forward-netbox 2.4.2__tar.gz → 2.4.4__tar.gz

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.4.2
+Version: 2.4.4
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -99,7 +99,9 @@ Latest release requires NetBox `4.6.4` and `netbox-branching` `1.1.0+`. Expand f
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.4.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Fix: endpoint import (`sync_endpoints`) and device-tag sync (`sync_device_tags`) now work with the alias-aware and rules-aware query variants (`forward_devices_with_netbox_aliases`, `forward_device_feature_tags_with_rules`), not just the base queries — operators running the variants saw the toggles silently do nothing (validated live: 355 Avocent endpoints import; `Mgmt_*` tags sync). Adds a **Publish Bundled Queries** button on the sync Health page (beside Refresh Query IDs) and two Health warnings: when an opt-in feature is enabled but no enabled map provides it, and when a base query and its opt-in variant are both enabled (they double-apply rows for the same model and churn — enable one). The alias-aware device query now emits the clean role name (e.g. `ROUTER`) to match the base query — expect a one-time role update on alias-mapped devices. |
+| `v2.4.4` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Fix: SNMP-endpoint import now works on **tag-scoped** syncs — the device-tag include scope silently excluded every endpoint, both query-side and in the plugin's local scope filter (whose scoped-device set was built from modeled devices only, so endpoint rows were always dropped; with prune enabled they would even be deleted). Endpoint import now ignores the include scope (exclude tags still apply) and endpoint names join the scoped set (validated live: 355 Avocent endpoints import under a tag-scoped sync). Also fixes the merge-phase `Tag with this Name already exists` issues: a same-named/same-slug tag already on main is now treated as merged instead of failing the branch's tag create. |
+| `v2.4.3` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.4`; Fix: the pinned-query opt-in Health warning (2.4.1) over-claimed failure — it reads "nothing new syncs" and fires on any pinned map with the feature on, even after the query is fixed, because the Health page can't read a pinned query's contents. Reworded to a "Pinned — can't verify locally" heads-up that points at **Export Live Query Drift** to confirm (`source_matches_bundled`), instead of asserting failure. No behavior change. |
+| `v2.4.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.3`; Fix: endpoint import (`sync_endpoints`) and device-tag sync (`sync_device_tags`) now work with the alias-aware and rules-aware query variants (`forward_devices_with_netbox_aliases`, `forward_device_feature_tags_with_rules`), not just the base queries — operators running the variants saw the toggles silently do nothing (validated live: 355 Avocent endpoints import; `Mgmt_*` tags sync). Adds a **Publish Bundled Queries** button on the sync Health page (beside Refresh Query IDs) and two Health warnings: when an opt-in feature is enabled but no enabled map provides it, and when a base query and its opt-in variant are both enabled (they double-apply rows for the same model and churn — enable one). The alias-aware device query now emits the clean role name (e.g. `ROUTER`) to match the base query — expect a one-time role update on alias-mapped devices. |
 | `v2.4.1` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.2`; Fix: opt-in features (SNMP endpoint import, device-tag sync) silently did nothing on sources that run org-managed **pinned** Forward query IDs predating the feature — the sync Health page now raises an actionable warning instead of a silent badge. Remediation: publish the bundled queries to your Forward org folder (Overwrite on), then use Refresh Query IDs, then re-sync. |
 | `v2.4.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.1`; Fix: the "Import SNMP Endpoints as Devices" toggle now renders on the source form (the field shipped in 2.3.2 but was not in any fieldset, so it never showed), letting operators enable endpoint import from the GUI. |
 | `v2.3.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.0`; Feature: optional import of Forward SNMP endpoints (e.g. Avocent console servers) as NetBox devices — off by default (`sync_endpoints`), enabled per source and scoped by the same device tags. |

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/README.md

@@ -66,7 +66,9 @@ Latest release requires NetBox `4.6.4` and `netbox-branching` `1.1.0+`. Expand f
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.4.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Fix: endpoint import (`sync_endpoints`) and device-tag sync (`sync_device_tags`) now work with the alias-aware and rules-aware query variants (`forward_devices_with_netbox_aliases`, `forward_device_feature_tags_with_rules`), not just the base queries — operators running the variants saw the toggles silently do nothing (validated live: 355 Avocent endpoints import; `Mgmt_*` tags sync). Adds a **Publish Bundled Queries** button on the sync Health page (beside Refresh Query IDs) and two Health warnings: when an opt-in feature is enabled but no enabled map provides it, and when a base query and its opt-in variant are both enabled (they double-apply rows for the same model and churn — enable one). The alias-aware device query now emits the clean role name (e.g. `ROUTER`) to match the base query — expect a one-time role update on alias-mapped devices. |
+| `v2.4.4` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Fix: SNMP-endpoint import now works on **tag-scoped** syncs — the device-tag include scope silently excluded every endpoint, both query-side and in the plugin's local scope filter (whose scoped-device set was built from modeled devices only, so endpoint rows were always dropped; with prune enabled they would even be deleted). Endpoint import now ignores the include scope (exclude tags still apply) and endpoint names join the scoped set (validated live: 355 Avocent endpoints import under a tag-scoped sync). Also fixes the merge-phase `Tag with this Name already exists` issues: a same-named/same-slug tag already on main is now treated as merged instead of failing the branch's tag create. |
+| `v2.4.3` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.4`; Fix: the pinned-query opt-in Health warning (2.4.1) over-claimed failure — it reads "nothing new syncs" and fires on any pinned map with the feature on, even after the query is fixed, because the Health page can't read a pinned query's contents. Reworded to a "Pinned — can't verify locally" heads-up that points at **Export Live Query Drift** to confirm (`source_matches_bundled`), instead of asserting failure. No behavior change. |
+| `v2.4.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.3`; Fix: endpoint import (`sync_endpoints`) and device-tag sync (`sync_device_tags`) now work with the alias-aware and rules-aware query variants (`forward_devices_with_netbox_aliases`, `forward_device_feature_tags_with_rules`), not just the base queries — operators running the variants saw the toggles silently do nothing (validated live: 355 Avocent endpoints import; `Mgmt_*` tags sync). Adds a **Publish Bundled Queries** button on the sync Health page (beside Refresh Query IDs) and two Health warnings: when an opt-in feature is enabled but no enabled map provides it, and when a base query and its opt-in variant are both enabled (they double-apply rows for the same model and churn — enable one). The alias-aware device query now emits the clean role name (e.g. `ROUTER`) to match the base query — expect a one-time role update on alias-mapped devices. |
 | `v2.4.1` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.2`; Fix: opt-in features (SNMP endpoint import, device-tag sync) silently did nothing on sources that run org-managed **pinned** Forward query IDs predating the feature — the sync Health page now raises an actionable warning instead of a silent badge. Remediation: publish the bundled queries to your Forward org folder (Overwrite on), then use Refresh Query IDs, then re-sync. |
 | `v2.4.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.1`; Fix: the "Import SNMP Endpoints as Devices" toggle now renders on the source form (the field shipped in 2.3.2 but was not in any fieldset, so it never showed), letting operators enable endpoint import from the GUI. |
 | `v2.3.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.4.0`; Feature: optional import of Forward SNMP endpoints (e.g. Avocent console servers) as NetBox devices — off by default (`sync_endpoints`), enabled per source and scoped by the same device tags. |

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/__init__.py

@@ -8,7 +8,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.4.2"
+    version = "2.4.4"
     base_url = "forward"
     min_version = "4.6.4"
 

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/queries/forward_devices.nqe

@@ -44,15 +44,12 @@ foreach row in (
   (
     // SNMP endpoints (opt-in): generic SSH/SNMP devices Forward collects but
     // does not model. Generic identity from MIB-2; Avocent overlay by enterprise
-    // OID 10418. Scoped by the same device tags (endpoints carry tagNames).
+    // OID 10418. Device-tag INCLUDE scope narrows modeled devices only —
+    // endpoints rarely carry device scoping tags, so requiring them silently
+    // excluded every endpoint on scoped syncs. Exclude tags still apply.
     foreach endpoint in network.endpoints
     where sync_endpoints
     where !isEmpty(endpoint.snmpOutputs)
-    where isEmpty(device_tag_include_tags)
-      || (device_tag_include_match == "all"
-        && all(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
-      || (device_tag_include_match != "all"
-        && any(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
     where isEmpty(device_tag_exclude_tags)
       || !any(foreach tag in device_tag_exclude_tags select tag in endpoint.tagNames)
     let sysDescrOpt = max(foreach o in endpoint.snmpOutputs where o.requestedOid == "1.3.6.1.2.1.1.1" select max(foreach e in o.rawOidEntries select e.rawValue))

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/queries/forward_devices_with_netbox_aliases.nqe

@@ -86,16 +86,13 @@ foreach row in (
   (
     // SNMP endpoints (opt-in): identical branch to forward_devices.nqe. Generic
     // SSH/SNMP devices Forward collects but does not model. Generic identity from
-    // MIB-2; Avocent overlay by enterprise OID 10418. Scoped by the same device
-    // tags (endpoints carry tagNames).
+    // MIB-2; Avocent overlay by enterprise OID 10418. Device-tag INCLUDE scope
+    // narrows modeled devices only — endpoints rarely carry device scoping tags,
+    // so requiring them silently excluded every endpoint on scoped syncs.
+    // Exclude tags still apply.
     foreach endpoint in network.endpoints
     where sync_endpoints
     where !isEmpty(endpoint.snmpOutputs)
-    where isEmpty(device_tag_include_tags)
-      || (device_tag_include_match == "all"
-        && all(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
-      || (device_tag_include_match != "all"
-        && any(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
     where isEmpty(device_tag_exclude_tags)
       || !any(foreach tag in device_tag_exclude_tags select tag in endpoint.tagNames)
     let sysDescrOpt = max(foreach o in endpoint.snmpOutputs where o.requestedOid == "1.3.6.1.2.1.1.1" select max(foreach e in o.rawOidEntries select e.rawValue))

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/tests/test_bulk_merge.py

@@ -569,3 +569,54 @@ class DeferredSelfRefFKSplitTest(TestCase):
         self.assertIn(upd_key, to_process)
         self.assertEqual(to_process[upd_key].postchange_data["lag"], 99)
         self.assertIn(cc.key, to_process[upd_key].depends_on)
+
+
+class BulkMergeTagNameCollisionTest(TransactionTestCase):
+    """A branch tag CREATE that collides by NAME with a main-side tag skips.
+
+    While a merge applies device UPDATEs (ordered before CREATEs),
+    netbox_branching sets device tags by name, get_or_creating the tag on main
+    with a new pk. The branch's tag CREATE then violated the unique name
+    constraint and surfaced as a ValidationError ingestion issue even though the
+    desired end state (tag exists) was already reached.
+    """
+
+    def setUp(self):
+        from django.contrib.auth import get_user_model
+
+        self.user = get_user_model().objects.create_user(username="tag-merge-user")
+        self.request = RequestFactory().get(reverse("home"))
+        self.request.user = self.user
+        self.logger = logging.getLogger("forward_netbox.tests.bulk_merge")
+
+    def test_tag_create_name_collision_skips_instead_of_failing(self):
+        from extras.models import Tag
+
+        branch = provision_branch(user=self.user, name="Tag Collision")
+        with activate_branch(branch), event_tracking(self.request):
+            self.request.id = uuid.uuid4()
+            self.request.user = self.user
+            Tag.objects.create(name="Mgmt_Coll", slug="mgmt-coll")
+
+        # Simulate the mid-merge name-based get_or_create on main: same name,
+        # different pk than the branch row.
+        Tag.objects.create(name="Mgmt_Coll", slug="mgmt-coll")
+
+        changes = branch.get_unmerged_changes().order_by("time")
+        apply_one = Mock(return_value=False)  # fallback would record an issue
+        applied, failed, _models = bulk_merge_changes(
+            branch,
+            changes,
+            self.request,
+            self.user,
+            self.logger,
+            apply_one=apply_one,
+        )
+
+        self.assertEqual(failed, 0)
+        # The colliding create must be skipped in the batch path, never routed
+        # to the per-object fallback (which would raise the ValidationError).
+        for call in apply_one.call_args_list:
+            collapsed = call.args[0]
+            self.assertNotEqual(collapsed.key[0], "extras.tag")
+        self.assertEqual(Tag.objects.filter(name="Mgmt_Coll").count(), 1)

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/tests/test_endpoints_import.py

@@ -74,9 +74,13 @@ class OptInPinnedDriftElevationTest(SimpleTestCase):
         self.assertEqual(drift[0]["severity"], "warn")
         self.assertEqual(drift[0]["status"], "direct_query_id_optin_stale_risk")
         self.assertIn("Refresh Query IDs", drift[0]["remediation"])
+        # Wording is a "can't verify locally" heads-up pointing at the live
+        # check, not a confirmed failure.
+        self.assertIn("Live Query Drift", drift[0]["remediation"])
+        self.assertIn("can't inspect locally", drift[0]["message"])
         # Badge label must track the elevated status, not the stale build-time one.
         self.assertNotEqual(drift[0].get("status_label"), "Org-managed (pinned)")
-        self.assertIn("predate", drift[0].get("status_label", ""))
+        self.assertIn("verify", drift[0].get("status_label", ""))
 
     def test_endpoints_disabled_leaves_pinned_device_query_silent(self):
         drift = [self._pinned("forward_devices.nqe")]
@@ -131,3 +135,129 @@ class EndpointFormRenderTest(TestCase):
             "sync_endpoints field exists but is not in any FieldSet, so the "
             "form never renders the toggle.",
         )
+
+
+from forward_netbox.utilities.query_fetch_execution import (  # noqa: E402
+    ForwardQueryFetcher,
+)
+
+
+class EndpointScopeUnionTest(TestCase):
+    """Tag-scoped syncs must keep opt-in endpoint rows, not silently drop them.
+
+    scoped_device_names was built from network.devices only, so the local scope
+    filter removed every endpoint row (and prune would delete them). With
+    sync_endpoints on, endpoint names join the scoped set; exclude tags still
+    apply to the endpoint probe.
+    """
+
+    def _fetcher(self, client):
+        from unittest.mock import Mock
+
+        return ForwardQueryFetcher(Mock(), client, Mock())
+
+    def test_scope_union_includes_endpoint_names(self):
+        from unittest.mock import Mock
+
+        client = Mock()
+        client.run_nqe_query.side_effect = [
+            [{"name": "dev-1", "site": "dc1", "tagNames": ["ACI"]}],  # device scope
+            [{"name": "avocent-1"}, {"name": "avocent-2"}],  # endpoint probe
+        ]
+        fetcher = self._fetcher(client)
+        names, _sites, _matched, failed = fetcher._resolve_scoped_tag_scope(
+            network_id="n",
+            snapshot_id="s",
+            include_tags=["ACI"],
+            exclude_tags=[],
+            include_match="any",
+            sync_endpoints=True,
+        )
+        self.assertEqual(names, {"dev-1", "avocent-1", "avocent-2"})
+        self.assertFalse(failed)
+
+    def test_scope_without_endpoints_flag_is_unchanged(self):
+        from unittest.mock import Mock
+
+        client = Mock()
+        client.run_nqe_query.return_value = [
+            {"name": "dev-1", "site": "dc1", "tagNames": ["ACI"]}
+        ]
+        fetcher = self._fetcher(client)
+        names, _sites, _matched, failed = fetcher._resolve_scoped_tag_scope(
+            network_id="n",
+            snapshot_id="s",
+            include_tags=["ACI"],
+            exclude_tags=[],
+            include_match="any",
+        )
+        self.assertEqual(names, {"dev-1"})
+        self.assertFalse(failed)
+        client.run_nqe_query.assert_called_once()
+
+    def test_endpoint_probe_honors_exclude_tags(self):
+        from unittest.mock import Mock
+
+        client = Mock()
+        client.run_nqe_query.return_value = [{"name": "avocent-1"}]
+        fetcher = self._fetcher(client)
+        fetcher._resolve_scoped_endpoint_names(
+            network_id="n", snapshot_id="s", exclude_tags=["Decom"]
+        )
+        query = client.run_nqe_query.call_args.kwargs["query"]
+        self.assertIn("network.endpoints", query)
+        self.assertIn('"Decom" in endpoint.tagNames', query)
+
+    def test_endpoint_probe_failure_warns_and_returns_none(self):
+        from unittest.mock import Mock
+
+        from forward_netbox.exceptions import ForwardClientError
+
+        client = Mock()
+        client.run_nqe_query.side_effect = ForwardClientError("boom")
+        fetcher = self._fetcher(client)
+        names = fetcher._resolve_scoped_endpoint_names(
+            network_id="n", snapshot_id="s", exclude_tags=[]
+        )
+        self.assertIsNone(names)
+        fetcher.logger.log_warning.assert_called_once()
+
+    def test_endpoint_probe_failure_flags_scope_as_failed(self):
+        # If the probe fails but the query still emitted endpoint rows, the
+        # local filter would drop them — and prune would DELETE previously
+        # imported endpoints. The failure flag lets resolve_context disable
+        # endpoint emission for the run instead.
+        from unittest.mock import Mock
+
+        from forward_netbox.exceptions import ForwardClientError
+
+        client = Mock()
+        client.run_nqe_query.side_effect = [
+            [{"name": "dev-1", "site": "dc1", "tagNames": ["ACI"]}],
+            ForwardClientError("boom"),
+        ]
+        fetcher = self._fetcher(client)
+        names, _sites, _matched, failed = fetcher._resolve_scoped_tag_scope(
+            network_id="n",
+            snapshot_id="s",
+            include_tags=["ACI"],
+            exclude_tags=[],
+            include_match="any",
+            sync_endpoints=True,
+        )
+        self.assertEqual(names, {"dev-1"})
+        self.assertTrue(failed)
+
+
+class EndpointBranchIncludeScopeRemovalTest(SimpleTestCase):
+    """The endpoint branch must not gate on device INCLUDE tags (exclude only)."""
+
+    def test_endpoint_branches_do_not_filter_include_tags(self):
+        for filename in (
+            "forward_devices.nqe",
+            "forward_devices_with_netbox_aliases.nqe",
+        ):
+            src = _read_query(filename)
+            endpoint_branch = src.split("network.endpoints", 1)[1]
+            self.assertIn("device_tag_exclude_tags", endpoint_branch, filename)
+            self.assertNotIn("device_tag_include_tags", endpoint_branch, filename)

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/tests/test_scope_matched_tags.py

@@ -41,7 +41,9 @@ class ScopeMatchedTagsResolveTest(TestCase):
             {"name": "d3", "site": "s", "tagNames": ["TagA", "TagB"]},
             {"name": "d4", "site": "s", "tagNames": ["TagX"]},
         ]
-        names, sites, matched = self._fetcher(client)._resolve_scoped_tag_scope(
+        names, sites, matched, _failed = self._fetcher(
+            client
+        )._resolve_scoped_tag_scope(
             network_id="net-1",
             snapshot_id="snap",
             include_tags=["TagA", "TagB"],
@@ -65,7 +67,7 @@ class ScopeMatchedTagsResolveTest(TestCase):
             exclude_tags=[],
             include_match="any",
         )
-        self.assertEqual(result, (set(), set(), {}))
+        self.assertEqual(result, (set(), set(), {}, False))
 
     def test_context_as_dict_carries_full_matched_map(self):
         ctx = ForwardQueryContext(

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/utilities/bulk_merge.py

@@ -28,6 +28,7 @@ from collections import defaultdict
 from django.db import DEFAULT_DB_ALIAS
 from django.db import IntegrityError
 from django.db import transaction
+from django.db.models import Q
 from mptt.models import MPTTModel
 from netbox_branching.merge_strategies.squash import ActionType
 from netbox_branching.merge_strategies.squash import CollapsedChange
@@ -398,6 +399,31 @@ def bulk_merge_changes(
         existing = set(
             model_class.objects.filter(pk__in=all_pks).values_list("pk", flat=True)
         )
+        # Tags collide by NAME, not pk: while the merge applies device UPDATEs
+        # (ordered before CREATEs), netbox_branching sets device tags by name,
+        # which get_or_creates the tag on main with a NEW pk. The branch's tag
+        # CREATE then violates the unique name/slug constraint. Treat a
+        # same-named (or same-slug) main-side tag as already merged. If the
+        # branch create carried different non-unique attrs (color/description),
+        # they converge on the next sync: its branch is provisioned from a main
+        # that has the tag, so the apply-time coalesce records an UPDATE.
+        existing_names: set[str] = set()
+        existing_slugs: set[str] = set()
+        if getattr(model_class._meta, "label_lower", "") == "extras.tag":
+            pending_names = [
+                str((c.postchange_data or {}).get("name") or "") for c in pending
+            ]
+            pending_slugs = [
+                str((c.postchange_data or {}).get("slug") or "") for c in pending
+            ]
+            name_filter = Q(name__in=[n for n in pending_names if n]) | Q(
+                slug__in=[s for s in pending_slugs if s]
+            )
+            for name, slug in model_class.objects.filter(name_filter).values_list(
+                "name", "slug"
+            ):
+                existing_names.add(str(name))
+                existing_slugs.add(str(slug))
         skipped = 0
         objects = []
         built = []  # (collapsed, deserialized) for rows we actually create
@@ -405,6 +431,14 @@ def bulk_merge_changes(
             if collapsed_change.key[1] in existing:
                 skipped += 1
                 continue
+            if existing_names or existing_slugs:
+                data = collapsed_change.postchange_data or {}
+                if (
+                    str(data.get("name") or "") in existing_names
+                    or str(data.get("slug") or "") in existing_slugs
+                ):
+                    skipped += 1
+                    continue
             try:
                 deserialized = _deserialize(
                     model_class, collapsed_change, change_logger

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/utilities/health.py

@@ -136,17 +136,23 @@ def _elevate_optin_pinned_query_drift(query_drift, source_parameters):
         # stale "Org-managed (pinned)" badge on the elevated row.
         item["status_label"] = _QUERY_DRIFT_STATUS_LABELS.get(
             "direct_query_id_optin_stale_risk",
-            "Pinned — may predate an enabled feature",
+            "Pinned — can't verify locally",
         )
         item["severity"] = "warn"
+        # This is a "can't verify locally" heads-up, not a confirmed failure:
+        # the Health page can't read a pinned query's contents, so it warns for
+        # any pinned map with the feature on — including one that's already
+        # current after publishing. Point at the live check, don't claim failure.
         item["message"] = (
-            f"“{label}” is enabled, but this map runs a pinned Forward query ID. "
-            "If that query predates the feature it is silently ignored, so "
-            "nothing new syncs."
+            f"“{label}” is enabled and this map runs a pinned Forward query ID, "
+            "which the Health page can't inspect locally to confirm it includes "
+            "the feature. If those rows aren't importing, the pinned query may "
+            "predate the feature."
         )
         item["remediation"] = (
-            "Publish the bundled queries to your Forward org folder (Overwrite "
-            "on), then use Refresh Query IDs on this Health page, then re-run the "
+            "Use Export Live Query Drift on this page to confirm the pinned "
+            "query matches the current bundled source. If it doesn't, use "
+            "Publish Bundled Queries, then Refresh Query IDs, then re-run the "
             "sync."
         )
         item["remediation_action"] = "refresh_query_ids"

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/utilities/query_binding_resolution.py

@@ -436,7 +436,7 @@ def _committed_query_source(committed_query: dict) -> str:
 # read like an error.
 _QUERY_DRIFT_STATUS_LABELS = {
     "direct_query_id_unverified": "Org-managed (pinned)",
-    "direct_query_id_optin_stale_risk": "Pinned — may predate an enabled feature",
+    "direct_query_id_optin_stale_risk": "Pinned — can't verify locally",
 }
 
 

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/forward_netbox/utilities/query_fetch_execution.py

@@ -392,6 +392,7 @@ class ForwardQueryFetcher:
             tuple(exclude_tags),
             include_match,
             prune_out_of_scope,
+            sync_endpoints,
             branch_run_state.get("ingestion_id"),
             branch_run_state.get("pending_ingestion_id"),
             branch_run_state.get("current_ingestion_id"),
@@ -406,6 +407,7 @@ class ForwardQueryFetcher:
             include_tags=include_tags,
             exclude_tags=exclude_tags,
             include_match=include_match,
+            sync_endpoints=sync_endpoints,
         )
         cached_context = self._load_context_artifact(context_artifact)
         if cached_context is None:
@@ -428,21 +430,30 @@ class ForwardQueryFetcher:
                 scoped_device_names,
                 scoped_site_names,
                 scoped_matched_tags,
+                endpoint_scope_failed,
             ) = self._resolve_scoped_tag_scope(
                 network_id=network_id,
                 snapshot_id=snapshot_id,
                 include_tags=include_tags,
                 exclude_tags=exclude_tags,
                 include_match=include_match,
+                sync_endpoints=sync_endpoints,
             )
-            self._save_context_artifact(
-                context_artifact,
-                snapshot_info=snapshot_info,
-                snapshot_metrics=snapshot_metrics,
-                scoped_device_names=scoped_device_names,
-                scoped_site_names=scoped_site_names,
-                scoped_matched_tags=scoped_matched_tags,
-            )
+            if endpoint_scope_failed:
+                # The scoped set carries no endpoint names, so emitting endpoint
+                # rows would get them dropped locally — and pruned as deletes.
+                # Disable endpoint emission for this run and do NOT persist the
+                # endpoint-less scope under the endpoints-on artifact key.
+                sync_endpoints = False
+            else:
+                self._save_context_artifact(
+                    context_artifact,
+                    snapshot_info=snapshot_info,
+                    snapshot_metrics=snapshot_metrics,
+                    scoped_device_names=scoped_device_names,
+                    scoped_site_names=scoped_site_names,
+                    scoped_matched_tags=scoped_matched_tags,
+                )
         else:
             snapshot_info = dict(cached_context.get("snapshot_info") or {})
             snapshot_metrics = dict(cached_context.get("snapshot_metrics") or {})
@@ -483,13 +494,16 @@ class ForwardQueryFetcher:
         include_tags: list[str],
         exclude_tags: list[str],
         include_match: str,
+        sync_endpoints: bool = False,
     ) -> dict[str, Any] | None:
         run = active_execution_run(self.sync)
         if run is None:
             return None
         artifact_run_id = f"shared-sync-{getattr(self.sync, 'pk', 'unknown')}"
         payload = {
-            "version": 2,
+            # v3: scoped_device_names now varies with the endpoint-import
+            # toggle, so the cache key must too.
+            "version": 3,
             "artifact_scope": "query_context",
             "cache_scope": "shared_sync",
             "sync_id": getattr(self.sync, "pk", None),
@@ -499,6 +513,7 @@ class ForwardQueryFetcher:
             "device_tag_include": sorted(include_tags or []),
             "device_tag_exclude": sorted(exclude_tags or []),
             "device_tag_include_match": include_match or "any",
+            "sync_endpoints": bool(sync_endpoints),
         }
         return {
             "key": fetch_artifact_key(payload),
@@ -575,9 +590,10 @@ class ForwardQueryFetcher:
         include_tags: list[str],
         exclude_tags: list[str],
         include_match: str,
-    ) -> tuple[set[str], set[str], dict[str, list[str]]]:
+        sync_endpoints: bool = False,
+    ) -> tuple[set[str], set[str], dict[str, list[str]], bool]:
         if not include_tags and not exclude_tags:
-            return set(), set(), {}
+            return set(), set(), {}, False
         scope_where = build_device_tag_scope_where(
             include_tags, exclude_tags, include_match
         )
@@ -656,7 +672,77 @@ class ForwardQueryFetcher:
                 exclude_tags=exclude_tags,
                 include_match=include_match,
             )
-        return names, sites, matched_tags_by_device
+        endpoint_scope_failed = False
+        if sync_endpoints:
+            endpoint_names = self._resolve_scoped_endpoint_names(
+                network_id=network_id,
+                snapshot_id=snapshot_id,
+                exclude_tags=exclude_tags,
+            )
+            if endpoint_names is None:
+                endpoint_scope_failed = True
+            else:
+                names |= endpoint_names
+        return names, sites, matched_tags_by_device, endpoint_scope_failed
+
+    def _resolve_scoped_endpoint_names(
+        self,
+        *,
+        network_id: str,
+        snapshot_id: str,
+        exclude_tags: list[str],
+    ) -> set[str] | None:
+        """Names of SNMP endpoints that opt-in endpoint import will emit.
+
+        Device-tag include scope narrows the modeled-device universe; SNMP
+        endpoints (e.g. Avocent console servers) rarely carry those device
+        scoping tags, so requiring them silently excludes every endpoint. When
+        endpoint import is enabled the endpoint names are unioned into the
+        scoped-device set so the local scope filter (and out-of-scope prune)
+        keeps their rows. Exclude tags still apply as the safety valve.
+
+        Returns ``None`` when the probe fails. The caller must then disable
+        endpoint emission for the run entirely (not just proceed with an empty
+        set): the device query would still emit endpoint rows, the local scope
+        filter would drop them, and with prune-out-of-scope enabled the dropped
+        rows would be emitted as DELETES of previously imported endpoints.
+        """
+        where = ["where !isEmpty(endpoint.snmpOutputs)"]
+        for tag in exclude_tags:
+            where.append(f"where !({_nqe_string_literal(tag)} in endpoint.tagNames)")
+        query = "\n".join(
+            [
+                "foreach endpoint in network.endpoints",
+                *where,
+                "select { name: endpoint.name }",
+            ]
+        )
+        try:
+            rows = self.client.run_nqe_query(
+                query=query,
+                network_id=network_id,
+                snapshot_id=snapshot_id,
+                fetch_all=True,
+            )
+        except (ForwardClientError, ForwardConnectivityError, ForwardQueryError) as exc:
+            self.logger.log_warning(
+                "Forward endpoint scope probe failed; SNMP endpoint import is "
+                f"disabled for this run: {_safe_exception_summary(exc)}",
+                obj=self.sync,
+            )
+            return None
+        endpoint_names = {
+            str(row.get("name") or "").strip()
+            for row in rows
+            if str(row.get("name") or "").strip()
+        }
+        if endpoint_names:
+            self.logger.log_info(
+                f"Added {len(endpoint_names)} SNMP endpoint(s) to the device tag "
+                "scope for opt-in endpoint import.",
+                obj=self.sync,
+            )
+        return endpoint_names
 
     def _warn_if_scope_all_backfilled(
         self,

{forward_netbox-2.4.2 → forward_netbox-2.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "forward-netbox"
-version = "2.4.2"
+version = "2.4.4"
 description = "NetBox plugin to sync Forward data into NetBox via built-in NQE queries"
 authors = ["Craig Johnson <craigjohnson@forwardnetworks.com>"]
 license = "MIT"