[tests] Fix deactivation test to exercise correct code path openwisp#1221

test_deactivation_fires_post_delete_signals was calling
device.config.templates.clear() directly without first setting the
config status to deactivating. This meant the per-instance delete
path guarded by is_deactivating_or_deactivated() in manage_vpn_clients
was never exercised, defeating the purpose of the regression test.

Replace templates.clear() with device.deactivate() which sets the
status to deactivating before clearing templates. Also replace
global IP count checks with object-level assertions, remove the
unused cert variable (F841), and replace the misleading
"certificate revoked for OpenVPN-style auto_cert" subTest with a
WireGuard-appropriate post_delete handler check.

Related to openwisp#1221

Author: mn-ram

openwisp_controller/config/tests/test_vpn.py

@@ -883,51 +883,49 @@ def test_vpn_peers_changed(self):
     def test_template_removal_fires_post_delete_signals(self):
         """Regression test for #1221: removing a VPN template must trigger
         VpnClient.post_delete so that the peer cache is invalidated,
-        certificates are revoked, and IP addresses are released."""
+        and IP addresses are released."""
         device, vpn, template = self._create_wireguard_vpn_template()
         vpn_client = device.config.vpnclient_set.first()
         self.assertIsNotNone(vpn_client)
-        cert = vpn_client.cert
-        ip = vpn_client.ip
-        self.assertIsNotNone(ip)
-        initial_ip_count = IpAddress.objects.count()
+        vpn_client_pk = vpn_client.pk
+        ip_pk = vpn_client.ip.pk
 
         with self.subTest("peer cache invalidated on template removal"):
             with catch_signal(vpn_peers_changed) as handler:
                 device.config.templates.remove(template)
                 handler.assert_called_once()
 
         with self.subTest("VpnClient deleted"):
-            self.assertEqual(device.config.vpnclient_set.count(), 0)
+            self.assertFalse(VpnClient.objects.filter(pk=vpn_client_pk).exists())
 
         with self.subTest("IP address released"):
-            self.assertLess(IpAddress.objects.count(), initial_ip_count)
-
-        with self.subTest("certificate revoked for OpenVPN-style auto_cert"):
-            # For WireGuard there's no x509 cert to revoke, but the
-            # post_delete handler should still have run without error.
-            # The cert object should not exist anymore (CASCADE from VpnClient).
-            self.assertFalse(
-                VpnClient.objects.filter(pk=vpn_client.pk).exists()
-            )
+            self.assertFalse(IpAddress.objects.filter(pk=ip_pk).exists())
+
+        with self.subTest("post_delete handler ran without error"):
+            # WireGuard does not use x509 certs, so there is nothing to
+            # revoke. Verify the post_delete handler completed by checking
+            # that the peer cache was invalidated (signal was already
+            # asserted above) and no VpnClient remains.
+            self.assertEqual(device.config.vpnclient_set.count(), 0)
 
     def test_deactivation_fires_post_delete_signals(self):
         """Regression test for #1221: deactivating a device must trigger
         VpnClient.post_delete for each client (not bulk QuerySet.delete)."""
         device, vpn, template = self._create_wireguard_vpn_template()
-        self.assertEqual(device.config.vpnclient_set.count(), 1)
-        initial_ip_count = IpAddress.objects.count()
+        vpn_client = device.config.vpnclient_set.first()
+        self.assertIsNotNone(vpn_client)
+        ip_pk = vpn_client.ip.pk
 
         with catch_signal(vpn_peers_changed) as handler:
-            device.config.templates.clear()
-            # post_clear with deactivating state deletes vpn clients
-            # The signal should fire because per-instance delete is used
-            if device.config.vpnclient_set.count() == 0:
-                handler.assert_called()
+            device.deactivate()
+            handler.assert_called_once()
 
         # Verify cleanup happened
         self.assertEqual(device.config.vpnclient_set.count(), 0)
 
+        with self.subTest("IP address released"):
+            self.assertFalse(IpAddress.objects.filter(pk=ip_pk).exists())
+
 
 class TestVxlan(BaseTestVpn, TestVxlanWireguardVpnMixin, TestCase):
     def test_vxlan_config_creation(self):