Give each endpoint its own credential and fix the review findings on the server

Per-PC credentials (replaces the 09-14 client-certificate attempt):
- POST /api/endpoints/enroll issues a credential to a PC that matches exactly
  one computer by hostname and BIOS serial and has none yet. Anything else
  (unknown or duplicate hostname, serial mismatch, already enrolled) waits as
  a request an admin approves or rejects. The agent's persisted nonce binds an
  approved request to the PC that asked.
- One auth helper serves every agent route. With X-Endpoint-Credential the
  asset comes from the credential and a request naming another PC gets 403
  ASSET_MISMATCH. The shared key still works for PCs that have not enrolled,
  is refused (401 SHARED_KEY_REFUSED) for any PC that has, and can be switched
  off. A revoked credential gets 401 CREDENTIAL_INVALID so the agent
  re-enrolls.
- The core collector accepts the credential for the computers, printers and
  endpoints collectors through two new plugin hooks exposed on shopdb.api
  (contract 0.33.0), and refuses the shared key for enrolled PCs.
- Admin API: enrollment list, approve, reject, revoke (un-enroll), settings.
  Migration API: per-PC readiness with blockers, and upgrade waves that
  package the agent once and queue the existing agent upgrade per PC.
- Migration 0023 creates endpointcredentials, endpointenrollrequests and
  endpointmigrationwaves, drops the certificate columns from assets where
  test databases have them, and renames app_fingerprint to appfingerprint.
  0021 and 0022 keep their ids but no longer alter the core assets table.
- Removed: client_cert.py, certificate renewal, the unauthenticated
  /test/client-cert route, nginx client certificate forwarding and the agent
  certificate script. The client-cert header could be forged on IIS, the key
  was readable by users, and the shared key remained a fallback.
- GET /settings/server-cert returns the SPKI SHA-256 pin for GE-Enforce.

Review fixes:
- report_command_result used g without importing it; every result was a 500.
- collect_log refuses setup answer files, appsettings, agent directories and
  key files at enqueue.
- Fleet alerts: alerttimeout and alertfleet agree with the migration, the
  scope is validated and a malformed scope no longer reaches the whole fleet,
  and the ack race no longer raises NameError.
- A refused break-glass override leaves no hold and no audit row.
- Agent upgrade checks locks and permissions before repackaging, and writes
  the package atomically.
- Server certificate upload validates the pair before replacing files;
  generation no longer builds an openssl config from user input; audit rows
  are actually written.
- Health evaluation runs in a savepoint so a caught error cannot lose the
  check-in.
- Required-app policies are found by appid, survive renames, and deleting an
  app deactivates policies that still name it. The UI and API now say such a
  policy only takes effect inside a business policy.
- Backfill handles duplicate fingerprints and rolls back a failed batch.
- Plugin settings routes skip a plugin whose hook raises.
- The setup token is no longer printed to the log.
- The naming gate checks top-level files again and handles odd file names.
- Removed root scratch scripts, one of which carried a token.
- Rewrote the fleet alert scheduling and app delta tests on real fixtures.

tests/test_backfill_app_fingerprints.py

@@ -0,0 +1,117 @@
+"""scripts/backfill_app_fingerprints.py against a real (SQLite) session.
+
+The unique index on (assetid, appfingerprint) turns two identical inventory rows
+on one asset into an IntegrityError mid-backfill. The script must keep the
+lowest id, delete the rest and report how many, and a failing batch must be
+rolled back rather than left half-applied.
+"""
+
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parent.parent / 'scripts' / 'backfill_app_fingerprints.py'
+
+
+@pytest.fixture
+def backfill(app):
+    spec = importlib.util.spec_from_file_location('backfillfingerprints', SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _asset(db, number):
+    from shopdb.core.models import Asset, AssetType
+
+    atype = AssetType.query.filter_by(assettype='computer').first()
+    if not atype:
+        atype = AssetType(assettype='computer')
+        db.session.add(atype)
+        db.session.flush()
+    asset = Asset(assetnumber=number, assettypeid=atype.assettypeid,
+                  isactive=True)
+    db.session.add(asset)
+    db.session.commit()
+    return asset.assetid
+
+
+def _row(db, assetid, name, version='1.0', publisher='Vendor',
+         fingerprint=None):
+    from plugins.endpoints.models import EndpointApplication
+
+    row = EndpointApplication(assetid=assetid, displayname=name,
+                              displayversion=version, publisher=publisher,
+                              **{'appfingerprint': fingerprint})
+    db.session.add(row)
+    db.session.commit()
+    return row.endpointapplicationid
+
+
+def test_self_check_uses_fixed_expected_values(backfill, monkeypatch):
+    assert backfill.verify_fingerprint_algorithm() is True
+    monkeypatch.setattr(backfill, 'compute_fingerprint',
+                        lambda name, version, publisher: '0' * 64)
+    with pytest.raises(ValueError):
+        backfill.verify_fingerprint_algorithm()
+
+
+def test_duplicates_keep_the_lowest_id(backfill, db):
+    from plugins.endpoints.models import EndpointApplication
+
+    first = _asset(db, 'FP01')
+    second = _asset(db, 'FP02')
+    keep = _row(db, first, 'Chrome')
+    _row(db, first, 'Chrome')
+    _row(db, first, 'Chrome')
+    other = _row(db, first, 'Office')
+    elsewhere = _row(db, second, 'Chrome')
+
+    summary = backfill.backfill_fingerprints(batch_size=2)
+
+    assert summary['duplicatesremoved'] == 2
+    assert summary['failed'] == 0
+    rows = EndpointApplication.query.order_by(
+        EndpointApplication.endpointapplicationid).all()
+    assert [r.endpointapplicationid for r in rows] == [keep, other, elsewhere]
+    assert all(r.appfingerprint for r in rows)
+
+
+def test_an_existing_higher_id_holder_gives_way(backfill, db):
+    from plugins.endpoints.models import EndpointApplication
+
+    assetid = _asset(db, 'FP03')
+    fingerprint = backfill.compute_fingerprint('Chrome', '1.0', 'Vendor')
+    older = _row(db, assetid, 'Chrome')
+    _row(db, assetid, 'Chrome', fingerprint=fingerprint)
+
+    summary = backfill.backfill_fingerprints()
+
+    assert summary['duplicatesremoved'] == 1
+    rows = EndpointApplication.query.all()
+    assert [(r.endpointapplicationid, r.appfingerprint) for r in rows] == \
+        [(older, fingerprint)]
+
+
+def test_a_failing_batch_is_rolled_back(backfill, db, monkeypatch):
+    from plugins.endpoints.models import EndpointApplication
+
+    assetid = _asset(db, 'FP04')
+    _row(db, assetid, 'Chrome')
+    _row(db, assetid, 'Office')
+
+    def broken(apps):
+        for app in apps:
+            app.appfingerprint = 'x' * 64
+        raise RuntimeError('simulated failure')
+
+    monkeypatch.setattr(backfill, '_fingerprint_batch', broken)
+
+    summary = backfill.backfill_fingerprints()
+
+    assert summary['failed'] == 2
+    assert summary['processed'] == 0
+    db.session.expire_all()
+    assert EndpointApplication.query.filter(
+        EndpointApplication.appfingerprint.isnot(None)).count() == 0

tests/test_core/test_application_required_policy_sync.py

@@ -0,0 +1,109 @@
+"""The generated "required on all PCs" policy follows the app by appid.
+
+The generated policy name embeds appname, so a name lookup orphaned the policy
+on rename. These pin the appid lookup, rename+untick in one PUT, delete handling
+of a customised ('kept') policy and of other policies naming the appid, and the
+truthful note that the generated policy is not attached to a business policy.
+"""
+
+from shopdb.core.models import Application
+
+
+def _policies():
+    from plugins.computers.models import ConfigurationPolicy
+    return ConfigurationPolicy.query
+
+
+def _create_required(client, headers, name='Fleet App'):
+    response = client.post('/api/applications',
+                           json={'appname': name, 'isrequired': True,
+                                 'acknowledgepolicy': True},
+                           headers=headers)
+    assert response.status_code == 201, response.get_json()
+    return response.get_json()['data']
+
+
+def test_created_response_says_the_policy_is_not_attached(client, db, auth_headers):
+    data = _create_required(client, auth_headers)
+    assert data['policyresult'] == 'created'
+    assert 'business policy' in data['policynote']
+
+
+def test_ack_message_mentions_business_policy(client, db, auth_headers):
+    response = client.post('/api/applications',
+                           json={'appname': 'Unacked', 'isrequired': True},
+                           headers=auth_headers)
+    assert response.status_code == 400
+    assert 'business policy' in response.get_json()['data']['error']['message']
+
+
+def test_rename_keeps_the_policy_and_renames_it(client, db, auth_headers):
+    data = _create_required(client, auth_headers, 'Old Name')
+
+    response = client.put(f"/api/applications/{data['appid']}",
+                          json={'appname': 'New Name'}, headers=auth_headers)
+    assert response.status_code == 200, response.get_json()
+
+    names = [policy.name for policy in _policies().all()]
+    assert names == ['Required app: New Name']
+
+
+def test_untick_after_rename_removes_the_policy(client, db, auth_headers):
+    data = _create_required(client, auth_headers, 'Before')
+    from plugins.computers.models import ConfigurationPolicy
+    # Simulate a rename that bypassed the sync (older data): name is stale.
+    policy = ConfigurationPolicy.query.one()
+    application = db.session.get(Application, data['appid'])
+    application.appname = 'After'
+    db.session.commit()
+    assert policy.name == 'Required app: Before'
+
+    response = client.put(f"/api/applications/{data['appid']}",
+                          json={'isrequired': False}, headers=auth_headers)
+    assert response.status_code == 200, response.get_json()
+    assert response.get_json()['data']['policyresult'] == 'removed'
+    assert _policies().count() == 0
+
+
+def test_rename_and_untick_in_one_put_removes_the_policy(client, db, auth_headers):
+    data = _create_required(client, auth_headers, 'Combo')
+
+    response = client.put(f"/api/applications/{data['appid']}",
+                          json={'appname': 'Combo Renamed', 'isrequired': False},
+                          headers=auth_headers)
+
+    assert response.status_code == 200, response.get_json()
+    assert response.get_json()['data']['policyresult'] == 'removed'
+    assert _policies().count() == 0
+
+
+def test_delete_deactivates_kept_and_referencing_policies(client, db, auth_headers):
+    from plugins.computers.models import (ConfigurationPolicy,
+                                          ConfigurationPolicyAction,
+                                          POLICY_SOURCE_LOCAL)
+
+    data = _create_required(client, auth_headers, 'Doomed')
+    generated = ConfigurationPolicy.query.one()
+    generated.source = POLICY_SOURCE_LOCAL  # admin customised it
+    handmade = ConfigurationPolicy(name='Hand made push', scopejson=None)
+    db.session.add(handmade)
+    db.session.flush()
+    db.session.add(ConfigurationPolicyAction(
+        configurationpolicyid=handmade.configurationpolicyid,
+        action='update_app', params={'appid': data['appid']}))
+    unrelated = ConfigurationPolicy(name='Unrelated', scopejson=None)
+    db.session.add(unrelated)
+    db.session.commit()
+
+    response = client.delete(f"/api/applications/{data['appid']}",
+                             json={'confirm': 'OK'}, headers=auth_headers)
+
+    assert response.status_code == 200, response.get_json()
+    body = response.get_json()
+    assert body['data']['policyresult'] == 'kept'
+    assert sorted(body['data']['deactivatedpolicies']) == \
+        ['Hand made push', 'Required app: Doomed']
+    db.session.expire_all()
+    states = {policy.name: policy.isactive for policy in _policies().all()}
+    assert states == {'Required app: Doomed': False, 'Hand made push': False,
+                      'Unrelated': True}

tests/test_core/test_authz.py

@@ -121,7 +121,20 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # resolves to, so the key cannot ack another machine's alert.
                     # AUTHORING a fleet alert is the actual authority and stays
                     # permission-gated in the notifications plugin.
-                    'endpoints.acknowledge_fleet_alert'}
+                    'endpoints.acknowledge_fleet_alert',
+                    # Agent enrollment. A PC with no credential asks for one on
+                    # the shared collector key (same shape as the exempt
+                    # collector blueprint); with the shared key switched off it
+                    # takes no auth and only collects a credential an admin
+                    # already approved for that hostname, serial and nonce.
+                    # Approving, rejecting and revoking ARE admin-gated and
+                    # ARE swept.
+                    'endpoints.enroll_endpoint',
+                    # Agent telemetry ingest under the endpoints prefix. The
+                    # same handler as POST /api/collector/endpoints, whose
+                    # blueprint is exempt: authenticated by the per-PC
+                    # credential or the shared collector key.
+                    'endpoints.agent_collect'}
 
 
 @pytest.fixture(autouse=True)

tests/test_core/test_plugin_settings_routes.py

@@ -0,0 +1,28 @@
+"""GET /api/plugins/settings-routes survives a plugin whose hook raises."""
+
+
+def test_a_raising_plugin_is_skipped_not_fatal(app, client, db, monkeypatch):
+    manager = app.extensions.get('plugin_manager')
+    plugins = manager.get_all_plugins()
+    enabled = [name for name in plugins if manager.registry.is_enabled(name)]
+    assert len(enabled) >= 2
+
+    broken, healthy = enabled[0], enabled[1]
+
+    def explode():
+        raise RuntimeError('broken settings hook')
+
+    def contribute():
+        return [{'hub': 'model-catalog', 'path': 'probe', 'name': 'probe-route',
+                 'tab': 'Probe', 'component': 'probe.vue'}]
+
+    monkeypatch.setattr(plugins[broken], 'get_settings_routes', explode,
+                        raising=False)
+    monkeypatch.setattr(plugins[healthy], 'get_settings_routes', contribute,
+                        raising=False)
+
+    response = client.get('/api/plugins/settings-routes')
+
+    assert response.status_code == 200, response.get_json()
+    names = [route['name'] for route in response.get_json()['data']['routes']]
+    assert 'probe-route' in names

tests/test_plugin_migrations.py

@@ -116,7 +116,11 @@ EXPECTED_HEAD_REVISION['warranty'] = 'warranty0002proof'
 # on one endpoint, a caller-authority axis separate from the policy hold.
 # 0019 splits the 0007 bundle into one shipped Configuration Policy per monitor
 # and drops the shipped Business Policy, so sites compose their own.
-EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0019splitpolicies'
+# 0020 adds endpointapplications.appfingerprint for delta app updates. 0021 and
+# 0022 are retired no-ops (client certificates, removed). 0023 drops their
+# leftover asset columns, renames app_fingerprint, and adds per-PC credentials:
+# endpointcredentials, endpointenrollrequests and endpointmigrationwaves.
+EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0023credentials'
 
 # Plugins built after the cutover: their 0001 baseline really creates tables the
 # core chain never owned.

tests/test_plugin_settings_reachable.py

@@ -30,6 +30,12 @@ EXEMPT = {
     # Written by the app itself when the agent key is minted, not typed.
     'plugin.endpoints.agentkeyprovisioned',
     'plugin.endpoints.envkeyfallback',
+    # Edited on the endpoints Enrollment page through
+    # PUT /api/endpoints/enrollment/settings, not the generic settings view:
+    # turning the shared key off needs a confirm that shows how many PCs are
+    # not enrolled yet, which a plain settings field cannot give.
+    'plugin.endpoints.sharedkeyallowed',
+    'plugin.endpoints.autoenroll',
 }
 
 

tests/test_plugins/test_endpoints_agent_upgrade_route.py

@@ -192,6 +192,54 @@ def test_an_endpoint_lock_still_blocks_the_upgrade(client, db, app):
     assert EndpointCommand.query.filter_by(assetid=assetid).count() == 0
 
 
+def test_refused_callers_never_trigger_repackaging(client, db, app,
+                                                  monkeypatch):
+    """Lock and runscript checks run BEFORE the package and script are rebuilt.
+
+    Repackaging rewrites a shared file and script row; a caller who will be
+    refused anyway must not be able to cause that side effect.
+    """
+    calls = []
+    monkeypatch.setattr(agentregistry, 'register_current_agent_package',
+                        lambda: calls.append('package'))
+    monkeypatch.setattr(agentupgradescript, 'seed_upgrade_script',
+                        lambda: calls.append('script'))
+
+    _publish_agent()
+    assetid = _endpoint(db, 'UPGRADE09')
+
+    noscript = _login(db, client, 'noscriptoperator',
+                      permissions=['endpoints.view', 'endpoints.command',
+                                   'endpoints.agentupdate'])
+    response = client.post(UPGRADE_URL.format(assetid), json={},
+                           headers=noscript)
+    assert response.status_code == 403
+    assert 'endpoints.runscript' in \
+        response.get_json()['data']['error']['message']
+
+    owner = _login(db, client, 'lockowner2', admin=True)
+    client.post(f'/api/endpoints/{assetid}/lock',
+                json={'reason': 'bench repair'}, headers=owner)
+    locked = _login(db, client, 'lockedoperator',
+                    permissions=['endpoints.view', 'endpoints.command',
+                                 'endpoints.agentupdate',
+                                 'endpoints.runscript'])
+    response = client.post(UPGRADE_URL.format(assetid), json={},
+                           headers=locked)
+    assert response.status_code == 403
+    assert calls == []
+
+
+def test_package_write_leaves_no_temp_files(client, db, app, isolate_store):
+    _publish_agent()
+    agentregistry.register_current_agent_package()
+    agentregistry.register_current_agent_package()
+    leftovers = [name for _root, _dirs, files in
+                 os.walk(isolate_store / 'applicationpackages')
+                 for name in files if name.endswith('.tmp')]
+    assert leftovers == []
+
+
 def test_a_second_upgrade_cannot_stack_on_an_in_flight_command(client, db, app):
     """at-most-one-in-flight must still hold through this route."""
     from plugins.endpoints.models import EndpointCommand

tests/test_plugins/test_endpoints_app_delta.py

@@ -5,11 +5,10 @@ including safety features: fingerprint validation, delete count verification,
 memory limits, and concurrent update protection.
 """
 
-import pytest
 import hashlib
-from datetime import datetime
 
-from shopdb.extensions import db
+import pytest
+
 from plugins.endpoints.models import EndpointApplication
 from plugins.endpoints.plugin import EndpointsPlugin
 
@@ -23,6 +22,22 @@ def compute_test_fingerprint(name, version, publisher):
     return hashlib.sha256(data.encode('utf-8')).hexdigest()
 
 
+def _make_asset(db, assetnumber):
+    """A bare computer-type Asset; _replace_applications needs only the id."""
+    from shopdb.core.models import Asset, AssetType
+
+    assettype = AssetType.query.filter_by(assettype='computer').first()
+    if assettype is None:
+        assettype = AssetType(assettype='computer')
+        db.session.add(assettype)
+        db.session.flush()
+    asset = Asset(assetnumber=assetnumber, name=assetnumber,
+                  assettypeid=assettype.assettypeid, isactive=True)
+    db.session.add(asset)
+    db.session.commit()
+    return asset.assetid
+
+
 class TestApplicationDelta:
     """Test delta-based application inventory updates."""
 
@@ -31,13 +46,9 @@ class TestApplicationDelta:
         return EndpointsPlugin()
 
     @pytest.fixture
-    def asset_id(self, db_session):
+    def asset_id(self, db):
         """Create a test asset."""
-        from shopdb.core.models import Asset
-        asset = Asset(assettag='TEST-001')
-        db_session.add(asset)
-        db_session.commit()
-        return asset.assetid
+        return _make_asset(db, 'TEST-001')
 
     def test_fingerprint_validation_valid(self, plugin):
         """Valid fingerprints (64 lowercase hex chars) pass validation."""
@@ -65,7 +76,7 @@ class TestApplicationDelta:
         for fp in invalid_fps:
             assert not plugin._is_valid_fingerprint(fp), f"Should reject: {fp}"
 
-    def test_delta_no_changes(self, plugin, asset_id, db_session):
+    def test_delta_no_changes(self, plugin, asset_id, db):
         """No apps added/removed when inventory unchanged."""
         # Initial insert: 3 apps
         apps_v1 = [
@@ -91,7 +102,7 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps_v1, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 3
         assert len(warnings) == 0
@@ -100,13 +111,13 @@ class TestApplicationDelta:
         # Second report: same apps (no changes)
         warnings = []
         result = plugin._replace_applications(asset_id, apps_v1, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 0  # 0 added
         assert len(warnings) == 0
         assert EndpointApplication.query.filter_by(assetid=asset_id).count() == 3  # Still 3
 
-    def test_delta_add_remove(self, plugin, asset_id, db_session):
+    def test_delta_add_remove(self, plugin, asset_id, db):
         """Detect adds and removes correctly."""
         # Initial: 2 apps
         apps_v1 = [
@@ -126,7 +137,7 @@ class TestApplicationDelta:
 
         warnings = []
         plugin._replace_applications(asset_id, apps_v1, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert EndpointApplication.query.filter_by(assetid=asset_id).count() == 2
 
@@ -148,7 +159,7 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps_v2, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 1  # 1 added (Office)
         assert len(warnings) == 0
@@ -158,7 +169,7 @@ class TestApplicationDelta:
         app_names = {app.displayname for app in apps}
         assert app_names == {'Chrome', 'Office'}
 
-    def test_delta_version_change(self, plugin, asset_id, db_session):
+    def test_delta_version_change(self, plugin, asset_id, db):
         """Version change detected (different fingerprint)."""
         # Initial: Chrome 117.0
         apps_v1 = [
@@ -172,7 +183,7 @@ class TestApplicationDelta:
 
         warnings = []
         plugin._replace_applications(asset_id, apps_v1, warnings)
-        db_session.commit()
+        db.session.commit()
 
         # Update: Chrome 118.0 (different fingerprint)
         apps_v2 = [
@@ -186,14 +197,14 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps_v2, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 1  # 1 added (new version)
         apps = EndpointApplication.query.filter_by(assetid=asset_id).all()
         assert len(apps) == 1
         assert apps[0].displayversion == '118.0'
 
-    def test_invalid_fingerprint_skipped(self, plugin, asset_id, db_session):
+    def test_invalid_fingerprint_skipped(self, plugin, asset_id, db):
         """Apps with invalid fingerprints are skipped with warning."""
         apps = [
             {
@@ -212,7 +223,7 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 1  # Only Firefox added
         assert len(warnings) == 1
@@ -223,7 +234,7 @@ class TestApplicationDelta:
         assert len(apps) == 1
         assert apps[0].displayname == 'Firefox'
 
-    def test_legacy_fallback_no_fingerprints(self, plugin, asset_id, db_session):
+    def test_legacy_fallback_no_fingerprints(self, plugin, asset_id, db):
         """Legacy mode works when agent doesn't send fingerprints."""
         apps = [
             {
@@ -242,16 +253,16 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 2
         assert len(warnings) == 0
 
         apps = EndpointApplication.query.filter_by(assetid=asset_id).all()
         assert len(apps) == 2
-        assert all(app.app_fingerprint is None for app in apps)
+        assert all(app.appfingerprint is None for app in apps)
 
-    def test_empty_inventory(self, plugin, asset_id, db_session):
+    def test_empty_inventory(self, plugin, asset_id, db):
         """Empty inventory removes all apps."""
         # Initial: 2 apps
         apps_v1 = [
@@ -271,19 +282,19 @@ class TestApplicationDelta:
 
         warnings = []
         plugin._replace_applications(asset_id, apps_v1, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert EndpointApplication.query.filter_by(assetid=asset_id).count() == 2
 
         # Update: Empty list
         warnings = []
         result = plugin._replace_applications(asset_id, [], warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 0
         assert EndpointApplication.query.filter_by(assetid=asset_id).count() == 0
 
-    def test_missing_displayname_skipped(self, plugin, asset_id, db_session):
+    def test_missing_displayname_skipped(self, plugin, asset_id, db):
         """Apps without displayname are skipped."""
         apps = [
             {
@@ -302,13 +313,13 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 1  # Only Firefox added
         assert len(warnings) == 1
         assert 'no displayname' in warnings[0].lower()
 
-    def test_string_truncation(self, plugin, asset_id, db_session):
+    def test_string_truncation(self, plugin, asset_id, db):
         """Long strings are truncated to column limits."""
         apps = [
             {
@@ -321,7 +332,7 @@ class TestApplicationDelta:
 
         warnings = []
         result = plugin._replace_applications(asset_id, apps, warnings)
-        db_session.commit()
+        db.session.commit()
 
         assert result == 1
         app = EndpointApplication.query.filter_by(assetid=asset_id).first()
@@ -338,13 +349,9 @@ class TestApplicationDeltaSafety:
         return EndpointsPlugin()
 
     @pytest.fixture
-    def asset_id(self, db_session):
+    def asset_id(self, db):
         """Create a test asset."""
-        from shopdb.core.models import Asset
-        asset = Asset(assettag='TEST-SAFETY-001')
-        db_session.add(asset)
-        db_session.commit()
-        return asset.assetid
+        return _make_asset(db, 'TEST-SAFETY-001')
 
     def test_compute_fingerprint_consistency(self):
         """Fingerprint algorithm is deterministic."""

tests/test_plugins/test_endpoints_collect_log_denylist.py

@@ -0,0 +1,107 @@
+"""collect_log sensitive-path denylist at enqueue.
+
+The agent refuses answer files, its own install/state and key material. The
+server refuses the same set at enqueue so the operator gets a 400 naming the
+reason instead of a queued command that fails on the endpoint.
+"""
+
+import pytest
+from werkzeug.security import generate_password_hash
+
+from plugins.endpoints.api.routes import _validate_log_path
+
+
+@pytest.mark.parametrize('path', [
+    r'C:\Windows\Panther\setupact.log',
+    r'c:/windows/panther/UnattendGC/setupact.log',
+    r'%SystemRoot%\Panther\setupact.log',
+    r'%windir%\System32\Sysprep\Panther\setupact.log',
+    r'D:\WINDOWS\System32\sysprep\x.log',
+    r'C:\Windows\\Panther\.\setupact.log',
+    r'C:\ProgramData\ShopDB\state.json',
+    r'%ProgramData%\shopdb\agent.log',
+    r'C:\Program Files\ShopDB\EndpointAgent\agent.log',
+    r'C:\PROGRA~1\ShopDB\EndpointAgent\agent.log',
+    r'C:\temp\Unattend.xml',
+    r'C:\temp\unattend-original.xml',
+    r'C:\temp\AutoUnattend.xml',
+    r'C:\app\appsettings.json',
+    r'C:\app\AppSettings.Production.json',
+    r'C:\certs\server.KEY',
+    r'C:\certs\client.pfx',
+    r'C:\certs\client.p12',
+])
+def test_sensitive_paths_are_refused_with_a_reason(path):
+    error = _validate_log_path(path)
+    assert error is not None
+    assert 'not permitted' in error
+
+
+@pytest.mark.parametrize('path', [
+    r'C:\Windows\Logs\CBS\CBS.log',
+    r'C:\ProgramData\Vendor\app.log',
+    r'C:\Program Files\Other\settings.json',
+    r'C:\temp\notunattend.xml',
+])
+def test_ordinary_log_paths_still_pass(path):
+    assert _validate_log_path(path) is None
+
+
+def _endpoint(db, hostname):
+    from shopdb.api import Asset, AssetType
+    from plugins.computers.models import Computer
+    from plugins.endpoints.models import EndpointState
+
+    assettype = AssetType.query.filter_by(assettype='computer').first()
+    if assettype is None:
+        assettype = AssetType(assettype='computer', pluginname='computers',
+                              tablename='computers')
+        db.session.add(assettype)
+        db.session.flush()
+    asset = Asset(assetnumber=hostname, name=hostname,
+                  assettypeid=assettype.assettypeid, isactive=True)
+    db.session.add(asset)
+    db.session.flush()
+    db.session.add(Computer(assetid=asset.assetid, hostname=hostname))
+    db.session.add(EndpointState(assetid=asset.assetid, hostname=hostname,
+                                 agentversion='1.16.0.0'))
+    db.session.commit()
+    return asset.assetid
+
+
+def _admin(db, client, username='denylistadmin'):
+    from shopdb.core.models import User, Role, Permission
+
+    Permission.seed()
+    db.session.flush()
+    role = Role.query.filter_by(rolename='admin').first()
+    if role is None:
+        role = Role(rolename='admin')
+        db.session.add(role)
+        db.session.commit()
+    user = User(username=username, email=username + '@test.local',
+                passwordhash=generate_password_hash('testpass'))
+    user.roles.append(role)
+    db.session.add(user)
+    db.session.commit()
+    response = client.post('/api/auth/login',
+                           json={'username': username, 'password': 'testpass'})
+    token = response.get_json()['data']['access_token']
+    return {'Authorization': f'Bearer {token}'}
+
+
+def test_enqueue_refuses_an_answer_file_and_queues_nothing(app, client, db):
+    from plugins.endpoints.models import EndpointCommand
+
+    assetid = _endpoint(db, 'denylistbox')
+    headers = _admin(db, client)
+
+    response = client.post(f'/api/endpoints/{assetid}/commands',
+                           json={'action': 'collect_log',
+                                 'target': r'%SystemRoot%\Panther\unattend.xml'},
+                           headers=headers)
+
+    assert response.status_code == 400
+    message = response.get_json()['data']['error']['message']
+    assert 'Panther' in message
+    assert EndpointCommand.query.filter_by(assetid=assetid).count() == 0

tests/test_plugins/test_endpoints_credentials.py

@@ -0,0 +1,589 @@
+"""Per-PC endpoint credentials: enrollment, authentication and identity binding.
+
+A PC enrolls once on the shared fleet key and gets its own secret. From then on
+the server derives the calling asset from that secret, so a request naming a
+different PC is refused (ASSET_MISMATCH), the shared key is refused for that PC
+(SHARED_KEY_REFUSED), and a revoked secret is refused outright
+(CREDENTIAL_INVALID) so the agent knows to enroll again.
+"""
+
+import pytest
+
+from shopdb.core.models import Asset, AssetType, Setting
+
+
+COLLECTOR_KEY = 'testcollectorkey'
+ENROLL_URL = '/api/endpoints/enroll'
+NONCE = 'n' * 40
+OTHER_NONCE = 'm' * 40
+
+
+@pytest.fixture
+def keyheaders(app):
+    app.config['COLLECTOR_API_KEY'] = COLLECTOR_KEY
+    return {'X-API-Key': COLLECTOR_KEY}
+
+
+def _computer(db, hostname, serialnumber='SER-1'):
+    from plugins.computers.models import Computer
+
+    atype = AssetType.query.filter_by(assettype='computer').first()
+    if atype is None:
+        atype = AssetType(assettype='computer')
+        db.session.add(atype)
+        db.session.flush()
+    asset = Asset(assetnumber=hostname, assettypeid=atype.assettypeid,
+                  serialnumber=serialnumber, isactive=True)
+    db.session.add(asset)
+    db.session.flush()
+    db.session.add(Computer(assetid=asset.assetid, hostname=hostname))
+    db.session.commit()
+    return asset.assetid
+
+
+def _enroll_body(hostname='BAY-01', serialnumber='SER-1', nonce=NONCE):
+    return {'hostname': hostname, 'serialnumber': serialnumber,
+            'deviceid': None, 'enrollnonce': nonce, 'agentversion': '1.20.0'}
+
+
+def _enroll(client, headers, **kwargs):
+    return client.post(ENROLL_URL, json=_enroll_body(**kwargs), headers=headers)
+
+
+def _credential(client, keyheaders, **kwargs):
+    response = _enroll(client, keyheaders, **kwargs)
+    assert response.status_code == 201, response.get_data(as_text=True)
+    return response.get_json()['data']['credential']
+
+
+def _setting(db, key, value):
+    Setting.set(key, value, valuetype='boolean', category='plugin.endpoints')
+    db.session.commit()
+
+
+def _code(response):
+    return response.get_json()['data']['error']['code']
+
+
+# -- enroll ------------------------------------------------------------------
+
+def test_auto_enroll_issues_a_credential_once(client, db, app, keyheaders):
+    from plugins.endpoints.models import EndpointCredential
+
+    assetid = _computer(db, 'BAY-01')
+    response = _enroll(client, keyheaders)
+
+    assert response.status_code == 201, response.get_data(as_text=True)
+    data = response.get_json()['data']
+    assert data['status'] == 'enrolled'
+    assert data['assetid'] == assetid
+    assert data['credential'].startswith('sdbe_')
+    assert len(data['credential']) == 48
+
+    row = EndpointCredential.query.filter_by(assetid=assetid).one()
+    assert row.enrolledvia == 'auto'
+    assert row.credentialprefix == data['credential'][:12]
+    # Hash only, never the secret.
+    assert data['credential'] not in (row.credentialhash, row.credentialprefix)
+
+    again = _enroll(client, keyheaders)
+    assert again.status_code == 202
+    assert again.get_json()['data']['reason'] == 'already enrolled'
+
+
+@pytest.mark.parametrize('setup,body,reason', [
+    ('none', {}, 'unknown hostname'),
+    ('duplicate', {}, 'duplicate hostname'),
+    ('noserial', {}, 'no serial on record'),
+    ('serial', {'serialnumber': 'OTHER'}, 'serial mismatch'),
+    ('noauto', {}, 'awaiting approval'),
+])
+def test_each_pending_reason(client, db, app, keyheaders, setup, body, reason):
+    if setup == 'duplicate':
+        _computer(db, 'BAY-01')
+        _computer(db, 'bay-01')
+    elif setup == 'noserial':
+        _computer(db, 'BAY-01', serialnumber=None)
+    elif setup in ('serial', 'noauto'):
+        _computer(db, 'BAY-01')
+    if setup == 'noauto':
+        _setting(db, 'plugin.endpoints.autoenroll', False)
+
+    response = _enroll(client, keyheaders, **body)
+
+    assert response.status_code == 202, response.get_data(as_text=True)
+    data = response.get_json()['data']
+    assert data['status'] == 'pending'
+    assert data['reason'] == reason
+    assert data['requestid']
+
+
+def test_serial_compare_ignores_case_and_whitespace(client, db, app, keyheaders):
+    _computer(db, 'BAY-01', serialnumber='  ser-1 ')
+    assert _enroll(client, keyheaders, serialnumber='SER-1').status_code == 201
+
+
+def test_enroll_validates_the_nonce(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    for nonce in ('short', 'x' * 129, 'bad nonce ' * 4):
+        response = _enroll(client, keyheaders, nonce=nonce)
+        assert response.status_code == 400, nonce
+
+
+def test_enroll_requires_the_shared_key_while_it_is_allowed(client, db, app,
+                                                            keyheaders):
+    _computer(db, 'BAY-01')
+    response = client.post(ENROLL_URL, json=_enroll_body())
+    assert response.status_code in (401, 500)
+
+
+def test_a_second_nonce_on_a_pending_request_stays_pending(client, db, app,
+                                                          keyheaders):
+    from plugins.endpoints.models import EndpointEnrollRequest
+
+    _computer(db, 'BAY-01')
+    _setting(db, 'plugin.endpoints.autoenroll', False)
+    first = _enroll(client, keyheaders)
+    assert first.status_code == 202
+
+    # Auto-enroll back on: a different installation still does not get through.
+    _setting(db, 'plugin.endpoints.autoenroll', True)
+    second = _enroll(client, keyheaders, nonce=OTHER_NONCE)
+    assert second.status_code == 202
+    assert second.get_json()['data']['reason'] == 'nonce changed'
+    row = db.session.get(EndpointEnrollRequest,
+                         first.get_json()['data']['requestid'])
+    assert row.enrollnonce == NONCE
+
+
+def test_approved_request_issues_only_to_its_nonce(client, db, app, keyheaders,
+                                                  auth_headers):
+    from plugins.endpoints.models import EndpointCredential
+
+    assetid = _computer(db, 'BAY-01')
+    _setting(db, 'plugin.endpoints.autoenroll', False)
+    pending = _enroll(client, keyheaders)
+    requestid = pending.get_json()['data']['requestid']
+
+    approve = client.post(
+        f'/api/endpoints/enrollment/requests/{requestid}/approve',
+        json={'assetid': assetid}, headers=auth_headers)
+    assert approve.status_code == 200, approve.get_data(as_text=True)
+
+    wrong = _enroll(client, keyheaders, nonce=OTHER_NONCE)
+    assert wrong.status_code == 403
+    assert _code(wrong) == 'ENROLL_NONCE_MISMATCH'
+
+    right = _enroll(client, keyheaders)
+    assert right.status_code == 201, right.get_data(as_text=True)
+    assert EndpointCredential.query.filter_by(assetid=assetid).one() \
+        .enrolledvia == 'approved'
+
+
+def test_shared_key_off_enroll_takes_no_auth_but_never_auto_enrolls(
+        client, db, app, keyheaders, auth_headers):
+    assetid = _computer(db, 'BAY-01')
+    _setting(db, 'plugin.endpoints.sharedkeyallowed', False)
+
+    pending = client.post(ENROLL_URL, json=_enroll_body())
+    assert pending.status_code == 202, pending.get_data(as_text=True)
+    assert pending.get_json()['data']['reason'] == 'awaiting approval'
+
+    requestid = pending.get_json()['data']['requestid']
+    client.post(f'/api/endpoints/enrollment/requests/{requestid}/approve',
+                json={'assetid': assetid}, headers=auth_headers)
+    issued = client.post(ENROLL_URL, json=_enroll_body())
+    assert issued.status_code == 201
+
+
+def test_rejected_request_stays_rejected_for_the_same_nonce(
+        client, db, app, keyheaders, auth_headers):
+    _computer(db, 'BAY-01', serialnumber='SER-9')
+    pending = _enroll(client, keyheaders)
+    requestid = pending.get_json()['data']['requestid']
+    client.post(f'/api/endpoints/enrollment/requests/{requestid}/reject',
+                headers=auth_headers)
+
+    again = _enroll(client, keyheaders)
+    assert again.status_code == 202
+    assert again.get_json()['data']['reason'] == 'rejected'
+
+
+# -- agent auth --------------------------------------------------------------
+
+def test_shared_key_is_refused_after_enrollment(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+
+    refused = client.get('/api/endpoints/alerts?hostname=BAY-01',
+                         headers=keyheaders)
+    assert refused.status_code == 401
+    assert _code(refused) == 'SHARED_KEY_REFUSED'
+
+    ok = client.get('/api/endpoints/alerts',
+                    headers={'X-Endpoint-Credential': secret})
+    assert ok.status_code == 200, ok.get_data(as_text=True)
+
+
+def test_shared_key_still_works_for_a_pc_that_has_not_enrolled(
+        client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    _computer(db, 'BAY-02')
+    _credential(client, keyheaders)
+
+    response = client.get('/api/endpoints/alerts?hostname=BAY-02',
+                          headers=keyheaders)
+    assert response.status_code == 200
+
+
+def test_shared_key_switched_off_is_refused(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    _setting(db, 'plugin.endpoints.sharedkeyallowed', False)
+
+    response = client.get('/api/endpoints/alerts?hostname=BAY-01',
+                          headers=keyheaders)
+    assert response.status_code == 401
+    assert _code(response) == 'SHARED_KEY_REFUSED'
+
+
+def test_credential_is_invalid_after_revoke(client, db, app, keyheaders,
+                                            auth_headers):
+    assetid = _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+
+    revoke = client.post(f'/api/endpoints/enrollment/assets/{assetid}/revoke',
+                         headers=auth_headers)
+    assert revoke.status_code == 200, revoke.get_data(as_text=True)
+
+    response = client.get('/api/endpoints/alerts',
+                          headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 401
+    assert _code(response) == 'CREDENTIAL_INVALID'
+
+    # Revoked: the shared key is admitted again and the PC can re-enroll.
+    assert client.get('/api/endpoints/alerts?hostname=BAY-01',
+                      headers=keyheaders).status_code == 200
+    reissued = _credential(client, keyheaders)
+    assert reissued != secret
+
+
+def test_garbage_credential_is_invalid(client, db, app):
+    response = client.get('/api/endpoints/commands/next',
+                          headers={'X-Endpoint-Credential': 'sdbe_nope'})
+    assert response.status_code == 401
+    assert _code(response) == 'CREDENTIAL_INVALID'
+
+
+def test_package_downloads_need_no_identity(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+    response = client.get('/api/endpoints/scriptbody/999',
+                          headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 404
+
+
+# -- ASSET_MISMATCH ----------------------------------------------------------
+
+def test_commands_next_refuses_another_hostname(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    _computer(db, 'BAY-02', serialnumber='SER-2')
+    secret = _credential(client, keyheaders)
+
+    response = client.get('/api/endpoints/commands/next?hostname=BAY-02',
+                          headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 403
+    assert _code(response) == 'ASSET_MISMATCH'
+
+
+def test_commands_next_claims_for_the_credential_asset(client, db, app,
+                                                      keyheaders):
+    from plugins.endpoints.models import EndpointCommand
+
+    assetid = _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+    db.session.add(EndpointCommand(assetid=assetid, action='mtconnect_status',
+                                   status=EndpointCommand.STATUS_PENDING))
+    db.session.commit()
+
+    response = client.get('/api/endpoints/commands/next',
+                          headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 200, response.get_data(as_text=True)
+    assert response.get_json()['data']['action'] == 'mtconnect_status'
+
+
+def test_command_result_refuses_another_assets_command(client, db, app,
+                                                      keyheaders):
+    from plugins.endpoints.models import EndpointCommand
+
+    _computer(db, 'BAY-01')
+    other = _computer(db, 'BAY-02', serialnumber='SER-2')
+    secret = _credential(client, keyheaders)
+    command = EndpointCommand(assetid=other, action='mtconnect_status',
+                              status=EndpointCommand.STATUS_RUNNING)
+    db.session.add(command)
+    db.session.commit()
+
+    response = client.post(
+        f'/api/endpoints/commands/{command.endpointcommandid}/result',
+        json={'succeeded': True},
+        headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 403
+    assert _code(response) == 'ASSET_MISMATCH'
+
+
+def test_command_result_for_own_command_needs_no_hostname(client, db, app,
+                                                         keyheaders):
+    from plugins.endpoints.models import EndpointCommand
+
+    assetid = _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+    command = EndpointCommand(assetid=assetid, action='mtconnect_status',
+                              status=EndpointCommand.STATUS_RUNNING)
+    db.session.add(command)
+    db.session.commit()
+
+    response = client.post(
+        f'/api/endpoints/commands/{command.endpointcommandid}/result',
+        json={'succeeded': True},
+        headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 200, response.get_data(as_text=True)
+
+
+def _fleet_alert(db):
+    from plugins.notifications.models import Notification, NotificationType
+
+    ntype = NotificationType(typename='Fleet Alert', typecolor='#d93f3f',
+                             isactive=True)
+    db.session.add(ntype)
+    db.session.flush()
+    note = Notification(notificationtypeid=ntype.notificationtypeid,
+                        notification='Line 3 is down', alertfleet=True,
+                        alerttimeout=60, isactive=True)
+    db.session.add(note)
+    db.session.commit()
+    return note.notificationid
+
+
+def test_alert_ack_refuses_another_asset(client, db, app, keyheaders):
+    _computer(db, 'BAY-01')
+    other = _computer(db, 'BAY-02', serialnumber='SER-2')
+    secret = _credential(client, keyheaders)
+    notificationid = _fleet_alert(db)
+
+    response = client.post(
+        f'/api/endpoints/alerts/{notificationid}/acknowledge',
+        json={'assetid': other},
+        headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 403
+    assert _code(response) == 'ASSET_MISMATCH'
+
+    byhostname = client.post(
+        f'/api/endpoints/alerts/{notificationid}/acknowledge',
+        json={'hostname': 'BAY-02'},
+        headers={'X-Endpoint-Credential': secret})
+    assert byhostname.status_code == 403
+    assert _code(byhostname) == 'ASSET_MISMATCH'
+
+
+def test_alert_ack_with_no_assetid_means_the_caller(client, db, app,
+                                                   keyheaders):
+    from plugins.notifications.models import NotificationAcknowledgement
+
+    assetid = _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+    notificationid = _fleet_alert(db)
+
+    response = client.post(
+        f'/api/endpoints/alerts/{notificationid}/acknowledge',
+        json={'assetid': 0},
+        headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 201, response.get_data(as_text=True)
+    assert NotificationAcknowledgement.query.filter_by(
+        notificationid=notificationid, assetid=assetid).count() == 1
+
+
+def test_collector_computers_refuses_another_hostname(client, db, app,
+                                                     keyheaders):
+    _computer(db, 'BAY-01')
+    _computer(db, 'BAY-02', serialnumber='SER-2')
+    secret = _credential(client, keyheaders)
+    headers = {'X-Endpoint-Credential': secret}
+
+    mismatch = client.post('/api/collector/computers',
+                           json={'hostname': 'BAY-02'}, headers=headers)
+    assert mismatch.status_code == 403, mismatch.get_data(as_text=True)
+    assert _code(mismatch) == 'ASSET_MISMATCH'
+
+    # A credential never creates a PC.
+    unknown = client.post('/api/collector/computers',
+                          json={'hostname': 'NEW-BAY'}, headers=headers)
+    assert unknown.status_code == 403
+    assert _code(unknown) == 'ASSET_MISMATCH'
+
+    own = client.post('/api/collector/computers',
+                      json={'hostname': 'BAY-01'}, headers=headers)
+    assert own.status_code == 200, own.get_data(as_text=True)
+
+
+def test_collector_refuses_shared_key_for_an_enrolled_pc(client, db, app,
+                                                        keyheaders):
+    _computer(db, 'BAY-01')
+    _credential(client, keyheaders)
+
+    response = client.post('/api/collector/computers',
+                           json={'hostname': 'BAY-01'}, headers=keyheaders)
+    assert response.status_code == 401
+    assert _code(response) == 'SHARED_KEY_REFUSED'
+
+
+def test_collector_invalid_credential(client, db, app):
+    response = client.post('/api/collector/printers',
+                           json={'hostname': 'BAY-01', 'queues': []},
+                           headers={'X-Endpoint-Credential': 'sdbe_' + 'a' * 43})
+    assert response.status_code == 401
+    assert _code(response) == 'CREDENTIAL_INVALID'
+
+
+def test_endpoints_collect_route_is_the_collector(client, db, app, keyheaders):
+    from plugins.endpoints.models import EndpointState
+
+    assetid = _computer(db, 'BAY-01')
+    secret = _credential(client, keyheaders)
+
+    response = client.post('/api/endpoints/collect',
+                           json={'hostname': 'BAY-01', 'agentversion': '1.20.0'},
+                           headers={'X-Endpoint-Credential': secret})
+    assert response.status_code == 200, response.get_data(as_text=True)
+    assert EndpointState.query.filter_by(assetid=assetid).one() \
+        .agentversion == '1.20.0'
+
+    _computer(db, 'BAY-02', serialnumber='SER-2')
+    mismatch = client.post('/api/endpoints/collect',
+                           json={'hostname': 'BAY-02'},
+                           headers={'X-Endpoint-Credential': secret})
+    assert mismatch.status_code == 403
+    assert _code(mismatch) == 'ASSET_MISMATCH'
+
+
+def test_contract_exports_answer_through_the_endpoints_plugin(client, db, app,
+                                                             keyheaders):
+    from shopdb.api import agent_shared_key_refused, resolve_agent_credential
+
+    assetid = _computer(db, 'BAY-01')
+    assert agent_shared_key_refused('BAY-01') is False
+    secret = _credential(client, keyheaders)
+    with app.test_request_context():
+        assert resolve_agent_credential(secret) == assetid
+        assert resolve_agent_credential('sdbe_' + 'z' * 43) is None
+        assert agent_shared_key_refused('BAY-01') is True
+        assert agent_shared_key_refused('UNKNOWN') is False
+
+
+# -- admin gating ------------------------------------------------------------
+
+@pytest.mark.parametrize('method,url', [
+    ('get', '/api/endpoints/enrollment'),
+    ('get', '/api/endpoints/enrollment/migration'),
+    ('post', '/api/endpoints/enrollment/requests/1/approve'),
+    ('post', '/api/endpoints/enrollment/requests/1/reject'),
+    ('post', '/api/endpoints/enrollment/assets/1/revoke'),
+    ('put', '/api/endpoints/enrollment/settings'),
+    ('post', '/api/endpoints/enrollment/migration/wave'),
+])
+def test_member_without_a_role_is_forbidden(client, db, member_headers, method,
+                                            url):
+    response = getattr(client, method)(url, json={}, headers=member_headers)
+    assert response.status_code == 403
+
+
+def test_enrollment_listing_and_settings(client, db, app, keyheaders,
+                                         auth_headers):
+    enrolled = _computer(db, 'BAY-01')
+    _computer(db, 'BAY-02', serialnumber='SER-2')
+    _computer(db, 'BAY-03', serialnumber=None)
+    _credential(client, keyheaders)
+    _enroll(client, keyheaders, hostname='BAY-03', serialnumber='X')
+
+    response = client.get('/api/endpoints/enrollment', headers=auth_headers)
+    assert response.status_code == 200, response.get_data(as_text=True)
+    body = response.get_json()
+    data = body['data']
+    assert data['settings'] == {'sharedkeyallowed': True, 'autoenroll': True}
+    assert data['counts'] == {'enrolled': 1, 'notenrolled': 1, 'pending': 1}
+    states = {row['hostname']: row['state'] for row in data['computers']}
+    assert states == {'BAY-01': 'enrolled', 'BAY-02': 'notenrolled',
+                      'BAY-03': 'pending'}
+    row = next(r for r in data['computers'] if r['assetid'] == enrolled)
+    assert row['credentialprefix'].startswith('sdbe_')
+    assert row['enrolledvia'] == 'auto'
+    assert [r['reason'] for r in data['requests']
+            if r['status'] == 'pending'] == ['no serial on record']
+    assert body['meta']['pagination']['total'] == 3
+
+    filtered = client.get('/api/endpoints/enrollment?state=enrolled',
+                          headers=auth_headers).get_json()['data']
+    assert [r['hostname'] for r in filtered['computers']] == ['BAY-01']
+
+    put = client.put('/api/endpoints/enrollment/settings',
+                     json={'sharedkeyallowed': False}, headers=auth_headers)
+    assert put.status_code == 200
+    assert put.get_json()['data'] == {'sharedkeyallowed': False,
+                                      'autoenroll': True}
+    bad = client.put('/api/endpoints/enrollment/settings',
+                     json={'autoenroll': 'yes'}, headers=auth_headers)
+    assert bad.status_code == 400
+
+
+def test_approve_refuses_an_enrolled_computer(client, db, app, keyheaders,
+                                              auth_headers):
+    assetid = _computer(db, 'BAY-01')
+    _credential(client, keyheaders)
+    pending = _enroll(client, keyheaders, nonce=OTHER_NONCE)
+    requestid = pending.get_json()['data']['requestid']
+
+    response = client.post(
+        f'/api/endpoints/enrollment/requests/{requestid}/approve',
+        json={'assetid': assetid}, headers=auth_headers)
+    assert response.status_code == 409
+
+
+# -- server certificate pin --------------------------------------------------
+
+def test_server_cert_reports_the_spki_pin(client, db, auth_headers, tmp_path,
+                                          monkeypatch):
+    import hashlib
+    from datetime import datetime, timedelta, timezone
+
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from cryptography.x509.oid import NameOID
+
+    from plugins.endpoints.api import routes as endpoint_routes
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, 'pin.example.test')])
+    now = datetime.now(timezone.utc)
+    certificate = (x509.CertificateBuilder()
+                   .subject_name(name).issuer_name(name)
+                   .public_key(key.public_key())
+                   .serial_number(x509.random_serial_number())
+                   .not_valid_before(now - timedelta(days=1))
+                   .not_valid_after(now + timedelta(days=30))
+                   .sign(key, hashes.SHA256()))
+    certdir = tmp_path / 'certs'
+    certdir.mkdir()
+    (certdir / 'server.crt').write_bytes(
+        certificate.public_bytes(serialization.Encoding.PEM))
+    monkeypatch.chdir(tmp_path)
+    if hasattr(endpoint_routes, '_server_cert_dir'):
+        monkeypatch.setattr(endpoint_routes, '_server_cert_dir', lambda: certdir)
+
+    expected = hashlib.sha256(key.public_key().public_bytes(
+        serialization.Encoding.DER,
+        serialization.PublicFormat.SubjectPublicKeyInfo)).hexdigest()
+
+    response = client.get('/api/endpoints/settings/server-cert',
+                          headers=auth_headers)
+    assert response.status_code == 200, response.get_data(as_text=True)
+    assert response.get_json()['data']['spkisha256'] == expected

tests/test_plugins/test_endpoints_credentials_migration.py

@@ -0,0 +1,139 @@
+"""Migration 0023: per-PC credential tables, and the client certificate cleanup.
+
+Two starting points matter. A database that ran the 2026-09-14 builds of
+0020-0022 carries app_fingerprint and five certificate columns on assets; a
+fresh one carries neither. Both must reach the same schema, twice over.
+"""
+
+import importlib.util
+from pathlib import Path
+
+from alembic.migration import MigrationContext
+from alembic.operations import Operations
+from sqlalchemy import create_engine, inspect, text
+
+
+_VERSIONS = (Path(__file__).resolve().parent.parent.parent
+             / 'plugins' / 'endpoints' / 'migrations' / 'versions')
+_CHAIN = ('0020_app_delta_fingerprints.py', '0021_client_certificates.py',
+          '0022_client_cert_revocation.py', '0023_endpoint_credentials.py')
+_CERT_COLUMNS = {'client_cert_fingerprint', 'cert_issued_at', 'cert_expires_at',
+                 'cert_revoked_at', 'cert_revocation_reason'}
+
+
+def _load(filename):
+    path = _VERSIONS / filename
+    spec = importlib.util.spec_from_file_location('endpoints_mig_' + path.stem,
+                                                  str(path))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _run(connection, step='upgrade', files=_CHAIN):
+    operations = Operations(MigrationContext.configure(connection))
+    operations._install_proxy()
+    try:
+        for filename in files:
+            getattr(_load(filename), step)()
+    finally:
+        operations._remove_proxy()
+    connection.commit()
+
+
+def _base_schema(connection, legacy):
+    certcolumns = ''
+    if legacy:
+        certcolumns = (', client_cert_fingerprint VARCHAR(64), '
+                       'cert_issued_at DATETIME, cert_expires_at DATETIME, '
+                       'cert_revoked_at DATETIME, '
+                       'cert_revocation_reason VARCHAR(255)')
+    connection.execute(text(
+        'CREATE TABLE assets (assetid INTEGER PRIMARY KEY, '
+        'assetnumber VARCHAR(50)' + certcolumns + ')'))
+    fingerprint = ', app_fingerprint VARCHAR(64)' if legacy else ''
+    connection.execute(text(
+        'CREATE TABLE endpointapplications (endpointapplicationid INTEGER '
+        'PRIMARY KEY, assetid INTEGER, displayname VARCHAR(255)'
+        + fingerprint + ')'))
+    if legacy:
+        connection.execute(text(
+            'CREATE INDEX idx_assets_cert_fingerprint ON assets '
+            '(client_cert_fingerprint)'))
+        connection.execute(text(
+            'CREATE UNIQUE INDEX idx_endpointapplications_fingerprint ON '
+            'endpointapplications (assetid, app_fingerprint)'))
+        connection.execute(text(
+            "INSERT INTO endpointapplications VALUES (1, 7, 'App', '"
+            + 'a' * 64 + "')"))
+    connection.commit()
+
+
+def _assert_head_schema(connection):
+    inspector = inspect(connection)
+    assetcolumns = {c['name'] for c in inspector.get_columns('assets')}
+    assert not assetcolumns & _CERT_COLUMNS
+    appcolumns = {c['name'] for c in inspector.get_columns('endpointapplications')}
+    assert 'appfingerprint' in appcolumns
+    assert 'app_fingerprint' not in appcolumns
+    indexed = {tuple(ix['column_names']): ix['unique'] for ix in
+               inspector.get_indexes('endpointapplications')}
+    assert indexed.get(('assetid', 'appfingerprint')) in (True, 1)
+
+    for table in ('endpointcredentials', 'endpointenrollrequests',
+                  'endpointmigrationwaves'):
+        assert inspector.has_table(table), table
+    credentialcolumns = {c['name'] for c in inspector.get_columns('endpointcredentials')}
+    assert credentialcolumns == {
+        'credentialid', 'assetid', 'credentialhash', 'credentialprefix',
+        'enrolledvia', 'issuedat', 'lastusedat', 'revokedat', 'revokedby'}
+    requestindexes = [tuple(ix['column_names']) for ix in
+                      inspector.get_indexes('endpointenrollrequests')]
+    assert requestindexes.count(('hostname', 'serialnumber')) == 1
+
+
+def test_upgrade_from_the_client_certificate_builds():
+    engine = create_engine('sqlite://')
+    with engine.connect() as connection:
+        _base_schema(connection, legacy=True)
+        _run(connection)
+        _assert_head_schema(connection)
+        # Data survives the rename.
+        assert connection.execute(text(
+            'SELECT appfingerprint FROM endpointapplications')).scalar() == 'a' * 64
+
+        _run(connection)
+        _assert_head_schema(connection)
+
+
+def test_upgrade_on_a_fresh_database():
+    engine = create_engine('sqlite://')
+    with engine.connect() as connection:
+        _base_schema(connection, legacy=False)
+        _run(connection)
+        _assert_head_schema(connection)
+        _run(connection)
+        _assert_head_schema(connection)
+
+
+def test_retired_certificate_revisions_are_no_ops():
+    engine = create_engine('sqlite://')
+    with engine.connect() as connection:
+        _base_schema(connection, legacy=False)
+        _run(connection, files=_CHAIN[1:3])
+        columns = {c['name'] for c in inspect(connection).get_columns('assets')}
+        assert not columns & _CERT_COLUMNS
+
+
+def test_downgrade_drops_the_credential_tables():
+    engine = create_engine('sqlite://')
+    with engine.connect() as connection:
+        _base_schema(connection, legacy=False)
+        _run(connection)
+        _run(connection, step='downgrade', files=_CHAIN[3:])
+        inspector = inspect(connection)
+        for table in ('endpointcredentials', 'endpointenrollrequests',
+                      'endpointmigrationwaves'):
+            assert not inspector.has_table(table), table
+        _run(connection, files=_CHAIN[3:])
+        _assert_head_schema(connection)

tests/test_plugins/test_endpoints_enrollment_migration.py

@@ -0,0 +1,278 @@
+"""Moving the existing fleet onto per-PC credentials.
+
+A PC on agent 1.19 or older holds only the shared key. It moves by receiving
+agent 1.20, which enrolls itself. The migration surface computes, per computer,
+whether that upgrade can be pushed, and pushes it in waves through the same
+enqueue path as the single-asset agentupgrade route, packaging once per wave.
+
+The agent store is isolated per test, as in test_endpoints_agent_upgrade_route.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from plugins.endpoints.api import agentregistry, agentstore, agentupgradescript
+
+MIGRATION_URL = '/api/endpoints/enrollment/migration'
+WAVE_URL = '/api/endpoints/enrollment/migration/wave'
+
+_PE_BYTES = b'MZ' + b'\x00' * 4096
+
+
+@pytest.fixture(autouse=True)
+def isolate_store(tmp_path, monkeypatch):
+    siteagent = tmp_path / 'siteagent'
+    packages = tmp_path / 'applicationpackages'
+    scripts = tmp_path / 'scripts'
+    for directory in (siteagent, packages, scripts):
+        directory.mkdir()
+    monkeypatch.setattr(agentstore, '_siteagent_dir', lambda: str(siteagent))
+    monkeypatch.setattr(agentregistry, 'application_package_location',
+                        lambda: (str(packages), '/api/applications/package/'))
+    monkeypatch.setattr(agentupgradescript, 'script_body_location',
+                        lambda: (str(scripts), '/api/scripts/body/'))
+    return tmp_path
+
+
+def _now():
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+def _publish_agent(version='1.20.0'):
+    agentstore.store_version('agent', version, _PE_BYTES, make_current=True)
+
+
+def _pc(db, hostname, agentversion='1.19.0', serialnumber='SER',
+        reportedago=timedelta(hours=1), reports=True):
+    from shopdb.api import Asset, AssetType
+    from plugins.computers.models import Computer
+    from plugins.endpoints.models import EndpointState
+
+    atype = AssetType.query.filter_by(assettype='computer').first()
+    if atype is None:
+        atype = AssetType(assettype='computer')
+        db.session.add(atype)
+        db.session.flush()
+    asset = Asset(assetnumber=hostname + '-asset', name=hostname,
+                  assettypeid=atype.assettypeid, isactive=True,
+                  serialnumber=serialnumber)
+    db.session.add(asset)
+    db.session.flush()
+    db.session.add(Computer(assetid=asset.assetid, hostname=hostname))
+    if reports:
+        db.session.add(EndpointState(
+            assetid=asset.assetid, hostname=hostname, agentversion=agentversion,
+            lastreportedat=_now() - reportedago if reportedago else None))
+    db.session.commit()
+    return asset.assetid
+
+
+def _rows(client, headers, query=''):
+    response = client.get(MIGRATION_URL + query, headers=headers)
+    assert response.status_code == 200, response.get_data(as_text=True)
+    return response.get_json()['data']
+
+
+def _by_host(data):
+    return {row['hostname']: row for row in data['computers']}
+
+
+def test_readiness_states(client, db, app, auth_headers):
+    from plugins.endpoints.api.agentauth import generate_credential
+    from plugins.endpoints.api.enrollment import issue_credential
+    from plugins.endpoints.models import EndpointCommand, EndpointEnrollRequest
+
+    _publish_agent()
+    enrolled = _pc(db, 'PC-ENROLLED')
+    issue_credential(enrolled, 'auto')
+    pending = _pc(db, 'PC-PENDING')
+    db.session.add(EndpointEnrollRequest(
+        hostname='pc-pending', serialnumber='SER', enrollnonce=generate_credential(),
+        status='pending', reason='awaiting approval', matchedassetid=pending,
+        requestedat=_now(), lastseenat=_now()))
+    upgrading = _pc(db, 'PC-UPGRADING')
+    _pc(db, 'PC-READY')
+    _pc(db, 'PC-BLOCKED', serialnumber=None, reportedago=timedelta(days=3))
+    _pc(db, 'PC-SHAREONLY', reports=False)
+    _pc(db, 'PC-NEW', agentversion='1.20.0.0')
+    db.session.commit()
+
+    seeded_app = agentregistry.register_current_agent_package()
+    assert seeded_app is not None
+    scriptid = agentupgradescript.seed_upgrade_script()['scriptid']
+    db.session.add(EndpointCommand(assetid=upgrading, action='run_script',
+                                   target=f'script:{scriptid}',
+                                   status=EndpointCommand.STATUS_PENDING))
+    db.session.commit()
+
+    data = _rows(client, auth_headers)
+    rows = _by_host(data)
+    assert data['target'] == '1.20.0'
+    assert rows['PC-ENROLLED']['state'] == 'enrolled'
+    assert rows['PC-PENDING']['state'] == 'pending'
+    assert rows['PC-UPGRADING']['state'] == 'upgrading'
+    assert rows['PC-READY']['state'] == 'ready'
+    assert rows['PC-READY']['blockers'] == []
+    assert rows['PC-BLOCKED']['state'] == 'blocked'
+    assert rows['PC-BLOCKED']['blockers'] == ['offline', 'no serial on record']
+    assert rows['PC-SHAREONLY']['state'] == 'notreporting'
+    assert rows['PC-NEW']['state'] == 'blocked'
+    assert rows['PC-NEW']['blockers'] == ['awaiting enrollment']
+    assert data['counts'] == {'enrolled': 1, 'pending': 1, 'upgrading': 1,
+                              'ready': 1, 'blocked': 2, 'notreporting': 1}
+
+    only = _rows(client, auth_headers, '?state=ready')
+    assert [row['hostname'] for row in only['computers']] == ['PC-READY']
+    assert client.get(MIGRATION_URL + '?state=bogus',
+                      headers=auth_headers).status_code == 400
+
+
+def test_every_blocker_is_listed(client, db, app, auth_headers, monkeypatch):
+    from plugins.endpoints import commands
+    from plugins.endpoints.api import enrollment
+
+    # No package in the store at all.
+    _pc(db, 'DUP')
+    _pc(db, 'dup', agentversion='1.5.0')
+    lockedid = _pc(db, 'LOCKED')
+    commands.PLACE_ENDPOINT_LOCK(assetid=lockedid, reason='bench repair')
+    db.session.commit()
+    monkeypatch.setattr(enrollment, 'minimum_agent_version_for',
+                        lambda action: '1.10.0')
+
+    rows = {}
+    for row in _rows(client, auth_headers)['computers']:
+        rows.setdefault(row['hostname'], []).append(row)
+    assert rows['dup'][0]['blockers'] == ['duplicate hostname',
+                                          'no agent package in store',
+                                          'agent too old for remote upgrade']
+    assert rows['LOCKED'][0]['blockers'] == ['commands locked',
+                                             'no agent package in store']
+
+
+def test_an_old_store_build_counts_as_no_package(client, db, app, auth_headers):
+    _publish_agent('1.19.5')
+    _pc(db, 'PC-A')
+    row = _by_host(_rows(client, auth_headers))['PC-A']
+    assert row['blockers'] == ['no agent package in store']
+
+
+def test_version_compare_is_numeric(client, db, app, auth_headers):
+    _publish_agent('1.20.0')
+    _pc(db, 'PC-NINE', agentversion='1.9.0')
+    _pc(db, 'PC-HUNDRED', agentversion='1.100.0')
+    rows = _by_host(_rows(client, auth_headers))
+    assert rows['PC-NINE']['state'] == 'ready'
+    assert rows['PC-HUNDRED']['blockers'] == ['awaiting enrollment']
+
+
+def test_wave_next_n_queues_ready_pcs_in_hostname_order(client, db, app,
+                                                       auth_headers):
+    from plugins.endpoints.models import EndpointCommand, EndpointMigrationWave
+
+    _publish_agent()
+    third = _pc(db, 'PC-C')
+    first = _pc(db, 'PC-A')
+    second = _pc(db, 'PC-B')
+    _pc(db, 'PC-OFFLINE', reportedago=timedelta(days=2))
+
+    response = client.post(WAVE_URL, json={'next': 2}, headers=auth_headers)
+    assert response.status_code == 201, response.get_data(as_text=True)
+    data = response.get_json()['data']
+    assert data['queued'] == [first, second]
+    assert data['skipped'] == []
+
+    commands = EndpointCommand.query.filter_by(action='run_script').all()
+    assert sorted(c.assetid for c in commands) == [first, second]
+    wave = EndpointMigrationWave.query.one()
+    assert wave.waveid == data['waveid']
+    assert wave.assetidlist == [first, second]
+
+    migration = _rows(client, auth_headers)
+    rows = _by_host(migration)
+    assert rows['PC-A']['state'] == 'upgrading'
+    assert rows['PC-C']['state'] == 'ready'
+    assert migration['waves'] == [{
+        'waveid': wave.waveid, 'createdat': migration['waves'][0]['createdat'],
+        'createdby': 'testadmin', 'size': 2, 'queued': 2, 'enrolled': 0,
+        'failed': 0, 'done': False}]
+    assert third not in data['queued']
+
+
+def test_wave_explicit_ids_rechecks_readiness(client, db, app, auth_headers):
+    _publish_agent()
+    ready = _pc(db, 'PC-READY')
+    offline = _pc(db, 'PC-OFFLINE', reportedago=timedelta(days=2))
+    noagent = _pc(db, 'PC-NOAGENT', reports=False)
+
+    response = client.post(WAVE_URL,
+                           json={'assetids': [ready, offline, noagent, 999999]},
+                           headers=auth_headers)
+    assert response.status_code == 201, response.get_data(as_text=True)
+    data = response.get_json()['data']
+    assert data['queued'] == [ready]
+    assert data['skipped'] == [
+        {'assetid': offline, 'reason': 'offline'},
+        {'assetid': noagent, 'reason': 'notreporting'},
+        {'assetid': 999999, 'reason': 'not a computer'},
+    ]
+
+
+def test_wave_packages_once(client, db, app, auth_headers, monkeypatch):
+    from plugins.endpoints.api import routes
+
+    _publish_agent()
+    ids = [_pc(db, f'PC-{n}') for n in range(3)]
+    calls = []
+    real = routes.prepare_agent_upgrade
+
+    def counting():
+        calls.append(1)
+        return real()
+
+    monkeypatch.setattr(routes, 'prepare_agent_upgrade', counting)
+    response = client.post(WAVE_URL, json={'assetids': ids},
+                           headers=auth_headers)
+    assert response.status_code == 201
+    assert response.get_json()['data']['queued'] == ids
+    assert calls == [1]
+
+
+def test_wave_progress_counts_enrolled_and_failed(client, db, app,
+                                                  auth_headers):
+    from plugins.endpoints.api.enrollment import issue_credential
+    from plugins.endpoints.models import EndpointCommand
+
+    _publish_agent()
+    good = _pc(db, 'PC-GOOD')
+    bad = _pc(db, 'PC-BAD')
+    client.post(WAVE_URL, json={'assetids': [good, bad]}, headers=auth_headers)
+
+    issue_credential(good, 'auto')
+    EndpointCommand.query.filter_by(assetid=bad).one().status = \
+        EndpointCommand.STATUS_FAILED
+    db.session.commit()
+
+    wave = _rows(client, auth_headers)['waves'][0]
+    assert (wave['size'], wave['enrolled'], wave['failed'], wave['done']) == \
+        (2, 1, 1, True)
+
+
+def test_wave_without_ready_pcs_creates_nothing(client, db, app, auth_headers):
+    from plugins.endpoints.models import EndpointMigrationWave
+
+    offline = _pc(db, 'PC-OFFLINE', reportedago=timedelta(days=2))
+    response = client.post(WAVE_URL, json={'assetids': [offline]},
+                           headers=auth_headers)
+    assert response.status_code == 200
+    assert response.get_json()['data']['waveid'] is None
+    assert EndpointMigrationWave.query.count() == 0
+
+
+@pytest.mark.parametrize('body', [{}, {'next': 0}, {'next': 101},
+                                  {'assetids': []}, {'assetids': ['1']},
+                                  {'assetids': list(range(1, 102))}])
+def test_wave_validation(client, db, app, auth_headers, body):
+    assert client.post(WAVE_URL, json=body,
+                       headers=auth_headers).status_code == 400

tests/test_plugins/test_endpoints_fleet_alert_scheduling.py

@@ -1,254 +1,114 @@
-"""Test fleet alert scheduling respects starttime.
+"""Fleet alert scheduling respects starttime and endtime.
 
-Regression test for bug where fleet alerts with future starttime were sent
-immediately instead of waiting for the scheduled time.
+Regression test for a bug where fleet alerts with a future starttime were sent
+immediately instead of waiting for the scheduled time. The agent polls on the
+collector credential, and the hostname must resolve to a Computer, so the
+fixtures mirror test_endpoints_fleet_alerts.py.
 """
 
-import pytest
 from datetime import datetime, timedelta, timezone
 
+from shopdb.core.models import Asset, AssetType
 
-def test_fleet_alert_respects_future_starttime(client, auth_headers, sample_asset):
-    """Fleet alerts with future starttime should not appear until that time."""
+
+ALERTS_URL = '/api/endpoints/alerts'
+COLLECTOR_KEY = 'testcollectorkey'
+
+
+def _collector_headers(app):
+    app.config['COLLECTOR_API_KEY'] = COLLECTOR_KEY
+    return {'X-API-Key': COLLECTOR_KEY}
+
+
+def _computer(db, hostname):
+    from plugins.computers.models import Computer
+
+    atype = AssetType.query.filter_by(assettype='computer').first()
+    if not atype:
+        atype = AssetType(assettype='computer')
+        db.session.add(atype)
+        db.session.flush()
+    asset = Asset(assetnumber=hostname, assettypeid=atype.assettypeid,
+                  isactive=True)
+    db.session.add(asset)
+    db.session.flush()
+    db.session.add(Computer(assetid=asset.assetid, hostname=hostname))
+    db.session.commit()
+    return asset
+
+
+def _fleet_alert(db, message, starttime=None, endtime=None):
     from plugins.notifications.models import Notification, NotificationType
-    from plugins.endpoints.models import EndpointState
-    from shopdb.api import db
 
-    # Create notification type
-    ntype = NotificationType(
-        typename='System Maintenance',
-        typecolor='#ffc107',
-        isactive=True
-    )
-    db.session.add(ntype)
-    db.session.flush()
+    ntype = NotificationType.query.filter_by(typename='Fleet Alert').first()
+    if not ntype:
+        ntype = NotificationType(typename='Fleet Alert', typecolor='#ffc107',
+                                 isactive=True)
+        db.session.add(ntype)
+        db.session.flush()
+    note = Notification(notification=message,
+                        notificationtypeid=ntype.notificationtypeid,
+                        starttime=starttime, endtime=endtime, isactive=True,
+                        alertfleet=True, alertscope=None, alerttimeout=0)
+    db.session.add(note)
+    db.session.commit()
+    return note
 
-    # Create endpoint state for the asset
-    state = EndpointState(
-        assetid=sample_asset.assetid,
-        hostname='TEST-PC-01',
-        agentversion='1.0.0',
-        lastreportedat=datetime.utcnow()
-    )
-    db.session.add(state)
-    db.session.flush()
 
-    now = datetime.now(timezone.utc).replace(tzinfo=None)
-    future_time = now + timedelta(minutes=20)  # 20 minutes from now
-    end_time = future_time + timedelta(hours=1)
+def _now():
+    return datetime.now(timezone.utc).replace(tzinfo=None)
 
-    # Create fleet alert scheduled for 20 minutes in the future
-    notification = Notification(
-        notification='Scheduled maintenance at 3:30 PM',
-        notificationtypeid=ntype.notificationtypeid,
-        starttime=future_time,
-        endtime=end_time,
-        isactive=True,
-        alertfleet=True,
-        alertscope=None,  # All endpoints
-        alerttimeout=0
-    )
-    db.session.add(notification)
+
+def _poll(client, app, hostname):
+    response = client.get(f'{ALERTS_URL}?hostname={hostname}',
+                          headers=_collector_headers(app))
+    assert response.status_code == 200, response.get_data(as_text=True)
+    body = response.get_json()
+    assert body['status'] == 'success'
+    return body['data']
+
+
+def test_fleet_alert_respects_future_starttime(client, db, app):
+    """A future starttime keeps the alert off the endpoint until it passes."""
+    _computer(db, 'TEST-PC-01')
+    now = _now()
+    note = _fleet_alert(db, 'Scheduled maintenance at 3:30 PM',
+                        starttime=now + timedelta(minutes=20),
+                        endtime=now + timedelta(hours=2))
+
+    assert _poll(client, app, 'TEST-PC-01') == []
+
+    note.starttime = now - timedelta(minutes=5)
     db.session.commit()
 
-    # Agent polls for fleet alerts NOW (before starttime)
-    response = client.get(
-        '/api/endpoints/alerts?hostname=TEST-PC-01',
-        headers=auth_headers
-    )
-
-    assert response.status_code == 200
-    data = response.get_json()
-    assert data['status'] == 'success'
-
-    # BUG FIX: Alert should NOT appear because starttime is in the future
-    alerts = data['data']
-    assert len(alerts) == 0, 'Fleet alert with future starttime should not appear yet'
-
-    # Simulate time passing - set starttime to the past
-    notification.starttime = now - timedelta(minutes=5)
-    db.session.commit()
-
-    # Agent polls again (now starttime has passed)
-    response = client.get(
-        '/api/endpoints/alerts?hostname=TEST-PC-01',
-        headers=auth_headers
-    )
-
-    assert response.status_code == 200
-    data = response.get_json()
-    assert data['status'] == 'success'
-
-    # Now the alert SHOULD appear
-    alerts = data['data']
-    assert len(alerts) == 1
-    assert alerts[0]['notificationId'] == notification.notificationid
+    alerts = _poll(client, app, 'TEST-PC-01')
+    assert [a['notificationId'] for a in alerts] == [note.notificationid]
     assert alerts[0]['title'] == 'Scheduled maintenance at 3:30 PM'
 
 
-def test_fleet_alert_with_no_starttime_appears_immediately(client, auth_headers, sample_asset):
-    """Fleet alerts with no starttime should appear immediately."""
-    from plugins.notifications.models import Notification, NotificationType
-    from plugins.endpoints.models import EndpointState
-    from shopdb.api import db
+def test_fleet_alert_with_no_starttime_appears_immediately(client, db, app):
+    _computer(db, 'TEST-PC-02')
+    note = _fleet_alert(db, 'Immediate alert - urgent')
 
-    # Create notification type
-    ntype = NotificationType(
-        typename='System Alert',
-        typecolor='#dc3545',
-        isactive=True
-    )
-    db.session.add(ntype)
-    db.session.flush()
-
-    # Create endpoint state
-    state = EndpointState(
-        assetid=sample_asset.assetid,
-        hostname='TEST-PC-02',
-        agentversion='1.0.0',
-        lastreportedat=datetime.utcnow()
-    )
-    db.session.add(state)
-    db.session.flush()
-
-    # Create fleet alert with no starttime (immediate)
-    notification = Notification(
-        notification='Immediate alert - urgent',
-        notificationtypeid=ntype.notificationtypeid,
-        starttime=None,  # No starttime = immediate
-        endtime=None,
-        isactive=True,
-        alertfleet=True,
-        alertscope=None,
-        alerttimeout=0
-    )
-    db.session.add(notification)
-    db.session.commit()
-
-    # Agent polls for fleet alerts
-    response = client.get(
-        '/api/endpoints/alerts?hostname=TEST-PC-02',
-        headers=auth_headers
-    )
-
-    assert response.status_code == 200
-    data = response.get_json()
-    assert data['status'] == 'success'
-
-    # Alert should appear immediately
-    alerts = data['data']
-    assert len(alerts) == 1
-    assert alerts[0]['notificationId'] == notification.notificationid
+    alerts = _poll(client, app, 'TEST-PC-02')
+    assert [a['notificationId'] for a in alerts] == [note.notificationid]
     assert alerts[0]['title'] == 'Immediate alert - urgent'
 
 
-def test_fleet_alert_past_starttime_appears(client, auth_headers, sample_asset):
-    """Fleet alerts with past starttime should appear."""
-    from plugins.notifications.models import Notification, NotificationType
-    from plugins.endpoints.models import EndpointState
-    from shopdb.api import db
+def test_fleet_alert_past_starttime_appears(client, db, app):
+    _computer(db, 'TEST-PC-03')
+    note = _fleet_alert(db, 'Alert started 1 hour ago',
+                        starttime=_now() - timedelta(hours=1))
 
-    ntype = NotificationType(
-        typename='Update',
-        typecolor='#17a2b8',
-        isactive=True
-    )
-    db.session.add(ntype)
-    db.session.flush()
-
-    state = EndpointState(
-        assetid=sample_asset.assetid,
-        hostname='TEST-PC-03',
-        agentversion='1.0.0',
-        lastreportedat=datetime.utcnow()
-    )
-    db.session.add(state)
-    db.session.flush()
-
-    now = datetime.now(timezone.utc).replace(tzinfo=None)
-    past_time = now - timedelta(hours=1)
-
-    # Create fleet alert that started 1 hour ago
-    notification = Notification(
-        notification='Alert started 1 hour ago',
-        notificationtypeid=ntype.notificationtypeid,
-        starttime=past_time,
-        endtime=None,
-        isactive=True,
-        alertfleet=True,
-        alertscope=None,
-        alerttimeout=0
-    )
-    db.session.add(notification)
-    db.session.commit()
-
-    # Agent polls for fleet alerts
-    response = client.get(
-        '/api/endpoints/alerts?hostname=TEST-PC-03',
-        headers=auth_headers
-    )
-
-    assert response.status_code == 200
-    data = response.get_json()
-    assert data['status'] == 'success'
-
-    # Alert should appear (starttime is in the past)
-    alerts = data['data']
-    assert len(alerts) == 1
-    assert alerts[0]['notificationId'] == notification.notificationid
+    alerts = _poll(client, app, 'TEST-PC-03')
+    assert [a['notificationId'] for a in alerts] == [note.notificationid]
 
 
-def test_fleet_alert_expired_does_not_appear(client, auth_headers, sample_asset):
-    """Fleet alerts with past endtime should not appear."""
-    from plugins.notifications.models import Notification, NotificationType
-    from plugins.endpoints.models import EndpointState
-    from shopdb.api import db
+def test_fleet_alert_expired_does_not_appear(client, db, app):
+    _computer(db, 'TEST-PC-04')
+    now = _now()
+    _fleet_alert(db, 'This alert already ended',
+                 starttime=now - timedelta(hours=2),
+                 endtime=now - timedelta(hours=1))
 
-    ntype = NotificationType(
-        typename='Expired',
-        typecolor='#6c757d',
-        isactive=True
-    )
-    db.session.add(ntype)
-    db.session.flush()
-
-    state = EndpointState(
-        assetid=sample_asset.assetid,
-        hostname='TEST-PC-04',
-        agentversion='1.0.0',
-        lastreportedat=datetime.utcnow()
-    )
-    db.session.add(state)
-    db.session.flush()
-
-    now = datetime.now(timezone.utc).replace(tzinfo=None)
-    past_start = now - timedelta(hours=2)
-    past_end = now - timedelta(hours=1)
-
-    # Create expired fleet alert
-    notification = Notification(
-        notification='This alert already ended',
-        notificationtypeid=ntype.notificationtypeid,
-        starttime=past_start,
-        endtime=past_end,  # Ended 1 hour ago
-        isactive=True,
-        alertfleet=True,
-        alertscope=None,
-        alerttimeout=0
-    )
-    db.session.add(notification)
-    db.session.commit()
-
-    # Agent polls for fleet alerts
-    response = client.get(
-        '/api/endpoints/alerts?hostname=TEST-PC-04',
-        headers=auth_headers
-    )
-
-    assert response.status_code == 200
-    data = response.get_json()
-    assert data['status'] == 'success'
-
-    # Alert should NOT appear (endtime is in the past)
-    alerts = data['data']
-    assert len(alerts) == 0
+    assert _poll(client, app, 'TEST-PC-04') == []

tests/test_plugins/test_endpoints_fleet_alerts.py

@@ -427,14 +427,42 @@ def test_an_unknown_scope_key_is_ignored_not_fatal(client, db, app):
     assert _ids(client, app, 'BAY-01') == [alert.notificationid]
 
 
-def test_a_non_dict_scope_falls_back_to_the_whole_fleet(client, db, app):
-    """Garbled scope JSON must not stop an alert reaching the floor."""
+def test_a_non_dict_scope_fails_closed(client, db, app):
+    """A scope that is present but not an object is corrupt, not fleet-wide.
+
+    Create/update refuse such a scope, so a row carrying one did not come from
+    an operator's intent to reach everyone. Broadcasting it could put a
+    one-bay alert on every screen, so it reaches nobody.
+    """
     _computer(db, 'BAY-01')
     alert = _fleet_alert(db)
     alert.alertscope = 'BAY-01'
     db.session.commit()
+    assert _ids(client, app, 'BAY-01') == []
+
+    alert.alertscope = ['BAY-01']
+    db.session.commit()
+    assert _ids(client, app, 'BAY-01') == []
+
+
+def test_a_json_string_scope_is_parsed(client, db, app):
+    """Legacy rows written through the TEXT column hold the object as text."""
+    _computer(db, 'BAY-01')
+    _computer(db, 'BAY-02')
+    alert = _fleet_alert(db)
+    alert.alertscope = '{"hostname": "BAY-01"}'
+    db.session.commit()
 
     assert _ids(client, app, 'BAY-01') == [alert.notificationid]
+    assert _ids(client, app, 'BAY-02') == []
+
+
+def test_scope_keys_match_the_notifications_validator():
+    """Create/update validation and the matcher must agree on the key set."""
+    from plugins.endpoints.api.routes import _ALERT_SCOPE_KEYS
+    from plugins.notifications.models.notification import ALERT_SCOPE_KEYS
+
+    assert set(_ALERT_SCOPE_KEYS) == set(ALERT_SCOPE_KEYS)
 
 
 def test_scoping_does_not_leak_into_acknowledgement(client, db, app):

tests/test_plugins/test_endpoints_health_savepoint.py

@@ -0,0 +1,53 @@
+"""Health evaluation failing with a database error must not sink the check-in.
+
+The health rollup is fail-open: a caught exception leaves the previous verdict
+standing. A caught IntegrityError from a flush, though, leaves the session
+needing a rollback, and the outer commit of the whole check-in would then fail.
+The evaluation runs inside a SAVEPOINT so only its own writes are discarded.
+"""
+
+from shopdb.core.models import Asset, AssetType
+
+
+def _computer(db, hostname):
+    from plugins.computers.models import Computer
+
+    atype = AssetType.query.filter_by(assettype='computer').first()
+    if not atype:
+        atype = AssetType(assettype='computer')
+        db.session.add(atype)
+        db.session.flush()
+    asset = Asset(assetnumber=hostname, assettypeid=atype.assettypeid,
+                  isactive=True)
+    db.session.add(asset)
+    db.session.flush()
+    db.session.add(Computer(assetid=asset.assetid, hostname=hostname))
+    db.session.commit()
+    return asset
+
+
+def test_integrity_error_in_health_keeps_the_checkin(client, db, app,
+                                                     monkeypatch):
+    from plugins.endpoints.plugin import EndpointsPlugin
+    from plugins.endpoints.models import EndpointState
+    from plugins.endpoints.services import health
+
+    calls = []
+
+    def exploding_health(assetid, state, computertypeid=None):
+        calls.append(assetid)
+        # A duplicate unique value: the flush raises IntegrityError.
+        db.session.add(AssetType(assettype='computer'))
+        db.session.flush()
+
+    monkeypatch.setattr(health, 'evaluate_endpoint_health', exploding_health)
+
+    asset = _computer(db, 'SAVEPT01')
+    plugin = EndpointsPlugin()
+    plugin.apply_collector_payload({'hostname': 'SAVEPT01', 'services': []})
+    db.session.commit()
+
+    assert calls == [asset.assetid]
+    state = EndpointState.query.filter_by(assetid=asset.assetid).first()
+    assert state is not None
+    assert AssetType.query.filter_by(assettype='computer').count() == 1

tests/test_plugins/test_endpoints_policy_override.py

@@ -175,6 +175,44 @@ def test_an_admin_override_is_accepted_and_audited(client, db):
     assert entry is not None, 'break-glass must leave an audit record'
 
 
+def test_a_refused_override_leaves_no_hold_and_no_audit_row(client, db):
+    """Validation after the override branch must run before anything is written.
+
+    A targetless service action, and a second command while one is in flight,
+    are both refused. Neither may leave a policyoverridden audit row or a
+    PolicyActionHold behind, or the record claims a break-glass that never ran.
+    """
+    from shopdb.api import AuditLog
+    from plugins.computers.models import PolicyActionHold
+    from plugins.endpoints.models import EndpointCommand
+
+    _enable_policies(db)
+    assetid = _endpoint(db, 'refusedbox')
+    _deny_everything(db, assetid)
+    headers = _user(db, client, 'refusedadmin',
+                    ['endpoints.view', 'endpoints.command'], admin=True)
+
+    missing_target = client.post(_url(assetid), headers=headers,
+                                 json={'action': 'service_status',
+                                       'policyoverride': True,
+                                       'overridereason': 'no target given'})
+    assert missing_target.status_code == 400, missing_target.get_json()
+
+    db.session.add(EndpointCommand(assetid=assetid, action='collect_now',
+                                   status=EndpointCommand.STATUS_PENDING))
+    db.session.commit()
+    in_flight = client.post(_url(assetid), headers=headers,
+                            json={'action': 'service_status',
+                                  'target': 'spooler',
+                                  'policyoverride': True,
+                                  'overridereason': 'queue is busy'})
+    assert in_flight.status_code == 409, in_flight.get_json()
+
+    db.session.expire_all()
+    assert AuditLog.query.filter_by(action='policyoverridden').count() == 0
+    assert PolicyActionHold.query.filter_by(assetid=assetid).count() == 0
+
+
 def test_override_is_checked_after_the_elevated_permission_gate(client, db):
     """The override widens WHERE an action may run, never WHICH actions the
     caller may use.

tests/test_plugins/test_endpoints_server_certificate.py

@@ -0,0 +1,157 @@
+"""Server TLS certificate upload and generate routes.
+
+The new pair must be parsed, and the key proven to match the certificate,
+BEFORE the existing files are backed up or replaced: a bad upload must leave
+nginx's current certificate exactly where it was. cn and san must be plain
+hostname/IP syntax; anything else (newlines, '=', brackets) is refused.
+"""
+
+import io
+from datetime import datetime, timedelta, timezone
+
+import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.x509.oid import NameOID
+
+from plugins.endpoints.api import routes as endpoint_routes
+
+UPLOAD_URL = '/api/endpoints/settings/server-cert/upload'
+GENERATE_URL = '/api/endpoints/settings/server-cert/generate'
+
+
+@pytest.fixture(autouse=True)
+def cert_dir(tmp_path, monkeypatch):
+    directory = tmp_path / 'certs'
+    directory.mkdir()
+    monkeypatch.setattr(endpoint_routes, '_server_cert_dir', lambda: directory)
+    monkeypatch.setattr(endpoint_routes, '_restart_nginx', lambda: None)
+    return directory
+
+
+def _pair(cn='old.example.test'):
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])
+    now = datetime.now(timezone.utc)
+    certificate = (x509.CertificateBuilder()
+                   .subject_name(name).issuer_name(name)
+                   .public_key(key.public_key())
+                   .serial_number(x509.random_serial_number())
+                   .not_valid_before(now - timedelta(days=1))
+                   .not_valid_after(now + timedelta(days=30))
+                   .sign(key, hashes.SHA256()))
+    cert_pem = certificate.public_bytes(serialization.Encoding.PEM)
+    key_pem = key.private_bytes(serialization.Encoding.PEM,
+                                serialization.PrivateFormat.PKCS8,
+                                serialization.NoEncryption())
+    return cert_pem, key_pem
+
+
+def _seed_existing(cert_dir):
+    cert_pem, key_pem = _pair('existing.example.test')
+    (cert_dir / 'server.crt').write_bytes(cert_pem)
+    (cert_dir / 'server.key').write_bytes(key_pem)
+    return cert_pem, key_pem
+
+
+def _upload(client, headers, cert_bytes, key_bytes):
+    return client.post(UPLOAD_URL, headers=headers,
+                       content_type='multipart/form-data',
+                       data={'cert': (io.BytesIO(cert_bytes), 'server.crt'),
+                             'key': (io.BytesIO(key_bytes), 'server.key')})
+
+
+def test_a_matching_pair_replaces_and_backs_up(client, db, auth_headers, cert_dir):
+    from shopdb.api import AuditLog
+
+    old_cert, old_key = _seed_existing(cert_dir)
+    new_cert, new_key = _pair('new.example.test')
+
+    response = _upload(client, auth_headers, new_cert, new_key)
+
+    assert response.status_code == 200, response.get_json()
+    assert (cert_dir / 'server.crt').read_bytes() == new_cert
+    assert (cert_dir / 'server.key').read_bytes() == new_key
+    backups = sorted(p.name for p in cert_dir.iterdir() if '.backup.' in p.name)
+    assert len(backups) == 2
+    assert not [p for p in cert_dir.iterdir() if p.name.endswith('.tmp')]
+    assert AuditLog.query.filter_by(
+        action='endpoints.server_cert.uploaded').count() == 1
+
+
+def test_a_mismatched_key_touches_nothing(client, db, auth_headers, cert_dir):
+    old_cert, old_key = _seed_existing(cert_dir)
+    new_cert, _new_key = _pair('new.example.test')
+    _other_cert, other_key = _pair('other.example.test')
+
+    response = _upload(client, auth_headers, new_cert, other_key)
+
+    assert response.status_code == 400
+    assert 'does not match' in response.get_json()['data']['error']['message']
+    assert (cert_dir / 'server.crt').read_bytes() == old_cert
+    assert (cert_dir / 'server.key').read_bytes() == old_key
+    assert sorted(p.name for p in cert_dir.iterdir()) == ['server.crt', 'server.key']
+
+
+def test_garbage_certificate_touches_nothing(client, db, auth_headers, cert_dir):
+    old_cert, _old_key = _seed_existing(cert_dir)
+    _cert, key = _pair()
+    garbage = b'-----BEGIN CERTIFICATE-----\nnope\n-----END CERTIFICATE-----\n'
+
+    response = _upload(client, auth_headers, garbage, key)
+
+    assert response.status_code == 400
+    assert (cert_dir / 'server.crt').read_bytes() == old_cert
+    assert len(list(cert_dir.iterdir())) == 2
+
+
+@pytest.mark.parametrize('cn', [
+    'host\nprompt = yes',
+    'bad host',
+    'a=b',
+    '[alt_names]',
+    'a' * 65,
+])
+def test_generate_refuses_unsafe_cn(client, db, auth_headers, cert_dir, cn):
+    _seed_existing(cert_dir)
+    response = client.post(GENERATE_URL, headers=auth_headers,
+                           json={'cn': cn, 'days': 30})
+    assert response.status_code == 400
+    assert len(list(cert_dir.iterdir())) == 2
+
+
+@pytest.mark.parametrize('san', [
+    'DNS:ok.example.test,DNS:bad\nname',
+    'IP:999.1.1.1',
+    'URI:http://x',
+    'DNS:a b',
+])
+def test_generate_refuses_unsafe_san(client, db, auth_headers, cert_dir, san):
+    _seed_existing(cert_dir)
+    response = client.post(GENERATE_URL, headers=auth_headers,
+                           json={'cn': 'ok.example.test', 'san': san,
+                                 'days': 30})
+    assert response.status_code == 400
+    assert len(list(cert_dir.iterdir())) == 2
+
+
+def test_generate_installs_a_valid_pair(client, db, auth_headers, cert_dir):
+    from shopdb.api import AuditLog
+
+    _seed_existing(cert_dir)
+    response = client.post(GENERATE_URL, headers=auth_headers,
+                           json={'cn': 'shopdb.example.test',
+                                 'san': 'DNS:shopdb.example.test,IP:10.0.0.5',
+                                 'days': 30})
+
+    assert response.status_code == 200, response.get_json()
+    certificate = x509.load_pem_x509_certificate(
+        (cert_dir / 'server.crt').read_bytes())
+    assert certificate.subject.get_attributes_for_oid(
+        NameOID.COMMON_NAME)[0].value == 'shopdb.example.test'
+    assert endpoint_routes._validate_certificate_pair(
+        (cert_dir / 'server.crt').read_bytes(),
+        (cert_dir / 'server.key').read_bytes()) is None
+    assert AuditLog.query.filter_by(
+        action='endpoints.server_cert.generated').count() == 1

tests/test_plugins/test_notifications_fleet_alert_fields.py

@@ -0,0 +1,101 @@
+"""Fleet alert fields on notification create/update.
+
+alertfleet and alerttimeout are NOT NULL in migration 0006, so a null from the
+form is coerced to the column default rather than reaching the database.
+alertscope must be an object whose keys the endpoint matcher understands; a
+typo or a non-object is refused at the API instead of being stored and
+silently re-interpreted at delivery time.
+"""
+
+from plugins.notifications.models import Notification, NotificationType
+
+
+def _type(db):
+    ntype = NotificationType(typename='Fleet Alert', typecolor='#d93f3f',
+                             isactive=True)
+    db.session.add(ntype)
+    db.session.commit()
+    return ntype.notificationtypeid
+
+
+def _create(client, headers, typeid, **fields):
+    body = {'notification': 'Line 3 is down', 'notificationtypeid': typeid}
+    body.update(fields)
+    return client.post('/api/notifications', json=body, headers=headers)
+
+
+def test_null_timeout_and_fleet_are_coerced_to_defaults(client, db, auth_headers):
+    typeid = _type(db)
+    resp = _create(client, auth_headers, typeid, alertfleet=None,
+                   alerttimeout=None, alertscope=None)
+    assert resp.status_code == 201, resp.get_json()
+    row = db.session.get(Notification, resp.get_json()['data']['notificationid'])
+    assert row.alertfleet is False
+    assert row.alerttimeout == 0
+    assert row.alertscope is None
+
+
+def test_update_coerces_null_timeout(client, db, auth_headers):
+    typeid = _type(db)
+    created = _create(client, auth_headers, typeid, alertfleet=True,
+                      alerttimeout=60).get_json()['data']
+    resp = client.put(f"/api/notifications/{created['notificationid']}",
+                      json={'alerttimeout': None, 'alertfleet': None},
+                      headers=auth_headers)
+    assert resp.status_code == 200, resp.get_json()
+    row = db.session.get(Notification, created['notificationid'])
+    assert row.alerttimeout == 0
+    assert row.alertfleet is False
+
+
+def test_a_valid_scope_is_stored(client, db, auth_headers):
+    typeid = _type(db)
+    resp = _create(client, auth_headers, typeid, alertfleet=True,
+                   alertscope={'hostname': ['BAY-01', 'BAY-02'],
+                               'computertype': 'CMM PC'})
+    assert resp.status_code == 201, resp.get_json()
+    assert resp.get_json()['data']['alertscope']['computertype'] == 'CMM PC'
+
+
+def test_an_empty_scope_means_whole_fleet(client, db, auth_headers):
+    typeid = _type(db)
+    resp = _create(client, auth_headers, typeid, alertfleet=True, alertscope='')
+    assert resp.status_code == 201, resp.get_json()
+    assert resp.get_json()['data']['alertscope'] is None
+
+
+def test_unknown_scope_key_is_refused(client, db, auth_headers):
+    typeid = _type(db)
+    resp = _create(client, auth_headers, typeid, alertfleet=True,
+                   alertscope={'hostnam': 'BAY-01'})
+    assert resp.status_code == 400
+    assert 'hostnam' in resp.get_json()['data']['error']['message']
+    assert Notification.query.count() == 0
+
+
+def test_non_object_scope_is_refused(client, db, auth_headers):
+    typeid = _type(db)
+    for scope in (['BAY-01'], 'BAY-01', '{not json', 5):
+        resp = _create(client, auth_headers, typeid, alertfleet=True,
+                       alertscope=scope)
+        assert resp.status_code == 400, scope
+    assert Notification.query.count() == 0
+
+
+def test_update_refuses_bad_scope_and_keeps_the_old_one(client, db, auth_headers):
+    typeid = _type(db)
+    created = _create(client, auth_headers, typeid, alertfleet=True,
+                      alertscope={'hostname': 'BAY-01'}).get_json()['data']
+    resp = client.put(f"/api/notifications/{created['notificationid']}",
+                      json={'alertscope': {'building': 'X'}},
+                      headers=auth_headers)
+    assert resp.status_code == 400
+    db.session.expire_all()
+    row = db.session.get(Notification, created['notificationid'])
+    assert row.alertscope == {'hostname': 'BAY-01'}
+
+
+def test_bad_timeout_is_refused(client, db, auth_headers):
+    typeid = _type(db)
+    assert _create(client, auth_headers, typeid, alerttimeout=-1).status_code == 400
+    assert _create(client, auth_headers, typeid, alerttimeout='soon').status_code == 400