arthexis 0.1.12__py3-none-any.whl → 0.1.13__py3-none-any.whl

nodes/tests.py

@@ -34,6 +34,7 @@ from django.test import Client, SimpleTestCase, TestCase, TransactionTestCase, o
 from django.urls import reverse
 from django.contrib.auth import get_user_model
 from django.contrib import admin
+from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
 from django_celery_beat.models import IntervalSchedule, PeriodicTask
 from django.conf import settings
@@ -60,7 +61,7 @@ from .backends import OutboxEmailBackend
 from .tasks import capture_node_screenshot, sample_clipboard
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.primitives import serialization, hashes
-from core.models import PackageRelease, SecurityGroup
+from core.models import Package, PackageRelease, SecurityGroup, RFID
 
 
 class NodeBadgeColorTests(TestCase):
@@ -122,6 +123,32 @@ class NodeGetLocalDatabaseUnavailableTests(SimpleTestCase):
 
 
 class NodeGetLocalTests(TestCase):
+    def test_normalize_relation_handles_various_inputs(self):
+        self.assertEqual(
+            Node.normalize_relation(Node.Relation.UPSTREAM),
+            Node.Relation.UPSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation(None),
+            Node.Relation.PEER,
+        )
+        self.assertEqual(
+            Node.normalize_relation("Upstream"),
+            Node.Relation.UPSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation("DOWNSTREAM"),
+            Node.Relation.DOWNSTREAM,
+        )
+        self.assertEqual(
+            Node.normalize_relation("peer"),
+            Node.Relation.PEER,
+        )
+        self.assertEqual(
+            Node.normalize_relation("unexpected"),
+            Node.Relation.PEER,
+        )
+
     def test_register_current_does_not_create_release(self):
         node = None
         created = False
@@ -245,6 +272,41 @@ class NodeGetLocalTests(TestCase):
         hostnames = {n["hostname"] for n in data["nodes"]}
         self.assertEqual(hostnames, {"dup", "local2"})
 
+    def test_register_node_generates_unique_public_endpoint(self):
+        url = reverse("register-node")
+        User = get_user_model()
+        user = User.objects.create_user(username="registrar", password="pwd")
+        self.client.force_login(user)
+        first = self.client.post(
+            url,
+            data={
+                "hostname": "duplicate-host",
+                "address": "10.0.0.10",
+                "port": 8080,
+                "mac_address": "00:11:22:33:aa:bb",
+            },
+            content_type="application/json",
+        )
+        self.assertEqual(first.status_code, 200)
+        node_one = Node.objects.get(mac_address="00:11:22:33:aa:bb")
+        self.assertEqual(node_one.public_endpoint, "duplicate-host")
+
+        second = self.client.post(
+            url,
+            data={
+                "hostname": "duplicate-host",
+                "address": "10.0.0.11",
+                "port": 8081,
+                "mac_address": "00:11:22:33:aa:cc",
+            },
+            content_type="application/json",
+        )
+        self.assertEqual(second.status_code, 200)
+        node_two = Node.objects.get(mac_address="00:11:22:33:aa:cc")
+
+        self.assertNotEqual(node_one.public_endpoint, node_two.public_endpoint)
+        self.assertTrue(node_two.public_endpoint.startswith("duplicate-host-"))
+
     def test_register_node_feature_toggle(self):
         NodeFeature.objects.get_or_create(
             slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
@@ -341,6 +403,48 @@ class NodeGetLocalTests(TestCase):
         self.assertEqual(subject, "UP friend")
         self.assertEqual(body, "v2.0.0 r123456")
 
+    def test_register_node_marks_nonrelease_version(self):
+        package = Package.objects.create(name="pkg-node", is_active=False)
+        PackageRelease.objects.create(
+            package=package,
+            version="2.0.0",
+            revision="0" * 40,
+        )
+
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:11",
+            installed_version="1.0.0",
+            installed_revision="rev-old",
+        )
+        user = get_user_model().objects.create_user(
+            username="node-registrar", password="pwd"
+        )
+        self.client.force_login(user)
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:11",
+            "installed_version": "2.0.0",
+            "installed_revision": "1" * 40,
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.0.0")
+        self.assertEqual(node.installed_revision, "1" * 40)
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0+ r111111")
+
     def test_register_node_update_without_version_change_still_notifies(self):
         node = Node.objects.create(
             hostname="friend",
@@ -534,6 +638,64 @@ class NodeGetLocalTests(TestCase):
         self.assertEqual(node.current_relation, Node.Relation.UPSTREAM)
 
 
+class RegisterVisitorNodeMessageTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        User = get_user_model()
+        self.user = User.objects.create_user(username="visitor", password="pwd")
+        self.client.force_login(self.user)
+        self.role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        self.visitor = Node.objects.create(
+            hostname="visitor-node",
+            address="10.0.0.100",
+            port=8000,
+            mac_address="00:10:20:30:40:50",
+            role=self.role,
+        )
+
+    def test_register_node_emits_join_message_when_upstream_added(self):
+        payload = {
+            "hostname": "host-node",
+            "address": "10.0.0.10",
+            "port": 8100,
+            "mac_address": "aa:bb:cc:dd:ee:01",
+            "current_relation": "Upstream",
+        }
+        with patch("nodes.views.Node.get_local", return_value=self.visitor), patch.object(
+            NetMessage, "broadcast"
+        ) as mock_broadcast:
+            response = self.client.post(
+                reverse("register-node"),
+                data=json.dumps(payload),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_broadcast.assert_called_once_with(
+            subject="NODE visitor-node", body="JOINS host-node"
+        )
+
+    def test_register_node_skips_message_when_not_upstream(self):
+        payload = {
+            "hostname": "remote-node",
+            "address": "10.0.0.11",
+            "port": 8101,
+            "mac_address": "aa:bb:cc:dd:ee:02",
+            "current_relation": "Downstream",
+        }
+        with patch("nodes.views.Node.get_local", return_value=self.visitor), patch.object(
+            NetMessage, "broadcast"
+        ) as mock_broadcast:
+            response = self.client.post(
+                reverse("register-node"),
+                data=json.dumps(payload),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_broadcast.assert_not_called()
+
+
 class NodeRegisterCurrentTests(TestCase):
     def setUp(self):
         User = get_user_model()
@@ -845,6 +1007,17 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:cc",
             public_key=public_key,
         )
+        target_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="net-message", defaults={"display": "Net Message"}
+        )
+        target = Node.objects.create(
+            hostname="target",
+            address="10.0.0.2",
+            port=8001,
+            mac_address="00:11:22:33:44:dd",
+            role=target_role,
+        )
         msg_id = str(uuid.uuid4())
         payload = {
             "uuid": msg_id,
@@ -853,6 +1026,12 @@ class NodeRegisterCurrentTests(TestCase):
             "seen": [],
             "sender": str(sender.uuid),
             "origin": str(sender.uuid),
+            "filter_node": str(target.uuid),
+            "filter_node_feature": feature.slug,
+            "filter_node_role": target_role.name,
+            "filter_current_relation": Node.Relation.UPSTREAM,
+            "filter_installed_version": "1.0.0",
+            "filter_installed_revision": "rev123",
         }
         payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
         signature = key.sign(payload_json.encode(), padding.PKCS1v15(), hashes.SHA256())
@@ -866,6 +1045,12 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertTrue(NetMessage.objects.filter(uuid=msg_id).exists())
         message = NetMessage.objects.get(uuid=msg_id)
         self.assertEqual(message.node_origin, sender)
+        self.assertEqual(message.filter_node, target)
+        self.assertEqual(message.filter_node_feature, feature)
+        self.assertEqual(message.filter_node_role, target_role)
+        self.assertEqual(message.filter_current_relation, Node.Relation.UPSTREAM)
+        self.assertEqual(message.filter_installed_version, "1.0.0")
+        self.assertEqual(message.filter_installed_revision, "rev123")
 
     def test_clipboard_polling_creates_task(self):
         feature, _ = NodeFeature.objects.get_or_create(
@@ -944,6 +1129,18 @@ class NodeAdminTests(TestCase):
         action_url = reverse("admin:core_rfid_scan")
         self.assertContains(response, f'href="{action_url}"')
 
+    def test_node_feature_list_shows_all_actions_for_rpi_camera(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        response = self.client.get(reverse("admin:nodes_nodefeature_changelist"))
+        snapshot_url = reverse("admin:nodes_nodefeature_take_snapshot")
+        stream_url = reverse("admin:nodes_nodefeature_view_stream")
+        self.assertContains(response, f'href="{snapshot_url}"')
+        self.assertContains(response, f'href="{stream_url}"')
+
     def test_node_feature_list_hides_default_action_when_disabled(self):
         self._create_local_node()
         NodeFeature.objects.get_or_create(
@@ -1010,6 +1207,34 @@ class NodeAdminTests(TestCase):
         )
         self.assertIn(node.public_key.strip(), resp.content.decode())
 
+    def test_register_current_requires_superuser(self):
+        User = get_user_model()
+        staff = User.objects.create_user(
+            username="staff", password="pass", is_staff=True
+        )
+        permission = Permission.objects.get(codename="view_node")
+        staff.user_permissions.add(permission)
+        self.client.force_login(staff)
+
+        response = self.client.get(reverse("admin:nodes_node_register_current"))
+
+        self.assertEqual(response.status_code, 403)
+
+    def test_register_current_link_hidden_for_non_superusers(self):
+        User = get_user_model()
+        staff = User.objects.create_user(
+            username="linkstaff", password="pass", is_staff=True
+        )
+        permission = Permission.objects.get(codename="view_node")
+        staff.user_permissions.add(permission)
+        self.client.force_login(staff)
+
+        response = self.client.get(reverse("admin:nodes_node_changelist"))
+
+        self.assertNotContains(
+            response, reverse("admin:nodes_node_register_current")
+        )
+
     @patch("nodes.admin.capture_screenshot")
     def test_capture_site_screenshot_from_admin(self, mock_capture_screenshot):
         screenshot_dir = settings.LOG_DIR / "screenshots"
@@ -1241,6 +1466,195 @@ class NodeAdminTests(TestCase):
         change_url = reverse("admin:nodes_contentsample_change", args=[sample.pk])
         self.assertEqual(response.redirect_chain[-1][0], change_url)
 
+    def test_view_stream_requires_enabled_feature(self):
+        self._create_local_node()
+        NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        response = self.client.get(
+            reverse("admin:nodes_nodefeature_view_stream"), follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        changelist_url = reverse("admin:nodes_nodefeature_changelist")
+        self.assertEqual(response.wsgi_request.path, changelist_url)
+        self.assertContains(
+            response, "Raspberry Pi Camera feature is not enabled on this node."
+        )
+
+    def test_view_stream_renders_when_feature_enabled(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        response = self.client.get(reverse("admin:nodes_nodefeature_view_stream"))
+        self.assertEqual(response.status_code, 200)
+        response.render()
+        expected_stream = "http://testserver:8554/"
+        self.assertEqual(response.context_data["stream_url"], expected_stream)
+        self.assertContains(response, expected_stream)
+        self.assertContains(response, "camera-stream__frame")
+
+    def test_view_stream_uses_configured_stream_url(self):
+        node = self._create_local_node()
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rpi-camera", defaults={"display": "Raspberry Pi Camera"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        configured_stream = "https://camera.local/stream"
+        with self.settings(RPI_CAMERA_STREAM_URL=configured_stream):
+            response = self.client.get(
+                reverse("admin:nodes_nodefeature_view_stream")
+            )
+        self.assertEqual(response.status_code, 200)
+        response.render()
+        self.assertEqual(response.context_data["stream_url"], configured_stream)
+        self.assertContains(response, configured_stream)
+
+    @patch("nodes.admin.requests.post")
+    def test_fetch_rfids_action_fetches_and_imports(self, mock_post):
+        local = self._create_local_node()
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        private_bytes = key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+        public_bytes = key.public_key().public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+        security_dir = Path(settings.BASE_DIR) / "security"
+        security_dir.mkdir(parents=True, exist_ok=True)
+        (security_dir / f"{local.public_endpoint}").write_bytes(private_bytes)
+        (security_dir / f"{local.public_endpoint}.pub").write_bytes(public_bytes)
+        local.public_key = public_bytes.decode()
+        local.save(update_fields=["public_key"])
+
+        remote = Node.objects.create(
+            hostname="remote",
+            address="127.0.0.2",
+            port=8010,
+            mac_address="aa:bb:cc:dd:ee:ff",
+        )
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "rfids": [
+                {
+                    "rfid": "abc123",
+                    "custom_label": "Remote tag",
+                    "key_a": "A1B2C3D4E5F6",
+                    "key_b": "FFFFFFFFFFFF",
+                    "data": ["sector"],
+                    "key_a_verified": True,
+                    "key_b_verified": False,
+                    "allowed": True,
+                    "color": RFID.BLACK,
+                    "kind": RFID.CLASSIC,
+                    "released": False,
+                    "last_seen_on": None,
+                }
+            ]
+        }
+        mock_response.text = ""
+        mock_post.return_value = mock_response
+
+        response = self.client.post(
+            reverse("admin:nodes_node_changelist"),
+            {"action": "fetch_rfids", "_selected_action": [str(remote.pk)]},
+            follow=True,
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(RFID.objects.filter(rfid="ABC123").exists())
+        tag = RFID.objects.get(rfid="ABC123")
+        self.assertEqual(tag.custom_label, "Remote tag")
+        self.assertEqual(tag.origin_node, remote)
+        self.assertEqual(tag.data, ["sector"])
+
+        self.assertTrue(mock_post.called)
+        call_kwargs = mock_post.call_args.kwargs
+        payload = call_kwargs["data"]
+        headers = call_kwargs["headers"]
+        signature = base64.b64decode(headers["X-Signature"])
+        key.public_key().verify(
+            signature,
+            payload.encode(),
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+        self.assertContains(response, "Fetched RFIDs from 1 node(s)")
+
+
+class RFIDExportViewTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        NodeRole.objects.get_or_create(name="Terminal")
+        self.local_node = Node.objects.create(
+            hostname="local",
+            address="127.0.0.1",
+            port=8000,
+            mac_address=Node.get_current_mac(),
+        )
+        self.remote_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        self.remote_public = (
+            self.remote_key.public_key()
+            .public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            .decode()
+        )
+        self.remote_node = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.2",
+            port=8100,
+            mac_address="00:11:22:33:44:55",
+            public_key=self.remote_public,
+        )
+
+    def _sign_payload(self, payload):
+        payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
+        signature = self.remote_key.sign(
+            payload_json.encode(),
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+        return payload_json, base64.b64encode(signature).decode()
+
+    def test_export_requires_signature(self):
+        payload_json = json.dumps(
+            {"requester": str(self.remote_node.uuid)},
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+        response = self.client.post(
+            reverse("node-rfid-export"),
+            data=payload_json,
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_export_returns_serialized_data(self):
+        RFID.objects.create(rfid="ABCDEF")
+        payload_json, signature = self._sign_payload(
+            {"requester": str(self.remote_node.uuid)}
+        )
+        response = self.client.post(
+            reverse("node-rfid-export"),
+            data=payload_json,
+            content_type="application/json",
+            HTTP_X_SIGNATURE=signature,
+        )
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertIn("rfids", body)
+        self.assertEqual(len(body["rfids"]), 1)
+        tag_data = body["rfids"][0]
+        self.assertEqual(tag_data["rfid"], "ABCDEF")
+        self.assertIn("custom_label", tag_data)
+
 
 class NetMessageAdminTests(TransactionTestCase):
     reset_sequences = True
@@ -1273,6 +1687,27 @@ class NetMessageAdminTests(TransactionTestCase):
         self.assertEqual(response.status_code, 302)
         mock_propagate.assert_called_once()
 
+    def test_reply_action_prefills_initial_data(self):
+        role = NodeRole.objects.get(name="Terminal")
+        node = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.10",
+            port=8100,
+            mac_address="00:11:22:33:44:55",
+            role=role,
+        )
+        original = NetMessage.objects.create(
+            subject="Ping",
+            body="Hello",
+            node_origin=node,
+        )
+        url = f"{reverse('admin:nodes_netmessage_add')}?reply_to={original.pk}"
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        form = response.context_data["adminform"].form
+        self.assertEqual(form["subject"].value(), "Re: Ping")
+        self.assertEqual(str(form["filter_node"].value()), str(node.pk))
+
 
 class LastNetMessageViewTests(TestCase):
     def setUp(self):
@@ -1281,10 +1716,19 @@ class LastNetMessageViewTests(TestCase):
 
     def test_returns_latest_message(self):
         NetMessage.objects.create(subject="old", body="msg1")
-        NetMessage.objects.create(subject="new", body="msg2")
+        latest = NetMessage.objects.create(subject="new", body="msg2")
         resp = self.client.get(reverse("last-net-message"))
         self.assertEqual(resp.status_code, 200)
-        self.assertEqual(resp.json(), {"subject": "new", "body": "msg2"})
+        self.assertEqual(
+            resp.json(),
+            {
+                "subject": "new",
+                "body": "msg2",
+                "admin_url": reverse(
+                    "admin:nodes_netmessage_change", args=[latest.pk]
+                ),
+            },
+        )
 
 
 class NetMessageReachTests(TestCase):
@@ -1345,8 +1789,10 @@ class NetMessageReachTests(TestCase):
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
-        self.assertEqual(roles, {"Constellation", "Satellite", "Control"})
-        self.assertEqual(mock_post.call_count, 3)
+        self.assertEqual(
+            roles, {"Constellation", "Satellite", "Control", "Terminal"}
+        )
+        self.assertEqual(mock_post.call_count, 4)
 
     @patch("requests.post")
     def test_default_reach_not_limited_to_terminal(self, mock_post):
@@ -1357,7 +1803,105 @@ class NetMessageReachTests(TestCase):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
         self.assertIn("Control", roles)
-        self.assertEqual(mock_post.call_count, 3)
+        self.assertEqual(mock_post.call_count, 4)
+
+
+class NetMessageFilterTests(TestCase):
+    def setUp(self):
+        self.terminal_role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        self.control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        self.nodes = {
+            "terminal": Node.objects.create(
+                hostname="terminal-filter",
+                address="10.20.0.1",
+                port=8020,
+                mac_address="00:11:22:33:55:01",
+                role=self.terminal_role,
+            ),
+            "control": Node.objects.create(
+                hostname="control-filter",
+                address="10.20.0.2",
+                port=8021,
+                mac_address="00:11:22:33:55:02",
+                role=self.control_role,
+            ),
+        }
+        self.feature, _ = NodeFeature.objects.get_or_create(
+            slug="filter-test", defaults={"display": "Filter Test"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(
+            node=self.nodes["control"], feature=self.feature
+        )
+        self.nodes["control"].current_relation = Node.Relation.UPSTREAM
+        self.nodes["control"].installed_version = "1.2.3"
+        self.nodes["control"].installed_revision = "abc123"
+        self.nodes["control"].save(
+            update_fields=[
+                "current_relation",
+                "installed_version",
+                "installed_revision",
+            ]
+        )
+
+    @patch("requests.post")
+    def test_filter_node_limits_targets(self, mock_post):
+        msg = NetMessage.objects.create(
+            subject="s", body="b", filter_node=self.nodes["control"]
+        )
+        with patch.object(Node, "get_local", return_value=None):
+            msg.propagate()
+        self.assertEqual(
+            list(msg.propagated_to.values_list("pk", flat=True)),
+            [self.nodes["control"].pk],
+        )
+        mock_post.assert_called_once()
+
+    @patch("requests.post")
+    def test_filter_fields_limit_queryset(self, mock_post):
+        msg = NetMessage.objects.create(
+            subject="s",
+            body="b",
+            filter_node_feature=self.feature,
+            filter_node_role=self.control_role,
+            filter_current_relation=Node.Relation.UPSTREAM,
+            filter_installed_version="1.2.3",
+            filter_installed_revision="abc123",
+        )
+        with patch.object(Node, "get_local", return_value=None):
+            msg.propagate()
+        self.assertEqual(
+            list(msg.propagated_to.values_list("pk", flat=True)),
+            [self.nodes["control"].pk],
+        )
+        mock_post.assert_called_once()
+
+
+class NetMessageBroadcastStringReachTests(TestCase):
+    def test_broadcast_uses_role_lookup_for_string_reach(self):
+        role = NodeRole.objects.create(name="Terminal")
+        local = Node.objects.create(
+            hostname="terminal-local",
+            address="10.10.0.1",
+            port=8010,
+            mac_address="00:aa:bb:cc:dd:ff",
+            role=role,
+            public_endpoint="terminal-local",
+        )
+        seen = ["existing"]
+
+        with patch.object(Node, "get_local", return_value=local), patch.object(
+            NetMessage, "propagate"
+        ) as mock_propagate:
+            msg = NetMessage.broadcast(
+                "Subject", "Body", reach="Terminal", seen=seen
+            )
+
+        self.assertEqual(msg.reach, role)
+        self.assertEqual(msg.node_origin, local)
+        mock_propagate.assert_called_once()
+        called_args = mock_propagate.call_args
+        self.assertIn("seen", called_args.kwargs)
+        self.assertIs(called_args.kwargs["seen"], seen)
 
 
 class NetMessagePropagationTests(TestCase):
@@ -1412,6 +1956,29 @@ class NetMessagePropagationTests(TestCase):
         self.assertEqual(msg.propagated_to.count(), 4)
         self.assertTrue(msg.complete)
 
+    @patch("requests.post")
+    @patch("core.notifications.notify", return_value=False)
+    def test_propagate_defaults_to_six_when_available(
+        self, mock_notify, mock_post
+    ):
+        for idx in range(6, 12):
+            self.remotes.append(
+                Node.objects.create(
+                    hostname=f"n{idx}",
+                    address=f"10.0.0.{idx}",
+                    port=8000 + idx,
+                    mac_address=f"00:11:22:33:44:{idx:02x}",
+                    role=self.role,
+                    public_endpoint=f"n{idx}",
+                )
+            )
+        msg = NetMessage.objects.create(subject="s", body="b", reach=self.role)
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg.propagate()
+        self.assertEqual(mock_post.call_count, 6)
+        self.assertEqual(msg.propagated_to.count(), 6)
+        self.assertFalse(msg.complete)
+
     @patch("requests.post")
     @patch("core.notifications.notify", return_value=True)
     def test_propagate_prunes_old_local_messages(self, mock_notify, mock_post):
@@ -1545,6 +2112,36 @@ class StartupNotificationTests(TestCase):
         self.assertEqual(kwargs["subject"], "host:9000")
         self.assertTrue(kwargs["body"].startswith("1.2.3 r"))
 
+    def test_startup_notification_marks_nonrelease_version(self):
+        from nodes.apps import _startup_notification
+
+        package = Package.objects.create(name="pkg-start", is_active=False)
+        PackageRelease.objects.create(
+            package=package,
+            version="1.2.3",
+            revision="0" * 40,
+        )
+
+        with TemporaryDirectory() as tmp:
+            tmp_path = Path(tmp)
+            (tmp_path / "VERSION").write_text("1.2.3")
+            with self.settings(BASE_DIR=tmp_path):
+                with patch(
+                    "nodes.apps.revision.get_revision", return_value="1" * 40
+                ):
+                    with patch("nodes.models.NetMessage.broadcast") as mock_broadcast:
+                        with patch(
+                            "nodes.apps.socket.gethostname", return_value="host"
+                        ):
+                            with patch.dict(os.environ, {"PORT": "9000"}):
+                                _startup_notification()
+                                time.sleep(0.1)
+
+        mock_broadcast.assert_called_once()
+        _, kwargs = mock_broadcast.call_args
+        self.assertEqual(kwargs["subject"], "host:9000")
+        self.assertEqual(kwargs["body"], "1.2.3+ r111111")
+
 
 class StartupHandlerTests(TestCase):
     def test_handler_logs_db_errors(self):
@@ -2001,24 +2598,39 @@ class NodeFeatureTests(TestCase):
         feature = NodeFeature.objects.create(
             slug="rfid-scanner", display="RFID Scanner"
         )
-        action = feature.get_default_action()
-        self.assertIsNotNone(action)
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 1)
+        action = actions[0]
         self.assertEqual(action.label, "Scan RFIDs")
         self.assertEqual(action.url_name, "admin:core_rfid_scan")
+        self.assertEqual(feature.get_default_action(), action)
 
     def test_celery_feature_default_action(self):
         feature = NodeFeature.objects.create(
             slug="celery-queue", display="Celery Queue"
         )
-        action = feature.get_default_action()
-        self.assertIsNotNone(action)
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 1)
+        action = actions[0]
         self.assertEqual(action.label, "Celery Report")
         self.assertEqual(action.url_name, "admin:nodes_nodefeature_celery_report")
+        self.assertEqual(feature.get_default_action(), action)
+
+    def test_rpi_camera_feature_has_multiple_actions(self):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        actions = feature.get_default_actions()
+        self.assertEqual(len(actions), 2)
+        labels = {action.label for action in actions}
+        self.assertIn("Take a Snapshot", labels)
+        self.assertIn("View stream", labels)
 
     def test_default_action_missing_when_unconfigured(self):
         feature = NodeFeature.objects.create(
             slug="custom-feature", display="Custom Feature"
         )
+        self.assertEqual(feature.get_default_actions(), ())
         self.assertIsNone(feature.get_default_action())
 
     def test_lcd_screen_enabled(self):
@@ -2035,6 +2647,13 @@ class NodeFeatureTests(TestCase):
         ):
             self.assertFalse(feature.is_enabled)
 
+    def test_feature_disabled_when_local_node_missing(self):
+        feature = NodeFeature.objects.create(slug="lcd-screen", display="LCD")
+        with patch("nodes.models.Node.get_local", return_value=None):
+            with patch("core.notifications.supports_gui_toast") as mock_toast:
+                self.assertFalse(feature.is_enabled)
+        mock_toast.assert_not_called()
+
     def test_rfid_scanner_lock(self):
         feature = NodeFeature.objects.create(slug="rfid-scanner", display="RFID")
         feature.roles.add(self.role)