fix(clustering) do not export plugins on a route attached to a disabled service

kong/db/declarative/init.lua

@@ -453,6 +453,7 @@ local function export_from_db(emitter, skip_ws, skip_disabled_entities, expand_f
   })
 
   local disabled_services = {}
+  local disabled_routes = {}
   for i = 1, #sorted_schemas do
     local schema = sorted_schemas[i]
     if schema.db_export == false then
@@ -482,7 +483,8 @@ local function export_from_db(emitter, skip_ws, skip_disabled_entities, expand_f
       -- as well do not export plugins and routes of dsiabled services
       if skip_disabled_entities and name == "services" and not row.enabled then
         disabled_services[row.id] = true
-
+      elseif skip_disabled_entities and name == "routes" and disabled_services[row.service.id] then
+        disabled_routes[row.id] = true
       elseif skip_disabled_entities and name == "plugins" and not row.enabled then
         goto skip_emit
 
@@ -492,7 +494,7 @@ local function export_from_db(emitter, skip_ws, skip_disabled_entities, expand_f
           if type(row[foreign_name]) == "table" then
             local id = row[foreign_name].id
             if id ~= nil then
-              if disabled_services[id] then
+              if disabled_services[id] or disabled_routes[id] then
                 goto skip_emit
               end
               if not expand_foreigns then

spec/02-integration/09-hybrid_mode/01-sync_spec.lua

@@ -288,6 +288,76 @@ for _, strategy in helpers.each_strategy() do
 
           proxy_client:close()
         end)
+
+        it('does not sync plugins when service with plugin-enabled route is disabled', function()
+          local admin_client = helpers.admin_client(10000)
+          finally(function()
+            admin_client:close()
+          end)
+
+          -- create service
+          local res = assert(admin_client:post("/services", {
+            body = { name = "mockbin-service2", url = "https://127.0.0.1:15556/request", },
+            headers = {["Content-Type"] = "application/json"}
+          }))
+          local body = assert.res_status(201, res)
+          local json = cjson.decode(body)
+          local service_id = json.id
+
+          -- create route
+          res = assert(admin_client:post("/services/mockbin-service2/routes", {
+            body = { paths = { "/soon-to-be-disabled" }, },
+            headers = {["Content-Type"] = "application/json"}
+          }))
+          local body = assert.res_status(201, res)
+          local json = cjson.decode(body)
+
+          local route_id = json.id
+
+          -- add a plugin for route
+          res = assert(admin_client:post("/routes/" .. route_id .. "/plugins", {
+            body = { name = "bot-detection" },
+            headers = {["Content-Type"] = "application/json"}
+          }))
+          assert.res_status(201, res)
+
+          -- test route
+          helpers.wait_until(function()
+            local proxy_client = helpers.http_client("127.0.0.1", 9002)
+
+            res = proxy_client:send({
+              method  = "GET",
+              path    = "/soon-to-be-disabled",
+            })
+
+            local status = res and res.status
+            proxy_client:close()
+            if status == 200 then
+              return true
+            end
+          end, 10)
+
+          -- disable service
+          local res = assert(admin_client:patch("/services/" .. service_id, {
+            body = { enabled = false, },
+            headers = {["Content-Type"] = "application/json"}
+          }))
+          assert.res_status(200, res)
+          -- as this is testing a negative behavior, there is no sure way to wait
+          -- this can probably be optimizted
+          ngx.sleep(2)
+
+          local proxy_client = helpers.http_client("127.0.0.1", 9002)
+
+          -- test route again
+          res = assert(proxy_client:send({
+            method  = "GET",
+            path    = "/soon-to-be-disabled",
+          }))
+          assert.res_status(404, res)
+
+          proxy_client:close()
+        end)
       end)
     end)
   end