cmdbsyncer 4.2.1__tar.gz → 4.2.2__tar.gz

{cmdbsyncer-4.2.1/cmdbsyncer.egg-info → cmdbsyncer-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.2.1
+Version: 4.2.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

cmdbsyncer-4.2.2/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-07-14T11:01:00Z

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/changelog/v4.2.md

@@ -1,5 +1,23 @@
 # Version 4.2
 
+## Version 4.2.2
+
+### Ansible
+- FIX: Playbook tasks delegated to localhost (`delegate_to: localhost`) no longer abort with "Failed to create temporary directory" under the web server — the local connection's temp dir now points at a writable per-run path instead of the web user's home
+- FEAT: Checkmk Settings gain an "installation staging path" — the Checkmk server-management playbook stages the downloaded installer there instead of `/tmp`; leave it empty to keep using `/tmp`. Use it when the executing user can't reliably use `/tmp` (permission or private-tmp isolation)
+- FIX: The Checkmk site-update playbook no longer fails the "set downtime" step with "401 Unauthorized" when no Checkmk API user/secret is configured — the downtime is skipped instead
+
+### Checkmk
+- FEAT: The Checkmk module menu is tidier — "Setup Rule Projects" now sits next to "Manage Checkmk Setup Rules", "Limit Host Export to Folders" moved under the host filters, and the separate "Export Scoping" submenu is gone
+- FIX: "Limit Host Export to Folders" now lists rule folders in lowercase to match Checkmk's folder names, so the scope reliably matches the folders hosts are exported to
+- FEAT: "Limit Host Export to Folders" is easier to use — clicking a rule folder or typing one adds it to a list of selected folders you can remove individually, instead of editing a comma-separated text field
+- FEAT: Importing Setup Rules from a Checkmk folder into a project now shows a progress bar and status message while it runs, so you can see it is working
+- FEAT: Checkmk Setup Rules can reference a syncer Checkmk Password with `{{ cmk_password("name") }}`, which resolves to that entry's Checkmk password-store ident on export — run the password export so the entry exists in the target Checkmk
+- FEAT: Importing rules from a Checkmk folder now rewrites inline rule passwords (which Checkmk masks as `******` on read) into such password-store references, so imported rules deploy from a test to a production Checkmk without exposing or overwriting the secret — create a Checkmk Password with the reported name and export it
+
+### Interface
+- FIX: Card-style admin form pages (e.g. the "New Account" plugin-type picker) render with consistent padding and a theme-aware header in all four themes, instead of a header hanging off the edge of a flat card
+
 ## Version 4.2.1
 
 ### Ansible

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/helpers/syncer_jinja.py

@@ -48,6 +48,17 @@ def _cmk_cleanup_hostname(value):
     return _cleanup(value)
 
 
+def _cmk_password(name):
+    """
+    Resolve a syncer Checkmk Password name to its password-store ident
+    (``cmdbsyncer_<id>``) so rules can reference a stored secret instead of an
+    inlined one. Lazily imported to avoid circular imports.
+    """
+    from application.plugins.checkmk.rule_passwords import password_ident
+
+    return password_ident(name)
+
+
 def syncer_eval(string, default=None):
     """
     Evals given object
@@ -139,6 +150,7 @@ _GLOBALS = {
     'merge_list_of_dicts': merge_list_of_dicts,
     'cmk_cleanup_tag_id': _cmk_cleanup_tag_id,
     'cmk_cleanup_hostname': _cmk_cleanup_hostname,
+    'cmk_password': _cmk_password,
     'get_ip_network': get_ip_network,
     'get_ip4_interface': get_ip_interface,
     'get_ip_interface': get_ip_interface,

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/ansible/runner.py

@@ -350,6 +350,17 @@ def _execute(stats_id, run_params: dict, cwd: Path, provider: str):
         run_tmp = tempfile.mkdtemp(prefix='cmdbsyncer-ansible-')
         env['ANSIBLE_LOCAL_TEMP'] = run_tmp
         env['HOME'] = run_tmp
+        # ANSIBLE_LOCAL_TEMP / $HOME only cover the controller-side scratch
+        # dir. A task delegated to localhost (delegate_to: localhost) runs
+        # over the *local* connection, whose remote_tmp still defaults to
+        # ``~/.ansible/tmp`` — and that ``~`` is expanded via the passwd
+        # database (the web user's non-writable home, e.g.
+        # ``/usr/share/httpd``), ignoring $HOME. That makes such tasks abort
+        # "Failed to create temporary directory". Pin remote_tmp to the
+        # writable per-run dir (a literal /tmp path, no ``~`` to expand) so
+        # local-delegated tasks work; real SSH hosts just create this path
+        # under their own /tmp.
+        env['ANSIBLE_REMOTE_TEMP'] = run_tmp
         inventory_path = _write_run_inventory_spec(
             run_tmp, provider, env['CMDBSYNCER_INVENTORY_MODE'],
             cmdbsyncer_bin=_cmdbsyncer_bin(),

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/ansible/site_syncer.py

@@ -47,6 +47,7 @@ class SyncSites(Plugin):
             'cmk_edition': site.settings_master.cmk_edition,
             'cmk_version': site.settings_master.cmk_version,
             'cmk_version_filename': filename,
+            'installation_staging_path': site.settings_master.installation_staging_path or '',
             'subscription_username': site.settings_master.subscription_username,
             'subscription_password': site.settings_master.subscription_password,
             'cmk_user': cmk_user,

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/checkmk/admin_views.py

@@ -72,6 +72,15 @@ def register_admin_views(admin):
             menu_icon_value='fa-filter',
         )
     )
+    admin.add_view(
+        CheckmkTestFolderScopeView(
+            name="Limit Host Export to Folders",
+            category="Checkmk",
+            endpoint="checkmk_test_folder_scope",
+            menu_icon_type='fa',
+            menu_icon_value='fa-folder-open',
+        )
+    )
     admin.add_view(
         CheckmkRuleView(
             CheckmkRule,
@@ -99,6 +108,15 @@ def register_admin_views(admin):
             menu_icon_value='fa-cogs',
         )
     )
+    admin.add_view(
+        CheckmkRuleProjectView(
+            CheckmkRuleProject,
+            name="Setup Rule Projects",
+            category="Checkmk",
+            menu_icon_type='fa',
+            menu_icon_value='fa-cubes',
+        )
+    )
     admin.add_view(
         CheckmkTagMngmtView(
             CheckmkTagMngmt,
@@ -183,32 +201,6 @@ def register_admin_views(admin):
             menu_icon_value='fa-folder-open',
         )
     )
-    admin.add_sub_category(name="Export Scoping", parent_name="Checkmk")
-    # add_sub_category does not apply category_icon_classes to sub-categories,
-    # so set the menu icon directly on the created SubMenuCategory.
-    _ttp_category = admin.get_category_menu_item("Export Scoping")
-    if _ttp_category is not None:
-        _ttp_category.icon_type = 'fa'
-        _ttp_category.icon_value = 'fa-filter'
-    admin.add_view(
-        CheckmkRuleProjectView(
-            CheckmkRuleProject,
-            name="Setup Rule Projects",
-            category="Export Scoping",
-            menu_icon_type='fa',
-            menu_icon_value='fa-cubes',
-        )
-    )
-    admin.add_view(
-        CheckmkTestFolderScopeView(
-            name="Limit Host Export to Folders",
-            category="Export Scoping",
-            endpoint="checkmk_test_folder_scope",
-            menu_icon_type='fa',
-            menu_icon_value='fa-folder-open',
-        )
-    )
-
     admin.add_view(
         CheckmkInventorizeAttributesView(
             CheckmkInventorizeAttributes,

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/checkmk/cmk_rules.py

@@ -11,7 +11,7 @@ from pprint import pformat
 
 from rich.progress import Progress, SpinnerColumn, TimeElapsedColumn, MofNCompleteColumn
 
-from application import logger
+from application import app, logger
 from application.models.host import Host
 from application.plugins.checkmk.cmk2 import CmkException, CMK2
 from application.helpers.syncer_jinja import render_jinja, get_list
@@ -44,6 +44,25 @@ def normalize_cmk_folder(folder):
     return normalize_folder(folder)
 
 
+def scope_folder(folder):
+    """
+    Normalise a folder for a folder-scope selection.
+
+    Like :func:`normalize_cmk_folder`, but also prefixes a leading ``/`` and
+    lowercases the path when ``CMK_LOWERCASE_FOLDERNAMES`` is on. Checkmk's API
+    folder names are always lowercase, and the export side (``rules.py``) writes
+    them that way, so a picked or typed folder compares equal to the folder a
+    host actually lands in.
+    """
+    folder = (folder or '').strip()
+    if folder and not folder.startswith('/'):
+        folder = '/' + folder
+    folder = normalize_cmk_folder(folder)
+    if app.config['CMK_LOWERCASE_FOLDERNAMES']:
+        folder = folder.lower()
+    return folder
+
+
 def folder_in_scope(rule_folder, target_folder, recursive=False):
     """
     True when ``rule_folder`` should be imported for ``target_folder``.
@@ -90,7 +109,7 @@ def iter_rule_folders():
     for rule in CheckmkRuleMngmt.objects():
         for outcome in rule.outcomes:
             if outcome.folder and '{{' not in outcome.folder:
-                folders.add(normalize_cmk_folder(outcome.folder))
+                folders.add(scope_folder(outcome.folder))
 
     for rule in CheckmkRule.objects(enabled=True):
         for outcome in rule.outcomes:
@@ -99,11 +118,11 @@ def iter_rule_folders():
             param = (outcome.action_param or '').strip()
             if not param or '{{' in param:
                 continue
-            folders.add(normalize_cmk_folder(param))
+            folders.add(scope_folder(param))
 
     for pool in CheckmkFolderPool.objects():
         if pool.folder_name:
-            folders.add(normalize_cmk_folder(pool.folder_name))
+            folders.add(scope_folder(pool.folder_name))
 
     return sorted(folders)
 

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/checkmk/inits.py

@@ -14,6 +14,11 @@ from application.plugins.checkmk.rules import CheckmkRulesetRule, DefaultRule
 from application.plugins.checkmk.inventorize import InventorizeHosts
 from application.plugins.checkmk.dcd import CheckmkDCDRuleSync
 from application.plugins.checkmk.passwords import CheckmkPasswordSync
+from application.plugins.checkmk.rule_passwords import (
+    rewrite_explicit_passwords,
+    preserve_password_macros,
+    referenced_password_names,
+)
 from application.plugins.checkmk.groups import CheckmkGroupSync
 from application.plugins.checkmk.users import CheckmkUserSync
 from application.plugins.checkmk.bi import BI
@@ -384,6 +389,7 @@ def import_project_rules_from_folder(project_name, account, folder,  # pylint: d
         found = syncer.fetch_rules_in_folder(folder, recursive=recursive)
 
         imported = 0
+        password_hints = set()
         for entry in found:
             cmk_id = entry.get('cmk_id')
             if not cmk_id:
@@ -402,18 +408,42 @@ def import_project_rules_from_folder(project_name, account, folder,  # pylint: d
                 f"Imported from Checkmk account '{account}', "
                 f"folder '{folder}' (rule {cmk_id})")
             outcome = entry['outcome']
+            # Checkmk masks explicit passwords as '******' on read, so a rule
+            # imported here can't carry a usable secret. Rewrite each into a
+            # syncer password-store reference (a cmk_password macro); on a
+            # re-import keep the macro already on the rule so a renamed one is
+            # not reverted to its default hint.
+            new_value, hints = rewrite_explicit_passwords(
+                outcome.get('value_template', ''))
+            if hints:
+                old_outcome = rule.outcomes[0] if rule.outcomes else None
+                if old_outcome is not None:
+                    new_value = preserve_password_macros(
+                        old_outcome.value_template, new_value)
+                outcome['value_template'] = new_value
+                password_hints.update(referenced_password_names(new_value))
             rule.outcomes = [RuleMngmtOutcome(**outcome)]
             rule.primary_ruleset = outcome.get('ruleset', '')
             rule.save()
             imported += 1
 
+        if password_hints:
+            hint_list = ', '.join(sorted(password_hints))
+            print(f"{ColorCodes.WARNING} * Rules reference password store "
+                  f"entries: {hint_list}. Create matching Checkmk Passwords in "
+                  f"the syncer and run 'checkmk export_passwords <account>' so "
+                  f"the reference resolves in the target Checkmk.{ColorCodes.ENDC}")
+
         message = (f"Imported {imported} rule(s) from Checkmk folder "
                    f"'{folder}' into project '{project_name}'")
         print(f'{ColorCodes.OKGREEN}{message}{ColorCodes.ENDC}')
-        log.log(message, source="cmk_project_rule_import",
-                details=[('account', account), ('folder', folder),
-                         ('recursive', str(recursive)),
-                         ('imported', str(imported))])
+        details = [('account', account), ('folder', folder),
+                   ('recursive', str(recursive)),
+                   ('imported', str(imported))]
+        if password_hints:
+            details.append(('password_store_entries',
+                            ', '.join(sorted(password_hints))))
+        log.log(message, source="cmk_project_rule_import", details=details)
         return imported
     except CmkException as error_obj:
         # Record the failure, then re-raise so callers can surface it.

{cmdbsyncer-4.2.1 → cmdbsyncer-4.2.2}/application/plugins/checkmk/models.py

@@ -505,6 +505,7 @@ class CheckmkSettings(db.Document):
     cmk_version = db.StringField()
     cmk_edition = db.StringField(choices=editions)
     cmk_version_filename = db.StringField()
+    installation_staging_path = db.StringField()
     inital_password = db.StringField()
 
     subscription_username = db.StringField()

cmdbsyncer-4.2.2/application/plugins/checkmk/rule_passwords.py

@@ -0,0 +1,126 @@
+"""
+Bridge Checkmk rule secrets to the syncer's own Checkmk password store.
+
+Checkmk masks an ``explicit_password`` in a rule value as ``******`` on every
+read, so a rule imported from one Checkmk instance carries no usable secret and
+would overwrite the target's password with ``******`` on deploy. Instead we
+rewrite every ``explicit_password`` into a ``stored_password`` reference backed
+by a syncer :class:`CheckmkPassword`. The reference is a Jinja macro
+``{{ cmk_password("name") }}`` that resolves to the entry's stable ident
+``cmdbsyncer_<id>`` at export time — the same ident the password export writes
+into every Checkmk instance, so a rule deployed to test and prod resolves each
+instance's own stored secret.
+"""
+import ast
+import re
+
+from application import logger
+
+# Checkmk 2.3+ tags password values in a rule's ``value_raw`` as
+# ``('cmk_postprocessed', <kind>, (<ident>, <value>))``. ``explicit_password``
+# inlines the (masked) secret; ``stored_password`` only references a password
+# store ident and carries no secret.
+POSTPROCESSED = 'cmk_postprocessed'
+EXPLICIT_PASSWORD = 'explicit_password'
+STORED_PASSWORD = 'stored_password'
+
+# ``{{ cmk_password("name") }}`` — tolerant of surrounding whitespace and either
+# quote style, matching how the macro may be hand-edited on the rule.
+_MACRO_RE = re.compile(r'\{\{\s*cmk_password\([^)]*\)\s*\}\}')
+_MACRO_NAME_RE = re.compile(r'cmk_password\(\s*["\']([^"\']+)["\']\s*\)')
+
+
+def password_ident(name):
+    """
+    Resolve a syncer password name to its Checkmk password-store ident.
+
+    Returns ``cmdbsyncer_<id>`` for the :class:`CheckmkPassword` named ``name``.
+    A missing name is logged and resolved to a clearly-invalid ident so only the
+    one affected rule fails to deploy (Checkmk rejects the unknown reference)
+    instead of aborting the whole export.
+    """
+    from .models import CheckmkPassword  # pylint: disable=import-outside-toplevel
+    entry = CheckmkPassword.objects(name=name).first()
+    if not entry:
+        logger.error(
+            "cmk_password(%r): no Checkmk Password with that name in the syncer",
+            name)
+        return f"cmdbsyncer_missing_{name}"
+    return f"cmdbsyncer_{entry.id}"
+
+
+def _macro_for(hint):
+    """Build the ``{{ cmk_password(...) }}`` macro for a default name hint."""
+    return '{{ cmk_password("%s") }}' % (hint or 'password')
+
+
+def rewrite_explicit_passwords(value_raw):
+    """
+    Rewrite every ``explicit_password`` in a rule ``value_raw`` string into a
+    ``stored_password`` password-store reference.
+
+    Each ``('cmk_postprocessed', 'explicit_password', (<uuid>, '******'))``
+    becomes ``('cmk_postprocessed', 'stored_password', ('{{ cmk_password("<hint>") }}', ''))``
+    where ``<hint>`` defaults to the value's field name (e.g. ``secret``). The
+    hint is only a starting name — rename the macro on the rule and create a
+    matching syncer Checkmk Password.
+
+    Returns ``(new_value_raw, hints)`` where ``hints`` is the list of default
+    names inserted (empty, and ``value_raw`` returned unchanged, when the value
+    holds no explicit password or cannot be parsed).
+    """
+    if not isinstance(value_raw, str) or EXPLICIT_PASSWORD not in value_raw:
+        return value_raw, []
+    try:
+        parsed = ast.literal_eval(value_raw)
+    except (ValueError, SyntaxError):
+        return value_raw, []
+
+    hints = []
+
+    def convert(obj, key=None):
+        if isinstance(obj, tuple):
+            if len(obj) == 3 and obj[0] == POSTPROCESSED \
+                    and obj[1] == EXPLICIT_PASSWORD:
+                hint = key if isinstance(key, str) and key else 'password'
+                hints.append(hint)
+                return (POSTPROCESSED, STORED_PASSWORD, (_macro_for(hint), ''))
+            return tuple(convert(item, key) for item in obj)
+        if isinstance(obj, list):
+            return [convert(item, key) for item in obj]
+        if isinstance(obj, dict):
+            return {k: convert(v, k) for k, v in obj.items()}
+        return obj
+
+    new = convert(parsed)
+    if not hints:
+        return value_raw, []
+    return repr(new), hints
+
+
+def preserve_password_macros(old_value, new_value):
+    """
+    Carry a rule's existing ``cmk_password`` macros over into a freshly
+    re-imported value, so a re-run of the folder import does not revert a
+    renamed macro back to its default hint.
+
+    Positional: when ``old_value`` and ``new_value`` hold the same number of
+    macros (the usual case — the rule's password fields did not change), the
+    i-th new macro is replaced by the i-th old one. On any mismatch the new
+    value is kept unchanged.
+    """
+    if not old_value:
+        return new_value
+    old_macros = _MACRO_RE.findall(old_value)
+    new_macros = _MACRO_RE.findall(new_value)
+    if not old_macros or len(old_macros) != len(new_macros):
+        return new_value
+    carried = iter(old_macros)
+    return _MACRO_RE.sub(lambda _match: next(carried), new_value)
+
+
+def referenced_password_names(text):
+    """Return the set of syncer password names a value references via macro."""
+    if not text:
+        return set()
+    return set(_MACRO_NAME_RE.findall(text))

cmdbsyncer-4.2.2/application/plugins/checkmk/tests/test_rule_passwords.py

@@ -0,0 +1,160 @@
+"""
+Unit tests for checkmk rule_passwords module
+"""
+# pylint: disable=missing-function-docstring,protected-access
+import ast
+import types
+import unittest
+from unittest.mock import patch, MagicMock
+
+from application.plugins.checkmk.rule_passwords import (
+    rewrite_explicit_passwords,
+    preserve_password_macros,
+    referenced_password_names,
+    password_ident,
+)
+
+# The Azure special-agent value the user reported: one explicit_password
+# ('secret') plus an explicit_proxy that must be left untouched.
+AZURE_VALUE = repr({
+    'subscription': 'e602c412-033e-4df7-ac6e-6d1a7942aa71',
+    'tenant': 'ef65c7f0-656e-4646-a2fd-3e45d36a39fd',
+    'client': '743d3780-7009-4865-a894-506d23edf34f',
+    'secret': ('cmk_postprocessed', 'explicit_password',
+               ('uuidd3b2cc18-be10-4bfa-85e9-bdc4a27562e0', '******')),
+    'authority': 'global_',
+    'proxy': ('cmk_postprocessed', 'explicit_proxy',
+              'http://134.247.251.203:9092'),
+    'services': ['Microsoft_Network_slash_loadBalancers'],
+    'config': {},
+    'piggyback_vms': 'grouphost',
+})
+
+
+class TestRewriteExplicitPasswords(unittest.TestCase):
+    """rewrite_explicit_passwords"""
+
+    def test_converts_explicit_and_keeps_proxy(self):
+        new_value, hints = rewrite_explicit_passwords(AZURE_VALUE)
+        self.assertEqual(hints, ['secret'])
+        parsed = ast.literal_eval(new_value)
+        # secret is now a stored_password reference with a cmk_password macro
+        self.assertEqual(
+            parsed['secret'],
+            ('cmk_postprocessed', 'stored_password',
+             ('{{ cmk_password("secret") }}', '')))
+        # the explicit_proxy is untouched
+        self.assertEqual(
+            parsed['proxy'],
+            ('cmk_postprocessed', 'explicit_proxy',
+             'http://134.247.251.203:9092'))
+        # unrelated fields survive
+        self.assertEqual(parsed['authority'], 'global_')
+
+    def test_no_password_returns_unchanged(self):
+        value = "{'foo': 'bar'}"
+        new_value, hints = rewrite_explicit_passwords(value)
+        self.assertEqual(new_value, value)
+        self.assertEqual(hints, [])
+
+    def test_unparseable_returns_unchanged(self):
+        value = "{'foo': explicit_password("  # contains the marker, won't parse
+        new_value, hints = rewrite_explicit_passwords(value)
+        self.assertEqual(new_value, value)
+        self.assertEqual(hints, [])
+
+    def test_non_string_returns_unchanged(self):
+        new_value, hints = rewrite_explicit_passwords(None)
+        self.assertIsNone(new_value)
+        self.assertEqual(hints, [])
+
+    def test_nested_password_uses_field_key_hint(self):
+        value = repr({'servers': [
+            {'name': 'a',
+             'token': ('cmk_postprocessed', 'explicit_password',
+                       ('uuidX', '******'))},
+        ]})
+        new_value, hints = rewrite_explicit_passwords(value)
+        self.assertEqual(hints, ['token'])
+        parsed = ast.literal_eval(new_value)
+        self.assertEqual(
+            parsed['servers'][0]['token'],
+            ('cmk_postprocessed', 'stored_password',
+             ('{{ cmk_password("token") }}', '')))
+
+    def test_rewritten_value_is_valid_and_round_trips(self):
+        # The rewritten value must stay a parseable Python literal whose macro,
+        # once a resolver substitutes the ident, yields a valid stored_password.
+        new_value, _ = rewrite_explicit_passwords(AZURE_VALUE)
+        resolved = new_value.replace('{{ cmk_password("secret") }}',
+                                     'cmdbsyncer_deadbeef')
+        parsed = ast.literal_eval(resolved)
+        self.assertEqual(
+            parsed['secret'],
+            ('cmk_postprocessed', 'stored_password',
+             ('cmdbsyncer_deadbeef', '')))
+
+
+class TestPreservePasswordMacros(unittest.TestCase):
+    """preserve_password_macros"""
+
+    def test_carries_renamed_macro_when_counts_match(self):
+        old = "{'secret': ('x', 'y', ('{{ cmk_password(\"azure-prod\") }}', ''))}"
+        new = "{'secret': ('x', 'y', ('{{ cmk_password(\"secret\") }}', ''))}"
+        merged = preserve_password_macros(old, new)
+        self.assertIn('cmk_password("azure-prod")', merged)
+        self.assertNotIn('cmk_password("secret")', merged)
+
+    def test_keeps_new_on_count_mismatch(self):
+        old = "{{ cmk_password(\"a\") }} {{ cmk_password(\"b\") }}"
+        new = "{{ cmk_password(\"secret\") }}"
+        self.assertEqual(preserve_password_macros(old, new), new)
+
+    def test_empty_old_keeps_new(self):
+        new = "{{ cmk_password(\"secret\") }}"
+        self.assertEqual(preserve_password_macros('', new), new)
+        self.assertEqual(preserve_password_macros(None, new), new)
+
+
+class TestReferencedPasswordNames(unittest.TestCase):
+    """referenced_password_names"""
+
+    def test_extracts_names_both_quote_styles(self):
+        text = ('{{ cmk_password("azure-prod") }} and '
+                "{{ cmk_password('other') }}")
+        self.assertEqual(referenced_password_names(text),
+                         {'azure-prod', 'other'})
+
+    def test_empty_and_none(self):
+        self.assertEqual(referenced_password_names(''), set())
+        self.assertEqual(referenced_password_names(None), set())
+
+    def test_no_macro(self):
+        self.assertEqual(referenced_password_names("{'k': 'v'}"), set())
+
+
+class TestPasswordIdent(unittest.TestCase):
+    """password_ident resolves against the syncer password store"""
+
+    def _patch_model(self, entry):
+        fake_models = types.ModuleType(
+            'application.plugins.checkmk.models')
+        fake_models.CheckmkPassword = MagicMock()
+        fake_models.CheckmkPassword.objects.return_value.first.return_value = entry
+        return patch.dict(
+            'sys.modules',
+            {'application.plugins.checkmk.models': fake_models})
+
+    def test_found_returns_prefixed_id(self):
+        entry = MagicMock()
+        entry.id = 'abc123'
+        with self._patch_model(entry):
+            self.assertEqual(password_ident('azure-prod'), 'cmdbsyncer_abc123')
+
+    def test_missing_returns_sentinel(self):
+        with self._patch_model(None):
+            self.assertEqual(password_ident('nope'), 'cmdbsyncer_missing_nope')
+
+
+if __name__ == '__main__':
+    unittest.main()