cmdbsyncer 4.2.0__tar.gz → 4.2.2__tar.gz

{cmdbsyncer-4.2.0/cmdbsyncer.egg-info → cmdbsyncer-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.2.0
+Version: 4.2.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

cmdbsyncer-4.2.2/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-07-14T11:01:00Z

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/changelog/v4.2.md

@@ -1,5 +1,35 @@
 # Version 4.2
 
+## Version 4.2.2
+
+### Ansible
+- FIX: Playbook tasks delegated to localhost (`delegate_to: localhost`) no longer abort with "Failed to create temporary directory" under the web server — the local connection's temp dir now points at a writable per-run path instead of the web user's home
+- FEAT: Checkmk Settings gain an "installation staging path" — the Checkmk server-management playbook stages the downloaded installer there instead of `/tmp`; leave it empty to keep using `/tmp`. Use it when the executing user can't reliably use `/tmp` (permission or private-tmp isolation)
+- FIX: The Checkmk site-update playbook no longer fails the "set downtime" step with "401 Unauthorized" when no Checkmk API user/secret is configured — the downtime is skipped instead
+
+### Checkmk
+- FEAT: The Checkmk module menu is tidier — "Setup Rule Projects" now sits next to "Manage Checkmk Setup Rules", "Limit Host Export to Folders" moved under the host filters, and the separate "Export Scoping" submenu is gone
+- FIX: "Limit Host Export to Folders" now lists rule folders in lowercase to match Checkmk's folder names, so the scope reliably matches the folders hosts are exported to
+- FEAT: "Limit Host Export to Folders" is easier to use — clicking a rule folder or typing one adds it to a list of selected folders you can remove individually, instead of editing a comma-separated text field
+- FEAT: Importing Setup Rules from a Checkmk folder into a project now shows a progress bar and status message while it runs, so you can see it is working
+- FEAT: Checkmk Setup Rules can reference a syncer Checkmk Password with `{{ cmk_password("name") }}`, which resolves to that entry's Checkmk password-store ident on export — run the password export so the entry exists in the target Checkmk
+- FEAT: Importing rules from a Checkmk folder now rewrites inline rule passwords (which Checkmk masks as `******` on read) into such password-store references, so imported rules deploy from a test to a production Checkmk without exposing or overwriting the secret — create a Checkmk Password with the reported name and export it
+
+### Interface
+- FIX: Card-style admin form pages (e.g. the "New Account" plugin-type picker) render with consistent padding and a theme-aware header in all four themes, instead of a header hanging off the edge of a flat card
+
+## Version 4.2.1
+
+### Ansible
+- FIX: Running a playbook from the UI no longer aborts with "cmdbsyncer binary not found" — the local-mode inventory now resolves the `cmdbsyncer` CLI from the venv even when the web server's PATH omits it
+
+### Setup
+- FIX: A fresh `docker compose up` from git now starts — the bundled compose stack was told to reach MongoDB on `127.0.0.1` (the app container itself) instead of the `mongo` service, so the API aborted on boot with `Connection refused` (gh #124)
+
+### Checkmk
+- FIX: Importing Setup Rules from a Checkmk folder now surfaces the real Checkmk error (e.g. wrong credentials) instead of silently reporting "0 rules imported"
+- FEAT: The Checkmk group export now honors an account's (or child account's) object filter for "Checkmk: Export Groups" — set it to include CMDB objects/shadow hosts in the group calculation; without a filter the export stays host-only as before
+
 ## Version 4.2.0
 
 ### Hosts

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/helpers/syncer_jinja.py

@@ -48,6 +48,17 @@ def _cmk_cleanup_hostname(value):
     return _cleanup(value)
 
 
+def _cmk_password(name):
+    """
+    Resolve a syncer Checkmk Password name to its password-store ident
+    (``cmdbsyncer_<id>``) so rules can reference a stored secret instead of an
+    inlined one. Lazily imported to avoid circular imports.
+    """
+    from application.plugins.checkmk.rule_passwords import password_ident
+
+    return password_ident(name)
+
+
 def syncer_eval(string, default=None):
     """
     Evals given object
@@ -139,6 +150,7 @@ _GLOBALS = {
     'merge_list_of_dicts': merge_list_of_dicts,
     'cmk_cleanup_tag_id': _cmk_cleanup_tag_id,
     'cmk_cleanup_hostname': _cmk_cleanup_hostname,
+    'cmk_password': _cmk_password,
     'get_ip_network': get_ip_network,
     'get_ip4_interface': get_ip_interface,
     'get_ip_interface': get_ip_interface,

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/ansible/runner.py

@@ -92,13 +92,23 @@ def _cmdbsyncer_bin() -> str:
 
     The plugin defaults to a bare `cmdbsyncer` and only looks on $PATH,
     which fails when the app runs from a source checkout / container where
-    no `cmdbsyncer` console script is on PATH. Prefer an explicit config /
-    env override, then PATH, then the repo-root wrapper that sits next to
-    the `application` package (mirrors the legacy `ansible/inventory` shim).
+    no `cmdbsyncer` console script is on PATH. Resolution order: explicit
+    config / env override, then the console script inside the running
+    interpreter's venv, then PATH, then the repo-root wrapper that sits next
+    to the `application` package (mirrors the legacy `ansible/inventory` shim).
     """
     override = app.config.get('CMDBSYNCER_BIN') or os.environ.get('CMDBSYNCER_BIN')
     if override:
         return override
+    # Console script installed alongside the running interpreter (e.g.
+    # `/opt/cmdbsyncer/venv/bin/cmdbsyncer`). Checked before $PATH because a
+    # mod_wsgi / gunicorn worker typically runs with a PATH that omits the
+    # venv's bin dir, so shutil.which() finds nothing and we would fall
+    # through to the bare name — which the inventory plugin then fails to
+    # spawn with "cmdbsyncer binary not found ('cmdbsyncer')".
+    venv_bin = Path(sys.prefix) / 'bin' / 'cmdbsyncer'
+    if venv_bin.is_file():
+        return str(venv_bin)
     on_path = shutil.which('cmdbsyncer')
     if on_path:
         return on_path
@@ -340,6 +350,17 @@ def _execute(stats_id, run_params: dict, cwd: Path, provider: str):
         run_tmp = tempfile.mkdtemp(prefix='cmdbsyncer-ansible-')
         env['ANSIBLE_LOCAL_TEMP'] = run_tmp
         env['HOME'] = run_tmp
+        # ANSIBLE_LOCAL_TEMP / $HOME only cover the controller-side scratch
+        # dir. A task delegated to localhost (delegate_to: localhost) runs
+        # over the *local* connection, whose remote_tmp still defaults to
+        # ``~/.ansible/tmp`` — and that ``~`` is expanded via the passwd
+        # database (the web user's non-writable home, e.g.
+        # ``/usr/share/httpd``), ignoring $HOME. That makes such tasks abort
+        # "Failed to create temporary directory". Pin remote_tmp to the
+        # writable per-run dir (a literal /tmp path, no ``~`` to expand) so
+        # local-delegated tasks work; real SSH hosts just create this path
+        # under their own /tmp.
+        env['ANSIBLE_REMOTE_TEMP'] = run_tmp
         inventory_path = _write_run_inventory_spec(
             run_tmp, provider, env['CMDBSYNCER_INVENTORY_MODE'],
             cmdbsyncer_bin=_cmdbsyncer_bin(),

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/ansible/site_syncer.py

@@ -47,6 +47,7 @@ class SyncSites(Plugin):
             'cmk_edition': site.settings_master.cmk_edition,
             'cmk_version': site.settings_master.cmk_version,
             'cmk_version_filename': filename,
+            'installation_staging_path': site.settings_master.installation_staging_path or '',
             'subscription_username': site.settings_master.subscription_username,
             'subscription_password': site.settings_master.subscription_password,
             'cmk_user': cmk_user,

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/__init__.py

@@ -442,7 +442,10 @@ def cli_import_project_rules(project, account, folder, recursive, debug):
         account (string): Checkmk account to read the rules from
         folder (string): Checkmk folder to import rules from
     """
-    import_project_rules_from_folder(project, account, folder, recursive, debug)
+    try:
+        import_project_rules_from_folder(project, account, folder, recursive, debug)
+    except CmkException as error_obj:
+        print(f'{ColorCodes.FAIL}Checkmk Error: {error_obj}{ColorCodes.ENDC}')
 
 #.
 #   .-- Command: Export Group

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/admin_views.py

@@ -72,6 +72,15 @@ def register_admin_views(admin):
             menu_icon_value='fa-filter',
         )
     )
+    admin.add_view(
+        CheckmkTestFolderScopeView(
+            name="Limit Host Export to Folders",
+            category="Checkmk",
+            endpoint="checkmk_test_folder_scope",
+            menu_icon_type='fa',
+            menu_icon_value='fa-folder-open',
+        )
+    )
     admin.add_view(
         CheckmkRuleView(
             CheckmkRule,
@@ -99,6 +108,15 @@ def register_admin_views(admin):
             menu_icon_value='fa-cogs',
         )
     )
+    admin.add_view(
+        CheckmkRuleProjectView(
+            CheckmkRuleProject,
+            name="Setup Rule Projects",
+            category="Checkmk",
+            menu_icon_type='fa',
+            menu_icon_value='fa-cubes',
+        )
+    )
     admin.add_view(
         CheckmkTagMngmtView(
             CheckmkTagMngmt,
@@ -183,32 +201,6 @@ def register_admin_views(admin):
             menu_icon_value='fa-folder-open',
         )
     )
-    admin.add_sub_category(name="Export Scoping", parent_name="Checkmk")
-    # add_sub_category does not apply category_icon_classes to sub-categories,
-    # so set the menu icon directly on the created SubMenuCategory.
-    _ttp_category = admin.get_category_menu_item("Export Scoping")
-    if _ttp_category is not None:
-        _ttp_category.icon_type = 'fa'
-        _ttp_category.icon_value = 'fa-filter'
-    admin.add_view(
-        CheckmkRuleProjectView(
-            CheckmkRuleProject,
-            name="Setup Rule Projects",
-            category="Export Scoping",
-            menu_icon_type='fa',
-            menu_icon_value='fa-cubes',
-        )
-    )
-    admin.add_view(
-        CheckmkTestFolderScopeView(
-            name="Limit Host Export to Folders",
-            category="Export Scoping",
-            endpoint="checkmk_test_folder_scope",
-            menu_icon_type='fa',
-            menu_icon_value='fa-folder-open',
-        )
-    )
-
     admin.add_view(
         CheckmkInventorizeAttributesView(
             CheckmkInventorizeAttributes,

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/cmk_rules.py

@@ -11,7 +11,7 @@ from pprint import pformat
 
 from rich.progress import Progress, SpinnerColumn, TimeElapsedColumn, MofNCompleteColumn
 
-from application import logger
+from application import app, logger
 from application.models.host import Host
 from application.plugins.checkmk.cmk2 import CmkException, CMK2
 from application.helpers.syncer_jinja import render_jinja, get_list
@@ -44,6 +44,25 @@ def normalize_cmk_folder(folder):
     return normalize_folder(folder)
 
 
+def scope_folder(folder):
+    """
+    Normalise a folder for a folder-scope selection.
+
+    Like :func:`normalize_cmk_folder`, but also prefixes a leading ``/`` and
+    lowercases the path when ``CMK_LOWERCASE_FOLDERNAMES`` is on. Checkmk's API
+    folder names are always lowercase, and the export side (``rules.py``) writes
+    them that way, so a picked or typed folder compares equal to the folder a
+    host actually lands in.
+    """
+    folder = (folder or '').strip()
+    if folder and not folder.startswith('/'):
+        folder = '/' + folder
+    folder = normalize_cmk_folder(folder)
+    if app.config['CMK_LOWERCASE_FOLDERNAMES']:
+        folder = folder.lower()
+    return folder
+
+
 def folder_in_scope(rule_folder, target_folder, recursive=False):
     """
     True when ``rule_folder`` should be imported for ``target_folder``.
@@ -90,7 +109,7 @@ def iter_rule_folders():
     for rule in CheckmkRuleMngmt.objects():
         for outcome in rule.outcomes:
             if outcome.folder and '{{' not in outcome.folder:
-                folders.add(normalize_cmk_folder(outcome.folder))
+                folders.add(scope_folder(outcome.folder))
 
     for rule in CheckmkRule.objects(enabled=True):
         for outcome in rule.outcomes:
@@ -99,11 +118,11 @@ def iter_rule_folders():
             param = (outcome.action_param or '').strip()
             if not param or '{{' in param:
                 continue
-            folders.add(normalize_cmk_folder(param))
+            folders.add(scope_folder(param))
 
     for pool in CheckmkFolderPool.objects():
         if pool.folder_name:
-            folders.add(normalize_cmk_folder(pool.folder_name))
+            folders.add(scope_folder(pool.folder_name))
 
     return sorted(folders)
 

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/groups.py

@@ -39,7 +39,17 @@ class CheckmkGroupSync(CMK2):
         """
         collection_keys = {}
         collection_values = {}
-        for db_host in Host.get_export_hosts():
+        # Default stays host-only (is_object=True documents, e.g. shadow
+        # hosts, are excluded). If the account — or a child account — defines
+        # an object filter for this export, honor it so the configured
+        # object types (shadow hosts, CMDB objects, …) feed the groups too,
+        # consistent with the rules/tags export.
+        object_filter = self.config['settings'].get(self.name, {}).get('filter')
+        if object_filter:
+            db_hosts = Host.objects_by_filter(object_filter)
+        else:
+            db_hosts = Host.get_export_hosts()
+        for db_host in db_hosts:
             if attributes := self.get_attributes(db_host, 'cmk_conf'):
                 for key, value in attributes['all'].items():
                     key, value = str(key), str(value)

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/inits.py

@@ -14,6 +14,11 @@ from application.plugins.checkmk.rules import CheckmkRulesetRule, DefaultRule
 from application.plugins.checkmk.inventorize import InventorizeHosts
 from application.plugins.checkmk.dcd import CheckmkDCDRuleSync
 from application.plugins.checkmk.passwords import CheckmkPasswordSync
+from application.plugins.checkmk.rule_passwords import (
+    rewrite_explicit_passwords,
+    preserve_password_macros,
+    referenced_password_names,
+)
 from application.plugins.checkmk.groups import CheckmkGroupSync
 from application.plugins.checkmk.users import CheckmkUserSync
 from application.plugins.checkmk.bi import BI
@@ -384,6 +389,7 @@ def import_project_rules_from_folder(project_name, account, folder,  # pylint: d
         found = syncer.fetch_rules_in_folder(folder, recursive=recursive)
 
         imported = 0
+        password_hints = set()
         for entry in found:
             cmk_id = entry.get('cmk_id')
             if not cmk_id:
@@ -402,21 +408,47 @@ def import_project_rules_from_folder(project_name, account, folder,  # pylint: d
                 f"Imported from Checkmk account '{account}', "
                 f"folder '{folder}' (rule {cmk_id})")
             outcome = entry['outcome']
+            # Checkmk masks explicit passwords as '******' on read, so a rule
+            # imported here can't carry a usable secret. Rewrite each into a
+            # syncer password-store reference (a cmk_password macro); on a
+            # re-import keep the macro already on the rule so a renamed one is
+            # not reverted to its default hint.
+            new_value, hints = rewrite_explicit_passwords(
+                outcome.get('value_template', ''))
+            if hints:
+                old_outcome = rule.outcomes[0] if rule.outcomes else None
+                if old_outcome is not None:
+                    new_value = preserve_password_macros(
+                        old_outcome.value_template, new_value)
+                outcome['value_template'] = new_value
+                password_hints.update(referenced_password_names(new_value))
             rule.outcomes = [RuleMngmtOutcome(**outcome)]
             rule.primary_ruleset = outcome.get('ruleset', '')
             rule.save()
             imported += 1
 
+        if password_hints:
+            hint_list = ', '.join(sorted(password_hints))
+            print(f"{ColorCodes.WARNING} * Rules reference password store "
+                  f"entries: {hint_list}. Create matching Checkmk Passwords in "
+                  f"the syncer and run 'checkmk export_passwords <account>' so "
+                  f"the reference resolves in the target Checkmk.{ColorCodes.ENDC}")
+
         message = (f"Imported {imported} rule(s) from Checkmk folder "
                    f"'{folder}' into project '{project_name}'")
         print(f'{ColorCodes.OKGREEN}{message}{ColorCodes.ENDC}')
-        log.log(message, source="cmk_project_rule_import",
-                details=[('account', account), ('folder', folder),
-                         ('recursive', str(recursive)),
-                         ('imported', str(imported))])
+        details = [('account', account), ('folder', folder),
+                   ('recursive', str(recursive)),
+                   ('imported', str(imported))]
+        if password_hints:
+            details.append(('password_store_entries',
+                            ', '.join(sorted(password_hints))))
+        log.log(message, source="cmk_project_rule_import", details=details)
         return imported
     except CmkException as error_obj:
-        print(f'C{ColorCodes.FAIL}MK Connection Error: {error_obj} {ColorCodes.ENDC}')
+        # Record the failure, then re-raise so callers can surface it.
+        # Swallowing it into "return 0" made a wrong-credentials error
+        # (401) look identical to an empty folder in the web UI.
         if syncer is not None:
             syncer.record_exception(error_obj)
         else:
@@ -424,7 +456,7 @@ def import_project_rules_from_folder(project_name, account, folder,  # pylint: d
                     f"{account} not started",
                     source="cmk_project_rule_import",
                     details=[('error', str(error_obj))])
-        return 0
+        raise
 #.
 #   .-- Export Notification Rules
 def export_notifications(account, debug=False):

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/models.py

@@ -505,6 +505,7 @@ class CheckmkSettings(db.Document):
     cmk_version = db.StringField()
     cmk_edition = db.StringField(choices=editions)
     cmk_version_filename = db.StringField()
+    installation_staging_path = db.StringField()
     inital_password = db.StringField()
 
     subscription_username = db.StringField()

cmdbsyncer-4.2.2/application/plugins/checkmk/rule_passwords.py

@@ -0,0 +1,126 @@
+"""
+Bridge Checkmk rule secrets to the syncer's own Checkmk password store.
+
+Checkmk masks an ``explicit_password`` in a rule value as ``******`` on every
+read, so a rule imported from one Checkmk instance carries no usable secret and
+would overwrite the target's password with ``******`` on deploy. Instead we
+rewrite every ``explicit_password`` into a ``stored_password`` reference backed
+by a syncer :class:`CheckmkPassword`. The reference is a Jinja macro
+``{{ cmk_password("name") }}`` that resolves to the entry's stable ident
+``cmdbsyncer_<id>`` at export time — the same ident the password export writes
+into every Checkmk instance, so a rule deployed to test and prod resolves each
+instance's own stored secret.
+"""
+import ast
+import re
+
+from application import logger
+
+# Checkmk 2.3+ tags password values in a rule's ``value_raw`` as
+# ``('cmk_postprocessed', <kind>, (<ident>, <value>))``. ``explicit_password``
+# inlines the (masked) secret; ``stored_password`` only references a password
+# store ident and carries no secret.
+POSTPROCESSED = 'cmk_postprocessed'
+EXPLICIT_PASSWORD = 'explicit_password'
+STORED_PASSWORD = 'stored_password'
+
+# ``{{ cmk_password("name") }}`` — tolerant of surrounding whitespace and either
+# quote style, matching how the macro may be hand-edited on the rule.
+_MACRO_RE = re.compile(r'\{\{\s*cmk_password\([^)]*\)\s*\}\}')
+_MACRO_NAME_RE = re.compile(r'cmk_password\(\s*["\']([^"\']+)["\']\s*\)')
+
+
+def password_ident(name):
+    """
+    Resolve a syncer password name to its Checkmk password-store ident.
+
+    Returns ``cmdbsyncer_<id>`` for the :class:`CheckmkPassword` named ``name``.
+    A missing name is logged and resolved to a clearly-invalid ident so only the
+    one affected rule fails to deploy (Checkmk rejects the unknown reference)
+    instead of aborting the whole export.
+    """
+    from .models import CheckmkPassword  # pylint: disable=import-outside-toplevel
+    entry = CheckmkPassword.objects(name=name).first()
+    if not entry:
+        logger.error(
+            "cmk_password(%r): no Checkmk Password with that name in the syncer",
+            name)
+        return f"cmdbsyncer_missing_{name}"
+    return f"cmdbsyncer_{entry.id}"
+
+
+def _macro_for(hint):
+    """Build the ``{{ cmk_password(...) }}`` macro for a default name hint."""
+    return '{{ cmk_password("%s") }}' % (hint or 'password')
+
+
+def rewrite_explicit_passwords(value_raw):
+    """
+    Rewrite every ``explicit_password`` in a rule ``value_raw`` string into a
+    ``stored_password`` password-store reference.
+
+    Each ``('cmk_postprocessed', 'explicit_password', (<uuid>, '******'))``
+    becomes ``('cmk_postprocessed', 'stored_password', ('{{ cmk_password("<hint>") }}', ''))``
+    where ``<hint>`` defaults to the value's field name (e.g. ``secret``). The
+    hint is only a starting name — rename the macro on the rule and create a
+    matching syncer Checkmk Password.
+
+    Returns ``(new_value_raw, hints)`` where ``hints`` is the list of default
+    names inserted (empty, and ``value_raw`` returned unchanged, when the value
+    holds no explicit password or cannot be parsed).
+    """
+    if not isinstance(value_raw, str) or EXPLICIT_PASSWORD not in value_raw:
+        return value_raw, []
+    try:
+        parsed = ast.literal_eval(value_raw)
+    except (ValueError, SyntaxError):
+        return value_raw, []
+
+    hints = []
+
+    def convert(obj, key=None):
+        if isinstance(obj, tuple):
+            if len(obj) == 3 and obj[0] == POSTPROCESSED \
+                    and obj[1] == EXPLICIT_PASSWORD:
+                hint = key if isinstance(key, str) and key else 'password'
+                hints.append(hint)
+                return (POSTPROCESSED, STORED_PASSWORD, (_macro_for(hint), ''))
+            return tuple(convert(item, key) for item in obj)
+        if isinstance(obj, list):
+            return [convert(item, key) for item in obj]
+        if isinstance(obj, dict):
+            return {k: convert(v, k) for k, v in obj.items()}
+        return obj
+
+    new = convert(parsed)
+    if not hints:
+        return value_raw, []
+    return repr(new), hints
+
+
+def preserve_password_macros(old_value, new_value):
+    """
+    Carry a rule's existing ``cmk_password`` macros over into a freshly
+    re-imported value, so a re-run of the folder import does not revert a
+    renamed macro back to its default hint.
+
+    Positional: when ``old_value`` and ``new_value`` hold the same number of
+    macros (the usual case — the rule's password fields did not change), the
+    i-th new macro is replaced by the i-th old one. On any mismatch the new
+    value is kept unchanged.
+    """
+    if not old_value:
+        return new_value
+    old_macros = _MACRO_RE.findall(old_value)
+    new_macros = _MACRO_RE.findall(new_value)
+    if not old_macros or len(old_macros) != len(new_macros):
+        return new_value
+    carried = iter(old_macros)
+    return _MACRO_RE.sub(lambda _match: next(carried), new_value)
+
+
+def referenced_password_names(text):
+    """Return the set of syncer password names a value references via macro."""
+    if not text:
+        return set()
+    return set(_MACRO_NAME_RE.findall(text))

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/tests/test_cmk_rules.py

@@ -863,6 +863,21 @@ class TestImportProjectRules(unittest.TestCase):
             instance.fetch_rules_in_folder.assert_called_once_with(
                 '/folder', recursive=True)
 
+    def test_cmk_error_propagates_and_is_recorded(self):
+        """A Checkmk error (e.g. wrong credentials -> 401) must NOT be
+        swallowed into a "0 imported" result — it has to reach the caller so
+        the CLI/web UI can surface it instead of showing an empty import."""
+        from application.plugins.checkmk.cmk2 import CmkException  # noqa: E402  pylint: disable=import-outside-toplevel
+        with patch.object(inits, 'CheckmkRuleProject') as proj, \
+                patch.object(inits, 'CheckmkRuleSync') as sync:
+            proj.objects.return_value.first.return_value = SimpleNamespace(name='P')
+            instance = sync.return_value
+            instance.fetch_rules_in_folder.side_effect = \
+                CmkException('Unauthorized Wrong credentials (Bearer header)')
+            with self.assertRaises(CmkException):
+                inits.import_project_rules_from_folder('P', 'acc', '/folder')
+            instance.record_exception.assert_called_once()
+
 
 class TestProjectsForAccount(unittest.TestCase):
     """inits.projects_for_account account-filter selection."""

{cmdbsyncer-4.2.0 → cmdbsyncer-4.2.2}/application/plugins/checkmk/tests/test_groups.py

@@ -154,6 +154,34 @@ class TestCheckmkGroupSync(unittest.TestCase):
         self.assertEqual(keys, {})
         self.assertEqual(values, {})
 
+    @patch('application.plugins.checkmk.groups.Host')
+    def test_parse_attributes_default_is_host_only(self, mock_host):
+        """Without an account object filter the default stays host-only."""
+        self.sync.name = 'Checkmk: Export Groups'
+        self.sync.config['settings'] = {}
+        mock_host.get_export_hosts.return_value = []
+
+        self.sync.parse_attributes()
+
+        mock_host.get_export_hosts.assert_called_once()
+        mock_host.objects_by_filter.assert_not_called()
+
+    @patch('application.plugins.checkmk.groups.Host')
+    def test_parse_attributes_uses_account_object_filter(self, mock_host):
+        """An account (or child account) object filter opts objects/shadow
+        hosts into the group calculation instead of the host-only default."""
+        self.sync.name = 'Checkmk: Export Groups'
+        self.sync.config['settings'] = {
+            'Checkmk: Export Groups': {'filter': ['host', 'shadow_host']},
+        }
+        mock_host.objects_by_filter.return_value = []
+
+        self.sync.parse_attributes()
+
+        mock_host.objects_by_filter.assert_called_once_with(
+            ['host', 'shadow_host'])
+        mock_host.get_export_hosts.assert_not_called()
+
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)