[fix] Add group-scoped view cache invalidation for device group context change openwisp#1070

When device group context variables are updated,
bulk_invalidate_config_get_cached_checksum was already called to mark
affected configs as modified, but invalidate_controller_views_cache was
never called, leaving the DeviceChecksumView cache stale for devices in
the group.

Replace the org-wide invalidate_controller_views_cache with a new
group-scoped task, invalidate_controller_views_for_group, that only
clears DeviceChecksumView entries for devices in the changed group,
avoiding unnecessary invalidation of unrelated devices and VPNs.

Author: mn-ram

.github/workflows/bot-ci-failure.yml

@@ -7,7 +7,7 @@ on:
       - completed
 
 permissions:
-  pull-requests: write
+  pull-requests: read
   actions: read
   contents: read
 
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   find-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
     outputs:
       pr_number: ${{ steps.pr.outputs.number }}
       pr_author: ${{ steps.pr.outputs.author }}
@@ -35,9 +35,8 @@ jobs:
             local pr_number="$1"
             local pr_author
             pr_author=$(gh pr view "$pr_number" --repo "$REPO" --json author --jq '.author.login // empty' 2>/dev/null || echo "")
-            if [ -z "$pr_author" ]; then
-              pr_author="${{ github.event.workflow_run.actor.login }}"
-              echo "::warning::Could not fetch PR author for PR #$pr_number; falling back to @$pr_author"
+            if [ -z "$pr_author" ] || [ "$pr_author" = "null" ]; then
+              echo "::warning::Could not fetch PR author for PR #$pr_number"
             fi 
             echo "number=$pr_number" >> "$GITHUB_OUTPUT"
             echo "author=$pr_author" >> "$GITHUB_OUTPUT"
@@ -69,6 +68,10 @@ jobs:
   call-ci-failure-bot:
     needs: find-pr
     if: ${{ needs.find-pr.outputs.pr_number != '' }}
+    permissions:
+      pull-requests: write
+      actions: write
+      contents: read
     uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-ci-failure.yml@master
     with:
       pr_number: ${{ needs.find-pr.outputs.pr_number }}

openwisp_controller/config/base/device_group.py

@@ -15,7 +15,10 @@
 from .. import settings as app_settings
 from ..signals import group_templates_changed
 from ..sortedm2m.fields import SortedManyToManyField
-from ..tasks import bulk_invalidate_config_get_cached_checksum
+from ..tasks import (
+    bulk_invalidate_config_get_cached_checksum,
+    invalidate_controller_views_for_group,
+)
 from .config import TemplatesThrough
 
 
@@ -88,6 +91,7 @@ def save(
             bulk_invalidate_config_get_cached_checksum.delay(
                 {"device__group_id": str(self.id)}
             )
+            invalidate_controller_views_for_group.delay(str(self.id))
 
     def get_context(self):
         return deepcopy(self.context)

openwisp_controller/config/tasks.py

@@ -217,3 +217,21 @@ def invalidate_controller_views_cache(organization_id):
         Vpn.objects.filter(organization_id=organization_id).only("id").iterator()
     ):
         GetVpnView.invalidate_get_vpn_cache(vpn)
+
+
+@shared_task(base=OpenwispCeleryTask)
+def invalidate_controller_views_for_group(group_id):
+    """
+    Invalidates the DeviceChecksumView cache only for devices in the given group.
+
+    Unlike invalidate_controller_views_cache, this is scoped to a single device
+    group and does not invalidate VPN caches.
+    """
+    from .controller.views import DeviceChecksumView
+
+    Device = load_model("config", "Device")
+
+    for device in (
+        Device.objects.filter(group_id=group_id).only("id").iterator()
+    ):
+        DeviceChecksumView.invalidate_get_device_cache(device)

openwisp_controller/config/tests/test_device.py

@@ -440,8 +440,8 @@ def test_status_update_on_org_variable_change(self):
         c1.templates.add(
             self._create_template(
                 name="t-with-var",
-                config={"interfaces": [{"name": "eth0", "type": "{{ ssid }}"}]},
-                default_values={"ssid": "default"},
+                config={"interfaces": [{"name": "{{ ssid }}", "type": "ethernet"}]},
+                default_values={"ssid": "eth0"},
             )
         )
         c1.set_status_applied()
@@ -468,8 +468,8 @@ def test_status_update_on_group_variable_change(self):
         c1.templates.add(
             self._create_template(
                 name="t-with-var",
-                config={"interfaces": [{"name": "eth0", "type": "{{ ssid }}"}]},
-                default_values={"ssid": "default"},
+                config={"interfaces": [{"name": "{{ ssid }}", "type": "ethernet"}]},
+                default_values={"ssid": "eth0"},
             )
         )
         c1.set_status_applied()
@@ -480,7 +480,13 @@ def test_status_update_on_group_variable_change(self):
         c2.set_status_applied()
         dg.context = {"ssid": "OrgA"}
         dg.full_clean()
-        dg.save()
+        patch_path = (
+            "openwisp_controller.config.base.device_group"
+            ".invalidate_controller_views_for_group"
+        )
+        with mock.patch(patch_path) as mocked_task:
+            dg.save()
+            mocked_task.delay.assert_called_once_with(str(dg.id))
         c1.refresh_from_db()
         c2.refresh_from_db()
         with self.subTest("affected config changes to modified"):