forward-netbox 3.0.0__tar.gz → 3.0.2__tar.gz

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 3.0.0
+Version: 3.0.2
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -27,12 +27,13 @@ Provides-Extra: integrations
 Provides-Extra: peering
 Provides-Extra: routing
 Provides-Extra: validity
+Requires-Dist: forward-sdk (==0.1.20)
 Requires-Dist: httpx (>0.26,<0.29)
 Requires-Dist: netbox-cisco-aci (==0.4.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "aci" or extra == "integrations")
-Requires-Dist: netbox-dlm (>=0.4.1,<0.10.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "dlm" or extra == "integrations")
-Requires-Dist: netbox-peering-manager (==0.3.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "peering" or extra == "integrations")
-Requires-Dist: netbox-routing (==0.4.3) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "routing" or extra == "integrations")
-Requires-Dist: netbox-validity (==3.5.2) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "validity" or extra == "integrations")
+Requires-Dist: netbox-dlm (>=0.4.1,<0.11.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "dlm" or extra == "integrations")
+Requires-Dist: netbox-peering-manager (==0.3.1) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "peering" or extra == "integrations")
+Requires-Dist: netbox-routing (>=0.5.0,<0.6.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "routing" or extra == "integrations")
+Requires-Dist: netbox-validity (==3.6.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "validity" or extra == "integrations")
 Requires-Dist: netboxlabs-netbox-branching (>=1.2.0,<1.3.0) ; python_version >= "3.12" and python_version < "3.15"
 Requires-Dist: pyzipper (>=0.4.0,<0.5.0)
 Project-URL: Changelog, https://github.com/forwardnetworks/forward-netbox/blob/main/CHANGELOG.md
@@ -108,15 +109,17 @@ See the
 
 ## Release Compatibility
 
-The `3.0.0` release candidate requires NetBox `4.7.x` (tested on `4.7.0`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
+The `3.0.2` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
-| `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
+| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
+| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
+| `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.1`; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
+| `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v3.0.0`; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
 | `v2.9.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.2`; Accepts netbox-branching 1.1.3 and records the validated runtime in the lockfile. |
 | `v2.9.0` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.1`; Feature: back up device configurations from Forward into a git data source for Validity golden-config checks, plus the runtime-validation refactor and health check it required. |
 | `v2.8.9` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.0`; Fix: a sync deletes a device only on the same quarantined evidence the operator prune requires, and never stages a delete the database will refuse. |

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/README.md

@@ -64,15 +64,17 @@ See the
 
 ## Release Compatibility
 
-The `3.0.0` release candidate requires NetBox `4.7.x` (tested on `4.7.0`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
+The `3.0.2` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
-| `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Current release; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
+| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
+| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
+| `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.1`; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
+| `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v3.0.0`; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
 | `v2.9.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.2`; Accepts netbox-branching 1.1.3 and records the validated runtime in the lockfile. |
 | `v2.9.0` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.1`; Feature: back up device configurations from Forward into a git data source for Validity golden-config checks, plus the runtime-validation refactor and health check it required. |
 | `v2.8.9` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.0`; Fix: a sync deletes a device only on the same quarantined evidence the operator prune requires, and never stages a delete the database will refuse. |

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/__init__.py

@@ -5,7 +5,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "3.0.0"
+    version = "3.0.2"
     base_url = "forward"
     min_version = "4.7.0"
     max_version = "4.7.99"

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/api/serializers.py

@@ -378,6 +378,13 @@ class ForwardIngestionIssueSerializer(OrganizationalModelSerializer):
     ingestion = ForwardIngestionSerializer(nested=True)
 
     def to_representation(self, instance):
+        # Tier 1, deliberately: this is an authenticated in-deployment read,
+        # the same trust level as the GUI, so `raw_data` keeps its
+        # `operator_detail` values here. The redaction applies to FILES - a
+        # support bundle is exported to be sent to us, and
+        # `export_redaction.export_safe_payload` drops that key on every
+        # download path. Do not "fix" this by filtering here; the operator
+        # troubleshooting their own estate is the reason the values exist.
         data = super().to_representation(instance)
         data["coalesce_fields"] = json_safe_value(data.get("coalesce_fields"))
         data["defaults"] = json_safe_value(data.get("defaults"))

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/api/views.py

@@ -40,8 +40,15 @@ from forward_netbox.models import ForwardNQEMap
 from forward_netbox.models import ForwardSource
 from forward_netbox.models import ForwardSync
 from forward_netbox.models import ForwardValidationRun
+from forward_netbox.utilities.forward_api import get_committed_nqe_query
+from forward_netbox.utilities.forward_api import get_latest_processed_snapshot
+from forward_netbox.utilities.forward_api import get_networks
+from forward_netbox.utilities.forward_api import get_nqe_query_history
+from forward_netbox.utilities.forward_api import get_nqe_repository_query_index
+from forward_netbox.utilities.forward_api import get_snapshots
 from forward_netbox.utilities.forward_api import LATEST_COLLECTED_SNAPSHOT
 from forward_netbox.utilities.forward_api import LATEST_PROCESSED_SNAPSHOT
+from forward_netbox.utilities.forward_api import run_nqe_query
 from forward_netbox.utilities.query_binding import builtin_filename_to_query_default
 from forward_netbox.utilities.query_binding import query_filename_from_path
 
@@ -139,7 +146,7 @@ class ForwardSourceViewSet(NetBoxModelViewSet):
         results = []
         if source is not None:
             try:
-                for network in source.get_client().get_networks():
+                for network in get_networks(source.get_client()):
                     if (
                         q
                         and q not in network["label"].lower()
@@ -245,7 +252,7 @@ class ForwardSourceViewSet(NetBoxModelViewSet):
         tag_set = set()
         try:
             client = source.get_client()
-            snapshot = client.get_latest_processed_snapshot(network_id)
+            snapshot = get_latest_processed_snapshot(client, network_id)
             snapshot_id = str(snapshot.get("id") or "").strip()
             if not snapshot_id:
                 return Response(
@@ -259,7 +266,8 @@ class ForwardSourceViewSet(NetBoxModelViewSet):
                     }
                 )
 
-            rows = client.run_nqe_query(
+            rows = run_nqe_query(
+                client,
                 query=(
                     "foreach device in network.devices\n"
                     "where device.snapshotInfo.result == DeviceSnapshotResult.completed\n"
@@ -336,7 +344,8 @@ class ForwardNQEMapViewSet(NetBoxModelViewSet):
             )
 
         try:
-            query_index = source.get_client().get_nqe_repository_query_index(
+            query_index = get_nqe_repository_query_index(
+                source.get_client(),
                 repository=repository,
                 directory="/",
             )
@@ -392,7 +401,8 @@ class ForwardNQEMapViewSet(NetBoxModelViewSet):
 
         results = []
         try:
-            query_index = source.get_client().get_nqe_repository_query_index(
+            query_index = get_nqe_repository_query_index(
+                source.get_client(),
                 repository=repository,
                 directory=directory,
             )
@@ -472,7 +482,8 @@ class ForwardNQEMapViewSet(NetBoxModelViewSet):
             client = source.get_client()
             if query_path and not query_id:
                 try:
-                    query_index = client.get_nqe_repository_query_index(
+                    query_index = get_nqe_repository_query_index(
+                        client,
                         repository=repository,
                         directory="/",
                     )
@@ -482,14 +493,15 @@ class ForwardNQEMapViewSet(NetBoxModelViewSet):
                 if indexed_query and indexed_query.get("queryId"):
                     query_id = str(indexed_query.get("queryId") or "").strip()
                 else:
-                    committed_query = client.get_committed_nqe_query(
+                    committed_query = get_committed_nqe_query(
+                        client,
                         repository=repository,
                         query_path=query_path,
                         commit_id="head",
                         query_index=query_index,
                     )
                     query_id = str(committed_query.get("queryId") or "").strip()
-            commits = client.get_nqe_query_history(query_id)
+            commits = get_nqe_query_history(client, query_id)
         except Exception:
             return Response(
                 {
@@ -592,7 +604,7 @@ class ForwardSyncViewSet(NetBoxModelViewSet):
             return Response({"count": len(results), "results": results})
 
         try:
-            for snapshot in source.get_client().get_snapshots(network_id):
+            for snapshot in get_snapshots(source.get_client(), network_id):
                 display = snapshot["label"]
                 if q and q not in display.lower() and q not in snapshot["id"].lower():
                     continue
@@ -928,6 +940,283 @@ class ForwardSyncViewSet(NetBoxModelViewSet):
     def tag_delete_eligible_ipam(self, request, pk):
         return self._enqueue_button_job_response(request, "tag_delete_eligible_ipam")
 
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description='{"status": "already_running", "job_id": N}'
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="recover-stuck-sync")
+    def recover_stuck_sync(self, request, pk):
+        return self._enqueue_button_job_response(request, "recover_stuck_sync")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description=(
+                    '{"status": "already_running"|"blocked_by_sync_run", '
+                    '"job_id": N}'
+                )
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="prune-uncovered")
+    def prune_uncovered(self, request, pk):
+        return self._enqueue_button_job_response(request, "prune_uncovered")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description=(
+                    '{"status": "already_running"|"blocked_by_sync_run", '
+                    '"job_id": N}'
+                )
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="prune-out-of-scope-catalogue")
+    def prune_out_of_scope_catalogue(self, request, pk):
+        return self._enqueue_button_job_response(
+            request, "prune_out_of_scope_catalogue"
+        )
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description=(
+                    '{"status": "already_running"|"blocked_by_sync_run", '
+                    '"job_id": N}'
+                )
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="merge-site-relabel-duplicates")
+    def merge_site_relabel_duplicates(self, request, pk):
+        return self._enqueue_button_job_response(
+            request, "merge_site_relabel_duplicates"
+        )
+
+    @extend_schema(
+        methods=["post"],
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description=(
+                    '{"status": "already_running"|"blocked_by_sync_run", '
+                    '"job_id": N}'
+                )
+            ),
+            400: OpenApiResponse(
+                description="missing or malformed `device`/`expected_blockers`"
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="release-foreign-delete-blockers")
+    def release_foreign_delete_blockers(self, request, pk):
+        """Release exactly the netbox_routing rows named as delete blockers.
+
+        Unlike every other button action here, this one has no whole-set
+        meaning - there is no device to act on without one being named - so
+        it validates its own body rather than going through
+        `_enqueue_button_job_response`, which assumes an empty POST is a
+        complete request.
+        """
+        from ..utilities.sync_facade import button_job_permission
+        from ..utilities.sync_facade import enqueue_button_job
+        from ..utilities.sync_facade import JobAlreadyActive
+        from ..utilities.sync_facade import JobBlockedBySyncRun
+
+        permission = button_job_permission("release_foreign_delete_blockers")
+        if not request.user.has_perm(permission):
+            raise PermissionDenied(
+                f"This user does not have the `{permission}` permission."
+            )
+        data = request.data if isinstance(request.data, dict) else {}
+        try:
+            device_pk = int(data.get("device") or "")
+        except (TypeError, ValueError):
+            return Response(
+                {"detail": "A `device` id is required."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+        expected_blockers = data.get("expected_blockers")
+        if (
+            not isinstance(expected_blockers, dict)
+            or not expected_blockers
+            or not all(
+                isinstance(label, str) and isinstance(count, int)
+                for label, count in expected_blockers.items()
+            )
+        ):
+            return Response(
+                {
+                    "detail": (
+                        "`expected_blockers` must name at least one blocking "
+                        "row as {label: count}."
+                    )
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+        sync = self.get_object()
+        try:
+            job = enqueue_button_job(
+                sync,
+                "release_foreign_delete_blockers",
+                request.user,
+                job_kwargs={
+                    "device_pk": device_pk,
+                    "expected_blockers": expected_blockers,
+                },
+            )
+        except JobBlockedBySyncRun as exc:
+            return Response(
+                {
+                    "status": "blocked_by_sync_run",
+                    "job_id": exc.job.pk,
+                    "detail": (
+                        "This operation is blocked while a Forward sync job "
+                        "is active."
+                    ),
+                },
+                status=status.HTTP_202_ACCEPTED,
+            )
+        except JobAlreadyActive as exc:
+            return Response(
+                {
+                    "status": "already_running",
+                    "job_id": exc.job.pk,
+                    "detail": "An equivalent job is already queued or running.",
+                },
+                status=status.HTTP_202_ACCEPTED,
+            )
+        return Response(
+            JobSerializer(job, context={"request": request}).data, status=201
+        )
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description=(
+                    '{"status": "already_running"|"blocked_by_sync_run", '
+                    '"job_id": N}'
+                )
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="config-backup")
+    def config_backup(self, request, pk):
+        return self._enqueue_button_job_response(request, "config_backup")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(
+                description='{"status": "already_running", "job_id": N}'
+            ),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="prune-stale-hardware-notices")
+    def prune_stale_hardware_notices(self, request, pk):
+        return self._enqueue_button_job_response(
+            request, "prune_stale_hardware_notices"
+        )
+
+    # Read-only audits that talk to Forward; the report pages render the
+    # latest job. Same overlap guard and permission check as every button.
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/primary-ip")
+    def audit_primary_ip(self, request, pk):
+        return self._enqueue_button_job_response(request, "audit_primary_ip")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/global-ipam")
+    def audit_global_ipam(self, request, pk):
+        return self._enqueue_button_job_response(request, "audit_global_ipam")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/stale-hardware-notices")
+    def audit_stale_hardware_notices(self, request, pk):
+        return self._enqueue_button_job_response(
+            request, "audit_stale_hardware_notices"
+        )
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/apply-identity")
+    def audit_apply_identity(self, request, pk):
+        return self._enqueue_button_job_response(request, "audit_apply_identity")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/apic-cimc-readiness")
+    def audit_apic_cimc_readiness(self, request, pk):
+        return self._enqueue_button_job_response(request, "audit_apic_cimc_readiness")
+
+    @extend_schema(
+        methods=["post"],
+        request=EmptySerializer(),
+        responses={
+            201: JobSerializer(),
+            202: OpenApiResponse(description="already running"),
+        },
+    )
+    @action(detail=True, methods=["post"], url_path="audits/fast-baseline-preflight")
+    def audit_fast_baseline_preflight(self, request, pk):
+        return self._enqueue_button_job_response(
+            request, "audit_fast_baseline_preflight"
+        )
+
 
 class ForwardIngestionViewSet(NetBoxReadOnlyModelViewSet):
     queryset = ForwardIngestion.objects.all()

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/change_control/criteria.py

@@ -6,6 +6,7 @@
 # would silently compare two different questions.
 from dataclasses import dataclass
 
+from ..utilities.forward_api import resolve_nqe_query_reference
 from ..utilities.query_execution_contract import query_source_sha256
 from .choices import ForwardCriterionExpectationChoices as Expectation
 
@@ -31,7 +32,8 @@ def bind_criterion(criterion, client) -> BindResult:
     if not criterion.query_path:
         return BindResult(False, error="The criterion has no query path to bind.")
     try:
-        resolved = client.resolve_nqe_query_reference(
+        resolved = resolve_nqe_query_reference(
+            client,
             repository="org",
             query_path=criterion.query_path,
             commit_id=criterion.commit_id or None,

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/choices.py

@@ -10,6 +10,10 @@ FORWARD_BGP_MODELS = (
     "netbox_routing.ospfinstance",
     "netbox_routing.ospfarea",
     "netbox_routing.ospfinterface",
+    "netbox_routing.prefixlistentry",
+    "netbox_routing.communitylistentry",
+    "netbox_routing.routemapentry",
+    "netbox_routing.staticroute",
     "netbox_peering_manager.peeringsession",
 )
 
@@ -33,6 +37,13 @@ FORWARD_ACI_MODELS = (
     "netbox_cisco_aci.acibridgedomain",
     "netbox_cisco_aci.acifilter",
     "netbox_cisco_aci.acil3out",
+    "netbox_cisco_aci.aciappprofile",
+    "netbox_cisco_aci.aciendpointgroup",
+    "netbox_cisco_aci.acicontract",
+    "netbox_cisco_aci.acisubject",
+    "netbox_cisco_aci.acifilterentry",
+    "netbox_cisco_aci.acisubjectfilter",
+    "netbox_cisco_aci.acistaticportbinding",
 )
 
 FORWARD_SUPPORTED_MODELS = (

{forward_netbox-3.0.0 → forward_netbox-3.0.2}/forward_netbox/filtersets.py

@@ -162,11 +162,45 @@ class ForwardIngestionIssueFilterSet(BaseFilterSet):
         choices=ForwardIngestionPhaseChoices,
         null_value=None,
     )
+    # "Which of these actually stops the baseline" was answerable only by
+    # running a command against the ingestion. Same predicate as readiness.
+    blocking = django_filters.BooleanFilter(
+        method="filter_blocking",
+        label="Blocks baseline readiness",
+    )
 
     class Meta:
         model = ForwardIngestionIssue
         fields = ("phase", "model", "timestamp", "exception", "message")
 
+    def filter_blocking(self, queryset, name, value):
+        from django.db.models import Q
+
+        from .utilities.ingestion_issues import blocking_issue_q
+
+        if value is None:
+            return queryset
+        # Matches the column, in both its exclusions. A row whose ingestion
+        # promoted blocked nothing; and a row the merge recorded as skipped
+        # blocked nothing either, because no retry can satisfy it - that is
+        # true whether or not the run went on to promote. Filtering to rows
+        # the column calls Blocking and getting back rows it calls Skipped or
+        # Promoted over is the same disagreement in the other direction.
+        #
+        # Rows written before 2.9.5 carry no `disposition` key, and they must
+        # keep their old behaviour with no migration. `~Q(disposition=...)`
+        # alone does NOT do that: a missing JSONB key reads as NULL, `NOT NULL`
+        # is NULL rather than true, and every legacy row would be dropped from
+        # the Blocking filter it used to match. The key's absence has to be
+        # tested explicitly.
+        not_skipped = ~Q(raw_data__has_key="disposition") | ~Q(
+            raw_data__disposition="skipped"
+        )
+        predicate = (
+            blocking_issue_q() & Q(ingestion__baseline_ready=False) & not_skipped
+        )
+        return queryset.filter(predicate if value else ~predicate)
+
     def search(self, queryset, name, value):
         if not value.strip():
             return queryset