arthexis 0.1.8__py3-none-any.whl → 0.1.10__py3-none-any.whl

nodes/tests.py

@@ -6,14 +6,20 @@ import django
 django.setup()
 
 from pathlib import Path
+from types import SimpleNamespace
 from unittest.mock import patch, call, MagicMock
+from django.core import mail
+from django.core.mail import EmailMessage
+from django.core.management import call_command
 import socket
 import base64
 import json
 import uuid
 from tempfile import TemporaryDirectory
 import shutil
+import stat
 import time
+from datetime import timedelta
 
 from django.test import Client, TestCase, TransactionTestCase, override_settings
 from django.urls import reverse
@@ -22,6 +28,7 @@ from django.contrib import admin
 from django.contrib.sites.models import Site
 from django_celery_beat.models import PeriodicTask
 from django.conf import settings
+from django.utils import timezone
 from .actions import NodeAction
 from selenium.common.exceptions import WebDriverException
 from .utils import capture_screenshot
@@ -31,23 +38,22 @@ from .models import (
     EmailOutbox,
     ContentSample,
     NodeRole,
+    NodeFeature,
+    NodeFeatureAssignment,
     NetMessage,
 )
+from .backends import OutboxEmailBackend
 from .tasks import capture_node_screenshot, sample_clipboard
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.primitives import serialization, hashes
-from core.models import PackageRelease
-from .models import Operation
-from .admin import RUN_CONTEXTS
+from core.models import PackageRelease, SecurityGroup
 
 
 class NodeTests(TestCase):
     def setUp(self):
         self.client = Client()
         User = get_user_model()
-        self.user = User.objects.create_user(
-            username="nodeuser", password="pwd"
-        )
+        self.user = User.objects.create_user(username="nodeuser", password="pwd")
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
 
@@ -55,16 +61,18 @@ class NodeTests(TestCase):
         with TemporaryDirectory() as tmp:
             base = Path(tmp)
             with override_settings(BASE_DIR=base):
-                with patch(
-                    "nodes.models.Node.get_current_mac",
-                    return_value="00:ff:ee:dd:cc:bb",
-                ), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
                     Node.register_current()
         self.assertEqual(PackageRelease.objects.count(), 0)
 
@@ -117,7 +125,10 @@ class NodeTests(TestCase):
         hostnames = {n["hostname"] for n in data["nodes"]}
         self.assertEqual(hostnames, {"dup", "local2"})
 
-    def test_register_node_has_lcd_screen_toggle(self):
+    def test_register_node_feature_toggle(self):
+        NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
         url = reverse("register-node")
         first = self.client.post(
             url,
@@ -126,13 +137,13 @@ class NodeTests(TestCase):
                 "address": "127.0.0.1",
                 "port": 8000,
                 "mac_address": "00:aa:bb:cc:dd:ee",
-                "has_lcd_screen": True,
+                "features": ["clipboard-poll"],
             },
             content_type="application/json",
         )
         self.assertEqual(first.status_code, 200)
         node = Node.objects.get(mac_address="00:aa:bb:cc:dd:ee")
-        self.assertTrue(node.has_lcd_screen)
+        self.assertTrue(node.has_feature("clipboard-poll"))
 
         self.client.post(
             url,
@@ -141,12 +152,224 @@ class NodeTests(TestCase):
                 "address": "127.0.0.1",
                 "port": 8000,
                 "mac_address": "00:aa:bb:cc:dd:ee",
-                "has_lcd_screen": False,
+                "features": [],
             },
             content_type="application/json",
         )
         node.refresh_from_db()
-        self.assertFalse(node.has_lcd_screen)
+        self.assertFalse(node.has_feature("clipboard-poll"))
+
+    def test_register_node_records_version_details(self):
+        url = reverse("register-node")
+        payload = {
+            "hostname": "versioned",
+            "address": "127.0.0.5",
+            "port": 8100,
+            "mac_address": "aa:bb:cc:dd:ee:10",
+            "installed_version": "2.0.1",
+            "installed_revision": "rev-abcdef",
+        }
+        response = self.client.post(
+            url, data=json.dumps(payload), content_type="application/json"
+        )
+        self.assertEqual(response.status_code, 200)
+        node = Node.objects.get(mac_address="aa:bb:cc:dd:ee:10")
+        self.assertEqual(node.installed_version, "2.0.1")
+        self.assertEqual(node.installed_revision, "rev-abcdef")
+
+        update_payload = {
+            **payload,
+            "installed_version": "2.1.0",
+            "installed_revision": "rev-fedcba",
+        }
+        second = self.client.post(
+            url, data=json.dumps(update_payload), content_type="application/json"
+        )
+        self.assertEqual(second.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.1.0")
+        self.assertEqual(node.installed_revision, "rev-fedcba")
+
+    def test_register_node_update_triggers_notification(self):
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:01",
+            installed_version="1.0.0",
+            installed_revision="rev-old",
+        )
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:01",
+            "installed_version": "2.0.0",
+            "installed_revision": "abcdef123456",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.0.0")
+        self.assertEqual(node.installed_revision, "abcdef123456")
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0 r123456")
+
+    def test_register_node_update_without_version_change_still_notifies(self):
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:02",
+            installed_version="2.0.0",
+            installed_revision="abcdef123456",
+        )
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:02",
+            "installed_version": "2.0.0",
+            "installed_revision": "abcdef123456",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0 r123456")
+
+    def test_register_node_creation_triggers_notification(self):
+        url = reverse("register-node")
+        payload = {
+            "hostname": "newbie",
+            "address": "10.1.1.6",
+            "port": 8124,
+            "mac_address": "aa:bb:cc:dd:ee:03",
+            "installed_version": "3.0.0",
+            "installed_revision": "rev-1234567890",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Node.objects.filter(mac_address="aa:bb:cc:dd:ee:03").exists())
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP newbie")
+        self.assertEqual(body, "v3.0.0 r567890")
+
+    def test_register_node_sets_cors_headers(self):
+        payload = {
+            "hostname": "cors",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "10:20:30:40:50:60",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+        self.assertEqual(response["Access-Control-Allow-Credentials"], "true")
+
+    def test_register_node_requires_auth_without_signature(self):
+        self.client.logout()
+        payload = {
+            "hostname": "visitor",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "aa:bb:cc:dd:ee:00",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 401)
+        data = response.json()
+        self.assertEqual(data["detail"], "authentication required")
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+
+    def test_register_node_allows_preflight_without_authentication(self):
+        self.client.logout()
+        response = self.client.options(
+            reverse("register-node"), HTTP_ORIGIN="https://example.com"
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "https://example.com")
+        self.assertEqual(response["Access-Control-Allow-Credentials"], "true")
+
+    def test_register_node_accepts_signed_payload_without_login(self):
+        self.client.logout()
+        NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        public_bytes = private_key.public_key().public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        ).decode()
+        token = "visitor-token"
+        signature = base64.b64encode(
+            private_key.sign(
+                token.encode(),
+                padding.PKCS1v15(),
+                hashes.SHA256(),
+            )
+        ).decode()
+        payload = {
+            "hostname": "visitor",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "aa:bb:cc:dd:ee:11",
+            "public_key": public_bytes,
+            "token": token,
+            "signature": signature,
+            "features": ["clipboard-poll"],
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+        node = Node.objects.get(mac_address="aa:bb:cc:dd:ee:11")
+        self.assertEqual(node.public_key, public_bytes)
+        self.assertTrue(node.has_feature("clipboard-poll"))
+
+    def test_register_node_accepts_text_plain_payload(self):
+        payload = {
+            "hostname": "plain",
+            "address": "127.0.0.1",
+            "port": 8001,
+            "mac_address": "aa:bb:cc:dd:ee:ff",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="text/plain",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Node.objects.filter(mac_address="aa:bb:cc:dd:ee:ff").exists())
 
 
 class NodeRegisterCurrentTests(TestCase):
@@ -156,39 +379,179 @@ class NodeRegisterCurrentTests(TestCase):
         self.user = User.objects.create_user(username="nodeuser", password="pwd")
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
-    def test_register_current_sets_and_retains_lcd(self):
+
+    def test_register_current_notifies_peers_on_start(self):
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                    patch.object(Node, "notify_peers_of_update") as mock_notify,
+                ):
+                    Node.register_current()
+        mock_notify.assert_called_once()
+
+    def test_register_current_refreshes_lcd_feature(self):
+        NodeFeature.objects.get_or_create(
+            slug="lcd-screen", defaults={"display": "LCD Screen"}
+        )
         with TemporaryDirectory() as tmp:
             base = Path(tmp)
             locks = base / "locks"
             locks.mkdir()
-            (locks / "lcd_screen.lck").touch()
+            lock = locks / "lcd_screen.lck"
+            lock.touch()
             with override_settings(BASE_DIR=base):
-                with patch("nodes.models.Node.get_current_mac", return_value="00:ff:ee:dd:cc:bb"), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
                     node, created = Node.register_current()
             self.assertTrue(created)
-            self.assertTrue(node.has_lcd_screen)
-
-            node.has_lcd_screen = False
-            node.save(update_fields=["has_lcd_screen"])
+            self.assertTrue(node.has_feature("lcd-screen"))
 
+            lock.unlink()
             with override_settings(BASE_DIR=base):
-                with patch("nodes.models.Node.get_current_mac", return_value="00:ff:ee:dd:cc:bb"), patch(
-                    "nodes.models.socket.gethostname", return_value="testhost"
-                ), patch(
-                    "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
-                ), patch(
-                    "nodes.models.revision.get_revision", return_value="rev"
-                ), patch.object(Node, "ensure_keys"):
-                    node2, created2 = Node.register_current()
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
+                    _, created2 = Node.register_current()
             self.assertFalse(created2)
             node.refresh_from_db()
-            self.assertFalse(node.has_lcd_screen)
+            self.assertFalse(node.has_feature("lcd-screen"))
+
+            lock.touch()
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                ):
+                    node, created3 = Node.register_current()
+            self.assertFalse(created3)
+            node.refresh_from_db()
+            self.assertTrue(node.has_feature("lcd-screen"))
+
+    def test_register_current_notifies_peers_on_version_upgrade(self):
+        remote = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.2",
+            port=9100,
+            mac_address="aa:bb:cc:dd:ee:ff",
+        )
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            (base / "VERSION").write_text("2.0.0")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="localnode"),
+                    patch(
+                        "nodes.models.socket.gethostbyname",
+                        return_value="192.168.1.5",
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="newrev"),
+                    patch("requests.post") as mock_post,
+                ):
+                    Node.objects.create(
+                        hostname="localnode",
+                        address="192.168.1.5",
+                        port=8000,
+                        mac_address="00:ff:ee:dd:cc:bb",
+                        installed_version="1.9.0",
+                        installed_revision="oldrev",
+                    )
+                    mock_post.return_value = SimpleNamespace(
+                        ok=True, status_code=200, text=""
+                    )
+                    node, created = Node.register_current()
+        self.assertFalse(created)
+        self.assertGreaterEqual(mock_post.call_count, 1)
+        args, kwargs = mock_post.call_args
+        self.assertIn(str(remote.port), args[0])
+        payload = json.loads(kwargs["data"])
+        self.assertEqual(payload["hostname"], "localnode")
+        self.assertEqual(payload["installed_version"], "2.0.0")
+        self.assertEqual(payload["installed_revision"], "newrev")
+
+    def test_register_current_notifies_peers_without_version_change(self):
+        Node.objects.create(
+            hostname="remote",
+            address="10.0.0.3",
+            port=9200,
+            mac_address="aa:bb:cc:dd:ee:11",
+        )
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            (base / "VERSION").write_text("1.0.0")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:cc",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="samever"),
+                    patch(
+                        "nodes.models.socket.gethostbyname",
+                        return_value="192.168.1.6",
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev1"),
+                    patch("requests.post") as mock_post,
+                ):
+                    Node.objects.create(
+                        hostname="samever",
+                        address="192.168.1.6",
+                        port=8000,
+                        mac_address="00:ff:ee:dd:cc:cc",
+                        installed_version="1.0.0",
+                        installed_revision="rev1",
+                    )
+                    mock_post.return_value = SimpleNamespace(
+                        ok=True, status_code=200, text=""
+                    )
+                    Node.register_current()
+        self.assertEqual(mock_post.call_count, 1)
+        args, kwargs = mock_post.call_args
+        self.assertIn("/nodes/register/", args[0])
+        payload = json.loads(kwargs["data"])
+        self.assertEqual(payload["installed_version"], "1.0.0")
+        self.assertEqual(payload.get("installed_revision"), "rev1")
 
     @patch("nodes.views.capture_screenshot")
     def test_capture_screenshot(self, mock_capture):
@@ -270,9 +633,7 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertEqual(get_resp.json()["hostname"], "public")
 
         pre_count = NetMessage.objects.count()
-        post_resp = self.client.post(
-            url, data="hello", content_type="text/plain"
-        )
+        post_resp = self.client.post(url, data="hello", content_type="text/plain")
         self.assertEqual(post_resp.status_code, 200)
         self.assertEqual(NetMessage.objects.count(), pre_count + 1)
         msg = NetMessage.objects.order_by("-created").first()
@@ -307,10 +668,14 @@ class NodeRegisterCurrentTests(TestCase):
 
     def test_net_message_with_valid_signature(self):
         key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-        public_key = key.public_key().public_bytes(
-            encoding=serialization.Encoding.PEM,
-            format=serialization.PublicFormat.SubjectPublicKeyInfo,
-        ).decode()
+        public_key = (
+            key.public_key()
+            .public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            .decode()
+        )
         sender = Node.objects.create(
             hostname="sender",
             address="10.0.0.1",
@@ -325,11 +690,10 @@ class NodeRegisterCurrentTests(TestCase):
             "body": "world",
             "seen": [],
             "sender": str(sender.uuid),
+            "origin": str(sender.uuid),
         }
         payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
-        signature = key.sign(
-            payload_json.encode(), padding.PKCS1v15(), hashes.SHA256()
-        )
+        signature = key.sign(payload_json.encode(), padding.PKCS1v15(), hashes.SHA256())
         resp = self.client.post(
             reverse("net-message"),
             data=payload_json,
@@ -338,8 +702,13 @@ class NodeRegisterCurrentTests(TestCase):
         )
         self.assertEqual(resp.status_code, 200)
         self.assertTrue(NetMessage.objects.filter(uuid=msg_id).exists())
+        message = NetMessage.objects.get(uuid=msg_id)
+        self.assertEqual(message.node_origin, sender)
 
     def test_clipboard_polling_creates_task(self):
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
         node = Node.objects.create(
             hostname="clip",
             address="127.0.0.1",
@@ -347,15 +716,16 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:99",
         )
         task_name = f"poll_clipboard_node_{node.pk}"
-        self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
-        node.clipboard_polling = True
-        node.save()
+        PeriodicTask.objects.filter(name=task_name).delete()
+        NodeFeatureAssignment.objects.create(node=node, feature=feature)
         self.assertTrue(PeriodicTask.objects.filter(name=task_name).exists())
-        node.clipboard_polling = False
-        node.save()
+        NodeFeatureAssignment.objects.filter(node=node, feature=feature).delete()
         self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
 
     def test_screenshot_polling_creates_task(self):
+        feature, _ = NodeFeature.objects.get_or_create(
+            slug="screenshot-poll", defaults={"display": "Screenshot Poll"}
+        )
         node = Node.objects.create(
             hostname="shot",
             address="127.0.0.1",
@@ -363,14 +733,22 @@ class NodeRegisterCurrentTests(TestCase):
             mac_address="00:11:22:33:44:aa",
         )
         task_name = f"capture_screenshot_node_{node.pk}"
-        self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
-        node.screenshot_polling = True
-        node.save()
+        PeriodicTask.objects.filter(name=task_name).delete()
+        NodeFeatureAssignment.objects.create(node=node, feature=feature)
         self.assertTrue(PeriodicTask.objects.filter(name=task_name).exists())
-        node.screenshot_polling = False
-        node.save()
+        NodeFeatureAssignment.objects.filter(node=node, feature=feature).delete()
         self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
 
+
+class CheckRegistrationReadyCommandTests(TestCase):
+    def test_command_completes_successfully(self):
+        NodeRole.objects.get_or_create(name="Terminal")
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            with override_settings(BASE_DIR=base):
+                call_command("check_registration_ready")
+
+
 class NodeAdminTests(TestCase):
 
     def setUp(self):
@@ -395,7 +773,7 @@ class NodeAdminTests(TestCase):
         self.assertTemplateUsed(response, "admin/nodes/node/register_remote.html")
         self.assertEqual(Node.objects.count(), 1)
         node = Node.objects.first()
-        ver = Path('VERSION').read_text().strip()
+        ver = Path("VERSION").read_text().strip()
         rev = "abcdef123456"
         self.assertEqual(node.base_path, str(settings.BASE_DIR))
         self.assertEqual(node.installed_version, ver)
@@ -408,9 +786,7 @@ class NodeAdminTests(TestCase):
         self.assertTrue(priv.exists())
         self.assertTrue(pub.exists())
         self.assertTrue(node.public_key)
-        self.assertTrue(
-            Site.objects.filter(domain=hostname, name="host").exists()
-        )
+        self.assertTrue(Site.objects.filter(domain=hostname, name="host").exists())
 
     def test_register_current_updates_existing_node(self):
         hostname = socket.gethostname()
@@ -446,9 +822,7 @@ class NodeAdminTests(TestCase):
         self.assertIn(node.public_key.strip(), resp.content.decode())
 
     @patch("nodes.admin.capture_screenshot")
-    def test_capture_site_screenshot_from_admin(
-        self, mock_capture_screenshot
-    ):
+    def test_capture_site_screenshot_from_admin(self, mock_capture_screenshot):
         screenshot_dir = settings.LOG_DIR / "screenshots"
         screenshot_dir.mkdir(parents=True, exist_ok=True)
         file_path = screenshot_dir / "test.png"
@@ -472,9 +846,7 @@ class NodeAdminTests(TestCase):
         self.assertEqual(screenshot.path, "screenshots/test.png")
         self.assertEqual(screenshot.method, "ADMIN")
         mock_capture_screenshot.assert_called_once_with("http://testserver/")
-        self.assertContains(
-            response, "Screenshot saved to screenshots/test.png"
-        )
+        self.assertContains(response, "Screenshot saved to screenshots/test.png")
 
     def test_view_screenshot_in_change_admin(self):
         screenshot_dir = settings.LOG_DIR / "screenshots"
@@ -578,7 +950,9 @@ class NetMessageReachTests(TestCase):
         for name in ["Terminal", "Control", "Satellite", "Constellation"]:
             self.roles[name], _ = NodeRole.objects.get_or_create(name=name)
         self.nodes = {}
-        for idx, name in enumerate(["Terminal", "Control", "Satellite", "Constellation"], start=1):
+        for idx, name in enumerate(
+            ["Terminal", "Control", "Satellite", "Constellation"], start=1
+        ):
             self.nodes[name] = Node.objects.create(
                 hostname=name.lower(),
                 address=f"10.0.0.{idx}",
@@ -589,7 +963,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_terminal_reach_limits_nodes(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Terminal"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Terminal"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -598,7 +974,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_control_reach_includes_control_and_terminal(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Control"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Control"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -607,7 +985,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_satellite_reach_includes_lower_roles(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Satellite"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Satellite"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -616,7 +996,9 @@ class NetMessageReachTests(TestCase):
 
     @patch("requests.post")
     def test_constellation_reach_prioritizes_constellation(self, mock_post):
-        msg = NetMessage.objects.create(subject="s", body="b", reach=self.roles["Constellation"])
+        msg = NetMessage.objects.create(
+            subject="s", body="b", reach=self.roles["Constellation"]
+        )
         with patch.object(Node, "get_local", return_value=None):
             msg.propagate()
         roles = set(msg.propagated_to.values_list("role__name", flat=True))
@@ -648,14 +1030,24 @@ class NetMessagePropagationTests(TestCase):
                 )
             )
 
+    def test_broadcast_sets_node_origin(self):
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg = NetMessage.broadcast(subject="subject", body="body")
+        self.assertEqual(msg.node_origin, self.local)
+
     @patch("requests.post")
     @patch("core.notifications.notify")
-    def test_propagate_forwards_to_three_and_notifies_local(self, mock_notify, mock_post):
+    def test_propagate_forwards_to_three_and_notifies_local(
+        self, mock_notify, mock_post
+    ):
         msg = NetMessage.objects.create(subject="s", body="b", reach=self.role)
         with patch.object(Node, "get_local", return_value=self.local):
             msg.propagate(seen=[str(self.remotes[0].uuid)])
         mock_notify.assert_called_once_with("s", "b")
         self.assertEqual(mock_post.call_count, 3)
+        for call_args in mock_post.call_args_list:
+            payload = json.loads(call_args.kwargs["data"])
+            self.assertEqual(payload.get("origin"), str(self.local.uuid))
         targets = {
             call.args[0].split("//")[1].split("/")[0]
             for call in mock_post.call_args_list
@@ -665,6 +1057,42 @@ class NetMessagePropagationTests(TestCase):
         self.assertEqual(msg.propagated_to.count(), 4)
         self.assertTrue(msg.complete)
 
+    @patch("requests.post")
+    @patch("core.notifications.notify", return_value=True)
+    def test_propagate_prunes_old_local_messages(self, mock_notify, mock_post):
+        old_local = NetMessage.objects.create(
+            subject="old local",
+            body="body",
+            reach=self.role,
+            node_origin=self.local,
+        )
+        NetMessage.objects.filter(pk=old_local.pk).update(
+            created=timezone.now() - timedelta(days=8)
+        )
+        old_remote = NetMessage.objects.create(
+            subject="old remote",
+            body="body",
+            reach=self.role,
+            node_origin=self.remotes[0],
+        )
+        NetMessage.objects.filter(pk=old_remote.pk).update(
+            created=timezone.now() - timedelta(days=8)
+        )
+        msg = NetMessage.objects.create(
+            subject="fresh",
+            body="body",
+            reach=self.role,
+            node_origin=self.local,
+        )
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg.propagate()
+
+        mock_notify.assert_called_once_with("fresh", "body")
+        self.assertFalse(NetMessage.objects.filter(pk=old_local.pk).exists())
+        self.assertTrue(NetMessage.objects.filter(pk=old_remote.pk).exists())
+        self.assertTrue(NetMessage.objects.filter(pk=msg.pk).exists())
+
+
 class NodeActionTests(TestCase):
     def setUp(self):
         self.client = Client()
@@ -739,7 +1167,7 @@ class NodeActionTests(TestCase):
 
 
 class StartupNotificationTests(TestCase):
-    def test_startup_notification_uses_ip_and_revision(self):
+    def test_startup_notification_uses_hostname_and_revision(self):
         from nodes.apps import _startup_notification
 
         with TemporaryDirectory() as tmp:
@@ -750,20 +1178,17 @@ class StartupNotificationTests(TestCase):
                     "nodes.apps.revision.get_revision", return_value="abcdef123456"
                 ):
                     with patch("nodes.models.NetMessage.broadcast") as mock_broadcast:
-                        with patch("nodes.apps.socket.gethostname", return_value="host"):
-                            with patch(
-                                "nodes.apps.socket.gethostbyname", return_value="1.2.3.4"
-                            ):
-                                with patch.dict(
-                                    os.environ, {"PORT": "9000"}
-                                ):
-                                    _startup_notification()
-                                    time.sleep(0.1)
+                        with patch(
+                            "nodes.apps.socket.gethostname", return_value="host"
+                        ):
+                            with patch.dict(os.environ, {"PORT": "9000"}):
+                                _startup_notification()
+                                time.sleep(0.1)
 
         mock_broadcast.assert_called_once()
         _, kwargs = mock_broadcast.call_args
-        self.assertEqual(kwargs["subject"], "1.2.3.4:9000")
-        self.assertTrue(kwargs["body"].startswith("v1.2.3 r"))
+        self.assertEqual(kwargs["subject"], "host:9000")
+        self.assertTrue(kwargs["body"].startswith("1.2.3 r"))
 
 
 class StartupHandlerTests(TestCase):
@@ -787,11 +1212,14 @@ class StartupHandlerTests(TestCase):
 
         with patch("nodes.apps._startup_notification") as mock_start:
             with patch("nodes.apps.connections") as mock_connections:
-                mock_connections.__getitem__.return_value.ensure_connection.return_value = None
+                mock_connections.__getitem__.return_value.ensure_connection.return_value = (
+                    None
+                )
                 _trigger_startup_notification()
 
         mock_start.assert_called_once()
 
+
 class NotificationManagerTests(TestCase):
     def test_send_writes_trimmed_lines(self):
         from core.notifications import NotificationManager
@@ -921,6 +1349,7 @@ class ContentSampleAdminTests(TestCase):
         self.assertContains(resp, "Duplicate sample not created")
 
 
+@override_settings(EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend")
 class EmailOutboxTests(TestCase):
     def test_node_send_mail_uses_outbox(self):
         node = Node.objects.create(
@@ -929,31 +1358,51 @@ class EmailOutboxTests(TestCase):
             port=8000,
             mac_address="00:11:22:33:aa:bb",
         )
-        EmailOutbox.objects.create(
+        outbox = EmailOutbox.objects.create(
             node=node, host="smtp.example.com", port=25, username="u", password="p"
         )
-        with patch("nodes.models.get_connection") as gc, patch(
-            "nodes.models.send_mail"
-        ) as sm:
-            conn = MagicMock()
-            gc.return_value = conn
+        with patch("nodes.models.mailer.send") as ms:
             node.send_mail("sub", "msg", ["to@example.com"])
-            gc.assert_called_once_with(
-                host="smtp.example.com",
-                port=25,
-                username="u",
-                password="p",
-                use_tls=True,
-                use_ssl=False,
-            )
-            sm.assert_called_once_with(
-                "sub",
-                "msg",
-                settings.DEFAULT_FROM_EMAIL,
-                ["to@example.com"],
-                connection=conn,
+            ms.assert_called_once_with(
+                "sub", "msg", ["to@example.com"], None, outbox=outbox
             )
 
+    def test_node_send_mail_queues_email(self):
+        node = Node.objects.create(
+            hostname="host",
+            address="127.0.0.1",
+            port=8000,
+            mac_address="00:11:22:33:cc:dd",
+        )
+        node.send_mail("sub", "msg", ["to@example.com"])
+        self.assertEqual(len(mail.outbox), 1)
+        email = mail.outbox[0]
+        self.assertEqual(email.subject, "sub")
+        self.assertEqual(email.to, ["to@example.com"])
+
+    def test_string_representation_prefers_from_email(self):
+        outbox = EmailOutbox.objects.create(
+            host="smtp.example.com",
+            port=587,
+            username="mailer",
+            password="secret",
+            from_email="noreply@example.com",
+        )
+
+        self.assertEqual(str(outbox), "noreply@example.com")
+
+    def test_string_representation_prefers_username_over_owner(self):
+        group = SecurityGroup.objects.create(name="Operators")
+        outbox = EmailOutbox.objects.create(
+            group=group,
+            host="smtp.example.com",
+            port=587,
+            username="mailer",
+            password="secret",
+        )
+
+        self.assertEqual(str(outbox), "mailer@smtp.example.com")
+
 
 class ClipboardTaskTests(TestCase):
     @patch("nodes.tasks.pyperclip.paste")
@@ -1066,29 +1515,344 @@ class NodeRoleAdminTests(TestCase):
         self.assertIsNone(node1.role)
         self.assertEqual(node2.role, role)
 
+    def test_registered_count_displayed(self):
+        role = NodeRole.objects.create(name="ViewRole")
+        Node.objects.create(
+            hostname="n1",
+            address="127.0.0.1",
+            port=8000,
+            mac_address="00:11:22:33:44:77",
+            role=role,
+        )
+        resp = self.client.get(reverse("admin:nodes_noderole_changelist"))
+        self.assertContains(resp, '<td class="field-registered">1</td>', html=True)
+
+
+class NodeFeatureFixtureTests(TestCase):
+    def test_rfid_scanner_fixture_includes_control_role(self):
+        for name in ("Terminal", "Satellite", "Constellation", "Control"):
+            NodeRole.objects.get_or_create(name=name)
+        fixture_path = (
+            Path(__file__).resolve().parent
+            / "fixtures"
+            / "node_features__nodefeature_rfid_scanner.json"
+        )
+        call_command("loaddata", str(fixture_path), verbosity=0)
+        feature = NodeFeature.objects.get(slug="rfid-scanner")
+        role_names = set(feature.roles.values_list("name", flat=True))
+        self.assertIn("Control", role_names)
+
+    def test_ap_router_fixture_limits_roles(self):
+        for name in ("Control", "Satellite"):
+            NodeRole.objects.get_or_create(name=name)
+        fixture_path = (
+            Path(__file__).resolve().parent
+            / "fixtures"
+            / "node_features__nodefeature_ap_router.json"
+        )
+        call_command("loaddata", str(fixture_path), verbosity=0)
+        feature = NodeFeature.objects.get(slug="ap-router")
+        role_names = set(feature.roles.values_list("name", flat=True))
+        self.assertEqual(role_names, {"Satellite"})
 
-class OperationWorkflowTests(TestCase):
+
+class NodeFeatureTests(TestCase):
     def setUp(self):
-        self.client = Client()
-        User = get_user_model()
-        self.user = User.objects.create_superuser(
-            username="admin", email="admin@example.com", password="pwd"
+        self.role, _ = NodeRole.objects.get_or_create(name="Terminal")
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node = Node.objects.create(
+                hostname="local",
+                address="127.0.0.1",
+                port=8000,
+                mac_address="00:11:22:33:44:55",
+                role=self.role,
+            )
+
+    def test_lcd_screen_enabled(self):
+        feature = NodeFeature.objects.create(slug="lcd-screen", display="LCD")
+        feature.roles.add(self.role)
+        NodeFeatureAssignment.objects.create(node=self.node, feature=feature)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertTrue(feature.is_enabled)
+        NodeFeatureAssignment.objects.filter(node=self.node, feature=feature).delete()
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertFalse(feature.is_enabled)
+
+    def test_rfid_scanner_lock(self):
+        feature = NodeFeature.objects.create(slug="rfid-scanner", display="RFID")
+        feature.roles.add(self.role)
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            locks = base / "locks"
+            locks.mkdir()
+            with override_settings(BASE_DIR=base):
+                with patch(
+                    "nodes.models.Node.get_current_mac",
+                    return_value="00:11:22:33:44:55",
+                ):
+                    self.assertFalse(feature.is_enabled)
+                    (locks / "rfid.lck").touch()
+                    self.assertTrue(feature.is_enabled)
+
+    def test_gui_toast_detection(self):
+        feature = NodeFeature.objects.create(slug="gui-toast", display="GUI Toast")
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            with patch("core.notifications.supports_gui_toast", return_value=True):
+                self.assertTrue(feature.is_enabled)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            with patch("core.notifications.supports_gui_toast", return_value=False):
+                self.assertFalse(feature.is_enabled)
+
+    def test_role_membership_alone_does_not_enable_feature(self):
+        feature = NodeFeature.objects.create(
+            slug="custom-feature", display="Custom Feature"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertFalse(feature.is_enabled)
+        NodeFeatureAssignment.objects.create(node=self.node, feature=feature)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.assertTrue(feature.is_enabled)
+
+    @patch("nodes.models.Node._has_rpi_camera", return_value=True)
+    def test_rpi_camera_detection(self, mock_camera):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
         )
-        self.client.force_login(self.user)
 
-    def tearDown(self):
-        RUN_CONTEXTS.clear()
+    @patch("nodes.models.Node._has_rpi_camera", side_effect=[True, False])
+    def test_rpi_camera_removed_when_unavailable(self, mock_camera):
+        feature = NodeFeature.objects.create(
+            slug="rpi-camera", display="Raspberry Pi Camera"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+            self.assertTrue(
+                NodeFeatureAssignment.objects.filter(
+                    node=self.node, feature=feature
+                ).exists()
+            )
+            self.node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+
+    @patch("nodes.models.Node._hosts_gelectriic_ap", return_value=True)
+    def test_ap_router_detection(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        feature.roles.add(control_role)
+        mac = "00:11:22:33:44:66"
+        with patch("nodes.models.Node.get_current_mac", return_value=mac):
+            node = Node.objects.create(
+                hostname="control",
+                address="127.0.0.1",
+                port=8000,
+                mac_address=mac,
+                role=control_role,
+            )
+            node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(node=node, feature=feature).exists()
+        )
 
-    def test_unresolved_sigils_prompt(self):
-        op = Operation.objects.create(name="op1", command="[ENV.MISSING]")
-        url = reverse("admin:nodes_operation_run", args=[op.pk])
-        resp = self.client.post(url, follow=True)
-        self.assertContains(resp, 'name="ENV__MISSING"')
+    @patch("nodes.models.Node._hosts_gelectriic_ap", return_value=True)
+    def test_ap_public_wifi_detection(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        router = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        router.roles.add(control_role)
+        public = NodeFeature.objects.create(
+            slug="ap-public-wifi", display="AP Public Wi-Fi"
+        )
+        public.roles.add(control_role)
+        mac = "00:11:22:33:44:88"
+        with TemporaryDirectory() as tmp, override_settings(BASE_DIR=Path(tmp)):
+            locks = Path(tmp) / "locks"
+            locks.mkdir(parents=True, exist_ok=True)
+            (locks / "public_wifi_mode.lck").touch()
+            with patch("nodes.models.Node.get_current_mac", return_value=mac):
+                node = Node.objects.create(
+                    hostname="control",
+                    address="127.0.0.1",
+                    port=8000,
+                    mac_address=mac,
+                    role=control_role,
+                    base_path=str(Path(tmp)),
+                )
+                node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(node=node, feature=public).exists()
+        )
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(node=node, feature=router).exists()
+        )
+
+    @patch("nodes.models.Node._hosts_gelectriic_ap", side_effect=[True, False])
+    def test_ap_router_removed_when_not_hosting(self, mock_hosts):
+        control_role, _ = NodeRole.objects.get_or_create(name="Control")
+        feature = NodeFeature.objects.create(slug="ap-router", display="AP Router")
+        feature.roles.add(control_role)
+        mac = "00:11:22:33:44:77"
+        with patch("nodes.models.Node.get_current_mac", return_value=mac):
+            node = Node.objects.create(
+                hostname="control",
+                address="127.0.0.1",
+                port=8000,
+                mac_address=mac,
+                role=control_role,
+            )
+            self.assertTrue(
+                NodeFeatureAssignment.objects.filter(
+                    node=node, feature=feature
+                ).exists()
+            )
+            node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(node=node, feature=feature).exists()
+        )
+
+    @patch("nodes.models.Node._uses_postgres", return_value=True)
+    def test_postgres_detection(self, mock_postgres):
+        feature = NodeFeature.objects.create(
+            slug="postgres-db", display="PostgreSQL Database"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+
+    @patch("nodes.models.Node._uses_postgres", side_effect=[True, False])
+    def test_postgres_removed_when_not_in_use(self, mock_postgres):
+        feature = NodeFeature.objects.create(
+            slug="postgres-db", display="PostgreSQL Database"
+        )
+        feature.roles.add(self.role)
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertTrue(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+        with patch(
+            "nodes.models.Node.get_current_mac", return_value="00:11:22:33:44:55"
+        ):
+            self.node.refresh_features()
+        self.assertFalse(
+            NodeFeatureAssignment.objects.filter(
+                node=self.node, feature=feature
+            ).exists()
+        )
+
+
+class NodeRpiCameraDetectionTests(TestCase):
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_true(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = True
+        mock_stat.return_value = SimpleNamespace(st_mode=stat.S_IFCHR)
+        mock_access.return_value = True
+        mock_which.side_effect = lambda name: f"/usr/bin/{name}"
+        mock_run.return_value = SimpleNamespace(returncode=0)
+
+        self.assertTrue(Node._has_rpi_camera())
+        self.assertEqual(mock_which.call_count, len(Node.RPI_CAMERA_BINARIES))
+        self.assertEqual(mock_run.call_count, len(Node.RPI_CAMERA_BINARIES))
+
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_missing_device(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = False
+
+        self.assertFalse(Node._has_rpi_camera())
+        mock_stat.assert_not_called()
+        mock_access.assert_not_called()
+        mock_which.assert_not_called()
+        mock_run.assert_not_called()
+
+    @patch("nodes.models.subprocess.run")
+    @patch("nodes.models.shutil.which")
+    @patch("nodes.models.os.access")
+    @patch("nodes.models.os.stat")
+    @patch("nodes.models.Path.exists")
+    def test_has_rpi_camera_missing_tool(
+        self,
+        mock_exists,
+        mock_stat,
+        mock_access,
+        mock_which,
+        mock_run,
+    ):
+        mock_exists.return_value = True
+        mock_stat.return_value = SimpleNamespace(st_mode=stat.S_IFCHR)
+        mock_access.return_value = True
+        mock_run.return_value = SimpleNamespace(returncode=0)
 
-    def test_continue_effect(self):
-        op = Operation.objects.create(name="op2", command="...")
-        url = reverse("admin:nodes_operation_run", args=[op.pk])
-        resp = self.client.post(url, follow=True)
-        self.assertContains(resp, 'value="Continue"')
+        def tool_lookup(name):
+            if name == Node.RPI_CAMERA_BINARIES[-1]:
+                return None
+            return f"/usr/bin/{name}"
 
+        mock_which.side_effect = tool_lookup
 
+        self.assertFalse(Node._has_rpi_camera())
+        missing_index = Node.RPI_CAMERA_BINARIES.index(Node.RPI_CAMERA_BINARIES[-1])
+        self.assertEqual(mock_run.call_count, missing_index)