From 43c592e5d451eed57f5dc362f7df8215bd63e00e Mon Sep 17 00:00:00 2001
From: Christoph Emsenhuber <christoph@emsenhuber.com>
Date: Thu, 10 Sep 2026 11:09:30 +0200
Subject: [PATCH] =?UTF-8?q?TP44=20Teil=20B:=20CF-Sync-Job=20=E2=80=94=20VP?=
 =?UTF-8?q?C=20service=5Fid-Feld=20+=20None-Match-Guard?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dry-Run-Befund: CloudService 'terpene-db' (VPC) wurde faelschlich als stale
markiert und fremde extra_config in 'App Launcher' gemischt. Ursache: VPC-
Directory-Services tragen ihren Identifier in "service_id", der Job las "id"
(=None). Ueber .get(mk)==None matchte der None-Wert das erste Objekt ohne den
Key. Fix: VPC nutzt v["service_id"]; _upsert ueberspringt mv=None generell.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 jobs/cf_estate_sync.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/jobs/cf_estate_sync.py b/jobs/cf_estate_sync.py
index 7d623e5..aa33cf4 100644
--- a/jobs/cf_estate_sync.py
+++ b/jobs/cf_estate_sync.py
@@ -127,8 +127,10 @@ class CFEstateSync(Job):
         if not ok:
             skipped.append("connectivity/directory/services")
         for v in (vpc or []):
-            services.append((v.get("name") or v.get("id"), "Cloudflare VPC Service", "VPC-Service",
-                             {"service_id": v.get("id"), "type": v.get("type")}, "service_id", v.get("id")))
+            # VPC-Directory-Services tragen ihren Identifier in "service_id" (NICHT "id").
+            sid = v.get("service_id") or v.get("id")
+            services.append((v.get("name") or sid, "Cloudflare VPC Service", "VPC-Service",
+                             {"service_id": sid, "type": v.get("type")}, "service_id", sid))
 
         ok, rts = self._cf_get(f"/accounts/{A}/teamnet/routes?per_page=50")
         if not ok:
@@ -141,6 +143,11 @@ class CFEstateSync(Job):
 
     # ---------------------------------------------------------------- ORM-Upsert
     def _upsert(self, model, cache, name, rt, acct, desc, extra, mk, mv, label, seen, dryrun):
+        # mv=None nie matchen: sonst greift .get(mk)==None auf das erste Objekt OHNE mk
+        # und mischt fremde extra_config zusammen (z.B. VPC ohne id -> App-Launcher).
+        if mv is None:
+            self.logger.warning("~ %s '%s' ohne Match-Wert (%s) — uebersprungen", label, name, mk)
+            return None
         ex = next((o for o in cache if (o.extra_config or {}).get(mk) == mv), None)
         if ex:
             seen.add(ex.id)