Sync: implement update-only policy

fixes #2059

application/forms/SyncRuleForm.php

@@ -54,13 +54,15 @@ class SyncRuleForm extends DirectorObjectForm
                 'Define what should happen when an object with a matching key'
                 . " already exists. You could merge its properties (import source"
                 . ' wins), replace it completely with the imported object or ignore'
-                . ' it (helpful for one-time imports)'
+                . ' it (helpful for one-time imports). "Update only" means that this'
+                . ' Rule would never create (or delete) full Objects.'
             ),
             'required'     => true,
             'multiOptions' => $this->optionalEnum([
-                'merge'    => $this->translate('Merge'),
+                'merge'       => $this->translate('Merge'),
-                'override' => $this->translate('Replace'),
+                'override'    => $this->translate('Replace'),
-                'ignore'   => $this->translate('Ignore'),
+                'ignore'      => $this->translate('Ignore'),
+                'update-only' => $this->translate('Update only'),
             ])
         ]);
 

doc/82-Changelog.md

@@ -18,6 +18,9 @@ next (will be 1.8.0)
 * FEATURE: Allow to disable the Director frontend / UI (#2007)
 * FEATURE: Endpoints table now shows the object type (e.g. external) (#2050)
 
+### Import and Sync
+* FEATURE: allow to define update-only Sync Rules (#2059)
+
 ### REST API
 * FEATURE: Self Service API ignores empty/missing properties (e.g. no address)
 

library/Director/Import/Sync.php

@@ -106,10 +106,14 @@ class Sync
     {
         $modified = [];
         $objects = $this->prepare();
+        $updateOnly = $this->rule->get('update_policy') === 'update-only';
+        $allowCreate = ! $updateOnly;
         foreach ($objects as $object) {
             if ($object->hasBeenModified()) {
-                $modified[] = $object;
+                if ($allowCreate || $object->hasBeenLoadedFromDb()) {
-            } elseif ($object->shouldBeRemoved()) {
+                    $modified[] = $object;
+                }
+            } elseif (! $updateOnly && $object->shouldBeRemoved()) {
                 $modified[] = $object;
             }
         }
@@ -691,6 +695,7 @@ class Sync
                 break;
 
             case 'merge':
+            case 'update-only':
                 // TODO: re-evaluate merge settings. vars.x instead of
                 //       just "vars" might suffice.
                 $this->objects[$key]->merge($object, $this->replaceVars);
@@ -738,6 +743,8 @@ class Sync
         $dba->beginTransaction();
 
         $object = null;
+        $updateOnly = $this->rule->get('update_policy') === 'update-only';
+        $allowCreate = ! $updateOnly;
 
         try {
             $formerActivityChecksum = hex2bin(
@@ -750,7 +757,7 @@ class Sync
             // $failed = 0;
             foreach ($objects as $object) {
                 $this->setResolver($object);
-                if ($object->shouldBeRemoved()) {
+                if (! $updateOnly && $object->shouldBeRemoved()) {
                     $object->delete();
                     $deleted++;
                     continue;
@@ -758,11 +765,11 @@ class Sync
 
                 if ($object->hasBeenModified()) {
                     $existing = $object->hasBeenLoadedFromDb();
-                    $object->store($db);
-
                     if ($existing) {
+                        $object->store($db);
                         $modified++;
-                    } else {
+                    } elseif ($allowCreate) {
+                        $object->store($db);
                         $created++;
                     }
                 }

schema/mysql.sql

@@ -1524,7 +1524,7 @@ CREATE TABLE sync_rule (
     'notification',
     'dependency'
   ) NOT NULL,
-  update_policy ENUM('merge', 'override', 'ignore') NOT NULL,
+  update_policy ENUM('merge', 'override', 'ignore', 'update-only') NOT NULL,
   purge_existing ENUM('y', 'n') NOT NULL DEFAULT 'n',
   filter_expression TEXT DEFAULT NULL,
   sync_state ENUM(
@@ -1883,4 +1883,4 @@ CREATE TABLE icinga_scheduled_downtime_range (
 
 INSERT INTO director_schema_migration
   (schema_version, migration_time)
-  VALUES (168, NOW());
+  VALUES (170, NOW());

schema/pgsql.sql

@@ -36,7 +36,7 @@ CREATE TYPE enum_sync_rule_object_type AS ENUM(
   'notification',
   'dependency'
 );
-CREATE TYPE enum_sync_rule_update_policy AS ENUM('merge', 'override', 'ignore');
+CREATE TYPE enum_sync_rule_update_policy AS ENUM('merge', 'override', 'ignore', 'update-only');
 CREATE TYPE enum_sync_property_merge_policy AS ENUM('override', 'merge');
 CREATE TYPE enum_sync_state AS ENUM(
     'unknown',
@@ -2199,4 +2199,4 @@ COMMENT ON COLUMN icinga_scheduled_downtime_range.merge_behaviour IS 'set -> = {
 
 INSERT INTO director_schema_migration
   (schema_version, migration_time)
-  VALUES (169, NOW());
+  VALUES (170, NOW());