cmdbsyncer 4.2.2__tar.gz → 4.2.4__tar.gz

{cmdbsyncer-4.2.2/cmdbsyncer.egg-info → cmdbsyncer-4.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.2.2
+Version: 4.2.4
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

cmdbsyncer-4.2.4/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-07-15T17:59:01Z

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/changelog/v4.2.md

@@ -1,35 +1,48 @@
 # Version 4.2
 
-## Version 4.2.2
+## Version 4.2.4
+
+### Checkmk
+- FIX: Downtime export now reports the real error — a Checkmk/livestatus timeout or connection problem while reading current downtimes is surfaced (and re-raised with `--debug`) instead of ending in a generic "Checkmk: Export Downtimes" failure with no detail; reading downtimes for a host that returns no data no longer aborts the run
+- FIX: Host export no longer logs "Created Host" when the host creation actually failed — the success line is now only printed when Checkmk accepted the host, so a failed single-host create is reported as an error instead of a false success
+- FIX: Exporting host tags to Checkmk 2.5 no longer fails with "Unknown field" — the tag group id field (renamed from `ident` to `id` in Checkmk 2.4) is now selected per Checkmk version, so 2.3 and older keep working too
+- FEAT: DCD rules can be flagged "static" — a host-independent DCD rule is rendered once and always created instead of being recalculated for every host, which speeds up the DCD export on large inventories (like the Setup rule static flag)
+- FIX: Exporting DCD rules works again on Checkmk 2.4 and 2.5 — the connector settings are now sent nested under a `connector` object as the REST API requires; before, the export failed with many "Unknown field" errors. Checkmk 2.3 keeps its two extra connector fields
+- FEAT: A DCD rule's site can be set to `{{ cmk_site }}`, which resolves to the exporting account's Checkmk site — so one rule targets the right site on a test and a prod instance with different site names; the field now shows this as a placeholder hint
+- FEAT: DCD rules can use `{{ account.<field> }}` to insert any (non-secret) attribute of the exporting Checkmk account — including per-account custom fields — so one rule adapts its values per account (e.g. test vs prod); passwords are never exposed
+
+### Netbox
+- FEAT: Netbox can now import interfaces of devices and virtual machines (analogous to the device and VM import) — each host's Netbox interfaces, including their assigned IP addresses, are stored on the host's inventory; with the account option `import_as_hosts` every interface is instead imported as its own host so it can be exported again
+
+### Interface
+- FIX: Rule forms render fully theme-aware on the dark themes (Gruvbox, Dracula, Nord) — the nested outcome/condition field groups and their "Add …" buttons no longer show a hard-coded white/light background; nested cards, `bg-light`/`bg-white` utilities and the inline "Add" buttons now follow the active theme's surface colours everywhere
+
+## Version 4.2.3
 
 ### Ansible
 - FIX: Playbook tasks delegated to localhost (`delegate_to: localhost`) no longer abort with "Failed to create temporary directory" under the web server — the local connection's temp dir now points at a writable per-run path instead of the web user's home
 - FEAT: Checkmk Settings gain an "installation staging path" — the Checkmk server-management playbook stages the downloaded installer there instead of `/tmp`; leave it empty to keep using `/tmp`. Use it when the executing user can't reliably use `/tmp` (permission or private-tmp isolation)
 - FIX: The Checkmk site-update playbook no longer fails the "set downtime" step with "401 Unauthorized" when no Checkmk API user/secret is configured — the downtime is skipped instead
+- FIX: Running a playbook from the UI no longer aborts with "cmdbsyncer binary not found" — the local-mode inventory now resolves the `cmdbsyncer` CLI from the venv even when the web server's PATH omits it
+
+### Setup
+- FIX: A fresh `docker compose up` from git now starts — the bundled compose stack was told to reach MongoDB on `127.0.0.1` (the app container itself) instead of the `mongo` service, so the API aborted on boot with `Connection refused` (gh #124)
 
 ### Checkmk
+- FIX: Importing Setup Rules from a Checkmk folder now surfaces the real Checkmk error (e.g. wrong credentials) instead of silently reporting "0 rules imported"
+- FEAT: The Checkmk group export now honors an account's (or child account's) object filter for "Checkmk: Export Groups" — set it to include CMDB objects/shadow hosts in the group calculation; without a filter the export stays host-only as before
 - FEAT: The Checkmk module menu is tidier — "Setup Rule Projects" now sits next to "Manage Checkmk Setup Rules", "Limit Host Export to Folders" moved under the host filters, and the separate "Export Scoping" submenu is gone
 - FIX: "Limit Host Export to Folders" now lists rule folders in lowercase to match Checkmk's folder names, so the scope reliably matches the folders hosts are exported to
 - FEAT: "Limit Host Export to Folders" is easier to use — clicking a rule folder or typing one adds it to a list of selected folders you can remove individually, instead of editing a comma-separated text field
 - FEAT: Importing Setup Rules from a Checkmk folder into a project now shows a progress bar and status message while it runs, so you can see it is working
 - FEAT: Checkmk Setup Rules can reference a syncer Checkmk Password with `{{ cmk_password("name") }}`, which resolves to that entry's Checkmk password-store ident on export — run the password export so the entry exists in the target Checkmk
 - FEAT: Importing rules from a Checkmk folder now rewrites inline rule passwords (which Checkmk masks as `******` on read) into such password-store references, so imported rules deploy from a test to a production Checkmk without exposing or overwriting the secret — create a Checkmk Password with the reported name and export it
+- FEAT: The Checkmk rule export now respects an account's folder scope ("Limit Host Export to Folders") — a scoped account only receives Setup rules whose target folder is in scope, just like the host export
+- FEAT: DCD rules can be assigned to a Rule Project — they show on the project overview, follow the project's account filter on export (only exported to the accounts the project allows), and are included in the project's JSON export/import; the project list gains an "Import project from JSON" button
 
 ### Interface
 - FIX: Card-style admin form pages (e.g. the "New Account" plugin-type picker) render with consistent padding and a theme-aware header in all four themes, instead of a header hanging off the edge of a flat card
 
-## Version 4.2.1
-
-### Ansible
-- FIX: Running a playbook from the UI no longer aborts with "cmdbsyncer binary not found" — the local-mode inventory now resolves the `cmdbsyncer` CLI from the venv even when the web server's PATH omits it
-
-### Setup
-- FIX: A fresh `docker compose up` from git now starts — the bundled compose stack was told to reach MongoDB on `127.0.0.1` (the app container itself) instead of the `mongo` service, so the API aborted on boot with `Connection refused` (gh #124)
-
-### Checkmk
-- FIX: Importing Setup Rules from a Checkmk folder now surfaces the real Checkmk error (e.g. wrong credentials) instead of silently reporting "0 rules imported"
-- FEAT: The Checkmk group export now honors an account's (or child account's) object filter for "Checkmk: Export Groups" — set it to include CMDB objects/shadow hosts in the group calculation; without a filter the export stays host-only as before
-
 ## Version 4.2.0
 
 ### Hosts

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/cmk2.py

@@ -69,6 +69,21 @@ class CMK2(Plugin):
         self._init_complete = True
 
 
+    def version_at_least(self, major, minor):
+        """
+        True when the probed Checkmk version is at least ``major.minor``.
+
+        Central helper for version switches in the export code (the Checkmk REST
+        API changes field shapes between releases). ``checkmk_version`` looks
+        like ``2.4.0p19.cee`` or ``2.5.0.pro``; an unreadable value is treated
+        as the newest release so new installs get the current behaviour.
+        """
+        try:
+            release = tuple(int(p) for p in str(self.checkmk_version).split('.')[:2])
+        except (AttributeError, ValueError, TypeError):
+            return True
+        return release >= (major, minor)
+
     def _probe_checkmk_version(self):
         """
         Ask Checkmk for its version and return the bare version string.

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/cmk_rules.py

@@ -83,6 +83,31 @@ def folder_in_scope(rule_folder, target_folder, recursive=False):
     return rule_folder.startswith(target_folder + '/')
 
 
+def folder_within_scope(folder, limits):
+    """
+    True when ``folder`` falls within an account's ``limit_by_folders`` scope.
+
+    ``limits`` is the raw comma-separated ``limit_by_folders`` value off the
+    account. An empty or missing scope means no restriction (always True).
+    Folders typed without a leading slash are tolerated, and the match is
+    recursive so selecting ``/test`` also covers ``/test/linux``. Shared by the
+    host export (which folder a host lands in) and the rule export (which folder
+    a Setup rule is placed in) so both honour the same scope.
+    """
+    allowed = []
+    for entry in (limits or '').split(','):
+        entry = entry.strip()
+        if not entry:
+            continue
+        if not entry.startswith('/'):
+            entry = '/' + entry
+        allowed.append(entry)
+    if not allowed:
+        return True
+    folder = folder or '/'
+    return any(folder_in_scope(folder, scope, recursive=True) for scope in allowed)
+
+
 def iter_rule_folders():
     """
     Collect the literal folders that the configured rules can place objects
@@ -758,6 +783,12 @@ class CheckmkRuleSync(CMK2):
         value = render_jinja(rule_params['value_template'], **context)
         rule_params['folder'] = normalize_folder(
             render_jinja(rule_params['folder'], **context))
+        # Respect the account's folder scope (limit_by_folders): a scoped
+        # account only receives rules whose target folder is in scope, just
+        # like the host export only pushes hosts of those folders.
+        if not folder_within_scope(
+                rule_params['folder'], self.config.get('limit_by_folders')):
+            return None
         rule_params['value'] = value
         del rule_params['value_template']
         rule_params['optimize'] = False

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/dcd.py

@@ -17,6 +17,10 @@ class CheckmkDCDRuleSync(CMK2):
     """
     console = None
 
+    # Host-independent DCD rules, rendered once instead of per host. Injected
+    # by inits.export_dcd_rules; defaults to empty so other callers still work.
+    static_rules = []
+
     def __init__(self, account=False):
         super().__init__(account)
         # Per-instance run state. Class-level defaults would accumulate
@@ -24,6 +28,33 @@ class CheckmkDCDRuleSync(CMK2):
         # into later exports.
         self.all_rules = []
 
+    # Account config keys withheld from the rule template context — secrets and
+    # internal ids that must never end up in a rendered rule.
+    _ACCOUNT_HIDDEN_KEYS = frozenset({
+        'password', 'bakery_passphrase', 'ca_cert_chain', 'ca_root_cert',
+        '_id', 'id', 'ref',
+    })
+
+    def _account_site(self):
+        """
+        Checkmk site name of the exporting account — the last path segment of
+        its address (which ends in ``/<site>``). Exposed to DCD rules as
+        ``{{ cmk_site }}`` so one rule can target the correct site on each
+        Checkmk (e.g. a test and a prod instance with different site names).
+        """
+        address = (self.config.get('address') or '').rstrip('/')
+        return address.rsplit('/', 1)[-1] if '/' in address else ''
+
+    def _account_context(self):
+        """
+        The exporting account's attributes exposed to DCD rules as
+        ``{{ account.<field> }}`` — its standard fields plus any per-account
+        custom field (flattened into the account config). Lets one rule use a
+        value configured per account (test vs prod). Secrets are withheld.
+        """
+        return {key: value for key, value in (self.config or {}).items()
+                if key not in self._ACCOUNT_HIDDEN_KEYS}
+
     def does_rule_exist(self, rule_id):
         """
         Check if Rule is existing
@@ -97,25 +128,34 @@ class CheckmkDCDRuleSync(CMK2):
             exclude_time_ranges = self.build_timeranges(rule)
 
 
-            payload =  {
-                  "dcd_id": render_jinja(rule['dcd_id'], mode='raise', **attributes),
-                  "title": render_jinja(rule['title'], mode='raise', **attributes),
-                  "comment": render_jinja(rule['comment'], mode='raise',**attributes),
-                  "disabled": rule['disabled'],
-                  "site": render_jinja(rule['site'], mode='raise',**attributes),
+            # Checkmk's DCD REST API nests the connector settings under a
+            # "connector" object (all three supported versions). Checkmk 2.4
+            # dropped the "activate_changes_interval" and "exclude_time_ranges"
+            # connector fields — only 2.3 and older still accept them.
+            connector = {
                   "connector_type": render_jinja(rule['connector_type'], mode='raise',**attributes),
                   "restrict_source_hosts": restricted_hosts,
                   "interval": render_jinja(rule['interval'], mode='raise', **attributes),
                   "creation_rules": creation_rules,
-                  "activate_changes_interval": render_jinja(rule['activate_changes_interval'], \
-                                                                                    **attributes),
                   "discover_on_creation": rule['discover_on_creation'],
-                  "exclude_time_ranges": exclude_time_ranges,
                   "no_deletion_time_after_init": render_jinja(rule['no_deletion_time_after_init'],\
                                                                                     **attributes),
                   "max_cache_age": render_jinja(rule['max_cache_age'], **attributes),
                   "validity_period": render_jinja(rule['validity_period'], **attributes),
             }
+            if not self.version_at_least(2, 4):
+                connector["activate_changes_interval"] = \
+                        render_jinja(rule['activate_changes_interval'], **attributes)
+                connector["exclude_time_ranges"] = exclude_time_ranges
+
+            payload =  {
+                  "dcd_id": render_jinja(rule['dcd_id'], mode='raise', **attributes),
+                  "title": render_jinja(rule['title'], mode='raise', **attributes),
+                  "comment": render_jinja(rule['comment'], mode='raise',**attributes),
+                  "disabled": rule['disabled'],
+                  "site": render_jinja(rule['site'], mode='raise',**attributes),
+                  "connector": connector,
+            }
             if rule['documentation_url']:
                 payload['documentation_url']= rule['documentation_url']
             logger.debug(payload)
@@ -151,6 +191,11 @@ class CheckmkDCDRuleSync(CMK2):
         Export DCD Rules
         """
 
+        # Exposed to every DCD rule: {{ cmk_site }} = the account's Checkmk site,
+        # and {{ account.<field> }} = any (non-secret) account attribute, so one
+        # rule can use values configured per account (test vs prod).
+        site = self._account_site()
+        account_ctx = self._account_context()
         db_objects = Host.active_non_template()
         total = db_objects.count()
         with Progress(SpinnerColumn(),
@@ -168,12 +213,25 @@ class CheckmkDCDRuleSync(CMK2):
                     logger.debug(' -- Skiped no attributes')
                     progress.advance(task1)
                     continue
+                attributes['all']['cmk_site'] = site
+                attributes['all']['account'] = account_ctx
                 # pylint: disable-next=no-member
                 host_actions = self.actions.get_outcomes(db_host, attributes['all'])
                 if host_actions:
                     logger.debug(' -- Got Actions')
                     self.calculate_rules_of_host(db_host.hostname, host_actions, attributes['all'])
                 progress.advance(task1)
+
+            # Static rules carry no host data: render each once against an empty
+            # host context instead of per host (their match conditions are
+            # ignored — a static rule is always emitted).
+            for rule in self.static_rules:
+                host_actions = {'dcd': [dict(outcome.to_mongo())
+                                        for outcome in rule.outcomes]}
+                self.calculate_rules_of_host(
+                    f"static:{rule.name}", host_actions,
+                    {'cmk_site': site, 'account': account_ctx})
+
             task2 = progress.add_task("Send Rules to Checkmk", total=len(self.all_rules))
             count_new = 0
             count_existing = 0

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/downtimes.py

@@ -316,7 +316,11 @@ class CheckmkDowntimeSync(CMK2):
         url = f"domain-types/downtime/collections/all?"\
               f"host_name={hostname}&downtime_type=host"
         response = self.request(url, method="GET")
-        downtimes = response[0]['value']
+        # request() returns an empty ``{}`` body on error responses
+        # (404, non-200, no content). Guard the lookup so a failed
+        # downtime read yields "no current downtimes" instead of a bare
+        # KeyError that would escape as a detail-less run failure.
+        downtimes = response[0].get('value', []) if response[0] else []
         for downtime in downtimes:
             yield {
                 "start" : datetime.datetime.fromisoformat(

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/inits.py

@@ -516,10 +516,16 @@ def export_downtimes(account, debug=False, debug_rules=False):
             syncer.actions = actions
             syncer.debug_rules(debug_rules, "Checkmk")
 
-    except CmkException as error_obj:
+    except Exception as error_obj:  # pylint: disable=broad-exception-caught
+        # Catch every error, not just CmkException: the downtime export
+        # talks to Checkmk's livestatus (e.g. reading current downtimes),
+        # which can raise a plain requests timeout/connection error. With
+        # the old CmkException-only catch those escaped uncaught, so the
+        # run left only a detail-less "Checkmk: Export Downtimes" log entry
+        # and `--debug` never surfaced the real cause.
         if debug:
             raise
-        print(f'C{ColorCodes.FAIL}MK Connection Error: {error_obj} {ColorCodes.ENDC}')
+        print(f'{ColorCodes.FAIL}Error: {error_obj} {ColorCodes.ENDC}')
         if syncer is not None:
             syncer.record_exception(error_obj)
         else:
@@ -540,12 +546,24 @@ def export_dcd_rules(account, debug=False, debug_rules=False):
             Name overwrite
             """
         actions = ExportDCD(account)
-        actions.rules = CheckmkDCDRule.objects(enabled=True)
+        # Honour each project's account filter (limit_by_accounts): a DCD rule
+        # assigned to a project is only exported to the accounts that project
+        # allows. Rules without a project stay global (exported everywhere),
+        # matching the Setup-rule export.
+        allowed_projects = [None, ''] + projects_for_account(account)
+        # Static rules carry no host data — they are rendered once (see
+        # CheckmkDCDRuleSync.export_rules) instead of per host, so they are kept
+        # out of the per-host engine here.
+        actions.rules = CheckmkDCDRule.objects(
+            enabled=True, static_rule__ne=True, project__in=allowed_projects)
+        static_rules = CheckmkDCDRule.objects(
+            enabled=True, static_rule=True, project__in=allowed_projects)
 
         if not debug_rules:
             syncer = CheckmkDCDRuleSync(account)
             syncer.debug = debug
             syncer.actions = actions
+            syncer.static_rules = static_rules
             syncer.rewrite = rules['rewrite']
             syncer.filter = rules['filter']
             syncer.name = 'Checkmk: Export DCD Rules'
@@ -554,6 +572,7 @@ def export_dcd_rules(account, debug=False, debug_rules=False):
         else:
             syncer = CheckmkDCDRuleSync(False)
             syncer.actions = actions
+            syncer.static_rules = static_rules
             syncer.rewrite = rules['rewrite']
             syncer.filter = rules['filter']
             syncer.debug_rules(debug_rules, "Checkmk")

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/models.py

@@ -690,12 +690,25 @@ class CheckmkDCDRule(db.Document):
     render_cmk_dcd_rule = db.StringField()
     last_match = db.BooleanField(default=False)
 
+    # Host-independent DCD rule: a DCD connection rarely depends on host data, so
+    # a static rule is rendered once (against an empty host context, ignoring the
+    # match conditions) instead of once per host and de-duplicated — the same
+    # optimisation CheckmkRuleMngmt.static_rule provides for Setup rules.
+    static_rule = db.BooleanField(default=False)
+
+    # Name of the CheckmkRuleProject this DCD rule belongs to (or empty).
+    # Referenced by name to match CheckmkRuleMngmt.project. A DCD rule assigned
+    # to a project follows that project's account filter (limit_by_accounts) on
+    # export, just like a Setup rule — it is only exported to the accounts the
+    # project allows. A rule without a project stays global.
+    project = db.StringField()
 
     enabled = db.BooleanField()
     sort_field = db.IntField(default=0)
 
     meta = {
-        'strict': False
+        'strict': False,
+        'indexes': ['project'],
     }
 
 #.

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/syncer.py

@@ -9,7 +9,7 @@ from rich.progress import Progress, SpinnerColumn, TimeElapsedColumn, MofNComple
 from application import app, logger, log, init_db
 from application.models.host import Host
 from application.plugins.checkmk.cmk2 import CMK2, CmkException
-from application.plugins.checkmk.cmk_rules import folder_in_scope
+from application.plugins.checkmk.cmk_rules import folder_within_scope
 from application.modules.debug import ColorCodes as CC
 
 
@@ -349,25 +349,8 @@ class SyncCMK2(CMK2):
         Returns:
             bool: True if the host should be exported to this account.
         """
-        limits = self.config.get('limit_by_folders')
-        if not limits:
-            return True
-        # A folder entered without a leading slash (e.g. "test/linux" instead of
-        # "/test/linux") would otherwise never match the slash-prefixed folder a
-        # rule produces — normalise it so the scope works regardless of how it
-        # was typed, on this page or directly in the account's custom fields.
-        allowed = []
-        for entry in limits.split(','):
-            entry = entry.strip()
-            if not entry:
-                continue
-            if not entry.startswith('/'):
-                entry = '/' + entry
-            allowed.append(entry)
-        if not allowed:
-            return True
         folder = next_actions.get('move_folder') or '/'
-        return any(folder_in_scope(folder, scope, recursive=True) for scope in allowed)
+        return folder_within_scope(folder, self.config.get('limit_by_folders'))
 
     def handle_clusters(self):
         """
@@ -1039,10 +1022,10 @@ class SyncCMK2(CMK2):
             try:
                 self.request(url, method="POST", data=body)
                 self.num_created += 1
+                self.console(f" * Created Host {hostname}")
             except CmkException as error:
                 self.log_details.append(('error', f"Host Create Error: {error}"))
                 self.console(f" * CMK API ERROR {error}")
-            self.console(f" * Created Host {hostname}")
 
 
 

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/tags.py

@@ -310,6 +310,7 @@ class CheckmkTagSync(CMK2):
         config_tags.sort(key=lambda tup: tup[1])
         if len(config_tags) > 1:
             config_tags.insert(0, (None, "Not set"))
+        id_field = self._tag_id_field()
         found_ids = []
         tags = []
         for x, y in config_tags:
@@ -319,7 +320,7 @@ class CheckmkTagSync(CMK2):
             if not y:
                 continue
             if x not in found_ids:
-                tags.append({'ident':x, 'title': y})
+                tags.append({id_field: x, 'title': y})
                 found_ids.append(x)
 
         if not tags or len(tags) == 0:
@@ -327,6 +328,14 @@ class CheckmkTagSync(CMK2):
             return False
         return tags
 
+    def _tag_id_field(self):
+        """
+        Field name for a host tag group id and its tag choices. Checkmk renamed
+        it from ``ident`` to ``id`` in 2.4, so 2.4+ use ``id`` and 2.3 and older
+        use ``ident`` (verified against 2.3.0p48, 2.4.0p19 and 2.5.0p8).
+        """
+        return 'id' if self.version_at_least(2, 4) else 'ident'
+
     def sync_to_checkmk(self, groups, tag_group_list):
         """
         Use generated configuration to Sync
@@ -341,12 +350,17 @@ class CheckmkTagSync(CMK2):
                       *Progress.get_default_columns(),
                       TimeElapsedColumn()) as progress:
             task1 = progress.add_task("Sending to Checkmk", total=len(groups))
+            # Checkmk renamed the tag group id field 'ident' -> 'id' in 2.4.
+            id_field = self._tag_id_field()
             for syncer_group_id, syncer_group_data in groups.items():
                 payload = syncer_group_data.copy()
                 for what in ['object_filter', 'rw_id', 'is_template',
                              'rw_title', 'multiply_list']:
                     if what in payload:
                         del payload[what]
+                # The group is built with an 'ident' key internally; send it
+                # under the field name this Checkmk version expects.
+                payload[id_field] = payload.pop('ident')
 
                 tag_list = [(x[1], x[2]) for x in tag_group_list if x[0] == syncer_group_id]
                 if tags := self.prepare_tags_for_checkmk(tag_list):
@@ -362,7 +376,7 @@ class CheckmkTagSync(CMK2):
                     # Check if we need to update it
                     checkmk_tags = checkmk_ids[syncer_group_id]
                     checkmk_tags_flat = \
-                            [{'ident': x['id'], 'title': x['title']} \
+                            [{id_field: x['id'], 'title': x['title']} \
                             for x in checkmk_tags if x['title'].strip()]
 
                     if app.config['CMK_DONT_DELETE_TAGS']:
@@ -370,10 +384,10 @@ class CheckmkTagSync(CMK2):
                         found = set()
                         new_tags = []
                         for tag in payload['tags'] + checkmk_tags_flat:
-                            if tag['ident'] not in found:
-                                found.add(tag['ident'])
+                            if tag[id_field] not in found:
+                                found.add(tag[id_field])
                                 new_tags.append(tag)
-                        payload['tags'] = sorted(new_tags, key=lambda x: str(x['ident']))
+                        payload['tags'] = sorted(new_tags, key=lambda x: str(x[id_field]))
                     checkmk_tags_frozen = {frozenset(d.items()) for d in checkmk_tags_flat}
                     syncer_tags_frozen = {frozenset(d.items()) for d in payload['tags']}
                     if checkmk_tags_frozen == syncer_tags_frozen:
@@ -386,12 +400,11 @@ class CheckmkTagSync(CMK2):
                         update_headers = {
                             'if-match': etag
                         }
-                        del payload['ident']
+                        del payload[id_field]
                         payload['repair'] = False
                         try:
-                            self.request(url,
-                                method="PUT",
-                                data=payload,
+                            self.request(
+                                url, method="PUT", data=payload,
                                 additional_header=update_headers)
                         except Exception as error:
                             progress.console.print(f" ! Group {syncer_group_id} can't be updated.")

{cmdbsyncer-4.2.2 → cmdbsyncer-4.2.4}/application/plugins/checkmk/tests/test_cmk_rules.py

@@ -16,6 +16,7 @@ from application.plugins.checkmk.cmk_rules import (
     render_jinja_in_value,
     normalize_cmk_folder,
     folder_in_scope,
+    folder_within_scope,
     cmk_conditions_to_outcome,
     cmk_rule_to_outcome,
     CheckmkRuleSync,
@@ -210,6 +211,43 @@ class TestCheckmkRuleSync(unittest.TestCase):
         self.assertIn('host_label_groups', result['condition'])
         self.assertNotIn('service_labels', result['condition'])
 
+    @patch('application.plugins.checkmk.cmk_rules.render_jinja')
+    def test_folder_scope_skips_out_of_scope_rule(self, mock_render):
+        # A scoped account (limit_by_folders) drops a rule whose folder is not
+        # in scope — build returns None so the caller skips it.
+        mock_render.side_effect = lambda tpl, **kw: tpl
+        self.sync.config = {'limit_by_folders': '/test'}
+        rule_params = {
+            'value_template': "{'k': 'v'}", 'folder': '/prod', 'comment': 'c',
+        }
+        result = self.sync.build_condition_and_update_rule_params(
+            rule_params, {'all': {'HOSTNAME': 'h'}})
+        self.assertIsNone(result)
+
+    @patch('application.plugins.checkmk.cmk_rules.render_jinja')
+    def test_folder_scope_keeps_in_scope_rule(self, mock_render):
+        mock_render.side_effect = lambda tpl, **kw: tpl
+        self.sync.config = {'limit_by_folders': '/test'}
+        rule_params = {
+            'value_template': "{'k': 'v'}", 'folder': '/test/linux',
+            'comment': 'c',
+        }
+        result = self.sync.build_condition_and_update_rule_params(
+            rule_params, {'all': {'HOSTNAME': 'h'}})
+        self.assertIsNotNone(result)
+        self.assertEqual(result['folder'], '/test/linux')
+
+    @patch('application.plugins.checkmk.cmk_rules.render_jinja')
+    def test_no_folder_scope_keeps_rule(self, mock_render):
+        mock_render.side_effect = lambda tpl, **kw: tpl
+        # config without limit_by_folders (the setUp default) — no restriction.
+        rule_params = {
+            'value_template': "{'k': 'v'}", 'folder': '/prod', 'comment': 'c',
+        }
+        result = self.sync.build_condition_and_update_rule_params(
+            rule_params, {'all': {'HOSTNAME': 'h'}})
+        self.assertIsNotNone(result)
+
     @patch('application.plugins.checkmk.cmk_rules.render_jinja')
     def test_build_condition_v22(self, mock_render):
         mock_render.side_effect = lambda tpl, **kw: tpl
@@ -624,6 +662,19 @@ class TestCmkFolderHelpers(unittest.TestCase):
         self.assertFalse(
             folder_in_scope('/server-old', '/server', recursive=True))
 
+    def test_within_scope_no_limit_allows_all(self):
+        self.assertTrue(folder_within_scope('/anything', ''))
+        self.assertTrue(folder_within_scope('/anything', None))
+
+    def test_within_scope_recursive_and_leading_slash_tolerant(self):
+        # scope typed without a leading slash still matches, recursively.
+        self.assertTrue(folder_within_scope('/test/linux', 'test'))
+        self.assertTrue(folder_within_scope('/test', '/test,/other'))
+
+    def test_within_scope_out_of_scope_folder(self):
+        self.assertFalse(folder_within_scope('/prod', '/test'))
+        self.assertFalse(folder_within_scope('/', '/test'))
+
 
 class TestCmkConditionReverse(unittest.TestCase):
     """cmk_conditions_to_outcome + cmk_rule_to_outcome (reverse of export)."""
@@ -898,5 +949,39 @@ class TestProjectsForAccount(unittest.TestCase):
         self.assertEqual(for_b, ['all', 'a_and_b', 'only_b'])
 
 
+class TestExportDcdRulesProjectFilter(unittest.TestCase):
+    """export_dcd_rules restricts DCD rules by their project's account filter."""
+
+    def test_dcd_export_filters_by_project(self):
+        # DefaultRule stand-in (must be subclassable)
+        class _StubRule:  # pylint: disable=too-few-public-methods
+            def __init__(self, account=None):
+                self.rules = None
+
+        # CheckmkDCDRuleSync stand-in
+        class _StubSync:  # pylint: disable=too-few-public-methods
+            def __init__(self, account=False):
+                pass
+
+            def export_rules(self):
+                pass
+
+        with patch.object(inits, '_load_rules',
+                          return_value={'rewrite': [], 'filter': []}), \
+                patch.object(inits, 'projects_for_account',
+                             return_value=['proj_a']), \
+                patch.object(inits, 'DefaultRule', _StubRule), \
+                patch.object(inits, 'CheckmkDCDRuleSync', _StubSync), \
+                patch.object(inits, 'CheckmkDCDRule') as mock_dcd:
+            mock_dcd.objects.return_value = ['rule']
+            inits.export_dcd_rules('acc_a')
+        # Global (no project) rules plus the projects this account is allowed,
+        # split into the per-host (non-static) and static-rule querysets.
+        mock_dcd.objects.assert_any_call(
+            enabled=True, static_rule__ne=True, project__in=[None, '', 'proj_a'])
+        mock_dcd.objects.assert_any_call(
+            enabled=True, static_rule=True, project__in=[None, '', 'proj_a'])
+
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)