[fix] Addressed review comments

- Replaced the assert authorizing websocket connections with an explicit
  conditional, which python -O cannot strip
- Rechecked permissions and organization scope on every websocket request
  and pushed update, closing the socket when access was revoked
- Accepted binary frames in BatchCommandConsumer.receive() and ignored them
- Revalidated batch ownership when creating child commands and before
  executing each one, skipping devices transferred to another organization
- Made the batch status write conditional on the status the calculation
  started from, so a stale result cannot overwrite a newer one
- Evaluated the confirm page device ids once, so the reviewed set and the
  executed set cannot diverge
- Rotated the wizard token when the target set changes, dropping the
  exclusions of the previous set
- Sent the active filters with the reconnect request, applied them before
  pagination and reconciled the table against the filtered snapshot
- Moved the batch command signal receivers to connection/handlers.py
- Moved skipped device counting, filtering and row building to the model
- Broadcast canonical status and ISO timestamps, rendering them in the
  browser like the single command page does
- Derived the device admin URLs from the swapped model
- Restored the wizard when the confirm page Back link is used
- Returned the union of the schemas available to superusers
- Made the password masking of the input summary case insensitive
- Restored the punctuation of the command validation messages
- Pluralized the device count of the confirm page
- Documented mass commands as asynchronous with a concurrency which
  depends on the celery workers
- Removed the leftovers of the dropped Django 4.2 support

Author: dee077

docs/user/shell-commands.rst

@@ -241,9 +241,11 @@ superusers).
 
 .. note::
 
-    Commands are executed in the background, one device at a time, so a
-    mass command sent to many devices keeps updating for a while after the
-    page is opened.
+    Commands are executed asynchronously in the background: each device is
+    handled by an independent background task, so how many devices are
+    contacted at the same time depends on the concurrency of the Celery
+    workers. A mass command sent to many devices keeps updating for a
+    while after the page is opened.
 
 Finding Past Mass Commands
 ~~~~~~~~~~~~~~~~~~~~~~~~~~

docs/user/websocket-api.rst

@@ -204,14 +204,24 @@ When the mass command itself changes, for example when it moves from
         "type": "batch_status",
         "id": "<uuid>",                  // Mass command identifier
         "label": "<string>",             // Label given when it was sent
+        "notes": "<string>",             // Notes given when it was sent
+        "input": { /* ... */ },          // Command input, masked for "change_password"
+        "organization": "<uuid>",        // Organization, null when system wide
+        "group": "<uuid>",               // Device group target, null when not used
+        "location": "<uuid>",            // Location target, null when not used
         "status": "<string>",            // "idle", "in-progress", "success" or "failed"
-        "status_display": "<string>",    // Status as shown in the user interface
+        "created": "<string>",           // ISO 8601 timestamp
+        "modified": "<string>",          // ISO 8601 timestamp
         "affected_devices": <integer>,   // Number of devices the command runs on
         "skipped_count": <integer>,      // Number of devices which were skipped
         "skipped_preview": [ /* ... */], // First and last skipped devices, with the reason
         "total_rows": <integer>          // Affected plus skipped devices
     }
 
+The status and the timestamps are sent as they are stored, without
+translation or formatting, so that each client can render them with its
+own language and time zone.
+
 When the command of one device changes:
 
 .. code-block:: javascript
@@ -221,11 +231,14 @@ When the command of one device changes:
         "id": "<uuid>",                  // Command identifier
         "device": "<uuid>",              // Device identifier
         "device_name": "<string>",       // Device name
+        "connection": "<uuid>",          // Device connection used, may be null
+        "batch_command": "<uuid>",       // Mass command this command belongs to
         "status": "<string>",            // "in-progress", "success" or "failed"
-        "status_display": "<string>",    // Status as shown in the user interface
         "output": "<string>",            // Output collected so far
-        "modified": "<string>",          // Last modification, formatted for display
+        "created": "<string>",           // ISO 8601 timestamp
+        "modified": "<string>",          // ISO 8601 timestamp
         "index": <integer>,              // Position of the row, sent only for new commands
+        "affected_devices": <integer>,   // Commands created so far, sent with "index"
         "total_rows": <integer>          // Affected plus skipped devices, sent with "index"
     }
 
@@ -239,16 +252,34 @@ for the results it missed:
 
     {
         "type": "request_current_state",
-        "page": 1                        // Page of results, 20 rows per page
+        "page": 1,                       // Page of results, 20 rows per page
+        "filters": {                     // Optional, the filters the page is showing
+            "q": "<string>",             // Search term matched against the device name
+            "status": "<string>",        // Command status, or "skipped"
+            "location_id": "<uuid>",     // Location of the device
+            "group_id": "<uuid>",        // Device group
+            "organization_id": "<uuid>"  // Organization of the device
+        }
     }
 
+Every filter is optional and an empty string means the filter is not
+active. The filters are applied before the results are paginated, so a
+client which is showing a filtered table receives the same rows it would
+get by reloading the page.
+
 The server replies with one message holding that page:
 
 .. code-block:: javascript
 
     {
         "type": "batch_state",
-        "batch_status": { /* ... */ },   // Same fields as the "batch_status" message
-        "commands": [ /* ... */ ],       // Rows of the requested page
-        "total_rows": <integer>          // Affected plus skipped devices
+        "batch_status": { /* ... */ },   // Fields of the "batch_status" message,
+                                         // except "type" and "total_rows"
+        "commands": [ /* ... */ ],       // Rows of the requested page, in the shape
+                                         // of the "command_update" message
+        "total_rows": <integer>          // Rows matching the filters, for the paginator
     }
+
+Rows of devices which were skipped are included in ``commands`` with
+``is_skipped`` set to ``true``, a ``status`` of ``skipped`` and the reason
+in ``output``.

openwisp_controller/config/base/channels_consumer.py

@@ -10,7 +10,8 @@ class BaseDeviceConsumer(WebsocketConsumer):
     channel_layer_group = "config.device"
 
     def _is_user_authenticated(self):
-        return self.scope["user"].is_authenticated is True
+        user = self.scope.get("user")
+        return user is not None and user.is_authenticated
 
     def is_user_authorized(self):
         user = self.scope["user"]
@@ -32,16 +33,18 @@ def _user_has_permissions(self, add=True, change=True, delete=True):
         return self.scope["user"].has_perms(permissions)
 
     def connect(self):
+        if not self._is_user_authenticated() or not self.is_user_authorized():
+            self.close()
+            return
         try:
-            assert self._is_user_authenticated() and self.is_user_authorized()
             self.pk_ = self.scope["url_route"]["kwargs"]["pk"]
-        except (AssertionError, KeyError):
+        except KeyError:
             self.close()
-        else:
-            async_to_sync(self.channel_layer.group_add)(
-                f"{self.channel_layer_group}-{self.pk_}", self.channel_name
-            )
-            self.accept()
+            return
+        async_to_sync(self.channel_layer.group_add)(
+            f"{self.channel_layer_group}-{self.pk_}", self.channel_name
+        )
+        self.accept()
 
     def disconnect(self, close_code):
         try: