Can't create prefix via available-prefixes API endpoint with all needed constraint permissions

[Dimaqa]

Environment

• Python version: 3.6.9
• NetBox version: 2.10.3

Steps to Reproduce

1. As admin create active prefix
2. Create permission to view all prefixes
3. Create permission to add reserved prefix
4. As test user with permissions above POST on /api/ipam/prefixes/{created_active_prefix_id}/available-prefixes/ with body {"status" : "reserved", "prefix_length" : 24}
5. API will return 404 NOT FOUND error
6. GET on /api/ipam/prefixes/{created_active_prefix_id}/available-prefixes/ works fine

Expected Behavior

Create reserved child prefix.

Observed Behavior

NOT FOUND error

This is related to #5841, but deserves separate bugreport.
Creation via web interface works fine.

[DanSheps]

So just so we are clear. The test user has the following permissions:

• View all prefixes
• Create prefixes with status "reserved" (only)

[Dimaqa]

Yes, that's right.

[jeremystretch]

The 404 is returned due to a permissions failure. DRF is checking the necessary permissions (POST, status=reserved) against the parent prefix object rather than the one being created. I'm not sure how to properly adjust the permissions evaluation.

As a workaround, you can request the next available prefix using GET, and then create it directly using a POST to the /api/ipam/prefixes/ endpoint.

[Dimaqa]

Can't you override permission_classes in PrefixViewSet with custom permission class with same idea as in def get_serializer_class(self):? Because it's not that simple to ensure parrallel lock in your workaround

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.