwareLicense, "bulk_import", detail=False)
-class SoftwareLicenseBulkImportView(generic.BulkImportView):
+class SoftwareLicenseBulkImportView(EmailNotificationPermissionMixin, generic.BulkImportView):
     queryset = SoftwareLicense.objects.all()
     model_form = forms.SoftwareLicenseBulkImportForm
 
 
 @register_model_view(SoftwareLicense, "bulk_edit", path="edit", detail=False)
-class SoftwareLicenseBulkEditView(generic.BulkEditView):
+class SoftwareLicenseBulkEditView(EmailNotificationPermissionMixin, generic.BulkEditView):
     queryset = SoftwareLicense.objects.all()
     filterset = filtersets.SoftwareLicenseFilterSet
     table = tables.SoftwareLicenseTable