A missing CMDB source sheet soft-deletes all its applications, silently #1304

Found during a Quick review of #1269 (release development → beta). Present on development at af446eb8; introduced in #1288.

Impact

The reader refuses a workbook only when none of its source sheets is present, and the reconciliation scope is every earlier import, so a workbook missing one sheet soft-deletes every application that sheet created, with no reason in the report.

The chain

CmdbWorkbookReader::sourceSheets() keeps array_intersect($expected, $available) and throws NO_SOURCE_SHEET only when none of the profile's sheets is present. So a workbook that has Onbeh Applicaties CMDB and Gearchiveerde Applicaties but not Beheerde Applicaties CMDB (the sheet was renamed, or someone exported a partial workbook) is read without an error or a warning. The only warning for a missing sheet in the reader is the one for an optional column (line 862).

In reconcileTarget() the workbook counts as authoritative for deletion when the archive sheet is present and no key was unreadable. Whether every source sheet was there is never checked. As a result, every application that an earlier import created from the absent sheet is missing from winningSheets and moves to DELETED: its usage and module are soft-deleted. missingRecords defaults to archive (DEFAULT_MISSING_RECORDS), so this is what happens on a plain re-import. The objects are recoverable from the trash, but the report does not say why they left. No unit test covers a workbook with only some of the source sheets.

Fix: have the reader return the expected sheets that are absent. Treat a missing sheet like an unreadable key: never DELETED (archive at most, or skip reconciliation), and add an import warning naming the sheet.

Verified against af446eb8cc46917bc7151b9e7fb7ce4f58748013.

Reproduction

Verified by reading the code at af446eb8; not executed.

Done when

• A test imports a workbook with the archive sheet and only Onbeh Applicaties CMDB, with a prior application from Beheerde Applicaties CMDB in scope, and asserts that the application is not soft-deleted and that the report carries a warning naming the missing sheet; the test goes red when the new check is removed

Review thread

#1269 (comment)