[fix] Swap m2m_changed signal connections for correct VPN client handling

Ensure that VPN clients are created or removed before
`templates_changed` is triggered. The VpnClient context can
affect the configuration checksum, so swapping the signal
connections preserves the correct order of operations.

Also added tests to verify that configuration checksums
correctly account for VPN client templates.

Author: pandafy

openwisp_controller/config/apps.py

@@ -78,15 +78,18 @@ def connect_signals(self):
             sender=self.config_model.templates.through,
             dispatch_uid="config.clean_templates",
         )
+        # VPN clients must be created or removed **before**
+        # self.config_model.templates_changed is evaluated, because
+        # the VpnClient context can influence the configuration checksum.
         m2m_changed.connect(
-            self.config_model.templates_changed,
+            self.config_model.manage_vpn_clients,
             sender=self.config_model.templates.through,
-            dispatch_uid="config.templates_changed",
+            dispatch_uid="config.manage_vpn_clients",
         )
         m2m_changed.connect(
-            self.config_model.manage_vpn_clients,
+            self.config_model.templates_changed,
             sender=self.config_model.templates.through,
-            dispatch_uid="config.manage_vpn_clients",
+            dispatch_uid="config.templates_changed",
         )
         # the order of the following connect() call must be maintained
         m2m_changed.connect(

openwisp_controller/config/tests/test_config.py

@@ -13,7 +13,12 @@
 from .. import settings as app_settings
 from ..base.base import logger as base_config_logger
 from ..signals import config_backend_changed, config_modified, config_status_changed
-from .utils import CreateConfigTemplateMixin, CreateDeviceGroupMixin, TestVpnX509Mixin
+from .utils import (
+    CreateConfigTemplateMixin,
+    CreateDeviceGroupMixin,
+    TestVpnX509Mixin,
+    TestWireguardVpnMixin,
+)
 
 Config = load_model("config", "Config")
 Device = load_model("config", "Device")
@@ -906,6 +911,7 @@ def test_config_backend_changed(self):
 class TestTransactionConfig(
     CreateConfigTemplateMixin,
     TestVpnX509Mixin,
+    TestWireguardVpnMixin,
     TransactionTestCase,
 ):
     def test_multiple_vpn_client_templates_same_vpn(self):
@@ -983,3 +989,14 @@ def test_certificate_renew_invalidates_checksum_cache(self):
             self.assertNotEqual(config.get_cached_checksum(), old_checksum)
             config.refresh_from_db()
             self.assertEqual(config.status, "modified")
+
+    def test_checksum_db_accounts_for_vpnclient(self):
+        vpn = self._create_wireguard_vpn()
+        vpn_template = self._create_template(
+            name="vpn1-template", type="vpn", vpn=vpn, config={}
+        )
+        config = self._create_config(organization=self._get_org())
+        config.templates.add(vpn_template)
+        config.refresh_from_db()
+        config._invalidate_backend_instance_cache()
+        self.assertEqual(config.checksum, config.checksum_db)