arthexis 0.1.9__py3-none-any.whl → 0.1.11__py3-none-any.whl

nodes/tests.py

@@ -7,8 +7,10 @@ django.setup()
 
 from pathlib import Path
 from types import SimpleNamespace
+import unittest.mock as mock
 from unittest.mock import patch, call, MagicMock
 from django.core import mail
+from django.core.mail import EmailMessage
 from django.core.management import call_command
 import socket
 import base64
@@ -18,17 +20,22 @@ from tempfile import TemporaryDirectory
 import shutil
 import stat
 import time
+from datetime import timedelta
 
-from django.test import Client, TestCase, TransactionTestCase, override_settings
+from django.test import Client, SimpleTestCase, TestCase, TransactionTestCase, override_settings
 from django.urls import reverse
 from django.contrib.auth import get_user_model
 from django.contrib import admin
 from django.contrib.sites.models import Site
 from django_celery_beat.models import PeriodicTask
 from django.conf import settings
+from django.utils import timezone
+from dns import resolver as dns_resolver
 from .actions import NodeAction
+from . import dns as dns_utils
 from selenium.common.exceptions import WebDriverException
 from .utils import capture_screenshot
+from django.db.utils import DatabaseError
 
 from .models import (
     Node,
@@ -38,12 +45,14 @@ from .models import (
     NodeFeature,
     NodeFeatureAssignment,
     NetMessage,
+    NodeManager,
+    DNSRecord,
 )
 from .backends import OutboxEmailBackend
 from .tasks import capture_node_screenshot, sample_clipboard
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.primitives import serialization, hashes
-from core.models import PackageRelease
+from core.models import PackageRelease, SecurityGroup
 
 
 class NodeTests(TestCase):
@@ -54,7 +63,23 @@ class NodeTests(TestCase):
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
 
+
+class NodeGetLocalDatabaseUnavailableTests(SimpleTestCase):
+    def test_get_local_handles_database_errors(self):
+        with patch.object(Node.objects, "filter", side_effect=DatabaseError("fail")):
+            with self.assertLogs("nodes.models", level="DEBUG") as logs:
+                result = Node.get_local()
+
+        self.assertIsNone(result)
+        self.assertTrue(
+            any("Node.get_local skipped: database unavailable" in message for message in logs.output)
+        )
+
+
+class NodeGetLocalTests(TestCase):
     def test_register_current_does_not_create_release(self):
+        node = None
+        created = False
         with TemporaryDirectory() as tmp:
             base = Path(tmp)
             with override_settings(BASE_DIR=base):
@@ -70,8 +95,11 @@ class NodeTests(TestCase):
                     patch("nodes.models.revision.get_revision", return_value="rev"),
                     patch.object(Node, "ensure_keys"),
                 ):
-                    Node.register_current()
+                    node, created = Node.register_current()
         self.assertEqual(PackageRelease.objects.count(), 0)
+        self.assertIsNotNone(node)
+        self.assertTrue(created)
+        self.assertEqual(node.current_relation, Node.Relation.SELF)
 
     def test_register_and_list_node(self):
         response = self.client.post(
@@ -86,6 +114,8 @@ class NodeTests(TestCase):
         )
         self.assertEqual(response.status_code, 200)
         self.assertEqual(Node.objects.count(), 1)
+        node = Node.objects.get(mac_address="00:11:22:33:44:55")
+        self.assertEqual(node.current_relation, Node.Relation.PEER)
 
         # allow same IP with different MAC
         self.client.post(
@@ -156,6 +186,118 @@ class NodeTests(TestCase):
         node.refresh_from_db()
         self.assertFalse(node.has_feature("clipboard-poll"))
 
+    def test_register_node_records_version_details(self):
+        url = reverse("register-node")
+        payload = {
+            "hostname": "versioned",
+            "address": "127.0.0.5",
+            "port": 8100,
+            "mac_address": "aa:bb:cc:dd:ee:10",
+            "installed_version": "2.0.1",
+            "installed_revision": "rev-abcdef",
+        }
+        response = self.client.post(
+            url, data=json.dumps(payload), content_type="application/json"
+        )
+        self.assertEqual(response.status_code, 200)
+        node = Node.objects.get(mac_address="aa:bb:cc:dd:ee:10")
+        self.assertEqual(node.installed_version, "2.0.1")
+        self.assertEqual(node.installed_revision, "rev-abcdef")
+
+        update_payload = {
+            **payload,
+            "installed_version": "2.1.0",
+            "installed_revision": "rev-fedcba",
+        }
+        second = self.client.post(
+            url, data=json.dumps(update_payload), content_type="application/json"
+        )
+        self.assertEqual(second.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.1.0")
+        self.assertEqual(node.installed_revision, "rev-fedcba")
+
+    def test_register_node_update_triggers_notification(self):
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:01",
+            installed_version="1.0.0",
+            installed_revision="rev-old",
+        )
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:01",
+            "installed_version": "2.0.0",
+            "installed_revision": "abcdef123456",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.installed_version, "2.0.0")
+        self.assertEqual(node.installed_revision, "abcdef123456")
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0 r123456")
+
+    def test_register_node_update_without_version_change_still_notifies(self):
+        node = Node.objects.create(
+            hostname="friend",
+            address="10.1.1.5",
+            port=8123,
+            mac_address="aa:bb:cc:dd:ee:02",
+            installed_version="2.0.0",
+            installed_revision="abcdef123456",
+        )
+        url = reverse("register-node")
+        payload = {
+            "hostname": "friend",
+            "address": "10.1.1.5",
+            "port": 8123,
+            "mac_address": "aa:bb:cc:dd:ee:02",
+            "installed_version": "2.0.0",
+            "installed_revision": "abcdef123456",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        node.refresh_from_db()
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP friend")
+        self.assertEqual(body, "v2.0.0 r123456")
+
+    def test_register_node_creation_triggers_notification(self):
+        url = reverse("register-node")
+        payload = {
+            "hostname": "newbie",
+            "address": "10.1.1.6",
+            "port": 8124,
+            "mac_address": "aa:bb:cc:dd:ee:03",
+            "installed_version": "3.0.0",
+            "installed_revision": "rev-1234567890",
+        }
+        with patch("nodes.models.notify_async") as mock_notify:
+            response = self.client.post(
+                url, data=json.dumps(payload), content_type="application/json"
+            )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Node.objects.filter(mac_address="aa:bb:cc:dd:ee:03").exists())
+        mock_notify.assert_called_once()
+        subject, body = mock_notify.call_args[0]
+        self.assertEqual(subject, "UP newbie")
+        self.assertEqual(body, "v3.0.0 r567890")
+
     def test_register_node_sets_cors_headers(self):
         payload = {
             "hostname": "cors",
@@ -173,6 +315,74 @@ class NodeTests(TestCase):
         self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
         self.assertEqual(response["Access-Control-Allow-Credentials"], "true")
 
+    def test_register_node_requires_auth_without_signature(self):
+        self.client.logout()
+        payload = {
+            "hostname": "visitor",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "aa:bb:cc:dd:ee:00",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 401)
+        data = response.json()
+        self.assertEqual(data["detail"], "authentication required")
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+
+    def test_register_node_allows_preflight_without_authentication(self):
+        self.client.logout()
+        response = self.client.options(
+            reverse("register-node"), HTTP_ORIGIN="https://example.com"
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "https://example.com")
+        self.assertEqual(response["Access-Control-Allow-Credentials"], "true")
+
+    def test_register_node_accepts_signed_payload_without_login(self):
+        self.client.logout()
+        NodeFeature.objects.get_or_create(
+            slug="clipboard-poll", defaults={"display": "Clipboard Poll"}
+        )
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        public_bytes = private_key.public_key().public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        ).decode()
+        token = "visitor-token"
+        signature = base64.b64encode(
+            private_key.sign(
+                token.encode(),
+                padding.PKCS1v15(),
+                hashes.SHA256(),
+            )
+        ).decode()
+        payload = {
+            "hostname": "visitor",
+            "address": "127.0.0.1",
+            "port": 8000,
+            "mac_address": "aa:bb:cc:dd:ee:11",
+            "public_key": public_bytes,
+            "token": token,
+            "signature": signature,
+            "features": ["clipboard-poll"],
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+            HTTP_ORIGIN="http://example.com",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Access-Control-Allow-Origin"], "http://example.com")
+        node = Node.objects.get(mac_address="aa:bb:cc:dd:ee:11")
+        self.assertEqual(node.public_key, public_bytes)
+        self.assertTrue(node.has_feature("clipboard-poll"))
+
     def test_register_node_accepts_text_plain_payload(self):
         payload = {
             "hostname": "plain",
@@ -188,6 +398,48 @@ class NodeTests(TestCase):
         self.assertEqual(response.status_code, 200)
         self.assertTrue(Node.objects.filter(mac_address="aa:bb:cc:dd:ee:ff").exists())
 
+    def test_register_node_respects_relation_payload(self):
+        payload = {
+            "hostname": "relation",
+            "address": "127.0.0.2",
+            "port": 8100,
+            "mac_address": "11:22:33:44:55:66",
+            "current_relation": "Downstream",
+        }
+        response = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(payload),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 200)
+        node = Node.objects.get(mac_address="11:22:33:44:55:66")
+        self.assertEqual(node.current_relation, Node.Relation.DOWNSTREAM)
+
+        update_payload = {
+            **payload,
+            "hostname": "relation-updated",
+            "current_relation": "Upstream",
+        }
+        second = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(update_payload),
+            content_type="application/json",
+        )
+        self.assertEqual(second.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.current_relation, Node.Relation.UPSTREAM)
+
+        final_payload = {**update_payload, "hostname": "relation-final"}
+        final_payload.pop("current_relation")
+        third = self.client.post(
+            reverse("register-node"),
+            data=json.dumps(final_payload),
+            content_type="application/json",
+        )
+        self.assertEqual(third.status_code, 200)
+        node.refresh_from_db()
+        self.assertEqual(node.current_relation, Node.Relation.UPSTREAM)
+
 
 class NodeRegisterCurrentTests(TestCase):
     def setUp(self):
@@ -197,6 +449,26 @@ class NodeRegisterCurrentTests(TestCase):
         self.client.force_login(self.user)
         NodeRole.objects.get_or_create(name="Terminal")
 
+    def test_register_current_notifies_peers_on_start(self):
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="testhost"),
+                    patch(
+                        "nodes.models.socket.gethostbyname", return_value="127.0.0.1"
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev"),
+                    patch.object(Node, "ensure_keys"),
+                    patch.object(Node, "notify_peers_of_update") as mock_notify,
+                ):
+                    Node.register_current()
+        mock_notify.assert_called_once()
+
     def test_register_current_refreshes_lcd_feature(self):
         NodeFeature.objects.get_or_create(
             slug="lcd-screen", defaults={"display": "LCD Screen"}
@@ -262,6 +534,94 @@ class NodeRegisterCurrentTests(TestCase):
             node.refresh_from_db()
             self.assertTrue(node.has_feature("lcd-screen"))
 
+    def test_register_current_notifies_peers_on_version_upgrade(self):
+        remote = Node.objects.create(
+            hostname="remote",
+            address="10.0.0.2",
+            port=9100,
+            mac_address="aa:bb:cc:dd:ee:ff",
+        )
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            (base / "VERSION").write_text("2.0.0")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:bb",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="localnode"),
+                    patch(
+                        "nodes.models.socket.gethostbyname",
+                        return_value="192.168.1.5",
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="newrev"),
+                    patch("requests.post") as mock_post,
+                ):
+                    Node.objects.create(
+                        hostname="localnode",
+                        address="192.168.1.5",
+                        port=8000,
+                        mac_address="00:ff:ee:dd:cc:bb",
+                        installed_version="1.9.0",
+                        installed_revision="oldrev",
+                    )
+                    mock_post.return_value = SimpleNamespace(
+                        ok=True, status_code=200, text=""
+                    )
+                    node, created = Node.register_current()
+        self.assertFalse(created)
+        self.assertGreaterEqual(mock_post.call_count, 1)
+        args, kwargs = mock_post.call_args
+        self.assertIn(str(remote.port), args[0])
+        payload = json.loads(kwargs["data"])
+        self.assertEqual(payload["hostname"], "localnode")
+        self.assertEqual(payload["installed_version"], "2.0.0")
+        self.assertEqual(payload["installed_revision"], "newrev")
+
+    def test_register_current_notifies_peers_without_version_change(self):
+        Node.objects.create(
+            hostname="remote",
+            address="10.0.0.3",
+            port=9200,
+            mac_address="aa:bb:cc:dd:ee:11",
+        )
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            (base / "VERSION").write_text("1.0.0")
+            with override_settings(BASE_DIR=base):
+                with (
+                    patch(
+                        "nodes.models.Node.get_current_mac",
+                        return_value="00:ff:ee:dd:cc:cc",
+                    ),
+                    patch("nodes.models.socket.gethostname", return_value="samever"),
+                    patch(
+                        "nodes.models.socket.gethostbyname",
+                        return_value="192.168.1.6",
+                    ),
+                    patch("nodes.models.revision.get_revision", return_value="rev1"),
+                    patch("requests.post") as mock_post,
+                ):
+                    Node.objects.create(
+                        hostname="samever",
+                        address="192.168.1.6",
+                        port=8000,
+                        mac_address="00:ff:ee:dd:cc:cc",
+                        installed_version="1.0.0",
+                        installed_revision="rev1",
+                    )
+                    mock_post.return_value = SimpleNamespace(
+                        ok=True, status_code=200, text=""
+                    )
+                    Node.register_current()
+        self.assertEqual(mock_post.call_count, 1)
+        args, kwargs = mock_post.call_args
+        self.assertIn("/nodes/register/", args[0])
+        payload = json.loads(kwargs["data"])
+        self.assertEqual(payload["installed_version"], "1.0.0")
+        self.assertEqual(payload.get("installed_revision"), "rev1")
+
     @patch("nodes.views.capture_screenshot")
     def test_capture_screenshot(self, mock_capture):
         hostname = socket.gethostname()
@@ -399,6 +759,7 @@ class NodeRegisterCurrentTests(TestCase):
             "body": "world",
             "seen": [],
             "sender": str(sender.uuid),
+            "origin": str(sender.uuid),
         }
         payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
         signature = key.sign(payload_json.encode(), padding.PKCS1v15(), hashes.SHA256())
@@ -410,6 +771,8 @@ class NodeRegisterCurrentTests(TestCase):
         )
         self.assertEqual(resp.status_code, 200)
         self.assertTrue(NetMessage.objects.filter(uuid=msg_id).exists())
+        message = NetMessage.objects.get(uuid=msg_id)
+        self.assertEqual(message.node_origin, sender)
 
     def test_clipboard_polling_creates_task(self):
         feature, _ = NodeFeature.objects.get_or_create(
@@ -446,6 +809,15 @@ class NodeRegisterCurrentTests(TestCase):
         self.assertFalse(PeriodicTask.objects.filter(name=task_name).exists())
 
 
+class CheckRegistrationReadyCommandTests(TestCase):
+    def test_command_completes_successfully(self):
+        NodeRole.objects.get_or_create(name="Terminal")
+        with TemporaryDirectory() as tmp:
+            base = Path(tmp)
+            with override_settings(BASE_DIR=base):
+                call_command("check_registration_ready")
+
+
 class NodeAdminTests(TestCase):
 
     def setUp(self):
@@ -702,6 +1074,17 @@ class NetMessageReachTests(TestCase):
         self.assertEqual(roles, {"Constellation", "Satellite", "Control"})
         self.assertEqual(mock_post.call_count, 3)
 
+    @patch("requests.post")
+    def test_default_reach_not_limited_to_terminal(self, mock_post):
+        msg = NetMessage.objects.create(subject="s", body="b")
+        with patch.object(Node, "get_local", return_value=None), patch(
+            "random.shuffle", side_effect=lambda seq: None
+        ):
+            msg.propagate()
+        roles = set(msg.propagated_to.values_list("role__name", flat=True))
+        self.assertIn("Control", roles)
+        self.assertEqual(mock_post.call_count, 3)
+
 
 class NetMessagePropagationTests(TestCase):
     def setUp(self):
@@ -727,6 +1110,12 @@ class NetMessagePropagationTests(TestCase):
                 )
             )
 
+    def test_broadcast_sets_node_origin(self):
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg = NetMessage.broadcast(subject="subject", body="body")
+        self.assertEqual(msg.node_origin, self.local)
+        self.assertIsNone(msg.reach)
+
     @patch("requests.post")
     @patch("core.notifications.notify")
     def test_propagate_forwards_to_three_and_notifies_local(
@@ -737,6 +1126,9 @@ class NetMessagePropagationTests(TestCase):
             msg.propagate(seen=[str(self.remotes[0].uuid)])
         mock_notify.assert_called_once_with("s", "b")
         self.assertEqual(mock_post.call_count, 3)
+        for call_args in mock_post.call_args_list:
+            payload = json.loads(call_args.kwargs["data"])
+            self.assertEqual(payload.get("origin"), str(self.local.uuid))
         targets = {
             call.args[0].split("//")[1].split("/")[0]
             for call in mock_post.call_args_list
@@ -746,6 +1138,41 @@ class NetMessagePropagationTests(TestCase):
         self.assertEqual(msg.propagated_to.count(), 4)
         self.assertTrue(msg.complete)
 
+    @patch("requests.post")
+    @patch("core.notifications.notify", return_value=True)
+    def test_propagate_prunes_old_local_messages(self, mock_notify, mock_post):
+        old_local = NetMessage.objects.create(
+            subject="old local",
+            body="body",
+            reach=self.role,
+            node_origin=self.local,
+        )
+        NetMessage.objects.filter(pk=old_local.pk).update(
+            created=timezone.now() - timedelta(days=8)
+        )
+        old_remote = NetMessage.objects.create(
+            subject="old remote",
+            body="body",
+            reach=self.role,
+            node_origin=self.remotes[0],
+        )
+        NetMessage.objects.filter(pk=old_remote.pk).update(
+            created=timezone.now() - timedelta(days=8)
+        )
+        msg = NetMessage.objects.create(
+            subject="fresh",
+            body="body",
+            reach=self.role,
+            node_origin=self.local,
+        )
+        with patch.object(Node, "get_local", return_value=self.local):
+            msg.propagate()
+
+        mock_notify.assert_called_once_with("fresh", "body")
+        self.assertFalse(NetMessage.objects.filter(pk=old_local.pk).exists())
+        self.assertTrue(NetMessage.objects.filter(pk=old_remote.pk).exists())
+        self.assertTrue(NetMessage.objects.filter(pk=msg.pk).exists())
+
 
 class NodeActionTests(TestCase):
     def setUp(self):
@@ -1034,6 +1461,91 @@ class EmailOutboxTests(TestCase):
         self.assertEqual(email.subject, "sub")
         self.assertEqual(email.to, ["to@example.com"])
 
+    def test_string_representation_prefers_from_email(self):
+        outbox = EmailOutbox.objects.create(
+            host="smtp.example.com",
+            port=587,
+            username="mailer",
+            password="secret",
+            from_email="noreply@example.com",
+        )
+
+        self.assertEqual(str(outbox), "noreply@example.com")
+
+    def test_string_representation_prefers_username_over_owner(self):
+        group = SecurityGroup.objects.create(name="Operators")
+        outbox = EmailOutbox.objects.create(
+            group=group,
+            host="smtp.example.com",
+            port=587,
+            username="mailer",
+            password="secret",
+        )
+
+        self.assertEqual(str(outbox), "mailer@smtp.example.com")
+
+    def test_string_representation_does_not_duplicate_email_hostname(self):
+        outbox = EmailOutbox.objects.create(
+            host="smtp.example.com",
+            port=587,
+            username="mailer@example.com",
+            password="secret",
+        )
+
+        self.assertEqual(str(outbox), "mailer@example.com")
+
+    def test_unattached_outbox_used_as_fallback(self):
+        EmailOutbox.objects.create(
+            group=SecurityGroup.objects.create(name="Attached"),
+            host="smtp.attached.example.com",
+            port=587,
+            username="attached",
+            password="secret",
+        )
+        fallback = EmailOutbox.objects.create(
+            host="smtp.fallback.example.com",
+            port=587,
+            username="fallback",
+            password="secret",
+        )
+
+        backend = OutboxEmailBackend()
+        message = EmailMessage("subject", "body", to=["to@example.com"])
+
+        selected, fallbacks = backend._select_outbox(message)
+
+        self.assertEqual(selected, fallback)
+        self.assertEqual(fallbacks, [])
+
+    def test_disabled_outbox_excluded_from_selection(self):
+        EmailOutbox.objects.create(
+            host="smtp.disabled.example.com",
+            port=587,
+            username="disabled@example.com",
+            password="secret",
+            from_email="disabled@example.com",
+            is_enabled=False,
+        )
+        enabled = EmailOutbox.objects.create(
+            host="smtp.enabled.example.com",
+            port=587,
+            username="enabled@example.com",
+            password="secret",
+        )
+
+        backend = OutboxEmailBackend()
+        message = EmailMessage(
+            "subject",
+            "body",
+            from_email="disabled@example.com",
+            to=["to@example.com"],
+        )
+
+        selected, fallbacks = backend._select_outbox(message)
+
+        self.assertEqual(selected, enabled)
+        self.assertEqual(fallbacks, [])
+
 
 class ClipboardTaskTests(TestCase):
     @patch("nodes.tasks.pyperclip.paste")
@@ -1487,3 +1999,170 @@ class NodeRpiCameraDetectionTests(TestCase):
         self.assertFalse(Node._has_rpi_camera())
         missing_index = Node.RPI_CAMERA_BINARIES.index(Node.RPI_CAMERA_BINARIES[-1])
         self.assertEqual(mock_run.call_count, missing_index)
+
+
+class DNSIntegrationTests(TestCase):
+    def setUp(self):
+        self.group = SecurityGroup.objects.create(name="Infra")
+
+    def test_deploy_records_success(self):
+        manager = NodeManager.objects.create(
+            group=self.group,
+            api_key="test-key",
+            api_secret="test-secret",
+        )
+        record_a = DNSRecord.objects.create(
+            domain="example.com",
+            name="@",
+            record_type=DNSRecord.Type.A,
+            data="1.2.3.4",
+            ttl=600,
+        )
+        record_b = DNSRecord.objects.create(
+            domain="example.com",
+            name="@",
+            record_type=DNSRecord.Type.A,
+            data="5.6.7.8",
+            ttl=600,
+        )
+
+        calls = []
+
+        class DummyResponse:
+            status_code = 200
+            reason = "OK"
+
+            def json(self):
+                return {}
+
+        class DummySession:
+            def __init__(self):
+                self.headers = {}
+
+            def put(self, url, json, timeout):
+                calls.append((url, json, timeout, dict(self.headers)))
+                return DummyResponse()
+
+        with mock.patch.object(dns_utils.requests, "Session", DummySession):
+            result = manager.publish_dns_records([record_a, record_b])
+
+        self.assertEqual(len(result.deployed), 2)
+        self.assertFalse(result.failures)
+        self.assertFalse(result.skipped)
+        self.assertTrue(calls)
+        url, payload, timeout, headers = calls[0]
+        self.assertTrue(url.endswith("/v1/domains/example.com/records/A/@"))
+        self.assertEqual(len(payload), 2)
+        self.assertEqual(headers["Authorization"], "sso-key test-key:test-secret")
+
+        record_a.refresh_from_db()
+        record_b.refresh_from_db()
+        self.assertIsNotNone(record_a.last_synced_at)
+        self.assertIsNotNone(record_b.last_synced_at)
+        self.assertEqual(record_a.node_manager_id, manager.pk)
+        self.assertEqual(record_b.node_manager_id, manager.pk)
+
+    def test_deploy_records_handles_error(self):
+        manager = NodeManager.objects.create(
+            group=self.group,
+            api_key="test-key",
+            api_secret="test-secret",
+        )
+        record = DNSRecord.objects.create(
+            domain="example.com",
+            name="www",
+            record_type=DNSRecord.Type.CNAME,
+            data="target.example.com",
+        )
+
+        class DummyResponse:
+            status_code = 400
+            reason = "Bad Request"
+
+            def json(self):
+                return {"message": "Invalid data"}
+
+        class DummySession:
+            def __init__(self):
+                self.headers = {}
+
+            def put(self, url, json, timeout):
+                return DummyResponse()
+
+        with mock.patch.object(dns_utils.requests, "Session", DummySession):
+            result = manager.publish_dns_records([record])
+
+        self.assertFalse(result.deployed)
+        self.assertIn(record, result.failures)
+        record.refresh_from_db()
+        self.assertEqual(record.last_error, "Invalid data")
+        self.assertIsNone(record.last_synced_at)
+
+    def test_validate_record_success(self):
+        record = DNSRecord.objects.create(
+            domain="example.com",
+            name="www",
+            record_type=DNSRecord.Type.A,
+            data="1.2.3.4",
+        )
+
+        class DummyRdata:
+            address = "1.2.3.4"
+
+        class DummyResolver:
+            def resolve(self, name, rtype):
+                self_calls.append((name, rtype))
+                return [DummyRdata()]
+
+        self_calls = []
+        ok, message = dns_utils.validate_record(record, resolver=DummyResolver())
+
+        self.assertTrue(ok)
+        self.assertEqual(message, "")
+        record.refresh_from_db()
+        self.assertIsNotNone(record.last_verified_at)
+        self.assertEqual(record.last_error, "")
+        self.assertEqual(self_calls, [("www.example.com", "A")])
+
+    def test_validate_record_mismatch(self):
+        record = DNSRecord.objects.create(
+            domain="example.com",
+            name="www",
+            record_type=DNSRecord.Type.A,
+            data="1.2.3.4",
+        )
+
+        class DummyRdata:
+            address = "5.6.7.8"
+
+        class DummyResolver:
+            def resolve(self, name, rtype):
+                return [DummyRdata()]
+
+        ok, message = dns_utils.validate_record(record, resolver=DummyResolver())
+
+        self.assertFalse(ok)
+        self.assertEqual(message, "DNS record does not match expected value")
+        record.refresh_from_db()
+        self.assertEqual(record.last_error, message)
+        self.assertIsNone(record.last_verified_at)
+
+    def test_validate_record_handles_exception(self):
+        record = DNSRecord.objects.create(
+            domain="example.com",
+            name="www",
+            record_type=DNSRecord.Type.A,
+            data="1.2.3.4",
+        )
+
+        class DummyResolver:
+            def resolve(self, name, rtype):
+                raise dns_resolver.NXDOMAIN()
+
+        ok, message = dns_utils.validate_record(record, resolver=DummyResolver())
+
+        self.assertFalse(ok)
+        self.assertEqual(message, "The DNS query name does not exist.")
+        record.refresh_from_db()
+        self.assertEqual(record.last_error, message)
+        self.assertIsNone(record.last_verified_at)