Merge commit '3309032b261e891944db5270a305a3ecf9f926ce' into block-notes

CHANGELOG.md

@@ -36,6 +36,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- [#12142](https://github.com/inventree/InvenTree/pull/12142) prevents users from printing reports or labels against models for which they do not have adequate permissions. This change improves the security of the system by ensuring that users cannot access or print reports or labels for models they do not have permission to view.
 - [#11990](https://github.com/inventree/InvenTree/pull/11990) build output operations performed via the API now offload the work to a background task, and now return a task ID which can be used to monitor the progress of the task. This allows for better performance and responsiveness when performing build output operations, as the work is performed asynchronously in the background.
 - [#11825](https://github.com/inventree/InvenTree/pull/11825) adds a new "bom" ruleset and associated permissions for BOM management, separate from the "part" ruleset which remains focused on part management. This allows for more granular control over user permissions, allowing users to have different levels of access to part management and BOM management functionality.
 - [#11816](https://github.com/inventree/InvenTree/pull/11816) makes the `issued_by` field on the `Build` API read only, and instead sets the `issued_by` field to the current user when a build is created. This change was made to ensure that the `issued_by` field accurately reflects the user who created the build, and to prevent users from setting this field to an arbitrary value when creating or updating a build.

src/backend/InvenTree/InvenTree/api_version.py

@@ -1,16 +1,23 @@
 """InvenTree API version information."""
 
 # InvenTree API version
-INVENTREE_API_VERSION = 502
+INVENTREE_API_VERSION = 504
 """Increment this API version number whenever there is a significant change to the API that any clients need to know about."""
 
 INVENTREE_API_TEXT = """
 
-v502 -> 2026-06-06 : https://github.com/inventree/InvenTree/pull/11971
+v504 -> 2026-06-11 : https://github.com/inventree/InvenTree/pull/11971
     - Removes direct "notes" field from any models which previously supported markdown notes
     - Adds a generic "Note" model which can be attached to any model type via a generic foreign key relationship
     - Allow multiple notes to be attached to a single object, and for notes to be created / edited / deleted via the API
 
+v503 -> 2026-06-11 : https://github.com/inventree/InvenTree/pull/12155
+    - Adds additional filtering and sorting options to the LabelTemplate API endpoint
+    - Adds additional filtering and sorting options to the ReportTemplate API endpoint
+
+v502 -> 2026-06-10 : https://github.com/inventree/InvenTree/pull/12142
+    - Prevents users from printing reports or labels against models for which they do not have adequate permissions. This change improves the security of the system by ensuring that users cannot access or print reports or labels for models they do not have permission to view.
+
 v501 -> 2026-06-05 : https://github.com/inventree/InvenTree/pull/12093
     - Adds "read_only" attribute to PluginSetting API endpoint, which indicates whether a particular plugin setting is read-only (i.e. cannot be modified via the API)
 

src/backend/InvenTree/machine/machine_types/label_printer.py

@@ -267,4 +267,4 @@ class LabelPrinterMachine(BaseMachineType):
         if not location_pk:
             return None
 
-        return StockLocation.objects.get(pk=location_pk)
+        return StockLocation.objects.filter(pk=location_pk).first()

src/backend/InvenTree/machine/tests.py

@@ -171,6 +171,8 @@ class TestLabelPrinterMachineType(InvenTreeAPITestCase):
 
     fixtures = ['category', 'part', 'location', 'stock']
 
+    roles = ['part.view']
+
     def test_registration(self):
         """Test that the machine is correctly registered from the plugin."""
         PLG_KEY = 'label-printer-test-plugin'
@@ -295,6 +297,14 @@ class TestLabelPrinterMachineType(InvenTreeAPITestCase):
 
         self.assertIn('is not a valid choice', str(response.data['machine']))
 
+    def test_location_invalid_pk(self):
+        """Test that location property returns None for an invalid PK without raising."""
+        machine = self.create_machine()
+
+        machine.set_setting('LOCATION', 'M', 999999)
+
+        self.assertIsNone(machine.location)
+
 
 class AdminTest(AdminTestCase):
     """Tests for the admin interface integration."""

src/backend/InvenTree/plugin/registry.py

@@ -1027,7 +1027,11 @@ class PluginsRegistry:
         data = md5()
 
         # Hash for all loaded plugins
-        for slug, plug in self.plugins.items():
+        # Note: Sort by slug, so the hash is independent of discovery order.
+        # Different processes can discover the same plugins in a different
+        # order, and the hash must represent the registry *state*, not the
+        # iteration order of any particular process.
+        for slug, plug in sorted(self.plugins.items(), key=lambda item: item[0]):
             data.update(str(slug).encode())
             data.update(str(plug.name).encode())
             data.update(str(plug.version).encode())

src/backend/InvenTree/plugin/test_plugin.py

@@ -538,6 +538,30 @@ class RegistryTests(TestQueryMixin, PluginRegistryMixin, TestCase):
             registry.registry_hash = 'abc'
             self.assertTrue(registry.check_reload())
 
+    def test_registry_hash_order_independence(self):
+        """Test that the registry hash does not depend on plugin iteration order.
+
+        Different processes (gunicorn workers, background worker, shell) can
+        discover the same set of plugins in a different order. If the hash
+        depends on iteration order, processes disagree about the hash for the
+        same registry state, and ping-pong each other into endless reloads
+        via check_reload.
+        """
+        original_plugins = registry.plugins
+
+        # Reversing a dict with fewer than 2 entries would not change anything
+        self.assertGreater(len(original_plugins), 1)
+
+        try:
+            hash_original = registry.calculate_plugin_hash()
+
+            # Simulate a process which discovered the same plugins in reverse order
+            registry.plugins = dict(reversed(list(original_plugins.items())))
+
+            self.assertEqual(hash_original, registry.calculate_plugin_hash())
+        finally:
+            registry.plugins = original_plugins
+
     def test_builtin_mandatory_plugins(self):
         """Test that mandatory builtin plugins are always loaded."""
         from plugin.models import PluginConfig

src/backend/InvenTree/report/api.py

@@ -7,8 +7,8 @@ from django.utils.translation import gettext_lazy as _
 from django.views.decorators.cache import never_cache
 
 import django_filters.rest_framework.filters as rest_filters
-from django_filters.rest_framework import DjangoFilterBackend
 from django_filters.rest_framework.filterset import FilterSet
+from rest_framework.exceptions import PermissionDenied
 from rest_framework.generics import GenericAPIView
 from rest_framework.response import Response
 
@@ -16,10 +16,11 @@ import InvenTree.permissions
 import report.helpers
 import report.models
 import report.serializers
+import users.permissions
 from common.models import DataOutput
 from common.serializers import DataOutputSerializer
 from InvenTree.api import meta_path
-from InvenTree.filters import InvenTreeSearchFilter
+from InvenTree.filters import SEARCH_ORDER_FILTER
 from InvenTree.mixins import ListCreateAPI, RetrieveUpdateDestroyAPI
 from plugin import PluginMixinEnum
 from plugin.builtin.labels.inventree_label import InvenTreeLabelPlugin
@@ -79,7 +80,7 @@ class ReportFilter(ReportFilterBase):
         """Filter options."""
 
         model = report.models.ReportTemplate
-        fields = ['landscape']
+        fields = ['landscape', 'merge', 'attach_to_model', 'enabled', 'model_type']
 
 
 class LabelFilter(ReportFilterBase):
@@ -89,7 +90,7 @@ class LabelFilter(ReportFilterBase):
         """Filter options."""
 
         model = report.models.LabelTemplate
-        fields = []
+        fields = ['enabled']
 
 
 class LabelPrint(GenericAPIView):
@@ -161,6 +162,14 @@ class LabelPrint(GenericAPIView):
 
         template = serializer.validated_data['template']
 
+        model_class = template.get_model()
+        if model_class and not users.permissions.check_user_permission(
+            request.user, model_class, 'view'
+        ):
+            raise PermissionDenied(
+                _('You do not have permission to view this model type')
+            )
+
         if template.width <= 0 or template.height <= 0:
             raise ValidationError({'template': _('Invalid label dimensions')})
 
@@ -174,7 +183,7 @@ class LabelPrint(GenericAPIView):
 
         plugin = self.get_plugin_class(plugin_key, raise_error=True)
 
-        instances = template.get_model().objects.filter(pk__in=items)
+        instances = model_class.objects.filter(pk__in=items)
 
         # Sort the instances by the order of the provided items
         instances = sorted(instances, key=lambda item: items.index(item.pk))
@@ -236,9 +245,9 @@ class LabelTemplateList(TemplatePermissionMixin, LabelTemplateMixin, ListCreateA
     """API endpoint for viewing list of LabelTemplate objects."""
 
     filterset_class = LabelFilter
-    filter_backends = [DjangoFilterBackend, InvenTreeSearchFilter]
+    filter_backends = SEARCH_ORDER_FILTER
     search_fields = ['name', 'description']
-    ordering_fields = ['name', 'enabled']
+    ordering_fields = ['name', 'enabled', 'width', 'height']
 
 
 class LabelTemplateDetail(
@@ -261,9 +270,18 @@ class ReportPrint(GenericAPIView):
         serializer.is_valid(raise_exception=True)
 
         template = serializer.validated_data['template']
+
+        model_class = template.get_model()
+        if model_class and not users.permissions.check_user_permission(
+            request.user, model_class, 'view'
+        ):
+            raise PermissionDenied(
+                _('You do not have permission to view this model type')
+            )
+
         items = serializer.validated_data['items']
 
-        instances = template.get_model().objects.filter(pk__in=items)
+        instances = model_class.objects.filter(pk__in=items)
 
         # Sort the instances by the order of the provided items
         instances = sorted(instances, key=lambda item: items.index(item.pk))
@@ -322,7 +340,7 @@ class ReportTemplateList(TemplatePermissionMixin, ReportTemplateMixin, ListCreat
     """API endpoint for viewing list of ReportTemplate objects."""
 
     filterset_class = ReportFilter
-    filter_backends = [DjangoFilterBackend, InvenTreeSearchFilter]
+    filter_backends = SEARCH_ORDER_FILTER
     search_fields = ['name', 'description']
     ordering_fields = ['name', 'enabled']
 

src/backend/InvenTree/report/serializers.py

@@ -110,7 +110,7 @@ class ReportPrintSerializer(serializers.Serializer):
         fields = ['template', 'items']
 
     template = serializers.PrimaryKeyRelatedField(
-        queryset=report.models.ReportTemplate.objects.all(),
+        queryset=report.models.ReportTemplate.objects.filter(enabled=True),
         many=False,
         required=True,
         allow_null=False,
@@ -151,7 +151,7 @@ class LabelPrintSerializer(serializers.Serializer):
         super().__init__(*args, **kwargs)
 
     template = serializers.PrimaryKeyRelatedField(
-        queryset=report.models.LabelTemplate.objects.all(),
+        queryset=report.models.LabelTemplate.objects.filter(enabled=True),
         many=False,
         required=True,
         allow_null=False,

src/backend/InvenTree/report/tests.py

@@ -17,7 +17,7 @@ from build.models import Build
 from common.models import Attachment
 from common.settings import set_global_setting
 from InvenTree.unit_test import AdminTestCase, InvenTreeAPITestCase
-from order.models import ReturnOrder, SalesOrder
+from order.models import PurchaseOrder, ReturnOrder, SalesOrder
 from part.models import Part
 from plugin.registry import registry
 from report.models import LabelTemplate, ReportTemplate
@@ -731,6 +731,140 @@ class TestReportTest(PrintTestMixins, ReportTest):
             self.run_print_test(SalesOrder, 'salesorder', label=False)
 
 
+class ReportPrintPermissionTest(InvenTreeAPITestCase):
+    """Test that the report print endpoint checks VIEW permission on the associated model type."""
+
+    fixtures = [
+        'category',
+        'part',
+        'company',
+        'location',
+        'supplier_part',
+        'stock',
+        'order',
+    ]
+
+    superuser = False
+    roles = []
+
+    def setUp(self):
+        """Setup for permission tests."""
+        cache.clear()
+        apps.get_app_config('report').create_default_reports()
+        return super().setUp()
+
+    def test_report_print_model_permission(self):
+        """A user without VIEW permission on the model type must receive 403; granting the role allows printing."""
+        template = ReportTemplate.objects.filter(
+            enabled=True, model_type='purchaseorder'
+        ).first()
+        self.assertIsNotNone(template)
+
+        items = PurchaseOrder.objects.all()[:2]
+        self.assertGreater(len(items), 0)
+
+        url = reverse('api-report-print')
+        post_data = {'template': template.pk, 'items': [item.pk for item in items]}
+
+        # No roles assigned: expect permission denied
+        self.post(url, data=post_data, expected_code=403)
+
+        # Grant view access to purchase orders
+        self.assignRole('purchase_order.view')
+        cache.clear()
+
+        # Should now succeed
+        self.post(url, data=post_data, expected_code=201)
+
+    def test_report_print_disabled_template(self):
+        """Printing against a disabled report template must be rejected."""
+        self.assignRole('purchase_order.view')
+        cache.clear()
+
+        template = ReportTemplate.objects.filter(
+            enabled=True, model_type='purchaseorder'
+        ).first()
+        self.assertIsNotNone(template)
+
+        items = PurchaseOrder.objects.all()[:2]
+        self.assertGreater(len(items), 0)
+
+        url = reverse('api-report-print')
+        post_data = {'template': template.pk, 'items': [item.pk for item in items]}
+
+        # Enabled template: should succeed
+        self.post(url, data=post_data, expected_code=201)
+
+        # Disable the template and retry: should be rejected
+        template.enabled = False
+        template.save()
+
+        self.post(url, data=post_data, expected_code=400)
+
+
+class LabelPrintPermissionTest(InvenTreeAPITestCase):
+    """Test that the label print endpoint checks VIEW permission on the associated model type."""
+
+    fixtures = ['category', 'part', 'company', 'location', 'supplier_part', 'stock']
+
+    superuser = False
+    roles = []
+
+    def setUp(self):
+        """Setup for permission tests."""
+        cache.clear()
+        apps.get_app_config('report').create_default_labels()
+        return super().setUp()
+
+    def test_label_print_model_permission(self):
+        """A user without VIEW permission on the model type must receive 403; granting the role allows printing."""
+        template = LabelTemplate.objects.filter(enabled=True, model_type='part').first()
+        self.assertIsNotNone(template)
+        self.assertGreater(template.width, 0)
+        self.assertGreater(template.height, 0)
+
+        items = Part.objects.all()[:2]
+        self.assertGreater(len(items), 0)
+
+        url = reverse('api-label-print')
+        post_data = {'template': template.pk, 'items': [item.pk for item in items]}
+
+        # No roles assigned: expect permission denied
+        self.post(url, data=post_data, expected_code=403)
+
+        # Grant view access to parts
+        self.assignRole('part.view')
+        cache.clear()
+
+        # Should now succeed
+        self.post(url, data=post_data, expected_code=201)
+
+    def test_label_print_disabled_template(self):
+        """Printing against a disabled label template must be rejected."""
+        self.assignRole('part.view')
+        cache.clear()
+
+        template = LabelTemplate.objects.filter(enabled=True, model_type='part').first()
+        self.assertIsNotNone(template)
+        self.assertGreater(template.width, 0)
+        self.assertGreater(template.height, 0)
+
+        items = Part.objects.all()[:2]
+        self.assertGreater(len(items), 0)
+
+        url = reverse('api-label-print')
+        post_data = {'template': template.pk, 'items': [item.pk for item in items]}
+
+        # Enabled template: should succeed
+        self.post(url, data=post_data, expected_code=201)
+
+        # Disable the template and retry: should be rejected
+        template.enabled = False
+        template.save()
+
+        self.post(url, data=post_data, expected_code=400)
+
+
 class AdminTest(AdminTestCase):
     """Tests for the admin interface integration."""
 

src/frontend/lib/types/Tables.tsx

@@ -70,6 +70,11 @@ export type TableState = {
   idAccessor?: string;
 };
 
+export type TableColumnFilterType =
+  | string
+  | string[]
+  | (({ close }: { close: () => void }) => ReactNode);
+
 /**
  * Table column properties
  *
@@ -109,10 +114,7 @@ export type TableColumnProps<T = any> = {
   editable?: boolean;
   definition?: ApiFormFieldType;
   render?: (record: T, index?: number) => any;
-  filter?:
-    | string
-    | string[]
-    | (({ close }: { close: () => void }) => ReactNode);
+  filter?: TableColumnFilterType;
   filtering?: boolean;
   width?: number;
   minWidth?: string | number;

src/frontend/src/defaults/actions.tsx

@@ -2,6 +2,7 @@ import { t } from '@lingui/core/macro';
 import type { SpotlightActionData } from '@mantine/spotlight';
 import {
   IconBarcode,
+  IconDevicesPc,
   IconLink,
   IconPlug,
   IconPointer,
@@ -9,7 +10,8 @@ import {
   IconSettings,
   IconTags,
   IconUserBolt,
-  IconUserCog
+  IconUserCog,
+  IconUsers
 } from '@tabler/icons-react';
 import type { NavigateFunction } from 'react-router-dom';
 
@@ -213,6 +215,16 @@ export function getActions(navigate: NavigateFunction) {
         leftSection: <IconReport size='1.2rem' />
       });
 
+    staff &&
+      user?.hasViewPermission(ModelType.user) &&
+      _actions.push({
+        id: 'users',
+        label: t`Users`,
+        description: t`Manage user accounts`,
+        onClick: () => navigate('/settings/admin/user'),
+        leftSection: <IconUsers size='1.2rem' />
+      });
+
     staff &&
       user?.hasViewPermission(ModelType.pluginconfig) &&
       _actions.push({
@@ -223,6 +235,16 @@ export function getActions(navigate: NavigateFunction) {
         leftSection: <IconPlug size='1.2rem' />
       });
 
+    staff &&
+      user?.hasViewPermission(ModelType.pluginconfig) &&
+      _actions.push({
+        id: 'machine-management',
+        label: t`Machines`,
+        description: t`Manage machines and machine types`,
+        onClick: () => navigate('/settings/admin/machine'),
+        leftSection: <IconDevicesPc size='1.2rem' />
+      });
+
     staff &&
       user?.hasViewPermission(ModelType.reporttemplate) &&
       _actions.push({

src/frontend/src/pages/Index/Settings/AdminCenter/LabelTemplatePanel.tsx

@@ -10,8 +10,12 @@ function LabelTemplateTable() {
         templateEndpoint: ApiEndpoints.label_list,
         printingEndpoint: ApiEndpoints.label_print,
         additionalFormFields: {
-          width: {},
-          height: {}
+          width: {
+            sortable: true
+          },
+          height: {
+            sortable: true
+          }
         }
       }}
     />

src/frontend/src/pages/Index/Settings/AdminCenter/ReportTemplatePanel.tsx

@@ -17,24 +17,44 @@ function ReportTemplateTable() {
         modelType: ModelType.reporttemplate,
         templateEndpoint: ApiEndpoints.report_list,
         printingEndpoint: ApiEndpoints.report_print,
+        additionalFilters: [
+          {
+            name: 'landscape',
+            label: t`Landscape`,
+            type: 'boolean'
+          },
+          {
+            name: 'merge',
+            label: t`Merge`,
+            type: 'boolean'
+          },
+          {
+            name: 'attach_to_model',
+            label: t`Attach to Model`,
+            type: 'boolean'
+          }
+        ],
         additionalFormFields: {
           page_size: {
             label: t`Page Size`
           },
           landscape: {
             label: t`Landscape`,
+            filter: 'landscape',
             modelRenderer: (instance: any) => (
               <YesNoButton value={instance.landscape} />
             )
           },
           merge: {
             label: t`Merge`,
+            filter: 'merge',
             modelRenderer: (instance: any) => (
               <YesNoButton value={instance.merge} />
             )
           },
           attach_to_model: {
             label: t`Attach to Model`,
+            filter: 'attach_to_model',
             modelRenderer: (instance: any) => (
               <YesNoButton value={instance.attach_to_model} />
             )

src/frontend/src/tables/Filter.tsx

@@ -374,11 +374,13 @@ export function ProjectCodeFilter(): TableFilter {
 export function OwnerFilter({
   name,
   label,
-  description
+  description,
+  apiFilter
 }: {
   name: string;
   label: string;
   description: string;
+  apiFilter?: Record<string, any>;
 }): TableFilter {
   return {
     name: name,
@@ -386,6 +388,7 @@ export function OwnerFilter({
     description: description,
     type: 'api',
     apiUrl: apiUrl(ApiEndpoints.owner_list),
+    apiFilter: { is_active: true, ...apiFilter },
     model: ModelType.owner,
     modelRenderer: (instance: any) => instance.name
   };
@@ -425,11 +428,13 @@ export function TagsFilter({
 export function UserFilter({
   name,
   label,
-  description
+  description,
+  apiFilter
 }: {
   name?: string;
   label?: string;
   description?: string;
+  apiFilter?: Record<string, any>;
 }): TableFilter {
   return {
     name: name ?? 'user',
@@ -437,6 +442,7 @@ export function UserFilter({
     description: description ?? t`Filter by user`,
     type: 'api',
     apiUrl: apiUrl(ApiEndpoints.user_list),
+    apiFilter: { is_active: true, ...apiFilter },
     model: ModelType.user,
     modelRenderer: (instance: any) => instance.username
   };

src/frontend/src/tables/FilterSelectDrawer.tsx

@@ -585,7 +585,7 @@ export function ColumnFilterPopover({
   const closeOnApply = filters.length === 1;
 
   return (
-    <Stack gap={5} p={3}>
+    <Stack gap={5} p={3} miw={250}>
       {filters.map((filter, index) => (
         <Stack gap='xs' key={filter.name}>
           {index > 0 && <Divider />}

src/frontend/src/tables/TableHoverCard.tsx

@@ -24,7 +24,8 @@ export function TableHoverCard({
   icon, // The icon to display
   iconColor, // The icon color
   position, // The position of the hovercard
-  zIndex // Optional z-index for the hovercard
+  zIndex, // Optional z-index for the hovercard
+  minWidth // Optional minimum width for the dropdown
 }: Readonly<{
   value: any;
   extra?: ReactNode;
@@ -33,6 +34,7 @@ export function TableHoverCard({
   iconColor?: string;
   position?: FloatingPosition;
   zIndex?: string | number;
+  minWidth?: number;
 }>) {
   const extraItems: ReactNode = useMemo(() => {
     if (Array.isArray(extra)) {
@@ -74,7 +76,7 @@ export function TableHoverCard({
           />
         </Group>
       </HoverCard.Target>
-      <HoverCard.Dropdown>
+      <HoverCard.Dropdown style={minWidth ? { minWidth } : undefined}>
         <Stack gap='xs'>
           <Group gap='xs' justify='left'>
             <InvenTreeIcon

src/frontend/src/tables/build/BuildOrderTable.tsx

@@ -120,6 +120,7 @@ export function BuildOrderTable({
       UserColumn({
         accessor: 'issued_by_detail',
         ordering: 'issued_by',
+        filter: 'issued_by',
         title: t`Issued By`
       }),
       ResponsibleColumn({}),

src/frontend/src/tables/general/ParametricDataTable.tsx

@@ -14,13 +14,14 @@ import {
 import type { TableFilter } from '@lib/types/Filters';
 import type { TableColumn } from '@lib/types/Tables';
 import { t } from '@lingui/core/macro';
-import { Group } from '@mantine/core';
+import { Divider, Group, Text } from '@mantine/core';
 import { useHover } from '@mantine/hooks';
 import { IconCirclePlus } from '@tabler/icons-react';
 import { useQuery } from '@tanstack/react-query';
 import { type ReactNode, useCallback, useMemo, useState } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { useApi } from '../../contexts/ApiContext';
+import { formatDate } from '../../defaults/formatters';
 import { useParameterFields } from '../../forms/CommonForms';
 import {
   useCreateApiFormModal,
@@ -72,11 +73,41 @@ function ParameterCell({
     parameter.data_numeric != parameter.data
   ) {
     const numeric = formatDecimal(parameter.data_numeric, { digits: 15 });
-    extra.push(`${numeric} [${template.units}]`);
+
+    extra.push(
+      <Group gap='xs' justify='space-between'>
+        <Text size='sm' fw='bold'>
+          {numeric}
+        </Text>
+        <Text size='xs'>[{template.units}]</Text>
+      </Group>
+    );
+  }
+
+  if (parameter?.updated) {
+    extra.push(
+      <Group gap='xs' justify='space-between'>
+        <Text size='sm' fw='bold'>{t`Last Updated`}</Text>
+        <Text size='xs'>{formatDate(parameter.updated)}</Text>
+      </Group>
+    );
+  }
+
+  if (parameter?.updated_by_detail?.username) {
+    extra.push(
+      <Group gap='xs' justify='space-between'>
+        <Text size='sm' fw='bold'>{t`Updated By`}</Text>
+        <Text size='xs'>{parameter.updated_by_detail.username}</Text>
+      </Group>
+    );
   }
 
   if (hovered && canEdit) {
-    extra.push(t`Click to edit`);
+    if (extra.length > 0) {
+      extra.push(<Divider />);
+    }
+
+    extra.push(<Text size='xs'>{t`Click to edit`}</Text>);
   }
 
   return (
@@ -88,6 +119,7 @@ function ParameterCell({
             extra={extra}
             icon={hovered && canEdit ? 'edit' : 'info'}
             title={template.name}
+            minWidth={250}
           />
         </Group>
       </Group>

src/frontend/src/tables/settings/TemplateTable.tsx

@@ -18,8 +18,8 @@ import { apiUrl } from '@lib/functions/Api';
 import { identifierString } from '@lib/functions/Conversion';
 import useTable from '@lib/hooks/UseTable';
 import type { TableFilter } from '@lib/types/Filters';
-import type { ApiFormFieldSet } from '@lib/types/Forms';
-import type { TableColumn } from '@lib/types/Tables';
+import type { ApiFormFieldSet, ApiFormFieldType } from '@lib/types/Forms';
+import type { TableColumn, TableColumnFilterType } from '@lib/types/Tables';
 import {
   CodeEditor,
   PdfPreview,
@@ -68,11 +68,21 @@ export type TemplateI = {
   template: string;
 };
 
+// Additional field props to control the column behaviour in the template table
+interface TemplateFormFieldType extends ApiFormFieldType {
+  sortable?: boolean;
+  switchable?: boolean;
+  filter?: TableColumnFilterType;
+}
+
+type TemplateFormFieldSet = Record<string, TemplateFormFieldType>;
+
 export interface TemplateProps {
   modelType: ModelType.labeltemplate | ModelType.reporttemplate;
   templateEndpoint: ApiEndpoints;
   printingEndpoint: ApiEndpoints;
-  additionalFormFields?: ApiFormFieldSet;
+  additionalFilters?: TableFilter[];
+  additionalFormFields?: TemplateFormFieldSet;
 }
 
 export function TemplateDrawer({
@@ -233,6 +243,7 @@ export function TemplateTable({
       },
       {
         accessor: 'model_type',
+        filter: 'model_type',
         sortable: true,
         switchable: false
       },
@@ -276,10 +287,10 @@ export function TemplateTable({
       },
       ...Object.entries(additionalFormFields || {}).map(([key, field]) => ({
         accessor: key,
-        ...field,
-        title: field.label,
         sortable: false,
         switchable: true,
+        title: field.label,
+        ...field,
         render: field.modelRenderer
       })),
       BooleanColumn({ accessor: 'enabled', title: t`Enabled` })
@@ -391,6 +402,7 @@ export function TemplateTable({
 
   const tableFilters: TableFilter[] = useMemo(() => {
     return [
+      ...(templateProps.additionalFilters || []),
       {
         name: 'enabled',
         label: t`Enabled`,
@@ -404,7 +416,7 @@ export function TemplateTable({
         choices: modelTypeFilters.choices
       }
     ];
-  }, [modelTypeFilters.choices]);
+  }, [templateProps.additionalFilters, modelTypeFilters.choices]);
 
   return (
     <>