[tests] Strengthen regression tests and add API coverage for openwisp#1221

- Upgrade assert_called() to assert_called_once() in both VpnClient
  post_delete tests for stricter signal-call verification
- Add API regression test: PATCH device replacing a VPN template with
  a generic one must trigger VpnClient.post_delete, invalidate the
  peer cache, and revoke the auto-created certificate (covers the
  serializers.py code path)

Related to openwisp#1221
Co-Authored-By: mn-ram <mn-ram@users.noreply.github.com>

Author: mn-ram

openwisp_controller/config/tests/test_api.py

@@ -26,6 +26,7 @@
 Template = load_model("config", "Template")
 Vpn = load_model("config", "Vpn")
 VpnClient = load_model("config", "VpnClient")
+Cert = load_model("django_x509", "Cert")
 Device = load_model("config", "Device")
 Config = load_model("config", "Config")
 DeviceGroup = load_model("config", "DeviceGroup")
@@ -518,6 +519,33 @@ def test_device_patch_with_templates_of_different_org(self):
             f" do not match the organization of this configuration: {t3}",
         )
 
+    def test_device_patch_vpn_template_removal_triggers_post_delete(self):
+        """Regression test for #1221: replacing a VPN template with a generic
+        one via PATCH API must trigger VpnClient.post_delete so peer cache is
+        invalidated and the certificate is revoked."""
+        org = self._get_org()
+        vpn = self._create_vpn(organization=org)
+        t_vpn = self._create_template(
+            name="vpn-test", type="vpn", vpn=vpn, auto_cert=True, organization=org
+        )
+        t_generic = self._create_template(name="generic-test", organization=org)
+        device = self._create_device(organization=org)
+        config = self._create_config(device=device)
+        config.templates.add(t_vpn)
+        vpnclient = config.vpnclient_set.first()
+        self.assertIsNotNone(vpnclient)
+        cert_pk = vpnclient.cert.pk
+
+        path = reverse("config_api:device_detail", args=[device.pk])
+        # PATCH replacing VPN template with a generic template
+        data = {"config": {"templates": [str(t_generic.pk)]}}
+        with patch.object(Vpn, "_invalidate_peer_cache") as mock_invalidate:
+            response = self.client.patch(path, data, content_type="application/json")
+            mock_invalidate.assert_called_once()
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(VpnClient.objects.filter(pk=vpnclient.pk).exists())
+        self.assertTrue(Cert.objects.get(pk=cert_pk).revoked)
+
     def test_device_change_organization_required_templates(self):
         org1 = self._create_org(name="org1")
         org2 = self._create_org(name="org2")

openwisp_controller/config/tests/test_vpn.py

@@ -300,7 +300,7 @@ def test_vpn_client_post_delete_on_template_removal(self):
         cert_pk = vpnclient.cert.pk
         with mock.patch.object(Vpn, "_invalidate_peer_cache") as mock_invalidate:
             c.templates.remove(t)
-            mock_invalidate.assert_called()
+            mock_invalidate.assert_called_once()
         self.assertFalse(VpnClient.objects.filter(pk=vpnclient.pk).exists())
         # Certificate should be revoked (auto_cert=True)
         self.assertTrue(Cert.objects.get(pk=cert_pk).revoked)
@@ -320,7 +320,7 @@ def test_vpn_client_post_delete_on_device_deactivation(self):
         cert_pk = vpnclient.cert.pk
         with mock.patch.object(Vpn, "_invalidate_peer_cache") as mock_invalidate:
             d.deactivate()
-            mock_invalidate.assert_called()
+            mock_invalidate.assert_called_once()
         self.assertFalse(VpnClient.objects.filter(pk=vpnclient.pk).exists())
         # Certificate should be revoked (auto_cert=True)
         self.assertTrue(Cert.objects.get(pk=cert_pk).revoked)