Cannot Remove Authentication > Tokens access with permissions

[Pythbit]

NetBox version

v3.6.0

Python version

3.10

Steps to Reproduce

1. Create user with very limited access permissions (e.g view DCIM > Circuits)
2. Login with user
3. Admin > Authentication > API Tokens still visible

Expected Behavior

API Tokens and Admin tabs should be hidden without permissions to view them.

Observed Behavior

Option is visible in navigation bar

I notice the affected page is /user/tokens/ as opposed to /user/api-tokens and I'm not sure if one is a replacement for the other or what the plans may be here.

[jeremystretch]

Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.

[Pythbit]

re-opened and modified description. Was able to recreate on the demo as well.

[jeremystretch]

This is happening because display of the menu option is controlled by the users.view_token permission, which is assigned to all users by default. (The permission is constrained such that each user can view only their own API tokens.)

While the view itself is practically identical to the individual account view at /user/api-tokens/ for users without any additional permissions, I agree that it doesn't make sense to make it available in the menu.

[jeremystretch]

Marking this as blocked by #13638 for now. Hoping to have that implemented very soon.