arthexis 0.1.11__py3-none-any.whl → 0.1.13__py3-none-any.whl

nodes/tests.py

@@ -3,7 +3,15 @@ import os
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
 import django
 
-django.setup()
+try:  # Use the pytest-specific setup when available for database readiness
+    from tests.conftest import safe_setup as _safe_setup  # type: ignore
+except Exception:  # pragma: no cover - fallback for direct execution
+    _safe_setup = None
+
+if _safe_setup is not None:
+    _safe_setup()
+else:  # pragma: no cover - fallback when pytest fixtures are unavailable
+    django.setup()
 
 from pathlib import Path
 from types import SimpleNamespace
@@ -26,8 +34,9 @@ from django.test import Client, SimpleTestCase, TestCase, TransactionTestCase, o
 from django.urls import reverse
 from django.contrib.auth import get_user_model
 from django.contrib import admin
+from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
-from django_celery_beat.models import PeriodicTask
+from django_celery_beat.models import IntervalSchedule, PeriodicTask
 from django.conf import settings
 from django.utils import timezone
 from dns import resolver as dns_resolver
@@ -52,7 +61,44 @@ from .backends import OutboxEmailBackend
 from .tasks import capture_node_screenshot, sample_clipboard
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.primitives import serialization, hashes
-from core.models import PackageRelease, SecurityGroup
+from core.models import Package, PackageRelease, SecurityGroup, RFID
+
+
+class NodeBadgeColorTests(TestCase):
+    def setUp(self):
+        self.constellation, _ = NodeRole.objects.get_or_create(name="Constellation")
+        self.control, _ = NodeRole.objects.get_or_create(name="Control")
+
+    def test_constellation_role_defaults_to_goldenrod(self):
+        node = Node.objects.create(
+            hostname="constellation",
+            address="10.1.0.1",
+            port=8000,
+            mac_address="00:aa:bb:cc:dd:01",
+            role=self.constellation,
+        )
+        self.assertEqual(node.badge_color, "#daa520")
+
+    def test_control_role_defaults_to_deep_purple(self):
+        node = Node.objects.create(
+            hostname="control",
+            address="10.1.0.2",
+            port=8001,
+            mac_address="00:aa:bb:cc:dd:02",
+            role=self.control,
+        )
+        self.assertEqual(node.badge_color, "#673ab7")
+
+    def test_custom_badge_color_is_preserved(self):
+        node = Node.objects.create(
+            hostname="custom",
+            address="10.1.0.3",
+            port=8002,
+            mac_address="00:aa:bb:cc:dd:03",
+            role=self.constellation,
+            badge_color="#123456",
+        )
+        self.assertEqual(node.badge_color, "#123456")
 
 
 class NodeTests(TestCase):
@@ -77,6 +123,32 @@ class NodeGetLocalDatabaseUnavailableTests(SimpleTestCase):
 
 
 class NodeGetLocalTests(TestCase):
+    def test_normalize_relation_handles_various_inputs(self):
+        self.assertEqual(
+            Node.normalize_relation(Node.Relation.UPSTREAM),
+            Node.Relation.UPSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation(None),
+            Node.Relation.PEER,
+        )
+        self.assertEqual(
+            Node.normalize_relation("Upstream"),
+            Node.Relation.UPSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation("DOWNSTREAM"),
+            Node.Relation.DOWNSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation("peer"),
+            Node.Relation.PEER,
+        )
+        self.assertEqual(
+            Node.normalize_relation("unexpected"),
+            Node.Relation.PEER,
+        )
+
     def test_register_current_does_not_create_release(self):
         node = None
         created = False
@@ -101,6 +173,54 @@ class NodeGetLocalTests(TestCase):
         self.assertTrue(created)
         self.assertEqual(node.current_relation, Node.Relation.SELF)
 
+    def test_register_current_updates_role_from_lock_file(self):
+        NodeRole.objects.get_or_create(name="Terminal")
+        NodeRole.objects.get_or_create(name="Constellation")
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            lock_dir = base / "locks"
+            lock_dir.mkdir(parents=True, exist_ok=True)
+            role_file = lock_dir / "role.lck"
+            role_file.write_text("Terminal")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:aa:bb:cc:dd:ee",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="role-host"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                    patch.object(Node, "notify_peers_of_update"),
+                ):
+                    node, created = Node.register_current()
+            self.assertTrue(created)
+            self.assertEqual(node.role.name, "Terminal")
+
+            role_file.write_text("Constellation")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:aa:bb:cc:dd:ee",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="role-host"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                    patch.object(Node, "notify_peers_of_update"),
+                ):
+                    _, created_again = Node.register_current()
+
+            self.assertFalse(created_again)
+            node.refresh_from_db()
+            self.assertEqual(node.role.name, "Constellation")
+
     def test_register_and_list_node(self):
         response = self.client.post(
             reverse("register-node"),
@@ -152,6 +272,41 @@ class NodeGetLocalTests(TestCase):
         hostnames = {n["hostname"] for n in data["nodes"]}
         self.assertEqual(hostnames, {"dup", "local2"})
 
+    def test_register_node_generates_unique_public_endpoint(self):
+        url = reverse("register-node")
+        User = get_user_model()
+        user = User.objects.create_user(username="registrar", password="pwd")
+        self.client.force_login(user)
+        first = self.client.post(
+            url,
+            data={
+                "hostname": "duplicate-host",
+                "address": "10.0.0.10",
+                "port": 8080,
+                "mac_address": "00:11:22:33:aa:bb",
+            },
+            content_type="application/json",
+        )
+        self.assertEqual(first.status_code, 200)
+        node_one = Node.objects.get(mac_address="00:11:22:33:aa:bb")
+        self.assertEqual(node_one.public_endpoint, "duplicate-host")
+
+        second = self.client.post(
+            url,
+            data={
+                "hostname": "duplicate-host",
+                "address": "10.0.0.11",
+                "port": 8081,
+                "mac_address": "00:11:22:33:aa:cc",
+            },
+            content_type="application/json",
+        )
+        self.assertEqual(second.status_code, 200)
+        node_two = Node.objects.get(mac_address="00:11:22:33:aa:cc")
+
+        self.assertNotEqual(node_one.public_endpoint, node_two.public_endpoint)
+        self.assertTrue(node_two.public_endpoint.startswith("duplicate-host-"))
+
     def test_register_node_feature_toggle(self):
         NodeFeature.objects.get_or_create(
             slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
@@ -248,6 +403,48 @@ class NodeGetLocalTests(TestCase):
         self.assertEqual(subject, "UP friend")
         self.assertEqual(body, "v2.0.0 r123456")
 
+    def test_register_node_marks_nonrelease_version(self):
+        package = Package.objects.create(name="pkg-node", is_active=False)
+        PackageRelease.objects.create(
+            package=package,
+            version="2.0.0",
+            revision="0" * 40,
+        )
+
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:11",
+            installed_version="1.0.0",
+            installed_revision="rev-old",
+        )
+        user = get_user_model().objects.create_user(
+            username="node-registrar", password="pwd"
+        )
+        self.client.force_login(user)
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:11",
+            "installed_version": "2.0.0",
+            "installed_revision": "1" * 40,
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.0.0")
+        self.assertEqual(node.installed_revision, "1" * 40)
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0+ r111111")
+
     def test_register_node_update_without_version_change_still_notifies(self):
         node = Node.objects.create(
             hostname="friend",
@@ -441,6 +638,64 @@ class NodeGetLocalTests(TestCase):
         self.assertEqual(node.current_relation, Node.Relation.UPSTREAM)
 
 
+class RegisterVisitorNodeMessageTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        User = get_user_model()
+        self.user = User.objects.create_user(username="visitor", password="pwd")
+        self.client.force_login(self.user)
+        self.role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        self.visitor = Node.objects.create(
+            hostname="visitor-node",
+            address="10.0.0.100",
+            port=8000,
+            mac_address="00:10:20:30:40:50",
+            role=self.role,
+        )
+
+    def test_register_node_emits_join_message_when_upstream_added(self):
+        payload = {
+            "hostname": "host-node",
+            "address": "10.0.0.10",
+            "port": 8100,
+            "mac_address": "aa:bb:cc:dd:ee:01",
+            "current_relation": "Upstream",
+        }
+        with patch("nodes.views.Node.get_local", return_value=self.visitor), patch.object(
+            NetMessage, "broadcast"
+        ) as mock_broadcast:
+            response = self.client.post(
+                reverse("register-node"),
+                data=json.dumps(payload),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_broadcast.assert_called_once_with(
+            subject="NODE visitor-node", body="JOINS host-node"
+        )
+
+    def test_register_node_skips_message_when_not_upstream(self):
+        payload = {
+            "hostname": "remote-node",
+            "address": "10.0.0.11",
+            "port": 8101,
+            "mac_address": "aa:bb:cc:dd:ee:02",
+            "current_relation": "Downstream",
+        }
+        with patch("nodes.views.Node.get_local", return_value=self.visitor), patch.object(
+            NetMessage, "broadcast"
+        ) as mock_broadcast:
+            response = self.client.post(
+                reverse("register-node"),
+                data=json.dumps(payload),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_broadcast.assert_not_called()
+
+
 class NodeRegisterCurrentTests(TestCase):
     def setUp(self):
         User = get_user_model()
@@ -752,6 +1007,17 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:cc",
             public_key=public_key,
         )
+        target_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="net-message", defaults={"display": "Net Message"}
+        )
+        target = Node.objects.create(
+            hostname="target",
+            address="10.0.0.2",
+            port=8001,
+            mac_address="00:11:22:33:44:dd",
+            role=target_role,
+        )
         msg_id = str(uuid.uuid4())
         payload = {
             "uuid": msg_id,
@@ -760,6 +1026,12 @@ class NodeRegisterCurrentTests(TestCase):
             "seen": [],
             "sender": str(sender.uuid),
             "origin": str(sender.uuid),
+            "filter_node": str(target.uuid),
+            "filter_node_feature": feature.slug,
+            "filter_node_role": target_role.name,
+            "filter_current_relation": Node.Relation.UPSTREAM,
+            "filter_installed_version": "1.0.0",
+            "filter_installed_revision": "rev123",
         }
         payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
         signature = key.sign(payload_json.encode(), padding.PKCS1v15(), hashes.SHA256())
@@ -773,6 +1045,12 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertTrue(NetMessage.objects.filter(uuid=msg_id).exists())
         message = NetMessage.objects.get(uuid=msg_id)
         self.assertEqual(message.node_origin, sender)
+        self.assertEqual(message.filter_node, target)
+        self.assertEqual(message.filter_node_feature, feature)
+        self.assertEqual(message.filter_node_role, target_role)
+        self.assertEqual(message.filter_current_relation, Node.Relation.UPSTREAM)
+        self.assertEqual(message.filter_installed_version, "1.0.0")
+        self.assertEqual(message.filter_installed_revision, "rev123")
 
     def test_clipboard_polling_creates_task(self):
         feature, _ = NodeFeature.objects.get_or_create(
@@ -833,6 +1111,45 @@ class NodeAdminTests(TestCase):
         if security_dir.exists():
             shutil.rmtree(security_dir)
 
+    def _create_local_node(self):
+        return Node.objects.create(
+            hostname="localnode",
+            address="127.0.0.1",
+            port=8000,
+            mac_address=Node.get_current_mac(),
+        )
+
+    def test_node_feature_list_shows_default_action_when_enabled(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        response = self.client.get(reverse("admin:nodes_nodefeature_changelist"))
+        action_url = reverse("admin:core_rfid_scan")
+        self.assertContains(response, f'href="{action_url}"')
+
+    def test_node_feature_list_shows_all_actions_for_rpi_camera(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        response = self.client.get(reverse("admin:nodes_nodefeature_changelist"))
+        snapshot_url = reverse("admin:nodes_nodefeature_take_snapshot")
+        stream_url = reverse("admin:nodes_nodefeature_view_stream")
+        self.assertContains(response, f'href="{snapshot_url}"')
+        self.assertContains(response, f'href="{stream_url}"')
+
+    def test_node_feature_list_hides_default_action_when_disabled(self):
+        self._create_local_node()
+        NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
+        response = self.client.get(reverse("admin:nodes_nodefeature_changelist"))
+        action_url = reverse("admin:nodes_nodefeature_take_screenshot")
+        self.assertNotContains(response, f'href="{action_url}"')
+
     def test_register_current_host(self):
         url = reverse("admin:nodes_node_register_current")
         hostname = socket.gethostname()
@@ -890,6 +1207,34 @@ class NodeAdminTests(TestCase):
         )
         self.assertIn(node.public_key.strip(), resp.content.decode())
 
+    def test_register_current_requires_superuser(self):
+        User = get_user_model()
+        staff = User.objects.create_user(
+            username="staff", password="pass", is_staff=True
+        )
+        permission = Permission.objects.get(codename="view_node")
+        staff.user_permissions.add(permission)
+        self.client.force_login(staff)
+
+        response = self.client.get(reverse("admin:nodes_node_register_current"))
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_register_current_link_hidden_for_non_superusers(self):
+        User = get_user_model()
+        staff = User.objects.create_user(
+            username="linkstaff", password="pass", is_staff=True
+        )
+        permission = Permission.objects.get(codename="view_node")
+        staff.user_permissions.add(permission)
+        self.client.force_login(staff)
+
+        response = self.client.get(reverse("admin:nodes_node_changelist"))
+
+        self.assertNotContains(
+            response, reverse("admin:nodes_node_register_current")
+        )
+
     @patch("nodes.admin.capture_screenshot")
     def test_capture_site_screenshot_from_admin(self, mock_capture_screenshot):
         screenshot_dir = settings.LOG_DIR / "screenshots"
@@ -967,6 +1312,349 @@ class NodeAdminTests(TestCase):
         samples = list(ContentSample.objects.filter(kind=ContentSample.IMAGE))
         self.assertEqual(samples[0].transaction_uuid, samples[1].transaction_uuid)
 
+    @patch("nodes.admin.capture_screenshot")
+    def test_take_screenshot_default_action_creates_sample(
+        self, mock_capture_screenshot
+    ):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        screenshot_dir = settings.LOG_DIR / "screenshots"
+        screenshot_dir.mkdir(parents=True, exist_ok=True)
+        file_path = screenshot_dir / "default.png"
+        file_path.write_bytes(b"default")
+        mock_capture_screenshot.return_value = Path("screenshots/default.png")
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_take_screenshot"), follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        sample = ContentSample.objects.get(kind=ContentSample.IMAGE)
+        self.assertEqual(sample.node, node)
+        self.assertEqual(sample.method, "DEFAULT_ACTION")
+        mock_capture_screenshot.assert_called_once_with("http://testserver/")
+        change_url = reverse("admin:nodes_contentsample_change", args=[sample.pk])
+        self.assertEqual(response.redirect_chain[-1][0], change_url)
+
+    def test_check_features_for_eligibility_action_success(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        response = self.client.post(
+            changelist_url,
+            {
+                "action": "check_features_for_eligibility",
+                "_selected_action": [str(feature.pk)],
+            },
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(
+            response,
+            "RFID Scanner is enabled on localnode. This feature cannot be enabled manually.",
+            html=False,
+        )
+        self.assertContains(
+            response, "Completed 1 of 1 feature check(s) successfully.", html=False
+        )
+
+    def test_check_features_for_eligibility_action_warns_when_disabled(self):
+        self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        response = self.client.post(
+            changelist_url,
+            {
+                "action": "check_features_for_eligibility",
+                "_selected_action": [str(feature.pk)],
+            },
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(
+            response,
+            "RFID Scanner is not enabled on localnode. This feature cannot be enabled manually.",
+            html=False,
+        )
+        self.assertContains(
+            response, "Completed 0 of 1 feature check(s) successfully.", html=False
+        )
+
+    def test_enable_selected_features_enables_manual_feature(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        response = self.client.post(
+            changelist_url,
+            {
+                "action": "enable_selected_features",
+                "_selected_action": [str(feature.pk)],
+            },
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Node.objects.get(pk=node.pk).has_feature("screenshot-poll"))
+        self.assertContains(
+            response, "Enabled 1 feature(s): Screenshot Poll", html=False
+        )
+
+    def test_enable_selected_features_warns_for_non_manual(self):
+        self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        response = self.client.post(
+            changelist_url,
+            {
+                "action": "enable_selected_features",
+                "_selected_action": [str(feature.pk)],
+            },
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(
+            response, "RFID Scanner cannot be enabled manually.", html=False
+        )
+        self.assertContains(
+            response,
+            "None of the selected features can be enabled manually.",
+            html=False,
+        )
+
+    def test_take_screenshot_default_action_requires_enabled_feature(self):
+        self._create_local_node()
+        NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_take_screenshot"), follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        self.assertEqual(response.wsgi_request.path, changelist_url)
+        self.assertEqual(ContentSample.objects.count(), 0)
+        self.assertContains(response, "Screenshot Poll feature is not enabled")
+
+    @patch("nodes.admin.capture_rpi_snapshot")
+    def test_take_snapshot_default_action_creates_sample(self, mock_snapshot):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        camera_dir = settings.LOG_DIR / "camera"
+        camera_dir.mkdir(parents=True, exist_ok=True)
+        file_path = camera_dir / "snap.jpg"
+        file_path.write_bytes(b"camera")
+        mock_snapshot.return_value = file_path
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_take_snapshot"), follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        sample = ContentSample.objects.get(kind=ContentSample.IMAGE)
+        self.assertEqual(sample.node, node)
+        self.assertEqual(sample.method, "RPI_CAMERA")
+        change_url = reverse("admin:nodes_contentsample_change", args=[sample.pk])
+        self.assertEqual(response.redirect_chain[-1][0], change_url)
+
+    def test_view_stream_requires_enabled_feature(self):
+        self._create_local_node()
+        NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_view_stream"), follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        self.assertEqual(response.wsgi_request.path, changelist_url)
+        self.assertContains(
+            response, "Raspberry Pi Camera feature is not enabled on this node."
+        )
+
+    def test_view_stream_renders_when_feature_enabled(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        response = self.client.get(reverse("admin:nodes_nodefeature_view_stream"))
+        self.assertEqual(response.status_code, 200)
+        response.render()
+        expected_stream = "http://testserver:8554/"
+        self.assertEqual(response.context_data["stream_url"], expected_stream)
+        self.assertContains(response, expected_stream)
+        self.assertContains(response, "camera-stream__frame")
+
+    def test_view_stream_uses_configured_stream_url(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        configured_stream = "https://camera.local/stream"
+        with self.settings(RPI_CAMERA_STREAM_URL=configured_stream):
+            response = self.client.get(
+                reverse("admin:nodes_nodefeature_view_stream")
+            )
+        self.assertEqual(response.status_code, 200)
+        response.render()
+        self.assertEqual(response.context_data["stream_url"], configured_stream)
+        self.assertContains(response, configured_stream)
+
+    @patch("nodes.admin.requests.post")
+    def test_fetch_rfids_action_fetches_and_imports(self, mock_post):
+        local = self._create_local_node()
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        private_bytes = key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+        public_bytes = key.public_key().public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+        security_dir = Path(settings.BASE_DIR) / "security"
+        security_dir.mkdir(parents=True, exist_ok=True)
+        (security_dir / f"{local.public_endpoint}").write_bytes(private_bytes)
+        (security_dir / f"{local.public_endpoint}.pub").write_bytes(public_bytes)
+        local.public_key = public_bytes.decode()
+        local.save(update_fields=["public_key"])
+
+        remote = Node.objects.create(
+            hostname="remote",
+            address="127.0.0.2",
+            port=8010,
+            mac_address="aa:bb:cc:dd:ee:ff",
+        )
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "rfids": [
+                {
+                    "rfid": "abc123",
+                    "custom_label": "Remote tag",
+                    "key_a": "A1B2C3D4E5F6",
+                    "key_b": "FFFFFFFFFFFF",
+                    "data": ["sector"],
+                    "key_a_verified": True,
+                    "key_b_verified": False,
+                    "allowed": True,
+                    "color": RFID.BLACK,
+                    "kind": RFID.CLASSIC,
+                    "released": False,
+                    "last_seen_on": None,
+                }
+            ]
+        }
+        mock_response.text = ""
+        mock_post.return_value = mock_response
+
+        response = self.client.post(
+            reverse("admin:nodes_node_changelist"),
+            {"action": "fetch_rfids", "_selected_action": [str(remote.pk)]},
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(RFID.objects.filter(rfid="ABC123").exists())
+        tag = RFID.objects.get(rfid="ABC123")
+        self.assertEqual(tag.custom_label, "Remote tag")
+        self.assertEqual(tag.origin_node, remote)
+        self.assertEqual(tag.data, ["sector"])
+
+        self.assertTrue(mock_post.called)
+        call_kwargs = mock_post.call_args.kwargs
+        payload = call_kwargs["data"]
+        headers = call_kwargs["headers"]
+        signature = base64.b64decode(headers["X-Signature"])
+        key.public_key().verify(
+            signature,
+            payload.encode(),
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+        self.assertContains(response, "Fetched RFIDs from 1 node(s)")
+
+
+class RFIDExportViewTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        NodeRole.objects.get_or_create(name="Terminal")
+        self.local_node = Node.objects.create(
+            hostname="local",
+            address="127.0.0.1",
+            port=8000,
+            mac_address=Node.get_current_mac(),
+        )
+        self.remote_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        self.remote_public = (
+            self.remote_key.public_key()
+            .public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            .decode()
+        )
+        self.remote_node = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.2",
+            port=8100,
+            mac_address="00:11:22:33:44:55",
+            public_key=self.remote_public,
+        )
+
+    def _sign_payload(self, payload):
+        payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
+        signature = self.remote_key.sign(
+            payload_json.encode(),
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+        return payload_json, base64.b64encode(signature).decode()
+
+    def test_export_requires_signature(self):
+        payload_json = json.dumps(
+            {"requester": str(self.remote_node.uuid)},
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+        response = self.client.post(
+            reverse("node-rfid-export"),
+            data=payload_json,
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_export_returns_serialized_data(self):
+        RFID.objects.create(rfid="ABCDEF")
+        payload_json, signature = self._sign_payload(
+            {"requester": str(self.remote_node.uuid)}
+        )
+        response = self.client.post(
+            reverse("node-rfid-export"),
+            data=payload_json,
+            content_type="application/json",
+            HTTP_X_SIGNATURE=signature,
+        )
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertIn("rfids", body)
+        self.assertEqual(len(body["rfids"]), 1)
+        tag_data = body["rfids"][0]
+        self.assertEqual(tag_data["rfid"], "ABCDEF")
+        self.assertIn("custom_label", tag_data)
+
 
 class NetMessageAdminTests(TransactionTestCase):
     reset_sequences = True
@@ -999,6 +1687,27 @@ class NetMessageAdminTests(TransactionTestCase):
         self.assertEqual(response.status_code, 302)
         mock_propagate.assert_called_once()
 
+    def test_reply_action_prefills_initial_data(self):
+        role = NodeRole.objects.get(name="Terminal")
+        node = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.10",
+            port=8100,
+            mac_address="00:11:22:33:44:55",
+            role=role,
+        )
+        original = NetMessage.objects.create(
+            subject="Ping",
+            body="Hello",
+            node_origin=node,
+        )
+        url = f"{reverse('admin:nodes_netmessage_add')}?reply_to={original.pk}"
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        form = response.context_data["adminform"].form
+        self.assertEqual(form["subject"].value(), "Re: Ping")
+        self.assertEqual(str(form["filter_node"].value()), str(node.pk))
+
 
 class LastNetMessageViewTests(TestCase):
     def setUp(self):
@@ -1007,10 +1716,19 @@ class LastNetMessageViewTests(TestCase):
 
     def test_returns_latest_message(self):
         NetMessage.objects.create(subject="old", body="msg1")
-        NetMessage.objects.create(subject="new", body="msg2")
+        latest = NetMessage.objects.create(subject="new", body="msg2")
         resp = self.client.get(reverse("last-net-message"))
         self.assertEqual(resp.status_code, 200)
-        self.assertEqual(resp.json(), {"subject": "new", "body": "msg2"})
+        self.assertEqual(
+            resp.json(),
+            {
+                "subject": "new",
+                "body": "msg2",
+                "admin_url": reverse(
+                    "admin:nodes_netmessage_change", args=[latest.pk]
+                ),
+            },
+        )
 
 
 class NetMessageReachTests(TestCase):
@@ -1071,8 +1789,10 @@ class NetMessageReachTests(TestCase):
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
-        self.assertEqual(roles, {"Constellation", "Satellite", "Control"})
-        self.assertEqual(mock_post.call_count, 3)
+        self.assertEqual(
+            roles, {"Constellation", "Satellite", "Control", "Terminal"}
+        )
+        self.assertEqual(mock_post.call_count, 4)
 
     @patch("requests.post")
     def test_default_reach_not_limited_to_terminal(self, mock_post):
@@ -1083,7 +1803,105 @@ class NetMessageReachTests(TestCase):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
         self.assertIn("Control", roles)
-        self.assertEqual(mock_post.call_count, 3)
+        self.assertEqual(mock_post.call_count, 4)
+
+
+class NetMessageFilterTests(TestCase):
+    def setUp(self):
+        self.terminal_role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        self.control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        self.nodes = {
+            "terminal": Node.objects.create(
+                hostname="terminal-filter",
+                address="10.20.0.1",
+                port=8020,
+                mac_address="00:11:22:33:55:01",
+                role=self.terminal_role,
+            ),
+            "control": Node.objects.create(
+                hostname="control-filter",
+                address="10.20.0.2",
+                port=8021,
+                mac_address="00:11:22:33:55:02",
+                role=self.control_role,
+            ),
+        }
+        self.feature, _ = NodeFeature.objects.get_or_create(
+            slug="filter-test", defaults={"display": "Filter Test"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(
+            node=self.nodes["control"], feature=self.feature
+        )
+        self.nodes["control"].current_relation = Node.Relation.UPSTREAM
+        self.nodes["control"].installed_version = "1.2.3"
+        self.nodes["control"].installed_revision = "abc123"
+        self.nodes["control"].save(
+            update_fields=[
+                "current_relation",
+                "installed_version",
+                "installed_revision",
+            ]
+        )
+
+    @patch("requests.post")
+    def test_filter_node_limits_targets(self, mock_post):
+        msg = NetMessage.objects.create(
+            subject="s", body="b", filter_node=self.nodes["control"]
+        )
+        with patch.object(Node, "get_local", return_value=None):
+            msg.propagate()
+        self.assertEqual(
+            list(msg.propagated_to.values_list("pk", flat=True)),
+            [self.nodes["control"].pk],
+        )
+        mock_post.assert_called_once()
+
+    @patch("requests.post")
+    def test_filter_fields_limit_queryset(self, mock_post):
+        msg = NetMessage.objects.create(
+            subject="s",
+            body="b",
+            filter_node_feature=self.feature,
+            filter_node_role=self.control_role,
+            filter_current_relation=Node.Relation.UPSTREAM,
+            filter_installed_version="1.2.3",
+            filter_installed_revision="abc123",
+        )
+        with patch.object(Node, "get_local", return_value=None):
+            msg.propagate()
+        self.assertEqual(
+            list(msg.propagated_to.values_list("pk", flat=True)),
+            [self.nodes["control"].pk],
+        )
+        mock_post.assert_called_once()
+
+
+class NetMessageBroadcastStringReachTests(TestCase):
+    def test_broadcast_uses_role_lookup_for_string_reach(self):
+        role = NodeRole.objects.create(name="Terminal")
+        local = Node.objects.create(
+            hostname="terminal-local",
+            address="10.10.0.1",
+            port=8010,
+            mac_address="00:aa:bb:cc:dd:ff",
+            role=role,
+            public_endpoint="terminal-local",
+        )
+        seen = ["existing"]
+
+        with patch.object(Node, "get_local", return_value=local), patch.object(
+            NetMessage, "propagate"
+        ) as mock_propagate:
+            msg = NetMessage.broadcast(
+                "Subject", "Body", reach="Terminal", seen=seen
+            )
+
+        self.assertEqual(msg.reach, role)
+        self.assertEqual(msg.node_origin, local)
+        mock_propagate.assert_called_once()
+        called_args = mock_propagate.call_args
+        self.assertIn("seen", called_args.kwargs)
+        self.assertIs(called_args.kwargs["seen"], seen)
 
 
 class NetMessagePropagationTests(TestCase):
@@ -1138,6 +1956,29 @@ class NetMessagePropagationTests(TestCase):
         self.assertEqual(msg.propagated_to.count(), 4)
         self.assertTrue(msg.complete)
 
+    @patch("requests.post")
+    @patch("core.notifications.notify", return_value=False)
+    def test_propagate_defaults_to_six_when_available(
+        self, mock_notify, mock_post
+    ):
+        for idx in range(6, 12):
+            self.remotes.append(
+                Node.objects.create(
+                    hostname=f"n{idx}",
+                    address=f"10.0.0.{idx}",
+                    port=8000 + idx,
+                    mac_address=f"00:11:22:33:44:{idx:02x}",
+                    role=self.role,
+                    public_endpoint=f"n{idx}",
+                )
+            )
+        msg = NetMessage.objects.create(subject="s", body="b", reach=self.role)
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg.propagate()
+        self.assertEqual(mock_post.call_count, 6)
+        self.assertEqual(msg.propagated_to.count(), 6)
+        self.assertFalse(msg.complete)
+
     @patch("requests.post")
     @patch("core.notifications.notify", return_value=True)
     def test_propagate_prunes_old_local_messages(self, mock_notify, mock_post):
@@ -1271,6 +2112,36 @@ class StartupNotificationTests(TestCase):
         self.assertEqual(kwargs["subject"], "host:9000")
         self.assertTrue(kwargs["body"].startswith("1.2.3 r"))
 
+    def test_startup_notification_marks_nonrelease_version(self):
+        from nodes.apps import _startup_notification
+
+        package = Package.objects.create(name="pkg-start", is_active=False)
+        PackageRelease.objects.create(
+            package=package,
+            version="1.2.3",
+            revision="0" * 40,
+        )
+
+        with TemporaryDirectory() as tmp:
+            tmp_path = Path(tmp)
+            (tmp_path / "VERSION").write_text("1.2.3")
+            with self.settings(BASE_DIR=tmp_path):
+                with patch(
+                    "nodes.apps.revision.get_revision", return_value="1" * 40
+                ):
+                    with patch("nodes.models.NetMessage.broadcast") as mock_broadcast:
+                        with patch(
+                            "nodes.apps.socket.gethostname", return_value="host"
+                        ):
+                            with patch.dict(os.environ, {"PORT": "9000"}):
+                                _startup_notification()
+                                time.sleep(0.1)
+
+        mock_broadcast.assert_called_once()
+        _, kwargs = mock_broadcast.call_args
+        self.assertEqual(kwargs["subject"], "host:9000")
+        self.assertEqual(kwargs["body"], "1.2.3+ r111111")
+
 
 class StartupHandlerTests(TestCase):
     def test_handler_logs_db_errors(self):
@@ -1494,6 +2365,16 @@ class EmailOutboxTests(TestCase):
 
         self.assertEqual(str(outbox), "mailer@example.com")
 
+    def test_string_representation_trims_trailing_at_symbol(self):
+        outbox = EmailOutbox.objects.create(
+            host="smtp.example.com",
+            port=587,
+            username="mailer@",
+            password="secret",
+        )
+
+        self.assertEqual(str(outbox), "mailer@smtp.example.com")
+
     def test_unattached_outbox_used_as_fallback(self):
         EmailOutbox.objects.create(
             group=SecurityGroup.objects.create(name="Attached"),
@@ -1713,6 +2594,45 @@ class NodeFeatureTests(TestCase):
                 role=self.role,
             )
 
+    def test_default_action_mapping_for_known_feature(self):
+        feature = NodeFeature.objects.create(
+            slug="rfid-scanner", display="RFID Scanner"
+        )
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 1)
+        action = actions[0]
+        self.assertEqual(action.label, "Scan RFIDs")
+        self.assertEqual(action.url_name, "admin:core_rfid_scan")
+        self.assertEqual(feature.get_default_action(), action)
+
+    def test_celery_feature_default_action(self):
+        feature = NodeFeature.objects.create(
+            slug="celery-queue", display="Celery Queue"
+        )
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 1)
+        action = actions[0]
+        self.assertEqual(action.label, "Celery Report")
+        self.assertEqual(action.url_name, "admin:nodes_nodefeature_celery_report")
+        self.assertEqual(feature.get_default_action(), action)
+
+    def test_rpi_camera_feature_has_multiple_actions(self):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 2)
+        labels = {action.label for action in actions}
+        self.assertIn("Take a Snapshot", labels)
+        self.assertIn("View stream", labels)
+
+    def test_default_action_missing_when_unconfigured(self):
+        feature = NodeFeature.objects.create(
+            slug="custom-feature", display="Custom Feature"
+        )
+        self.assertEqual(feature.get_default_actions(), ())
+        self.assertIsNone(feature.get_default_action())
+
     def test_lcd_screen_enabled(self):
         feature = NodeFeature.objects.create(slug="lcd-screen", display="LCD")
         feature.roles.add(self.role)
@@ -1727,6 +2647,13 @@ class NodeFeatureTests(TestCase):
         ):
             self.assertFalse(feature.is_enabled)
 
+    def test_feature_disabled_when_local_node_missing(self):
+        feature = NodeFeature.objects.create(slug="lcd-screen", display="LCD")
+        with patch("nodes.models.Node.get_local", return_value=None):
+            with patch("core.notifications.supports_gui_toast") as mock_toast:
+                self.assertFalse(feature.is_enabled)
+        mock_toast.assert_not_called()
+
     def test_rfid_scanner_lock(self):
         feature = NodeFeature.objects.create(slug="rfid-scanner", display="RFID")
         feature.roles.add(self.role)
@@ -1884,45 +2811,66 @@ class NodeFeatureTests(TestCase):
             NodeFeatureAssignment.objects.filter(node=node, feature=feature).exists()
         )
 
-    @patch("nodes.models.Node._uses_postgres", return_value=True)
-    def test_postgres_detection(self, mock_postgres):
-        feature = NodeFeature.objects.create(
-            slug="postgres-db", display="PostgreSQL Database"
+
+class CeleryReportAdminViewTests(TestCase):
+    def setUp(self):
+        User = get_user_model()
+        self.superuser = User.objects.create_superuser(
+            username="admin", email="admin@example.com", password="secret"
         )
-        feature.roles.add(self.role)
-        with patch(
-            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
-        ):
-            self.node.refresh_features()
-        self.assertTrue(
-            NodeFeatureAssignment.objects.filter(
-                node=self.node, feature=feature
-            ).exists()
+        self.client.force_login(self.superuser)
+
+        self.log_file = Path(settings.LOG_DIR) / settings.LOG_FILE_NAME
+        self.log_file.parent.mkdir(parents=True, exist_ok=True)
+        self._original_log_contents: str | None = None
+        if self.log_file.exists():
+            self._original_log_contents = self.log_file.read_text(encoding="utf-8")
+        self.addCleanup(self._restore_log_file)
+
+        PeriodicTask.objects.all().delete()
+
+    def _restore_log_file(self):
+        if self._original_log_contents is None:
+            try:
+                self.log_file.unlink()
+            except FileNotFoundError:
+                pass
+        else:
+            self.log_file.write_text(
+                self._original_log_contents, encoding="utf-8"
+            )
+
+    def test_report_includes_tasks_and_logs(self):
+        now = timezone.now()
+        schedule = IntervalSchedule.objects.create(
+            every=1, period=IntervalSchedule.HOURS
+        )
+        PeriodicTask.objects.create(
+            name="test-task",
+            task="core.tasks.heartbeat",
+            interval=schedule,
+            enabled=True,
+            last_run_at=now - timedelta(minutes=30),
         )
 
-    @patch("nodes.models.Node._uses_postgres", side_effect=[True, False])
-    def test_postgres_removed_when_not_in_use(self, mock_postgres):
-        feature = NodeFeature.objects.create(
-            slug="postgres-db", display="PostgreSQL Database"
+        localized = timezone.localtime(now)
+        log_line = (
+            f"{localized.strftime('%Y-%m-%d %H:%M:%S,%f')} "
+            "[INFO] core.tasks: Heartbeat task executed\n"
         )
-        feature.roles.add(self.role)
-        with patch(
-            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
-        ):
-            self.node.refresh_features()
-        self.assertTrue(
-            NodeFeatureAssignment.objects.filter(
-                node=self.node, feature=feature
-            ).exists()
+        self.log_file.write_text(log_line, encoding="utf-8")
+
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_celery_report")
         )
-        with patch(
-            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
-        ):
-            self.node.refresh_features()
-        self.assertFalse(
-            NodeFeatureAssignment.objects.filter(
-                node=self.node, feature=feature
-            ).exists()
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Celery Report")
+        self.assertContains(response, "test-task")
+        self.assertContains(response, settings.LOG_FILE_NAME)
+        entries = response.context_data["log_entries"]
+        self.assertTrue(
+            any("Heartbeat task executed" in entry.message for entry in entries)
         )