cmdbsyncer 4.4.1__tar.gz → 4.4.2__tar.gz

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.4.1
+Version: 4.4.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

cmdbsyncer-4.4.2/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-11-10T09:35:59Z

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/changelog/v4.4.md

@@ -1,5 +1,15 @@
 # Version 4.4
 
+## Version 4.4.2
+- SEC: Netbox Dataflow: the API token only goes to the address of the account; a page link of the answer pointing to another host no longer gets it
+- FIX: Cron Groups: after a restart of the container a group no longer stays marked as running, when another process got the number of its old run
+- FIX: Accounts: a change, like the master flag, reaches every process of the web interface and REST API within a minute; before, some kept the old account until a restart
+- FIX: Checkmk: a host export with --limit creates a host that a rule turns into a cluster right away; before, the host was deleted and only came back as cluster with the next full run
+- FIX: Checkmk DCD Rules: Restrict Source Hosts renders Jinja like the other fields, e.g. {{ HOSTNAME }}; a line that renders empty is left out
+- FIX: Checkmk: rule export: a rule with a stored password, for example Kubernetes on Checkmk 2.5, is no longer updated on every run
+- FIX: Ansible: playbooks started from the web interface find ansible-playbook in the Syncer's venv, also when the web server runs under systemd without the venv on its PATH
+- FIX: Checkmk: Manage OMD Server creates a missing site again, including the initial cmkadmin password, instead of failing on the update step
+
 ## Version 4.4.1
 - FIX: REST import: entries without the hostname field are skipped instead of aborting the whole import
 - FIX: Checkmk users: an empty row under Roles or Contact Groups is no longer sent to Checkmk, which rejected the user because of it

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/helpers/get_account.py

@@ -2,6 +2,7 @@
 Helper to get Account
 """
 import copy
+import time
 from contextlib import contextmanager
 from contextvars import ContextVar
 
@@ -67,11 +68,13 @@ _CHILD_OWNED_FIELDS = ('typ', 'username', 'password', 'address', 'object_type')
 # Internal serialisation artefacts that never leave this layer.
 _INTERNAL_FIELDS = ('custom_fields', 'password_crypted', 'plugin_settings')
 
-# In-process cache: ``{(lookup_key, is_id): account_dict}``. Sync runs read
-# the same handful of accounts for every host/rule, so caching keeps Mongo
-# and the secrets-manager hook off the hot path. Invalidated on Account
-# save/delete via mongoengine signals so the web app picks up edits
-# without a process restart.
+# In-process cache: ``{(lookup_key, is_id): (loaded_at, account_dict)}``.
+# Sync runs read the same handful of accounts for every host/rule, so
+# caching keeps Mongo and the secrets-manager hook off the hot path.
+# Account save/delete clears it through mongoengine signals, but only in
+# the process that saved; the other web workers read the account again
+# after ACCOUNT_CACHE_SECONDS.
+ACCOUNT_CACHE_SECONDS = 60
 _account_cache = {}
 
 
@@ -177,10 +180,12 @@ def get_account_by_name(name, is_id=False):
     Get Account by Name or Return False
     """
     cache_key = (str(name), is_id)
-    cached = _account_cache.get(cache_key)
-    if cached is None:
+    entry = _account_cache.get(cache_key)
+    if entry and time.monotonic() - entry[0] < ACCOUNT_CACHE_SECONDS:
+        cached = entry[1]
+    else:
         cached = _build_account_dict(name, is_id)
-        _account_cache[cache_key] = cached
+        _account_cache[cache_key] = (time.monotonic(), cached)
     # Defensive copy — callers must not mutate the cached entry.
     return copy.deepcopy(cached)
 

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/models/account.py

@@ -1,6 +1,8 @@
 """
 Account
 """
+import time
+
 from bson.errors import InvalidId
 from mongoengine import DENY
 from mongoengine.errors import ValidationError
@@ -230,6 +232,7 @@ class Account(db.Document):
         return f"{self.name} ({self.typ})"
 
 
+IS_MASTER_CACHE_SECONDS = 60
 _IS_MASTER_CACHE = {}
 
 # Hosts an import had to leave alone because a master account owns them.
@@ -273,13 +276,17 @@ def account_is_master(account_id):
     Whether the account with *account_id* is flagged as master.
 
     An import asks this once per host it does not own, so the answer is
-    cached for the lifetime of the process. Unknown or malformed ids
-    (legacy data) count as "not master".
+    cached for IS_MASTER_CACHE_SECONDS; a change of the flag reaches a
+    running process (web workers) within that time. Unknown or malformed
+    ids (legacy data) count as "not master".
     """
-    if account_id not in _IS_MASTER_CACHE:
-        try:
-            account = Account.objects(id=account_id).only('is_master').first()
-        except (ValidationError, InvalidId):
-            account = None
-        _IS_MASTER_CACHE[account_id] = bool(account and account.is_master)
-    return _IS_MASTER_CACHE[account_id]
+    entry = _IS_MASTER_CACHE.get(account_id)
+    if entry and time.monotonic() - entry[0] < IS_MASTER_CACHE_SECONDS:
+        return entry[1]
+    try:
+        account = Account.objects(id=account_id).only('is_master').first()
+    except (ValidationError, InvalidId):
+        account = None
+    is_master = bool(account and account.is_master)
+    _IS_MASTER_CACHE[account_id] = (time.monotonic(), is_master)
+    return is_master

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/ansible/runner.py

@@ -57,10 +57,20 @@ def _ansible_dir() -> Path:
 
 
 def _ansible_binary() -> str:
-    """Path to `ansible-playbook` (default: rely on $PATH)."""
-    return app.config.get('ANSIBLE_PLAYBOOK_BIN') \
-        or os.environ.get('CMDBSYNCER_ANSIBLE_PLAYBOOK_BIN') \
-        or 'ansible-playbook'
+    """
+    Path to `ansible-playbook`: explicit config / env override, then the one
+    in the running interpreter's venv, then $PATH. The venv comes first for
+    the same reason as in `_cmdbsyncer_bin` — a gunicorn worker under
+    systemd runs with a PATH that omits the venv's bin dir.
+    """
+    override = app.config.get('ANSIBLE_PLAYBOOK_BIN') \
+        or os.environ.get('CMDBSYNCER_ANSIBLE_PLAYBOOK_BIN')
+    if override:
+        return override
+    venv_bin = Path(sys.prefix) / 'bin' / 'ansible-playbook'
+    if venv_bin.is_file():
+        return str(venv_bin)
+    return 'ansible-playbook'
 
 
 def _inventory_plugin_dir() -> str | None:

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/ansible/tests/test_runner_ssh_env.py

@@ -3,10 +3,12 @@ The playbook runner has to work under a web user without a writable home.
 """
 # pylint: disable=missing-function-docstring,missing-class-docstring,protected-access
 import os
+import shutil
 import sys
+import tempfile
 import unittest
 from types import ModuleType
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
 
 from tests import _load_real_module
 
@@ -56,6 +58,40 @@ class SshEnvTest(unittest.TestCase):
                         args.index('/tmp/run-2/known_hosts'))
 
 
+class AnsibleBinaryTest(unittest.TestCase):
+    """
+    Under systemd the venv's bin dir is not on PATH, so the runner has to
+    find ansible-playbook next to the running interpreter.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.runner = _load_runner()
+
+    def setUp(self):
+        self.prefix = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.prefix)
+        patcher = patch.object(self.runner.sys, 'prefix', self.prefix)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        self.runner.app.config.pop('ANSIBLE_PLAYBOOK_BIN', None)
+
+    def test_the_venv_binary_is_used(self):
+        os.mkdir(os.path.join(self.prefix, 'bin'))
+        binary = os.path.join(self.prefix, 'bin', 'ansible-playbook')
+        with open(binary, 'w', encoding='utf-8'):
+            pass
+        self.assertEqual(self.runner._ansible_binary(), binary)
+
+    def test_without_venv_binary_path_decides(self):
+        self.assertEqual(self.runner._ansible_binary(), 'ansible-playbook')
+
+    def test_the_config_wins(self):
+        self.runner.app.config['ANSIBLE_PLAYBOOK_BIN'] = '/usr/bin/ansible-playbook'
+        self.addCleanup(self.runner.app.config.pop, 'ANSIBLE_PLAYBOOK_BIN', None)
+        self.assertEqual(self.runner._ansible_binary(), '/usr/bin/ansible-playbook')
+
+
 class ConnectionHintTest(unittest.TestCase):
     """
     sshpass calls a non-writable home a wrong password. The log must not

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/cmk_rules.py

@@ -36,6 +36,9 @@ KEEP_VALUE_HINT = "Value managed manually in Checkmk - Syncer will not overwrite
 KEEP_VALUE_MARK = "(Value editable)"
 # Checkmk returns every explicit password of a rule value masked like this.
 MASKED_PASSWORD = "'******'"
+# Checkmk 2.5 masks the second part of a stored password reference too. It
+# holds no secret: the rule works with it left empty.
+MASKED_STORED_PASSWORD = re.compile(r"('stored_password', \('[^']*', )'\*{6}'")
 
 # Longest Setup Rule name written into the Checkmk rule description. Long
 # enough for real rule names, short enough to keep the rule list readable.
@@ -843,7 +846,7 @@ def preview_list_rule(rule):
 
 def clean_postproccessed(data):
     """
-    Normalize Checkmk's explicit_password tuples before rule comparison.
+    Normalize Checkmk's password tuples, at any depth, before rule comparison.
     """
     # Intentional: Checkmk re-encrypts the stored explicit_password tuple
     # (id, password) on every GET, so the ciphertext differs across reads
@@ -852,16 +855,20 @@ def clean_postproccessed(data):
     # on every sync. The trade-off — that a real password change is not
     # detected here — is accepted; password rotation is managed by the
     # Checkmk password store, not by rule diffs.
-    output = {}
-    for key, value in data.items():
-        if isinstance(value, tuple):
-            if value[0] == 'cmk_postprocessed' and \
-                    value[1] == 'explicit_password':
-                new_tuple = (None, None)
-                new_value = (value[0], value[1], new_tuple)
-                value = new_value
-        output[key] = value
-    return output
+    # A stored_password only references the store: Checkmk 2.5 returns its
+    # second part masked, so only the ident is compared.
+    if isinstance(data, dict):
+        return {key: clean_postproccessed(value) for key, value in data.items()}
+    if isinstance(data, list):
+        return [clean_postproccessed(value) for value in data]
+    if not isinstance(data, tuple):
+        return data
+    if len(data) == 3 and data[0] == 'cmk_postprocessed':
+        if data[1] == 'explicit_password':
+            return (data[0], data[1], (None, None))
+        if data[1] == 'stored_password':
+            return (data[0], data[1], (data[2][0], ''))
+    return tuple(clean_postproccessed(value) for value in data)
 
 def deep_compare(ours, stored, strict=False):
     """
@@ -883,9 +890,9 @@ def deep_compare(ours, stored, strict=False):
     Nested dicts inside lists are still compared structurally via each
     element's ``==``.
     """
+    ours = clean_postproccessed(ours)
+    stored = clean_postproccessed(stored)
     if isinstance(ours, dict) and isinstance(stored, dict):
-        ours = clean_postproccessed(ours)
-        stored = clean_postproccessed(stored)
         if strict:
             if set(ours.keys()) != set(stored.keys()):
                 return False
@@ -2694,7 +2701,9 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         current = properties.get('description', '')
         if current == wanted:
             return
-        if MASKED_PASSWORD in cmk_rule['extensions']['value_raw']:
+        value_raw = MASKED_STORED_PASSWORD.sub(
+            r"\1''", cmk_rule['extensions']['value_raw'])
+        if MASKED_PASSWORD in value_raw:
             # The value as read holds the password masked. Sending it back
             # would replace the real password with the mask, so the
             # description stays as it is.
@@ -2704,7 +2713,7 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         payload = {
             "properties": properties,
             "conditions": cmk_rule['extensions']['conditions'],
-            "value_raw": cmk_rule['extensions']['value_raw'],
+            "value_raw": value_raw,
         }
         if self.dry_run:
             self._plan('UPDATE', f"{ruleset_name} {rule_id}",

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/dcd.py

@@ -128,7 +128,11 @@ class CheckmkDCDRuleSync(CMK2):
         Return Payload as Dict
         """
         try:
-            restricted_hosts = rule['restricted_source_hosts']
+            # A line rendering empty (an attribute the host lacks) is left out.
+            restricted_hosts = [
+                host for host in (render_jinja(entry, mode='raise', **attributes).strip()
+                                  for entry in rule['restricted_source_hosts'])
+                if host]
             creation_rules = self.build_creation_rules(rule, attributes)
             exclude_time_ranges = self.build_timeranges(rule)
 

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/syncer.py

@@ -1201,6 +1201,9 @@ class SyncCMK2(CMK2):
         # skipping it left every already-existing folder unchanged whenever a
         # run was limited to single hosts (the usual way to test folder rules).
         self.handle_folders()
+        # Clusters only hold hosts of this run. A host that turned into a
+        # cluster was already deleted above and has to come back now.
+        self.handle_clusters()
 
         if self.limit:
             log.log(f"Finished Sync to Checkmk Account: {self.account_name} because LIMIT",
@@ -1208,7 +1211,6 @@ class SyncCMK2(CMK2):
             print(f"\n{CC.OKCYAN} -- {CC.ENDC}Stop processing in limit mode")
             return
 
-        self.handle_clusters()
         self.cleanup_hosts()
 
 

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/tests/test_cmk_rules.py

@@ -75,6 +75,11 @@ class TestCleanPostprocessed(unittest.TestCase):
         }
         self.assertEqual(result, expected)
 
+    def test_stored_password_keeps_ident_only(self):
+        data = {'token': ('cmk_postprocessed', 'stored_password', ('id', '******'))}
+        expected = {'token': ('cmk_postprocessed', 'stored_password', ('id', ''))}
+        self.assertEqual(clean_postproccessed(data), expected)
+
     def test_non_password_tuple_unchanged(self):
         data = {'other': ('something', 'else', 'data')}
         result = clean_postproccessed(data)
@@ -152,6 +157,31 @@ class TestDeepCompare(unittest.TestCase):
         b = {'password': ('cmk_postprocessed', 'explicit_password', ('id2', 'pw2'))}
         self.assertTrue(deep_compare(a, b))
 
+    def test_masked_stored_password_is_no_drift(self):
+        # Sent with an empty second part, Checkmk 2.5 returns it masked.
+        ours = {'token': ('cmk_postprocessed', 'stored_password', ('pw1', ''))}
+        stored = {'token': ('cmk_postprocessed', 'stored_password', ('pw1', '******'))}
+        self.assertTrue(deep_compare(ours, stored))
+        self.assertTrue(deep_compare(ours, stored, strict=True))
+
+    def test_other_stored_password_is_drift(self):
+        ours = {'token': ('cmk_postprocessed', 'stored_password', ('pw1', ''))}
+        stored = {'token': ('cmk_postprocessed', 'stored_password', ('pw2', '******'))}
+        self.assertFalse(deep_compare(ours, stored))
+
+    def test_nested_stored_password_is_no_drift(self):
+        def value(secret):
+            password = ('cmk_postprocessed', 'stored_password', ('pw1', secret))
+            return {'auth': ('user_auth', {'password': password}),
+                    'endpoints': [{'password': password}]}
+        self.assertTrue(deep_compare(value(''), value('******')))
+
+    def test_nested_explicit_password_is_no_drift(self):
+        def value(ident):
+            password = ('cmk_postprocessed', 'explicit_password', (ident, '******'))
+            return {'auth': ('user_auth', {'password': password})}
+        self.assertTrue(deep_compare(value('a'), value('b')))
+
 
 class TestAnalyzeValueDifferences(unittest.TestCase):
     """Tests for analyze_value_differences"""
@@ -3296,6 +3326,32 @@ class TestSyncDescription(unittest.TestCase):
         self.assertEqual(data['value_raw'], "{'levels': (99, 99)}")
         self.assertEqual(data['properties']['comment'], 'c')
 
+    def test_stale_description_with_stored_password_is_rewritten(self):
+        puts = self._wire()
+        cmk_rule = self._cmk_rule('cmdbsyncer_test_account')
+        cmk_rule['extensions']['value_raw'] = (
+            "{'token': ('cmk_postprocessed', 'stored_password', ('pw1', '******'))}")
+        local = {'description': 'cmdbsyncer_test_account - Kube'}
+
+        self.sync._sync_description(cmk_rule, local, 'a_ruleset')
+
+        self.assertEqual(len(puts), 1)
+        self.assertEqual(
+            puts[0][2]['value_raw'],
+            "{'token': ('cmk_postprocessed', 'stored_password', ('pw1', ''))}")
+
+    def test_stale_description_with_explicit_password_writes_nothing(self):
+        puts = self._wire()
+        cmk_rule = self._cmk_rule('cmdbsyncer_test_account')
+        cmk_rule['extensions']['value_raw'] = (
+            "{'stored': ('cmk_postprocessed', 'stored_password', ('pw1', '******')), "
+            "'token': ('cmk_postprocessed', 'explicit_password', ('id', '******'))}")
+        local = {'description': 'cmdbsyncer_test_account - Kube'}
+
+        self.sync._sync_description(cmk_rule, local, 'a_ruleset')
+
+        self.assertEqual(puts, [])
+
     def test_matching_description_writes_nothing(self):
         puts = self._wire()
         cmk_rule = self._cmk_rule('cmdbsyncer_test_account - Disk Levels')

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/tests/test_dcd.py

@@ -380,6 +380,14 @@ class TestDCDListRule(unittest.TestCase):
         self.assertTrue(any('dc1 not created' in str(detail)
                             for detail in self.sync.log_details))
 
+    def test_restrict_source_hosts_are_rendered(self, _render):
+        self.sync.static_rules = [_dcd_rule(
+            "id;host\ndc1;srv01\n",
+            restricted_source_hosts=['{{ host }}', '{{ missing | default("") }}'])]
+        self.sync.calculate_static_rules({'cmk_site': 'site_a', 'account': {}})
+        self.assertEqual(
+            self.sync.all_rules[0]['connector']['restrict_source_hosts'], ['srv01'])
+
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/checkmk/tests/test_syncer.py

@@ -963,10 +963,11 @@ class TestSyncCMK2(unittest.TestCase):
 
             self.syncer.run()
 
-            # Folders applied for the processed hosts ...
+            # Folders and clusters applied for the processed hosts, a host
+            # turned cluster was deleted and has to come back ...
             mock_folders.assert_called_once()
-            # ... but cluster/cleanup passes are skipped in limit mode.
-            mock_clusters.assert_not_called()
+            mock_clusters.assert_called_once()
+            # ... but the cleanup is skipped in limit mode.
             mock_cleanup.assert_not_called()
 
 

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/cron.py

@@ -35,20 +35,50 @@ def _pid_alive(pid):
     return True
 
 
+def _process_start(pid):
+    """
+    Local start time of the process ``pid``, from /proc. None where /proc
+    is missing (not Linux) or the process is gone.
+    """
+    try:
+        with open(f"/proc/{int(pid)}/stat", encoding="ascii") as handle:
+            # The name in brackets may hold spaces, the fields after it don't
+            ticks = int(handle.read().rsplit(")", 1)[1].split()[19])
+        with open("/proc/stat", encoding="ascii") as handle:
+            boot = next(int(line.split()[1]) for line in handle
+                        if line.startswith("btime "))
+        return datetime.fromtimestamp(boot + ticks / os.sysconf("SC_CLK_TCK"))
+    except (OSError, ValueError, IndexError, StopIteration):
+        return None
+
+
+def _pid_reused(stats):
+    """
+    Whether the PID of the lock now belongs to a process that started after
+    the run, as after a container restart, where PIDs count up from 1 again.
+    The runner itself starts before it writes last_start.
+    """
+    if not stats.last_start:
+        return False
+    started = _process_start(stats.pid)
+    return started is not None and started > stats.last_start + timedelta(seconds=2)
+
+
 def _reset_stale_lock(stats):
     """
     A previous run crashed (OOM, kill -9, container restart) before it could
     release `is_running`. Reset the lock when the recorded PID no longer
-    exists on this host (the runner is always local).
+    exists on this host (the runner is always local), or belongs to a
+    process started after the run.
     """
     if not stats.is_running:
         return
-    if _pid_alive(stats.pid):
+    if _pid_alive(stats.pid) and not _pid_reused(stats):
         return
     stats.is_running = False
     stats.failure = True
     message = (f"{datetime.now()}: Stale lock cleared "
-               f"(pid {stats.pid} no longer running)")
+               f"(pid {stats.pid} no longer running the group)")
     stats.last_message = message
     stats.all_messages = f"{stats.all_messages or ''}{message}\n"
     stats.last_ended = datetime.now()

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/netbox/dataflow.py

@@ -9,6 +9,7 @@ from application.models.host import Host
 
 from .netbox import SyncNetbox
 from .models import NetboxDataflowModels
+from .utils import same_host_url
 
 
 class DictObj:  # pylint: disable=too-few-public-methods
@@ -160,7 +161,7 @@ class SyncDataFlow(SyncNetbox):
             resp_data = resp.json()
             result_collection += resp_data['results']
             while resp_data.get('next'):
-                next_url = resp_data['next']
+                next_url = same_host_url(resp_data['next'], self.config['address'])
                 resp = self.inner_request("GET", next_url, headers=self.headers)
                 resp_data = resp.json()
                 result_collection += resp_data['results']

cmdbsyncer-4.4.2/application/plugins/netbox/tests/test_same_host_url.py

@@ -0,0 +1,29 @@
+"""
+The page link of a Netbox answer carries the token on the next request,
+so it is pinned to the host of the account.
+"""
+# pylint: disable=missing-function-docstring
+import unittest
+
+from application.plugins.netbox.utils import same_host_url
+
+
+class TestSameHostUrl(unittest.TestCase):
+    """Page links of the Dataflow sync."""
+
+    def test_link_to_another_host_stays_on_the_account(self):
+        self.assertEqual(
+            same_host_url('https://evil.example/api/plugins/data-flows/x/?limit=50&offset=50',
+                          'https://netbox.example.com'),
+            'https://netbox.example.com/api/plugins/data-flows/x/?limit=50&offset=50')
+
+    def test_link_of_the_own_host_is_kept(self):
+        url = 'https://netbox.example.com:8443/api/plugins/data-flows/x/?offset=50'
+        self.assertEqual(same_host_url(url, 'https://netbox.example.com:8443'), url)
+
+    def test_scheme_follows_the_account(self):
+        # Behind a TLS proxy Netbox may answer with http links
+        self.assertEqual(
+            same_host_url('http://netbox.example.com/api/x/?offset=50',
+                          'https://netbox.example.com'),
+            'https://netbox.example.com/api/x/?offset=50')

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/application/plugins/netbox/utils.py

@@ -2,6 +2,8 @@
 Shared helpers for the Netbox plugin.
 """
 from collections import defaultdict
+from urllib.parse import urlsplit, urlunsplit
+
 from rich.progress import Progress, SpinnerColumn, TimeElapsedColumn, MofNCompleteColumn
 
 
@@ -29,3 +31,14 @@ def parse_import_filter(import_filter):
             parsed_filter[key].append(value)
     return {key: values if len(values) > 1 else values[0]
             for key, values in parsed_filter.items()}
+
+
+def same_host_url(url, address):
+    """
+    The page link of an answer, with scheme and host of the account.
+    The link comes from the server and carries the token on the next
+    request, so it must not lead to another host.
+    """
+    page = urlsplit(url)
+    base = urlsplit(address)
+    return urlunsplit((base.scheme, base.netloc, page.path, page.query, ''))

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/cmdbsyncer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.4.1
+Version: 4.4.2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/cmdbsyncer.egg-info/SOURCES.txt

@@ -270,6 +270,7 @@ application/plugins/netbox/views.py
 application/plugins/netbox/virtualmachines.py
 application/plugins/netbox/tests/__init__.py
 application/plugins/netbox/tests/test_import_filter.py
+application/plugins/netbox/tests/test_same_host_url.py
 application/plugins/prtg/__init__.py
 application/plugins/prtg/plugin.json
 application/plugins/prtg/prtg.py
@@ -441,6 +442,7 @@ syncerapi/v1/core/__init__.py
 syncerapi/v1/inventory/__init__.py
 syncerapi/v1/rest/__init__.py
 tests/test_account_macro.py
+tests/test_account_master_cache_smoke.py
 tests/test_active_templates.py
 tests/test_ansible_cmk_roles.py
 tests/test_ansible_inventory.py
@@ -448,6 +450,7 @@ tests/test_api.py
 tests/test_api_csrf_invariant.py
 tests/test_config_dir.py
 tests/test_cron_missing_account.py
+tests/test_cron_stale_lock_smoke.py
 tests/test_csrf_config.py
 tests/test_data_quality_duplicates.py
 tests/test_default_view.py

{cmdbsyncer-4.4.1 → cmdbsyncer-4.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cmdbsyncer"
-version = "4.4.1"
+version = "4.4.2"
 description = "Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems"
 readme = "README.md"
 license = { text = "MIT" }

cmdbsyncer-4.4.2/tests/test_account_master_cache_smoke.py

@@ -0,0 +1,50 @@
+"""
+A change of the master flag reaches a running process within the cache time.
+
+The save signal only clears the caches of the process that saved, the
+other web workers learn about it when their entry runs out. Saving in
+another process is simulated by a direct database update, which sends no
+signal. See ``tests/web_smoke_helpers.py`` for why this needs a subprocess.
+"""
+
+import unittest
+
+from tests.web_smoke_helpers import HAVE_MONGOMOCK, SKIP_REASON, run_against_app
+
+
+SNIPPET = '''
+from unittest.mock import patch
+
+from application.models import account as account_module
+from application.models.account import Account, account_is_master
+
+now = [1000.0]
+clock = patch.object(account_module.time, 'monotonic', side_effect=lambda: now[0])
+clock.start()
+
+account = Account(name='src', type='csv', address='', enabled=True)
+account.save()
+eq(account_is_master(str(account.id)), False, 'before the change')
+
+Account.objects(id=account.id).update(set__is_master=True)
+now[0] += account_module.IS_MASTER_CACHE_SECONDS - 1
+eq(account_is_master(str(account.id)), False, 'within the cache time')
+
+now[0] += 2
+eq(account_is_master(str(account.id)), True, 'after the cache time')
+
+clock.stop()
+print('MASTER_CACHE_OK')
+'''
+
+
+@unittest.skipUnless(HAVE_MONGOMOCK, SKIP_REASON)
+class AccountMasterCacheTests(unittest.TestCase):
+    """Runs the snippet against the booted app."""
+
+    def test_master_flag_reaches_a_running_process(self):
+        """Cached within the cache time, read again after it."""
+        result = run_against_app(SNIPPET, False)
+        self.assertEqual(result.returncode, 0,
+                         f"{result.stdout[-1500:]}\n{result.stderr[-1500:]}")
+        self.assertIn('MASTER_CACHE_OK', result.stdout)