IcingaService: enforce zone for apply rules

fixes #1621
fixes #1634

library/Director/Objects/IcingaService.php

@@ -480,14 +480,24 @@ class IcingaService extends IcingaObject implements ExportInterface
 
     /**
      * @return string
+     * @throws \Icinga\Exception\NotFoundError
+     * @throws \Icinga\Module\Director\Exception\NestingError
      */
     protected function renderSuffix()
     {
-        if ($this->isApplyRule() || $this->usesVarOverrides()) {
-            return $this->renderImportHostVarOverrides() . parent::renderSuffix();
-        } else {
-            return parent::renderSuffix();
+        $suffix = '';
+        if ($this->isApplyRule()) {
+            $zoneName = $this->getRenderingZone();
+            if (!IcingaZone::zoneNameIsGlobal($zoneName, $this->connection)) {
+                $suffix .= c::renderKeyValue('zone', c::renderString($zoneName));
+            }
         }
+
+        if ($this->isApplyRule() || $this->usesVarOverrides()) {
+            $suffix .= $this->renderImportHostVarOverrides();
+        }
+
+        return $suffix . parent::renderSuffix();
     }
 
     /**

library/Director/Objects/IcingaZone.php

@@ -2,6 +2,7 @@
 
 namespace Icinga\Module\Director\Objects;
 
+use Icinga\Module\Director\Db;
 use Icinga\Module\Director\IcingaConfig\IcingaConfig;
 use Icinga\Module\Director\IcingaConfig\IcingaConfigHelper as c;
 
@@ -29,6 +30,8 @@ class IcingaZone extends IcingaObject
 
     protected $supportsImports = true;
 
+    protected static $globalZoneNames;
+
     private $endpointList;
 
     protected function renderCustomExtensions()
@@ -41,6 +44,28 @@ class IcingaZone extends IcingaObject
         return c::renderKeyValue('endpoints', c::renderArray($endpoints));
     }
 
+    public function isGlobal()
+    {
+        return $this->get('is_global') === 'y';
+    }
+
+    public static function zoneNameIsGlobal($name, Db $connection)
+    {
+        if (self::$globalZoneNames === null) {
+            $db = $connection->getDbAdapter();
+            self::setCachedGlobalZoneNames($db->fetchCol(
+                $db->select()->from('icinga_zone', 'object_name')->where('is_global = ?', 'y')
+            ));
+        }
+
+        return \in_array($name, self::$globalZoneNames);
+    }
+
+    public static function setCachedGlobalZoneNames($names)
+    {
+        self::$globalZoneNames = $names;
+    }
+
     public function getRenderingZone(IcingaConfig $config = null)
     {
         // If the zone has a parent zone...

library/Director/Test/BaseTestCase.php

@@ -9,6 +9,7 @@ use Icinga\Exception\ConfigurationError;
 use Icinga\Module\Director\Db;
 use Icinga\Module\Director\Db\Migrations;
 use Icinga\Module\Director\Objects\IcingaObject;
+use Icinga\Module\Director\Objects\IcingaZone;
 use PHPUnit_Framework_TestCase;
 
 abstract class BaseTestCase extends PHPUnit_Framework_TestCase
@@ -77,6 +78,11 @@ abstract class BaseTestCase extends PHPUnit_Framework_TestCase
             self::$db = new Db($dbConfig);
             $migrations = new Migrations(self::$db);
             $migrations->applyPendingMigrations();
+            IcingaZone::create([
+                'object_name' => 'director-global',
+                'object_type' => 'external_object',
+                'is_global'   => 'y'
+            ])->store(self::$db);
         }
 
         return self::$db;