From edbfd0bae6b44ccd28a25bc731d17c4c153ea715 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Mon, 12 Jan 2026 16:40:42 -0500 Subject: [PATCH] Fixes #21117: Avoid exception when attempting to create v2 token without API_TOKEN_PEPPERS defined (#21132) --- netbox/users/models/tokens.py | 3 +++ netbox/users/tests/test_models.py | 12 +++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/netbox/users/models/tokens.py b/netbox/users/models/tokens.py index bf51d6ef8..bc2fe197d 100644 --- a/netbox/users/models/tokens.py +++ b/netbox/users/models/tokens.py @@ -213,6 +213,9 @@ class Token(models.Model): def clean(self): super().clean() + if self.version == TokenVersionChoices.V2 and not settings.API_TOKEN_PEPPERS: + raise ValidationError(_("Unable to save v2 tokens: API_TOKEN_PEPPERS is not defined.")) + if self._state.adding: if self.pepper_id is not None and self.pepper_id not in settings.API_TOKEN_PEPPERS: raise ValidationError(_( diff --git a/netbox/users/tests/test_models.py b/netbox/users/tests/test_models.py index 367a82373..df3192260 100644 --- a/netbox/users/tests/test_models.py +++ b/netbox/users/tests/test_models.py @@ -1,9 +1,10 @@ from datetime import timedelta from django.core.exceptions import ValidationError -from django.test import TestCase +from django.test import TestCase, override_settings from django.utils import timezone +from users.choices import TokenVersionChoices from users.models import User, Token from utilities.testing import create_test_user @@ -94,6 +95,15 @@ class TokenTest(TestCase): token.refresh_from_db() self.assertEqual(token.description, 'New Description') + @override_settings(API_TOKEN_PEPPERS={}) + def test_v2_without_peppers_configured(self): + """ + Attempting to save a v2 token without API_TOKEN_PEPPERS defined should raise a ValidationError. + """ + token = Token(version=TokenVersionChoices.V2) + with self.assertRaises(ValidationError): + token.clean() + class UserConfigTest(TestCase):