fix(config): detect filter and rule deletions by tracking active row counts

hasChanges only checked MAX(timestamp) increases, missing deletions where
the timestamp didn't advance. Now also compares COUNT of active rows so
deactivations and hard deletes trigger config file regeneration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: osmontero

plugins/config/main.go

@@ -75,9 +75,13 @@ type ExpressionBackend struct {
 
 type ConfigState struct {
 	AssetsLastUpdate   time.Time
+	AssetsCount        int
 	RulesLastUpdate    time.Time
+	RulesCount         int
 	FiltersLastUpdate  time.Time
+	FiltersCount       int
 	PatternsLastUpdate time.Time
+	PatternsCount      int
 }
 
 func (b *ExpressionBackend) ToExpression() Expression {
@@ -431,26 +435,35 @@ func hasChanges(db *sql.DB, state *ConfigState) (bool, ConfigState, error) {
 	changed := false
 
 	queries := []struct {
-		query  string
-		target *time.Time
-		old    time.Time
+		timestampQuery string
+		countQuery     string
+		targetTime     *time.Time
+		targetCount    *int
+		oldTime        time.Time
+		oldCount       int
 	}{
-		{"SELECT MAX(last_update) FROM utm_tenant_config", &newState.AssetsLastUpdate, state.AssetsLastUpdate},
-		{"SELECT MAX(rule_last_update) FROM utm_correlation_rules", &newState.RulesLastUpdate, state.RulesLastUpdate},
-		{"SELECT MAX(updated_at) FROM utm_logstash_filter", &newState.FiltersLastUpdate, state.FiltersLastUpdate},
-		{"SELECT MAX(last_update) FROM utm_regex_pattern", &newState.PatternsLastUpdate, state.PatternsLastUpdate},
+		{"SELECT MAX(last_update) FROM utm_tenant_config", "SELECT COUNT(*) FROM utm_tenant_config", &newState.AssetsLastUpdate, &newState.AssetsCount, state.AssetsLastUpdate, state.AssetsCount},
+		{"SELECT MAX(rule_last_update) FROM utm_correlation_rules", "SELECT COUNT(*) FROM utm_correlation_rules WHERE rule_active = true", &newState.RulesLastUpdate, &newState.RulesCount, state.RulesLastUpdate, state.RulesCount},
+		{"SELECT MAX(updated_at) FROM utm_logstash_filter", "SELECT COUNT(*) FROM utm_logstash_filter WHERE is_active = true", &newState.FiltersLastUpdate, &newState.FiltersCount, state.FiltersLastUpdate, state.FiltersCount},
+		{"SELECT MAX(last_update) FROM utm_regex_pattern", "SELECT COUNT(*) FROM utm_regex_pattern", &newState.PatternsLastUpdate, &newState.PatternsCount, state.PatternsLastUpdate, state.PatternsCount},
 	}
 
 	for _, q := range queries {
 		var lastUpdate sql.NullTime
-		err := db.QueryRow(q.query).Scan(&lastUpdate)
+		err := db.QueryRow(q.timestampQuery).Scan(&lastUpdate)
 		if err != nil {
 			return false, newState, err
 		}
 		if lastUpdate.Valid {
-			*q.target = lastUpdate.Time
+			*q.targetTime = lastUpdate.Time
 		}
-		if (*q.target).After(q.old) {
+
+		err = db.QueryRow(q.countQuery).Scan(q.targetCount)
+		if err != nil {
+			return false, newState, err
+		}
+
+		if (*q.targetTime).After(q.oldTime) || *q.targetCount != q.oldCount {
 			changed = true
 		}
 	}