forward-netbox 3.0.2__tar.gz → 3.0.3__tar.gz

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 3.0.2
+Version: 3.0.3
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -36,6 +36,7 @@ Requires-Dist: netbox-routing (>=0.5.0,<0.6.0) ; (python_version >= "3.12" and p
 Requires-Dist: netbox-validity (==3.6.0) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "validity" or extra == "integrations")
 Requires-Dist: netboxlabs-netbox-branching (>=1.2.0,<1.3.0) ; python_version >= "3.12" and python_version < "3.15"
 Requires-Dist: pyzipper (>=0.4.0,<0.5.0)
+Requires-Dist: scrapli (>=2022.7.30,<2026.10) ; (python_version >= "3.12" and python_version < "3.15") and (extra == "validity" or extra == "integrations")
 Project-URL: Changelog, https://github.com/forwardnetworks/forward-netbox/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://github.com/forwardnetworks/forward-netbox/tree/main/docs
 Project-URL: Homepage, https://github.com/forwardnetworks/forward-netbox
@@ -109,15 +110,16 @@ See the
 
 ## Release Compatibility
 
-The `3.0.2` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
+The `3.0.3` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
-| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
+| `v3.0.3` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Static routes in the global table import; site-relabel repair releases BGP address families; primary IP falls back to the management address when a tag cannot resolve; interfaces holding a VLAN from a previous site are cleared instead of refused on every sync; scrapli capped so NetBox starts with netbox-validity; OSPF instances named per VRF for netbox-routing 0.5.0; support bundle gains dependency versions, scope-report age, site mismatch, a primary-IP split and mask breakdown, and per-rule issue counts; tested on NetBox 4.7.2 and netbox-branching 1.2.1 |
+| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
+| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.2`; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
 | `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.1`; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
 | `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v3.0.0`; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
 | `v2.9.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.2`; Accepts netbox-branching 1.1.3 and records the validated runtime in the lockfile. |

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/README.md

@@ -64,15 +64,16 @@ See the
 
 ## Release Compatibility
 
-The `3.0.2` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
+The `3.0.3` release candidate requires NetBox `4.7.x` (tested on `4.7.1`) and `netbox-branching` `1.2.x` (tested on `1.2.0`). Expand for the published release history and candidate notes.
 
 <details>
 <summary>Release compatibility history</summary>
 
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
-| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
+| `v3.0.3` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Release candidate; Static routes in the global table import; site-relabel repair releases BGP address families; primary IP falls back to the management address when a tag cannot resolve; interfaces holding a VLAN from a previous site are cleared instead of refused on every sync; scrapli capped so NetBox starts with netbox-validity; OSPF instances named per VRF for netbox-routing 0.5.0; support bundle gains dependency versions, scope-report age, site mismatch, a primary-IP split and mask breakdown, and per-rule issue counts; tested on NetBox 4.7.2 and netbox-branching 1.2.1 |
+| `v3.0.2` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Current release; Port of 2.9.13's PeeringSession crash + endpoint /32 fixes, plus the 3.0.1 upgrade-runtime override fix |
+| `v3.0.1` | NetBox `4.7.x` supported, tested on `4.7.1`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.2`; Release candidate; Fix: every fix shipped on the 2.9.x line as 2.9.7 through 2.9.11 now ships on NetBox 4.7 - the 3.x line had none of them. Fix: renaming a device's site in Forward moves the existing device instead of creating a duplicate, devices are matched case-insensitively the way NetBox identifies them, and the new Scope Reconciliation action Merge site-relabel duplicates repairs pairs already created (keeps the older device at the site Forward reports; held pairs are listed with a reason and never pruned). Fix: scope membership is by name, so no in-scope device is called out of scope. Feature: duplicates and other silent problems are no longer silent - a Health check, a sync-page banner, a Scope Reconciliation card and a job-log line. Fix: config backup reaches the repository through the proxy NetBox uses, no longer writes credentials to the worker log, fails when the remote refuses the branch, and names the cause of a failure in the job, Health and the support bundle. Fix: the fast baseline, COPY/SQL and set-based merge run on any subset of the validated plugins. Fix: routing-policy scope counts every device that holds a definition, pending removals are what the next sync removes, and Scope Reconciliation offers Remove out-of-scope routing policy (an allowlisted, gated operator action). Fix: the SDK repository lookup read attributes the forward-sdk RepositoryQuery does not have, so committed-query lookups by path failed against a real Forward; forward-sdk is now 0.1.20. Fix: protection against deleting a sync or ingestion while a job runs, and support bundles and log exports no longer carry operator values such as include-tag names. Feature: the support bundle carries a diagnostics section, and a live query-drift check flags a published query whose parameter list no longer matches this release. Feature: Auto merge stops for review when a run is far larger than the sync has been - only with Auto merge on, only after the sync has finished a run before, and only for a model that stages at least 10,000 changes at 3x the table's size (or 10x the typical earlier run); a held run stays staged, with the ingestion's Merge and Delete actions as Merge anyway and Discard. Feature: Health and the support bundle show Forward's row count next to NetBox's per model, the last three ingestions with job and merge status, statistics and merged changes by model and action, and a BGP peer duplicate count, and flag an abnormal run, a baseline that never completed and a NetBox table far smaller than Forward's. Feature: the config backup folder is configurable (nested folders allowed), Health shows the Validity device_config_path for it, and the last backup reports rows, written, unchanged, unmapped, managed devices with no collected configuration and files in the folder. Fix: the Include unmanaged configuration checkbox never persisted from the source form. Migrations 0053 through 0057 and 0060 adopt the 2.9.x schema history. Org-backed deployments: run Publish Bundled Queries after upgrading, because the interface and IPv4 address queries changed their parameter lists (a stale published copy fails every execution against it until republished) and the three routing-policy queries gained an output column. |
 | `v3.0.0` | NetBox `4.7.x` supported, tested on `4.7.0`; needs netbox-branching `1.2.x`, tested on `1.2.0` | Superseded by `v3.0.1`; NetBox 4.7 with netbox-branching 1.2, and change control gated on what Forward saw before and after the change. |
 | `v2.9.2` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v3.0.0`; Drift is measured exactly for every fetched model, the uncovered-device count says why it grows and warns when it does, and five delete and diagnostic defects are closed. |
 | `v2.9.1` | `4.6.x` (>= `4.6.5`) supported, tested on `4.6.8`; needs netbox-branching `1.1.x`, tested on `1.1.2` | Superseded by `v2.9.2`; Accepts netbox-branching 1.1.3 and records the validated runtime in the lockfile. |

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/__init__.py

@@ -5,7 +5,7 @@ class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
     verbose_name = "Forward"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "3.0.2"
+    version = "3.0.3"
     base_url = "forward"
     min_version = "4.7.0"
     max_version = "4.7.99"

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/templates/forward_netbox/forwardsync_scope_reconciliation.html

@@ -489,7 +489,11 @@
           </p>
           <ul class="mb-0">
             {% for entry in site_relabel_pairs.held_by_reason %}
-              <li><strong>{{ entry.count }}</strong> - {{ entry.remedy|default:entry.reason }}</li>
+              <li><strong>{{ entry.count }}</strong> - {{ entry.remedy|default:entry.reason }}
+                {% if entry.names %}
+                  <div class="text-muted small">{{ entry.names|join:", " }}{% if entry.more_names %}, +{{ entry.more_names }} {% trans "more" %}{% endif %}</div>
+                {% endif %}
+              </li>
             {% endfor %}
           </ul>
         {% endif %}

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_bulk_merge.py

@@ -4516,8 +4516,19 @@ class Phase4BulkStageTest(CleanTransactionTestCase):
             request_id=merge_request_id,
         )
         # The member is audited as CREATE plus the internal deferred-LAG UPDATE;
-        # the two audit rows still count as one logical branch change.
-        self.assertEqual(audits.count(), 4)
+        # the two audit rows still count as one logical branch change. Deleting
+        # the cable also clears the parent's cached cable fields (`cable`,
+        # `_path`, `cable_end`), which netbox-branching 1.2.1 records as its own
+        # UPDATE: five rows, still all attributed to the invoking user.
+        self.assertEqual(audits.count(), 5)
+        self.assertEqual(
+            audits.filter(
+                changed_object_type=interface_type,
+                changed_object_id=main_parent.pk,
+                action="update",
+            ).count(),
+            2,
+        )
         self.assertEqual(
             set(audits.values_list("user_id", flat=True)), {invoking_user.pk}
         )
@@ -4530,7 +4541,7 @@ class Phase4BulkStageTest(CleanTransactionTestCase):
         )
         self.assertEqual(
             branch.get_merged_changes().filter(pk__in=audits).count(),
-            4,
+            5,
         )
         self.assertEqual(
             list(

forward_netbox-3.0.3/forward_netbox/tests/test_bundle_triage_diagnostics.py

@@ -0,0 +1,173 @@
+# The support bundle answers the questions a customer report actually asks.
+#
+# A customer's report this cycle could not be matched to its bundle: a three-day-old
+# scope report sat beside a same-day sync, the primary-IP count had no split to
+# reconcile against the device list, 147 issues had to be tallied by hand to find
+# that 130 were one rule, and a dependency release that stopped NetBox starting left
+# no version in the file. These pin the figures that close each gap, and that the
+# export still carries counts rather than names.
+import json
+
+from dcim.models import Device
+from dcim.models import DeviceRole
+from dcim.models import DeviceType
+from dcim.models import Manufacturer
+from dcim.models import Site
+from django.test import TestCase
+from extras.models import Tag
+
+from forward_netbox.models import ForwardDeviceIdentity
+from forward_netbox.models import ForwardIngestion
+from forward_netbox.models import ForwardIngestionIssue
+from forward_netbox.models import ForwardSource
+from forward_netbox.models import ForwardSync
+from forward_netbox.utilities.bundle_diagnostics import bundle_diagnostics
+from forward_netbox.utilities.export_redaction import export_safe_payload
+from forward_netbox.views import _environment_bundle_payload
+from forward_netbox.views import _ingestion_issue_bundle_payload
+from forward_netbox.views import _primary_ip_bundle_payload
+from forward_netbox.views import _scope_reconciliation_bundle_payload
+
+
+class BundleTriageDiagnosticsTest(TestCase):
+    def setUp(self):
+        self.site = Site.objects.create(name="Secret Street Site", slug="secret")
+        mfr = Manufacturer.objects.create(name="Cisco", slug="cisco")
+        self.device_type = DeviceType.objects.create(
+            manufacturer=mfr, model="M1", slug="m1"
+        )
+        self.role = DeviceRole.objects.create(name="firewall", slug="firewall")
+        source = ForwardSource.objects.create(
+            name="src", url="https://fwd.example.invalid"
+        )
+        self.sync = ForwardSync.objects.create(name="sync", source=source)
+
+    def _device(self, name, *, managed=True, tag=None):
+        device = Device.objects.create(
+            name=name,
+            site=self.site,
+            device_type=self.device_type,
+            role=self.role,
+            status="active",
+        )
+        if managed:
+            ForwardDeviceIdentity.objects.create(
+                sync=self.sync, device=device, source_device_key=name
+            )
+        if tag:
+            device.tags.add(Tag.objects.get_or_create(name=tag, slug=tag.lower())[0])
+        return device
+
+    def test_the_primary_ip_count_is_split_so_it_can_be_reconciled(self):
+        self._device("fw-uncovered", tag="forward-uncovered")
+        self._device("fw-mgmt", tag="Mgmt_Vl211")
+        self._device("fw-plain")
+        self._device("unmanaged", managed=False)
+
+        payload = _primary_ip_bundle_payload(self.sync)
+
+        self.assertEqual(payload["sync_devices"], 3)
+        self.assertEqual(payload["without_primary_ip"], 3)
+        split = payload["without_primary_ip_split"]
+        self.assertEqual(split["tagged_uncovered"], 1)
+        self.assertEqual(split["with_a_mgmt_tag"], 1)
+        self.assertEqual(split["with_no_ip_at_all"], 3)
+        self.assertEqual(split["with_an_interface_ip"], 0)
+        # The figure on the device list covers devices this sync does not own.
+        self.assertEqual(payload["netbox_devices_without_primary_ip"], 4)
+
+    def test_primary_addresses_are_counted_by_mask_and_host_masks_by_role(self):
+        from ipam.models import IPAddress
+
+        loopback = self._device("fw-loopback")
+        subnet = self._device("fw-subnet")
+        for device, address in ((loopback, "10.0.0.1/32"), (subnet, "10.0.1.1/24")):
+            ip = IPAddress.objects.create(address=address)
+            Device.objects.filter(pk=device.pk).update(primary_ip4=ip)
+
+        masks = _primary_ip_bundle_payload(self.sync)["primary_ip4_prefix_lengths"]
+
+        self.assertEqual(
+            {row["prefix_length"]: row["devices"] for row in masks["by_prefix_length"]},
+            {32: 1, 24: 1},
+        )
+        self.assertEqual(
+            masks["host_mask_by_role"], [{"role": "firewall", "devices": 1}]
+        )
+
+    def test_issues_are_tallied_by_model_exception_and_rule_over_every_row(self):
+        ingestion = ForwardIngestion.objects.create(sync=self.sync)
+        for _ in range(3):
+            ForwardIngestionIssue.objects.create(
+                ingestion=ingestion,
+                model="dcim.interface",
+                exception="ValidationError",
+                message="Merge failed",
+                raw_data={"validation_rules": ["untagged-vlan-outside-device-site"]},
+            )
+        ForwardIngestionIssue.objects.create(
+            ingestion=ingestion,
+            model="dcim.site",
+            exception="ForwardDependencySkipError",
+            message="skipped",
+            raw_data={},
+        )
+
+        summary = _ingestion_issue_bundle_payload(ingestion)["summary"]
+
+        self.assertEqual(summary["counted"], 4)
+        self.assertEqual(
+            summary["by_model_and_exception"][0],
+            {"model": "dcim.interface", "exception": "ValidationError", "count": 3},
+        )
+        self.assertEqual(
+            summary["by_validation_rule"],
+            [
+                {
+                    "model": "dcim.interface",
+                    "rule": "untagged-vlan-outside-device-site",
+                    "count": 3,
+                }
+            ],
+        )
+
+    def test_the_environment_names_the_dependency_versions(self):
+        deps = _environment_bundle_payload()["dependency_versions"]
+
+        for name in ("scrapli", "scrapli-netconf", "forward-sdk", "django"):
+            self.assertIn(name, deps)
+        # A package that is not installed reads None, never an error.
+        self.assertTrue(all(v is None or isinstance(v, str) for v in deps.values()))
+        self.assertTrue(deps["django"])
+
+    def test_a_missing_scope_report_has_no_age_rather_than_a_wrong_one(self):
+        payload = _scope_reconciliation_bundle_payload(self.sync)
+
+        self.assertIsNone(payload["generated_at"])
+        self.assertIsNone(payload["age_hours"])
+        self.assertIsNone(payload["older_than_last_sync"])
+
+    def test_routing_name_collisions_reports_whether_the_plugin_is_there(self):
+        out = bundle_diagnostics(self.sync)
+
+        self.assertEqual(out["errors"], {})
+        collisions = out["routing_name_collisions"]
+        self.assertIn("installed", collisions)
+        if collisions["installed"]:
+            self.assertEqual(collisions["duplicate_name_groups"], 0)
+
+    def test_the_new_figures_export_without_names(self):
+        self._device("customer-firewall-01", tag="forward-uncovered")
+        text = json.dumps(
+            export_safe_payload(
+                {
+                    "primary_ip": _primary_ip_bundle_payload(self.sync),
+                    "diagnostics": bundle_diagnostics(self.sync),
+                    "environment": _environment_bundle_payload(),
+                }
+            ),
+            default=str,
+        )
+
+        self.assertNotIn("customer-firewall-01", text)
+        self.assertNotIn("Secret Street", text)

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_merge_rule_rejection.py

@@ -398,6 +398,18 @@ class FieldScopedValidationRuleTests(SimpleTestCase):
             ["untagged-vlan-outside-device-site"], diagnosis["validation_rules"]
         )
 
+    def test_an_ospf_name_collision_is_named(self):
+        # netbox-routing 0.5.0 unique (device, name): reported on a customer sync
+        # as an unrecognised rule until this slug existed.
+        diagnosis = structured_failure_diagnosis(
+            ValidationError(
+                "Name must be unique per device Only a single empty name is "
+                "permitted per device"
+            )
+        )
+        self.assertEqual(["name-not-unique-per-device"], diagnosis["validation_rules"])
+        self.assertNotIn("unrecognized_validation_rules", diagnosis)
+
     def test_untagged_vlan_without_mode_is_named(self):
         diagnosis = structured_failure_diagnosis(self.UNTAGGED_VLAN_MODE)
         self.assertEqual(

forward_netbox-3.0.3/forward_netbox/tests/test_null_vrf_identity.py

@@ -0,0 +1,119 @@
+from unittest import TestCase
+
+from forward_netbox.exceptions import ForwardQueryError
+from forward_netbox.utilities.sync_contracts import MODEL_SYNC_CONTRACTS
+from forward_netbox.utilities.sync_contracts import row_coalesce_field_is_complete
+from forward_netbox.utilities.sync_contracts import validate_row_shape_for_model
+
+# Models whose bundled query emits a null `vrf` for the global routing table
+# (`vrf: ... else null`) or for a route outside any VRF. Their default coalesce
+# set names `vrf`, so a null `vrf` must still identify the row: a global route
+# is a real, ordinary row, not an incomplete one.
+GLOBAL_TABLE_MODELS = (
+    "netbox_routing.staticroute",
+    "netbox_routing.bgppeer",
+    "netbox_routing.bgpaddressfamily",
+    "netbox_routing.bgppeeraddressfamily",
+    "netbox_routing.ospfinstance",
+    "netbox_peering_manager.peeringsession",
+)
+
+
+def _identity_row(model_string):
+    contract = MODEL_SYNC_CONTRACTS[model_string]
+    row = {field: "x" for field in contract.required_fields}
+    for field_set in contract.default_coalesce_fields:
+        for field in field_set:
+            row[field] = "x"
+    row["vrf"] = None
+    return row
+
+
+class NullVrfIdentityTest(TestCase):
+    def test_a_global_row_satisfies_the_default_coalesce_set(self):
+        for model_string in GLOBAL_TABLE_MODELS:
+            with self.subTest(model=model_string):
+                contract = MODEL_SYNC_CONTRACTS[model_string]
+                sets = [list(s) for s in contract.default_coalesce_fields]
+                try:
+                    validate_row_shape_for_model(
+                        model_string, _identity_row(model_string), sets
+                    )
+                except ForwardQueryError as exc:
+                    self.fail(f"{model_string} rejects a global-table row: {exc}")
+
+    def test_the_static_route_row_shape_the_bundled_query_emits_is_accepted(self):
+        validate_row_shape_for_model(
+            "netbox_routing.staticroute",
+            {
+                "device": "sw-a",
+                "os": "OS.NXOS",
+                "vrf": None,
+                "family": "ip",
+                "args": "0.0.0.0/0 10.0.0.1",
+            },
+            [["device", "vrf", "family", "args"]],
+        )
+
+    def test_a_missing_vrf_key_is_still_rejected(self):
+        row = _identity_row("netbox_routing.staticroute")
+        del row["vrf"]
+        with self.assertRaises(ForwardQueryError):
+            validate_row_shape_for_model(
+                "netbox_routing.staticroute",
+                row,
+                [["device", "vrf", "family", "args"]],
+            )
+
+    def test_other_identity_fields_stay_required(self):
+        for field in ("device", "family", "args"):
+            with self.subTest(field=field):
+                row = _identity_row("netbox_routing.staticroute")
+                row[field] = None
+                with self.assertRaises(ForwardQueryError):
+                    validate_row_shape_for_model(
+                        "netbox_routing.staticroute",
+                        row,
+                        [["device", "vrf", "family", "args"]],
+                    )
+
+    def test_a_null_vrf_is_complete_only_for_models_that_have_a_global_table(self):
+        self.assertFalse(
+            row_coalesce_field_is_complete("dcim.device", {"vrf": None}, "vrf")
+        )
+        self.assertTrue(
+            row_coalesce_field_is_complete(
+                "netbox_routing.staticroute", {"vrf": None}, "vrf"
+            )
+        )
+
+
+class RowShapeFailureIsNamedTest(TestCase):
+    def test_a_row_shape_refusal_is_named_not_unrecognized(self):
+        from forward_netbox.utilities.diagnostics import failure_reason
+
+        identity = ForwardQueryError(
+            "Row for `netbox_routing.staticroute` does not satisfy any configured "
+            "coalesce field set."
+        )
+        required = ForwardQueryError(
+            "Row for `netbox_routing.staticroute` is missing required fields: args."
+        )
+        self.assertEqual(failure_reason(identity), "row-identity-incomplete")
+        self.assertIn("shape-error", failure_reason(required))
+
+
+class RoutingAdapterReadinessTest(TestCase):
+    def test_every_routing_model_reports_its_adapters_present(self):
+        from forward_netbox.utilities.plugin_integrations.registry import (
+            integration_adapter_contract_summary,
+        )
+
+        summary = integration_adapter_contract_summary()
+        routing = next(
+            value for key, value in summary.items() if key.startswith("routing")
+        )
+        self.assertEqual(routing["gaps"], [], routing["gaps"])
+        models = {entry["model"] for entry in routing["models"]}
+        self.assertIn("netbox_routing.staticroute", models)
+        self.assertIn("netbox_routing.routemapentry", models)

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_optional_plugin_versions.py

@@ -136,7 +136,7 @@ class FastBaselineRuntimeTupleTest(SimpleTestCase):
 
         tuple_ = {
             "netbox": netbox,
-            "branching": "1.2.0",
+            "branching": "1.2.1",
             "forward_netbox": fast_baseline.forward_config.version,
             "optional_plugins": (
                 {

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_ospf_drift_comparison.py

@@ -77,10 +77,11 @@ class OspfPreviewTest(TestCase):
 
     def _existing_instance(self, *, router_id="10.0.0.1", vrf=None):
         from forward_netbox.utilities.sync_routing_impl import ospf_instance_comments
+        from forward_netbox.utilities.sync_routing_impl import ospf_instance_name
 
         OSPFInstance, _, _ = _ospf_models()
         return OSPFInstance.objects.create(
-            name=f"{self.device.name} OSPF 1",
+            name=ospf_instance_name(self.device.name, "1", vrf.name if vrf else None),
             router_id=router_id,
             process_id=1,
             device=self.device,
@@ -239,6 +240,27 @@ class OspfPreviewTest(TestCase):
         result = compare_model_rows(None, INSTANCE, [self._row(vrf="TENANT-B")])
         self.assertEqual(result["unchanged"], 1)
 
+    def test_a_vrf_instance_with_the_old_unsuffixed_name_is_renamed_not_created(self):
+        # Instances written before the name carried the VRF are matched on
+        # (device, vrf, process_id), so the sync renames them in place.
+        from forward_netbox.utilities.sync_routing_impl import ospf_instance_comments
+
+        OSPFInstance, _, _ = _ospf_models()
+        vrf = VRF.objects.create(name="TENANT-C")
+        OSPFInstance.objects.create(
+            name=f"{self.device.name} OSPF 1",
+            router_id="10.0.0.1",
+            process_id=1,
+            device=self.device,
+            vrf=vrf,
+            comments=ospf_instance_comments(self._row(), "1"),
+        )
+
+        result = compare_model_rows(None, INSTANCE, [self._row(vrf="TENANT-C")])
+
+        self.assertEqual(result["creates"], 0)
+        self.assertEqual(result["unchanged"], 0)
+
     # --- rows the apply refuses -------------------------------------------
 
     def test_an_instance_without_a_router_id_is_rejected(self):

forward_netbox-3.0.3/forward_netbox/tests/test_ospf_instance_names.py

@@ -0,0 +1,27 @@
+from unittest import TestCase
+
+from forward_netbox.utilities.sync_routing_impl import ospf_instance_name
+
+
+class OspfInstanceNameTest(TestCase):
+    def test_the_global_table_keeps_the_name_it_always_had(self):
+        self.assertEqual(
+            ospf_instance_name("sw-a", "default", None), "sw-a OSPF default"
+        )
+        self.assertEqual(ospf_instance_name("sw-a", "1", ""), "sw-a OSPF 1")
+
+    def test_the_same_process_in_two_vrfs_gets_two_names(self):
+        # netbox-routing 0.5.0 enforces unique (device, name) on OSPF instances.
+        names = {
+            ospf_instance_name("sw-a", "default", None),
+            ospf_instance_name("sw-a", "default", "BLUE"),
+            ospf_instance_name("sw-a", "default", "RED"),
+        }
+        self.assertEqual(len(names), 3)
+
+    def test_a_long_name_is_cut_in_the_base_never_in_the_vrf(self):
+        name = ospf_instance_name("d" * 120, "default", "BLUE")
+        self.assertEqual(len(name), 100)
+        self.assertTrue(name.endswith(" (BLUE)"))
+        other = ospf_instance_name("d" * 120, "default", "RED")
+        self.assertNotEqual(name, other)

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_primary_ip.py

@@ -152,6 +152,31 @@ class ResolveManagementIpAssignmentsTest(SimpleTestCase):
 
         self.assertEqual(result, {})
 
+    def test_unresolved_devices_report_why(self):
+        reasons = {}
+        self._resolve(
+            {
+                "many": ["10.0.0.1", "10.0.0.2"],
+                "none": ["10.0.0.3"],
+                "two": ["10.0.0.4"],
+            },
+            {
+                "many": {"Lo0": ["10.0.0.1/32"]},
+                "none": {"Lo0": ["10.9.9.9/32"]},
+                "two": {"Lo0": ["10.0.0.4/32"], "Vlan1": ["10.0.0.4/24"]},
+            },
+            reasons=reasons,
+        )
+
+        self.assertEqual(
+            reasons,
+            {
+                "many": "multiple-addresses",
+                "none": "no-interface",
+                "two": "several-interfaces",
+            },
+        )
+
     def test_a_device_with_a_mgmt_tag_is_never_given_the_fallback(self):
         result = self._resolve(
             {"r1": ["10.0.0.1"]},

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_primary_ip_integration.py

@@ -214,6 +214,49 @@ class PrimaryIpFromMgmtTagIntegrationTest(TransactionTestCase):
 
         executor.get_device_management_ips.assert_not_called()
 
+    def test_a_tag_that_resolves_nothing_still_gets_the_management_address(self):
+        # `Mgmt_Nope` names no interface, so the tag leaves the device bare. It
+        # used to block the fallback too, which left 590 tagged devices on one
+        # estate without a primary IP even though their management address sat
+        # on an interface.
+        self._enable(tag=True, fallback=True)
+        branch = provision_branch(user=self.user, name="Unresolved Tag Branch")
+        executor = self._fallback_executor(
+            mgmt_tags={"r1": ["Mgmt_Nope9"]},
+            management_ips={"r1": ["10.0.211.2"]},
+        )
+
+        updated = apply_primary_ip_from_mgmt_tags(
+            executor, branch, snapshot_id="snap-1"
+        )
+
+        self.assertEqual(updated, 1)
+        with activate_branch(branch):
+            self.assertEqual(
+                Device.objects.get(pk=self.device.pk).primary_ip4_id, self.ip.pk
+            )
+
+    def test_a_shared_management_address_is_recognised_as_shared(self):
+        from forward_netbox.utilities.primary_ip import (
+            _devices_sharing_management_address,
+        )
+
+        parent = Device.objects.create(
+            name="fw-parent",
+            site=self.device.site,
+            role=self.device.role,
+            device_type=self.device.device_type,
+        )
+        mgmt = Interface.objects.create(device=parent, name="mgmt", type="virtual")
+        IPAddress.objects.create(address="10.55.0.1/24", assigned_object=mgmt)
+
+        shared = _devices_sharing_management_address(
+            {"fw-vsys2": "no-interface", "r1": "no-interface"},
+            {"fw-vsys2": ["10.55.0.1"], "r1": ["10.66.0.1"]},
+        )
+
+        self.assertEqual(shared, {"fw-vsys2"})
+
     def test_a_tagged_device_ignores_the_management_address(self):
         other = Interface.objects.create(
             device=self.device, name="Loopback9", type="virtual"

{forward_netbox-3.0.2 → forward_netbox-3.0.3}/forward_netbox/tests/test_runtime_dependency_check.py

@@ -23,7 +23,7 @@ class RuntimeDependencyCheckTest(SimpleTestCase):
         self.assertIsNotNone(_resolved_branching_version())
 
     def test_plugin_config_version_matches_package_release(self):
-        self.assertEqual(NetboxForwardConfig.version, "3.0.2")
+        self.assertEqual(NetboxForwardConfig.version, "3.0.3")
 
     def test_exact_runtime_passes(self):
         _check_runtime_dependencies()