From efdcaf9911a87fd2551d110d6ab1359a5c7e6a61 Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 11:11:37 +0200
Subject: [PATCH 1/6] Add Add-button on Typed tabs with reverse-reference
 prefill (closes #9)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Each Typed tab now shows an "Add <Type>" button in the bottom toolbar
(alongside Bulk Edit and Bulk Delete) that opens the native
customobject_add view with the reverse-reference field pre-filled to the
parent object's PK and return_url set back to the tab. After saving, the
user lands back on the same tab, with any active filters preserved.

When a Custom Object Type has multiple fields referencing the same
parent model (e.g. primary_device and backup_device both point at
Device), the button becomes a split-dropdown listing each field. The
button is hidden for users without add_customobject permission.

Tabs with hide_if_empty=True remain hidden until the first object is
created via the native menu — subsequent additions can use the new
button. The button sits in the same .btn-list as the existing bulk
action buttons at full button size (no btn-sm) so heights match.
---
 .../netbox_custom_objects_tab/typed/tab.html  |  28 +-
 netbox_custom_objects_tab/views/typed.py      |  65 +++-
 tests/conftest.py                             |  65 ++--
 tests/settings.py                             |  12 +-
 tests/test_views_typed_smoke.py               | 294 +++++++++++++++---
 5 files changed, 383 insertions(+), 81 deletions(-)

diff --git a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
index 3ad9097..400d2ce 100644
--- a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
+++ b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
@@ -5,7 +5,6 @@
 {% load i18n %}
 {% block content %}
     {% if table %}
-        <hr class="mt-0 mb-3">
         {# Results / Filters inner tabs #}
         <ul class="nav nav-tabs custom-objects-subtabs mb-3" role="tablist">
             <li class="nav-item" role="presentation">
@@ -92,8 +91,33 @@
                     <div class="card">
                         <div class="htmx-container table-responsive" id="object_list">{% include 'htmx/table.html' %}</div>
                     </div>
-                    {# Bulk action buttons #}
+                    {# Add button + bulk action buttons #}
                     <div class="btn-list d-print-none">
+                        {% if can_add and add_links %}
+                            {% if add_links|length == 1 %}
+                                <a href="{{ add_links.0.url }}" class="btn btn-primary">
+                                    <i class="mdi mdi-plus-thick"></i>
+                                    {% blocktrans with label=add_label %}Add {{ label }}{% endblocktrans %}
+                                </a>
+                            {% else %}
+                                <div class="btn-group">
+                                    <button type="button"
+                                            class="btn btn-primary dropdown-toggle"
+                                            data-bs-toggle="dropdown"
+                                            aria-expanded="false">
+                                        <i class="mdi mdi-plus-thick"></i>
+                                        {% blocktrans with label=add_label %}Add {{ label }}{% endblocktrans %}
+                                    </button>
+                                    <ul class="dropdown-menu">
+                                        {% for link in add_links %}
+                                            <li>
+                                                <a class="dropdown-item" href="{{ link.url }}">{% blocktrans with f=link.label %}via {{ f }}{% endblocktrans %}</a>
+                                            </li>
+                                        {% endfor %}
+                                    </ul>
+                                </div>
+                            {% endif %}
+                        {% endif %}
                         <div class="bulk-action-buttons">
                             <button type="submit"
                                     name="_edit"
diff --git a/netbox_custom_objects_tab/views/typed.py b/netbox_custom_objects_tab/views/typed.py
index 666c739..855388f 100644
--- a/netbox_custom_objects_tab/views/typed.py
+++ b/netbox_custom_objects_tab/views/typed.py
@@ -1,10 +1,12 @@
 import logging
 from collections import defaultdict
+from urllib.parse import urlencode
 
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Q
 from django.db.utils import OperationalError, ProgrammingError
 from django.shortcuts import get_object_or_404, render
+from django.urls import NoReverseMatch, reverse
 from django.views.generic import View
 from extras.choices import CustomFieldTypeChoices, CustomFieldUIVisibleChoices
 from netbox.forms import NetBoxModelFilterSetForm
@@ -14,6 +16,7 @@
 from netbox_custom_objects.models import CustomObjectTypeField
 from netbox_custom_objects.tables import CustomObjectTable
 from utilities.forms.fields import TagFilterField
+from utilities.permissions import get_permission_for_model
 from utilities.views import ViewTab, register_model_view
 
 from ._co_common import _CO_BASE_TEMPLATE, _CUSTOM_OBJECTS_APP, _get_base_template  # noqa: F401
@@ -99,10 +102,44 @@ def _build_filterset_form(custom_object_type, dynamic_model):
     )
 
 
+def _build_add_links(custom_object_type_slug, instance_pk, field_infos, return_url):
+    """
+    Build pre-filled "Add" URLs for the native customobject_add view.
+
+    field_infos = list of (field_name, field_type, [label]) for fields referencing the parent.
+    Returns list of {"field_name", "label", "url"} dicts (one per unique field), or [] if URL
+    cannot be reversed (e.g. plugin URL conf not loaded).
+    """
+    try:
+        add_base = reverse(
+            "plugins:netbox_custom_objects:customobject_add",
+            kwargs={"custom_object_type": custom_object_type_slug},
+        )
+    except NoReverseMatch:
+        return []
+
+    links = []
+    seen = set()
+    for field_name, _field_type, *rest in field_infos:
+        if field_name in seen:
+            continue
+        seen.add(field_name)
+        field_label = (rest[0] if rest else field_name) or field_name
+        qs = urlencode({field_name: instance_pk, "return_url": return_url})
+        links.append(
+            {
+                "field_name": field_name,
+                "label": field_label,
+                "url": f"{add_base}?{qs}",
+            }
+        )
+    return links
+
+
 def _count_for_type(custom_object_type, field_infos):
     """
     Return a badge callable for one Custom Object Type.
-    field_infos = list of (field_name, field_type) for fields referencing the parent model.
+    field_infos = list of (field_name, field_type, [label]) for fields referencing the parent model.
     Uses COUNT(*) only. Returns None when 0.
     """
 
@@ -117,7 +154,7 @@ def _badge(instance):
             return None
 
         total = 0
-        for field_name, field_type in field_infos:
+        for field_name, field_type, *_ in field_infos:
             if field_type == CustomFieldTypeChoices.TYPE_OBJECT:
                 total += dynamic_model.objects.filter(**{f"{field_name}_id": instance.pk}).count()
             elif field_type == CustomFieldTypeChoices.TYPE_MULTIOBJECT:
@@ -177,7 +214,7 @@ def get(self, request, pk, **kwargs):
 
             # Build base queryset: union of all field filters for this type
             q_filter = Q()
-            for field_name, field_type in field_infos:
+            for field_name, field_type, *_ in field_infos:
                 if field_type == CustomFieldTypeChoices.TYPE_OBJECT:
                     q_filter |= Q(**{f"{field_name}_id": instance.pk})
                 elif field_type == CustomFieldTypeChoices.TYPE_MULTIOBJECT:
@@ -213,6 +250,16 @@ def get(self, request, pk, **kwargs):
 
             return_url = request.get_full_path()
 
+            # Add-button: link(s) to native CO add view with reverse field pre-filled
+            add_permission = get_permission_for_model(dynamic_model, "add")
+            can_add = request.user.has_perm(add_permission)
+            add_links = _build_add_links(cot.slug, instance.pk, field_infos, return_url) if can_add else []
+
+            try:
+                add_label = cot.get_verbose_name()
+            except AttributeError:
+                add_label = str(cot)
+
             context = {
                 "object": instance,
                 "tab": self.tab,
@@ -223,6 +270,9 @@ def get(self, request, pk, **kwargs):
                 "custom_object_type": cot,
                 "model": dynamic_model,
                 "preferences": preferences,
+                "can_add": can_add,
+                "add_links": add_links,
+                "add_label": add_label,
             }
 
             if request.htmx and not request.htmx.boosted:
@@ -250,16 +300,21 @@ def register_typed_tabs(model_classes, weight):
         ).select_related("custom_object_type")
 
         # Group by (content_type_id, custom_object_type_pk)
-        # -> list of (field_name, field_type)
+        # -> list of (field_name, field_type, field_label)
         ct_cot_fields = defaultdict(list)
         ct_cot_map = {}  # (ct_id, cot_pk) -> CustomObjectType
         for field in all_fields:
             if field.related_object_type_id is None:
                 continue
             key = (field.related_object_type_id, field.custom_object_type_id)
-            ct_cot_fields[key].append((field.name, field.type))
+            label = getattr(field, "label", "") or field.name
+            ct_cot_fields[key].append((field.name, field.type, label))
             ct_cot_map[key] = field.custom_object_type
 
+        # Sort each group by field name for deterministic Add-button order
+        for key in ct_cot_fields:
+            ct_cot_fields[key].sort(key=lambda f: f[0])
+
         # Build a set of content_type_ids we care about
         model_ct_map = {}  # content_type_id -> model_class
         for model_class in model_classes:
diff --git a/tests/conftest.py b/tests/conftest.py
index de8a150..934eac8 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -4,6 +4,7 @@
 This file is loaded by pytest before collection, ensuring mocks exist before
 plugin modules are imported.
 """
+
 import sys
 from types import ModuleType
 from unittest.mock import MagicMock
@@ -16,10 +17,10 @@ def _mock(dotted_name, **attrs):
     Create a mock module at `dotted_name` and register it (and any missing
     parent packages) in sys.modules.  Does NOT overwrite already-present entries.
     """
-    parts = dotted_name.split('.')
+    parts = dotted_name.split(".")
     # Ensure every parent package exists
     for i in range(1, len(parts)):
-        parent = '.'.join(parts[:i])
+        parent = ".".join(parts[:i])
         if parent not in sys.modules:
             sys.modules[parent] = ModuleType(parent)
 
@@ -34,7 +35,7 @@ def _mock(dotted_name, **attrs):
 
     # Attach as attribute on parent so `from parent import child` works
     if len(parts) > 1:
-        parent_mod = sys.modules['.'.join(parts[:-1])]
+        parent_mod = sys.modules[".".join(parts[:-1])]
         setattr(parent_mod, parts[-1], mod)
 
     return mod
@@ -45,41 +46,43 @@ def _mock(dotted_name, **attrs):
 # comparisons inside views.py work correctly when we set field.type = TYPE_OBJECT.
 # ---------------------------------------------------------------------------
 class _CustomFieldTypeChoices:
-    TYPE_OBJECT = 'object'
-    TYPE_MULTIOBJECT = 'multiobject'
-    TYPE_TEXT = 'text'
-    TYPE_LONGTEXT = 'longtext'
+    TYPE_OBJECT = "object"
+    TYPE_MULTIOBJECT = "multiobject"
+    TYPE_TEXT = "text"
+    TYPE_LONGTEXT = "longtext"
 
 
 class _CustomFieldUIVisibleChoices:
-    HIDDEN = 'hidden'
+    HIDDEN = "hidden"
 
 
 # --- netbox.* ---
-_mock('netbox')
-_mock('netbox.registry', registry={"views": {}})
-_mock('netbox.plugins',
-      PluginConfig=type('PluginConfig', (), {}),
-      get_plugin_config=MagicMock(return_value=[]))
-_NetBoxModelFilterSetForm = type('NetBoxModelFilterSetForm', (), {})
-_mock('netbox.forms', NetBoxModelFilterSetForm=_NetBoxModelFilterSetForm)
-_mock('netbox.forms.mixins', SavedFiltersMixin=type('SavedFiltersMixin', (), {}))
+_mock("netbox")
+_mock("netbox.registry", registry={"views": {}})
+_mock("netbox.plugins", PluginConfig=type("PluginConfig", (), {}), get_plugin_config=MagicMock(return_value=[]))
+_NetBoxModelFilterSetForm = type("NetBoxModelFilterSetForm", (), {})
+_mock("netbox.forms", NetBoxModelFilterSetForm=_NetBoxModelFilterSetForm)
+_mock("netbox.forms.mixins", SavedFiltersMixin=type("SavedFiltersMixin", (), {}))
 
 # --- extras.* ---
-_mock('extras')
+_mock("extras")
 _mock(
-    'extras.choices',
+    "extras.choices",
     CustomFieldTypeChoices=_CustomFieldTypeChoices,
     CustomFieldUIVisibleChoices=_CustomFieldUIVisibleChoices,
 )
 
 # --- utilities.* ---
-_mock('utilities')
-_mock('utilities.views', ViewTab=MagicMock(), register_model_view=MagicMock())
-_mock('utilities.paginator', EnhancedPaginator=MagicMock(), get_paginate_count=MagicMock())
-_mock('utilities.htmx', htmx_partial=MagicMock())
-_mock('utilities.forms')
-_mock('utilities.forms.fields', TagFilterField=MagicMock())
+_mock("utilities")
+_mock("utilities.views", ViewTab=MagicMock(), register_model_view=MagicMock())
+_mock("utilities.paginator", EnhancedPaginator=MagicMock(), get_paginate_count=MagicMock())
+_mock("utilities.htmx", htmx_partial=MagicMock())
+_mock("utilities.forms")
+_mock("utilities.forms.fields", TagFilterField=MagicMock())
+_mock(
+    "utilities.permissions",
+    get_permission_for_model=MagicMock(return_value="netbox_custom_objects.add_customobject"),
+)
 
 
 class _FakeBaseTable(_tables2.Table):
@@ -119,12 +122,12 @@ def _set_columns(self, selected_columns):
         ]
 
 
-_mock('netbox.tables', BaseTable=_FakeBaseTable)
+_mock("netbox.tables", BaseTable=_FakeBaseTable)
 
 # --- netbox_custom_objects.* ---
-_mock('netbox_custom_objects')
-_mock('netbox_custom_objects.models', CustomObjectTypeField=MagicMock())
-_mock('netbox_custom_objects.field_types', FIELD_TYPE_CLASS={})
-_mock('netbox_custom_objects.filtersets', get_filterset_class=MagicMock())
-_CustomObjectTable = type('CustomObjectTable', (), {})
-_mock('netbox_custom_objects.tables', CustomObjectTable=_CustomObjectTable)
+_mock("netbox_custom_objects")
+_mock("netbox_custom_objects.models", CustomObjectTypeField=MagicMock())
+_mock("netbox_custom_objects.field_types", FIELD_TYPE_CLASS={})
+_mock("netbox_custom_objects.filtersets", get_filterset_class=MagicMock())
+_CustomObjectTable = type("CustomObjectTable", (), {})
+_mock("netbox_custom_objects.tables", CustomObjectTable=_CustomObjectTable)
diff --git a/tests/settings.py b/tests/settings.py
index 5ce0f13..00023e4 100644
--- a/tests/settings.py
+++ b/tests/settings.py
@@ -2,15 +2,15 @@
 # Only the packages needed to make ContentType importable are included.
 
 INSTALLED_APPS = [
-    'django.contrib.contenttypes',
-    'django.contrib.auth',
+    "django.contrib.contenttypes",
+    "django.contrib.auth",
 ]
 
 DATABASES = {
-    'default': {
-        'ENGINE': 'django.db.backends.sqlite3',
-        'NAME': ':memory:',
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": ":memory:",
     }
 }
 
-DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
diff --git a/tests/test_views_typed_smoke.py b/tests/test_views_typed_smoke.py
index a013bc1..b2c2bb1 100644
--- a/tests/test_views_typed_smoke.py
+++ b/tests/test_views_typed_smoke.py
@@ -124,17 +124,22 @@ def test_visible_fields_included_hidden_excluded(self):
         ft_mock.return_value.get_table_column_field.return_value = MagicMock()
         ft_mock.return_value.render_table_column = MagicMock()
 
-        with patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {
-            CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
-        }):
-            cot, model = self._make_cot_and_model([
-                {"name": "visible_field", "type": CustomFieldTypeChoices.TYPE_TEXT, "ui_visible": "visible"},
-                {
-                    "name": "hidden_field",
-                    "type": CustomFieldTypeChoices.TYPE_TEXT,
-                    "ui_visible": CustomFieldUIVisibleChoices.HIDDEN,
-                },
-            ])
+        with patch.dict(
+            "netbox_custom_objects.field_types.FIELD_TYPE_CLASS",
+            {
+                CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
+            },
+        ):
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "visible_field", "type": CustomFieldTypeChoices.TYPE_TEXT, "ui_visible": "visible"},
+                    {
+                        "name": "hidden_field",
+                        "type": CustomFieldTypeChoices.TYPE_TEXT,
+                        "ui_visible": CustomFieldUIVisibleChoices.HIDDEN,
+                    },
+                ]
+            )
             table_cls = _build_typed_table_class(cot, model)
 
         assert "visible_field" in table_cls.Meta.fields
@@ -148,13 +153,18 @@ def test_get_table_column_field_called_per_visible_field(self):
         ft_instance.render_table_column = MagicMock()
         ft_mock = MagicMock(return_value=ft_instance)
 
-        with patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {
-            CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
-        }):
-            cot, model = self._make_cot_and_model([
-                {"name": "field_a", "type": CustomFieldTypeChoices.TYPE_TEXT},
-                {"name": "field_b", "type": CustomFieldTypeChoices.TYPE_TEXT},
-            ])
+        with patch.dict(
+            "netbox_custom_objects.field_types.FIELD_TYPE_CLASS",
+            {
+                CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
+            },
+        ):
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "field_a", "type": CustomFieldTypeChoices.TYPE_TEXT},
+                    {"name": "field_b", "type": CustomFieldTypeChoices.TYPE_TEXT},
+                ]
+            )
             _build_typed_table_class(cot, model)
 
         assert ft_instance.get_table_column_field.call_count == 2
@@ -167,12 +177,17 @@ def test_primary_text_field_gets_linkified_render(self):
         ft_instance.render_table_column_linkified = MagicMock()
         ft_mock = MagicMock(return_value=ft_instance)
 
-        with patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {
-            CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
-        }):
-            cot, model = self._make_cot_and_model([
-                {"name": "title", "type": CustomFieldTypeChoices.TYPE_TEXT, "primary": True},
-            ])
+        with patch.dict(
+            "netbox_custom_objects.field_types.FIELD_TYPE_CLASS",
+            {
+                CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
+            },
+        ):
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "title", "type": CustomFieldTypeChoices.TYPE_TEXT, "primary": True},
+                ]
+            )
             table_cls = _build_typed_table_class(cot, model)
 
         assert hasattr(table_cls, "render_title")
@@ -189,9 +204,11 @@ def test_not_implemented_column_logged_and_skipped(self, caplog):
             patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {"custom_type": ft_mock}),
             caplog.at_level(logging.DEBUG, logger="netbox_custom_objects_tab"),
         ):
-            cot, model = self._make_cot_and_model([
-                {"name": "weird_field", "type": "custom_type"},
-            ])
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "weird_field", "type": "custom_type"},
+                ]
+            )
             table_cls = _build_typed_table_class(cot, model)
 
         # Should still produce a valid class
@@ -241,13 +258,18 @@ def test_get_filterform_field_called_per_field(self):
         ft_instance.get_filterform_field.return_value = MagicMock()
         ft_mock = MagicMock(return_value=ft_instance)
 
-        with patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {
-            CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
-        }):
-            cot, model = self._make_cot_and_model([
-                {"name": "field_a", "type": CustomFieldTypeChoices.TYPE_TEXT},
-                {"name": "field_b", "type": CustomFieldTypeChoices.TYPE_TEXT},
-            ])
+        with patch.dict(
+            "netbox_custom_objects.field_types.FIELD_TYPE_CLASS",
+            {
+                CustomFieldTypeChoices.TYPE_TEXT: ft_mock,
+            },
+        ):
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "field_a", "type": CustomFieldTypeChoices.TYPE_TEXT},
+                    {"name": "field_b", "type": CustomFieldTypeChoices.TYPE_TEXT},
+                ]
+            )
             _build_filterset_form(cot, model)
 
         assert ft_instance.get_filterform_field.call_count == 2
@@ -263,9 +285,11 @@ def test_not_implemented_filter_logged_and_skipped(self, caplog):
             patch.dict("netbox_custom_objects.field_types.FIELD_TYPE_CLASS", {"custom_type": ft_mock}),
             caplog.at_level(logging.DEBUG, logger="netbox_custom_objects_tab"),
         ):
-            cot, model = self._make_cot_and_model([
-                {"name": "weird_field", "type": "custom_type"},
-            ])
+            cot, model = self._make_cot_and_model(
+                [
+                    {"name": "weird_field", "type": "custom_type"},
+                ]
+            )
             form_cls = _build_filterset_form(cot, model)
 
         assert not hasattr(form_cls, "weird_field")
@@ -376,6 +400,65 @@ def test_models_not_in_model_classes_skipped(self):
         mock_register.assert_not_called()
 
 
+# ---------------------------------------------------------------------------
+# register_typed_tabs -- label population + deterministic ordering
+# ---------------------------------------------------------------------------
+class TestRegisterTypedTabsLabelAndOrder:
+    def test_field_label_and_name_populated_in_field_infos_and_sorted(self):
+        from netbox_custom_objects_tab.views.typed import register_typed_tabs
+
+        model_class = MagicMock(__name__="Device")
+        model_class._meta.app_label = "dcim"
+        model_class._meta.model_name = "device"
+
+        ct = MagicMock()
+        ct.pk = 10
+
+        # Two fields on the same CustomObjectType; registered in order b, a; expect sorted a, b
+        field_b = MagicMock()
+        field_b.related_object_type_id = 10
+        field_b.custom_object_type_id = 100
+        field_b.custom_object_type = MagicMock(slug="server", pk=100)
+        field_b.name = "b_device"
+        field_b.label = "B Device"
+        field_b.type = CustomFieldTypeChoices.TYPE_OBJECT
+
+        field_a = MagicMock()
+        field_a.related_object_type_id = 10
+        field_a.custom_object_type_id = 100
+        field_a.custom_object_type = MagicMock(slug="server", pk=100)
+        field_a.name = "a_device"
+        field_a.label = ""  # blank label -> should fall back to name
+        field_a.type = CustomFieldTypeChoices.TYPE_MULTIOBJECT
+
+        captured_field_infos = {}
+
+        def fake_make_view(model_cls, cot, field_infos, weight):
+            captured_field_infos["infos"] = list(field_infos)
+            return MagicMock()
+
+        with (
+            patch("netbox_custom_objects_tab.views.typed.CustomObjectTypeField") as mock_cotf,
+            patch("netbox_custom_objects_tab.views.typed.ContentType") as mock_ct,
+            patch("netbox_custom_objects_tab.views.typed.register_model_view") as mock_register,
+            patch("netbox_custom_objects_tab.views.typed._make_typed_tab_view", side_effect=fake_make_view),
+        ):
+            mock_cotf.objects.filter.return_value.select_related.return_value = [field_b, field_a]
+            mock_ct.objects.get_for_model.return_value = ct
+            mock_register.return_value = lambda cls: cls
+
+            register_typed_tabs([model_class], weight=2100)
+
+        infos = captured_field_infos["infos"]
+        assert len(infos) == 2
+        # Sorted by field name ascending
+        assert infos[0][0] == "a_device"
+        assert infos[1][0] == "b_device"
+        # Labels: blank -> falls back to name; populated -> kept
+        assert infos[0][2] == "a_device"
+        assert infos[1][2] == "B Device"
+
+
 # ---------------------------------------------------------------------------
 # _get_base_template
 # ---------------------------------------------------------------------------
@@ -399,3 +482,140 @@ def test_non_co_model_returns_per_model_template(self):
 
         instance = self._make_instance("dcim", "device")
         assert _get_base_template(instance) == "dcim/device.html"
+
+
+# ---------------------------------------------------------------------------
+# _build_add_links
+# ---------------------------------------------------------------------------
+class TestBuildAddLinks:
+    def test_returns_empty_when_reverse_fails(self):
+        from django.urls import NoReverseMatch
+
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch("netbox_custom_objects_tab.views.typed.reverse", side_effect=NoReverseMatch):
+            links = _build_add_links(
+                "server",
+                42,
+                [("device", CustomFieldTypeChoices.TYPE_OBJECT, "Device")],
+                "/dcim/devices/42/",
+            )
+        assert links == []
+
+    def test_single_field_produces_one_link_with_prefill_and_return_url(self):
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/server/add/",
+        ):
+            links = _build_add_links(
+                "server",
+                42,
+                [("device", CustomFieldTypeChoices.TYPE_OBJECT, "Device")],
+                "/dcim/devices/42/custom-objects-server/",
+            )
+
+        assert len(links) == 1
+        assert links[0]["field_name"] == "device"
+        assert links[0]["label"] == "Device"
+        # Query string contains both the field prefill and the return_url, in either order
+        url = links[0]["url"]
+        assert url.startswith("/plugins/custom-objects/server/add/?")
+        assert "device=42" in url
+        assert "return_url=%2Fdcim%2Fdevices%2F42%2Fcustom-objects-server%2F" in url
+
+    def test_multiple_fields_produce_multiple_links(self):
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/link/add/",
+        ):
+            links = _build_add_links(
+                "link",
+                7,
+                [
+                    ("primary_device", CustomFieldTypeChoices.TYPE_OBJECT, "Primary"),
+                    ("backup_device", CustomFieldTypeChoices.TYPE_OBJECT, "Backup"),
+                ],
+                "/dcim/devices/7/",
+            )
+
+        assert len(links) == 2
+        names = {link["field_name"] for link in links}
+        labels = {link["label"] for link in links}
+        assert names == {"primary_device", "backup_device"}
+        assert labels == {"Primary", "Backup"}
+        for link in links:
+            assert f"{link['field_name']}=7" in link["url"]
+
+    def test_duplicate_field_names_deduplicated(self):
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/x/add/",
+        ):
+            links = _build_add_links(
+                "x",
+                1,
+                [
+                    ("device", CustomFieldTypeChoices.TYPE_OBJECT, "Device"),
+                    ("device", CustomFieldTypeChoices.TYPE_MULTIOBJECT, "Device"),
+                ],
+                "/dcim/devices/1/",
+            )
+        assert len(links) == 1
+        assert links[0]["field_name"] == "device"
+
+    def test_label_falls_back_to_field_name_when_label_blank(self):
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/x/add/",
+        ):
+            links = _build_add_links(
+                "x",
+                1,
+                [("device_ref", CustomFieldTypeChoices.TYPE_OBJECT, "")],
+                "/dcim/devices/1/",
+            )
+        assert links[0]["label"] == "device_ref"
+
+    def test_two_tuple_field_infos_supported_label_defaults_to_name(self):
+        """Backward-compatible: 2-tuples (no label) work via star unpacking."""
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/x/add/",
+        ):
+            links = _build_add_links(
+                "x",
+                1,
+                [("device", CustomFieldTypeChoices.TYPE_OBJECT)],
+                "/dcim/devices/1/",
+            )
+        assert links[0]["label"] == "device"
+
+    def test_return_url_with_query_string_is_url_encoded(self):
+        """A return_url containing & and ? must be URL-encoded so it doesn't break the outer query string."""
+        from netbox_custom_objects_tab.views.typed import _build_add_links
+
+        with patch(
+            "netbox_custom_objects_tab.views.typed.reverse",
+            return_value="/plugins/custom-objects/x/add/",
+        ):
+            links = _build_add_links(
+                "x",
+                1,
+                [("device", CustomFieldTypeChoices.TYPE_OBJECT, "Device")],
+                "/dcim/devices/1/custom-objects-x/?tag=foo&q=bar",
+            )
+        url = links[0]["url"]
+        # The inner '?' and '&' must be percent-encoded inside the return_url value
+        assert "return_url=%2Fdcim%2Fdevices%2F1%2Fcustom-objects-x%2F%3Ftag%3Dfoo%26q%3Dbar" in url
+        # Outer URL must have exactly one literal '?'
+        assert url.count("?") == 1

From b2e59069201e3a89723e3068eb6afe3e4f3fc4fc Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 11:11:37 +0200
Subject: [PATCH 2/6] Fix typed-tab URL registration broken by request_started
 deferral
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move typed-tab registration, CO URL injection, and registry deduplication
back to AppConfig.ready(). They were deferred to a request_started signal
handler in commit 5bf09c3 (PR #4) to silence DB-access startup warnings
from Django and netbox_branching, but that broke typed-tab routing
entirely: NetBox builds each model's URLconf via get_model_urls() on the
first resolve() call by snapshotting registry['views'] at that moment, so
anything registered after the URLconf is built has no URL pattern.

Combined tabs worked by coincidence — they were registered in Phase 1
(synchronous). Typed tabs and the new Add-button feature were
unreachable on any deployment with typed_models configured: the URL
returned 404 even though the view was in registry['views'].

The OperationalError / ProgrammingError safety net inside
register_typed_tabs still covers the manage.py migrate / fresh-DB case.
The "Accessing the database during app initialization is discouraged"
warning the original deferral suppressed is back, but it's informational;
broken URL routing was not.

- Removes _deferred_typed_init, _deferred_config, _deferred_init_lock,
  and the threading import from views/__init__.py
- Updates tests/test_views_init.py to assert synchronous registration
- Adds a defensive note to CLAUDE.md to prevent re-deferral
---
 CLAUDE.md                                   |  1 +
 netbox_custom_objects_tab/views/__init__.py | 87 +++++----------------
 tests/test_views_init.py                    | 66 ++++++----------
 3 files changed, 45 insertions(+), 109 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index ada6a69..85f4a1e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -209,6 +209,7 @@ permissions internally via `get_permission_for_model()`.
 - Typed tabs use `custom-objects-{slug}` path prefix — avoids collisions with built-in paths
 - Multiple fields of same type → union querysets with `.distinct()`
 - Tabs registered at `ready()` — new Custom Object Types need a restart (applies both to typed tabs on native models and to `netbox_custom_objects.*` tabs on Custom Object pages)
+- **Do NOT defer typed-tab registration to `request_started` or any post-`ready()` signal.** NetBox's `get_model_urls(app, model)` snapshots `registry['views']` when the model's `urls.py` is first imported (which happens lazily on the first `resolve()` call). Anything added to the registry after that has no URL pattern. Combined tabs work because they're registered in `ready()` synchronously; typed tabs MUST be registered the same way. PR #4 / commit `5bf09c3` deferred typed-tab registration to silence DB-access startup warnings — that change broke typed tabs entirely and was reverted in 2.3.1. The DB-access warning is acceptable; broken URL routing is not.
 - `netbox_custom_objects.*` wildcard is special-cased in `_resolve_model_labels()` — dynamic models are discovered via `app_config.get_models()` filtered to `CustomObject` subclasses. **Do NOT call `get_model()` here** — each cache-miss call re-registers journal/changelog tab views, producing duplicate tabs
 - `base_template` for CO model instances must be `netbox_custom_objects/customobject.html` — the per-model template (e.g. `netbox_custom_objects/table28model.html`) does not exist
 - Tab view `get()` must accept `**kwargs` — CO detail URLs pass `custom_object_type` slug as an extra kwarg alongside `pk`
diff --git a/netbox_custom_objects_tab/views/__init__.py b/netbox_custom_objects_tab/views/__init__.py
index 1d936f3..7bf9515 100644
--- a/netbox_custom_objects_tab/views/__init__.py
+++ b/netbox_custom_objects_tab/views/__init__.py
@@ -1,5 +1,4 @@
 import logging
-import threading
 
 from django.apps import apps
 from netbox.plugins import get_plugin_config
@@ -10,18 +9,6 @@
 
 logger = logging.getLogger("netbox_custom_objects_tab")
 
-# ── Deferred initialisation (avoids DB queries during ready()) ───────────
-# Typed-tab registration queries CustomObjectTypeField and ContentType.
-# Running those queries in AppConfig.ready() triggers warnings from Django
-# ("Accessing the database during app initialization is discouraged") and
-# from netbox_branching ("Routing database query … before branching support
-# is initialized").  We defer that work to the first HTTP request via
-# Django's request_started signal.  See GitHub issue #4.
-
-_deferred_init_lock = threading.Lock()
-_deferred_init_done = False
-_deferred_config = {}  # populated in register_tabs(), consumed in _deferred_typed_init()
-
 
 def _resolve_dynamic_custom_object_models():
     """
@@ -175,52 +162,25 @@ def _deduplicate_registry():
                 model_map[model_name] = deduped
 
 
-def _deferred_typed_init(sender=None, **kwargs):
-    """
-    One-shot ``request_started`` handler that performs DB-dependent initialisation.
-
-    Registers typed tabs, injects CO URL patterns, and deduplicates the view
-    registry.  Runs exactly once on the first HTTP request, then disconnects
-    itself so subsequent requests pay no overhead.
-    """
-    global _deferred_init_done
-    with _deferred_init_lock:
-        if _deferred_init_done:
-            return
-        _deferred_init_done = True
-
-    from django.core.signals import request_started
-
-    request_started.disconnect(_deferred_typed_init, dispatch_uid="netbox_custom_objects_tab_deferred")
-
-    config = _deferred_config
-    combined_models = config.get("combined_models", [])
-    typed_labels = config.get("typed_labels", [])
-    typed_weight = config.get("typed_weight", 2100)
-
-    typed_models = []
-    if typed_labels:
-        typed_models = _resolve_model_labels(typed_labels)
-        register_typed_tabs(typed_models, typed_weight)
-
-    # Inject URL patterns for CO dynamic models (combined + typed).
-    if any(m._meta.app_label == _CUSTOM_OBJECTS_APP for m in combined_models + typed_models):
-        _inject_co_urls()
-
-    # Deduplicate the registry — netbox_custom_objects re-registers journal/changelog
-    # on every get_model() cache miss, producing duplicate tabs.
-    _deduplicate_registry()
-
-
 def register_tabs():
     """
     Read plugin config and register both combined and typed tabs.
     Called from AppConfig.ready().
 
-    Combined tabs are registered immediately (no DB queries needed).
-    Typed tabs and other DB-dependent work are deferred to the first HTTP
-    request via the ``request_started`` signal to avoid DB access during
-    app initialisation (GitHub issue #4).
+    All registration must happen synchronously here: NetBox builds each model's
+    URLconf (via ``get_model_urls()``) on the first ``resolve()`` call, snapshotting
+    ``registry['views']`` at that moment.  Anything added to the registry after the
+    URLconf is built has no URL pattern.  Likewise, ``_inject_co_urls()`` mutates
+    ``netbox_custom_objects.urls.urlpatterns`` and must run before any URL resolver
+    populates its lookup cache against that list.
+
+    Earlier versions deferred typed-tab registration to the first HTTP request
+    (commit 5bf09c3, PR #4) to silence DB-access warnings from Django and
+    netbox_branching.  That broke typed-tab URL routing entirely — the Add-button
+    feature in 2.3.0 was never reachable on a deployment.  See 2.3.1 release notes.
+
+    The ``OperationalError`` / ``ProgrammingError`` safety net inside
+    ``register_typed_tabs`` covers the ``manage.py migrate`` / fresh-DB case.
     """
     try:
         combined_labels = get_plugin_config("netbox_custom_objects_tab", "combined_models")
@@ -232,22 +192,17 @@ def register_tabs():
         logger.exception("Could not read netbox_custom_objects_tab plugin config")
         return
 
-    # Phase 1 — immediate: combined tabs do not query the database.
     combined_models = []
     if combined_labels:
         combined_models = _resolve_model_labels(combined_labels)
         register_combined_tabs(combined_models, combined_label, combined_weight)
 
-    # Phase 2 — deferred: typed tabs, CO URL injection, and registry dedup
-    # all require DB access and must wait until the first request.
-    _deferred_config.update(
-        {
-            "combined_models": combined_models,
-            "typed_labels": typed_labels,
-            "typed_weight": typed_weight,
-        }
-    )
+    typed_models = []
+    if typed_labels:
+        typed_models = _resolve_model_labels(typed_labels)
+        register_typed_tabs(typed_models, typed_weight)
 
-    from django.core.signals import request_started
+    if any(m._meta.app_label == _CUSTOM_OBJECTS_APP for m in combined_models + typed_models):
+        _inject_co_urls()
 
-    request_started.connect(_deferred_typed_init, dispatch_uid="netbox_custom_objects_tab_deferred")
+    _deduplicate_registry()
diff --git a/tests/test_views_init.py b/tests/test_views_init.py
index 40d1ece..db003ca 100644
--- a/tests/test_views_init.py
+++ b/tests/test_views_init.py
@@ -54,11 +54,19 @@ def test_unknown_specific_model_logs_warning_no_exception(self, caplog):
 
 
 class TestRegisterTabs:
-    def test_dispatches_combined_tabs_immediately_and_defers_typed(self):
-        """register_tabs() registers combined tabs in ready() and defers typed tabs."""
+    def test_dispatches_combined_and_typed_tabs_synchronously(self):
+        """register_tabs() registers BOTH combined and typed tabs synchronously
+        in ready(). Registration must be synchronous because NetBox builds each
+        model's URLconf on the first resolve() call by snapshotting
+        registry['views']; anything added after that has no URL pattern.
+        See 2.3.1 fix.
+        """
         from netbox_custom_objects_tab import views
 
         combined_models = [MagicMock()]
+        typed_models = [MagicMock()]
+        combined_models[0]._meta.app_label = "dcim"
+        typed_models[0]._meta.app_label = "ipam"
 
         config_map = {
             "combined_models": ["dcim.device"],
@@ -68,54 +76,23 @@ def test_dispatches_combined_tabs_immediately_and_defers_typed(self):
             "typed_weight": 2100,
         }
 
+        # _resolve_model_labels is called twice (combined, then typed); return
+        # different lists for each call.
         with (
             patch.object(views, "get_plugin_config", side_effect=lambda _plugin, key: config_map[key]),
-            patch.object(views, "_resolve_model_labels", return_value=combined_models),
+            patch.object(views, "_resolve_model_labels", side_effect=[combined_models, typed_models]),
             patch.object(views, "register_combined_tabs") as register_combined,
             patch.object(views, "register_typed_tabs") as register_typed,
-            patch("django.core.signals.request_started") as mock_signal,
+            patch.object(views, "_inject_co_urls") as inject_co_urls,
+            patch.object(views, "_deduplicate_registry") as dedup,
         ):
             views.register_tabs()
 
-        # Combined tabs registered immediately
         register_combined.assert_called_once_with(combined_models, "Custom Objects", 2000)
-        # Typed tabs NOT called during register_tabs() — deferred to first request
-        register_typed.assert_not_called()
-        # Signal handler connected for deferred init
-        mock_signal.connect.assert_called_once()
-
-    def test_deferred_init_dispatches_typed_tabs(self):
-        """_deferred_typed_init() resolves labels and registers typed tabs."""
-        from netbox_custom_objects_tab import views
-
-        typed_models = [MagicMock()]
-        typed_models[0]._meta.app_label = "ipam"
-
-        # Reset the deferred state so the handler can run
-        views._deferred_init_done = False
-        views._deferred_config.update(
-            {
-                "combined_models": [],
-                "typed_labels": ["ipam.prefix"],
-                "typed_weight": 2100,
-            }
-        )
-
-        try:
-            with (
-                patch.object(views, "_resolve_model_labels", return_value=typed_models),
-                patch.object(views, "register_typed_tabs") as register_typed,
-                patch.object(views, "_inject_co_urls"),
-                patch.object(views, "_deduplicate_registry"),
-                patch("django.core.signals.request_started"),
-            ):
-                views._deferred_typed_init()
-
-            register_typed.assert_called_once_with(typed_models, 2100)
-        finally:
-            # Clean up global state
-            views._deferred_init_done = False
-            views._deferred_config.clear()
+        register_typed.assert_called_once_with(typed_models, 2100)
+        # No CO models in either list → CO URL injection skipped.
+        inject_co_urls.assert_not_called()
+        dedup.assert_called_once()
 
     def test_skips_dispatch_when_configured_model_lists_are_empty(self):
         from netbox_custom_objects_tab import views
@@ -132,12 +109,15 @@ def test_skips_dispatch_when_configured_model_lists_are_empty(self):
             patch.object(views, "get_plugin_config", side_effect=lambda _plugin, key: config_map[key]),
             patch.object(views, "_resolve_model_labels") as resolve_labels,
             patch.object(views, "register_combined_tabs") as register_combined,
-            patch("django.core.signals.request_started"),
+            patch.object(views, "register_typed_tabs") as register_typed,
+            patch.object(views, "_inject_co_urls"),
+            patch.object(views, "_deduplicate_registry"),
         ):
             views.register_tabs()
 
         resolve_labels.assert_not_called()
         register_combined.assert_not_called()
+        register_typed.assert_not_called()
 
     def test_config_exception_is_handled(self, caplog):
         from netbox_custom_objects_tab import views

From 212fbedb03a3b508b2e613493645dddd08a56cfd Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 11:11:37 +0200
Subject: [PATCH 3/6] Fix typed-tab badge over-counting + release 2.3.0

Badge fix
---------
The badge produced by _count_for_type summed per-field counts with no
deduplication, so a Custom Object Type with several fields pointing to
the same parent model (e.g. primary_device, backup_device,
affected_devices all -> dcim.device) reported a badge number larger
than the actual table row count whenever a row matched the parent via
more than one field.

Verified against real test data: a SmokeTest Equipment type with three
Device-pointing fields and 4 rows engineered to overlap on a single
device reported badge=9 / table=4 before the fix, badge=4 / table=4
after.

The fix mirrors View.get's queryset construction:
dynamic_model.objects.filter(Q | Q | ...).distinct().count(). Bonus
side-effect: badge issues a single SQL query per tab instead of N (one
per Device-pointing field).

Bug existed since the typed-tab feature was introduced in 2.0.0; only
became visible with multi-FK or M2M field combinations.

- Updates _count_for_type in views/typed.py
- Replaces the test_returns_sum_for_object_and_multiobject_fields test
  with three tests asserting the new contract: single filter() call,
  Q-OR-Q expression, defensive empty-fields guard

Release 2.3.0
-------------
Bumps version to 2.3.0 and adds a consolidated CHANGELOG entry covering
the Add-button feature plus the URL-registration fix and the badge fix
that landed alongside it. SemVer-correct: this is the first release
containing the new feature, so MINOR (not PATCH) bump from 2.2.0.
---
 CHANGELOG.md                             | 41 ++++++++++++++++
 netbox_custom_objects_tab/views/typed.py | 19 ++++++--
 pyproject.toml                           |  2 +-
 tests/test_views_typed_smoke.py          | 62 ++++++++++++++++++------
 4 files changed, 104 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7537bed..a08454b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.0] - 2026-05-12
+
+### Added
+
+- **Add button on Typed tabs** ([#9](https://github.com/CESNET/netbox-custom-objects-tab/issues/9)) —
+  each Typed tab now shows an "Add *Type*" button in the bottom toolbar
+  (alongside Bulk Edit and Bulk Delete) that opens the native
+  `customobject_add` view with the reverse-reference field pre-filled to the
+  parent object's PK and `return_url` set back to the tab. After saving, the
+  user lands back on the same tab, with any active filters preserved. When a
+  Custom Object Type has multiple fields referencing the same parent model
+  (e.g. `primary_device` and `backup_device` both → Device), the button
+  becomes a split-dropdown listing each field. The button is hidden for
+  users without `add_customobject` permission.
+
+### Fixed
+
+- **Typed-tab URL registration**: typed-tab views are now registered
+  synchronously inside `AppConfig.ready()` instead of from a `request_started`
+  signal handler. The earlier deferral (commit `5bf09c3`, PR #4) silenced
+  some startup warnings but broke typed-tab routing entirely — NetBox's
+  `get_model_urls()` snapshots `registry['views']` when each model's
+  `urls.py` is first imported, so any view added afterward has no URL
+  pattern. Combined tabs were unaffected because they were already
+  synchronous; typed tabs were unreachable on every deployment with
+  `typed_models` configured. The `OperationalError`/`ProgrammingError`
+  safety net inside `register_typed_tabs` still covers the
+  `manage.py migrate` / fresh-DB case.
+- **Typed-tab badge no longer over-counts** rows that match the parent via
+  multiple fields. `_count_for_type` previously summed per-field counts
+  with no deduplication, so a Custom Object Type with several fields
+  pointing to the same parent model (e.g. `primary_device` +
+  `backup_device` + `affected_devices` all → `dcim.device`) reported a
+  badge number larger than the actual table row count whenever a row
+  matched the parent via more than one field. Now uses the same
+  `Q-OR-Q + .distinct()` pattern as the table queryset, so the badge and
+  the table always agree. Bonus: one SQL query per tab badge instead of N
+  (one per Device-pointing field). Bug existed since the typed-tab
+  feature was introduced in 2.0.0; only became visible with multi-FK or
+  M2M field combinations.
+
 ## [2.2.0] - 2026-05-11
 
 ### Changed
diff --git a/netbox_custom_objects_tab/views/typed.py b/netbox_custom_objects_tab/views/typed.py
index 855388f..50affbe 100644
--- a/netbox_custom_objects_tab/views/typed.py
+++ b/netbox_custom_objects_tab/views/typed.py
@@ -139,8 +139,15 @@ def _build_add_links(custom_object_type_slug, instance_pk, field_infos, return_u
 def _count_for_type(custom_object_type, field_infos):
     """
     Return a badge callable for one Custom Object Type.
+
+    Mirrors View.get's queryset construction (Q-OR-Q + .distinct()) so a row
+    matching the parent via multiple fields is counted exactly once. Earlier
+    versions summed per-field counts, which over-counted when a row matched
+    via multiple Device-pointing fields (e.g. primary_device + affected_devices
+    both point at the same parent). See 2.3.3 release notes.
+
     field_infos = list of (field_name, field_type, [label]) for fields referencing the parent model.
-    Uses COUNT(*) only. Returns None when 0.
+    Returns None when the count is 0 (so ViewTab.hide_if_empty hides the tab).
     """
 
     def _badge(instance):
@@ -153,13 +160,17 @@ def _badge(instance):
             )
             return None
 
-        total = 0
+        q_filter = Q()
         for field_name, field_type, *_ in field_infos:
             if field_type == CustomFieldTypeChoices.TYPE_OBJECT:
-                total += dynamic_model.objects.filter(**{f"{field_name}_id": instance.pk}).count()
+                q_filter |= Q(**{f"{field_name}_id": instance.pk})
             elif field_type == CustomFieldTypeChoices.TYPE_MULTIOBJECT:
-                total += dynamic_model.objects.filter(**{field_name: instance.pk}).count()
+                q_filter |= Q(**{field_name: instance.pk})
+
+        if not q_filter:
+            return None
 
+        total = dynamic_model.objects.filter(q_filter).distinct().count()
         return total if total > 0 else None
 
     return _badge
diff --git a/pyproject.toml b/pyproject.toml
index af4bd41..0271cc0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "netbox-custom-objects-tab"
-version = "2.2.0"
+version = "2.3.0"
 description = "NetBox plugin that adds a Custom Objects tab to object detail pages"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/tests/test_views_typed_smoke.py b/tests/test_views_typed_smoke.py
index b2c2bb1..1d8b372 100644
--- a/tests/test_views_typed_smoke.py
+++ b/tests/test_views_typed_smoke.py
@@ -19,19 +19,23 @@ def test_typed_module_imports_under_test_mocks():
 # _count_for_type
 # ---------------------------------------------------------------------------
 class TestCountForType:
-    def _make_custom_object_type(self, field_count_map):
+    def _make_custom_object_type(self, distinct_count):
         """
-        Build a mock custom_object_type returning a dynamic model where:
-        filter(**{field_name condition})->count() returns field_count_map[field_name].
+        Build a mock custom_object_type returning a dynamic model whose
+        filter(Q(...)).distinct().count() resolves to ``distinct_count``.
+
+        The badge logic must call filter exactly ONCE with a Q object (not N
+        separate filters per field) and chain .distinct().count() on it. The
+        mock collects the Q passed to filter so tests can inspect it.
         """
         dynamic_model = MagicMock()
+        captured = {}
 
-        def filter_side_effect(**kwargs):
-            query_key = next(iter(kwargs.keys()))
-            field_name = query_key[:-3] if query_key.endswith("_id") else query_key
-            count = field_count_map.get(field_name, 0)
+        def filter_side_effect(*args, **kwargs):
+            captured["args"] = args
+            captured["kwargs"] = kwargs
             qs = MagicMock()
-            qs.count.return_value = count
+            qs.distinct.return_value.count.return_value = distinct_count
             return qs
 
         dynamic_model.objects.filter.side_effect = filter_side_effect
@@ -39,12 +43,12 @@ def filter_side_effect(**kwargs):
         cot = MagicMock()
         cot.get_model.return_value = dynamic_model
         cot.pk = 123
-        return cot
+        return cot, dynamic_model, captured
 
     def test_returns_none_when_zero_total(self):
         from netbox_custom_objects_tab.views.typed import _count_for_type
 
-        cot = self._make_custom_object_type({"ref_object": 0, "ref_multi": 0})
+        cot, _, _ = self._make_custom_object_type(distinct_count=0)
         badge = _count_for_type(
             cot,
             [
@@ -56,20 +60,48 @@ def test_returns_none_when_zero_total(self):
 
         assert badge(instance) is None
 
-    def test_returns_sum_for_object_and_multiobject_fields(self):
+    def test_uses_single_filter_with_OR_of_field_predicates(self):
+        """The badge must build one Q-OR-Q expression and pass it to a single
+        filter() call so .distinct() can deduplicate rows matching multiple
+        fields at the SQL level. Earlier versions made N separate filter calls
+        and summed their counts, which over-counted overlapping rows.
+        """
+        from django.db.models import Q
+
         from netbox_custom_objects_tab.views.typed import _count_for_type
 
-        cot = self._make_custom_object_type({"ref_object": 2, "ref_multi": 3})
+        cot, dynamic_model, captured = self._make_custom_object_type(distinct_count=4)
         badge = _count_for_type(
             cot,
             [
-                ("ref_object", CustomFieldTypeChoices.TYPE_OBJECT),
-                ("ref_multi", CustomFieldTypeChoices.TYPE_MULTIOBJECT),
+                ("primary_device", CustomFieldTypeChoices.TYPE_OBJECT),
+                ("backup_device", CustomFieldTypeChoices.TYPE_OBJECT),
+                ("affected_devices", CustomFieldTypeChoices.TYPE_MULTIOBJECT),
             ],
         )
         instance = MagicMock(pk=42)
 
-        assert badge(instance) == 5
+        assert badge(instance) == 4
+        # filter must be called exactly once (not three times — one per field)
+        assert dynamic_model.objects.filter.call_count == 1
+        # ...and the single positional arg must be a Q expression
+        (q_arg,) = captured["args"]
+        assert isinstance(q_arg, Q)
+        # The Q must combine the three field predicates with OR
+        assert q_arg.connector == "OR"
+        assert len(q_arg.children) == 3
+
+    def test_returns_none_when_field_infos_empty(self):
+        """Defensive: empty field_infos must not yield filter() — that would
+        return all rows, producing a wrong tab badge.
+        """
+        from netbox_custom_objects_tab.views.typed import _count_for_type
+
+        cot, dynamic_model, _ = self._make_custom_object_type(distinct_count=999)
+        badge = _count_for_type(cot, [])
+        assert badge(MagicMock(pk=42)) is None
+        # filter() must not be called when there are no fields to OR together
+        assert dynamic_model.objects.filter.call_count == 0
 
     def test_returns_none_when_get_model_raises(self, caplog):
         from netbox_custom_objects_tab.views.typed import _count_for_type

From b434c9b28c21ceddf7340630043dadba7046b304 Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 11:52:00 +0200
Subject: [PATCH 4/6] Apply PR #10 review fixups

Four small follow-ups from the PR #10 review, all 2.3.0-bound:

1. Permission check now uses the base CustomObject perm
   (`netbox_custom_objects.add_customobject`) instead of building one
   from the per-type dynamic subclass.  `get_permission_for_model`
   on a dynamic `Table28Model` yields `add_table28model`, a perm no
   user has, so the Add button was silently hidden from everyone on
   any real deployment.  Mirrors the perm enforced by `customobject_add`
   itself, so server-side and UI-side checks now agree.  Removes the
   now-unused `from utilities.permissions import get_permission_for_model`
   import.

2. Replaces stale `2.3.1` / `2.3.3` release-note references in code
   comments and test docstrings with the actual release number `2.3.0`
   (4 places: `views/typed.py`, `views/__init__.py`,
   `tests/test_views_init.py`, `CLAUDE.md`).

3. Converts the multi-field Add button from a plain dropdown into a
   real Bootstrap split-dropdown: a primary action button (using the
   first alphabetic field's prefill URL) plus a separate
   `dropdown-toggle-split` chevron that opens the field menu.  Adds the
   required `visually-hidden` screen-reader label.  Matches the
   "split-dropdown" wording used in the original PR description and
   the CHANGELOG.

4. `add_label` fallback: `cot.get_verbose_name() or str(cot)` so a
   verbose-name returning an empty string (not just raising
   `AttributeError`) also falls back to `str(cot)`, avoiding an
   "Add " button with a trailing space.

ruff check + format clean, 61/61 tests pass.
---
 CLAUDE.md                                          |  2 +-
 .../netbox_custom_objects_tab/typed/tab.html       | 11 ++++++++---
 netbox_custom_objects_tab/views/__init__.py        |  2 +-
 netbox_custom_objects_tab/views/typed.py           | 14 ++++++++------
 tests/test_views_init.py                           |  2 +-
 5 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 85f4a1e..f6c0e12 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -209,7 +209,7 @@ permissions internally via `get_permission_for_model()`.
 - Typed tabs use `custom-objects-{slug}` path prefix — avoids collisions with built-in paths
 - Multiple fields of same type → union querysets with `.distinct()`
 - Tabs registered at `ready()` — new Custom Object Types need a restart (applies both to typed tabs on native models and to `netbox_custom_objects.*` tabs on Custom Object pages)
-- **Do NOT defer typed-tab registration to `request_started` or any post-`ready()` signal.** NetBox's `get_model_urls(app, model)` snapshots `registry['views']` when the model's `urls.py` is first imported (which happens lazily on the first `resolve()` call). Anything added to the registry after that has no URL pattern. Combined tabs work because they're registered in `ready()` synchronously; typed tabs MUST be registered the same way. PR #4 / commit `5bf09c3` deferred typed-tab registration to silence DB-access startup warnings — that change broke typed tabs entirely and was reverted in 2.3.1. The DB-access warning is acceptable; broken URL routing is not.
+- **Do NOT defer typed-tab registration to `request_started` or any post-`ready()` signal.** NetBox's `get_model_urls(app, model)` snapshots `registry['views']` when the model's `urls.py` is first imported (which happens lazily on the first `resolve()` call). Anything added to the registry after that has no URL pattern. Combined tabs work because they're registered in `ready()` synchronously; typed tabs MUST be registered the same way. PR #4 / commit `5bf09c3` deferred typed-tab registration to silence DB-access startup warnings — that change broke typed tabs entirely and was reverted in 2.3.0. The DB-access warning is acceptable; broken URL routing is not.
 - `netbox_custom_objects.*` wildcard is special-cased in `_resolve_model_labels()` — dynamic models are discovered via `app_config.get_models()` filtered to `CustomObject` subclasses. **Do NOT call `get_model()` here** — each cache-miss call re-registers journal/changelog tab views, producing duplicate tabs
 - `base_template` for CO model instances must be `netbox_custom_objects/customobject.html` — the per-model template (e.g. `netbox_custom_objects/table28model.html`) does not exist
 - Tab view `get()` must accept `**kwargs` — CO detail URLs pass `custom_object_type` slug as an extra kwarg alongside `pk`
diff --git a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
index 400d2ce..bddeaf6 100644
--- a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
+++ b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
@@ -100,13 +100,18 @@
                                     {% blocktrans with label=add_label %}Add {{ label }}{% endblocktrans %}
                                 </a>
                             {% else %}
+                                {# True Bootstrap split-dropdown: primary button uses the first (alphabetic) field; #}
+                                {# chevron opens a menu listing every reverse-reference field. #}
                                 <div class="btn-group">
+                                    <a href="{{ add_links.0.url }}" class="btn btn-primary">
+                                        <i class="mdi mdi-plus-thick"></i>
+                                        {% blocktrans with label=add_label %}Add {{ label }}{% endblocktrans %}
+                                    </a>
                                     <button type="button"
-                                            class="btn btn-primary dropdown-toggle"
+                                            class="btn btn-primary dropdown-toggle dropdown-toggle-split"
                                             data-bs-toggle="dropdown"
                                             aria-expanded="false">
-                                        <i class="mdi mdi-plus-thick"></i>
-                                        {% blocktrans with label=add_label %}Add {{ label }}{% endblocktrans %}
+                                        <span class="visually-hidden">{% trans "Toggle Dropdown" %}</span>
                                     </button>
                                     <ul class="dropdown-menu">
                                         {% for link in add_links %}
diff --git a/netbox_custom_objects_tab/views/__init__.py b/netbox_custom_objects_tab/views/__init__.py
index 7bf9515..c2346f7 100644
--- a/netbox_custom_objects_tab/views/__init__.py
+++ b/netbox_custom_objects_tab/views/__init__.py
@@ -177,7 +177,7 @@ def register_tabs():
     Earlier versions deferred typed-tab registration to the first HTTP request
     (commit 5bf09c3, PR #4) to silence DB-access warnings from Django and
     netbox_branching.  That broke typed-tab URL routing entirely — the Add-button
-    feature in 2.3.0 was never reachable on a deployment.  See 2.3.1 release notes.
+    feature in 2.3.0 was never reachable on a deployment.  See 2.3.0 release notes.
 
     The ``OperationalError`` / ``ProgrammingError`` safety net inside
     ``register_typed_tabs`` covers the ``manage.py migrate`` / fresh-DB case.
diff --git a/netbox_custom_objects_tab/views/typed.py b/netbox_custom_objects_tab/views/typed.py
index 50affbe..4c49995 100644
--- a/netbox_custom_objects_tab/views/typed.py
+++ b/netbox_custom_objects_tab/views/typed.py
@@ -16,7 +16,6 @@
 from netbox_custom_objects.models import CustomObjectTypeField
 from netbox_custom_objects.tables import CustomObjectTable
 from utilities.forms.fields import TagFilterField
-from utilities.permissions import get_permission_for_model
 from utilities.views import ViewTab, register_model_view
 
 from ._co_common import _CO_BASE_TEMPLATE, _CUSTOM_OBJECTS_APP, _get_base_template  # noqa: F401
@@ -144,7 +143,7 @@ def _count_for_type(custom_object_type, field_infos):
     matching the parent via multiple fields is counted exactly once. Earlier
     versions summed per-field counts, which over-counted when a row matched
     via multiple Device-pointing fields (e.g. primary_device + affected_devices
-    both point at the same parent). See 2.3.3 release notes.
+    both point at the same parent). See 2.3.0 release notes.
 
     field_infos = list of (field_name, field_type, [label]) for fields referencing the parent model.
     Returns None when the count is 0 (so ViewTab.hide_if_empty hides the tab).
@@ -261,13 +260,16 @@ def get(self, request, pk, **kwargs):
 
             return_url = request.get_full_path()
 
-            # Add-button: link(s) to native CO add view with reverse field pre-filled
-            add_permission = get_permission_for_model(dynamic_model, "add")
-            can_add = request.user.has_perm(add_permission)
+            # Add-button: link(s) to native CO add view with reverse field pre-filled.
+            # Permission is checked against the BASE CustomObject model, not the per-type
+            # dynamic subclass: NetBox grants `netbox_custom_objects.add_customobject` (the
+            # single perm enforced by `customobject_add`), never `add_table28model`.
+            # Mirrors the pattern used inside `CustomObjectActionsColumn`.
+            can_add = request.user.has_perm("netbox_custom_objects.add_customobject")
             add_links = _build_add_links(cot.slug, instance.pk, field_infos, return_url) if can_add else []
 
             try:
-                add_label = cot.get_verbose_name()
+                add_label = cot.get_verbose_name() or str(cot)
             except AttributeError:
                 add_label = str(cot)
 
diff --git a/tests/test_views_init.py b/tests/test_views_init.py
index db003ca..1dac8d7 100644
--- a/tests/test_views_init.py
+++ b/tests/test_views_init.py
@@ -59,7 +59,7 @@ def test_dispatches_combined_and_typed_tabs_synchronously(self):
         in ready(). Registration must be synchronous because NetBox builds each
         model's URLconf on the first resolve() call by snapshotting
         registry['views']; anything added after that has no URL pattern.
-        See 2.3.1 fix.
+        See 2.3.0 fix.
         """
         from netbox_custom_objects_tab import views
 

From fd630d5b7dbf3175ee4234881029981d6ce3b087 Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 12:24:41 +0200
Subject: [PATCH 5/6] Permission-gate Bulk Edit/Delete on Typed tabs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Surfaced by the Section F smoke test of 2.3.0 with non-superusers
`smoke-yes` (only `add_customobject`) and `smoke-no` (only `view`):
the Bulk Edit and Bulk Delete buttons rendered unconditionally on
Typed tabs for any user who could view the tab, regardless of whether
they had `change_customobject` / `delete_customobject` permissions.

Asymmetric with the Add button: b434c9b correctly gates the Add button
against `netbox_custom_objects.add_customobject`, but the bulk-action
buttons next to it were never wrapped in similar guards.

Not a security hole — clicks reach NetBox's `customobject_bulk_edit`
and `customobject_bulk_delete` views, which DO enforce perms
server-side and would reject the unauthorized request. But the
unguarded UI render produced confusing UX for non-superusers and
broke toolbar consistency with the just-fixed Add button.

Fix mirrors the `can_add` plumbing for two new flags `can_change` and
`can_delete`, then wraps each bulk-action button individually with the
matching guard (so a user with only `change` perm sees Bulk Edit but
not Bulk Delete, and vice versa). Both template locations covered: the
always-visible toolbar at the bottom of the table card, and the
multi-page select-all-box that only renders when paginated.

Verified end-to-end via Django test client against the live deployment
test users:
- admin (superuser):       Add=1 BulkEdit=1 BulkDelete=1 (no regression)
- smoke-yes (add only):    Add=1 BulkEdit=0 BulkDelete=0 (NEW correct)
- smoke-no  (view only):   Add=0 BulkEdit=0 BulkDelete=0 (no regression)

Pre-fix smoke-yes had BulkEdit=1 / BulkDelete=1.

Rolls into the existing 2.3.0 release entry — no version bump.

Note on test coverage: like b434c9b's permission fix, this commit is
verified by manual smoke test only. There is no existing pattern in
`tests/test_views_typed_smoke.py` for asserting `_TypedTabView.get()`
context contents (all current tests target helper functions); adding
proper view-integration tests for the three perm flags would be its
own follow-up.
---
 CHANGELOG.md                                  | 10 +++
 .../netbox_custom_objects_tab/typed/tab.html  | 68 +++++++++++--------
 netbox_custom_objects_tab/views/typed.py      | 15 ++--
 3 files changed, 60 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a08454b..0efdeac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   (one per Device-pointing field). Bug existed since the typed-tab
   feature was introduced in 2.0.0; only became visible with multi-FK or
   M2M field combinations.
+- **Typed-tab Bulk Edit / Bulk Delete buttons are now permission-gated**
+  against `netbox_custom_objects.change_customobject` /
+  `delete_customobject` respectively, matching the gating pattern the
+  Add button uses. Previously these buttons rendered unconditionally on
+  Typed tabs; clicks were rejected server-side by NetBox's
+  `customobject_bulk_*` views but the unguarded UI render was confusing
+  for non-superusers. Per-button guards (rather than gating the whole
+  toolbar on `change AND delete`) so a user with only `change` perm
+  sees Bulk Edit but not Bulk Delete, and vice versa. Surfaced by the
+  2.3.0 smoke test with non-admin test users.
 
 ## [2.2.0] - 2026-05-11
 
diff --git a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
index bddeaf6..71e59a0 100644
--- a/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
+++ b/netbox_custom_objects_tab/templates/netbox_custom_objects_tab/typed/tab.html
@@ -66,20 +66,26 @@
                                         {% endblocktrans %}
                                     </label>
                                 </div>
-                                <div class="bulk-action-buttons">
-                                    <button type="submit"
-                                            name="_edit"
-                                            formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_edit' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
-                                            class="btn btn-yellow">
-                                        <i class="mdi mdi-pencil" aria-hidden="true"></i> Bulk Edit
-                                    </button>
-                                    <button type="submit"
-                                            name="_delete"
-                                            formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_delete' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
-                                            class="btn btn-red">
-                                        <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> Bulk Delete
-                                    </button>
-                                </div>
+                                {% if can_change or can_delete %}
+                                    <div class="bulk-action-buttons">
+                                        {% if can_change %}
+                                            <button type="submit"
+                                                    name="_edit"
+                                                    formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_edit' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
+                                                    class="btn btn-yellow">
+                                                <i class="mdi mdi-pencil" aria-hidden="true"></i> Bulk Edit
+                                            </button>
+                                        {% endif %}
+                                        {% if can_delete %}
+                                            <button type="submit"
+                                                    name="_delete"
+                                                    formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_delete' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
+                                                    class="btn btn-red">
+                                                <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> Bulk Delete
+                                            </button>
+                                        {% endif %}
+                                    </div>
+                                {% endif %}
                             </div>
                         </div>
                     </div>
@@ -123,20 +129,26 @@
                                 </div>
                             {% endif %}
                         {% endif %}
-                        <div class="bulk-action-buttons">
-                            <button type="submit"
-                                    name="_edit"
-                                    formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_edit' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
-                                    class="btn btn-yellow">
-                                <i class="mdi mdi-pencil" aria-hidden="true"></i> Bulk Edit
-                            </button>
-                            <button type="submit"
-                                    name="_delete"
-                                    formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_delete' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
-                                    class="btn btn-red">
-                                <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> Bulk Delete
-                            </button>
-                        </div>
+                        {% if can_change or can_delete %}
+                            <div class="bulk-action-buttons">
+                                {% if can_change %}
+                                    <button type="submit"
+                                            name="_edit"
+                                            formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_edit' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
+                                            class="btn btn-yellow">
+                                        <i class="mdi mdi-pencil" aria-hidden="true"></i> Bulk Edit
+                                    </button>
+                                {% endif %}
+                                {% if can_delete %}
+                                    <button type="submit"
+                                            name="_delete"
+                                            formaction="{% url 'plugins:netbox_custom_objects:customobject_bulk_delete' custom_object_type=custom_object_type.slug %}?return_url={{ return_url|urlencode:'' }}"
+                                            class="btn btn-red">
+                                        <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> Bulk Delete
+                                    </button>
+                                {% endif %}
+                            </div>
+                        {% endif %}
                     </div>
                 </div>
             </form>
diff --git a/netbox_custom_objects_tab/views/typed.py b/netbox_custom_objects_tab/views/typed.py
index 4c49995..014863d 100644
--- a/netbox_custom_objects_tab/views/typed.py
+++ b/netbox_custom_objects_tab/views/typed.py
@@ -260,12 +260,15 @@ def get(self, request, pk, **kwargs):
 
             return_url = request.get_full_path()
 
-            # Add-button: link(s) to native CO add view with reverse field pre-filled.
-            # Permission is checked against the BASE CustomObject model, not the per-type
-            # dynamic subclass: NetBox grants `netbox_custom_objects.add_customobject` (the
-            # single perm enforced by `customobject_add`), never `add_table28model`.
-            # Mirrors the pattern used inside `CustomObjectActionsColumn`.
+            # Toolbar permissions: checked against the BASE CustomObject model, not the
+            # per-type dynamic subclass. NetBox grants
+            # `netbox_custom_objects.{add,change,delete}_customobject` (the perms enforced
+            # by `customobject_add` / `customobject_bulk_edit` / `customobject_bulk_delete`),
+            # never `{add,change,delete}_table28model`. Mirrors the pattern used inside
+            # `CustomObjectActionsColumn`.
             can_add = request.user.has_perm("netbox_custom_objects.add_customobject")
+            can_change = request.user.has_perm("netbox_custom_objects.change_customobject")
+            can_delete = request.user.has_perm("netbox_custom_objects.delete_customobject")
             add_links = _build_add_links(cot.slug, instance.pk, field_infos, return_url) if can_add else []
 
             try:
@@ -284,6 +287,8 @@ def get(self, request, pk, **kwargs):
                 "model": dynamic_model,
                 "preferences": preferences,
                 "can_add": can_add,
+                "can_change": can_change,
+                "can_delete": can_delete,
                 "add_links": add_links,
                 "add_label": add_label,
             }

From 06b3cd4f9544f24f8e853ad379c55c043a0a0309 Mon Sep 17 00:00:00 2001
From: Jan Krupa <jan.krupa@cesnet.cz>
Date: Tue, 12 May 2026 13:12:28 +0200
Subject: [PATCH 6/6] Document upstream CustomObjectDeleteView ValueError as
 2.3.0 Known Issue

The 2.3.0 comprehensive smoke test surfaced a deterministic ValueError
in upstream `netbox_custom_objects` (NOT in this plugin) at
`netbox_custom_objects/views.py:977` inside
`CustomObjectDeleteView._get_dependent_objects(obj)`:

    ValueError: Cannot query "<row>": Must be "Table<N>Model" instance.

Trigger: create a custom object via this plugin's new 2.3.0 Add button,
then immediately click the per-row Delete in the typed-tab list. The
first delete GET fails; refreshing the list before clicking Delete
works around it. Bulk Delete (different upstream code path) is
unaffected. Pre-existing rows are unaffected.

Root cause is dynamic-model class identity drift across the
Create -> Delete request boundary: each Custom Object Type backs a
dynamically-generated Django model (Table<N>Model), the model class
registry rebuilds during the Create POST, and the immediately-following
Delete GET still holds a reference to the prior class object in some
scope until a request boundary refreshes it. Django's
`Collector.collect([obj])` walks each related model's
`_base_manager.using(...).filter(<predicate referencing obj>)`, and
`check_query_object_type` raises ValueError when obj's class doesn't
match the related model's expected concrete class.

This plugin's 2.3.0 release surface is correct end-to-end (smoke test
passed every brief item). What 2.3.0 does is make this latent upstream
bug more reachable by adding an Add button that delivers users straight
into the affected Create -> Delete flow. Per user decision, no upstream
issue filing, no upstream patch, no workaround in our code -- just
honest documentation in three places so users encountering the bug find
the workaround quickly:

- CHANGELOG.md: new `### Known Issues` subsection under [2.3.0]
- README.md: new `## Known Issues` section between How It Works and
  Support, with both workarounds (refresh the list, or use Bulk Delete)
- netbox_custom_objects_tab/views/typed.py: comment block immediately
  above the `add_links = _build_add_links(...)` line so contributors
  investigating the Add button code path see the upstream gotcha

No version bump (rolls into 2.3.0). No test changes. No pyproject
changes. ruff clean, 61/61 tests pass.
---
 CHANGELOG.md                             | 18 +++++++++++++
 README.md                                | 33 ++++++++++++++++++++++++
 netbox_custom_objects_tab/views/typed.py |  7 +++++
 3 files changed, 58 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0efdeac..0f0e4c4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,6 +56,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   sees Bulk Edit but not Bulk Delete, and vice versa. Surfaced by the
   2.3.0 smoke test with non-admin test users.
 
+### Known Issues
+
+- **Upstream `netbox_custom_objects` bug surfaced by the new Add button**:
+  deleting a custom object **immediately** after creating it via the
+  2.3.0 Add button (Create → row dropdown → Delete in the typed tab list)
+  raises `ValueError: Cannot query "X": Must be "Table<N>Model" instance.`
+  from `CustomObjectDeleteView._get_dependent_objects` (upstream
+  `netbox_custom_objects/views.py:977`). The error fires only on the
+  *first* delete GET in that flow; refreshing the list page before
+  clicking Delete works around it, and Bulk Delete (different code path)
+  is unaffected. Root cause is dynamic-model class identity drift across
+  the Create → Delete request boundary in upstream code (the dynamic
+  model class registry rebuilds during Create, but the immediately-
+  following Delete request still holds a reference to the previous class
+  in some scope). Tracked here as a documentation-only release note since
+  the fix needs to land in `netbox_custom_objects`, not in this plugin.
+  See README "Known Issues" section for user-facing workarounds.
+
 ## [2.2.0] - 2026-05-11
 
 ### Changed
diff --git a/README.md b/README.md
index 42f7593..1f0b3ad 100644
--- a/README.md
+++ b/README.md
@@ -208,6 +208,39 @@ The tab displays:
 | **Tags** | Colored tag badges assigned to the Custom Object instance; `—` when none |
 | *(actions)* | Edit and Delete buttons, each shown only when the user has the corresponding permission |
 
+## Known Issues
+
+### Per-row Delete fails on the first attempt right after Create (upstream bug)
+
+After creating a custom object via the 2.3.0 "Add *Type*" button on a
+Typed tab, clicking the per-row **Delete** action in the list **on the
+very first attempt** raises a `ValueError` inside upstream
+`netbox_custom_objects.CustomObjectDeleteView`:
+
+```
+ValueError: Cannot query "<row title>": Must be "Table<N>Model" instance.
+```
+
+(at `netbox_custom_objects/views.py:977`, inside
+`_get_dependent_objects`). Workarounds:
+
+1. **Refresh the typed-tab list page** between clicking Create and
+   clicking the per-row Delete. The second `/delete/` GET succeeds.
+2. **Use Bulk Delete** instead — it goes through a different upstream
+   code path and is unaffected.
+
+Pre-existing rows (created in earlier sessions or via the upstream
+"Add" menu under Custom Objects → *Type*) are not affected. The bug
+originates in dynamic-model class identity drift across the
+Create → Delete request boundary in the upstream `netbox_custom_objects`
+plugin: each Custom Object Type backs a dynamically-generated Django
+model (`Table<N>Model`), the model class registry rebuilds during the
+Create POST, and the immediately-following Delete GET still holds a
+reference to the prior class object in some scope (queryset cache,
+prefetch, or import-level reference) until a request boundary refreshes
+it. Will be tracked and fixed upstream; this plugin's 2.3.0 release
+ships with the workaround documented here.
+
 ## Support
 
 - Open an issue on [GitHub](https://github.com/CESNET/netbox-custom-objects-tab/issues)
diff --git a/netbox_custom_objects_tab/views/typed.py b/netbox_custom_objects_tab/views/typed.py
index 014863d..569198c 100644
--- a/netbox_custom_objects_tab/views/typed.py
+++ b/netbox_custom_objects_tab/views/typed.py
@@ -269,6 +269,13 @@ def get(self, request, pk, **kwargs):
             can_add = request.user.has_perm("netbox_custom_objects.add_customobject")
             can_change = request.user.has_perm("netbox_custom_objects.change_customobject")
             can_delete = request.user.has_perm("netbox_custom_objects.delete_customobject")
+            # Known issue (2.3.0): Add button below routes saved objects through upstream
+            # customobject_add and immediately back to this typed tab. Clicking the per-row
+            # Delete on the just-created row in the same flow triggers an upstream ValueError
+            # in CustomObjectDeleteView (model class identity drift across the Create→Delete
+            # request boundary; see netbox_custom_objects/views.py:977). User-facing
+            # workarounds: refresh the list between Create and Delete, or use Bulk Delete.
+            # Documented in README "Known Issues" and CHANGELOG [2.3.0].
             add_links = _build_add_links(cot.slug, instance.pk, field_infos, return_url) if can_add else []
 
             try: