cmdbsyncer 4.1.0.dev22__tar.gz → 4.1.2__tar.gz

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.1.0.dev22
+Version: 4.1.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/__init__.py

@@ -252,12 +252,16 @@ if not CLI_MODE:
         """
         Feed the navbar badge in master.html. Runs on every admin
         request, so it must be cheap and fail-soft — the count is a
-        nicety, not a correctness requirement.
+        nicety, not a correctness requirement. The workflow only
+        applies when the operator has nominated critical labels in
+        APPROVAL_REQUIRED_LABELS, so the badge stays hidden otherwise.
         """
         # pylint: disable=import-outside-toplevel
         from flask_login import current_user as _user
         if not app.config.get('CMDB_MODE'):
             return {'pending_approval_count': 0}
+        if not app.config.get('APPROVAL_REQUIRED_LABELS'):
+            return {'pending_approval_count': 0}
         try:
             if not _user.is_authenticated:
                 return {'pending_approval_count': 0}
@@ -557,7 +561,8 @@ def _register_web_layer():  # pylint: disable=too-many-locals,too-many-statement
     admin.add_sub_category(name="Backups", parent_name="Settings")
     from application.models.field_approval import FieldApproval
     from application.views.field_approval import FieldApprovalView
-    admin.add_view(FieldApprovalView(FieldApproval, name="Approvals",
+    admin.add_view(FieldApprovalView(FieldApproval,
+                                     name="Critical Label Approvals",
                                      category="Settings",
                                      menu_icon_type='fa',
                                      menu_icon_value='fa-hourglass-half'))

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/_version.py

@@ -94,13 +94,42 @@ def _has_unreleased_entries():
     return bool(match and match.group(1).strip())
 
 
-def get_display_version():
-    """Display form: ``4.0.0`` / ``4.0.0-dev`` / ``3.12-LTS3``.
+def _installed_version():
+    """The version recorded in installed-package metadata, or None.
+
+    `pyproject.toml` carries the authoritative pre-release counter
+    (``4.1.0.dev22`` etc.) but is gone after ``pip install``. The wheel's
+    dist-info keeps it, so ``importlib.metadata`` recovers the suffix on
+    both PyPI installs and editable installs. Source checkouts without
+    an installation just fall through to the changelog-derived version.
+    """
+    try:
+        from importlib.metadata import (  # pylint: disable=import-outside-toplevel
+            PackageNotFoundError, version as _md_version,
+        )
+        return _md_version('cmdbsyncer')
+    except (PackageNotFoundError, ImportError, ModuleNotFoundError):
+        return None
 
-    PEP 440 stores LTS as ``3.12+lts3``; users see the conventional
-    ``-LTS`` form. ``-dev`` is appended on the main line while an
-    ``## Unreleased`` section is open.
+
+def get_display_version():
+    """Display form: ``4.0.0`` / ``4.0.0-dev22`` / ``3.12-LTS3``.
+
+    Resolution:
+    - LTS lines keep their ``-LTS`` suffix (PEP 440 stores it as ``+lts``).
+    - If the installed metadata carries a pre-release suffix (``.devN``,
+      ``aN``, ``bN``, ``rcN``), surface it as ``-dev22`` / ``-rc1`` etc.
+      so users can tell which dev build they are on.
+    - Otherwise, while an ``## Unreleased`` section is still open in the
+      active changelog, append a bare ``-dev`` (source checkouts before
+      the next pre-release is cut).
     """
     if '+lts' in __version__:
         return __version__.replace('+lts', '-LTS')
+    installed = _installed_version()
+    if installed:
+        match = re.search(r'\.(dev\d+|a\d+|b\d+|rc\d+)$', installed)
+        if match:
+            base = installed[:match.start()]
+            return f'{base}-{match.group(1)}'
     return f'{__version__}-dev' if _has_unreleased_entries() else __version__

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/api/views.py

@@ -14,9 +14,12 @@ API_BP = Blueprint('api', __name__)
 
 # Rate-limit API auth failures per client IP. Only 401 responses deduct from
 # the bucket, so legitimate high-volume API traffic is not throttled — only
-# brute-force / credential-stuffing attempts are.
+# brute-force / credential-stuffing attempts are. Uses its own bucket
+# (API_RATE_LIMIT), independent of the much stricter form-login budget
+# (AUTH_RATE_LIMIT, used by /auth) — otherwise a polling monitoring agent
+# whose creds are momentarily wrong can lock the whole API for an hour.
 limiter.limit(
-    lambda: app.config.get('AUTH_RATE_LIMIT', '3 per minute; 10 per hour'),
+    lambda: app.config.get('API_RATE_LIMIT', '30 per minute; 300 per hour'),
     deduct_when=lambda response: response.status_code == 401,
 )(API_BP)
 

cmdbsyncer-4.1.2/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-05-18T12:46:22Z

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/changelog/v4.1.md

@@ -1,6 +1,22 @@
 # Version 4.1
 
-## Unreleased
+## Version 4.1.2
+
+### Hosts
+- FIX: Label names containing `.` or `$` are again run through the configured `REPLACERS` before the MongoDB-key check, so imports that relied on replacers to sanitize such names no longer fail
+
+### Rules
+- FIX: "Export all rules" now also includes cronjob groups, so a full rule export/import no longer silently drops the schedule configuration
+
+### UI
+- FIX: Settings menu entry "Approvals" renamed to "Critical Label Approvals" and only shown when `APPROVAL_REQUIRED_LABELS` is actually configured (was always visible in CMDB mode even when the workflow was inactive)
+
+## Version 4.1.1
+
+### API
+- FIX: Separate `API_RATE_LIMIT` for `/api/v1` (default `30/min; 300/hour`) so a few 401s no longer lock out monitoring polling for the rest of the hour
+
+## Version 4.1.0
 
 ### Ansible
 - FEAT: Trigger Ansible playbook runs from the host UI with live output and per-host run history
@@ -107,6 +123,7 @@
 - FIX: PyPI installs now ship every plugin's `plugin.json` (was only the `.py` files), and the user `plugins/` directory plus `disabled_plugins.json` next to `app.wsgi` are picked up correctly instead of being looked for inside `site-packages`
 - FEAT: Offline installation bundle always ships base, extras and ansible Python dependencies plus the default Ansible playbook collection, and the bundled `install.sh` deploys the playbooks to `/opt/cmdbsyncer/ansible` (override via `ANSIBLE_TARGET`, skip with `SKIP_ANSIBLE=1`, replace existing target with `FORCE=1`)
 - FEAT: New `make release-pre` target ships sequential pre-release builds (`.devN` / `aN` / `bN` / `rcN`) to PyPI without requiring a hand-edit before each upload; `tools/build_offline_bundle.sh --syncer-version 4.1.0.dev3 --enterprise-version 0.3.9.dev1` pins the offline bundle to those pre-releases so QA can test them on air-gapped systems
+- FEAT: Header version display surfaces the installed pre-release counter — `4.1.0-dev22` / `4.1.0-rc1` etc. — instead of the bare `-dev` suffix, so operators can tell which build is running
 
 ### Refactor
 - REFACTOR: `application/views/host.py` split into focused modules (widgets, filters, renderers)

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/config.py

@@ -196,6 +196,14 @@ class BaseConfig():
     # Applied per client IP to the POST handler; GET (rendering the form) is
     # not rate-limited.
     AUTH_RATE_LIMIT = '3 per minute; 10 per hour'
+    # Rate limit for the /api/v1 namespace. Only 401 responses deduct from
+    # the bucket (see application/api/views.py), so legitimate polling
+    # never spends quota. Picked generous enough that a misconfigured
+    # monitoring agent producing repeated 401s does not lock out the whole
+    # API for the rest of the hour, while still throttling credential
+    # stuffing. Set tighter via local_config.py if your network is fully
+    # trusted, or looser if you have many polling clients.
+    API_RATE_LIMIT = '30 per minute; 300 per hour'
     # Flask-Limiter storage backend. Default is in-process memory, which is
     # fine for single-worker deployments. For multiple workers, set to
     # e.g. 'redis://localhost:6379' or 'mongodb://localhost:27017/cmdb-api'.

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/helpers/local_config_presets.py

@@ -158,6 +158,11 @@ PRESETS = [
              'default': '3 per minute; 10 per hour',
              'hint': 'Per-IP rate limit for login + password-reset POSTs '
                      '(Flask-Limiter syntax).'},
+            {'key': 'API_RATE_LIMIT', 'type': 'str',
+             'default': '30 per minute; 300 per hour',
+             'hint': 'Per-IP rate limit for /api/v1. Only 401 responses '
+                     'count, so legitimate polling never spends quota. '
+                     'Raise if your monitoring polls many endpoints.'},
             {'key': 'RATELIMIT_STORAGE_URI', 'type': 'str',
              'default': 'memory://',
              'hint': 'Backend for rate-limit counters. Use redis:// or '

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/models/host.py

@@ -411,7 +411,6 @@ class Host(db.Document):
         but checks first if needed and also sets
         set_import_sync and import_seen as needed
         """
-        validate_mongo_keys(labels, "label")
         if app.config['LABELS_ITERATE_FIRST_LEVEL']:
             for key, value in list(labels.items()):
                 if isinstance(value, dict):
@@ -419,9 +418,10 @@ class Host(db.Document):
                         labels[f'{key}_{sub_key}'] = sub_value
                     del labels[key]
         label_dict = dict(map(lambda kv: (self._fix_key(kv[0]), kv[1]), labels.items()))
-        # Re-validate after _fix_key so a LOWERCASE/REPLACER config that
-        # strips a key down to an empty / MongoDB-reserved form cannot slip
-        # past the input check.
+        # Validate only after _fix_key: REPLACERS are the intended way to
+        # turn `.`/`$` in incoming label names into MongoDB-safe keys, so
+        # the check must run on the post-replacer form. Anything still
+        # invalid here is rejected with a clear error.
         validate_mongo_keys(label_dict, "label")
         if self.get_labels() != label_dict:
             self.set_import_sync()

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/models/user.py

@@ -16,8 +16,8 @@ roles = [
   ('host', "Hosts"),
   ('objects', "Objects"),
   ('hard_delete', "Permanently delete archived objects"),
-  ('approval', "Approve or reject pending field changes"),
-  ('approval_bypass', "Skip the approval queue when editing critical fields"),
+  ('approval', "Approve or reject pending critical-label changes"),
+  ('approval_bypass', "Skip the approval queue when editing critical labels"),
   ('account', "Account Management"),
   ('log', "Log View"),
   ('global_attributes', "Global Attributes"),

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/plugins/rules/rule_definitions.py

@@ -44,6 +44,7 @@ rules = {
     'vmware_custom_attributes': ('application.plugins.vmware.models', 'VMwareCustomAttributes'),
     'vmware_rewrite_attributes': ('application.plugins.vmware.models', 'VMwareRewriteAttributes'),
     'syncer_rule_automation': ('application.plugins.rules.models', 'SyncerRuleAutomation'),
+    'cron_groups': ('application.models.cron', 'CronGroup'),
 }
 
 

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/templates/admin/master.html

@@ -361,11 +361,11 @@
                     {% if pending_approval_count and pending_approval_count > 0 %}
                     <li id='pending-approvals' class="nav-item">
                       <a href="{{ pending_approval_url }}" class="nav-link"
-                         title="Pending approvals waiting for a second admin">
+                         title="Critical label changes waiting for approval">
                         <i class="fa fa-hourglass-half"></i>
                         <span class="badge badge-warning"
                               style="background:#f39c12;color:#000;">
-                          {{ pending_approval_count }} waiting
+                          {{ pending_approval_count }} label approvals
                         </span>
                       </a>
                     </li>

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/application/views/field_approval.py

@@ -39,10 +39,14 @@ class FieldApprovalView(ModelView):  # pylint: disable=too-many-public-methods,t
     column_filters = ('status', 'hostname', 'field_name', 'requested_by_email')
 
     def is_accessible(self):
-        # The approval queue is part of the CMDB workflow — hide it (and
-        # its menu link) when the install is running in plain syncer mode.
+        # The approval queue only applies when the operator has nominated
+        # critical labels in APPROVAL_REQUIRED_LABELS; with the default
+        # empty list nothing can ever land in the queue, so hide the menu
+        # entry entirely. Also hidden outside CMDB mode.
         if not app.config.get('CMDB_MODE'):
             return False
+        if not app.config.get('APPROVAL_REQUIRED_LABELS'):
+            return False
         return current_user.is_authenticated and (
             current_user.global_admin
             or current_user.has_right('approval')
@@ -56,8 +60,8 @@ class FieldApprovalView(ModelView):  # pylint: disable=too-many-public-methods,t
     def action_approve(self, ids):
         """Apply each pending change to its host and mark the row approved."""
         if not self._can_decide():
-            flash('Approval requires the "Approve or reject pending field '
-                  'changes" role.', 'error')
+            flash('Approval requires the "Approve or reject pending '
+                  'critical-label changes" role.', 'error')
             return redirect(request.referrer or url_for('.index_view'))
         applied, skipped = 0, 0
         for approval in FieldApproval.objects(id__in=ids, status='pending'):
@@ -95,8 +99,8 @@ class FieldApprovalView(ModelView):  # pylint: disable=too-many-public-methods,t
     def action_reject(self, ids):
         """Mark each pending change as rejected without touching the host."""
         if not self._can_decide():
-            flash('Approval requires the "Approve or reject pending field '
-                  'changes" role.', 'error')
+            flash('Approval requires the "Approve or reject pending '
+                  'critical-label changes" role.', 'error')
             return redirect(request.referrer or url_for('.index_view'))
         rejected = 0
         for approval in FieldApproval.objects(id__in=ids, status='pending'):

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/cmdbsyncer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.1.0.dev22
+Version: 4.1.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

{cmdbsyncer-4.1.0.dev22 → cmdbsyncer-4.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cmdbsyncer"
-version = "4.1.0.dev22"
+version = "4.1.2"
 description = "Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems"
 readme = "README.md"
 license = { text = "MIT" }

cmdbsyncer-4.1.0.dev22/application/buildinfo.txt

@@ -1 +0,0 @@
-BUILD_DATE=2026-05-13T08:07:31Z