Custom object types visible in menu without permissions

[jnovinger]

Plugin Version

0.4.5

NetBox Version

4.5.0

Python Version

3.12

Steps to Reproduce

1. Create a custom object type (e.g., "Server")
2. Create a user with no permissions for custom objects
3. Log in as that user
4. Open the navigation menu

Expected Behavior

The user should not see custom object types in the menu since they have no permissions to view the corresponding custom objects.

Observed Behavior

The user can see all custom object types listed in the "Custom Objects" menu. They cannot view the actual objects (permission enforcement works on the views), but the types themselves are visible.

[jnovinger]

The cause is navigation.py:29 iterates over CustomObjectType.objects.all() without permission filtering. Menu items set auth_required=True but don't use the permissions parameter that PluginMenuItem supports.