infrahub-server 1.4.5__tar.gz → 1.4.7__tar.gz

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: infrahub-server
-Version: 1.4.5
+Version: 1.4.7
 Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
 License: Apache-2.0
 Author: OpsMill

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/actions/constants.py

@@ -118,6 +118,12 @@ class ValueMatch(DropdownEnum):
         description="Match against both the current and previous values",
         color="#5ac8fa",
     )
+    ANY = DropdownChoice(
+        name="any",
+        label="Any",
+        description="Match against any value",
+        color="#276cc2",
+    )
 
 
 NODES_THAT_TRIGGER_ACTION_RULES_SETUP = [

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/api/oauth2.py

@@ -11,7 +11,7 @@ from opentelemetry import trace
 
 from infrahub import config, models
 from infrahub.api.dependencies import get_db
-from infrahub.auth import signin_sso_account
+from infrahub.auth import get_groups_from_provider, signin_sso_account
 from infrahub.exceptions import GatewayError, ProcessingError
 from infrahub.log import get_logger
 from infrahub.message_bus.types import KVTTL
@@ -109,7 +109,10 @@ async def token(
 
     _validate_response(response=userinfo_response)
     user_info = userinfo_response.json()
-    sso_groups = user_info.get("groups", [])
+    sso_groups = user_info.get("groups", []) or await get_groups_from_provider(
+        provider=provider, service=service, payload=payload, user_info=user_info
+    )
+
     if not sso_groups and config.SETTINGS.security.sso_user_default_group:
         sso_groups = [config.SETTINGS.security.sso_user_default_group]
 

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/api/oidc.py

@@ -13,7 +13,7 @@ from pydantic import BaseModel, HttpUrl
 
 from infrahub import config, models
 from infrahub.api.dependencies import get_db
-from infrahub.auth import signin_sso_account
+from infrahub.auth import get_groups_from_provider, signin_sso_account
 from infrahub.exceptions import GatewayError, ProcessingError
 from infrahub.log import get_logger
 from infrahub.message_bus.types import KVTTL
@@ -149,8 +149,12 @@ async def token(
 
     _validate_response(response=userinfo_response)
     user_info: dict[str, Any] = userinfo_response.json()
-    sso_groups = user_info.get("groups") or await _get_id_token_groups(
-        oidc_config=oidc_config, service=service, payload=payload, client_id=provider.client_id
+    sso_groups = (
+        user_info.get("groups")
+        or await _get_id_token_groups(
+            oidc_config=oidc_config, service=service, payload=payload, client_id=provider.client_id
+        )
+        or await get_groups_from_provider(provider=provider, service=service, payload=payload, user_info=user_info)
     )
 
     if not sso_groups and config.SETTINGS.security.sso_user_default_group:

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/api/query.py

@@ -40,7 +40,7 @@ router = APIRouter(prefix="/query")
 
 
 class QueryPayload(BaseModel):
-    variables: dict[str, str] = Field(default_factory=dict)
+    variables: dict[str, Any] = Field(default_factory=dict)
 
 
 async def execute_query(
@@ -48,7 +48,7 @@ async def execute_query(
     request: Request,
     branch_params: BranchParams,
     query_id: str,
-    params: dict[str, str],
+    params: dict[str, Any],
     update_group: bool,
     subscribers: list[str],
     permission_checker: GraphQLQueryPermissionChecker,

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/artifacts/models.py

@@ -7,7 +7,8 @@ class CheckArtifactCreate(BaseModel):
     """Runs a check to verify the creation of an artifact."""
 
     artifact_name: str = Field(..., description="Name of the artifact")
-    artifact_definition: str = Field(..., description="The the ID of the artifact definition")
+    artifact_definition: str = Field(..., description="The ID of the artifact definition")
+    artifact_definition_name: str = Field(..., description="The name of the artifact definition")
     commit: str = Field(..., description="The commit to target")
     content_type: str = Field(..., description="Content type of the artifact")
     transform_type: str = Field(..., description="The type of transform associated with this artifact")

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/auth.py

@@ -10,6 +10,7 @@ import jwt
 from pydantic import BaseModel
 
 from infrahub import config, models
+from infrahub.config import SecurityOAuth2Google, SecurityOAuth2Settings, SecurityOIDCGoogle, SecurityOIDCSettings
 from infrahub.core.account import validate_token
 from infrahub.core.constants import AccountStatus, InfrahubKind
 from infrahub.core.manager import NodeManager
@@ -21,6 +22,7 @@ from infrahub.exceptions import AuthorizationError, NodeNotFoundError
 if TYPE_CHECKING:
     from infrahub.core.protocols import CoreGenericAccount
     from infrahub.database import InfrahubDatabase
+    from infrahub.services import InfrahubServices
 
 
 class AuthType(str, Enum):
@@ -237,3 +239,20 @@ async def invalidate_refresh_token(db: InfrahubDatabase, token_id: str) -> None:
     refresh_token = await NodeManager.get_one(id=token_id, db=db)
     if refresh_token:
         await refresh_token.delete(db=db)
+
+
+async def get_groups_from_provider(
+    provider: SecurityOAuth2Settings | SecurityOIDCSettings, service: InfrahubServices, payload: dict, user_info: dict
+) -> list[str]:
+    if isinstance(provider, (SecurityOAuth2Google, SecurityOIDCGoogle)):
+        # Poor man's workaround to fetch user groups from Google
+        if provider.fetch_groups:
+            groups_response = await service.http.get(
+                f"{provider.cloudidentity_url}?query=member_key_id == '{user_info['email']}'",
+                headers={"Authorization": f"{payload.get('token_type')} {payload.get('access_token')}"},
+            )
+            group_memberships = groups_response.json()
+            if "memberships" in group_memberships:
+                return [membership["groupKey"]["id"] for membership in group_memberships["memberships"]]
+
+    return []

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/config.py

@@ -545,6 +545,14 @@ class SecurityOIDCGoogle(SecurityOIDCSettings):
     discovery_url: str = Field(default="https://accounts.google.com/.well-known/openid-configuration")
     icon: str = Field(default="mdi:google")
     display_label: str = Field(default="Google")
+    fetch_groups: bool = Field(
+        default=False,
+        description="Whether to use Cloud Identity API to fetch user groups. Note: requires additional scope: https://www.googleapis.com/auth/cloud-identity.groups.readonly",
+    )
+    cloudidentity_url: str = Field(
+        default="https://cloudidentity.googleapis.com/v1/groups/-/memberships:searchDirectGroups",
+        description="Google Cloud endpoint for Cloud Identity. Using searchDirectGroups by default because it is available for the Free plan",
+    )
 
 
 class SecurityOIDCProvider1(SecurityOIDCSettings):
@@ -605,6 +613,14 @@ class SecurityOAuth2Google(SecurityOAuth2Settings):
     userinfo_url: str = Field(default="https://www.googleapis.com/oauth2/v3/userinfo")
     icon: str = Field(default="mdi:google")
     display_label: str = Field(default="Google")
+    fetch_groups: bool = Field(
+        default=False,
+        description="Whether to use Cloud Identity API to fetch user groups. Note: requires additional scopes: https://www.googleapis.com/auth/cloud-identity.groups.readonly",
+    )
+    cloudidentity_url: str = Field(
+        default="https://cloudidentity.googleapis.com/v1/groups/-/memberships:searchDirectGroups",
+        description="Google Cloud endpoint for Cloud Identity. Using searchDirectGroups by default because it is available for the Free plan",
+    )
 
 
 class SecurityOAuth2ProviderSettings(BaseModel):

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/core/query/ipam.py

@@ -375,6 +375,10 @@ class IPPrefixReconcileQuery(Query):
         // ------------------
         MATCH (ip_namespace:%(namespace_kind)s {uuid: $namespace_id})-[r:IS_PART_OF]->(root:Root)
         WHERE %(branch_filter)s
+        ORDER BY r.branch_level DESC, r.from DESC, r.status ASC
+        LIMIT 1
+        WITH ip_namespace
+        WHERE r.status = "active"
         """ % {"branch_filter": branch_filter, "namespace_kind": self.params["namespace_kind"]}
         self.add_to_query(namespace_query)
 
@@ -384,8 +388,13 @@ class IPPrefixReconcileQuery(Query):
             // ------------------
             // Get IP Prefix node by UUID
             // ------------------
-            MATCH (ip_node:%(ip_kind)s {uuid: $node_uuid})
+            OPTIONAL MATCH (ip_node:%(ip_kind)s {uuid: $node_uuid})-[r:IS_PART_OF]->(:Root)
+            WHERE %(branch_filter)s
+            ORDER BY r.branch_level DESC, r.from DESC, r.status ASC
+            LIMIT 1
+            WITH ip_namespace, ip_node
             """ % {
+                "branch_filter": branch_filter,
                 "ip_kind": InfrahubKind.IPADDRESS
                 if isinstance(self.ip_value, IPAddressType)
                 else InfrahubKind.IPPREFIX,
@@ -395,17 +404,35 @@ class IPPrefixReconcileQuery(Query):
         else:
             get_node_by_prefix_query = """
             // ------------------
-            // Get IP Prefix node by prefix value
+            // Get IP node with the correct value on this branch
             // ------------------
-            OPTIONAL MATCH ip_node_path = (:Root)<-[:IS_PART_OF]-(ip_node:%(ip_kind)s)
-            -[:HAS_ATTRIBUTE]->(a:Attribute)-[:HAS_VALUE]->(aipn:%(ip_attribute_kind)s),
-            (ip_namespace)-[:IS_RELATED]-(nsr:Relationship)
-            -[:IS_RELATED]-(ip_node)
-            WHERE nsr.name IN ["ip_namespace__ip_prefix", "ip_namespace__ip_address"]
-            AND aipn.binary_address = $prefix_binary_full
+            OPTIONAL MATCH (:Root)<-[r1:IS_PART_OF]-(ip_node:%(ip_kind)s)
+                -[r2:HAS_ATTRIBUTE]->(a:Attribute)-[r3:HAS_VALUE]->(aipn:%(ip_attribute_kind)s)
+            WHERE aipn.binary_address = $prefix_binary_full
             AND aipn.prefixlen = $prefixlen
             AND aipn.version = $ip_version
-            AND all(r IN relationships(ip_node_path) WHERE (%(branch_filter)s) and r.status = "active")
+            AND all(r IN [r1, r2, r3] WHERE (%(branch_filter)s))
+            ORDER BY r3.branch_level DESC, r3.from DESC, r3.status ASC,
+                r2.branch_level DESC, r2.from DESC, r2.status ASC,
+                r1.branch_level DESC, r1.from DESC, r1.status ASC
+            LIMIT 1
+            WITH ip_namespace, CASE
+                WHEN ip_node IS NOT NULL AND r1.status = "active" AND r2.status = "active" AND r3.status = "active" THEN ip_node
+                ELSE NULL
+            END AS ip_node
+            // ------------------
+            // Filter to only those that are in the correct namespace
+            // ------------------
+            OPTIONAL MATCH (ip_namespace)-[r1:IS_RELATED]-(nsr:Relationship)-[r2:IS_RELATED]-(ip_node)
+            WHERE nsr.name IN ["ip_namespace__ip_prefix", "ip_namespace__ip_address"]
+            AND all(r IN [r1, r2] WHERE (%(branch_filter)s))
+            ORDER BY r1.branch_level DESC, r1.from DESC, r1.status ASC,
+                r2.branch_level DESC, r2.from DESC, r2.status ASC
+            LIMIT 1
+            WITH ip_namespace, CASE
+                WHEN ip_node IS NOT NULL AND r1.status = "active" AND r2.status = "active" THEN ip_node
+                ELSE NULL
+            END as ip_node
             """ % {
                 "branch_filter": branch_filter,
                 "ip_kind": InfrahubKind.IPADDRESS
@@ -425,7 +452,7 @@ class IPPrefixReconcileQuery(Query):
             OPTIONAL MATCH parent_prefix_path = (ip_node)-[r1:IS_RELATED]->(:Relationship {name: "parent__child"})-[r2:IS_RELATED]->(current_parent:%(ip_prefix_kind)s)
             WHERE all(r IN relationships(parent_prefix_path) WHERE (%(branch_filter)s))
             RETURN current_parent, (r1.status = "active" AND r2.status = "active") AS parent_is_active
-            ORDER BY r1.branch_level DESC, r2.branch_level DESC, r1.from DESC, r2.from DESC
+            ORDER BY r1.branch_level DESC, r1.from DESC, r1.status ASC, r2.branch_level DESC, r2.from DESC, r2.status ASC
             LIMIT 1
         }
         WITH ip_namespace, ip_node, CASE WHEN parent_is_active THEN current_parent ELSE NULL END as current_parent
@@ -474,28 +501,66 @@ class IPPrefixReconcileQuery(Query):
         // Identify the correct parent, if any, for the prefix node
         // ------------------
         CALL (ip_namespace) {
-            OPTIONAL MATCH parent_path = (ip_namespace)-[pr1:IS_RELATED {status: "active"}]-(ns_rel:Relationship {name: "ip_namespace__ip_prefix"})
-            -[pr2:IS_RELATED {status: "active"}]-(maybe_new_parent:%(ip_prefix_kind)s)
-            -[har:HAS_ATTRIBUTE]->(:Attribute {name: "prefix"})
-            -[hvr:HAS_VALUE]->(av:%(ip_prefix_attribute_kind)s)
-            USING INDEX av:%(ip_prefix_attribute_kind)s(binary_address)
-            WHERE all(r IN relationships(parent_path) WHERE (%(branch_filter)s))
-            AND av.version = $ip_version
+            // ------------------
+            // start with just the AttributeValue vertices b/c we have an index on them
+            // ------------------
+            OPTIONAL MATCH (av:%(ip_prefix_attribute_kind)s)
+            WHERE av.version = $ip_version
             AND av.binary_address IN $possible_prefix_list
             AND any(prefix_and_length IN $possible_prefix_and_length_list WHERE av.binary_address = prefix_and_length[0] AND av.prefixlen <= prefix_and_length[1])
+            // ------------------
+            // now get all the possible IPPrefix nodes for these AttributeValues
+            // ------------------
+            OPTIONAL MATCH parent_path = (ip_namespace)-[:IS_RELATED]-(:Relationship {name: "ip_namespace__ip_prefix"})
+            -[:IS_RELATED]-(maybe_new_parent:%(ip_prefix_kind)s)
+            -[:HAS_ATTRIBUTE]->(:Attribute {name: "prefix"})
+            -[:HAS_VALUE]->(av:AttributeValue)
+            WHERE all(r IN relationships(parent_path) WHERE (%(branch_filter)s))
+            RETURN DISTINCT maybe_new_parent
+        }
+        CALL (ip_namespace, maybe_new_parent) {
+            // ------------------
+            // filter to only active maybe_new_parent Nodes in the correct namespace
+            // ------------------
+            OPTIONAL MATCH (ip_namespace)-[r1:IS_RELATED]-(:Relationship {name: "ip_namespace__ip_prefix"})-[r2:IS_RELATED]-(maybe_new_parent)
+            WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
+            WITH maybe_new_parent, r1, r2, r1.status = "active" AND r2.status = "active" AS is_active
+            ORDER BY elementId(maybe_new_parent), r1.branch_level DESC, r1.from DESC, r1.status ASC, r2.branch_level DESC, r2.from DESC, r2.status ASC
+            WITH maybe_new_parent, head(collect(is_active)) AS is_active
+            RETURN is_active = TRUE AS parent_in_namespace
+        }
+        CALL (maybe_new_parent) {
+            // ------------------
+            // filter to only active maybe_new_parent Nodes currently linked to one of the allowed AttributeValues
+            // ------------------
+            OPTIONAL MATCH (maybe_new_parent)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "prefix"})-[r2:HAS_VALUE]->(av:AttributeValue)
+            WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
+            WITH maybe_new_parent, av, r1, r2, r1.status = "active" AND r2.status = "active" AS is_active
+            ORDER BY elementId(maybe_new_parent), r1.branch_level DESC, r1.from DESC, r1.status ASC, r2.branch_level DESC, r2.from DESC, r2.status ASC
+            // ------------------
+            // get the latest active attribute value for the maybe_new_parent
+            // ------------------
+            WITH maybe_new_parent, head(collect([av, is_active])) AS av_is_active
             WITH
-                maybe_new_parent,
-                har,
-                hvr,
-                av.prefixlen as prefixlen,
-                (har.status = "active" AND hvr.status = "active") AS is_active,
-                har.branch_level + hvr.branch_level AS branch_level
-            ORDER BY branch_level DESC, har.from DESC, hvr.from DESC
-            WITH maybe_new_parent, prefixlen, is_active
-            RETURN maybe_new_parent, head(collect(prefixlen)) AS mnp_prefixlen, head(collect(is_active)) AS mnp_is_active
+                av_is_active[0] AS av,
+                av_is_active[1] AS is_active
+            // ------------------
+            // return NULL if the value is not allowed or if it is not active
+            // ------------------
+            WITH av, is_active, (
+                av.version = $ip_version
+                AND av.binary_address IN $possible_prefix_list
+                AND any(prefix_and_length IN $possible_prefix_and_length_list WHERE av.binary_address = prefix_and_length[0] AND av.prefixlen <= prefix_and_length[1])
+            ) AS is_allowed_value
+            RETURN CASE WHEN is_active = TRUE AND is_allowed_value = TRUE THEN av ELSE NULL END AS allowed_av
         }
-        WITH ip_namespace, ip_node, current_parent, current_children, mnp_prefixlen,
-            CASE WHEN mnp_is_active THEN maybe_new_parent ELSE NULL END AS maybe_new_parent
+        // ------------------
+        // set inactive maybe_new_parents to NULL
+        // ------------------
+        WITH ip_namespace, ip_node, current_parent, current_children, allowed_av.prefixlen AS mnp_prefixlen,
+            CASE WHEN parent_in_namespace = TRUE AND allowed_av IS NOT NULL
+                THEN maybe_new_parent ELSE NULL
+            END AS maybe_new_parent
         WITH ip_namespace, ip_node, current_parent, current_children, maybe_new_parent, mnp_prefixlen
         ORDER BY ip_node.uuid, mnp_prefixlen DESC
         WITH ip_namespace, ip_node, current_parent, current_children, head(collect(maybe_new_parent)) as new_parent
@@ -511,19 +576,18 @@ class IPPrefixReconcileQuery(Query):
         // Identify the correct children, if any, for the prefix node
         // ------------------
         CALL (ip_namespace, ip_node) {
+            // ------------------
             // Get ALL possible children for the prefix node
-            OPTIONAL MATCH child_path = (
-                 (ip_namespace)-[r1:IS_RELATED]
-                 -(ns_rel:Relationship)-[r2:IS_RELATED]
-                 -(maybe_new_child:%(ip_prefix_kind)s|%(ip_address_kind)s)-[har:HAS_ATTRIBUTE]
-                 ->(a:Attribute)-[hvr:HAS_VALUE]
-                 ->(av:%(ip_prefix_attribute_kind)s|%(ip_address_attribute_kind)s)
+            // ------------------
+            OPTIONAL MATCH (
+                 (ip_namespace)-[:IS_RELATED]-(ns_rel:Relationship)-[:IS_RELATED]
+                 -(maybe_new_child:%(ip_prefix_kind)s|%(ip_address_kind)s)-[:HAS_ATTRIBUTE]
+                 ->(a:Attribute)-[:HAS_VALUE]->(av:%(ip_prefix_attribute_kind)s|%(ip_address_attribute_kind)s)
             )
             USING INDEX av:%(ip_prefix_attribute_kind)s(binary_address)
             USING INDEX av:%(ip_address_attribute_kind)s(binary_address)
             WHERE $is_prefix  // only prefix nodes can have children
             AND ns_rel.name IN ["ip_namespace__ip_prefix", "ip_namespace__ip_address"]
-            AND any(child_kind IN [$ip_prefix_kind, $ip_address_kind] WHERE child_kind IN labels(maybe_new_child))
             AND a.name in ["prefix", "address"]
             AND (ip_node IS NULL OR maybe_new_child.uuid <> ip_node.uuid)
             AND (
@@ -532,22 +596,58 @@ class IPPrefixReconcileQuery(Query):
             )
             AND av.version = $ip_version
             AND av.binary_address STARTS WITH $prefix_binary_host
-            AND all(r IN relationships(child_path) WHERE (%(branch_filter)s))
+            RETURN DISTINCT maybe_new_child
+        }
+        CALL (ip_namespace, maybe_new_child) {
+            // ------------------
+            // filter to only active maybe_new_child Nodes in the correct namespace
+            // ------------------
+            OPTIONAL MATCH (ip_namespace)-[r1:IS_RELATED]-(ns_rel:Relationship)-[r2:IS_RELATED]-(maybe_new_child)
+            WHERE ns_rel.name IN ["ip_namespace__ip_prefix", "ip_namespace__ip_address"]
+            AND all(r IN [r1, r2] WHERE (%(branch_filter)s))
+            WITH maybe_new_child, r1, r2, r1.status = "active" AND r2.status = "active" AS is_active
+            ORDER BY elementId(maybe_new_child), r1.branch_level DESC, r1.from DESC, r1.status ASC, r2.branch_level DESC, r2.from DESC, r2.status ASC
+            WITH maybe_new_child, head(collect(is_active)) AS is_active
+            RETURN is_active = TRUE AS child_in_namespace
+        }
+        CALL (maybe_new_child) {
+            // ------------------
+            // filter to only active maybe_new_child Nodes currently linked to a possible child AttributeValue
+            // ------------------
+            OPTIONAL MATCH (maybe_new_child:%(ip_prefix_kind)s|%(ip_address_kind)s)-[r1:HAS_ATTRIBUTE]->(a:Attribute)-[r2:HAS_VALUE]->(av:AttributeValue)
+            WHERE a.name in ["prefix", "address"]
+            AND all(r IN [r1, r2] WHERE (%(branch_filter)s))
+            WITH maybe_new_child, av, r1, r2, r1.status = "active" AND r2.status = "active" AS is_active
+            ORDER BY elementId(maybe_new_child), r1.branch_level DESC, r1.from DESC, r1.status ASC, r2.branch_level DESC, r2.from DESC, r2.status ASC
+            // ------------------
+            // get the latest active attribute value for the maybe_new_child
+            // ------------------
+            WITH maybe_new_child, head(collect([av, is_active])) AS av_is_active
             WITH
-                maybe_new_child,
-                av AS mnc_attribute,
-                r1,
-                r2,
-                har,
-                hvr,
-                all(r in relationships(child_path) WHERE r.status = "active") AS is_active,
-                reduce(br_lvl = 0, r in relationships(child_path) | br_lvl + r.branch_level) AS branch_level
-            ORDER BY maybe_new_child.uuid, branch_level DESC, hvr.from DESC, har.from DESC, r2.from DESC, r1.from DESC
-            WITH maybe_new_child, head(collect([mnc_attribute, is_active])) AS latest_mnc_details
-            RETURN maybe_new_child, latest_mnc_details[0] AS latest_mnc_attribute, latest_mnc_details[1] AS mnc_is_active
+                av_is_active[0] AS av,
+                av_is_active[1] AS is_active
+            // ------------------
+            // return NULL if the value is not allowed or if it is not active
+            // ------------------
+            WITH av, is_active, (
+                (
+                    ($ip_prefix_kind IN labels(maybe_new_child) AND av.prefixlen > $prefixlen)
+                    OR ($ip_address_kind IN labels(maybe_new_child) AND av.prefixlen >= $prefixlen)
+                )
+                AND av.version = $ip_version
+                AND av.binary_address STARTS WITH $prefix_binary_host
+            ) AS is_allowed_value
+            RETURN CASE WHEN is_active = TRUE AND is_allowed_value = TRUE THEN av ELSE NULL END AS latest_mnc_attribute
         }
-        WITH ip_namespace, ip_node, current_parent, current_children, new_parent, latest_mnc_attribute,
-            CASE WHEN mnc_is_active IN [TRUE, NULL] THEN maybe_new_child ELSE NULL END AS maybe_new_child
+        // ------------------
+        // set inactive/illegal value/wrong namespace maybe_new_children to NULL
+        // ------------------
+        WITH ip_namespace, ip_node, current_parent, current_children, new_parent,
+            CASE
+                WHEN child_in_namespace = TRUE AND latest_mnc_attribute IS NOT NULL THEN maybe_new_child
+                ELSE NULL
+            END AS maybe_new_child,
+            CASE WHEN child_in_namespace = TRUE THEN latest_mnc_attribute ELSE NULL END AS latest_mnc_attribute
         WITH ip_namespace, ip_node, current_parent, current_children, new_parent, collect([maybe_new_child, latest_mnc_attribute]) AS maybe_children_ips
         WITH ip_namespace, ip_node, current_parent, current_children, new_parent, maybe_children_ips, range(0, size(maybe_children_ips) - 1) AS child_indices
         UNWIND child_indices as ind
@@ -581,9 +681,9 @@ class IPPrefixReconcileQuery(Query):
             new_parent,
             collect(new_child) as new_children
         """ % {
-            "branch_filter": branch_filter,
             "ip_prefix_kind": InfrahubKind.IPPREFIX,
             "ip_address_kind": InfrahubKind.IPADDRESS,
+            "branch_filter": branch_filter,
             "ip_prefix_attribute_kind": PREFIX_ATTRIBUTE_LABEL,
             "ip_address_attribute_kind": ADDRESS_ATTRIBUTE_LABEL,
         }

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/events/artifact_action.py

@@ -11,6 +11,7 @@ class ArtifactEvent(InfrahubEvent):
 
     node_id: str = Field(..., description="The ID of the artifact")
     artifact_definition_id: str = Field(..., description="The ID of the artifact definition")
+    artifact_definition_name: str = Field(..., description="The name of the artifact definition")
     target_id: str = Field(..., description="The ID of the target of the artifact")
     target_kind: str = Field(..., description="The kind of the target of the artifact")
     checksum: str = Field(..., description="The current checksum of the artifact")
@@ -36,6 +37,7 @@ class ArtifactEvent(InfrahubEvent):
                 "infrahub.artifact.storage_id": self.storage_id,
                 "infrahub.artifact.storage_id_previous": self.storage_id_previous or "",
                 "infrahub.artifact.artifact_definition_id": self.artifact_definition_id,
+                "infrahub.artifact.artifact_definition_name": self.artifact_definition_name,
             }
         )
 

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/git/base.py

@@ -393,7 +393,7 @@ class InfrahubRepositoryBase(BaseModel, ABC):
             repo = Repo.clone_from(self.location, self.directory_default)
             repo.git.checkout(checkout_ref or self.default_branch)
         except GitCommandError as exc:
-            await self._raise_enriched_error(error=exc)
+            await self._raise_enriched_error(error=exc, branch_name=checkout_ref or self.default_branch)
 
         self.has_origin = True
 

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/git/integrator.py

@@ -1422,6 +1422,7 @@ class InfrahubRepositoryIntegrator(InfrahubRepositoryBase):
             target_id=message.target_id,
             target_kind=message.target_kind,
             artifact_definition_id=message.artifact_definition,
+            artifact_definition_name=message.artifact_definition_name,
             meta=EventMeta.from_context(context=message.context, branch=branch),
             checksum=checksum,
             checksum_previous=previous_checksum,

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/git/models.py

@@ -21,6 +21,7 @@ class RequestArtifactGenerate(BaseModel):
 
     artifact_name: str = Field(..., description="Name of the artifact")
     artifact_definition: str = Field(..., description="The ID of the artifact definition")
+    artifact_definition_name: str = Field(..., description="The name of the artifact definition")
     commit: str = Field(..., description="The commit to target")
     content_type: str = Field(..., description="Content type of the artifact")
     transform_type: str = Field(..., description="The type of transform associated with this artifact")

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/git/tasks.py

@@ -366,6 +366,7 @@ async def generate_request_artifact_definition(
             artifact_name=artifact_definition.artifact_name.value,
             artifact_id=artifact_id,
             artifact_definition=model.artifact_definition_id,
+            artifact_definition_name=model.artifact_definition_name,
             commit=repository.commit.value,
             content_type=artifact_definition.content_type.value,
             transform_type=str(transform.typename),

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/groups/models.py

@@ -1,3 +1,5 @@
+from typing import Any
+
 from pydantic import BaseModel, Field
 
 
@@ -9,4 +11,4 @@ class RequestGraphQLQueryGroupUpdate(BaseModel):
     query_id: str = Field(..., description="The ID of the GraphQLQuery that should be associated with the group")
     related_node_ids: list[str] = Field(..., description="List of nodes related to the GraphQLQuery")
     subscribers: list[str] = Field(..., description="List of subscribers to add to the group")
-    params: dict[str, str] = Field(..., description="Params sent with the query")
+    params: dict[str, Any] = Field(..., description="Params sent with the query")

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/backend/infrahub/proposed_change/tasks.py

@@ -683,6 +683,7 @@ async def validate_artifacts_generation(model: RequestArtifactDefinitionCheck, c
                 artifact_name=model.artifact_definition.artifact_name,
                 artifact_id=artifact_id,
                 artifact_definition=model.artifact_definition.definition_id,
+                artifact_definition_name=model.artifact_definition.definition_name,
                 commit=repository.source_commit,
                 content_type=model.artifact_definition.content_type,
                 transform_type=model.artifact_definition.transform_kind,

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "infrahub-server"
-version = "1.4.5"
+version = "1.4.7"
 description = "Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run."
 authors = ["OpsMill <info@opsmill.com>"]
 readme = "README.md"

{infrahub_server-1.4.5 → infrahub_server-1.4.7}/python_sdk/infrahub_sdk/branch.py

@@ -292,14 +292,13 @@ class InfrahubBranchManagerSync(InfraHubBranchManagerBase):
             },
         }
 
-        mutation_query = MUTATION_QUERY_TASK if background_execution else MUTATION_QUERY_DATA
-        query = Mutation(mutation="BranchCreate", input_data=input_data, query=mutation_query)
+        query = Mutation(mutation="BranchCreate", input_data=input_data, query=MUTATION_QUERY_DATA)
         response = self.client.execute_graphql(query=query.render(), tracker="mutation-branch-create")
 
         # Make sure server version is recent enough to support background execution, as previously
         # using background_execution=True had no effect.
         if background_execution and "task" in response["BranchCreate"]:
-            return response["BranchCreate"]["task"]["id"]
+            return BranchData(**response["BranchCreate"]["task"]["id"])
         return BranchData(**response["BranchCreate"]["object"])
 
     def delete(self, branch_name: str) -> bool: