arthexis 0.1.16__py3-none-any.whl → 0.1.28__py3-none-any.whl

core/tests.py

@@ -5,9 +5,11 @@ import django
 
 django.setup()
 
+from django import forms
 from django.test import Client, TestCase, RequestFactory, override_settings
 from django.urls import reverse
 from django.http import HttpRequest
+from django.contrib import messages
 import csv
 import json
 import importlib.util
@@ -20,6 +22,7 @@ import types
 from glob import glob
 from datetime import datetime, timedelta, timezone as datetime_timezone
 import tempfile
+from io import StringIO
 from urllib.parse import quote
 
 from django.utils import timezone
@@ -49,6 +52,7 @@ from core.admin import (
     PackageReleaseAdmin,
     PackageAdmin,
     RFIDResource,
+    SecurityGroupAdmin,
     UserAdmin,
     USER_PROFILE_INLINES,
 )
@@ -57,6 +61,7 @@ from nodes.models import ContentSample
 
 from django.core.exceptions import ValidationError
 from django.core.management import call_command
+from django.core.management.base import CommandError
 from django.db import IntegrityError
 from .backends import LocalhostAdminBackend
 from core.views import (
@@ -306,6 +311,16 @@ class UserAdminInlineTests(TestCase):
         self.assertEqual(len(other_profiles), len(USER_PROFILE_INLINES))
 
 
+class SecurityGroupAdminTests(TestCase):
+    def setUp(self):
+        self.site = AdminSite()
+        self.admin = SecurityGroupAdmin(SecurityGroup, self.site)
+
+    def test_search_fields_include_name_and_parent(self):
+        self.assertIn("name", self.admin.search_fields)
+        self.assertIn("parent__name", self.admin.search_fields)
+
+
 class RFIDLoginTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -321,7 +336,9 @@ class RFIDLoginTests(TestCase):
             content_type="application/json",
         )
         self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.json()["username"], "alice")
+        payload = response.json()
+        self.assertEqual(payload["username"], "alice")
+        self.assertEqual(payload["redirect"], "/")
 
     def test_rfid_login_invalid(self):
         response = self.client.post(
@@ -345,6 +362,7 @@ class RFIDLoginTests(TestCase):
         )
 
         self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json().get("redirect"), "/")
         run_args, run_kwargs = mock_run.call_args
         self.assertEqual(run_args[0], "echo ok")
         self.assertTrue(run_kwargs.get("shell"))
@@ -381,6 +399,7 @@ class RFIDLoginTests(TestCase):
         )
 
         self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json().get("redirect"), "/")
         mock_popen.assert_called_once()
         args, kwargs = mock_popen.call_args
         self.assertEqual(args[0], "echo welcome")
@@ -407,6 +426,24 @@ class RFIDLoginTests(TestCase):
         self.assertEqual(response.status_code, 401)
         mock_popen.assert_not_called()
 
+    def test_rfid_login_uses_next_redirect(self):
+        response = self.client.post(
+            reverse("rfid-login"),
+            data={"rfid": "CARD123", "next": "/dashboard/"},
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json().get("redirect"), "/dashboard/")
+
+    def test_rfid_login_ignores_unsafe_redirect(self):
+        response = self.client.post(
+            reverse("rfid-login"),
+            data={"rfid": "CARD123", "next": "https://example.com/"},
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json().get("redirect"), "/")
+
 
 class RFIDBatchApiTests(TestCase):
     def setUp(self):
@@ -439,6 +476,140 @@ class RFIDBatchApiTests(TestCase):
             },
         )
 
+
+class UserAdminPasswordChangeTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.admin = User.objects.create_superuser(
+            username="admin", email="admin@example.com", password="adminpass"
+        )
+        self.user = User.objects.create_user(username="target", password="oldpass")
+        self.client.force_login(self.admin)
+
+    def test_change_password_form_excludes_rfid_field(self):
+        url = reverse("admin:core_user_password_change", args=[self.user.pk])
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, 'name="rfid"')
+        self.assertNotContains(response, "Login RFID")
+
+    def test_change_password_does_not_alter_existing_rfid_assignment(self):
+        account = EnergyAccount.objects.create(user=self.user, name="TARGET")
+        tag = RFID.objects.create(rfid="CARD778")
+        account.rfids.add(tag)
+        url = reverse("admin:core_user_password_change", args=[self.user.pk])
+        response = self.client.post(
+            url,
+            {
+                "new_password1": "NewStrongPass123",
+                "new_password2": "NewStrongPass123",
+            },
+        )
+        self.assertRedirects(
+            response, reverse("admin:core_user_change", args=[self.user.pk])
+        )
+        account.refresh_from_db()
+        self.assertTrue(account.rfids.filter(pk=tag.pk).exists())
+        self.user.refresh_from_db()
+        self.assertTrue(self.user.check_password("NewStrongPass123"))
+
+
+class UserAdminLoginRFIDTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.admin = User.objects.create_superuser(
+            username="admin", email="admin@example.com", password="adminpass"
+        )
+        self.user = User.objects.create_user(username="target", password="oldpass")
+        self.client.force_login(self.admin)
+
+    def _build_change_form_data(self, response, **overrides):
+        form = response.context["adminform"].form
+        data = {}
+        for name, field in form.fields.items():
+            if isinstance(field, forms.ModelMultipleChoiceField):
+                initial = form.initial.get(name, field.initial) or []
+                data[name] = [str(value.pk) for value in initial]
+            elif isinstance(field, forms.BooleanField):
+                initial = form.initial.get(name, field.initial)
+                if initial:
+                    data[name] = "on"
+            elif name != "login_rfid":
+                value = form.initial.get(name, field.initial)
+                data[name] = "" if value is None else value
+        data["_save"] = "Save"
+        data.update({key: value for key, value in overrides.items() if value is not None})
+        return data
+
+    def test_change_form_includes_login_rfid_field(self):
+        tag = RFID.objects.create(rfid="CARD777")
+        EnergyAccount.objects.create(user=self.user, name="TARGET")
+        url = reverse("admin:core_user_change", args=[self.user.pk])
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, 'name="login_rfid"')
+        self.assertContains(response, str(tag.pk))
+
+    def test_change_form_assigns_login_rfid(self):
+        account = EnergyAccount.objects.create(user=self.user, name="TARGET")
+        tag = RFID.objects.create(rfid="CARD778")
+        url = reverse("admin:core_user_change", args=[self.user.pk])
+        response = self.client.get(url)
+        form_data = self._build_change_form_data(response, login_rfid=str(tag.pk))
+        post_response = self.client.post(url, form_data)
+        self.assertRedirects(
+            post_response, reverse("admin:core_user_change", args=[self.user.pk])
+        )
+        account.refresh_from_db()
+        self.assertTrue(account.rfids.filter(pk=tag.pk).exists())
+
+    def test_change_form_creates_energy_account_when_missing(self):
+        tag = RFID.objects.create(rfid="CARD779")
+        url = reverse("admin:core_user_change", args=[self.user.pk])
+        response = self.client.get(url)
+        form_data = self._build_change_form_data(response, login_rfid=str(tag.pk))
+        post_response = self.client.post(url, form_data)
+        self.assertRedirects(
+            post_response, reverse("admin:core_user_change", args=[self.user.pk])
+        )
+        account = EnergyAccount.objects.get(user=self.user)
+        self.assertTrue(account.rfids.filter(pk=tag.pk).exists())
+
+
+class AdminSitePasswordChangeTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.admin = User.objects.create_superuser(
+            username="admin", email="admin@example.com", password="adminpass"
+        )
+        self.client.force_login(self.admin)
+
+    def test_admin_password_change_form_excludes_rfid_field(self):
+        response = self.client.get(reverse("admin:password_change"))
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, 'name="rfid"')
+        self.assertNotContains(response, "Login RFID")
+
+    def test_admin_password_change_keeps_existing_rfid_assignment(self):
+        account = EnergyAccount.objects.create(user=self.admin, name="ADMIN")
+        tag = RFID.objects.create(rfid="CARD881")
+        account.rfids.add(tag)
+        response = self.client.post(
+            reverse("admin:password_change"),
+            {
+                "old_password": "adminpass",
+                "new_password1": "UltraSecurePass123",
+                "new_password2": "UltraSecurePass123",
+                "password1": "UltraSecurePass123",
+                "password2": "UltraSecurePass123",
+            },
+        )
+        self.assertRedirects(response, reverse("admin:password_change_done"))
+        self.admin.refresh_from_db()
+        self.assertTrue(self.admin.check_password("UltraSecurePass123"))
+        account.refresh_from_db()
+        self.assertTrue(account.rfids.filter(pk=tag.pk).exists())
+
     def test_export_rfids_color_filter(self):
         RFID.objects.create(rfid="CARD111", color=RFID.WHITE)
         response = self.client.get(reverse("rfid-batch"), {"color": "W"})
@@ -548,6 +719,15 @@ class RFIDValidationTests(TestCase):
         tag = RFID.objects.create(rfid="DEADBEEF10")
         self.assertEqual(tag.rfid, "DEADBEEF10")
 
+    def test_reversed_uid_updates_with_rfid(self):
+        tag = RFID.objects.create(rfid="A1B2C3D4")
+        self.assertEqual(tag.reversed_uid, "D4C3B2A1")
+
+        tag.rfid = "112233"
+        tag.save(update_fields=["rfid"])
+        tag.refresh_from_db()
+        self.assertEqual(tag.reversed_uid, "332211")
+
     def test_find_user_by_rfid(self):
         user = User.objects.create_user(username="finder", password="pwd")
         acc = EnergyAccount.objects.create(user=user, name="FINDER")
@@ -978,11 +1158,77 @@ class RFIDImportExportCommandTests(TestCase):
         result = resource.import_data(dataset, dry_run=False)
         self.assertFalse(result.has_errors())
 
+    def test_admin_import_restores_soft_deleted_label(self):
+        tag = RFID.objects.create(rfid="DELETEME01")
+        label = tag.label_id
+        tag.delete()
+        self.assertFalse(RFID.objects.filter(label_id=label).exists())
+        self.assertTrue(
+            RFID.all_objects.filter(label_id=label, is_deleted=True).exists()
+        )
+
+        resource = RFIDResource()
+        headers = resource.get_export_headers()
+        dataset = Dataset()
+        dataset.headers = headers
+        row = {header: "" for header in headers}
+        row.update(
+            {
+                "label_id": str(label),
+                "rfid": "DELETEME02",
+                "allowed": "true",
+                "color": RFID.BLACK,
+                "kind": RFID.CLASSIC,
+            }
+        )
+        dataset.append([row[h] for h in headers])
+
+        result = resource.import_data(dataset, dry_run=False)
+
+        self.assertFalse(result.has_errors())
+        restored = RFID.all_objects.get(label_id=label)
+        self.assertEqual(restored.rfid, "DELETEME02")
+        self.assertFalse(restored.is_deleted)
+
         account = EnergyAccount.objects.get(name="IMPORTED ADMIN ACCOUNT")
         tag = RFID.objects.get(rfid="NAMETAG002")
         self.assertTrue(tag.energy_accounts.filter(pk=account.pk).exists())
 
 
+class CheckRFIDCommandTests(TestCase):
+    def test_successful_validation_outputs_json(self):
+        out = StringIO()
+
+        call_command("check_rfid", "abcd1234", stdout=out)
+
+        payload = json.loads(out.getvalue())
+        self.assertEqual(payload["rfid"], "ABCD1234")
+        self.assertTrue(payload["created"])
+        self.assertTrue(RFID.objects.filter(rfid="ABCD1234").exists())
+
+    def test_invalid_value_raises_error(self):
+        with self.assertRaises(CommandError):
+            call_command("check_rfid", "invalid!")
+
+    def test_kind_option_updates_existing_tag(self):
+        tag = RFID.objects.create(rfid="EXISTING", allowed=False, kind=RFID.CLASSIC)
+        out = StringIO()
+
+        call_command(
+            "check_rfid",
+            "existing",
+            "--kind",
+            RFID.NTAG215,
+            stdout=out,
+        )
+
+        payload = json.loads(out.getvalue())
+        tag.refresh_from_db()
+        self.assertFalse(payload["created"])
+        self.assertEqual(payload["kind"], RFID.NTAG215)
+        self.assertEqual(tag.kind, RFID.NTAG215)
+
+
 class RFIDKeyVerificationFlagTests(TestCase):
     def test_flags_reset_on_key_change(self):
         tag = RFID.objects.create(
@@ -1037,6 +1283,44 @@ class ReleaseProcessTests(TestCase):
         )
         sync_main.assert_called_once_with(Path("rel.log"))
 
+    def test_step_check_todos_logs_instruction_when_pending(self):
+        log_path = Path("rel.log")
+        log_path.unlink(missing_ok=True)
+        Todo.objects.create(request="Review checklist")
+        ctx: dict[str, object] = {}
+
+        try:
+            with self.assertRaises(core_views.PendingTodos):
+                core_views._step_check_todos(self.release, ctx, log_path)
+
+            contents = log_path.read_text(encoding="utf-8")
+            message = "Release checklist requires acknowledgment before continuing."
+            self.assertIn(message, contents)
+            self.assertIn("Review outstanding TODO items", contents)
+
+            with self.assertRaises(core_views.PendingTodos):
+                core_views._step_check_todos(self.release, ctx, log_path)
+
+            contents = log_path.read_text(encoding="utf-8")
+            self.assertEqual(contents.count(message), 1)
+        finally:
+            log_path.unlink(missing_ok=True)
+
+    def test_step_check_todos_auto_ack_when_no_pending(self):
+        log_path = Path("rel.log")
+        log_path.unlink(missing_ok=True)
+        ctx: dict[str, object] = {}
+
+        try:
+            with mock.patch("core.views._refresh_changelog_once"):
+                core_views._step_check_todos(self.release, ctx, log_path)
+        finally:
+            log_path.unlink(missing_ok=True)
+
+        self.assertTrue(ctx.get("todos_ack"))
+        self.assertNotIn("todos_required", ctx)
+        self.assertIsNone(ctx.get("todos"))
+
     @mock.patch("core.views._sync_with_origin_main")
     @mock.patch("core.views.release_utils._git_clean", return_value=True)
     @mock.patch("core.views.release_utils.network_available", return_value=False)
@@ -1206,11 +1490,10 @@ class ReleaseProcessTests(TestCase):
         run.assert_any_call(["git", "clean", "-fd"], check=False)
 
     @mock.patch("core.views.PackageRelease.dump_fixture")
-    @mock.patch("core.views._ensure_release_todo")
     @mock.patch("core.views._sync_with_origin_main")
     @mock.patch("core.views.subprocess.run")
     def test_pre_release_syncs_with_main(
-        self, run, sync_main, ensure_todo, dump_fixture
+        self, run, sync_main, dump_fixture
     ):
         import subprocess as sp
 
@@ -1222,11 +1505,6 @@ class ReleaseProcessTests(TestCase):
             return sp.CompletedProcess(cmd, 0)
 
         run.side_effect = fake_run
-        ensure_todo.return_value = (
-            mock.Mock(request="Create release pkg 1.0.1", url="", request_details=""),
-            Path("core/fixtures/todos__next_release.json"),
-        )
-
         version_path = Path("VERSION")
         original_version = version_path.read_text(encoding="utf-8")
 
@@ -1527,6 +1805,54 @@ class ReleaseProcessTests(TestCase):
         ctx = session.get(f"release_publish_{self.release.pk}")
         self.assertTrue(ctx.get("dry_run"))
 
+    def test_resume_button_shown_when_credentials_missing(self):
+        user = User.objects.create_superuser("admin", "admin@example.com", "pw")
+        url = reverse("release-progress", args=[self.release.pk, "publish"])
+        self.client.force_login(user)
+
+        self.client.get(f"{url}?start=1")
+
+        session = self.client.session
+        ctx = session.get(f"release_publish_{self.release.pk}") or {}
+        ctx.update({"step": 7, "started": True, "paused": False})
+        session[f"release_publish_{self.release.pk}"] = ctx
+        session.save()
+
+        response = self.client.get(f"{url}?step=7")
+        self.assertEqual(response.status_code, 200)
+        context = response.context
+        if isinstance(context, list):
+            context = context[-1]
+        self.assertTrue(context["resume_available"])
+        self.assertIn(b"Resume Publish", response.content)
+
+    def test_resume_without_step_parameter_defaults_to_current_progress(self):
+        run: list[str] = []
+
+        def step_fn(release, ctx, log_path):
+            run.append("step")
+
+        steps = [("Only step", step_fn)]
+        user = User.objects.create_superuser("admin", "admin@example.com", "pw")
+        url = reverse("release-progress", args=[self.release.pk, "publish"])
+        with mock.patch("core.views.PUBLISH_STEPS", steps):
+            self.client.force_login(user)
+            session = self.client.session
+            session[f"release_publish_{self.release.pk}"] = {
+                "step": 0,
+                "started": True,
+                "paused": False,
+            }
+            session.save()
+
+            response = self.client.get(f"{url}?resume=1")
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(run, ["step"])
+
+            session = self.client.session
+            ctx = session.get(f"release_publish_{self.release.pk}")
+            self.assertEqual(ctx.get("step"), 1)
+
     def test_new_todo_does_not_reset_pending_flow(self):
         user = User.objects.create_superuser("admin", "admin@example.com", "pw")
         url = reverse("release-progress", args=[self.release.pk, "publish"])
@@ -1843,7 +2169,7 @@ class PackageReleaseAdminActionTests(TestCase):
 
     @mock.patch("core.admin.PackageRelease.dump_fixture")
     @mock.patch("core.admin.requests.get")
-    def test_refresh_from_pypi_creates_releases(self, mock_get, dump):
+    def test_refresh_from_pypi_reports_missing_releases(self, mock_get, dump):
         mock_get.return_value.raise_for_status.return_value = None
         mock_get.return_value.json.return_value = {
             "releases": {
@@ -1856,13 +2182,17 @@ class PackageReleaseAdminActionTests(TestCase):
             }
         }
         self.admin.refresh_from_pypi(self.request, PackageRelease.objects.none())
-        new_release = PackageRelease.objects.get(version="1.1.0")
-        self.assertEqual(new_release.revision, "")
-        self.assertEqual(
-            new_release.release_on,
-            datetime(2024, 2, 2, 15, 45, tzinfo=datetime_timezone.utc),
+        self.assertFalse(
+            PackageRelease.objects.filter(version="1.1.0").exists()
+        )
+        dump.assert_not_called()
+        self.assertIn(
+            (
+                "Manual creation required for 1 release: 1.1.0",
+                messages.WARNING,
+            ),
+            self.messages,
         )
-        dump.assert_called_once()
 
     @mock.patch("core.admin.PackageRelease.dump_fixture")
     @mock.patch("core.admin.requests.get")
@@ -2008,6 +2338,25 @@ class PackageReleaseCurrentTests(TestCase):
         self.package.save()
         self.assertFalse(self.release.is_current)
 
+    def test_is_current_false_when_version_has_plus(self):
+        self.version_path.write_text("1.0.0+")
+        self.assertFalse(self.release.is_current)
+
+
+class PackageReleaseRevisionTests(TestCase):
+    def setUp(self):
+        self.package = Package.objects.get(name="arthexis")
+        self.release = PackageRelease.objects.create(
+            package=self.package,
+            version="1.0.0",
+            revision="abcdef123456",
+        )
+
+    def test_matches_revision_ignores_plus_suffix(self):
+        self.assertTrue(
+            PackageRelease.matches_revision("1.0.0+", "abcdef123456")
+        )
+
     def test_is_current_false_when_version_differs(self):
         self.release.version = "2.0.0"
         self.release.save()
@@ -2058,13 +2407,22 @@ class PackageAdminPrepareNextReleaseTests(TestCase):
 
     def test_prepare_next_release_active_creates_release(self):
         PackageRelease.all_objects.filter(package=self.package).delete()
-        request = self.factory.get("/admin/core/package/prepare-next-release/")
+        request = self.factory.post("/admin/core/package/prepare-next-release/")
         response = self.admin.prepare_next_release_active(request)
         self.assertEqual(response.status_code, 302)
         self.assertEqual(
             PackageRelease.all_objects.filter(package=self.package).count(), 1
         )
 
+    def test_prepare_next_release_active_get_creates_release(self):
+        PackageRelease.all_objects.filter(package=self.package).delete()
+        request = self.factory.get("/admin/core/package/prepare-next-release/")
+        response = self.admin.prepare_next_release_active(request)
+        self.assertEqual(response.status_code, 302)
+        self.assertTrue(
+            PackageRelease.all_objects.filter(package=self.package).exists()
+        )
+
 
 class PackageAdminChangeViewTests(TestCase):
     def setUp(self):
@@ -2086,13 +2444,97 @@ class TodoDoneTests(TestCase):
         User.objects.create_superuser("admin", "admin@example.com", "pw")
         self.client.force_login(User.objects.get(username="admin"))
 
-    def test_mark_done_sets_timestamp(self):
+    @mock.patch("core.models.revision_utils.get_revision", return_value="rev123")
+    def test_mark_done_sets_timestamp(self, _get_revision):
         todo = Todo.objects.create(request="Task", is_seed_data=True)
         resp = self.client.post(reverse("todo-done", args=[todo.pk]))
         self.assertRedirects(resp, reverse("admin:index"))
         todo.refresh_from_db()
         self.assertIsNotNone(todo.done_on)
         self.assertFalse(todo.is_deleted)
+        self.assertIsNone(todo.done_node)
+        version_path = Path(settings.BASE_DIR) / "VERSION"
+        expected_version = ""
+        if version_path.exists():
+            expected_version = version_path.read_text(encoding="utf-8").strip()
+        self.assertEqual(todo.done_version, expected_version)
+        self.assertEqual(todo.done_revision, "rev123")
+        self.assertEqual(todo.done_username, "admin")
+
+    def test_mark_done_updates_seed_fixture(self):
+        todo = Todo.objects.create(request="Task", is_seed_data=True)
+        with tempfile.TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            fixture_dir = base / "core" / "fixtures"
+            fixture_dir.mkdir(parents=True)
+            fixture_path = fixture_dir / "todo__task.json"
+            fixture_path.write_text(
+                json.dumps(
+                    [
+                        {
+                            "model": "core.todo",
+                            "fields": {
+                                "request": "Task",
+                                "url": "",
+                                "request_details": "",
+                            },
+                        }
+                    ],
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+
+            with override_settings(BASE_DIR=base):
+                with mock.patch(
+                    "core.models.revision_utils.get_revision", return_value="rev456"
+                ):
+                    resp = self.client.post(reverse("todo-done", args=[todo.pk]))
+
+            self.assertRedirects(resp, reverse("admin:index"))
+            data = json.loads(fixture_path.read_text(encoding="utf-8"))
+            self.assertEqual(len(data), 1)
+            fields = data[0]["fields"]
+            self.assertIn("done_on", fields)
+            self.assertTrue(fields["done_on"])
+            self.assertFalse(fields.get("is_deleted", False))
+            self.assertIn("done_version", fields)
+            self.assertEqual(fields.get("done_revision"), "rev456")
+            self.assertEqual(fields.get("done_username"), "admin")
+
+    def test_soft_delete_updates_seed_fixture(self):
+        todo = Todo.objects.create(request="Task", is_seed_data=True)
+        with tempfile.TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            fixture_dir = base / "core" / "fixtures"
+            fixture_dir.mkdir(parents=True)
+            fixture_path = fixture_dir / "todo__task.json"
+            fixture_path.write_text(
+                json.dumps(
+                    [
+                        {
+                            "model": "core.todo",
+                            "fields": {
+                                "request": "Task",
+                                "url": "",
+                                "request_details": "",
+                            },
+                        }
+                    ],
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+
+            with override_settings(BASE_DIR=base):
+                todo.delete()
+
+            data = json.loads(fixture_path.read_text(encoding="utf-8"))
+            self.assertEqual(len(data), 1)
+            fields = data[0]["fields"]
+            self.assertTrue(fields.get("is_deleted"))
 
     def test_mark_done_missing_task_refreshes(self):
         todo = Todo.objects.create(request="Task", is_seed_data=True)
@@ -2198,6 +2640,61 @@ class TodoDoneTests(TestCase):
         self.assertTrue(todo.is_seed_data)
 
 
+class TodoDeleteTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        User.objects.create_superuser("admin", "admin@example.com", "pw")
+        self.client.force_login(User.objects.get(username="admin"))
+
+    def test_delete_marks_task_deleted(self):
+        todo = Todo.objects.create(request="Task", is_seed_data=True)
+        resp = self.client.post(reverse("todo-delete", args=[todo.pk]))
+        self.assertRedirects(resp, reverse("admin:index"))
+        todo.refresh_from_db()
+        self.assertTrue(todo.is_deleted)
+        self.assertIsNone(todo.done_on)
+
+    def test_delete_updates_seed_fixture(self):
+        todo = Todo.objects.create(request="Task", is_seed_data=True)
+        with tempfile.TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            fixture_dir = base / "core" / "fixtures"
+            fixture_dir.mkdir(parents=True)
+            fixture_path = fixture_dir / "todo__task.json"
+            fixture_path.write_text(
+                json.dumps(
+                    [
+                        {
+                            "model": "core.todo",
+                            "fields": {
+                                "request": "Task",
+                                "url": "",
+                                "request_details": "",
+                            },
+                        }
+                    ],
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+
+            with override_settings(BASE_DIR=base):
+                resp = self.client.post(reverse("todo-delete", args=[todo.pk]))
+                self.assertRedirects(resp, reverse("admin:index"))
+                data = json.loads(fixture_path.read_text(encoding="utf-8"))
+        self.assertEqual(len(data), 1)
+        fields = data[0]["fields"]
+        self.assertTrue(fields.get("is_deleted"))
+
+    def test_delete_missing_task_redirects(self):
+        todo = Todo.objects.create(request="Task")
+        todo.is_deleted = True
+        todo.save(update_fields=["is_deleted"])
+        resp = self.client.post(reverse("todo-delete", args=[todo.pk]))
+        self.assertRedirects(resp, reverse("admin:index"))
+
+
 class TodoFocusViewTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -2215,6 +2712,7 @@ class TodoFocusViewTests(TestCase):
         self.assertEqual(resp["X-Frame-Options"], "SAMEORIGIN")
         self.assertContains(resp, f'src="{todo.url}"')
         self.assertContains(resp, "Done")
+        self.assertContains(resp, "Delete")
         self.assertContains(resp, "Back")
         self.assertContains(resp, "Take Snapshot")
         snapshot_url = reverse("todo-snapshot", args=[todo.pk])
@@ -2236,7 +2734,7 @@ class TodoFocusViewTests(TestCase):
     def test_focus_view_sanitizes_loopback_absolute_url(self):
         todo = Todo.objects.create(
             request="Task",
-            url="http://127.0.0.1:8000/docs/?section=chart",
+            url="http://127.0.0.1:8888/docs/?section=chart",
         )
         resp = self.client.get(reverse("todo-focus", args=[todo.pk]))
         self.assertContains(resp, 'src="/docs/?section=chart"')