arthexis 0.1.16__py3-none-any.whl → 0.1.28__py3-none-any.whl

pages/tests.py

@@ -3,23 +3,26 @@ import os
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
 
 import django
+import pytest
 
 django.setup()
 
 from django.test import Client, RequestFactory, TestCase, SimpleTestCase, override_settings
 from django.test.utils import CaptureQueriesContext
 from django.urls import reverse
+from django.shortcuts import resolve_url
 from django.templatetags.static import static
 from urllib.parse import quote
 from django.contrib.auth import get_user_model
 from django.contrib.sites.models import Site
-from django.contrib import admin
+from django.contrib import admin, messages
 from django.contrib.messages.storage.fallback import FallbackStorage
 from django.core.exceptions import DisallowedHost
 from django.core.cache import cache
 from django.db import connection
 import socket
 from django.db import connection
+from pages import site_config
 from pages.models import (
     Application,
     Landing,
@@ -32,6 +35,8 @@ from pages.models import (
     UserManual,
     UserStory,
 )
+from django.http import FileResponse
+
 from pages.admin import (
     ApplicationAdmin,
     UserManualAdmin,
@@ -47,31 +52,40 @@ from pages.screenshot_specs import (
 )
 from pages.context_processors import nav_links
 from django.apps import apps as django_apps
+from config.middleware import SiteHttpsRedirectMiddleware
 from core import mailer
 from core.admin import ProfileAdminMixin
 from core.models import (
     AdminHistory,
+    ClientReport,
     InviteLead,
     Package,
     Reference,
     RFID,
     ReleaseManager,
     SecurityGroup,
+    GoogleCalendarProfile,
     Todo,
     TOTPDeviceSettings,
 )
+from ocpp.models import Charger
 from django.core.files.uploadedfile import SimpleUploadedFile
 import base64
+import json
 import tempfile
 import shutil
+from datetime import timedelta
 from io import StringIO
 from django.conf import settings
+from django.utils import timezone
+from django.utils.html import escape
 from pathlib import Path
 from unittest.mock import MagicMock, Mock, call, patch
 from types import SimpleNamespace
 from django.core.management import call_command
 import re
 from django.contrib.contenttypes.models import ContentType
+from django.http import HttpResponse
 from datetime import (
     date,
     datetime,
@@ -82,6 +96,7 @@ from datetime import (
 from django.core import mail
 from django.utils import timezone
 from django.utils.text import slugify
+from django.utils import translation
 from django.utils.translation import gettext
 from django_otp import DEVICE_ID_SESSION_KEY
 from django_otp.oath import TOTP
@@ -96,6 +111,7 @@ from nodes.models import (
     NodeRole,
     NodeFeature,
     NodeFeatureAssignment,
+    NetMessage,
 )
 from django.contrib.auth.models import AnonymousUser
 
@@ -109,9 +125,26 @@ class LoginViewTests(TestCase):
         self.user = User.objects.create_user(username="user", password="pwd")
         Site.objects.update_or_create(id=1, defaults={"name": "Terminal"})
 
+    def _enable_rfid_scanner(self):
+        node, _ = Node.objects.get_or_create(
+            mac_address=Node.get_current_mac(),
+            defaults={"hostname": "local-node"},
+        )
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        NodeFeatureAssignment.objects.get_or_create(node=node, feature=feature)
+        return node
+
     def test_login_link_in_navbar(self):
         resp = self.client.get(reverse("pages:index"))
-        self.assertContains(resp, 'href="/login/"')
+        login_url = resolve_url(settings.LOGIN_URL)
+        self.assertContains(resp, f'href="{login_url}"')
+
+    @override_settings(LOGIN_URL="/staff/login/")
+    def test_login_link_uses_configured_login_url(self):
+        resp = self.client.get(reverse("pages:index"))
+        self.assertContains(resp, 'href="/staff/login/"')
 
     def test_login_page_shows_authenticator_toggle(self):
         resp = self.client.get(reverse("pages:login"))
@@ -187,6 +220,83 @@ class LoginViewTests(TestCase):
         )
         self.assertRedirects(resp, "/nodes/list/")
 
+    def test_login_page_shows_rfid_link_when_feature_enabled(self):
+        self._enable_rfid_scanner()
+        resp = self.client.get(reverse("pages:login"))
+        self.assertContains(resp, reverse("pages:rfid-login"))
+
+    def test_login_page_detects_rfid_lock_without_mac_address(self):
+        Node.objects.all().delete()
+        NodeFeature.objects.get_or_create(
+            slug="rfid-scanner", defaults={"display": "RFID Scanner"}
+        )
+        with tempfile.TemporaryDirectory() as tempdir:
+            locks_dir = Path(tempdir) / "locks"
+            locks_dir.mkdir()
+            (locks_dir / "rfid.lck").touch()
+            Node.objects.create(
+                hostname="local-node",
+                base_path=tempdir,
+                current_relation=Node.Relation.SELF,
+                mac_address=None,
+            )
+
+            resp = self.client.get(reverse("pages:login"))
+
+        self.assertContains(resp, reverse("pages:rfid-login"))
+
+    def test_rfid_login_page_requires_feature(self):
+        resp = self.client.get(reverse("pages:rfid-login"))
+        self.assertEqual(resp.status_code, 404)
+
+    def test_rfid_login_page_redirects_authenticated_user(self):
+        self._enable_rfid_scanner()
+        self.client.force_login(self.user)
+        resp = self.client.get(reverse("pages:rfid-login"))
+        self.assertRedirects(resp, "/")
+
+    def test_rfid_login_page_includes_scan_url(self):
+        self._enable_rfid_scanner()
+        resp = self.client.get(reverse("pages:rfid-login"))
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.context["login_api_url"], reverse("rfid-login"))
+        self.assertEqual(resp.context["scan_api_url"], reverse("rfid-scan-next"))
+
+    def test_homepage_excludes_version_banner_for_anonymous(self):
+        response = self.client.get(reverse("pages:index"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, "__versionCheckInitialized")
+
+    def test_homepage_includes_version_banner_for_staff(self):
+        self.client.force_login(self.staff)
+        response = self.client.get(reverse("pages:index"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "__versionCheckInitialized")
+
+
+class AdminTemplateVersionBannerTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        User = get_user_model()
+        self.staff = User.objects.create_user(
+            username="admin-staff", password="pwd", is_staff=True
+        )
+
+    def test_admin_login_excludes_version_banner_for_anonymous(self):
+        response = self.client.get(reverse("admin:login"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, "__versionCheckInitialized")
+
+    def test_admin_dashboard_includes_version_banner_for_staff(self):
+        self.client.force_login(self.staff)
+        response = self.client.get(reverse("admin:index"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "__versionCheckInitialized")
+
     def test_staff_redirects_next_when_specified(self):
         resp = self.client.post(
             reverse("pages:login") + "?next=/nodes/list/",
@@ -466,6 +576,23 @@ class InvitationTests(TestCase):
         self.assertEqual(lead.mac_address, "")
         self.assertEqual(len(mail.outbox), 0)
 
+    def test_request_invite_uses_original_referer(self):
+        InviteLead.objects.all().delete()
+        self.client.get(
+            reverse("pages:index"),
+            HTTP_REFERER="https://campaign.example/landing",
+        )
+
+        resp = self.client.post(
+            reverse("pages:request-invite"),
+            {"email": "origin@example.com"},
+            HTTP_REFERER="http://testserver/pages/request-invite/",
+        )
+
+        self.assertEqual(resp.status_code, 200)
+        lead = InviteLead.objects.get()
+        self.assertEqual(lead.referer, "https://campaign.example/landing")
+
     def test_request_invite_falls_back_to_send_mail(self):
         node = Node.objects.create(
             hostname="local", address="127.0.0.1", mac_address="00:11:22:33:44:55"
@@ -501,6 +628,7 @@ class InvitationTests(TestCase):
         lead = InviteLead.objects.get()
         self.assertEqual(lead.mac_address, "aa:bb:cc:dd:ee:ff")
 
+    @pytest.mark.feature("ap-router")
     @patch("pages.views.public_wifi.grant_public_access")
     @patch(
         "pages.views.public_wifi.resolve_mac_address",
@@ -659,7 +787,7 @@ class AdminDashboardAppListTests(TestCase):
                 "hostname": socket.gethostname(),
                 "address": socket.gethostbyname(socket.gethostname()),
                 "base_path": settings.BASE_DIR,
-                "port": 8000,
+                "port": 8888,
             },
         )
         self.node.features.clear()
@@ -672,19 +800,36 @@ class AdminDashboardAppListTests(TestCase):
 
     def test_horologia_hidden_without_celery_feature(self):
         resp = self.client.get(reverse("admin:index"))
-        self.assertNotContains(resp, "5. Horologia MODELS")
+        self.assertNotContains(resp, "5. Horologia</a>")
 
     def test_horologia_visible_with_celery_feature(self):
         feature = NodeFeature.objects.create(slug="celery-queue", display="Celery Queue")
         NodeFeatureAssignment.objects.create(node=self.node, feature=feature)
         resp = self.client.get(reverse("admin:index"))
-        self.assertContains(resp, "5. Horologia MODELS")
+        self.assertContains(resp, "5. Horologia</a>")
 
     def test_horologia_visible_with_celery_lock(self):
         self.celery_lock.write_text("")
         resp = self.client.get(reverse("admin:index"))
-        self.assertContains(resp, "5. Horologia MODELS")
+        self.assertContains(resp, "5. Horologia</a>")
+
+    def test_dashboard_shows_last_net_message(self):
+        NetMessage.objects.all().delete()
+        NetMessage.objects.create(subject="Older", body="First body")
+        NetMessage.objects.create(subject="Latest", body="Signal ready")
+
+        resp = self.client.get(reverse("admin:index"))
+
+        self.assertContains(resp, gettext("Net message"))
+        self.assertContains(resp, "Latest — Signal ready")
+        self.assertNotContains(resp, gettext("No net messages available"))
+
+    def test_dashboard_shows_placeholder_without_net_message(self):
+        NetMessage.objects.all().delete()
+
+        resp = self.client.get(reverse("admin:index"))
 
+        self.assertContains(resp, gettext("No net messages available"))
 
 class AdminSidebarTests(TestCase):
     def setUp(self):
@@ -707,6 +852,66 @@ class AdminSidebarTests(TestCase):
         self.assertContains(resp, 'id="admin-collapsible-apps"')
 
 
+class AdminGoogleCalendarSidebarTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        User = get_user_model()
+        self.admin = User.objects.create_superuser(
+            username="calendar_admin", password="pwd", email="admin@example.com"
+        )
+        self.client.force_login(self.admin)
+        Site.objects.update_or_create(
+            id=1, defaults={"name": "test", "domain": "testserver"}
+        )
+        Node.objects.create(hostname="testserver", address="127.0.0.1")
+
+    def test_calendar_module_hidden_without_profile(self):
+        resp = self.client.get(reverse("admin:index"))
+        self.assertNotContains(resp, 'id="google-calendar-module"', html=False)
+
+    @patch("core.models.GoogleCalendarProfile.fetch_events")
+    def test_calendar_module_shows_events_for_user(self, fetch_events):
+        fetch_events.return_value = [
+            {
+                "summary": "Standup",
+                "start": timezone.now(),
+                "end": None,
+                "all_day": False,
+                "html_link": "https://calendar.google.com/event",
+                "location": "HQ",
+            }
+        ]
+        GoogleCalendarProfile.objects.create(
+            user=self.admin,
+            calendar_id="example@group.calendar.google.com",
+            api_key="secret",
+            display_name="Team Calendar",
+        )
+
+        resp = self.client.get(reverse("admin:index"))
+
+        self.assertContains(resp, 'id="google-calendar-module"', html=False)
+        self.assertContains(resp, "Standup")
+        self.assertContains(resp, "Open full calendar")
+        fetch_events.assert_called_once()
+
+    @patch("core.models.GoogleCalendarProfile.fetch_events")
+    def test_calendar_module_uses_group_profile(self, fetch_events):
+        fetch_events.return_value = []
+        group = SecurityGroup.objects.create(name="Calendar Group")
+        self.admin.groups.add(group)
+        GoogleCalendarProfile.objects.create(
+            group=group,
+            calendar_id="group@calendar.google.com",
+            api_key="secret",
+        )
+
+        resp = self.client.get(reverse("admin:index"))
+
+        self.assertContains(resp, 'id="google-calendar-module"', html=False)
+        fetch_events.assert_called_once()
+
+
 class ViewHistoryLoggingTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -715,8 +920,11 @@ class ViewHistoryLoggingTests(TestCase):
 
     def _reset_purge_task(self):
         from django_celery_beat.models import PeriodicTask
+        from core.celery_utils import periodic_task_name_variants
 
-        PeriodicTask.objects.filter(name="pages_purge_landing_leads").delete()
+        PeriodicTask.objects.filter(
+            name__in=periodic_task_name_variants("pages_purge_landing_leads")
+        ).delete()
 
     def _create_local_node(self):
         node, _ = Node.objects.update_or_create(
@@ -725,7 +933,7 @@ class ViewHistoryLoggingTests(TestCase):
                 "hostname": socket.gethostname(),
                 "address": "127.0.0.1",
                 "base_path": settings.BASE_DIR,
-                "port": 8000,
+                "port": 8888,
             },
         )
         return node
@@ -795,7 +1003,8 @@ class ViewHistoryLoggingTests(TestCase):
         )
         landing = module.landings.get(path="/")
         landing.label = "Home Landing"
-        landing.save(update_fields=["label"])
+        landing.track_leads = True
+        landing.save(update_fields=["label", "track_leads"])
 
         resp = self.client.get(
             reverse("pages:index"), HTTP_REFERER="https://example.com/ref"
@@ -807,6 +1016,35 @@ class ViewHistoryLoggingTests(TestCase):
         self.assertEqual(lead.path, "/")
         self.assertEqual(lead.referer, "https://example.com/ref")
 
+    def test_pages_config_purges_old_view_history(self):
+        ViewHistory.objects.all().delete()
+
+        old_entry = ViewHistory.objects.create(
+            path="/old/",
+            method="GET",
+            status_code=200,
+            status_text="OK",
+        )
+        new_entry = ViewHistory.objects.create(
+            path="/recent/",
+            method="GET",
+            status_code=200,
+            status_text="OK",
+        )
+
+        ViewHistory.objects.filter(pk=old_entry.pk).update(
+            visited_at=timezone.now() - timedelta(days=20)
+        )
+        ViewHistory.objects.filter(pk=new_entry.pk).update(
+            visited_at=timezone.now() - timedelta(days=10)
+        )
+
+        config = django_apps.get_app_config("pages")
+        config._purge_view_history()
+
+        self.assertFalse(ViewHistory.objects.filter(pk=old_entry.pk).exists())
+        self.assertTrue(ViewHistory.objects.filter(pk=new_entry.pk).exists())
+
     def test_landing_visit_does_not_record_lead_without_celery(self):
         role = NodeRole.objects.create(name="no-celery-role")
         application = Application.objects.create(
@@ -820,7 +1058,8 @@ class ViewHistoryLoggingTests(TestCase):
         )
         landing = module.landings.get(path="/")
         landing.label = "No Celery"
-        landing.save(update_fields=["label"])
+        landing.track_leads = True
+        landing.save(update_fields=["label", "track_leads"])
 
         resp = self.client.get(reverse("pages:index"))
 
@@ -840,7 +1079,8 @@ class ViewHistoryLoggingTests(TestCase):
         )
         landing = module.landings.get(path="/")
         landing.enabled = False
-        landing.save(update_fields=["enabled"])
+        landing.track_leads = True
+        landing.save(update_fields=["enabled", "track_leads"])
 
         resp = self.client.get(reverse("pages:index"))
 
@@ -902,6 +1142,44 @@ class ViewHistoryAdminTests(TestCase):
         self.assertEqual(totals.get("/"), 2)
         self.assertEqual(totals.get("/about/"), 1)
 
+    def test_graph_data_endpoint_respects_days_parameter(self):
+        ViewHistory.all_objects.all().delete()
+        reference_date = date(2025, 5, 1)
+        tz = timezone.get_current_timezone()
+        path = "/range/"
+
+        for offset in range(10):
+            entry = ViewHistory.objects.create(
+                path=path,
+                method="GET",
+                status_code=200,
+                status_text="OK",
+                error_message="",
+                view_name="pages:index",
+            )
+            visited_date = reference_date - timedelta(days=offset)
+            visited_at = timezone.make_aware(
+                datetime.combine(visited_date, datetime_time(12, 0)), tz
+            )
+            entry.visited_at = visited_at
+            entry.save(update_fields=["visited_at"])
+
+        url = reverse("admin:pages_viewhistory_traffic_data")
+        with patch("pages.admin.timezone.localdate", return_value=reference_date):
+            resp = self.client.get(url, {"days": 7})
+
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+
+        self.assertEqual(len(data.get("labels", [])), 7)
+        self.assertEqual(data.get("meta", {}).get("start"), (reference_date - timedelta(days=6)).isoformat())
+        self.assertEqual(data.get("meta", {}).get("end"), reference_date.isoformat())
+
+        totals = {
+            dataset["label"]: sum(dataset["data"]) for dataset in data.get("datasets", [])
+        }
+        self.assertEqual(totals.get(path), 7)
+
     def test_graph_data_includes_late_evening_visits(self):
         target_date = date(2025, 9, 27)
         entry = ViewHistory.objects.create(
@@ -964,7 +1242,7 @@ class LandingLeadAdminTests(TestCase):
                 "hostname": socket.gethostname(),
                 "address": "127.0.0.1",
                 "base_path": settings.BASE_DIR,
-                "port": 8000,
+                "port": 8888,
             },
         )
         self.node.features.clear()
@@ -972,8 +1250,11 @@ class LandingLeadAdminTests(TestCase):
 
     def _reset_purge_task(self):
         from django_celery_beat.models import PeriodicTask
+        from core.celery_utils import periodic_task_name_variants
 
-        PeriodicTask.objects.filter(name="pages_purge_landing_leads").delete()
+        PeriodicTask.objects.filter(
+            name__in=periodic_task_name_variants("pages_purge_landing_leads")
+        ).delete()
 
     def test_changelist_warns_without_celery(self):
         url = reverse("admin:pages_landinglead_changelist")
@@ -1109,6 +1390,50 @@ class LogViewerAdminTests(SimpleTestCase):
         self.assertEqual(context["selected_log"], "selected.log")
         self.assertIn("hello world", context["log_content"])
 
+    def test_log_viewer_applies_line_limit(self):
+        content = "\n".join(f"line {i}" for i in range(50))
+        self._create_log("limited.log", content)
+        response = self._render({"log": "limited.log", "limit": "20"})
+        context = response.context_data
+        self.assertEqual(context["log_limit_choice"], "20")
+        self.assertIn("line 49", context["log_content"])
+        self.assertIn("line 30", context["log_content"])
+        self.assertNotIn("line 29", context["log_content"])
+
+    def test_log_viewer_all_limit_returns_full_log(self):
+        content = "first\nsecond\nthird"
+        self._create_log("all.log", content)
+        response = self._render({"log": "all.log", "limit": "all"})
+        context = response.context_data
+        self.assertEqual(context["log_limit_choice"], "all")
+        self.assertIn("first", context["log_content"])
+        self.assertIn("second", context["log_content"])
+
+    def test_log_viewer_invalid_limit_defaults_to_20(self):
+        content = "\n".join(f"item {i}" for i in range(5))
+        self._create_log("invalid-limit.log", content)
+        response = self._render({"log": "invalid-limit.log", "limit": "oops"})
+        context = response.context_data
+        self.assertEqual(context["log_limit_choice"], "20")
+
+    def test_log_viewer_downloads_selected_log(self):
+        self._create_log("download.log", "downloadable content")
+        request = self._build_request({"log": "download.log", "download": "1"})
+        context = {
+            "site_title": "Constellation",
+            "site_header": "Constellation",
+            "site_url": "/",
+            "available_apps": [],
+        }
+        with patch("pages.admin.admin.site.each_context", return_value=context), patch(
+            "pages.context_processors.get_site", return_value=None
+        ):
+            response = log_viewer(request)
+        self.assertIsInstance(response, FileResponse)
+        self.assertIn("attachment", response["Content-Disposition"])
+        content = b"".join(response.streaming_content).decode()
+        self.assertIn("downloadable content", content)
+
     def test_log_viewer_reports_missing_log(self):
         response = self._render({"log": "missing.log"})
         self.assertIn("requested log could not be found", response.context_data["log_error"])
@@ -1145,15 +1470,131 @@ class AdminModelStatusTests(TestCase):
 
         Node.objects.create(hostname="testserver", address="127.0.0.1")
 
-    @patch("pages.templatetags.admin_extras.connection.introspection.table_names")
-    def test_status_dots_render(self, mock_tables):
-        from django.db import connection
-
-        tables = type(connection.introspection).table_names(connection.introspection)
-        mock_tables.return_value = [t for t in tables if t != "pages_module"]
+    def test_status_indicator_removed(self):
         resp = self.client.get(reverse("admin:index"))
-        self.assertContains(resp, 'class="model-status ok"')
-        self.assertContains(resp, 'class="model-status missing"', count=1)
+        self.assertNotContains(resp, "class=\"model-status")
+
+        changelist = self.client.get(reverse("admin:pages_application_changelist"))
+        self.assertNotContains(changelist, "class=\"model-status")
+
+
+class _FakeQuerySet(list):
+    def only(self, *args, **kwargs):
+        return self
+
+    def order_by(self, *args, **kwargs):
+        return self
+
+
+class SiteConfigurationStagingTests(SimpleTestCase):
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.tmpdir)
+        self.config_path = Path(self.tmpdir) / "nginx-sites.json"
+        self._path_patcher = patch(
+            "pages.site_config._sites_config_path", side_effect=lambda: self.config_path
+        )
+        self._path_patcher.start()
+        self.addCleanup(self._path_patcher.stop)
+        self._model_patcher = patch("pages.site_config.apps.get_model")
+        self.mock_get_model = self._model_patcher.start()
+        self.addCleanup(self._model_patcher.stop)
+
+    def _read_config(self):
+        if not self.config_path.exists():
+            return None
+        return json.loads(self.config_path.read_text(encoding="utf-8"))
+
+    def _set_sites(self, sites):
+        queryset = _FakeQuerySet(sites)
+
+        class _Manager:
+            @staticmethod
+            def filter(**kwargs):
+                return queryset
+
+        self.mock_get_model.return_value = SimpleNamespace(objects=_Manager())
+
+    def test_managed_site_persists_configuration(self):
+        self._set_sites([SimpleNamespace(domain="example.com", require_https=True)])
+        site_config.update_local_nginx_scripts()
+        config = self._read_config()
+        self.assertEqual(
+            config,
+            [
+                {
+                    "domain": "example.com",
+                    "require_https": True,
+                }
+            ],
+        )
+
+    def test_disabling_managed_site_removes_entry(self):
+        primary = SimpleNamespace(domain="primary.test", require_https=False)
+        secondary = SimpleNamespace(domain="secondary.test", require_https=False)
+        self._set_sites([primary, secondary])
+        site_config.update_local_nginx_scripts()
+        config = self._read_config()
+        self.assertEqual(
+            [entry["domain"] for entry in config],
+            ["primary.test", "secondary.test"],
+        )
+
+        self._set_sites([secondary])
+        site_config.update_local_nginx_scripts()
+        config = self._read_config()
+        self.assertEqual(config, [{"domain": "secondary.test", "require_https": False}])
+
+        self._set_sites([])
+        site_config.update_local_nginx_scripts()
+        self.assertIsNone(self._read_config())
+
+    def test_require_https_toggle_updates_configuration(self):
+        site = SimpleNamespace(domain="secure.example", require_https=False)
+        self._set_sites([site])
+        site_config.update_local_nginx_scripts()
+        config = self._read_config()
+        self.assertEqual(config, [{"domain": "secure.example", "require_https": False}])
+
+        site.require_https = True
+        self._set_sites([site])
+        site_config.update_local_nginx_scripts()
+        config = self._read_config()
+        self.assertEqual(config, [{"domain": "secure.example", "require_https": True}])
+
+
+class SiteRequireHttpsMiddlewareTests(SimpleTestCase):
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.middleware = SiteHttpsRedirectMiddleware(lambda request: HttpResponse("ok"))
+        self.secure_site = SimpleNamespace(domain="secure.test", require_https=True)
+
+    def test_http_request_redirects_to_https(self):
+        request = self.factory.get("/", HTTP_HOST="secure.test")
+        request.site = self.secure_site
+        response = self.middleware(request)
+        self.assertEqual(response.status_code, 301)
+        self.assertTrue(response["Location"].startswith("https://secure.test"))
+
+    def test_secure_request_not_redirected(self):
+        request = self.factory.get("/", HTTP_HOST="secure.test", secure=True)
+        request.site = self.secure_site
+        response = self.middleware(request)
+        self.assertEqual(response.status_code, 200)
+
+    def test_forwarded_proto_respected(self):
+        request = self.factory.get(
+            "/", HTTP_HOST="secure.test", HTTP_X_FORWARDED_PROTO="https"
+        )
+        request.site = self.secure_site
+        response = self.middleware(request)
+        self.assertEqual(response.status_code, 200)
+
+        self.secure_site.require_https = False
+        request = self.factory.get("/", HTTP_HOST="secure.test")
+        request.site = self.secure_site
+        response = self.middleware(request)
+        self.assertEqual(response.status_code, 200)
 
 
 class SiteAdminRegisterCurrentTests(TestCase):
@@ -1188,6 +1629,7 @@ class SiteAdminRegisterCurrentTests(TestCase):
         self.assertEqual(site.name, "")
 
 
+@pytest.mark.feature("screenshot-poll")
 class SiteAdminScreenshotTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -1307,17 +1749,17 @@ class NavAppsTests(TestCase):
         )
         app = Application.objects.create(name="Readme")
         Module.objects.create(
-            node_role=role, application=app, path="/", is_default=True
+            node_role=role, application=app, path="/", is_default=True, menu="Cookbooks"
         )
 
     def test_nav_pill_renders(self):
         resp = self.client.get(reverse("pages:index"))
-        self.assertContains(resp, "README")
+        self.assertContains(resp, "COOKBOOKS")
         self.assertContains(resp, "badge rounded-pill")
 
     def test_nav_pill_renders_with_port(self):
-        resp = self.client.get(reverse("pages:index"), HTTP_HOST="127.0.0.1:8000")
-        self.assertContains(resp, "README")
+        resp = self.client.get(reverse("pages:index"), HTTP_HOST="127.0.0.1:8888")
+        self.assertContains(resp, "COOKBOOKS")
 
     def test_nav_pill_uses_menu_field(self):
         site_app = Module.objects.get()
@@ -1325,7 +1767,7 @@ class NavAppsTests(TestCase):
         site_app.save()
         resp = self.client.get(reverse("pages:index"))
         self.assertContains(resp, 'badge rounded-pill text-bg-secondary">DOCS')
-        self.assertNotContains(resp, 'badge rounded-pill text-bg-secondary">README')
+        self.assertNotContains(resp, 'badge rounded-pill text-bg-secondary">COOKBOOKS')
 
     def test_app_without_root_url_excluded(self):
         role = NodeRole.objects.get(name="Terminal")
@@ -1390,20 +1832,22 @@ class RoleLandingRedirectTests(TestCase):
 
     def test_satellite_redirects_to_dashboard(self):
         target = self._configure_role_landing(
-            "Satellite", "/ocpp/", "CPMS Online Dashboard"
+            "Satellite", "/ocpp/cpms/dashboard/", "CPMS Online Dashboard"
         )
         resp = self.client.get(reverse("pages:index"))
         self.assertRedirects(resp, target, fetch_redirect_response=False)
 
     def test_control_redirects_to_rfid(self):
         target = self._configure_role_landing(
-            "Control", "/ocpp/rfid/", "RFID Tag Validator"
+            "Control", "/ocpp/rfid/validator/", "RFID Tag Validator"
         )
         resp = self.client.get(reverse("pages:index"))
         self.assertRedirects(resp, target, fetch_redirect_response=False)
 
     def test_security_group_redirect_takes_priority(self):
-        self._configure_role_landing("Control", "/ocpp/rfid/", "RFID Tag Validator")
+        self._configure_role_landing(
+            "Control", "/ocpp/rfid/validator/", "RFID Tag Validator"
+        )
         role = self.node.role
         group = SecurityGroup.objects.create(name="Operators")
         group_landing = self._ensure_landing(role, "/ocpp/group/", "Group Landing")
@@ -1420,7 +1864,9 @@ class RoleLandingRedirectTests(TestCase):
         )
 
     def test_user_redirect_overrides_group_with_higher_priority(self):
-        self._configure_role_landing("Control", "/ocpp/rfid/", "RFID Tag Validator")
+        self._configure_role_landing(
+            "Control", "/ocpp/rfid/validator/", "RFID Tag Validator"
+        )
         role = self.node.role
         group = SecurityGroup.objects.create(name="Operators")
         group_landing = self._ensure_landing(role, "/ocpp/group/", "Group Landing")
@@ -1442,10 +1888,10 @@ class RoleLandingRedirectTests(TestCase):
         )
 
 
-class ConstellationNavTests(TestCase):
+class WatchtowerNavTests(TestCase):
     def setUp(self):
         self.client = Client()
-        role, _ = NodeRole.objects.get_or_create(name="Constellation")
+        role, _ = NodeRole.objects.get_or_create(name="Watchtower")
         Node.objects.update_or_create(
             mac_address=Node.get_current_mac(),
             defaults={
@@ -1455,38 +1901,56 @@ class ConstellationNavTests(TestCase):
             },
         )
         Site.objects.update_or_create(
-            id=1, defaults={"domain": "testserver", "name": ""}
+            id=1, defaults={"domain": "arthexis.com", "name": "Arthexis"}
         )
         fixtures = [
             Path(
                 settings.BASE_DIR,
                 "pages",
                 "fixtures",
-                "constellation__application_ocpp.json",
+                "default__application_pages.json",
+            ),
+            Path(
+                settings.BASE_DIR,
+                "pages",
+                "fixtures",
+                "watchtower__application_ocpp.json",
+            ),
+            Path(
+                settings.BASE_DIR,
+                "pages",
+                "fixtures",
+                "watchtower__module_ocpp.json",
+            ),
+            Path(
+                settings.BASE_DIR,
+                "pages",
+                "fixtures",
+                "watchtower__landing_ocpp_dashboard.json",
             ),
             Path(
                 settings.BASE_DIR,
                 "pages",
                 "fixtures",
-                "constellation__module_ocpp.json",
+                "watchtower__landing_ocpp_cp_simulator.json",
             ),
             Path(
                 settings.BASE_DIR,
                 "pages",
                 "fixtures",
-                "constellation__landing_ocpp_dashboard.json",
+                "watchtower__landing_ocpp_rfid.json",
             ),
             Path(
                 settings.BASE_DIR,
                 "pages",
                 "fixtures",
-                "constellation__landing_ocpp_cp_simulator.json",
+                "watchtower__module_readme.json",
             ),
             Path(
                 settings.BASE_DIR,
                 "pages",
                 "fixtures",
-                "constellation__landing_ocpp_rfid.json",
+                "watchtower__landing_readme.json",
             ),
         ]
         call_command("loaddata", *map(str, fixtures))
@@ -1499,13 +1963,13 @@ class ConstellationNavTests(TestCase):
         self.assertNotIn("RFID", nav_labels)
         self.assertTrue(
             Module.objects.filter(
-                path="/ocpp/", node_role__name="Constellation"
+                path="/ocpp/", node_role__name="Watchtower"
             ).exists()
         )
         self.assertFalse(
             Module.objects.filter(
                 path="/ocpp/rfid/",
-                node_role__name="Constellation",
+                node_role__name="Watchtower",
                 is_deleted=False,
             ).exists()
         )
@@ -1517,9 +1981,16 @@ class ConstellationNavTests(TestCase):
         landing_labels = [landing.label for landing in ocpp_module.enabled_landings]
         self.assertIn("RFID Tag Validator", landing_labels)
 
+    @override_settings(ALLOWED_HOSTS=["testserver", "arthexis.com"])
+    def test_cookbooks_pill_visible_for_arthexis(self):
+        resp = self.client.get(
+            reverse("pages:index"), HTTP_HOST="arthexis.com"
+        )
+        self.assertContains(resp, 'badge rounded-pill text-bg-secondary">COOKBOOKS')
+
     def test_ocpp_dashboard_visible(self):
         resp = self.client.get(reverse("pages:index"))
-        self.assertContains(resp, 'href="/ocpp/"')
+        self.assertContains(resp, 'href="/ocpp/cpms/dashboard/"')
 
 
 class ReleaseModuleNavTests(TestCase):
@@ -1661,7 +2132,7 @@ class ControlNavTests(TestCase):
         self.client.force_login(user)
         resp = self.client.get(reverse("pages:index"))
         self.assertEqual(resp.status_code, 200)
-        self.assertContains(resp, 'href="/ocpp/"')
+        self.assertContains(resp, 'href="/ocpp/cpms/dashboard/"')
         self.assertContains(
             resp, 'badge rounded-pill text-bg-secondary">CHARGERS'
         )
@@ -1693,10 +2164,76 @@ class ControlNavTests(TestCase):
         self.assertFalse(resp.context["header_references"])
         self.assertNotContains(resp, "https://example.com/hidden")
 
+    def test_header_link_hidden_when_only_site_matches(self):
+        terminal_role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        site = Site.objects.get(domain="testserver")
+        reference = Reference.objects.create(
+            alt_text="Restricted",
+            value="https://example.com/restricted",
+            show_in_header=True,
+        )
+        reference.roles.add(terminal_role)
+        reference.sites.add(site)
+
+        resp = self.client.get(reverse("pages:index"))
+
+        self.assertIn("header_references", resp.context)
+        self.assertFalse(resp.context["header_references"])
+        self.assertNotContains(resp, "https://example.com/restricted")
+
     def test_readme_pill_visible(self):
         resp = self.client.get(reverse("pages:readme"))
-        self.assertContains(resp, 'href="/readme/"')
-        self.assertContains(resp, 'badge rounded-pill text-bg-secondary">README')
+        self.assertContains(resp, 'href="/read/docs/cookbooks/install-start-stop-upgrade-uninstall"')
+        self.assertContains(resp, 'badge rounded-pill text-bg-secondary">COOKBOOKS')
+
+    def test_cookbook_pill_has_no_dropdown(self):
+        module = Module.objects.get(node_role__name="Control", path="/read/")
+        Landing.objects.create(
+            module=module,
+            path="/man/",
+            label="Manuals",
+            enabled=True,
+        )
+
+        resp = self.client.get(reverse("pages:readme"))
+
+        self.assertContains(
+            resp,
+            '<a class="nav-link" href="/read/docs/cookbooks/install-start-stop-upgrade-uninstall"><span class="badge rounded-pill text-bg-secondary">COOKBOOKS</span></a>',
+            html=True,
+        )
+        self.assertNotContains(resp, 'dropdown-item" href="/man/"')
+
+    def test_readme_page_includes_qr_share(self):
+        resp = self.client.get(reverse("pages:readme"), {"section": "intro"})
+        self.assertContains(resp, 'id="reader-qr"')
+        self.assertContains(
+            resp,
+            'data-url="http://testserver/read/?section=intro"',
+        )
+        self.assertNotContains(resp, "Scan this page")
+        self.assertNotContains(
+            resp, 'class="small text-break text-muted mt-3 mb-0"'
+        )
+
+    def test_readme_document_by_name(self):
+        resp = self.client.get(reverse("pages:readme-document", args=["AGENTS.md"]))
+        self.assertEqual(resp.status_code, 200)
+        self.assertContains(resp, "Agent Guidelines")
+
+    def test_readme_document_by_relative_path(self):
+        resp = self.client.get(
+            reverse(
+                "pages:readme-document",
+                args=["docs/development/maintenance-roadmap.md"],
+            )
+        )
+        self.assertEqual(resp.status_code, 200)
+        self.assertContains(resp, "Maintenance Improvement Proposals")
+
+    def test_readme_document_rejects_traversal(self):
+        resp = self.client.get("/read/../../SECRET.md")
+        self.assertEqual(resp.status_code, 404)
 
 
 class SatelliteNavTests(TestCase):
@@ -1768,8 +2305,8 @@ class SatelliteNavTests(TestCase):
 
     def test_readme_pill_visible(self):
         resp = self.client.get(reverse("pages:readme"))
-        self.assertContains(resp, 'href="/readme/"')
-        self.assertContains(resp, 'badge rounded-pill text-bg-secondary">README')
+        self.assertContains(resp, 'href="/read/docs/cookbooks/install-start-stop-upgrade-uninstall"')
+        self.assertContains(resp, 'badge rounded-pill text-bg-secondary">COOKBOOKS')
 
 
 class PowerNavTests(TestCase):
@@ -1804,9 +2341,9 @@ class PowerNavTests(TestCase):
                 power_module = module
                 break
         self.assertIsNotNone(power_module)
-        self.assertEqual(power_module.menu_label.upper(), "CALCULATE")
+        self.assertEqual(power_module.menu_label.upper(), "CALCULATORS")
         landing_labels = {landing.label for landing in power_module.enabled_landings}
-        self.assertIn("AWG Calculator", landing_labels)
+        self.assertIn("AWG Cable Calculator", landing_labels)
 
     def test_manual_pill_label(self):
         resp = self.client.get(reverse("pages:index"))
@@ -1830,9 +2367,88 @@ class PowerNavTests(TestCase):
                 break
         self.assertIsNotNone(power_module)
         landing_labels = {landing.label for landing in power_module.enabled_landings}
-        self.assertIn("AWG Calculator", landing_labels)
+        self.assertIn("AWG Cable Calculator", landing_labels)
         self.assertIn("Energy Tariff Calculator", landing_labels)
 
+    def test_locked_landing_shows_lock_icon(self):
+        resp = self.client.get(reverse("pages:index"))
+        html = resp.content.decode()
+        energy_index = html.find("Energy Tariff Calculator")
+        self.assertGreaterEqual(energy_index, 0)
+        icon_index = html.find("dropdown-lock-icon", energy_index, energy_index + 300)
+        self.assertGreaterEqual(icon_index, 0)
+
+    def test_lock_icon_disappears_after_login(self):
+        self.client.force_login(self.user)
+        resp = self.client.get(reverse("pages:index"))
+        html = resp.content.decode()
+        energy_index = html.find("Energy Tariff Calculator")
+        self.assertGreaterEqual(energy_index, 0)
+        icon_index = html.find("dropdown-lock-icon", energy_index, energy_index + 300)
+        self.assertEqual(icon_index, -1)
+
+
+class WatchtowerLandingLinkTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.role, _ = NodeRole.objects.get_or_create(name="Watchtower")
+        Node.objects.update_or_create(
+            mac_address=Node.get_current_mac(),
+            defaults={
+                "hostname": "localhost",
+                "address": "127.0.0.1",
+                "role": self.role,
+            },
+        )
+        Site.objects.update_or_create(
+            id=1, defaults={"domain": "testserver", "name": ""}
+        )
+        self.ocpp_app, _ = Application.objects.get_or_create(name="ocpp")
+        self.ocpp_module, _ = Module.objects.get_or_create(
+            node_role=self.role,
+            application=self.ocpp_app,
+            path="/ocpp/",
+        )
+        self.ocpp_module.create_landings()
+
+    def _get_ocpp_module(self, response):
+        for module in response.context["nav_modules"]:
+            if module.path == "/ocpp/":
+                return module
+        return None
+
+    def test_ocpp_landings_present_for_anonymous_users(self):
+        response = self.client.get(reverse("pages:index"))
+        ocpp_module = self._get_ocpp_module(response)
+        self.assertIsNotNone(ocpp_module)
+        landing_by_label = {
+            landing.label: landing for landing in ocpp_module.enabled_landings
+        }
+        expected_landings = {
+            "CPMS Online Dashboard": "/ocpp/cpms/dashboard/",
+            "Charge Point Simulator": "/ocpp/evcs/simulator/",
+            "RFID Tag Validator": "/ocpp/rfid/validator/",
+        }
+        for label, path in expected_landings.items():
+            with self.subTest(label=label):
+                landing = landing_by_label.get(label)
+                self.assertIsNotNone(landing)
+                self.assertEqual(landing.path, path)
+                self.assertTrue(path.startswith("/"))
+                resolve(path)
+
+    def test_simulator_requires_login(self):
+        response = self.client.get(reverse("pages:index"))
+        ocpp_module = self._get_ocpp_module(response)
+        self.assertIsNotNone(ocpp_module)
+        locked_landings = {
+            landing.label: landing
+            for landing in ocpp_module.enabled_landings
+            if getattr(landing, "nav_is_locked", False)
+        }
+        simulator = locked_landings.get("Charge Point Simulator")
+        self.assertIsNotNone(simulator)
+        self.assertTrue(simulator.nav_is_locked)
 
 class StaffNavVisibilityTests(TestCase):
     def setUp(self):
@@ -1854,12 +2470,12 @@ class StaffNavVisibilityTests(TestCase):
     def test_nonstaff_pill_hidden(self):
         self.client.login(username="user", password="pw")
         resp = self.client.get(reverse("pages:index"))
-        self.assertContains(resp, 'href="/ocpp/"')
+        self.assertContains(resp, 'href="/ocpp/cpms/dashboard/"')
 
     def test_staff_sees_pill(self):
         self.client.login(username="staff", password="pw")
         resp = self.client.get(reverse("pages:index"))
-        self.assertContains(resp, 'href="/ocpp/"')
+        self.assertContains(resp, 'href="/ocpp/cpms/dashboard/"')
 
 
 class ModuleAdminReloadActionTests(TestCase):
@@ -1872,7 +2488,7 @@ class ModuleAdminReloadActionTests(TestCase):
             password="pw",
         )
         self.client.force_login(self.superuser)
-        self.role, _ = NodeRole.objects.get_or_create(name="Constellation")
+        self.role, _ = NodeRole.objects.get_or_create(name="Watchtower")
         Application.objects.get_or_create(name="ocpp")
         Application.objects.get_or_create(name="awg")
         Site.objects.update_or_create(
@@ -1910,7 +2526,11 @@ class ModuleAdminReloadActionTests(TestCase):
         )
         self.assertSetEqual(
             charger_landings,
-            {"/ocpp/", "/ocpp/simulator/", "/ocpp/rfid/"},
+            {
+                "/ocpp/cpms/dashboard/",
+                "/ocpp/evcs/simulator/",
+                "/ocpp/rfid/validator/",
+            },
         )
 
         calculator_landings = set(
@@ -2048,6 +2668,47 @@ class UserManualAdminFormTests(TestCase):
         self.assertEqual(form.cleaned_data["content_pdf"], self.manual.content_pdf)
 
 
+class UserManualModelTests(TestCase):
+    def _build_manual(self, **overrides):
+        defaults = {
+            "slug": "manual-model-test",
+            "title": "Manual Model",
+            "description": "Manual description",
+            "languages": "en",
+            "content_html": "<p>Manual</p>",
+            "content_pdf": base64.b64encode(b"initial").decode("ascii"),
+        }
+        defaults.update(overrides)
+        return UserManual(**defaults)
+
+    def test_save_encodes_uploaded_file(self):
+        upload = SimpleUploadedFile("manual.pdf", b"PDF data")
+        manual = self._build_manual(slug="manual-upload", content_pdf=upload)
+        manual.save()
+        manual.refresh_from_db()
+        self.assertEqual(
+            manual.content_pdf,
+            base64.b64encode(b"PDF data").decode("ascii"),
+        )
+
+    def test_save_encodes_raw_bytes(self):
+        manual = self._build_manual(slug="manual-bytes", content_pdf=b"PDF raw")
+        manual.save()
+        manual.refresh_from_db()
+        self.assertEqual(
+            manual.content_pdf,
+            base64.b64encode(b"PDF raw").decode("ascii"),
+        )
+
+    def test_save_strips_data_uri_prefix(self):
+        encoded = base64.b64encode(b"PDF data").decode("ascii")
+        data_uri = f"data:application/pdf;base64,{encoded}"
+        manual = self._build_manual(slug="manual-data-uri", content_pdf=data_uri)
+        manual.save()
+        manual.refresh_from_db()
+        self.assertEqual(manual.content_pdf, encoded)
+
+
 class LandingCreationTests(TestCase):
     def setUp(self):
         role, _ = NodeRole.objects.get_or_create(name="Terminal")
@@ -2069,12 +2730,12 @@ class LandingCreationTests(TestCase):
 
 
 class LandingFixtureTests(TestCase):
-    def test_constellation_fixture_loads_without_duplicates(self):
+    def test_watchtower_fixture_loads_without_duplicates(self):
         from glob import glob
 
-        NodeRole.objects.get_or_create(name="Constellation")
+        NodeRole.objects.get_or_create(name="Watchtower")
         fixtures = glob(
-            str(Path(settings.BASE_DIR, "pages", "fixtures", "constellation__*.json"))
+            str(Path(settings.BASE_DIR, "pages", "fixtures", "watchtower__*.json"))
         )
         fixtures = sorted(
             fixtures,
@@ -2084,9 +2745,11 @@ class LandingFixtureTests(TestCase):
         )
         call_command("loaddata", *fixtures)
         call_command("loaddata", *fixtures)
-        module = Module.objects.get(path="/ocpp/", node_role__name="Constellation")
+        module = Module.objects.get(path="/ocpp/", node_role__name="Watchtower")
         module.create_landings()
-        self.assertEqual(module.landings.filter(path="/ocpp/rfid/").count(), 1)
+        self.assertEqual(
+            module.landings.filter(path="/ocpp/rfid/validator/").count(), 1
+        )
 
 
 class AllowedHostSubnetTests(TestCase):
@@ -2239,9 +2902,9 @@ class FaviconTests(TestCase):
             )
             self.assertContains(resp, b64)
 
-    def test_constellation_nodes_use_goldenrod_favicon(self):
+    def test_watchtower_nodes_use_goldenrod_favicon(self):
         with override_settings(MEDIA_ROOT=self.tmpdir):
-            role, _ = NodeRole.objects.get_or_create(name="Constellation")
+            role, _ = NodeRole.objects.get_or_create(name="Watchtower")
             Node.objects.update_or_create(
                 mac_address=Node.get_current_mac(),
                 defaults={
@@ -2256,7 +2919,7 @@ class FaviconTests(TestCase):
             resp = self.client.get(reverse("pages:index"))
             b64 = (
                 Path(settings.BASE_DIR)
-                .joinpath("pages", "fixtures", "data", "favicon_constellation.txt")
+                .joinpath("pages", "fixtures", "data", "favicon_watchtower.txt")
                 .read_text()
                 .strip()
             )
@@ -2323,6 +2986,20 @@ class FavoriteTests(TestCase):
         self.assertEqual(fav.custom_label, "Apps")
         self.assertTrue(fav.user_data)
 
+    def test_add_favorite_defaults_user_data_checked(self):
+        ct = ContentType.objects.get_by_natural_key("pages", "application")
+        url = reverse("admin:favorite_toggle", args=[ct.id])
+        resp = self.client.get(url)
+        self.assertContains(resp, 'name="user_data" checked')
+
+    def test_add_favorite_with_priority(self):
+        ct = ContentType.objects.get_by_natural_key("pages", "application")
+        url = reverse("admin:favorite_toggle", args=[ct.id])
+        resp = self.client.post(url, {"priority": "7"})
+        self.assertRedirects(resp, reverse("admin:index"))
+        fav = Favorite.objects.get(user=self.user, content_type=ct)
+        self.assertEqual(fav.priority, 7)
+
     def test_cancel_link_uses_next(self):
         ct = ContentType.objects.get_by_natural_key("pages", "application")
         next_url = reverse("admin:pages_application_changelist")
@@ -2332,14 +3009,31 @@ class FavoriteTests(TestCase):
         resp = self.client.get(url)
         self.assertContains(resp, f'href="{next_url}"')
 
-    def test_existing_favorite_redirects_to_list(self):
+    def test_existing_favorite_shows_update_form(self):
         ct = ContentType.objects.get_by_natural_key("pages", "application")
-        Favorite.objects.create(user=self.user, content_type=ct)
+        favorite = Favorite.objects.create(
+            user=self.user, content_type=ct, custom_label="Apps", user_data=True
+        )
         url = reverse("admin:favorite_toggle", args=[ct.id])
         resp = self.client.get(url)
-        self.assertRedirects(resp, reverse("admin:favorite_list"))
-        resp = self.client.get(reverse("admin:favorite_list"))
-        self.assertContains(resp, ct.name)
+        self.assertContains(resp, "Update Favorite")
+        self.assertContains(resp, "value=\"Apps\"")
+        self.assertContains(resp, "checked")
+        self.assertContains(resp, "name=\"remove\"")
+
+        resp = self.client.post(url, {"custom_label": "Apps Updated"})
+        self.assertRedirects(resp, reverse("admin:index"))
+        favorite.refresh_from_db()
+        self.assertEqual(favorite.custom_label, "Apps Updated")
+        self.assertFalse(favorite.user_data)
+
+    def test_remove_existing_favorite_from_toggle(self):
+        ct = ContentType.objects.get_by_natural_key("pages", "application")
+        Favorite.objects.create(user=self.user, content_type=ct)
+        url = reverse("admin:favorite_toggle", args=[ct.id])
+        resp = self.client.post(url, {"remove": "1"})
+        self.assertRedirects(resp, reverse("admin:index"))
+        self.assertFalse(Favorite.objects.filter(user=self.user, content_type=ct).exists())
 
     def test_update_user_data_from_list(self):
         ct = ContentType.objects.get_by_natural_key("pages", "application")
@@ -2350,6 +3044,15 @@ class FavoriteTests(TestCase):
         fav.refresh_from_db()
         self.assertTrue(fav.user_data)
 
+    def test_update_priority_from_list(self):
+        ct = ContentType.objects.get_by_natural_key("pages", "application")
+        fav = Favorite.objects.create(user=self.user, content_type=ct, priority=3)
+        url = reverse("admin:favorite_list")
+        resp = self.client.post(url, {f"priority_{fav.pk}": "12"})
+        self.assertRedirects(resp, url)
+        fav.refresh_from_db()
+        self.assertEqual(fav.priority, 12)
+
     def test_dashboard_includes_favorites_and_user_data(self):
         fav_ct = ContentType.objects.get_by_natural_key("pages", "application")
         Favorite.objects.create(
@@ -2360,6 +3063,12 @@ class FavoriteTests(TestCase):
         self.assertContains(resp, reverse("admin:pages_application_changelist"))
         self.assertContains(resp, reverse("admin:nodes_noderole_changelist"))
 
+    def test_dashboard_shows_empty_todo_state(self):
+        Todo.objects.all().delete()
+        resp = self.client.get(reverse("admin:index"))
+        self.assertContains(resp, "Release manager tasks")
+        self.assertContains(resp, "No pending TODOs")
+
     def test_dashboard_merges_duplicate_future_actions(self):
         ct = ContentType.objects.get_for_model(NodeRole)
         Favorite.objects.create(user=self.user, content_type=ct)
@@ -2406,6 +3115,48 @@ class FavoriteTests(TestCase):
         self.assertContains(resp, f'title="{badge_label}"')
         self.assertContains(resp, f'aria-label="{badge_label}"')
 
+    def test_dashboard_shows_charge_point_availability_badge(self):
+        Charger.objects.create(
+            charger_id="CP-001", connector_id=1, last_status="Available"
+        )
+        Charger.objects.create(charger_id="CP-002", last_status="Available")
+        Charger.objects.create(
+            charger_id="CP-003", connector_id=1, last_status="Unavailable"
+        )
+
+        resp = self.client.get(reverse("admin:index"))
+
+        expected = "1 / 2"
+        badge_label = gettext(
+            "%(available)s chargers reporting Available status with a CP number, out of %(total)s total Available chargers. %(missing)s Available chargers are missing a connector number."
+        ) % {"available": 1, "total": 2, "missing": 1}
+
+        self.assertContains(resp, expected)
+        self.assertContains(resp, 'class="charger-availability-badge"')
+        self.assertContains(resp, f'title="{badge_label}"')
+        self.assertContains(resp, f'aria-label="{badge_label}"')
+
+    def test_dashboard_charge_point_badge_ignores_aggregator(self):
+        Charger.objects.create(charger_id="CP-AGG", last_status="Available")
+        Charger.objects.create(
+            charger_id="CP-AGG", connector_id=1, last_status="Available"
+        )
+        Charger.objects.create(
+            charger_id="CP-AGG", connector_id=2, last_status="Available"
+        )
+
+        resp = self.client.get(reverse("admin:index"))
+
+        expected = "2 / 2"
+        badge_label = gettext(
+            "%(available)s chargers reporting Available status with a CP number."
+        ) % {"available": 2}
+
+        self.assertContains(resp, expected)
+        self.assertContains(resp, 'class="charger-availability-badge"')
+        self.assertContains(resp, f'title="{badge_label}"')
+        self.assertContains(resp, f'aria-label="{badge_label}"')
+
     def test_nav_sidebar_hides_dashboard_badges(self):
         InviteLead.objects.create(email="open@example.com")
         RFID.objects.create(rfid="RFID0003", released=True, allowed=True)
@@ -2508,7 +3259,7 @@ class FavoriteTests(TestCase):
             hostname="cached-node",
             address="127.0.0.1",
             mac_address="AA:BB:CC:DD:EE:FF",
-            port=8000,
+            port=8888,
             is_user_data=True,
         )
 
@@ -2557,7 +3308,11 @@ class FavoriteTests(TestCase):
         todo = Todo.objects.create(request="Do thing")
         resp = self.client.get(reverse("admin:index"))
         done_url = reverse("todo-done", args=[todo.pk])
-        self.assertContains(resp, todo.request)
+        tooltip = escape(todo.request)
+        self.assertContains(resp, f'title="{tooltip}"')
+        self.assertContains(resp, f'aria-label="{tooltip}"')
+        task_label = gettext("Task %(counter)s") % {"counter": 1}
+        self.assertContains(resp, task_label)
         self.assertContains(resp, f'action="{done_url}"')
         self.assertContains(resp, "DONE")
 
@@ -2568,6 +3323,15 @@ class FavoriteTests(TestCase):
             resp, '<div class="todo-details">More info</div>', html=True
         )
 
+    def test_dashboard_hides_completed_todos(self):
+        todo = Todo.objects.create(request="Completed task")
+        Todo.objects.filter(pk=todo.pk).update(done_on=timezone.now())
+
+        resp = self.client.get(reverse("admin:index"))
+
+        self.assertNotContains(resp, todo.request)
+        self.assertNotContains(resp, "Completed")
+
     def test_dashboard_shows_todos_when_node_unknown(self):
         Todo.objects.create(request="Check fallback")
         from nodes.models import Node
@@ -2576,7 +3340,8 @@ class FavoriteTests(TestCase):
 
         resp = self.client.get(reverse("admin:index"))
         self.assertContains(resp, "Release manager tasks")
-        self.assertContains(resp, "Check fallback")
+        tooltip = escape("Check fallback")
+        self.assertContains(resp, f'title="{tooltip}"')
 
     def test_dashboard_shows_todos_without_release_manager_profile(self):
         Todo.objects.create(request="Unrestricted task")
@@ -2584,7 +3349,8 @@ class FavoriteTests(TestCase):
 
         resp = self.client.get(reverse("admin:index"))
         self.assertContains(resp, "Release manager tasks")
-        self.assertContains(resp, "Unrestricted task")
+        tooltip = escape("Unrestricted task")
+        self.assertContains(resp, f'title="{tooltip}"')
 
     def test_dashboard_excludes_todo_changelist_link(self):
         ct = ContentType.objects.get_for_model(Todo)
@@ -2608,7 +3374,8 @@ class FavoriteTests(TestCase):
         self.client.force_login(other_user)
         resp = self.client.get(reverse("admin:index"))
         self.assertContains(resp, "Release manager tasks")
-        self.assertContains(resp, todo.request)
+        tooltip = escape(todo.request)
+        self.assertContains(resp, f'title="{tooltip}"')
 
     def test_dashboard_shows_todos_for_non_terminal_node(self):
         todo = Todo.objects.create(request="Terminal Tasks")
@@ -2619,7 +3386,8 @@ class FavoriteTests(TestCase):
         self.node.save(update_fields=["role"])
         resp = self.client.get(reverse("admin:index"))
         self.assertContains(resp, "Release manager tasks")
-        self.assertContains(resp, todo.request)
+        tooltip = escape(todo.request)
+        self.assertContains(resp, f'title="{tooltip}"')
 
     def test_dashboard_shows_todos_for_delegate_release_manager(self):
         todo = Todo.objects.create(request="Delegate Task")
@@ -2641,7 +3409,8 @@ class FavoriteTests(TestCase):
         self.client.force_login(operator)
         resp = self.client.get(reverse("admin:index"))
         self.assertContains(resp, "Release manager tasks")
-        self.assertContains(resp, todo.request)
+        tooltip = escape(todo.request)
+        self.assertContains(resp, f'title="{tooltip}"')
 
 
 class AdminIndexQueryRegressionTests(TestCase):
@@ -2836,47 +3605,6 @@ class AdminModelGraphViewTests(TestCase):
         self.assertEqual(kwargs.get("format"), "pdf")
 
 
-class DatasetteTests(TestCase):
-    def setUp(self):
-        self.client = Client()
-        User = get_user_model()
-        self.user = User.objects.create_user(username="ds", password="pwd")
-        Site.objects.update_or_create(id=1, defaults={"name": "Terminal"})
-
-    def test_datasette_auth_endpoint(self):
-        resp = self.client.get(reverse("pages:datasette-auth"))
-        self.assertEqual(resp.status_code, 401)
-        self.client.force_login(self.user)
-        resp = self.client.get(reverse("pages:datasette-auth"))
-        self.assertEqual(resp.status_code, 200)
-
-    def test_navbar_includes_datasette_when_enabled(self):
-        lock_dir = Path(settings.BASE_DIR) / "locks"
-        lock_dir.mkdir(exist_ok=True)
-        lock_file = lock_dir / "datasette.lck"
-        try:
-            lock_file.touch()
-            resp = self.client.get(reverse("pages:index"))
-            self.assertContains(resp, 'href="/data/"')
-        finally:
-            lock_file.unlink(missing_ok=True)
-
-    def test_admin_home_includes_datasette_button_when_enabled(self):
-        lock_dir = Path(settings.BASE_DIR) / "locks"
-        lock_dir.mkdir(exist_ok=True)
-        lock_file = lock_dir / "datasette.lck"
-        try:
-            lock_file.touch()
-            self.user.is_staff = True
-            self.user.is_superuser = True
-            self.user.save()
-            self.client.force_login(self.user)
-            resp = self.client.get(reverse("admin:index"))
-            self.assertContains(resp, 'href="/data/"')
-            self.assertContains(resp, ">Datasette<")
-        finally:
-            lock_file.unlink(missing_ok=True)
-
 
 class UserStorySubmissionTests(TestCase):
     def setUp(self):
@@ -2885,6 +3613,14 @@ class UserStorySubmissionTests(TestCase):
         self.url = reverse("pages:user-story-submit")
         User = get_user_model()
         self.user = User.objects.create_user(username="feedbacker", password="pwd")
+        self.capture_patcher = patch("pages.views.capture_screenshot", autospec=True)
+        self.save_patcher = patch("pages.views.save_screenshot", autospec=True)
+        self.mock_capture = self.capture_patcher.start()
+        self.mock_save = self.save_patcher.start()
+        self.mock_capture.return_value = Path("/tmp/fake.png")
+        self.mock_save.return_value = None
+        self.addCleanup(self.capture_patcher.stop)
+        self.addCleanup(self.save_patcher.stop)
 
     def test_authenticated_submission_defaults_to_username(self):
         self.client.force_login(self.user)
@@ -2913,12 +3649,121 @@ class UserStorySubmissionTests(TestCase):
         self.assertEqual(story.referer, "https://example.test/wizard/step-1/")
         self.assertEqual(story.user_agent, "FeedbackBot/1.0")
         self.assertEqual(story.ip_address, "127.0.0.1")
+        expected_language = (translation.get_language() or "").split("-")[0]
+        self.assertTrue(story.language_code)
+        self.assertTrue(
+            story.language_code.startswith(expected_language),
+            story.language_code,
+        )
+
+    def test_submission_records_request_language(self):
+        self.client.cookies[settings.LANGUAGE_COOKIE_NAME] = "es"
+        with translation.override("es"):
+            response = self.client.post(
+                self.url,
+                {
+                    "rating": 4,
+                    "comments": "Buena experiencia",
+                    "path": "/es/soporte/",
+                    "take_screenshot": "1",
+                },
+                HTTP_ACCEPT_LANGUAGE="es",
+            )
+
+        self.assertEqual(response.status_code, 200)
+        story = UserStory.objects.get()
+        self.assertEqual(story.language_code, "es")
 
-    def test_anonymous_submission_uses_provided_name(self):
+    def test_submission_prefers_original_referer(self):
+        self.client.get(
+            reverse("pages:index"),
+            HTTP_REFERER="https://ads.example/original",
+        )
         response = self.client.post(
             self.url,
             {
-                "name": "Guest Reviewer",
+                "rating": 3,
+                "comments": "Works well",
+                "path": "/wizard/step-2/",
+                "name": "visitor@example.com",
+                "take_screenshot": "0",
+            },
+            HTTP_REFERER="http://testserver/wizard/step-2/",
+            HTTP_USER_AGENT="FeedbackBot/2.0",
+        )
+
+        self.assertEqual(response.status_code, 200)
+        story = UserStory.objects.get()
+        self.assertEqual(story.referer, "https://ads.example/original")
+
+    def test_superuser_submission_creates_triage_todo(self):
+        Todo.objects.all().delete()
+        superuser = get_user_model().objects.create_superuser(
+            username="overseer", email="overseer@example.com", password="pwd"
+        )
+        Node.objects.update_or_create(
+            mac_address=Node.get_current_mac(),
+            defaults={
+                "hostname": "local-node",
+                "address": "127.0.0.1",
+                "port": 8888,
+                "public_endpoint": "local-node",
+            },
+        )
+        self.client.force_login(superuser)
+        comments = "Review analytics dashboard flow"
+        response = self.client.post(
+            self.url,
+            {
+                "rating": 5,
+                "comments": comments,
+                "path": "/reports/analytics/",
+                "take_screenshot": "0",
+            },
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(Todo.objects.count(), 1)
+        todo = Todo.objects.get()
+        self.assertEqual(todo.request, f"Triage {comments}")
+        self.assertTrue(todo.is_user_data)
+        self.assertEqual(todo.original_user, superuser)
+        self.assertTrue(todo.original_user_is_authenticated)
+        self.assertEqual(todo.origin_node, Node.get_local())
+
+    def test_screenshot_request_links_saved_sample(self):
+        self.client.force_login(self.user)
+        screenshot_file = Path("/tmp/fake.png")
+        self.mock_capture.return_value = screenshot_file
+        sample = ContentSample.objects.create(kind=ContentSample.IMAGE)
+        self.mock_save.return_value = sample
+
+        response = self.client.post(
+            self.url,
+            {
+                "rating": 5,
+                "comments": "Loved the experience!",
+                "path": "/wizard/step-1/",
+                "take_screenshot": "1",
+            },
+            HTTP_REFERER="https://example.test/wizard/step-1/",
+        )
+
+        self.assertEqual(response.status_code, 200)
+        story = UserStory.objects.get()
+        self.assertEqual(story.screenshot, sample)
+        self.mock_capture.assert_called_once_with("https://example.test/wizard/step-1/")
+        self.mock_save.assert_called_once_with(
+            screenshot_file,
+            method="USER_STORY",
+            user=self.user,
+            link_duplicates=True,
+        )
+
+    def test_anonymous_submission_uses_provided_email(self):
+        response = self.client.post(
+            self.url,
+            {
+                "name": "guest@example.com",
                 "rating": 3,
                 "comments": "It was fine.",
                 "path": "/status/",
@@ -2928,7 +3773,7 @@ class UserStorySubmissionTests(TestCase):
         self.assertEqual(response.status_code, 200)
         self.assertEqual(UserStory.objects.count(), 1)
         story = UserStory.objects.get()
-        self.assertEqual(story.name, "Guest Reviewer")
+        self.assertEqual(story.name, "guest@example.com")
         self.assertIsNone(story.user)
         self.assertIsNone(story.owner)
         self.assertEqual(story.comments, "It was fine.")
@@ -2950,7 +3795,7 @@ class UserStorySubmissionTests(TestCase):
         self.assertFalse(UserStory.objects.exists())
         self.assertIn("rating", data.get("errors", {}))
 
-    def test_anonymous_submission_without_name_uses_fallback(self):
+    def test_anonymous_submission_without_email_returns_errors(self):
         response = self.client.post(
             self.url,
             {
@@ -2960,18 +3805,32 @@ class UserStorySubmissionTests(TestCase):
                 "take_screenshot": "1",
             },
         )
-        self.assertEqual(response.status_code, 200)
-        story = UserStory.objects.get()
-        self.assertEqual(story.name, "Anonymous")
-        self.assertIsNone(story.user)
-        self.assertIsNone(story.owner)
-        self.assertTrue(story.take_screenshot)
-        self.assertEqual(story.status, UserStory.Status.OPEN)
+        self.assertEqual(response.status_code, 400)
+        self.assertFalse(UserStory.objects.exists())
+        data = response.json()
+        self.assertIn("name", data.get("errors", {}))
+
+    def test_anonymous_submission_with_invalid_email_returns_errors(self):
+        response = self.client.post(
+            self.url,
+            {
+                "name": "Guest Reviewer",
+                "rating": 3,
+                "comments": "Needs improvement.",
+                "path": "/feedback/",
+                "take_screenshot": "1",
+            },
+        )
+        self.assertEqual(response.status_code, 400)
+        self.assertFalse(UserStory.objects.exists())
+        data = response.json()
+        self.assertIn("name", data.get("errors", {}))
 
     def test_submission_without_screenshot_request(self):
         response = self.client.post(
             self.url,
             {
+                "name": "guest@example.com",
                 "rating": 4,
                 "comments": "Skip the screenshot, please.",
                 "path": "/feedback/",
@@ -2981,9 +3840,14 @@ class UserStorySubmissionTests(TestCase):
         story = UserStory.objects.get()
         self.assertFalse(story.take_screenshot)
         self.assertIsNone(story.owner)
+        self.assertIsNone(story.screenshot)
+        self.assertEqual(story.status, UserStory.Status.OPEN)
+        self.mock_capture.assert_not_called()
+        self.mock_save.assert_not_called()
 
     def test_rate_limit_blocks_repeated_submissions(self):
         payload = {
+            "name": "guest@example.com",
             "rating": 4,
             "comments": "Pretty good",
             "path": "/feedback/",
@@ -3084,6 +3948,8 @@ class UserStoryAdminActionTests(TestCase):
             comments="Helpful notes",
             take_screenshot=True,
         )
+        self.story.language_code = "es"
+        self.story.save(update_fields=["language_code"])
         self.admin = UserStoryAdmin(UserStory, admin.site)
 
     def _build_request(self):
@@ -3117,6 +3983,8 @@ class UserStoryAdminActionTests(TestCase):
         args, kwargs = mock_create_issue.call_args
         self.assertIn("Feedback for", args[0])
         self.assertIn("**Rating:**", args[1])
+        self.assertIn("**Language:**", args[1])
+        self.assertIn("(es)", args[1])
         self.assertEqual(kwargs.get("labels"), ["feedback"])
         self.assertEqual(
             kwargs.get("fingerprint"), f"user-story:{self.story.pk}"
@@ -3134,6 +4002,40 @@ class UserStoryAdminActionTests(TestCase):
 
         mock_create_issue.assert_not_called()
 
+    def test_create_github_issues_action_links_to_credentials_when_missing(self):
+        request = self._build_request()
+        queryset = UserStory.objects.filter(pk=self.story.pk)
+
+        mock_url = "/admin/core/releasemanager/"
+        with (
+            patch(
+                "pages.admin.reverse", return_value=mock_url
+            ) as mock_reverse,
+            patch.object(
+                UserStory,
+                "create_github_issue",
+                side_effect=RuntimeError("GitHub token is not configured"),
+            ),
+        ):
+            self.admin.create_github_issues(request, queryset)
+
+        messages_list = list(request._messages)
+        self.assertTrue(messages_list)
+
+        opts = ReleaseManager._meta
+        mock_reverse.assert_called_once_with(
+            f"{self.admin.admin_site.name}:{opts.app_label}_{opts.model_name}_changelist"
+        )
+        self.assertTrue(
+            any(mock_url in message.message for message in messages_list),
+        )
+        self.assertTrue(
+            any("Configure GitHub credentials" in message.message for message in messages_list),
+        )
+        self.assertTrue(
+            any(message.level == messages.ERROR for message in messages_list),
+        )
+
 
 class ClientReportLiveUpdateTests(TestCase):
     def setUp(self):
@@ -3141,9 +4043,31 @@ class ClientReportLiveUpdateTests(TestCase):
 
     def test_client_report_includes_interval(self):
         resp = self.client.get(reverse("pages:client-report"))
-        self.assertEqual(resp.context["request"].live_update_interval, 5)
+        self.assertEqual(resp.wsgi_request.live_update_interval, 5)
         self.assertContains(resp, "setInterval(() => location.reload()")
 
+    def test_client_report_download_disables_refresh(self):
+        User = get_user_model()
+        user = User.objects.create_user(username="download-user", password="pwd")
+        report = ClientReport.objects.create(
+            start_date=date(2024, 1, 1),
+            end_date=date(2024, 1, 2),
+            data={},
+            owner=user,
+            disable_emails=True,
+            language="en",
+            title="",
+        )
+
+        self.client.force_login(user)
+        resp = self.client.get(
+            reverse("pages:client-report"), {"download": report.pk}
+        )
+
+        self.assertIsNone(getattr(resp.wsgi_request, "live_update_interval", None))
+        self.assertContains(resp, "report-download-frame")
+        self.assertNotContains(resp, "setInterval(() => location.reload()")
+
 
 class ScreenshotSpecInfrastructureTests(TestCase):
     def test_runner_creates_outputs_and_cleans_old_samples(self):