forward-netbox 2.2.4__tar.gz → 2.2.5__tar.gz

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.2.4
+Version: 2.2.5
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -31,7 +31,8 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
+| `v2.2.5` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Feature: operator-selectable **Sync Device Tags** — pick which Forward device tags (e.g. `Mgmt_*`) become NetBox device tags (replaces the hardcoded feature-tag set); Fix dependency-preview AttributeError + vsys job pile-up guard (hung pending); test/require NetBox 4.6.4 |
+| `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.5`; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
 | `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.4`; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
 | `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
 | `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/README.md

@@ -8,7 +8,8 @@ Forward 26.6 is the baseline for async NQE.
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Current release; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
+| `v2.2.5` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Feature: operator-selectable **Sync Device Tags** — pick which Forward device tags (e.g. `Mgmt_*`) become NetBox device tags (replaces the hardcoded feature-tag set); Fix dependency-preview AttributeError + vsys job pile-up guard (hung pending); test/require NetBox 4.6.4 |
+| `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.5`; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
 | `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.4`; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
 | `v2.2.2` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.3`; Fix 504 gateway timeouts on large syncs: stop recomputing change-explainability on every poll during a long merge + back off poll to 15s |
 | `v2.2.1` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.2`; Add read-only forward_apply_identity_audit diagnostic to pinpoint 1-created/1-deleted idempotency churn |

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/__init__.py

@@ -8,9 +8,9 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward Field Integration"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.2.4"
+    version = "2.2.5"
     base_url = "forward"
-    min_version = "4.6.3"
+    min_version = "4.6.4"
 
     def ready(self):
         super().ready()

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/forms.py

@@ -436,6 +436,19 @@ class ForwardSourceForm(NetBoxModelForm):
                 "filtered in NetBox."
             ),
         )
+        self.fields["sync_device_tags"] = FlexibleMultipleChoiceField(
+            required=False,
+            choices=(),
+            widget=APISelectMultiple(
+                api_url="/api/plugins/forward/source/available-tags/"
+            ),
+            label="Sync Device Tags",
+            help_text=(
+                "Forward device tags (e.g. Mgmt_*) to sync onto NetBox devices as "
+                "device tags. Select one or more; leave empty to sync none. "
+                "Independent of the include/exclude scope filters above."
+            ),
+        )
         _configure_api_select(
             self.fields["network_id"].widget,
             {
@@ -448,6 +461,7 @@ class ForwardSourceForm(NetBoxModelForm):
         )
         self.fields["device_tag_include_tags"].widget.attrs["multiple"] = "multiple"
         self.fields["device_tag_exclude_tags"].widget.attrs["multiple"] = "multiple"
+        self.fields["sync_device_tags"].widget.attrs["multiple"] = "multiple"
         _configure_api_select(
             self.fields["device_tag_include_tags"].widget,
             {
@@ -470,6 +484,17 @@ class ForwardSourceForm(NetBoxModelForm):
                 "network_id": "$network_id",
             },
         )
+        _configure_api_select(
+            self.fields["sync_device_tags"].widget,
+            {
+                "type": "$type",
+                "url": "$url",
+                "username": "$username",
+                "password": "$password",
+                "verify": "$verify",
+                "network_id": "$network_id",
+            },
+        )
         if self.instance.pk:
             self.fields["network_id"].widget.add_query_param(
                 "source_id", self.instance.pk
@@ -480,6 +505,9 @@ class ForwardSourceForm(NetBoxModelForm):
             self.fields["device_tag_exclude_tags"].widget.add_query_param(
                 "source_id", self.instance.pk
             )
+            self.fields["sync_device_tags"].widget.add_query_param(
+                "source_id", self.instance.pk
+            )
 
         parameters = self.instance.parameters or {}
         existing_username = parameters.get("username")
@@ -549,9 +577,11 @@ class ForwardSourceForm(NetBoxModelForm):
         self.fields["network_id"].choices = _selected_choice(existing_network_id)
         include_bound = []
         exclude_bound = []
+        sync_tags_bound = []
         if self.is_bound:
             include_bound = self._bound_tag_values("device_tag_include_tags")
             exclude_bound = self._bound_tag_values("device_tag_exclude_tags")
+            sync_tags_bound = self._bound_tag_values("sync_device_tags")
         include_initial = (
             include_bound
             if self.is_bound
@@ -568,14 +598,22 @@ class ForwardSourceForm(NetBoxModelForm):
         if exclude_initial is None and parameters.get("device_tag_exclude"):
             exclude_initial = [parameters.get("device_tag_exclude")]
         exclude_initial = self._normalize_tag_values(exclude_initial)
+        sync_tags_initial = (
+            sync_tags_bound if self.is_bound else parameters.get("sync_device_tags")
+        )
+        sync_tags_initial = self._normalize_tag_values(sync_tags_initial)
         self.fields["device_tag_include_tags"].initial = include_initial
         self.fields["device_tag_exclude_tags"].initial = exclude_initial
+        self.fields["sync_device_tags"].initial = sync_tags_initial
         self.fields["device_tag_include_tags"].choices = [
             (tag, tag) for tag in include_initial
         ]
         self.fields["device_tag_exclude_tags"].choices = [
             (tag, tag) for tag in exclude_initial
         ]
+        self.fields["sync_device_tags"].choices = [
+            (tag, tag) for tag in sync_tags_initial
+        ]
         self.fields["device_tag_include_match"].initial = (
             parameters.get("device_tag_include_match") or "any"
         )
@@ -619,6 +657,7 @@ class ForwardSourceForm(NetBoxModelForm):
                     "device_tag_filter_mode",
                     "device_tag_prune_out_of_scope",
                     "apply_device_scope_tags",
+                    "sync_device_tags",
                     name="Parameters",
                 )
             )
@@ -649,6 +688,7 @@ class ForwardSourceForm(NetBoxModelForm):
                     "device_tag_filter_mode",
                     "device_tag_prune_out_of_scope",
                     "apply_device_scope_tags",
+                    "sync_device_tags",
                     name="Parameters",
                 )
             )
@@ -690,6 +730,11 @@ class ForwardSourceForm(NetBoxModelForm):
             exclude_tags = self._normalize_tag_values(
                 self._bound_tag_values("device_tag_exclude_tags")
             )
+        sync_device_tags = self._normalize_tag_values(cleaned.get("sync_device_tags"))
+        if not sync_device_tags:
+            sync_device_tags = self._normalize_tag_values(
+                self._bound_tag_values("sync_device_tags")
+            )
         candidate_parameters = {
             "username": username,
             "password": password,
@@ -794,6 +839,7 @@ class ForwardSourceForm(NetBoxModelForm):
                 cleaned.get("device_tag_prune_out_of_scope")
             ),
             "apply_device_scope_tags": bool(cleaned.get("apply_device_scope_tags")),
+            "sync_device_tags": sync_device_tags,
         }
         self.instance.type = source_type
         self.instance.url = (
@@ -834,6 +880,9 @@ class ForwardSourceForm(NetBoxModelForm):
         self.fields["device_tag_exclude_tags"].choices = [
             (tag, tag) for tag in exclude_tags
         ]
+        self.fields["sync_device_tags"].choices = [
+            (tag, tag) for tag in sync_device_tags
+        ]
         return cleaned
 
     def save(self, *args, **kwargs):
@@ -861,6 +910,13 @@ class ForwardSourceForm(NetBoxModelForm):
             exclude_tags = self._normalize_tag_values(
                 self._bound_tag_values("device_tag_exclude_tags")
             )
+        sync_device_tags = self._normalize_tag_values(
+            self.cleaned_data.get("sync_device_tags")
+        )
+        if not sync_device_tags:
+            sync_device_tags = self._normalize_tag_values(
+                self._bound_tag_values("sync_device_tags")
+            )
         self.instance.parameters = {
             "username": self.cleaned_data.get("username")
             or existing_parameters.get("username")
@@ -976,6 +1032,7 @@ class ForwardSourceForm(NetBoxModelForm):
             "apply_device_scope_tags": bool(
                 self.cleaned_data.get("apply_device_scope_tags")
             ),
+            "sync_device_tags": sync_device_tags,
         }
         self.instance.status = ForwardSourceStatusChoices.NEW
         return super().save(*args, **kwargs)

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/jobs.py

@@ -121,6 +121,24 @@ def record_timeout_issue(ingestion, phase, message):
     )
 
 
+def _sync_has_active_job(sync, name):
+    """True if a pending/running job with ``name`` already exists for ``sync``.
+
+    Post-sync overlays are enqueued after EVERY sync; a slow/large overlay (e.g.
+    the vsys parent-link's full-network fetch) can still be running when the next
+    sync fires, so without this guard duplicate jobs pile up in PENDING behind it
+    and look 'hung'. Skipping the enqueue when one is already active keeps at most
+    one overlay of each kind queued per sync.
+    """
+    return sync.jobs.filter(
+        name=name,
+        status__in=[
+            JobStatusChoices.STATUS_PENDING,
+            JobStatusChoices.STATUS_RUNNING,
+        ],
+    ).exists()
+
+
 def _maybe_enqueue_device_analysis_refresh(sync):
     """Opt-in: after a successful sync, refresh the device-analysis overlay.
 
@@ -132,11 +150,14 @@ def _maybe_enqueue_device_analysis_refresh(sync):
     try:
         from django.utils.module_loading import import_string
 
+        name = f"{sync.name} - refresh device analysis (auto)"
+        if _sync_has_active_job(sync, name):
+            return
         Job.enqueue(
             import_string("forward_netbox.jobs.refresh_forward_device_analysis"),
             instance=sync,
             user=sync.user,
-            name=f"{sync.name} - refresh device analysis (auto)",
+            name=name,
         )
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("Auto device-analysis refresh enqueue failed: %s", exc)
@@ -156,11 +177,14 @@ def _maybe_enqueue_backfilled_tag_refresh(sync):
     try:
         from django.utils.module_loading import import_string
 
+        name = f"{sync.name} - tag backfilled devices (auto)"
+        if _sync_has_active_job(sync, name):
+            return
         Job.enqueue(
             import_string("forward_netbox.jobs.tag_forward_backfilled_devices"),
             instance=sync,
             user=sync.user,
-            name=f"{sync.name} - tag backfilled devices (auto)",
+            name=name,
         )
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("Auto backfilled-tag refresh enqueue failed: %s", exc)
@@ -180,11 +204,14 @@ def _maybe_enqueue_vsys_parent_link(sync):
     try:
         from django.utils.module_loading import import_string
 
+        name = f"{sync.name} - link vsys/vdom parents (auto)"
+        if _sync_has_active_job(sync, name):
+            return
         Job.enqueue(
             import_string("forward_netbox.jobs.link_forward_vsys_parents"),
             instance=sync,
             user=sync.user,
-            name=f"{sync.name} - link vsys/vdom parents (auto)",
+            name=name,
         )
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("Auto vsys parent-link enqueue failed: %s", exc)
@@ -202,11 +229,14 @@ def _maybe_enqueue_auto_prune(sync):
     try:
         from django.utils.module_loading import import_string
 
+        name = f"{sync.name} - prune orphans (auto)"
+        if _sync_has_active_job(sync, name):
+            return
         Job.enqueue(
             import_string("forward_netbox.jobs.prune_forward_orphans"),
             instance=sync,
             user=sync.user,
-            name=f"{sync.name} - prune orphans (auto)",
+            name=name,
         )
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("Auto prune-orphans enqueue failed: %s", exc)

forward_netbox-2.2.5/forward_netbox/queries/forward_device_feature_tags.nqe

@@ -0,0 +1,26 @@
+/**
+ * @intent Forward Device Feature Tags
+ * @description NetBox device tags synced from Forward. Emits the Forward device
+ * tags (device.tagNames) the sync selected in `sync_device_tags`, so operators
+ * choose exactly which Forward tags (e.g. Mgmt_*) become NetBox device tags. With
+ * no tags selected it emits nothing.
+ */
+
+@query
+f(forward_netbox_shard_keys: List<String>, sync_device_tags: List<String>) =
+foreach device in network.devices
+where device.snapshotInfo.result == DeviceSnapshotResult.completed
+where device.platform.vendor != Vendor.FORWARD_CUSTOM
+where isEmpty(forward_netbox_shard_keys) || device.name in forward_netbox_shard_keys
+foreach tag in device.tagNames
+where tag in sync_device_tags
+select distinct {
+  device: device.name,
+  tag: tag,
+  tag_slug: replaceRegexMatches(
+    replaceRegexMatches(toLowerCase(tag), re`[^a-z0-9]+`, "-"),
+    re`^-+|-+$`,
+    ""
+  ),
+  tag_color: "9e9e9e"
+};

forward_netbox-2.2.5/forward_netbox/tests/test_dependency_preview_summary.py

@@ -0,0 +1,45 @@
+from django.test import SimpleTestCase
+
+from forward_netbox.utilities.query_fetch_execution import ForwardModelResult
+from forward_netbox.views import _dependency_model_result_summary
+
+
+class DependencyModelResultSummaryTest(SimpleTestCase):
+    """Regression: fetcher.model_results are ForwardModelResult dataclasses, but
+    _dependency_model_result_summary called result.get(...) — AttributeError that
+    errored the whole dependency preview (hidden as null-data until 2.2.4 surfaced
+    job errors). The summary must accept a ForwardModelResult.
+    """
+
+    def _result(self, **kw):
+        base = dict(
+            model_string="ipam.prefix",
+            query_name="Forward Prefixes",
+            execution_mode="query_path",
+            execution_value="",
+            sync_mode="branching",
+            row_count=12,
+            delete_count=3,
+        )
+        base.update(kw)
+        return ForwardModelResult(**base)
+
+    def test_summary_accepts_dataclass(self):
+        summary = _dependency_model_result_summary(self._result())
+        self.assertEqual(summary["model"], "ipam.prefix")
+        self.assertEqual(summary["row_count"], 12)
+        self.assertEqual(summary["delete_count"], 3)
+        # estimated_changes is derived (as_dict has no such field).
+        self.assertEqual(summary["estimated_changes"], 15)
+
+    def test_summary_handles_none_runtime(self):
+        # runtime_ms defaults to None on the dataclass; must not blow up.
+        summary = _dependency_model_result_summary(self._result(runtime_ms=None))
+        self.assertEqual(summary["runtime_ms"], 0.0)
+
+    def test_summary_still_accepts_plain_dict(self):
+        summary = _dependency_model_result_summary(
+            {"model": "dcim.device", "row_count": 5, "delete_count": 1}
+        )
+        self.assertEqual(summary["model"], "dcim.device")
+        self.assertEqual(summary["estimated_changes"], 6)

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/tests/test_forms.py

@@ -118,6 +118,37 @@ class ForwardSourceFormTest(TestCase):
             ["tag-a", "tag-b", "tag-c"],
         )
 
+    def test_sync_device_tags_uses_multiselect_widget(self):
+        # The operator picks 1+ Forward tags to sync as NetBox device tags; the
+        # widget must keep every selected tag (same regression class as the
+        # include/exclude fields).
+        form = ForwardSourceForm()
+        self.assertTrue(
+            form.fields["sync_device_tags"].widget.allow_multiple_selected,
+            "sync_device_tags must use a multiple-select widget",
+        )
+
+    @patch("forward_netbox.forms.ForwardSource.validate_connection")
+    def test_sync_device_tags_persist_to_parameters(self, _mock_validate):
+        data = self._base_form_data()
+        data["sync_device_tags"] = ["Mgmt_Vl211", "N.Patel"]
+        form = ForwardSourceForm(data=data)
+        self.assertTrue(form.is_valid(), form.errors)
+        source = form.save()
+        # Order-independent: the query sorts on inject, but persistence keeps the
+        # normalized submitted set.
+        self.assertEqual(
+            sorted(source.parameters["sync_device_tags"]),
+            ["Mgmt_Vl211", "N.Patel"],
+        )
+
+    @patch("forward_netbox.forms.ForwardSource.validate_connection")
+    def test_sync_device_tags_default_empty(self, _mock_validate):
+        form = ForwardSourceForm(data=self._base_form_data())
+        self.assertTrue(form.is_valid(), form.errors)
+        source = form.save()
+        self.assertEqual(source.parameters["sync_device_tags"], [])
+
 
 class ForwardSyncFormTest(TestCase):
     def setUp(self):

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/tests/test_jobs.py

@@ -98,6 +98,34 @@ class ForwardJobsTest(TestCase):
             enqueue.assert_called_once()
             self.assertIn("prune orphans", enqueue.call_args.kwargs["name"])
 
+    def test_overlay_enqueue_skips_when_active_job_exists(self):
+        # Regression (hung-pending pile-up): the default-on vsys overlay enqueues
+        # after every sync; if one is still pending/running it must NOT enqueue a
+        # duplicate that stacks up behind it.
+        from django.contrib.contenttypes.models import ContentType
+
+        from forward_netbox.jobs import _maybe_enqueue_vsys_parent_link
+
+        name = f"{self.sync.name} - link vsys/vdom parents (auto)"
+        Job.objects.create(
+            object_type=ContentType.objects.get_for_model(ForwardSync),
+            object_id=self.sync.pk,
+            name=name,
+            status=JobStatusChoices.STATUS_PENDING,
+            job_id=uuid4(),
+        )
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_not_called()
+
+        # A completed job of the same name does NOT block a fresh enqueue.
+        Job.objects.filter(object_id=self.sync.pk, name=name).update(
+            status=JobStatusChoices.STATUS_COMPLETED
+        )
+        with patch("forward_netbox.jobs.Job.enqueue") as enqueue:
+            _maybe_enqueue_vsys_parent_link(self.sync)
+            enqueue.assert_called_once()
+
     def test_record_timeout_issue_creates_single_issue_per_ingestion_phase(self):
         issue_1 = record_timeout_issue(
             self.ingestion,

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/tests/test_models.py

@@ -151,6 +151,49 @@ class ForwardSyncModelTest(TestCase):
             str(ctx.exception),
         )
 
+    def test_source_accepts_sync_device_tags_list(self):
+        source = ForwardSource(
+            name="source-sync-device-tags",
+            type="saas",
+            url="https://fwd.app",
+            parameters={
+                "username": "user@example.com",
+                "password": "secret",
+                "verify": True,
+                "timeout": 1200,
+                "network_id": "test-network",
+                "sync_device_tags": ["Mgmt_Vl211", "N.Patel"],
+            },
+        )
+
+        source.clean()
+
+        self.assertEqual(
+            source.parameters["sync_device_tags"], ["Mgmt_Vl211", "N.Patel"]
+        )
+
+    def test_source_rejects_non_list_sync_device_tags(self):
+        source = ForwardSource(
+            name="source-bad-sync-device-tags",
+            type="saas",
+            url="https://fwd.app",
+            parameters={
+                "username": "user@example.com",
+                "password": "secret",
+                "verify": True,
+                "timeout": 1200,
+                "network_id": "test-network",
+                "sync_device_tags": "Mgmt_Vl211",
+            },
+        )
+
+        with self.assertRaises(ValidationError) as ctx:
+            source.clean()
+
+        self.assertIn(
+            "`sync_device_tags` must be a list of strings.", str(ctx.exception)
+        )
+
     def test_source_preserves_api_requests_per_minute(self):
         source = ForwardSource(
             name="source-api-rpm",

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/tests/test_query_registry.py

@@ -883,6 +883,20 @@ class QueryRegistryTest(TestCase):
             },
         )
 
+    def test_feature_tags_query_seeds_sync_device_tags_parameter(self):
+        # The device-feature-tags query is operator-driven: its signature declares
+        # sync_device_tags, so the seeded parameters must include it (empty) or the
+        # param-injection guard never fires and the selected tags never reach the
+        # fetch.
+        rows = {row["name"]: row for row in builtin_nqe_map_rows()}
+        self.assertEqual(
+            rows["Forward Device Feature Tags"]["parameters"],
+            {
+                "forward_netbox_shard_keys": [],
+                "sync_device_tags": [],
+            },
+        )
+
     def test_sync_builtin_queries_seed_empty_shard_parameter(self):
         rows = {row["name"]: row for row in builtin_nqe_map_rows()}
         excluded_names = {
@@ -1611,16 +1625,23 @@ class QueryRegistryTest(TestCase):
             (("device", "interface", "remote_device", "remote_interface"),),
         )
 
-    def test_device_feature_tag_query_emits_bgp_tag(self):
+    def test_device_feature_tag_query_syncs_operator_selected_tags(self):
+        # 2.2.5: the default feature-tags map is param-driven — it emits exactly the
+        # Forward device tags the operator selected in sync_device_tags, not a
+        # hardcoded Prot_BGP. (BGP tagging moved to the routing plugin.)
         spec = next(
             spec
             for spec in BUILTIN_QUERY_SPECS["extras.taggeditem"]
             if spec.query_name == "Forward Device Feature Tags"
         )
 
-        self.assertIn("where isPresent(protocol.bgp)", spec.query)
-        self.assertIn('tag: "Prot_BGP"', spec.query)
-        self.assertIn('tag_slug: "prot-bgp"', spec.query)
+        self.assertIn("sync_device_tags: List<String>", spec.query)
+        self.assertIn("foreach tag in device.tagNames", spec.query)
+        self.assertIn("where tag in sync_device_tags", spec.query)
+        self.assertIn("tag: tag", spec.query)
+        self.assertNotIn('tag: "Prot_BGP"', spec.query)
+        self.assertNotIn("protocol.bgp", spec.query)
+        self.assertIn("sync_device_tags", spec.parameters)
         self.assertEqual(spec.coalesce_fields, (("device", "tag_slug"),))
 
     def test_optional_device_feature_tag_rules_query_uses_data_file(self):

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/tests/test_sync.py

@@ -6734,6 +6734,68 @@ class ForwardSyncRunnerTest(TestCase):
             },
         )
 
+    def test_apply_context_tag_parameters_injects_sync_device_tags(self):
+        # The operator's selected Forward tags (context.sync_device_tags) must be
+        # injected into any query that declares the sync_device_tags parameter, and
+        # sorted so query results are deterministic across runs.
+        client = Mock()
+        logger = Mock()
+        fetcher = ForwardQueryFetcher(
+            sync=self.sync,
+            client=client,
+            logger_=logger,
+        )
+        context = ForwardQueryContext(
+            network_id="test-network",
+            snapshot_selector=LATEST_PROCESSED_SNAPSHOT,
+            snapshot_id="snapshot-before",
+            sync_device_tags=["N.Patel", "Mgmt_Vl211"],
+        )
+        spec = QuerySpec(
+            model_string="extras.taggeditem",
+            query_name="Forward Device Feature Tags",
+            query=(
+                "@query f(forward_netbox_shard_keys: List<String>, "
+                "sync_device_tags: List<String>) = []"
+            ),
+            parameters={"forward_netbox_shard_keys": [], "sync_device_tags": []},
+        )
+
+        resolved = fetcher._apply_context_tag_parameters(
+            spec, {"forward_netbox_shard_keys": []}, context
+        )
+
+        self.assertEqual(resolved["sync_device_tags"], ["Mgmt_Vl211", "N.Patel"])
+
+    def test_apply_context_tag_parameters_skips_sync_device_tags_when_undeclared(self):
+        # A query that does not declare sync_device_tags must not receive it, or the
+        # Forward engine rejects the fetch with an unexpected-parameter error.
+        client = Mock()
+        logger = Mock()
+        fetcher = ForwardQueryFetcher(
+            sync=self.sync,
+            client=client,
+            logger_=logger,
+        )
+        context = ForwardQueryContext(
+            network_id="test-network",
+            snapshot_selector=LATEST_PROCESSED_SNAPSHOT,
+            snapshot_id="snapshot-before",
+            sync_device_tags=["Mgmt_Vl211"],
+        )
+        spec = QuerySpec(
+            model_string="dcim.interface",
+            query_name="Forward Interfaces",
+            query="@query f(forward_netbox_shard_keys: List<String>) = []",
+            parameters={"forward_netbox_shard_keys": []},
+        )
+
+        resolved = fetcher._apply_context_tag_parameters(
+            spec, {"forward_netbox_shard_keys": []}, context
+        )
+
+        self.assertNotIn("sync_device_tags", resolved)
+
     def test_fetch_spec_rows_rejects_legacy_column_filter_scope(self):
         client = Mock()
         logger = Mock()

{forward_netbox-2.2.4 → forward_netbox-2.2.5}/forward_netbox/utilities/model_validation.py

@@ -59,6 +59,7 @@ def clean_forward_source(source):
             "device_tag_filter_mode",
             "device_tag_prune_out_of_scope",
             "apply_device_scope_tags",
+            "sync_device_tags",
         }
     )
     if invalid:
@@ -81,7 +82,11 @@ def clean_forward_source(source):
     for key in ("device_tag_include", "device_tag_exclude"):
         if parameters.get(key) is not None and not isinstance(parameters.get(key), str):
             raise ValidationError(_(f"`{key}` must be a string."))
-    for key in ("device_tag_include_tags", "device_tag_exclude_tags"):
+    for key in (
+        "device_tag_include_tags",
+        "device_tag_exclude_tags",
+        "sync_device_tags",
+    ):
         if parameters.get(key) is None:
             continue
         if not isinstance(parameters.get(key), list) or any(