arthexis 0.1.7__py3-none-any.whl → 0.1.9__py3-none-any.whl

nodes/tests.py

@@ -6,13 +6,17 @@ import django
 django.setup()
 
 from pathlib import Path
+from types import SimpleNamespace
 from unittest.mock import patch, call, MagicMock
+from django.core import mail
+from django.core.management import call_command
 import socket
 import base64
 import json
 import uuid
 from tempfile import TemporaryDirectory
 import shutil
+import stat
 import time
 
 from django.test import Client, TestCase, TransactionTestCase, override_settings
@@ -31,23 +35,22 @@ from .models import (
     EmailOutbox,
     ContentSample,
     NodeRole,
+    NodeFeature,
+    NodeFeatureAssignment,
     NetMessage,
 )
+from .backends import OutboxEmailBackend
 from .tasks import capture_node_screenshot, sample_clipboard
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.primitives import serialization, hashes
 from core.models import PackageRelease
-from .models import Operation
-from .admin import RUN_CONTEXTS
 
 
 class NodeTests(TestCase):
     def setUp(self):
         self.client = Client()
         User = get_user_model()
-        self.user = User.objects.create_user(
-            username="nodeuser", password="pwd"
-        )
+        self.user = User.objects.create_user(username="nodeuser", password="pwd")
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
 
@@ -55,16 +58,18 @@ class NodeTests(TestCase):
         with TemporaryDirectory() as tmp:
             base = Path(tmp)
             with override_settings(BASE_DIR=base):
-                with patch(
-                    "nodes.models.Node.get_current_mac",
-                    return_value="00:ff:ee:dd:cc:bb",
-                ), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
                     Node.register_current()
         self.assertEqual(PackageRelease.objects.count(), 0)
 
@@ -117,7 +122,10 @@ class NodeTests(TestCase):
         hostnames = {n["hostname"] for n in data["nodes"]}
         self.assertEqual(hostnames, {"dup", "local2"})
 
-    def test_register_node_has_lcd_screen_toggle(self):
+    def test_register_node_feature_toggle(self):
+        NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
         url = reverse("register-node")
         first = self.client.post(
             url,
@@ -126,13 +134,13 @@ class NodeTests(TestCase):
                 "address": "127.0.0.1",
                 "port": 8000,
                 "mac_address": "00:aa:bb:cc:dd:ee",
-                "has_lcd_screen": True,
+                "features": ["clipboard-poll"],
             },
             content_type="application/json",
         )
         self.assertEqual(first.status_code, 200)
         node = Node.objects.get(mac_address="00:aa:bb:cc:dd:ee")
-        self.assertTrue(node.has_lcd_screen)
+        self.assertTrue(node.has_feature("clipboard-poll"))
 
         self.client.post(
             url,
@@ -141,12 +149,44 @@ class NodeTests(TestCase):
                 "address": "127.0.0.1",
                 "port": 8000,
                 "mac_address": "00:aa:bb:cc:dd:ee",
-                "has_lcd_screen": False,
+                "features": [],
             },
             content_type="application/json",
         )
         node.refresh_from_db()
-        self.assertFalse(node.has_lcd_screen)
+        self.assertFalse(node.has_feature("clipboard-poll"))
+
+    def test_register_node_sets_cors_headers(self):
+        payload = {
+            "hostname": "cors",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "10:20:30:40:50:60",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+        self.assertEqual(response["Access-Control-Allow-Credentials"], "true")
+
+    def test_register_node_accepts_text_plain_payload(self):
+        payload = {
+            "hostname": "plain",
+            "address": "127.0.0.1",
+            "port": 8001,
+            "mac_address": "aa:bb:cc:dd:ee:ff",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="text/plain",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Node.objects.filter(mac_address="aa:bb:cc:dd:ee:ff").exists())
 
 
 class NodeRegisterCurrentTests(TestCase):
@@ -156,39 +196,71 @@ class NodeRegisterCurrentTests(TestCase):
         self.user = User.objects.create_user(username="nodeuser", password="pwd")
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
-    def test_register_current_sets_and_retains_lcd(self):
+
+    def test_register_current_refreshes_lcd_feature(self):
+        NodeFeature.objects.get_or_create(
+            slug="lcd-screen", defaults={"display": "LCD Screen"}
+        )
         with TemporaryDirectory() as tmp:
             base = Path(tmp)
             locks = base / "locks"
             locks.mkdir()
-            (locks / "lcd_screen.lck").touch()
+            lock = locks / "lcd_screen.lck"
+            lock.touch()
             with override_settings(BASE_DIR=base):
-                with patch("nodes.models.Node.get_current_mac", return_value="00:ff:ee:dd:cc:bb"), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
                     node, created = Node.register_current()
             self.assertTrue(created)
-            self.assertTrue(node.has_lcd_screen)
-
-            node.has_lcd_screen = False
-            node.save(update_fields=["has_lcd_screen"])
+            self.assertTrue(node.has_feature("lcd-screen"))
 
+            lock.unlink()
             with override_settings(BASE_DIR=base):
-                with patch("nodes.models.Node.get_current_mac", return_value="00:ff:ee:dd:cc:bb"), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
-                    node2, created2 = Node.register_current()
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
+                    _, created2 = Node.register_current()
             self.assertFalse(created2)
             node.refresh_from_db()
-            self.assertFalse(node.has_lcd_screen)
+            self.assertFalse(node.has_feature("lcd-screen"))
+
+            lock.touch()
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
+                    node, created3 = Node.register_current()
+            self.assertFalse(created3)
+            node.refresh_from_db()
+            self.assertTrue(node.has_feature("lcd-screen"))
 
     @patch("nodes.views.capture_screenshot")
     def test_capture_screenshot(self, mock_capture):
@@ -270,9 +342,7 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertEqual(get_resp.json()["hostname"], "public")
 
         pre_count = NetMessage.objects.count()
-        post_resp = self.client.post(
-            url, data="hello", content_type="text/plain"
-        )
+        post_resp = self.client.post(url, data="hello", content_type="text/plain")
         self.assertEqual(post_resp.status_code, 200)
         self.assertEqual(NetMessage.objects.count(), pre_count + 1)
         msg = NetMessage.objects.order_by("-created").first()
@@ -307,10 +377,14 @@ class NodeRegisterCurrentTests(TestCase):
 
     def test_net_message_with_valid_signature(self):
         key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-        public_key = key.public_key().public_bytes(
-            encoding=serialization.Encoding.PEM,
-            format=serialization.PublicFormat.SubjectPublicKeyInfo,
-        ).decode()
+        public_key = (
+            key.public_key()
+            .public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            .decode()
+        )
         sender = Node.objects.create(
             hostname="sender",
             address="10.0.0.1",
@@ -327,9 +401,7 @@ class NodeRegisterCurrentTests(TestCase):
             "sender": str(sender.uuid),
         }
         payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
-        signature = key.sign(
-            payload_json.encode(), padding.PKCS1v15(), hashes.SHA256()
-        )
+        signature = key.sign(payload_json.encode(), padding.PKCS1v15(), hashes.SHA256())
         resp = self.client.post(
             reverse("net-message"),
             data=payload_json,
@@ -340,6 +412,9 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertTrue(NetMessage.objects.filter(uuid=msg_id).exists())
 
     def test_clipboard_polling_creates_task(self):
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
         node = Node.objects.create(
             hostname="clip",
             address="127.0.0.1",
@@ -347,15 +422,16 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:99",
         )
         task_name = f"poll_clipboard_node_{node.pk}"
-        self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
-        node.clipboard_polling = True
-        node.save()
+        PeriodicTask.objects.filter(name=task_name).delete()
+        NodeFeatureAssignment.objects.create(node=node, feature=feature)
         self.assertTrue(PeriodicTask.objects.filter(name=task_name).exists())
-        node.clipboard_polling = False
-        node.save()
+        NodeFeatureAssignment.objects.filter(node=node, feature=feature).delete()
         self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
 
     def test_screenshot_polling_creates_task(self):
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
         node = Node.objects.create(
             hostname="shot",
             address="127.0.0.1",
@@ -363,14 +439,13 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:aa",
         )
         task_name = f"capture_screenshot_node_{node.pk}"
-        self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
-        node.screenshot_polling = True
-        node.save()
+        PeriodicTask.objects.filter(name=task_name).delete()
+        NodeFeatureAssignment.objects.create(node=node, feature=feature)
         self.assertTrue(PeriodicTask.objects.filter(name=task_name).exists())
-        node.screenshot_polling = False
-        node.save()
+        NodeFeatureAssignment.objects.filter(node=node, feature=feature).delete()
         self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
 
+
 class NodeAdminTests(TestCase):
 
     def setUp(self):
@@ -395,7 +470,7 @@ class NodeAdminTests(TestCase):
         self.assertTemplateUsed(response, "admin/nodes/node/register_remote.html")
         self.assertEqual(Node.objects.count(), 1)
         node = Node.objects.first()
-        ver = Path('VERSION').read_text().strip()
+        ver = Path("VERSION").read_text().strip()
         rev = "abcdef123456"
         self.assertEqual(node.base_path, str(settings.BASE_DIR))
         self.assertEqual(node.installed_version, ver)
@@ -408,9 +483,7 @@ class NodeAdminTests(TestCase):
         self.assertTrue(priv.exists())
         self.assertTrue(pub.exists())
         self.assertTrue(node.public_key)
-        self.assertTrue(
-            Site.objects.filter(domain=hostname, name="host").exists()
-        )
+        self.assertTrue(Site.objects.filter(domain=hostname, name="host").exists())
 
     def test_register_current_updates_existing_node(self):
         hostname = socket.gethostname()
@@ -446,9 +519,7 @@ class NodeAdminTests(TestCase):
         self.assertIn(node.public_key.strip(), resp.content.decode())
 
     @patch("nodes.admin.capture_screenshot")
-    def test_capture_site_screenshot_from_admin(
-        self, mock_capture_screenshot
-    ):
+    def test_capture_site_screenshot_from_admin(self, mock_capture_screenshot):
         screenshot_dir = settings.LOG_DIR / "screenshots"
         screenshot_dir.mkdir(parents=True, exist_ok=True)
         file_path = screenshot_dir / "test.png"
@@ -472,9 +543,7 @@ class NodeAdminTests(TestCase):
         self.assertEqual(screenshot.path, "screenshots/test.png")
         self.assertEqual(screenshot.method, "ADMIN")
         mock_capture_screenshot.assert_called_once_with("http://testserver/")
-        self.assertContains(
-            response, "Screenshot saved to screenshots/test.png"
-        )
+        self.assertContains(response, "Screenshot saved to screenshots/test.png")
 
     def test_view_screenshot_in_change_admin(self):
         screenshot_dir = settings.LOG_DIR / "screenshots"
@@ -578,7 +647,9 @@ class NetMessageReachTests(TestCase):
         for name in ["Terminal", "Control", "Satellite", "Constellation"]:
             self.roles[name], _ = NodeRole.objects.get_or_create(name=name)
         self.nodes = {}
-        for idx, name in enumerate(["Terminal", "Control", "Satellite", "Constellation"], start=1):
+        for idx, name in enumerate(
+            ["Terminal", "Control", "Satellite", "Constellation"], start=1
+        ):
             self.nodes[name] = Node.objects.create(
                 hostname=name.lower(),
                 address=f"10.0.0.{idx}",
@@ -589,7 +660,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_terminal_reach_limits_nodes(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Terminal"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Terminal"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -598,7 +671,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_control_reach_includes_control_and_terminal(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Control"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Control"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -607,7 +682,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_satellite_reach_includes_lower_roles(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Satellite"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Satellite"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -616,7 +693,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_constellation_reach_prioritizes_constellation(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Constellation"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Constellation"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -650,7 +729,9 @@ class NetMessagePropagationTests(TestCase):
 
     @patch("requests.post")
     @patch("core.notifications.notify")
-    def test_propagate_forwards_to_three_and_notifies_local(self, mock_notify, mock_post):
+    def test_propagate_forwards_to_three_and_notifies_local(
+        self, mock_notify, mock_post
+    ):
         msg = NetMessage.objects.create(subject="s", body="b", reach=self.role)
         with patch.object(Node, "get_local", return_value=self.local):
             msg.propagate(seen=[str(self.remotes[0].uuid)])
@@ -665,6 +746,7 @@ class NetMessagePropagationTests(TestCase):
         self.assertEqual(msg.propagated_to.count(), 4)
         self.assertTrue(msg.complete)
 
+
 class NodeActionTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -739,7 +821,7 @@ class NodeActionTests(TestCase):
 
 
 class StartupNotificationTests(TestCase):
-    def test_startup_notification_uses_ip_and_revision(self):
+    def test_startup_notification_uses_hostname_and_revision(self):
         from nodes.apps import _startup_notification
 
         with TemporaryDirectory() as tmp:
@@ -750,20 +832,17 @@ class StartupNotificationTests(TestCase):
                     "nodes.apps.revision.get_revision", return_value="abcdef123456"
                 ):
                     with patch("nodes.models.NetMessage.broadcast") as mock_broadcast:
-                        with patch("nodes.apps.socket.gethostname", return_value="host"):
-                            with patch(
-                                "nodes.apps.socket.gethostbyname", return_value="1.2.3.4"
-                            ):
-                                with patch.dict(
-                                    os.environ, {"PORT": "9000"}
-                                ):
-                                    _startup_notification()
-                                    time.sleep(0.1)
+                        with patch(
+                            "nodes.apps.socket.gethostname", return_value="host"
+                        ):
+                            with patch.dict(os.environ, {"PORT": "9000"}):
+                                _startup_notification()
+                                time.sleep(0.1)
 
         mock_broadcast.assert_called_once()
         _, kwargs = mock_broadcast.call_args
-        self.assertEqual(kwargs["subject"], "1.2.3.4:9000")
-        self.assertTrue(kwargs["body"].startswith("v1.2.3 r"))
+        self.assertEqual(kwargs["subject"], "host:9000")
+        self.assertTrue(kwargs["body"].startswith("1.2.3 r"))
 
 
 class StartupHandlerTests(TestCase):
@@ -787,11 +866,14 @@ class StartupHandlerTests(TestCase):
 
         with patch("nodes.apps._startup_notification") as mock_start:
             with patch("nodes.apps.connections") as mock_connections:
-                mock_connections.__getitem__.return_value.ensure_connection.return_value = None
+                mock_connections.__getitem__.return_value.ensure_connection.return_value = (
+                    None
+                )
                 _trigger_startup_notification()
 
         mock_start.assert_called_once()
 
+
 class NotificationManagerTests(TestCase):
     def test_send_writes_trimmed_lines(self):
         from core.notifications import NotificationManager
@@ -921,6 +1003,7 @@ class ContentSampleAdminTests(TestCase):
         self.assertContains(resp, "Duplicate sample not created")
 
 
+@override_settings(EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend")
 class EmailOutboxTests(TestCase):
     def test_node_send_mail_uses_outbox(self):
         node = Node.objects.create(
@@ -929,31 +1012,28 @@ class EmailOutboxTests(TestCase):
             port=8000,
             mac_address="00:11:22:33:aa:bb",
         )
-        EmailOutbox.objects.create(
+        outbox = EmailOutbox.objects.create(
             node=node, host="smtp.example.com", port=25, username="u", password="p"
         )
-        with patch("nodes.models.get_connection") as gc, patch(
-            "nodes.models.send_mail"
-        ) as sm:
-            conn = MagicMock()
-            gc.return_value = conn
+        with patch("nodes.models.mailer.send") as ms:
             node.send_mail("sub", "msg", ["to@example.com"])
-            gc.assert_called_once_with(
-                host="smtp.example.com",
-                port=25,
-                username="u",
-                password="p",
-                use_tls=True,
-                use_ssl=False,
-            )
-            sm.assert_called_once_with(
-                "sub",
-                "msg",
-                settings.DEFAULT_FROM_EMAIL,
-                ["to@example.com"],
-                connection=conn,
+            ms.assert_called_once_with(
+                "sub", "msg", ["to@example.com"], None, outbox=outbox
             )
 
+    def test_node_send_mail_queues_email(self):
+        node = Node.objects.create(
+            hostname="host",
+            address="127.0.0.1",
+            port=8000,
+            mac_address="00:11:22:33:cc:dd",
+        )
+        node.send_mail("sub", "msg", ["to@example.com"])
+        self.assertEqual(len(mail.outbox), 1)
+        email = mail.outbox[0]
+        self.assertEqual(email.subject, "sub")
+        self.assertEqual(email.to, ["to@example.com"])
+
 
 class ClipboardTaskTests(TestCase):
     @patch("nodes.tasks.pyperclip.paste")
@@ -1066,29 +1146,344 @@ class NodeRoleAdminTests(TestCase):
         self.assertIsNone(node1.role)
         self.assertEqual(node2.role, role)
 
+    def test_registered_count_displayed(self):
+        role = NodeRole.objects.create(name="ViewRole")
+        Node.objects.create(
+            hostname="n1",
+            address="127.0.0.1",
+            port=8000,
+            mac_address="00:11:22:33:44:77",
+            role=role,
+        )
+        resp = self.client.get(reverse("admin:nodes_noderole_changelist"))
+        self.assertContains(resp, '<td class="field-registered">1</td>', html=True)
+
+
+class NodeFeatureFixtureTests(TestCase):
+    def test_rfid_scanner_fixture_includes_control_role(self):
+        for name in ("Terminal", "Satellite", "Constellation", "Control"):
+            NodeRole.objects.get_or_create(name=name)
+        fixture_path = (
+            Path(__file__).resolve().parent
+            / "fixtures"
+            / "node_features__nodefeature_rfid_scanner.json"
+        )
+        call_command("loaddata", str(fixture_path), verbosity=0)
+        feature = NodeFeature.objects.get(slug="rfid-scanner")
+        role_names = set(feature.roles.values_list("name", flat=True))
+        self.assertIn("Control", role_names)
+
+    def test_ap_router_fixture_limits_roles(self):
+        for name in ("Control", "Satellite"):
+            NodeRole.objects.get_or_create(name=name)
+        fixture_path = (
+            Path(__file__).resolve().parent
+            / "fixtures"
+            / "node_features__nodefeature_ap_router.json"
+        )
+        call_command("loaddata", str(fixture_path), verbosity=0)
+        feature = NodeFeature.objects.get(slug="ap-router")
+        role_names = set(feature.roles.values_list("name", flat=True))
+        self.assertEqual(role_names, {"Satellite"})
 
-class OperationWorkflowTests(TestCase):
+
+class NodeFeatureTests(TestCase):
     def setUp(self):
-        self.client = Client()
-        User = get_user_model()
-        self.user = User.objects.create_superuser(
-            username="admin", email="admin@example.com", password="pwd"
+        self.role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node = Node.objects.create(
+                hostname="local",
+                address="127.0.0.1",
+                port=8000,
+                mac_address="00:11:22:33:44:55",
+                role=self.role,
+            )
+
+    def test_lcd_screen_enabled(self):
+        feature = NodeFeature.objects.create(slug="lcd-screen", display="LCD")
+        feature.roles.add(self.role)
+        NodeFeatureAssignment.objects.create(node=self.node, feature=feature)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertTrue(feature.is_enabled)
+        NodeFeatureAssignment.objects.filter(node=self.node, feature=feature).delete()
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertFalse(feature.is_enabled)
+
+    def test_rfid_scanner_lock(self):
+        feature = NodeFeature.objects.create(slug="rfid-scanner", display="RFID")
+        feature.roles.add(self.role)
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            locks = base / "locks"
+            locks.mkdir()
+            with override_settings(BASE_DIR=base):
+                with patch(
+                    "nodes.models.Node.get_current_mac",
+                    return_value="00:11:22:33:44:55",
+                ):
+                    self.assertFalse(feature.is_enabled)
+                    (locks / "rfid.lck").touch()
+                    self.assertTrue(feature.is_enabled)
+
+    def test_gui_toast_detection(self):
+        feature = NodeFeature.objects.create(slug="gui-toast", display="GUI Toast")
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            with patch("core.notifications.supports_gui_toast", return_value=True):
+                self.assertTrue(feature.is_enabled)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            with patch("core.notifications.supports_gui_toast", return_value=False):
+                self.assertFalse(feature.is_enabled)
+
+    def test_role_membership_alone_does_not_enable_feature(self):
+        feature = NodeFeature.objects.create(
+            slug="custom-feature", display="Custom Feature"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertFalse(feature.is_enabled)
+        NodeFeatureAssignment.objects.create(node=self.node, feature=feature)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertTrue(feature.is_enabled)
+
+    @patch("nodes.models.Node._has_rpi_camera", return_value=True)
+    def test_rpi_camera_detection(self, mock_camera):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
         )
-        self.client.force_login(self.user)
 
-    def tearDown(self):
-        RUN_CONTEXTS.clear()
+    @patch("nodes.models.Node._has_rpi_camera", side_effect=[True, False])
+    def test_rpi_camera_removed_when_unavailable(self, mock_camera):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+            self.assertTrue(
+                NodeFeatureAssignment.objects.filter(
+                    node=self.node, feature=feature
+                ).exists()
+            )
+            self.node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+
+    @patch("nodes.models.Node._hosts_gelectriic_ap", return_value=True)
+    def test_ap_router_detection(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        feature.roles.add(control_role)
+        mac = "00:11:22:33:44:66"
+        with patch("nodes.models.Node.get_current_mac", return_value=mac):
+            node = Node.objects.create(
+                hostname="control",
+                address="127.0.0.1",
+                port=8000,
+                mac_address=mac,
+                role=control_role,
+            )
+            node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(node=node, feature=feature).exists()
+        )
+
+    @patch("nodes.models.Node._hosts_gelectriic_ap", return_value=True)
+    def test_ap_public_wifi_detection(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        router = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        router.roles.add(control_role)
+        public = NodeFeature.objects.create(
+            slug="ap-public-wifi", display="AP Public Wi-Fi"
+        )
+        public.roles.add(control_role)
+        mac = "00:11:22:33:44:88"
+        with TemporaryDirectory() as tmp, override_settings(BASE_DIR=Path(tmp)):
+            locks = Path(tmp) / "locks"
+            locks.mkdir(parents=True, exist_ok=True)
+            (locks / "public_wifi_mode.lck").touch()
+            with patch("nodes.models.Node.get_current_mac", return_value=mac):
+                node = Node.objects.create(
+                    hostname="control",
+                    address="127.0.0.1",
+                    port=8000,
+                    mac_address=mac,
+                    role=control_role,
+                    base_path=str(Path(tmp)),
+                )
+                node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(node=node, feature=public).exists()
+        )
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(node=node, feature=router).exists()
+        )
+
+    @patch("nodes.models.Node._hosts_gelectriic_ap", side_effect=[True, False])
+    def test_ap_router_removed_when_not_hosting(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        feature.roles.add(control_role)
+        mac = "00:11:22:33:44:77"
+        with patch("nodes.models.Node.get_current_mac", return_value=mac):
+            node = Node.objects.create(
+                hostname="control",
+                address="127.0.0.1",
+                port=8000,
+                mac_address=mac,
+                role=control_role,
+            )
+            self.assertTrue(
+                NodeFeatureAssignment.objects.filter(
+                    node=node, feature=feature
+                ).exists()
+            )
+            node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(node=node, feature=feature).exists()
+        )
+
+    @patch("nodes.models.Node._uses_postgres", return_value=True)
+    def test_postgres_detection(self, mock_postgres):
+        feature = NodeFeature.objects.create(
+            slug="postgres-db", display="PostgreSQL Database"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
 
-    def test_unresolved_sigils_prompt(self):
-        op = Operation.objects.create(name="op1", command="[ENV.MISSING]")
-        url = reverse("admin:nodes_operation_run", args=[op.pk])
-        resp = self.client.post(url, follow=True)
-        self.assertContains(resp, 'name="ENV__MISSING"')
+    @patch("nodes.models.Node._uses_postgres", side_effect=[True, False])
+    def test_postgres_removed_when_not_in_use(self, mock_postgres):
+        feature = NodeFeature.objects.create(
+            slug="postgres-db", display="PostgreSQL Database"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+
+
+class NodeRpiCameraDetectionTests(TestCase):
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_true(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = True
+        mock_stat.return_value = SimpleNamespace(st_mode=stat.S_IFCHR)
+        mock_access.return_value = True
+        mock_which.side_effect = lambda name: f"/usr/bin/{name}"
+        mock_run.return_value = SimpleNamespace(returncode=0)
+
+        self.assertTrue(Node._has_rpi_camera())
+        self.assertEqual(mock_which.call_count, len(Node.RPI_CAMERA_BINARIES))
+        self.assertEqual(mock_run.call_count, len(Node.RPI_CAMERA_BINARIES))
+
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_missing_device(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = False
+
+        self.assertFalse(Node._has_rpi_camera())
+        mock_stat.assert_not_called()
+        mock_access.assert_not_called()
+        mock_which.assert_not_called()
+        mock_run.assert_not_called()
+
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_missing_tool(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = True
+        mock_stat.return_value = SimpleNamespace(st_mode=stat.S_IFCHR)
+        mock_access.return_value = True
+        mock_run.return_value = SimpleNamespace(returncode=0)
 
-    def test_continue_effect(self):
-        op = Operation.objects.create(name="op2", command="...")
-        url = reverse("admin:nodes_operation_run", args=[op.pk])
-        resp = self.client.post(url, follow=True)
-        self.assertContains(resp, 'value="Continue"')
+        def tool_lookup(name):
+            if name == Node.RPI_CAMERA_BINARIES[-1]:
+                return None
+            return f"/usr/bin/{name}"
 
+        mock_which.side_effect = tool_lookup
 
+        self.assertFalse(Node._has_rpi_camera())
+        missing_index = Node.RPI_CAMERA_BINARIES.index(Node.RPI_CAMERA_BINARIES[-1])
+        self.assertEqual(mock_run.call_count, missing_index)