nautobot 2.4.16__py3-none-any.whl → 2.4.17__py3-none-any.whl

nautobot/extras/tests/test_models.py

@@ -153,6 +153,10 @@ class ComputedFieldTest(ModelTestCases.BaseModelTestCase):
             secret_type=SecretsGroupSecretTypeChoices.TYPE_SECRET,
         )
 
+        # Template strings for validation testing (cannot be saved due to syntax errors)
+        self.invalid_template_unclosed_bracket = "{{ obj.name }"
+        self.invalid_template_unknown_tag = "{% unknowntag %}{{ obj.name }}{% endunknowntag %}"
+
     def test_render_method(self):
         rendered_value = self.good_computed_field.render(context={"obj": self.location1})
         self.assertEqual(rendered_value, f"{self.location1.name} is awesome!")
@@ -214,6 +218,218 @@ class ComputedFieldTest(ModelTestCases.BaseModelTestCase):
             str(error.exception),
         )
 
+    def test_template_validation_invalid_syntax(self):
+        """
+        Test that ComputedField with invalid Jinja2 template syntax raises ValidationError.
+        """
+        # Invalid template with syntax error - unclosed bracket
+        invalid_computed_field = ComputedField(
+            label="Invalid Template Test",
+            key="invalid_template_test",
+            template=self.invalid_template_unclosed_bracket,
+            content_type=ContentType.objects.get_for_model(Device),
+        )
+
+        with self.assertRaises(ValidationError) as context:
+            invalid_computed_field.full_clean()
+
+        # Check that the error message contains template-specific information
+        error_dict = context.exception.error_dict
+        self.assertIn("template", error_dict)
+        self.assertIn("Template syntax error", str(error_dict["template"][0]))
+        self.assertIn("line", str(error_dict["template"][0]))
+
+    def test_template_validation_invalid_tag(self):
+        """
+        Test that ComputedField with invalid Jinja2 tag raises ValidationError.
+        """
+        # Invalid template with unknown tag
+        invalid_computed_field = ComputedField(
+            label="Invalid Tag Test",
+            key="invalid_tag_test",
+            template=self.invalid_template_unknown_tag,
+            content_type=ContentType.objects.get_for_model(Device),
+        )
+
+        with self.assertRaises(ValidationError) as context:
+            invalid_computed_field.full_clean()
+
+        # Check that the error message contains template-specific information
+        error_dict = context.exception.error_dict
+        self.assertIn("template", error_dict)
+        self.assertIn("Template syntax error", str(error_dict["template"][0]))
+
+    def test_bulk_create_valid_templates(self):
+        """Test that bulk_create works with valid templates."""
+        valid_fields = [
+            ComputedField(
+                label="Bulk Test 1",
+                key="bulk_test_1",
+                template="{{ obj.name }} - Test 1",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+            ComputedField(
+                label="Bulk Test 2",
+                key="bulk_test_2",
+                template="{{ obj.id }} - Test 2",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+        ]
+
+        # Should not raise ValidationError
+        created_fields = ComputedField.objects.bulk_create(valid_fields)
+        self.assertEqual(len(created_fields), 2)
+
+    def test_bulk_create_invalid_templates(self):
+        """Test that bulk_create fails with invalid templates and reports all errors."""
+        invalid_fields = [
+            ComputedField(
+                label="Invalid Test 1",
+                key="invalid_test_1",
+                template=self.invalid_template_unclosed_bracket,
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+            ComputedField(
+                label="Invalid Test 2",
+                key="invalid_test_2",
+                template=self.invalid_template_unknown_tag,
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+        ]
+
+        with self.assertRaises(ValidationError) as context:
+            ComputedField.objects.bulk_create(invalid_fields)
+
+        # Check that both errors are reported
+        error_message = str(context.exception)
+        self.assertIn("Template validation failed", error_message)
+        self.assertIn("Invalid Test 1", error_message)
+        self.assertIn("Invalid Test 2", error_message)
+
+    def test_bulk_update_template_field(self):
+        """Test that bulk_update validates templates when template field is updated."""
+        # Create valid objects first
+        valid_fields = [
+            ComputedField(
+                label="Update Test 1",
+                key="update_test_1",
+                template="{{ obj.name }}",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+            ComputedField(
+                label="Update Test 2",
+                key="update_test_2",
+                template="{{ obj.id }}",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+        ]
+        created_fields = ComputedField.objects.bulk_create(valid_fields)
+
+        # Update with invalid templates
+        for field in created_fields:
+            field.template = self.invalid_template_unclosed_bracket
+
+        with self.assertRaises(ValidationError) as context:
+            ComputedField.objects.bulk_update(created_fields, ["template"])
+
+        # Check that validation error occurred
+        error_message = str(context.exception)
+        self.assertIn("Template validation failed", error_message)
+        self.assertIn("Update Test 1", error_message)
+        self.assertIn("Update Test 2", error_message)
+
+    def test_bulk_update_non_template_field(self):
+        """Test that bulk_update skips template validation when template field is not updated."""
+        # Create a field with invalid template (bypassing validation for this test)
+        field = ComputedField(
+            label="Non-template Update Test",
+            key="non_template_update_test",
+            template="{{ obj.name }}",  # Start with valid template
+            content_type=ContentType.objects.get_for_model(Device),
+        )
+        field.save()
+
+        # Manually set invalid template (simulating existing invalid data)
+        ComputedField.objects.filter(pk=field.pk).update(template=self.invalid_template_unclosed_bracket)
+        field.refresh_from_db()
+
+        # Update only the label field - should not trigger template validation
+        field.label = "Updated Label"
+        try:
+            ComputedField.objects.bulk_update([field], ["label"])
+        except ValidationError:
+            self.fail("bulk_update should not validate templates when template field is not being updated")
+
+    def test_bulk_create_mixed_valid_invalid(self):
+        """Test that bulk_create fails when mixing valid and invalid templates."""
+        mixed_fields = [
+            ComputedField(
+                label="Valid Mixed Test",
+                key="valid_mixed_test",
+                template="{{ obj.name }} - Valid",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+            ComputedField(
+                label="Invalid Mixed Test",
+                key="invalid_mixed_test",
+                template=self.invalid_template_unclosed_bracket,
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+        ]
+
+        with self.assertRaises(ValidationError) as context:
+            ComputedField.objects.bulk_create(mixed_fields)
+
+        # Check that the invalid object is reported but valid one is not
+        error_message = str(context.exception)
+        self.assertIn("Template validation failed", error_message)
+        self.assertIn("Invalid Mixed Test", error_message)
+        # Valid object should not appear in error message
+        self.assertNotIn("Valid Mixed Test", error_message)
+
+        # Verify no objects were created (all-or-nothing behavior)
+        self.assertFalse(ComputedField.objects.filter(key="valid_mixed_test").exists())
+        self.assertFalse(ComputedField.objects.filter(key="invalid_mixed_test").exists())
+
+    def test_bulk_update_mixed_valid_invalid(self):
+        """Test that bulk_update fails when mixing valid and invalid template updates."""
+        # Create valid objects first
+        valid_fields = [
+            ComputedField(
+                label="Valid Update Mixed",
+                key="valid_update_mixed",
+                template="{{ obj.name }}",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+            ComputedField(
+                label="Invalid Update Mixed",
+                key="invalid_update_mixed",
+                template="{{ obj.id }}",
+                content_type=ContentType.objects.get_for_model(Device),
+            ),
+        ]
+        created_fields = ComputedField.objects.bulk_create(valid_fields)
+
+        # Update: one with valid template, one with invalid
+        created_fields[0].template = "{{ obj.name }} - Updated Valid"  # Valid
+        created_fields[1].template = self.invalid_template_unclosed_bracket  # Invalid
+
+        with self.assertRaises(ValidationError) as context:
+            ComputedField.objects.bulk_update(created_fields, ["template"])
+
+        # Check that only the invalid object is reported
+        error_message = str(context.exception)
+        self.assertIn("Template validation failed", error_message)
+        self.assertIn("Invalid Update Mixed", error_message)
+        # Valid object should not appear in error message
+        self.assertNotIn("Valid Update Mixed", error_message)
+
+        # Verify templates were not updated (all-or-nothing behavior)
+        created_fields[0].refresh_from_db()
+        created_fields[1].refresh_from_db()
+        self.assertEqual(created_fields[0].template, "{{ obj.name }}")  # Original template
+        self.assertEqual(created_fields[1].template, "{{ obj.id }}")  # Original template
+
 
 class ConfigContextTest(ModelTestCases.BaseModelTestCase):
     """

nautobot/extras/tests/test_views.py

@@ -205,7 +205,7 @@ class ComputedFieldRenderingTestCase(TestCase):
     def test_view_object_with_computed_field_fallback_value(self):
         """Ensure that the fallback_value is rendered if the template fails to render."""
         # Make the template invalid to demonstrate the fallback value
-        self.computedfield.template = "FOO {{ obj."
+        self.computedfield.template = "FOO {{ obj | invalid_filter }}"
         self.computedfield.validated_save()
         response = self.client.get(self.location_type.get_absolute_url(), follow=True)
         self.assertEqual(response.status_code, 200)
@@ -224,7 +224,7 @@ class ComputedFieldRenderingTestCase(TestCase):
 
     def test_view_object_with_computed_field_unsafe_fallback_value(self):
         """Ensure that computed field fallback values can't be used as an XSS vector."""
-        self.computedfield.template = "FOO {{ obj."
+        self.computedfield.template = "FOO {{ obj | invalid_filter }}"
         self.computedfield.fallback_value = '<script>alert("Hello world!"</script>'
         self.computedfield.validated_save()
         response = self.client.get(self.location_type.get_absolute_url(), follow=True)

nautobot/extras/views.py

@@ -2879,6 +2879,7 @@ class TagUIViewSet(NautobotUIViewSet):
                 table_filter="tag",
                 select_related_fields=["content_type"],
                 prefetch_related_fields=["content_object"],
+                include_paginator=True,
             ),
         ),
     )

nautobot/ipam/apps.py

@@ -19,6 +19,7 @@ class IPAMConfig(NautobotConfig):
         from graphene_django.converter import convert_django_field, convert_field_to_string
 
         from nautobot.ipam.fields import VarbinaryIPField
+        import nautobot.ipam.jobs
         import nautobot.ipam.signals  # noqa: F401  # unused-import -- but this import installs the signals
 
         # Register VarbinaryIPField to be converted to a string type

nautobot/ipam/jobs/__init__.py

@@ -0,0 +1,10 @@
+from nautobot.core.celery import register_jobs
+
+from .cleanup import FixIPAMParents
+
+name = "System Jobs"
+
+jobs = [
+    FixIPAMParents,
+]
+register_jobs(*jobs)

nautobot/ipam/jobs/cleanup.py

@@ -0,0 +1,296 @@
+from django.core.exceptions import PermissionDenied
+from django.db import models
+
+from nautobot.core.choices import ChoiceSet
+from nautobot.extras.jobs import DryRunVar, IPNetworkVar, Job, MultiChoiceVar, ObjectVar
+from nautobot.ipam.models import get_default_namespace_pk, IPAddress, Namespace, Prefix
+
+name = "System Jobs"
+
+
+class CleanupTypes(ChoiceSet):
+    IPADDRESS = "ipam.IPAddress"
+    PREFIX = "ipam.Prefix"
+
+    CHOICES = (
+        (IPADDRESS, "IP addresses"),
+        (PREFIX, "Prefixes"),
+    )
+
+
+class FixIPAMParents(Job):
+    cleanup_types = MultiChoiceVar(
+        choices=CleanupTypes.CHOICES, required=True, default=[CleanupTypes.IPADDRESS, CleanupTypes.PREFIX]
+    )
+
+    restrict_to_namespace = ObjectVar(
+        model=Namespace, required=False, description="Check only records within this namespace"
+    )
+    restrict_to_network = IPNetworkVar(required=False, description="Check only records within this network")
+
+    dryrun = DryRunVar()
+
+    class Meta:
+        name = "Check/Fix IPAM Parents"
+        description = "Check for and/or fix incorrect 'parent' values on IP Address and/or Prefix records."
+        has_sensitive_variables = False
+
+    def run(  # pylint: disable=arguments-differ
+        self, *, cleanup_types, restrict_to_namespace=None, restrict_to_network=None, dryrun=False
+    ):
+        all_relevant_prefixes = Prefix.objects.restrict(self.user, "change")
+
+        if restrict_to_namespace is not None:
+            self.logger.info(
+                "Inspecting only records in namespace %s",
+                restrict_to_namespace.name,
+                extra={"object": restrict_to_namespace},
+            )
+            all_relevant_prefixes = all_relevant_prefixes.filter(namespace=restrict_to_namespace)
+        if restrict_to_network is not None:
+            self.logger.info("Inspecting only records that fall within %s", restrict_to_network)
+            all_relevant_prefixes = all_relevant_prefixes.net_contained_or_equal(restrict_to_network)
+
+        if CleanupTypes.PREFIX in cleanup_types:
+            if not self.user.has_perm("ipam.change_prefix"):
+                self.fail('User "%s" does not have permission to update Prefix records', self.user.username)
+                raise PermissionDenied("User does not have update permission for Prefix records")
+
+            self.logger.info("Inspecting Prefix records...")
+
+            self.logger.debug("Beginning with a quick check for obviously wrong `parent` values...")
+            # 1. Obviously wrong Prefix parents
+            #    - parent is set but has wrong IP version
+            #    - parent is set but has wrong namespace
+            #    - parent is set but its network/broadcast range doesn't contain the given subnet
+            prefixes_with_invalid_parents = (
+                all_relevant_prefixes.exclude(parent__ip_version=models.F("ip_version"))
+                | all_relevant_prefixes.exclude(parent__namespace_id=models.F("namespace_id"))
+                | all_relevant_prefixes.filter(parent__network__gt=models.F("network"))
+                | all_relevant_prefixes.filter(parent__broadcast__lt=models.F("broadcast"))
+                | all_relevant_prefixes.filter(parent__prefix_length__gte=models.F("prefix_length"))
+            ).exclude(parent__isnull=True)
+
+            prefixes_with_invalid_parents = prefixes_with_invalid_parents.select_related("parent")
+
+            if prefixes_with_invalid_parents.exists():
+                fixed_prefixes = []
+                for pfx in prefixes_with_invalid_parents:
+                    candidate_parents = Prefix.objects.all()
+                    # Preserve namespace
+                    candidate_parents = candidate_parents.filter(namespace_id=pfx.namespace_id)
+                    try:
+                        parent = candidate_parents.get_closest_parent(pfx.prefix, include_self=False)
+                    except Prefix.DoesNotExist:
+                        parent = None
+                    self.logger.warning(
+                        "Parent for %s should be corrected from %s to %s",
+                        pfx.prefix,
+                        pfx.parent.display if pfx.parent is not None else None,
+                        parent.display if parent is not None else None,
+                        extra={"object": pfx},
+                    )
+                    pfx.parent = parent
+                    fixed_prefixes.append(pfx)
+
+                if dryrun:
+                    self.logger.warning(
+                        "Would correct invalid `parent` for %d Prefixes if this were not a dry-run", len(fixed_prefixes)
+                    )
+                else:
+                    update_count = Prefix.objects.bulk_update(fixed_prefixes, ["parent"], batch_size=1000)
+                    self.logger.success("Corrected invalid `parent` for %d Prefixes", update_count)
+            else:
+                self.logger.success("No Prefix records had clearly invalid `parent` values")
+
+            self.logger.debug("Continuing by checking Prefixes with null `parent` to make sure that's correct...")
+            # 2. parent is null but should not be
+            fixed_prefixes = []
+            processed_pfx_count = 0
+            for pfx in all_relevant_prefixes.filter(parent__isnull=True):
+                candidate_parents = Prefix.objects.all()
+                # Preserve namespace
+                candidate_parents = candidate_parents.filter(namespace_id=pfx.namespace_id)
+                try:
+                    parent = candidate_parents.get_closest_parent(pfx.prefix, include_self=False)
+                except Prefix.DoesNotExist:
+                    parent = None
+
+                if parent is not None:
+                    self.logger.warning(
+                        "Parent for %s should be set to %s instead of None",
+                        pfx.display,
+                        parent.prefix,
+                        extra={"object": pfx},
+                    )
+                    pfx.parent = parent
+                    fixed_prefixes.append(pfx)
+                processed_pfx_count += 1
+
+            self.logger.debug(
+                "Inspected %d Prefixes with null `parent` to see if an appropriate parent exists",
+                processed_pfx_count,
+            )
+
+            if fixed_prefixes:
+                if dryrun:
+                    self.logger.warning(
+                        "Would set a more precise `parent` for %d Prefixes if this were not a dry-run",
+                        len(fixed_prefixes),
+                    )
+                else:
+                    update_count = Prefix.objects.bulk_update(fixed_prefixes, ["parent"], batch_size=1000)
+                    self.logger.success("Corrected imprecise `parent` for %d Prefixes", update_count)
+
+            self.logger.debug("Continuing with a more involved check for more subtly incorrect `parent` values...")
+            # 3. More subtly wrong Prefix parents
+            #    - parent is set but a more specific parent Prefix also exists
+            fixed_prefixes = []
+            processed_pfx_count = 0
+            for pfx in all_relevant_prefixes.filter(
+                parent__prefix_length__lt=models.F("prefix_length") - 1
+            ).select_related("parent"):
+                try:
+                    parent = pfx.parent.subnets(include_self=True).get_closest_parent(pfx.prefix, include_self=False)
+                except Prefix.DoesNotExist:
+                    parent = None
+                if parent != pfx.parent:
+                    self.logger.warning(
+                        "Parent for %s should be corrected from %s to %s",
+                        pfx.display,
+                        pfx.parent.prefix if pfx.parent else None,
+                        parent.prefix if parent else None,
+                        extra={"object": pfx},
+                    )
+                    pfx.parent = parent
+                    fixed_prefixes.append(pfx)
+                processed_pfx_count += 1
+
+            self.logger.debug(
+                "Inspected %d Prefixes for more subtly incorrect `parent` values",
+                processed_pfx_count,
+            )
+
+            if fixed_prefixes:
+                if dryrun:
+                    self.logger.warning(
+                        "Would set a more precise `parent` for %d Prefixes if this were not a dry-run",
+                        len(fixed_prefixes),
+                    )
+                else:
+                    update_count = Prefix.objects.bulk_update(fixed_prefixes, ["parent"], batch_size=1000)
+                    self.logger.success("Corrected imprecise `parent` for %d Prefixes", update_count)
+
+        if CleanupTypes.IPADDRESS in cleanup_types:
+            if not self.user.has_perm("ipam.change_ipaddress"):
+                self.fail('User "%s" does not have permission to update IP Address records', self.user.username)
+                raise PermissionDenied("User does not have update permission for IP Address records")
+
+            self.logger.info("Inspecting IP Address records...")
+
+            all_relevant_ips = IPAddress.objects.restrict(self.user, "change")
+            if restrict_to_namespace is not None:
+                self.logger.info("Inspecting only records in namespace %s", restrict_to_namespace.name)
+                all_relevant_ips = all_relevant_ips.filter(parent__namespace=restrict_to_namespace)
+            if restrict_to_network is not None:
+                self.logger.info("Inspecting only records that fall within %s", restrict_to_network)
+                all_relevant_ips = all_relevant_ips.net_host_contained(restrict_to_network)
+
+            self.logger.debug("Beginning with a quick check for obviously wrong `parent` values...")
+            # 4. Obviously wrong IPAddress parents
+            #    - parent is unset entirely
+            #    - parent is set but has wrong IP version
+            #    - parent is set but its network/broadcast range doesn't contain the given host IP
+            ips_with_invalid_parents = (
+                all_relevant_ips.filter(parent__isnull=True)
+                | all_relevant_ips.exclude(parent__ip_version=models.F("ip_version"))
+                | all_relevant_ips.filter(parent__network__gt=models.F("host"))
+                | all_relevant_ips.filter(parent__broadcast__lt=models.F("host"))
+            )
+
+            ips_with_invalid_parents = ips_with_invalid_parents.select_related("parent")
+
+            if ips_with_invalid_parents.exists():
+                fixed_ips = []
+                for ip in ips_with_invalid_parents:
+                    candidate_parents = Prefix.objects.all()
+                    # Preserve namespace
+                    if ip.parent is not None:
+                        candidate_parents = candidate_parents.filter(namespace_id=ip.parent.namespace_id)
+                    else:
+                        candidate_parents = candidate_parents.filter(namespace_id=get_default_namespace_pk())
+                    try:
+                        parent = candidate_parents.get_closest_parent(ip.host, include_self=True)
+                        self.logger.warning(
+                            "Parent for %s should be corrected from %s to %s",
+                            ip.host,
+                            ip.parent.prefix if ip.parent is not None else None,
+                            parent.prefix,
+                            extra={"object": ip},
+                        )
+                        ip.parent = parent
+                        fixed_ips.append(ip)
+                    except Prefix.DoesNotExist:
+                        self.logger.warning(
+                            "No valid parent Prefix could be identified for %s. "
+                            "You should create a %s/%d Prefix or similar to contain this IP Address.",
+                            ip.host,
+                            ip.address.network,
+                            ip.mask_length,
+                            extra={"object": ip},
+                        )
+
+                if dryrun:
+                    self.logger.warning(
+                        "Would correct invalid `parent` for %d IP Addresses if this were not a dry-run", len(fixed_ips)
+                    )
+                else:
+                    update_count = IPAddress.objects.bulk_update(fixed_ips, ["parent"], batch_size=1000)
+                    self.logger.success("Corrected invalid `parent` for %d IP Addresses", update_count)
+            else:
+                self.logger.success("No IP Address records had null or clearly invalid `parent` values")
+
+            self.logger.debug("Continuing with a more involved check for more subtly incorrect `parent` values...")
+            # 5. More subtly wrong IPAddress parents
+            #    - parent is set and contains the IP, but is not the most specific such Prefix
+            fixed_ips = []
+            processed_ip_count = 0
+            for ip in all_relevant_ips.exclude(parent__children__isnull=True).select_related("parent"):
+                candidate_parents = ip.parent.subnets(include_self=True)
+                try:
+                    parent = candidate_parents.get_closest_parent(ip.host, include_self=True)
+                    if parent.id != ip.parent_id:
+                        self.logger.warning(
+                            "Parent for %s should be corrected from %s to %s",
+                            ip.host,
+                            ip.parent.prefix,
+                            parent.prefix,
+                            extra={"object": ip},
+                        )
+                        ip.parent = parent
+                        fixed_ips.append(ip)
+                except Prefix.DoesNotExist:
+                    self.logger.warning(
+                        "No valid parent Prefix could be identified for %s. "
+                        "You should create a %s/%d Prefix or similar to contain this IP Address.",
+                        ip.host,
+                        ip.address.network,
+                        ip.mask_length,
+                        extra={"object": ip},
+                    )
+                processed_ip_count += 1
+
+            self.logger.debug(
+                "Inspected %d IP Addresses for more subtly incorrect `parent` values",
+                processed_ip_count,
+            )
+
+            if fixed_ips:
+                if dryrun:
+                    self.logger.warning(
+                        "Would set a more precise `parent` for %d IP Addresses if this were not a dry-run",
+                        len(fixed_ips),
+                    )
+                else:
+                    update_count = IPAddress.objects.bulk_update(fixed_ips, ["parent"], batch_size=1000)
+                    self.logger.success("Corrected imprecise `parent` for %d IP Addresses", update_count)