forward-netbox 2.2.1__tar.gz → 2.2.3__tar.gz

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.2.1
+Version: 2.2.3
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -31,7 +31,9 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
+| `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
+| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
+| `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
 | `v2.2.0` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.1`; Fix devices mis-assigned the ACI platform; link Palo vsys / Fortinet vdom firewalls to their physical chassis |
 | `v2.1.5` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.0`; Fix Prune orphans erroring on empty sites that still hold a VLAN/VM/prefix (delete only truly-empty sites) |
 | `v2.1.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.1.5`; Tag delete-eligible global IPAM (prefixes/VLANs/VRFs) for manual review |

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/README.md

@@ -8,7 +8,9 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
+| `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
+| `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
+| `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |
 | `v2.2.0` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.1`; Fix devices mis-assigned the ACI platform; link Palo vsys / Fortinet vdom firewalls to their physical chassis |
 | `v2.1.5` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.0`; Fix Prune orphans erroring on empty sites that still hold a VLAN/VM/prefix (delete only truly-empty sites) |
 | `v2.1.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.1.5`; Tag delete-eligible global IPAM (prefixes/VLANs/VRFs) for manual review |

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/__init__.py

@@ -8,7 +8,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward Field Integration"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.2.1"
+    version = "2.2.3"
     base_url = "forward"
     min_version = "4.6.3"
 

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/jobs.py

@@ -167,13 +167,15 @@ def _maybe_enqueue_backfilled_tag_refresh(sync):
 
 
 def _maybe_enqueue_vsys_parent_link(sync):
-    """Opt-in: after a successful sync, link virtual-context firewalls (Palo vsys /
+    """After a successful sync, link virtual-context firewalls (Palo vsys /
     Fortinet vdom) to their physical chassis via the ``forward_parent_device``
-    custom field. Enabled per sync with ``auto_link_vsys_parents=True`` (matches
-    the other post-sync overlays); otherwise run ``forward_link_vsys_parents`` by
-    hand. Non-destructive and never affects the sync result.
+    custom field. Non-destructive, idempotent, and never affects the sync result.
+
+    Runs by DEFAULT (unlike the opt-in overlays): a blank ``Parent Device`` on
+    every vsys/vdom is a confusing default, so the link auto-refreshes each sync
+    unless the sync explicitly opts out with ``auto_link_vsys_parents=False``.
     """
-    if not (sync.parameters or {}).get("auto_link_vsys_parents"):
+    if (sync.parameters or {}).get("auto_link_vsys_parents") is False:
         return
     try:
         from django.utils.module_loading import import_string
@@ -188,6 +190,28 @@ def _maybe_enqueue_vsys_parent_link(sync):
         logger.warning("Auto vsys parent-link enqueue failed: %s", exc)
 
 
+def _maybe_enqueue_auto_prune(sync):
+    """Opt-in: after a successful sync, run "Prune orphans" (delete out-of-scope
+    devices + empty orphan sites). OFF by default because it deletes NetBox data;
+    enable per sync with ``auto_prune_orphans=True``. The prune keeps its own
+    guards (refuses when the Forward scope returned 0 devices). Never lets a prune
+    problem affect the sync result.
+    """
+    if not (sync.parameters or {}).get("auto_prune_orphans"):
+        return
+    try:
+        from django.utils.module_loading import import_string
+
+        Job.enqueue(
+            import_string("forward_netbox.jobs.prune_forward_orphans"),
+            instance=sync,
+            user=sync.user,
+            name=f"{sync.name} - prune orphans (auto)",
+        )
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.warning("Auto prune-orphans enqueue failed: %s", exc)
+
+
 def sync_forwardsync(job, *args, **kwargs):
     sync = ForwardSync.objects.get(pk=job.object_id)
 
@@ -198,6 +222,7 @@ def sync_forwardsync(job, *args, **kwargs):
         _maybe_enqueue_device_analysis_refresh(sync)
         _maybe_enqueue_backfilled_tag_refresh(sync)
         _maybe_enqueue_vsys_parent_link(sync)
+        _maybe_enqueue_auto_prune(sync)
         job.terminate()
     except Exception as exc:
         safe_save_job_data(job, sync)

forward_netbox-2.2.3/forward_netbox/migrations/0030_forwarddeviceanalysis_cve_ids.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.6 on 2026-07-01 17:10
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("forward_netbox", "0029_forward_parent_device_cf"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="forwarddeviceanalysis",
+            name="cve_ids",
+            field=models.JSONField(blank=True, default=list),
+        ),
+    ]

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/models.py

@@ -959,6 +959,9 @@ class ForwardDeviceAnalysis(ForwardPluginModelDocsMixin, ChangeLoggedModel):
     collection_result = models.CharField(max_length=64, blank=True, default="")
     blast_radius = models.PositiveIntegerField(default=0)
     cve_count = models.PositiveIntegerField(default=0)
+    # The actual confirmed-vulnerable CVE IDs behind cve_count, so the device
+    # panel can list them (not just the exposure number).
+    cve_ids = models.JSONField(default=list, blank=True)
     up_interfaces = models.PositiveIntegerField(default=0)
     detail = models.CharField(max_length=255, blank=True, default="")
     snapshot_id = models.CharField(max_length=100, blank=True, default="")

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/queries/forward_device_analysis.nqe

@@ -30,16 +30,17 @@ let physicalLinks =
          where i.operStatus == OperStatus.UP
          foreach l in i.links
          select l)
-let vulnerabilities =
-  length(foreach c in device.cveFindings
-         where c.isVulnerable
-         select c.cveId)
+let cveIds =
+  foreach c in device.cveFindings
+  where c.isVulnerable
+  select c.cveId
 select {
   name: device.name,
   reachable: device.snapshotInfo.result == DeviceSnapshotResult.completed,
   collection_result: toString(device.snapshotInfo.result),
   blast_radius: physicalLinks,
-  cve_count: vulnerabilities,
+  cve_count: length(cveIds),
+  cve_ids: cveIds,
   up_interfaces: upInterfaces,
   detail: device.locationName
 }

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/queries/forward_vrfs.nqe

@@ -19,6 +19,20 @@ foreach ni in device.networkInstances
 where ni.name != "default"
 where toString(ni.instanceType) != "NetworkInstanceType.DEFAULT_INSTANCE"
 where isEmpty(forward_netbox_shard_keys) || ni.name in forward_netbox_shard_keys
+// Skip VRFs with no addressing: NetBox derives prefixes/IPs from subinterface
+// addresses keyed by networkInstanceName, so a VRF whose subinterfaces carry no
+// IPv4/IPv6 address imports as an empty VRF and re-imports every sync. Only emit
+// a VRF that has at least one addressed subinterface (mirrors how the prefix/IP
+// queries associate addressing to a VRF).
+where !isEmpty(
+  foreach interface in device.interfaces
+  foreach subinterface in interface.subinterfaces
+  where isPresent(subinterface.networkInstanceName)
+    && subinterface.networkInstanceName == ni.name
+    && (!isEmpty(subinterface.ipv4.addresses)
+      || !isEmpty(subinterface.ipv6.addresses))
+  select subinterface.networkInstanceName
+)
 select distinct {
   name: ni.name,
   rd: null : String,

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/forwardingestion.html

@@ -167,7 +167,7 @@
     <div id="ingestion_poll"
          class="col col-md-12"
          hx-get="{% url 'plugins:forward_netbox:forwardingestion_logs' pk=object.pk %}?stage={{ active_stage|default:'sync' }}"
-         hx-trigger="{% if job_running %}every 5s{% else %}none{% endif %}"
+         hx-trigger="{% if job_running %}every 15s{% else %}none{% endif %}"
          hx-target="#ingestion_logs"
          hx-select="#ingestion_logs"
          hx-select-oob="#ingestion_status:innerHTML,#ingestion_progress:innerHTML,#ingestion_statistics:innerHTML,#change_explainability:innerHTML,#object_tabs:innerHTML,#ingestion_merge_button:innerHTML"

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/forwardsync_health.html

@@ -551,11 +551,11 @@
                 <td>{{ item.commit_message }}</td>
                 <td>
                   {% if item.severity == "pass" %}
-                    <span class="badge text-bg-success">{{ item.status }}</span>
+                    <span class="badge text-bg-success">{{ item.status_label|default:item.status }}</span>
                   {% elif item.severity == "warn" %}
-                    <span class="badge text-bg-warning">{{ item.status }}</span>
+                    <span class="badge text-bg-warning">{{ item.status_label|default:item.status }}</span>
                   {% else %}
-                    <span class="badge text-bg-secondary">{{ item.status }}</span>
+                    <span class="badge text-bg-secondary" title="{{ item.message }}">{{ item.status_label|default:item.status }}</span>
                   {% endif %}
                 </td>
                 <td>{{ item.message }}</td>

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/inc/device_analysis_panel.html

@@ -34,6 +34,14 @@
           {% endif %}
         </td>
       </tr>
+      {% if analysis.cve_ids %}
+      <tr>
+        <th scope="row">{% trans "CVEs" %}</th>
+        <td class="lh-lg">
+          {% for cve in analysis.cve_ids %}<a href="https://nvd.nist.gov/vuln/detail/{{ cve|urlencode }}" target="_blank" rel="noopener"><code>{{ cve }}</code></a>{% if not forloop.last %} {% endif %}{% endfor %}
+        </td>
+      </tr>
+      {% endif %}
       {% if analysis.detail %}
       <tr>
         <th scope="row">{% trans "Location" %}</th>

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/inc/execution_insights.html

@@ -74,7 +74,8 @@
                 </div>
                 <div class="text-end text-muted small">
                   <div>{{ item.execution_mode }} / {{ item.fetch_mode }}</div>
-                  <div>{{ item.row_count }} rows, {{ item.delete_count }} deletes</div>
+                  {# delete_count is PLANNED intent from the Forward snapshot diff (rows Forward stopped reporting), computed before apply. The APPLIED delete count is the ingestion's num_deleted / change log — an item already absent from NetBox plans a delete but applies none, so these legitimately differ. Label as planned to avoid contradicting the change log. #}
+                  <div>{{ item.row_count }} rows, {{ item.delete_count }} delete(s) planned</div>
                 </div>
               </div>
             </li>

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/templates/forward_netbox/partials/ingestion_all.html

@@ -22,7 +22,7 @@
      hx-swap-oob="true"
      class="col col-md-12"
      hx-get="{{ logs_url }}?stage={{ active_stage }}"
-     hx-trigger="{% if polling_done %}none{% else %}every 5s{% endif %}"
+     hx-trigger="{% if polling_done %}none{% else %}every 15s{% endif %}"
      hx-target="#ingestion_logs"
      hx-select="#ingestion_logs"
      hx-select-oob="#ingestion_status:innerHTML,#ingestion_progress:innerHTML,#ingestion_statistics:innerHTML,#change_explainability:innerHTML,#object_tabs:innerHTML,#ingestion_merge_button:innerHTML"

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_apply_identity_audit.py

@@ -39,6 +39,36 @@ class ApplyIdentityAuditTest(TestCase):
         self.assertEqual(result["would_create_count"], 0)
         self.assertFalse(result["churn_suspect"])
 
+    def test_churn_pairs_names_the_object_and_diff(self):
+        # The 1/1 churn signature should pinpoint the SAME logical object and the
+        # exact key disagreement (here: underscore vs dash in the slug).
+        # Both keys must differ for it to be churn (a matching name would match
+        # on the name lookup_set): NetBox slug dc_one / name "DC 1"; Forward
+        # slug dc-one / name "DC One".
+        Site.objects.create(name="DC 1", slug="dc_one")
+        rows = [{"slug": "dc-one", "name": "DC One"}]
+        result = audit_model_identity("dcim.site", rows)
+        self.assertTrue(result["churn_suspect"])
+        self.assertEqual(len(result["churn_pairs"]), 1)
+        pair = result["churn_pairs"][0]
+        self.assertIn("dc_one", pair["netbox"])
+        self.assertIn("dc-one", pair["forward"])
+        self.assertEqual(pair["differs_on"], "underscore-vs-dash")
+        self.assertGreater(pair["similarity"], 0.8)
+
+    def test_device_name_churn_is_audited(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer
+
+        site = Site.objects.create(name="S", slug="s")
+        mfr = Manufacturer.objects.create(name="M", slug="m")
+        dt = DeviceType.objects.create(manufacturer=mfr, model="DT", slug="dt")
+        role = DeviceRole.objects.create(name="R", slug="r")
+        Device.objects.create(name="fw01-vsys1", device_type=dt, role=role, site=site)
+        # Forward now emits a trailing-space variant -> name-key flip-flop.
+        result = audit_model_identity("dcim.device", [{"name": "fw01-vsys1 "}])
+        self.assertTrue(result["churn_suspect"])
+        self.assertEqual(result["churn_pairs"][0]["differs_on"], "whitespace")
+
     def test_audit_filters_to_enabled_models(self):
         Site.objects.create(name="A", slug="a")
         sync = SimpleNamespace(get_model_strings=lambda: ["dcim.site", "dcim.device"])
@@ -46,5 +76,6 @@ class ApplyIdentityAuditTest(TestCase):
         payload = audit_apply_identity(
             sync, fetch_rows=lambda s, model: canned.get(model, [])
         )
-        self.assertEqual(payload["models_audited"], ["dcim.site"])
+        # dcim.device is now an audited model; with no device rows it is clean.
+        self.assertEqual(payload["models_audited"], ["dcim.site", "dcim.device"])
         self.assertEqual(payload["churn_suspect_models"], [])

forward_netbox-2.2.3/forward_netbox/tests/test_execution_insights_delete_label.py

@@ -0,0 +1,42 @@
+from django.template.loader import render_to_string
+from django.test import TestCase
+
+
+class ExecutionInsightsDeleteLabelTest(TestCase):
+    """The per-model panel shows delete_count, which is PLANNED intent from the
+    Forward snapshot diff (rows Forward stopped reporting), computed before apply.
+    An item already absent from NetBox plans a delete but applies none, so this
+    number legitimately differs from the applied num_deleted / change log. It must
+    be labeled "planned" so it does not read as "48 deleted" and contradict an
+    empty change log (the sync-23 confusion).
+    """
+
+    def _render(self):
+        return render_to_string(
+            "forward_netbox/inc/execution_insights.html",
+            {
+                "latest_execution_insights": {
+                    "available": True,
+                    "top_model_results": [
+                        {
+                            "model": "dcim.inventoryitem",
+                            "query_name": "Forward Inventory Items",
+                            "execution_mode": "query_path",
+                            "fetch_mode": "nqe_parameters",
+                            "row_count": 61129,
+                            "delete_count": 48,
+                        }
+                    ],
+                }
+            },
+        )
+
+    def test_delete_count_is_labeled_planned(self):
+        html = self._render()
+        self.assertIn("48 delete(s) planned", html)
+
+    def test_bare_deleted_label_is_gone(self):
+        # The old "{n} deletes" label read as applied and contradicted the change
+        # log; it must not reappear.
+        html = self._render()
+        self.assertNotIn("48 deletes", html)

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_jobs.py

@@ -64,6 +64,40 @@ class ForwardJobsTest(TestCase):
             enqueue.assert_called_once()
             self.assertEqual(enqueue.call_args.kwargs["instance"], self.sync)
 
+    def test_vsys_parent_link_enqueues_by_default_and_respects_opt_out(self):
+        from forward_netbox.jobs import _maybe_enqueue_vsys_parent_link
+
+        # DEFAULT-ON: no parameter -> the parent-link overlay enqueues (a blank
+        # Parent Device on every vsys/vdom is a confusing default).
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_called_once()
+            self.assertEqual(enqueue.call_args.kwargs["instance"], self.sync)
+
+        # Explicit opt-out with auto_link_vsys_parents=False -> no enqueue.
+        self.sync.parameters = {
+            **self.sync.parameters,
+            "auto_link_vsys_parents": False,
+        }
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_not_called()
+
+    def test_auto_prune_orphans_enqueues_only_when_enabled(self):
+        from forward_netbox.jobs import _maybe_enqueue_auto_prune
+
+        # OFF by default (it deletes NetBox data): no enqueue.
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_auto_prune(self.sync)
+            enqueue.assert_not_called()
+
+        # Opt-in via auto_prune_orphans: enqueues the prune job.
+        self.sync.parameters = {**self.sync.parameters, "auto_prune_orphans": True}
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_auto_prune(self.sync)
+            enqueue.assert_called_once()
+            self.assertIn("prune orphans", enqueue.call_args.kwargs["name"])
+
     def test_record_timeout_issue_creates_single_issue_per_ingestion_phase(self):
         issue_1 = record_timeout_issue(
             self.ingestion,

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_log_export.py

@@ -338,6 +338,66 @@ class ForwardIngestionLogExportViewTest(TestCase):
         self.assertContains(response, "ipam.prefix 1")
         self.assertContains(response, "vrf 1")
 
+    def test_poll_defers_change_explainability_while_running(self):
+        # Regression (504 fix): while the job is running, the 5s/15s poll must
+        # NOT recompute change_explainability — doing so on every poll piles DB
+        # load onto the web workers during a long settling merge, which is what
+        # produces the gateway 504s on large platform-reclassification syncs.
+        running_sync = ForwardSync.objects.create(
+            name="sync-running-poll",
+            source=self.source,
+            parameters={"snapshot_id": "latestProcessed"},
+        )
+        running_ing = ForwardIngestion.objects.create(
+            sync=running_sync,
+            snapshot_selector="latestProcessed",
+            snapshot_id="snap-running",
+        )
+        now = timezone.now()
+        running_job = Job.objects.create(
+            object_type=ContentType.objects.get_for_model(ForwardIngestion),
+            object_id=running_ing.pk,
+            name="running-ingestion-job",
+            user=None,
+            status=JobStatusChoices.STATUS_RUNNING,
+            job_id="333e4567-e89b-12d3-a456-426614174002",
+            created=now,
+            started=now,
+            completed=None,
+            data={},
+        )
+        running_ing.job = running_job
+        running_ing.save(update_fields=["job"])
+
+        self.client.force_login(self.user)
+        with patch("forward_netbox.views.change_explainability_summary") as mock_ce:
+            response = self.client.get(
+                reverse(
+                    "plugins:forward_netbox:forwardingestion_logs",
+                    kwargs={"pk": running_ing.pk},
+                ),
+                headers={"HX-Request": "true"},
+            )
+        self.assertEqual(response.status_code, 200)
+        mock_ce.assert_not_called()
+
+    def test_poll_computes_change_explainability_when_done(self):
+        # The completed ingestion still computes it (the deferral is only while
+        # the job runs), so the operator sees the breakdown once it finishes.
+        self.client.force_login(self.user)
+        with patch(
+            "forward_netbox.views.change_explainability_summary",
+            return_value={"available": False},
+        ) as mock_ce:
+            self.client.get(
+                reverse(
+                    "plugins:forward_netbox:forwardingestion_logs",
+                    kwargs={"pk": self.ingestion.pk},
+                ),
+                headers={"HX-Request": "true"},
+            )
+        mock_ce.assert_called_once()
+
     def test_export_logs_compacts_large_execution_plan_items(self):
         sync = ForwardSync.objects.create(
             name="sync-log-export-plan-items",

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_models.py

@@ -1604,6 +1604,10 @@ class ForwardSyncModelTest(TestCase):
             parameters={
                 "snapshot_id": LATEST_PROCESSED_SNAPSHOT,
                 "dcim.device": True,
+                # Isolate this test to the recurring-reschedule enqueue; the
+                # vsys/vdom parent-link overlay is default-on and would add a
+                # second enqueue (covered by its own test).
+                "auto_link_vsys_parents": False,
             },
         )
         user = get_user_model().objects.create_user(username="recurring-user")

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_scope_module_ui.py

@@ -384,6 +384,7 @@ class ScopeModuleUiTest(TestCase):
                     "collection_result": "DeviceSnapshotResult.completed",
                     "blast_radius": 7,
                     "cve_count": 2,
+                    "cve_ids": ["CVE-2022-5678", "CVE-2021-1234"],
                     "up_interfaces": 5,
                     "detail": "DC1",
                 },
@@ -421,6 +422,8 @@ class ScopeModuleUiTest(TestCase):
         self.assertTrue(analysis.reachable)
         self.assertEqual(analysis.blast_radius, 7)
         self.assertEqual(analysis.cve_count, 2)
+        # CVE IDs stored (deduped + sorted) so the panel can list them.
+        self.assertEqual(analysis.cve_ids, ["CVE-2021-1234", "CVE-2022-5678"])
         self.assertEqual(analysis.up_interfaces, 5)
         self.assertEqual(analysis.collection_result, "completed")
         # The failed device surfaces the specific Forward collection error token.
@@ -442,6 +445,9 @@ class ScopeModuleUiTest(TestCase):
         )
         rendered = panel.right_page()
         self.assertIn("Forward Analysis", rendered)
+        # The actual CVE IDs behind the exposure count are listed + linked to NVD.
+        self.assertIn("CVE-2021-1234", rendered)
+        self.assertIn("nvd.nist.gov/vuln/detail/CVE-2022-5678", rendered)
         # Deep-link pivot into the Forward app.
         self.assertIn("Open in Forward", rendered)
         self.assertIn("https://fwd.app", rendered)

{forward_netbox-2.2.1 → forward_netbox-2.2.3}/forward_netbox/tests/test_vsys_parent.py

@@ -39,6 +39,25 @@ class VsysParentTest(TestCase):
         self.assertEqual(vsys.custom_field_data.get(PARENT_DEVICE_CF), chassis.pk)
         # The physical chassis itself is never linked.
         self.assertIn(chassis.custom_field_data.get(PARENT_DEVICE_CF), (None, ""))
+        # The context is also modeled as a VirtualDeviceContext under the chassis.
+        from dcim.models import VirtualDeviceContext
+
+        self.assertEqual(result["vdc_created"], 1)
+        self.assertTrue(
+            VirtualDeviceContext.objects.filter(
+                device=chassis, name=vsys.name, status="active"
+            ).exists()
+        )
+        # Re-running is idempotent — the VDC is found, not re-created.
+        again = link_vsys_parents(
+            None, fetch_rows=self._rows([(vsys.name, chassis.name)])
+        )
+        self.assertEqual(again["vdc_created"], 0)
+        self.assertEqual(again["vdc_existing"], 1)
+        self.assertEqual(
+            VirtualDeviceContext.objects.filter(device=chassis, name=vsys.name).count(),
+            1,
+        )
 
     def test_orphan_parent_not_linked(self):
         # vsys present in NetBox, but its physical chassis is not collected.