From 94ae64a10c4ba89b8d0aea41cc361e471481688a Mon Sep 17 00:00:00 2001
From: dee077 <deepanshu.sahu27@gmail.com>
Date: Thu, 27 Aug 2026 05:02:55 +0530
Subject: [PATCH 1/3] [feature] Add mass command admin action to the device
 changelist #1347

- Execute mass command action on the device changelist
- Device selection carried in a hidden form field, not the session
- Organization prefilled and disabled when devices are selected
- Group and location hidden when devices are selected
- Selected device count shown as a message above the targets
- Mixed organization selections refused on both entry points

Fixes #1347
---
 openwisp_controller/connection/admin.py       | 158 +++++++++++++++---
 .../static/connection/css/batch-command.css   |   4 +
 .../static/connection/js/execute-command.js   |   7 +-
 .../batch_command/execute_command.html        |  14 +-
 4 files changed, 155 insertions(+), 28 deletions(-)

diff --git a/openwisp_controller/connection/admin.py b/openwisp_controller/connection/admin.py
index a39c4c9ac..b7b882360 100644
--- a/openwisp_controller/connection/admin.py
+++ b/openwisp_controller/connection/admin.py
@@ -11,7 +11,12 @@
 from django.core.exceptions import ObjectDoesNotExist, PermissionDenied, ValidationError
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
 from django.db.models import Count, Q
-from django.http import HttpResponseForbidden, HttpResponseNotAllowed, JsonResponse
+from django.http import (
+    HttpResponseForbidden,
+    HttpResponseNotAllowed,
+    HttpResponseRedirect,
+    JsonResponse,
+)
 from django.shortcuts import redirect
 from django.template.response import TemplateResponse
 from django.urls import path, resolve
@@ -19,6 +24,7 @@
 from django.utils.safestring import mark_safe
 from django.utils.timezone import localtime
 from django.utils.translation import gettext_lazy as _
+from django.utils.translation import ngettext
 
 from openwisp_users.multitenancy import MultitenantOrgFilter
 from openwisp_utils.admin import ReadOnlyAdmin, TimeReadonlyAdminMixin
@@ -61,6 +67,7 @@ class Meta:
 
 class BatchCommandExecutionForm(forms.ModelForm):
     required_css_class = "required"
+    devices = forms.CharField(widget=forms.HiddenInput, required=False)
 
     class Meta:
         model = BatchCommand
@@ -95,9 +102,15 @@ class Media:
             ]
         }
 
-    def __init__(self, *args, request=None, **kwargs):
+    def __init__(self, *args, request=None, device_ids=None, **kwargs):
         super().__init__(*args, **kwargs)
         self.request = request
+        self.device_ids = self._scope_devices(device_ids)
+        if self.device_ids:
+            self.fields["devices"].initial = ",".join(self.device_ids)
+            for field_name in ("organization", "group", "location"):
+                self.fields[field_name].disabled = True
+            self.fields["organization"].initial = self._selected_organization_id()
         if request is None or request.user.is_superuser:
             return
         organization_ids = request.user.organizations_managed
@@ -118,8 +131,39 @@ def __init__(self, *args, request=None, **kwargs):
         ]
         self.fields["type"].choices = empty_choices + list(allowed_commands.items())
 
+    def _scope_devices(self, device_ids):
+        self._organization_ids = set()
+        self._dropped_devices = False
+        if not device_ids:
+            return []
+        devices = Device.objects.filter(pk__in=device_ids)
+        if self.request is not None and not self.request.user.is_superuser:
+            devices = devices.filter(
+                organization_id__in=self.request.user.organizations_managed
+            )
+        rows = list(devices.values_list("pk", "organization_id"))
+        self._organization_ids = {row[1] for row in rows}
+        self._dropped_devices = len(rows) != len(set(device_ids))
+        return [str(row[0]) for row in rows]
+
+    def _selected_organization_id(self):
+        if len(self._organization_ids) != 1:
+            return None
+        return str(next(iter(self._organization_ids)))
+
     def clean(self):
         cleaned_data = super().clean()
+        if self._dropped_devices:
+            raise ValidationError(
+                _("Some of the selected devices are no longer available.")
+            )
+        if len(self._organization_ids) > 1:
+            raise ValidationError(
+                _(
+                    "All devices must belong to the same organization,"
+                    " unless it is a system wide command."
+                )
+            )
         if self.request is None or self.request.user.is_superuser:
             return cleaned_data
         organization = cleaned_data.get("organization")
@@ -127,7 +171,7 @@ def clean(self):
         location = cleaned_data.get("location")
         # a batch without any target would run on every device of the
         # deployment, which only superusers are allowed to do
-        if not any([organization, group, location]):
+        if not self.device_ids and not any([organization, group, location]):
             raise ValidationError(
                 _(
                     "Please select at least one of: organization, device group,"
@@ -174,6 +218,7 @@ def _pk(value):
             "organization_id": _pk(self.cleaned_data.get("organization")),
             "group_id": _pk(self.cleaned_data.get("group")),
             "location_id": _pk(self.cleaned_data.get("location")),
+            "device_ids": self.device_ids,
         }
 
 
@@ -527,7 +572,11 @@ def execute_command_view(self, request):
             return HttpResponseNotAllowed(["GET", "POST"])
         self._check_add_permission(request)
         if request.method == "POST":
-            form = BatchCommandExecutionForm(request.POST, request=request)
+            form = BatchCommandExecutionForm(
+                request.POST,
+                request=request,
+                device_ids=self._get_pk_list(request.POST, "devices"),
+            )
             if form.is_valid():
                 request.session[self.session_key] = form.to_session()
                 return redirect(
@@ -542,6 +591,9 @@ def execute_command_view(self, request):
             else:
                 request.session.pop(self.session_key, None)
                 form = BatchCommandExecutionForm(request=request)
+        return self._render_execute_page(request, form)
+
+    def _render_execute_page(self, request, form):
         context = {
             **self.admin_site.each_context(request),
             "title": _("Execute mass command"),
@@ -549,6 +601,7 @@ def execute_command_view(self, request):
             "form": form,
             "media": form.media,
             "has_view_permission": self.has_view_permission(request),
+            "device_count": len(form.device_ids),
         }
         return TemplateResponse(request, self.execute_command_template, context)
 
@@ -617,27 +670,31 @@ def _restart(self, request):
         return redirect(f"admin:{self.opts.app_label}_{self.opts.model_name}_execute")
 
     def _resolve_target_queryset(self, request, wizard):
-        """Devices matched by the organization, group and location chosen.
-        The targeting rule lives on the model so this page and the execution
-        cannot drift apart; the multitenancy scope and the ordering the
-        pagination needs are admin concerns, applied on top.
+        """Devices picked one by one, or matched by the organization, group
+        and location chosen. The targeting rule lives on the model so this
+        page and the execution cannot drift apart; the multitenancy scope and
+        the ordering the pagination needs are admin concerns, applied on top.
         """
-        try:
-            devices = BatchCommand.dry_run(
-                organization_id=wizard.get("organization_id"),
-                group_id=wizard.get("group_id"),
-                location_id=wizard.get("location_id"),
-            )["devices"]
-        except (ObjectDoesNotExist, ValidationError) as error:
-            logger.warning(
-                "Failed to resolve devices for mass command wizard"
-                " (organization_id=%s, group_id=%s, location_id=%s): %s",
-                wizard.get("organization_id"),
-                wizard.get("group_id"),
-                wizard.get("location_id"),
-                error,
-            )
-            return Device.objects.none()
+        device_ids = wizard.get("device_ids")
+        if device_ids:
+            devices = Device.objects.filter(pk__in=device_ids)
+        else:
+            try:
+                devices = BatchCommand.dry_run(
+                    organization_id=wizard.get("organization_id"),
+                    group_id=wizard.get("group_id"),
+                    location_id=wizard.get("location_id"),
+                )["devices"]
+            except (ObjectDoesNotExist, ValidationError) as error:
+                logger.warning(
+                    "Failed to resolve devices for mass command wizard"
+                    " (organization_id=%s, group_id=%s, location_id=%s): %s",
+                    wizard.get("organization_id"),
+                    wizard.get("group_id"),
+                    wizard.get("location_id"),
+                    error,
+                )
+                return Device.objects.none()
         if not request.user.is_superuser:
             devices = devices.filter(
                 organization_id__in=request.user.organizations_managed
@@ -652,6 +709,7 @@ def _devices_digest(self, device_ids):
         return hashlib.sha256(",".join(pks).encode()).hexdigest()
 
     def _confirm_context(self, request, wizard, devices):
+        device_count = devices.count()
         targets = []
         for model, key in (
             (Organization, "organization_id"),
@@ -672,11 +730,18 @@ def _confirm_context(self, request, wizard, devices):
             "wizard": wizard,
             "command_type_display": command_types.get(wizard["type"], wizard["type"]),
             "command_description": self._describe_input(wizard.get("input")),
-            "targets_display": ", ".join(targets) if targets else _("All devices"),
-            "device_count": devices.count(),
+            "targets_display": self._targets_display(wizard, targets, device_count),
+            "device_count": device_count,
             "has_view_permission": self.has_view_permission(request),
         }
 
+    def _targets_display(self, wizard, targets, device_count):
+        if wizard.get("device_ids"):
+            return ngettext(
+                "%(count)d selected device", "%(count)d selected devices", device_count
+            ) % {"count": device_count}
+        return ", ".join(targets) if targets else _("All devices")
+
     def _describe_input(self, command_input):
         """Renders the submitted input for the review step, so that every
         registered command type is shown and not only custom ones.
@@ -1053,3 +1118,44 @@ def change_view(self, request, object_id, form_url="", extra_context=None):
 
 
 admin.site.register(BatchCommand, BatchCommandAdmin)
+
+
+@admin.action(
+    description=_("Execute mass command"),
+    permissions=["execute_mass_command"],
+)
+def execute_mass_command(modeladmin, request, queryset):
+    """Second entry point of the mass command workflow: the devices are
+    picked one by one instead of being matched by organization, group or
+    location. The selection travels in the form rather than in the session,
+    so it cannot outlive the wizard it belongs to.
+    """
+    # TODO: replace _registry with get_model_admin once Django 4.2 is dropped
+    batch_admin = modeladmin.admin_site._registry[BatchCommand]
+    batch_admin._check_add_permission(request)
+    organization_ids = set(queryset.values_list("organization_id", flat=True))
+    if len(organization_ids) > 1:
+        modeladmin.message_user(
+            request,
+            _(
+                "All devices must belong to the same organization,"
+                " unless it is a system wide command."
+            ),
+            messages.ERROR,
+        )
+        return HttpResponseRedirect(request.get_full_path())
+    form = BatchCommandExecutionForm(
+        request=request,
+        device_ids=[str(pk) for pk in queryset.values_list("pk", flat=True)],
+    )
+    return batch_admin._render_execute_page(request, form)
+
+
+def has_execute_mass_command_permission(self, request):
+    options = BatchCommand._meta
+    return request.user.has_perm(f"{options.app_label}.add_{options.model_name}")
+
+
+DeviceAdmin.execute_mass_command = execute_mass_command
+DeviceAdmin.has_execute_mass_command_permission = has_execute_mass_command_permission
+DeviceAdmin.actions += ["execute_mass_command"]
diff --git a/openwisp_controller/connection/static/connection/css/batch-command.css b/openwisp_controller/connection/static/connection/css/batch-command.css
index 288870bee..259a96b0f 100644
--- a/openwisp_controller/connection/static/connection/css/batch-command.css
+++ b/openwisp_controller/connection/static/connection/css/batch-command.css
@@ -306,6 +306,10 @@
 .execute-batch-command .form-row.field-input.errors .flex-container {
   display: none;
 }
+.execute-batch-command ul.selected-devices-message li {
+  padding: 15px 10px 15px 42px !important;
+  background-position: 15px 17px !important;
+}
 #main .form-row .ow-text-field {
   width: 320px;
 }
diff --git a/openwisp_controller/connection/static/connection/js/execute-command.js b/openwisp_controller/connection/static/connection/js/execute-command.js
index bc5863766..12ed0368e 100644
--- a/openwisp_controller/connection/static/connection/js/execute-command.js
+++ b/openwisp_controller/connection/static/connection/js/execute-command.js
@@ -98,7 +98,12 @@ function initCommandInput($, $typeSelect) {
 
 function initOrganizationScope($) {
   const $organization = $("#id_organization");
-  const fields = ["#id_group", "#id_location"];
+  const fields = ["#id_group", "#id_location"].filter(function (selector) {
+    return $(selector).length;
+  });
+  if (!fields.length) {
+    return;
+  }
   fields.forEach(function (selector) {
     $(selector).data("allOptions", $(selector).find("option").clone());
   });
diff --git a/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html b/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
index 3dae5f60d..34ffd3dd4 100644
--- a/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
+++ b/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
@@ -30,8 +30,10 @@
 
 {% block content %}
 <div id="content-main">
-  <form method="post" novalidate class="execute-form">
+  {# the action renders this page from the device changelist, so the target is explicit #}
+  <form method="post" novalidate action="{% url opts|admin_urlname:'execute' %}">
     {% csrf_token %}
+    {{ form.devices }}
     <nav class="stepper" aria-label="{% trans 'Execution progress' %}">
       <div class="stepper-step active" aria-current="step">
         <span class="stepper-badge">1</span>
@@ -64,11 +66,21 @@ <h2>{% trans "Command" %}</h2>
       {% include "admin/connection/batch_command/form_row.html" with field=form.notes %}
     </fieldset>
 
+    {% if device_count %}
+    <ul class="messagelist selected-devices-message">
+      <li class="warning">
+        {% blocktrans count counter=device_count %}The command will run on the device you selected.{% plural %}The command will run on the {{ counter }} devices you selected.{% endblocktrans %}
+      </li>
+    </ul>
+    {% endif %}
+
     <fieldset class="module aligned">
       <h2>{% trans "Targets" %}</h2>
       {% include "admin/connection/batch_command/form_row.html" with field=form.organization %}
+      {% if not device_count %}
       {% include "admin/connection/batch_command/form_row.html" with field=form.location %}
       {% include "admin/connection/batch_command/form_row.html" with field=form.group %}
+      {% endif %}
     </fieldset>
 
     <div class="submit-row">

From ea29717b36e958415fbad7fb2ebb52871eade0ff Mon Sep 17 00:00:00 2001
From: dee077 <deepanshu.sahu27@gmail.com>
Date: Fri, 28 Aug 2026 02:40:46 +0530
Subject: [PATCH 2/3] [feature] Add tests and docs and some fixes

---
 docs/user/shell-commands.rst                  |  18 +++
 .../connection/tests/test_admin.py            | 110 +++++++++++++++++-
 .../connection/tests/test_selenium.py         |  74 +++++++++++-
 openwisp_controller/connection/tests/utils.py |  14 +++
 4 files changed, 214 insertions(+), 2 deletions(-)

diff --git a/docs/user/shell-commands.rst b/docs/user/shell-commands.rst
index 7e57b298c..9c116e44c 100644
--- a/docs/user/shell-commands.rst
+++ b/docs/user/shell-commands.rst
@@ -214,6 +214,24 @@ devices of the system. Other users must choose at least one target, and
 only see the command types enabled for their organizations (see
 :ref:`openwisp_controller_organization_enabled_commands`).
 
+Sending a Mass Command to Selected Devices
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+A mass command can also be started from the device list: select the
+devices with their checkboxes, choose *Execute mass command* from the
+actions dropdown and click *Go*.
+
+The first step opens with the selection already applied: the devices it
+will run on are shown above the targets, and the organization is filled in
+and cannot be changed, while device group and location are not asked for,
+since the devices are already known.
+
+The selected devices must belong to the same organization, otherwise the
+action refuses to start.
+
+The rest of the workflow is the same as described below: the devices can
+still be reviewed and left out before executing.
+
 Reviewing the Devices
 ~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/openwisp_controller/connection/tests/test_admin.py b/openwisp_controller/connection/tests/test_admin.py
index 5c2e922a0..a81957aef 100644
--- a/openwisp_controller/connection/tests/test_admin.py
+++ b/openwisp_controller/connection/tests/test_admin.py
@@ -6,7 +6,7 @@
 from django.contrib.auth.models import Permission
 from django.core.exceptions import ValidationError
 from django.db import connection as db_connection
-from django.test import TestCase, override_settings
+from django.test import RequestFactory, TestCase, override_settings
 from django.test.utils import CaptureQueriesContext
 from django.urls import reverse
 from swapper import load_model
@@ -300,12 +300,16 @@ def test_notification_host_setting(self, ctx_processors=[]):
 
 class TestBatchCommandAdmin(BatchCommandMixin, TestCase):
     app_label = "connection"
+    config_app_label = "config"
 
     def setUp(self):
         self._create_admin()
         self.execute_url = reverse(f"admin:{self.app_label}_batchcommand_execute")
         self.confirm_url = reverse(f"admin:{self.app_label}_batchcommand_confirm")
         self.changelist_url = reverse(f"admin:{self.app_label}_batchcommand_changelist")
+        self.device_changelist_url = reverse(
+            f"admin:{self.config_app_label}_device_changelist"
+        )
 
     def test_wizard_permissions_and_tenant_isolation(self):
         org = self._get_org()
@@ -816,6 +820,110 @@ def test_wizard_device_selection(self):
             self.assertFalse(BatchCommand.objects.exists())
             self.assertIn(BatchCommandAdmin.session_key, self.client.session)
 
+    def test_device_action_selection(self):
+        org = self._get_org()
+        org2 = self._create_org(name="org2", slug="org2")
+        devices = [
+            self._create_device(
+                name=f"device{index}",
+                mac_address=f"00:11:22:33:44:0{index}",
+                organization=org,
+            )
+            for index in range(2)
+        ]
+        device_org2 = self._create_device(
+            name="device-org2", mac_address="00:11:22:33:44:09", organization=org2
+        )
+        self._login()
+        with self.subTest("the selection prefills the form"):
+            response = self._post_device_action(devices)
+            self.assertEqual(response.status_code, 200)
+            form = response.context["form"]
+            self.assertEqual(response.context["device_count"], 2)
+            self.assertEqual(
+                set(form.device_ids), {str(device.pk) for device in devices}
+            )
+            self.assertEqual(form.fields["devices"].initial, ",".join(form.device_ids))
+            self.assertEqual(form.fields["organization"].initial, str(org.pk))
+            for field_name in ("organization", "group", "location"):
+                self.assertTrue(form.fields[field_name].disabled)
+        with self.subTest("the selection is announced and the wider targets hidden"):
+            self.assertContains(
+                response, "The command will run on the 2 devices you selected."
+            )
+            self.assertContains(response, 'name="devices"')
+            self.assertNotContains(response, 'name="group"')
+            self.assertNotContains(response, 'name="location"')
+        with self.subTest("devices of different organizations are refused"):
+            response = self._post_device_action(devices + [device_org2])
+            self.assertRedirects(response, self.device_changelist_url)
+            self.assertIn(
+                "All devices must belong to the same organization",
+                " ".join(self._messages(response)),
+            )
+        with self.subTest("the selection travels to the review step"):
+            response = self._post_execute(devices=self._pk_list(devices))
+            self.assertEqual(response.status_code, 302)
+            wizard = self.client.session[BatchCommandAdmin.session_key]
+            self.assertEqual(
+                set(wizard["device_ids"]), {str(device.pk) for device in devices}
+            )
+            response = self.client.get(self.confirm_url)
+            self.assertEqual(response.context["device_count"], 2)
+            self.assertEqual(response.context["targets_display"], "2 selected devices")
+            self.assertEqual(set(response.context["cl"].queryset), set(devices))
+        with self.subTest("only the selected devices are executed"):
+            self._post_confirm(wizard["token"])
+            batch = BatchCommand.objects.get()
+            self.assertEqual(set(batch.devices.all()), set(devices))
+
+    def test_device_action_permissions_and_scope(self):
+        org = self._get_org()
+        org2 = self._create_org(name="org2", slug="org2")
+        device = self._create_device(organization=org)
+        device2 = self._create_device(
+            name="device2", mac_address="00:11:22:33:44:02", organization=org2
+        )
+        device_admin = admin.site._registry[Device]
+        request = RequestFactory().get(self.device_changelist_url)
+        with self.subTest("the add permission is required"):
+            viewer = self._create_operator(
+                organizations=[org], username="viewer", email="viewer@test.com"
+            )
+            viewer.groups.clear()
+            viewer.user_permissions.set(
+                Permission.objects.filter(codename="view_batchcommand")
+            )
+            request.user = viewer
+            self.assertFalse(device_admin.has_execute_mass_command_permission(request))
+            self.assertNotIn("execute_mass_command", device_admin.get_actions(request))
+        with self.subTest("the operator group can use the action"):
+            operator = self._create_operator(organizations=[org])
+            request.user = operator
+            self.assertTrue(device_admin.has_execute_mass_command_permission(request))
+            self.assertIn("execute_mass_command", device_admin.get_actions(request))
+        with self.subTest("devices of unmanaged organizations are dropped"):
+            self.client.force_login(operator)
+            response = self._post_execute(devices=self._pk_list([device, device2]))
+            form = response.context["form"]
+            self.assertEqual(form.device_ids, [str(device.pk)])
+            self.assertIn(
+                "Some of the selected devices are no longer available.",
+                form.errors["__all__"],
+            )
+        with self.subTest("devices which disappeared are dropped"):
+            self._login()
+            response = self._post_execute(devices=f"{device.pk},{uuid4()}")
+            self.assertEqual(response.context["form"].device_ids, [str(device.pk)])
+        with self.subTest("mixed organizations are refused by the form"):
+            response = self._post_execute(devices=self._pk_list([device, device2]))
+            form = response.context["form"]
+            self.assertIsNone(form.fields["organization"].initial)
+            self.assertIn(
+                "All devices must belong to the same organization",
+                " ".join(form.errors["__all__"]),
+            )
+
     def test_changelist_multitenancy(self):
         org = self._get_org()
         org2 = self._create_org(name="org2", slug="org2")
diff --git a/openwisp_controller/connection/tests/test_selenium.py b/openwisp_controller/connection/tests/test_selenium.py
index e8b86442d..2128febc3 100644
--- a/openwisp_controller/connection/tests/test_selenium.py
+++ b/openwisp_controller/connection/tests/test_selenium.py
@@ -12,7 +12,7 @@
 from django.urls import reverse
 from selenium.webdriver.common.by import By
 from selenium.webdriver.support import expected_conditions as EC
-from selenium.webdriver.support.ui import WebDriverWait
+from selenium.webdriver.support.ui import Select, WebDriverWait
 from swapper import load_model
 
 from openwisp_users.migrations import (
@@ -180,6 +180,9 @@ def setUp(self):
         self.execute_url = reverse(f"admin:{self.app_label}_batchcommand_execute")
         self.confirm_url = reverse(f"admin:{self.app_label}_batchcommand_confirm")
         self.changelist_url = reverse(f"admin:{self.app_label}_batchcommand_changelist")
+        self.device_changelist_url = reverse(
+            f"admin:{self.config_app_label}_device_changelist"
+        )
 
     # this is a TransactionTestCase: the flush performed after every test
     # restores what post_migrate creates (permissions, content types) but
@@ -390,6 +393,21 @@ def _wait_for_url(self, path, timeout=None):
         )
         self.assertEqual(urlparse(self.web_driver.current_url).path, path)
 
+    def _execute_mass_command_action(self, devices):
+        self.open(self.device_changelist_url)
+        self._wait_for_url(self.device_changelist_url)
+        self.hide_loading_overlay()
+        for device in devices:
+            self.find_element(
+                by=By.CSS_SELECTOR, value=f'.action-select[value="{device.pk}"]'
+            ).click()
+        Select(self.find_element(by=By.NAME, value="action")).select_by_value(
+            "execute_mass_command"
+        )
+        self.find_element(by=By.CSS_SELECTOR, value='button[name="index"]').click()
+        self.wait_for_visibility(By.ID, "review-command-btn", timeout=5)
+        self.hide_loading_overlay()
+
     def _wait_for_review_page(self):
         self._wait_for_url(self.confirm_url)
         self.wait_for_visibility(By.CSS_SELECTOR, ".command-summary", timeout=5)
@@ -687,6 +705,60 @@ def test_execute_batch_command(self):
 
         self.assertEqual(self.get_browser_errors(), [])
 
+    def test_execute_batch_command_from_device_changelist(self):
+        org = self._get_org()
+        devices = self._create_devices(
+            org,
+            2,
+            credentials=self._create_credentials_with_key(
+                organization=org, port=self.ssh_server.port
+            ),
+        )
+        self.login()
+        self._execute_mass_command_action(devices)
+
+        with self.subTest("the selection replaces the wider targets"):
+            self.assertEqual(
+                self.find_element(
+                    by=By.CSS_SELECTOR, value=".selected-devices-message li"
+                ).text,
+                "The command will run on the 2 devices you selected.",
+            )
+            devices_field = self.find_element(
+                by=By.ID, value="id_devices", wait_for="presence"
+            )
+            self.assertEqual(
+                set(devices_field.get_attribute("value").split(",")),
+                {str(device.pk) for device in devices},
+            )
+            self.assertTrue(
+                self.find_element(
+                    by=By.ID, value="id_organization", wait_for="presence"
+                ).get_attribute("disabled")
+            )
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_group"), [])
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_location"), [])
+
+        with self.subTest("the command runs on the selected devices"):
+            self._fill_wizard(
+                type="Custom commands",
+                label="selection-custom",
+                command_input={"command": "echo test"},
+                open_page=False,
+            )
+            self.find_element(by=By.ID, value="review-command-btn").click()
+            self._wait_for_review_page()
+            summary = self._summary()
+            self.assertEqual(summary["Targets"], "2 selected devices")
+            self.assertEqual(summary["Will run on"], "2 devices")
+            self.assertEqual(self._device_names(), [device.name for device in devices])
+            self.find_element(by=By.ID, value="execute-button").click()
+            self._wait_for_batch_result("selection-custom", "success", 2)
+            self.assertEqual(
+                sorted(self._command_device_names()),
+                sorted(device.name for device in devices),
+            )
+
     def test_execute_large_batch(self):
         org1 = self._get_org()
         devices = self._create_devices(org1, 50)
diff --git a/openwisp_controller/connection/tests/utils.py b/openwisp_controller/connection/tests/utils.py
index 9be852d4e..0e1f609a0 100644
--- a/openwisp_controller/connection/tests/utils.py
+++ b/openwisp_controller/connection/tests/utils.py
@@ -1,5 +1,6 @@
 import os
 
+from django.contrib.admin.helpers import ACTION_CHECKBOX_NAME
 from django.contrib.messages import get_messages
 from mockssh import Server
 from swapper import load_model
@@ -155,6 +156,19 @@ def _create_command(self, device_conn=None, device_conn_opts={}, **kwargs):
 
 
 class BatchCommandMixin(TestAdminMixin, CreateConnectionsMixin):
+    @staticmethod
+    def _pk_list(devices):
+        return ",".join(str(device.pk) for device in devices)
+
+    def _post_device_action(self, devices, action="execute_mass_command"):
+        return self.client.post(
+            self.device_changelist_url,
+            {
+                "action": action,
+                ACTION_CHECKBOX_NAME: [str(device.pk) for device in devices],
+            },
+        )
+
     def _post_execute(self, **overrides):
         data = {
             "type": "custom",

From b1c9064bb5c9df1dd3979938a421eba0dd0f0bb9 Mon Sep 17 00:00:00 2001
From: dee077 <deepanshu.sahu27@gmail.com>
Date: Fri, 4 Sep 2026 22:44:29 +0530
Subject: [PATCH 3/3] [feature] Improve the mass command admin action

- Move the action into BatchCommandAdmin as a static method guarded by
  the device change permission
- Hide the target fields when the command runs system wide
- Move the selection warning to the messages framework
- Add unit and selenium tests for the organization scope and the
  permissions of the action
---
 docs/user/shell-commands.rst                  |  12 +-
 openwisp_controller/connection/admin.py       |  93 ++++-----
 .../static/connection/css/batch-command.css   |   4 -
 .../batch_command/execute_command.html        |  10 +-
 .../connection/tests/test_admin.py            | 111 ++++++++++-
 .../connection/tests/test_selenium.py         | 177 +++++++++++++++++-
 openwisp_controller/connection/tests/utils.py |  26 ++-
 7 files changed, 353 insertions(+), 80 deletions(-)

diff --git a/docs/user/shell-commands.rst b/docs/user/shell-commands.rst
index 9c116e44c..86dd436af 100644
--- a/docs/user/shell-commands.rst
+++ b/docs/user/shell-commands.rst
@@ -221,13 +221,15 @@ A mass command can also be started from the device list: select the
 devices with their checkboxes, choose *Execute mass command* from the
 actions dropdown and click *Go*.
 
-The first step opens with the selection already applied: the devices it
-will run on are shown above the targets, and the organization is filled in
-and cannot be changed, while device group and location are not asked for,
-since the devices are already known.
+The first step opens with the selection already applied: a message at the
+top of the page states how many devices the command will run on, and the
+organization is filled in and cannot be changed, while device group and
+location are not asked for, since the devices are already known.
 
 The selected devices must belong to the same organization, otherwise the
-action refuses to start.
+action refuses to start. The exception is a superuser selecting every
+device of the system: the command then runs on all of them and no target
+is asked for.
 
 The rest of the workflow is the same as described below: the devices can
 still be reviewed and left out before executing.
diff --git a/openwisp_controller/connection/admin.py b/openwisp_controller/connection/admin.py
index b7b882360..4b3577777 100644
--- a/openwisp_controller/connection/admin.py
+++ b/openwisp_controller/connection/admin.py
@@ -159,10 +159,7 @@ def clean(self):
             )
         if len(self._organization_ids) > 1:
             raise ValidationError(
-                _(
-                    "All devices must belong to the same organization,"
-                    " unless it is a system wide command."
-                )
+                _("All devices must belong to the same organization.")
             )
         if self.request is None or self.request.user.is_superuser:
             return cleaned_data
@@ -593,7 +590,20 @@ def execute_command_view(self, request):
                 form = BatchCommandExecutionForm(request=request)
         return self._render_execute_page(request, form)
 
-    def _render_execute_page(self, request, form):
+    def _render_execute_page(self, request, form, system_wide=False):
+        device_count = len(form.device_ids)
+        if device_count:
+            messages.warning(
+                request,
+                ngettext(
+                    "The command will run on the device you selected.",
+                    "The command will run on the %(count)d devices you selected.",
+                    device_count,
+                )
+                % {"count": device_count},
+            )
+        elif system_wide:
+            messages.warning(request, _("The command will run on all devices."))
         context = {
             **self.admin_site.each_context(request),
             "title": _("Execute mass command"),
@@ -601,7 +611,8 @@ def _render_execute_page(self, request, form):
             "form": form,
             "media": form.media,
             "has_view_permission": self.has_view_permission(request),
-            "device_count": len(form.device_ids),
+            "device_count": device_count,
+            "system_wide": system_wide,
         }
         return TemplateResponse(request, self.execute_command_template, context)
 
@@ -1116,46 +1127,36 @@ def change_view(self, request, object_id, form_url="", extra_context=None):
             )
         return super().change_view(request, object_id, extra_context=extra_context)
 
-
-admin.site.register(BatchCommand, BatchCommandAdmin)
-
-
-@admin.action(
-    description=_("Execute mass command"),
-    permissions=["execute_mass_command"],
-)
-def execute_mass_command(modeladmin, request, queryset):
-    """Second entry point of the mass command workflow: the devices are
-    picked one by one instead of being matched by organization, group or
-    location. The selection travels in the form rather than in the session,
-    so it cannot outlive the wizard it belongs to.
-    """
-    # TODO: replace _registry with get_model_admin once Django 4.2 is dropped
-    batch_admin = modeladmin.admin_site._registry[BatchCommand]
-    batch_admin._check_add_permission(request)
-    organization_ids = set(queryset.values_list("organization_id", flat=True))
-    if len(organization_ids) > 1:
-        modeladmin.message_user(
-            request,
-            _(
-                "All devices must belong to the same organization,"
-                " unless it is a system wide command."
-            ),
-            messages.ERROR,
+    @staticmethod
+    @admin.action(description=_("Execute mass command"), permissions=["change"])
+    def execute_mass_command_admin_action(modeladmin, request, queryset):
+        """Second entry point of the mass command workflow: the devices are
+        picked one by one instead of being matched by organization, group or
+        location. The selection travels in the form rather than in the session,
+        so it cannot outlive the wizard it belongs to.
+        """
+        batch_admin = modeladmin.admin_site.get_model_admin(BatchCommand)
+        batch_admin._check_add_permission(request)
+        organization_ids = set(queryset.values_list("organization_id", flat=True))
+        if len(organization_ids) > 1:
+            if request.user.is_superuser and queryset.count() == Device.objects.count():
+                return batch_admin._render_execute_page(
+                    request,
+                    BatchCommandExecutionForm(request=request),
+                    system_wide=True,
+                )
+            modeladmin.message_user(
+                request,
+                _("All devices must belong to the same organization."),
+                messages.ERROR,
+            )
+            return HttpResponseRedirect(request.get_full_path())
+        form = BatchCommandExecutionForm(
+            request=request,
+            device_ids=[str(pk) for pk in queryset.values_list("pk", flat=True)],
         )
-        return HttpResponseRedirect(request.get_full_path())
-    form = BatchCommandExecutionForm(
-        request=request,
-        device_ids=[str(pk) for pk in queryset.values_list("pk", flat=True)],
-    )
-    return batch_admin._render_execute_page(request, form)
-
+        return batch_admin._render_execute_page(request, form)
 
-def has_execute_mass_command_permission(self, request):
-    options = BatchCommand._meta
-    return request.user.has_perm(f"{options.app_label}.add_{options.model_name}")
 
-
-DeviceAdmin.execute_mass_command = execute_mass_command
-DeviceAdmin.has_execute_mass_command_permission = has_execute_mass_command_permission
-DeviceAdmin.actions += ["execute_mass_command"]
+admin.site.register(BatchCommand, BatchCommandAdmin)
+DeviceAdmin.actions += [BatchCommandAdmin.execute_mass_command_admin_action]
diff --git a/openwisp_controller/connection/static/connection/css/batch-command.css b/openwisp_controller/connection/static/connection/css/batch-command.css
index 259a96b0f..288870bee 100644
--- a/openwisp_controller/connection/static/connection/css/batch-command.css
+++ b/openwisp_controller/connection/static/connection/css/batch-command.css
@@ -306,10 +306,6 @@
 .execute-batch-command .form-row.field-input.errors .flex-container {
   display: none;
 }
-.execute-batch-command ul.selected-devices-message li {
-  padding: 15px 10px 15px 42px !important;
-  background-position: 15px 17px !important;
-}
 #main .form-row .ow-text-field {
   width: 320px;
 }
diff --git a/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html b/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
index 34ffd3dd4..852a4a70d 100644
--- a/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
+++ b/openwisp_controller/connection/templates/admin/connection/batch_command/execute_command.html
@@ -66,14 +66,7 @@ <h2>{% trans "Command" %}</h2>
       {% include "admin/connection/batch_command/form_row.html" with field=form.notes %}
     </fieldset>
 
-    {% if device_count %}
-    <ul class="messagelist selected-devices-message">
-      <li class="warning">
-        {% blocktrans count counter=device_count %}The command will run on the device you selected.{% plural %}The command will run on the {{ counter }} devices you selected.{% endblocktrans %}
-      </li>
-    </ul>
-    {% endif %}
-
+    {% if not system_wide %}
     <fieldset class="module aligned">
       <h2>{% trans "Targets" %}</h2>
       {% include "admin/connection/batch_command/form_row.html" with field=form.organization %}
@@ -82,6 +75,7 @@ <h2>{% trans "Targets" %}</h2>
       {% include "admin/connection/batch_command/form_row.html" with field=form.group %}
       {% endif %}
     </fieldset>
+    {% endif %}
 
     <div class="submit-row">
       <a class="button cancel-link" href="{% url opts|admin_urlname:'changelist' %}">{% trans "Cancel" %}</a>
diff --git a/openwisp_controller/connection/tests/test_admin.py b/openwisp_controller/connection/tests/test_admin.py
index a81957aef..b388076d5 100644
--- a/openwisp_controller/connection/tests/test_admin.py
+++ b/openwisp_controller/connection/tests/test_admin.py
@@ -855,7 +855,7 @@ def test_device_action_selection(self):
             self.assertNotContains(response, 'name="group"')
             self.assertNotContains(response, 'name="location"')
         with self.subTest("devices of different organizations are refused"):
-            response = self._post_device_action(devices + [device_org2])
+            response = self._post_device_action([devices[0], device_org2])
             self.assertRedirects(response, self.device_changelist_url)
             self.assertIn(
                 "All devices must belong to the same organization",
@@ -876,6 +876,74 @@ def test_device_action_selection(self):
             self._post_confirm(wizard["token"])
             batch = BatchCommand.objects.get()
             self.assertEqual(set(batch.devices.all()), set(devices))
+        with self.subTest("a single device is announced in the singular"):
+            response = self._post_device_action(devices[:1])
+            self.assertContains(
+                response, "The command will run on the device you selected."
+            )
+            self._start_wizard(devices=self._pk_list(devices[:1]))
+            response = self.client.get(self.confirm_url)
+            self.assertEqual(response.context["targets_display"], "1 selected device")
+
+    def test_device_action_system_wide(self):
+        org = self._get_org()
+        org2 = self._create_org(name="org2", slug="org2")
+        devices = [
+            self._create_device(
+                name=f"device{index}",
+                mac_address=f"00:11:22:33:44:0{index}",
+                organization=org,
+            )
+            for index in range(2)
+        ]
+        device_org2 = self._create_device(
+            name="device-org2", mac_address="00:11:22:33:44:09", organization=org2
+        )
+        self._login()
+        with self.subTest("selecting every device is system wide"):
+            response = self._post_device_action(
+                devices + [device_org2], select_across=True
+            )
+            self.assertEqual(response.status_code, 200)
+            form = response.context["form"]
+            self.assertEqual(form.device_ids, [])
+            self.assertEqual(response.context["device_count"], 0)
+            self.assertIsNone(form.fields["organization"].initial)
+            for field_name in ("organization", "group", "location"):
+                self.assertFalse(form.fields[field_name].disabled)
+            self.assertContains(response, "The command will run on all devices.")
+            self.assertNotContains(response, 'name="organization"')
+            self.assertNotContains(response, 'name="group"')
+            self.assertNotContains(response, 'name="location"')
+        with self.subTest("the excluded devices are left out of the batch"):
+            wizard = self._start_wizard()
+            self.client.get(self.confirm_url)
+            response = self._post_confirm(wizard["token"], excluded=str(device_org2.pk))
+            self.assertEqual(response.status_code, 302)
+            self.assertIn(
+                "Mass command executed successfully.", self._messages(response)
+            )
+            batch = BatchCommand.objects.get()
+            self.assertIsNone(batch.organization_id)
+            self.assertIsNone(batch.group_id)
+            self.assertIsNone(batch.location_id)
+            self.assertEqual(set(batch.devices.all()), set(devices))
+        with self.subTest("a partial multi organization selection is refused"):
+            self._create_device(
+                name="excluded-by-the-search",
+                mac_address="00:11:22:33:44:08",
+                organization=org2,
+            )
+            response = self._post_device_action(
+                devices + [device_org2],
+                select_across=True,
+                query={"q": "device"},
+            )
+            self.assertRedirects(response, f"{self.device_changelist_url}?q=device")
+            self.assertIn(
+                "All devices must belong to the same organization",
+                " ".join(self._messages(response)),
+            )
 
     def test_device_action_permissions_and_scope(self):
         org = self._get_org()
@@ -884,9 +952,10 @@ def test_device_action_permissions_and_scope(self):
         device2 = self._create_device(
             name="device2", mac_address="00:11:22:33:44:02", organization=org2
         )
-        device_admin = admin.site._registry[Device]
+        device_admin = admin.site.get_model_admin(Device)
         request = RequestFactory().get(self.device_changelist_url)
-        with self.subTest("the add permission is required"):
+        action_name = "execute_mass_command_admin_action"
+        with self.subTest("the device change permission is required"):
             viewer = self._create_operator(
                 organizations=[org], username="viewer", email="viewer@test.com"
             )
@@ -895,13 +964,19 @@ def test_device_action_permissions_and_scope(self):
                 Permission.objects.filter(codename="view_batchcommand")
             )
             request.user = viewer
-            self.assertFalse(device_admin.has_execute_mass_command_permission(request))
-            self.assertNotIn("execute_mass_command", device_admin.get_actions(request))
+            self.assertNotIn(action_name, device_admin.get_actions(request))
         with self.subTest("the operator group can use the action"):
             operator = self._create_operator(organizations=[org])
             request.user = operator
-            self.assertTrue(device_admin.has_execute_mass_command_permission(request))
-            self.assertIn("execute_mass_command", device_admin.get_actions(request))
+            self.assertIn(action_name, device_admin.get_actions(request))
+        with self.subTest("the batch command add permission is enforced"):
+            viewer.user_permissions.set(
+                Permission.objects.filter(
+                    codename__in=["view_device", "change_device", "view_batchcommand"]
+                )
+            )
+            self.client.force_login(viewer)
+            self.assertEqual(self._post_device_action([device]).status_code, 403)
         with self.subTest("devices of unmanaged organizations are dropped"):
             self.client.force_login(operator)
             response = self._post_execute(devices=self._pk_list([device, device2]))
@@ -923,6 +998,28 @@ def test_device_action_permissions_and_scope(self):
                 "All devices must belong to the same organization",
                 " ".join(form.errors["__all__"]),
             )
+        with self.subTest("selecting every device is not system wide for operators"):
+            multi_operator = self._create_operator(
+                organizations=[org, org2], username="multi", email="multi@test.com"
+            )
+            self.client.force_login(multi_operator)
+            response = self._post_device_action([device, device2], select_across=True)
+            self.assertRedirects(response, self.device_changelist_url)
+            self.assertIn(
+                "All devices must belong to the same organization",
+                " ".join(self._messages(response)),
+            )
+        with self.subTest("an operator executes the devices it manages"):
+            self.client.force_login(operator)
+            wizard = self._start_wizard(devices=self._pk_list([device]))
+            self.assertEqual(wizard["device_ids"], [str(device.pk)])
+            self.assertEqual(wizard["organization_id"], str(org.pk))
+            self.client.get(self.confirm_url)
+            response = self._post_confirm(wizard["token"])
+            self.assertEqual(response.status_code, 302)
+            batch = BatchCommand.objects.get()
+            self.assertEqual(batch.organization_id, org.pk)
+            self.assertEqual(set(batch.devices.all()), {device})
 
     def test_changelist_multitenancy(self):
         org = self._get_org()
diff --git a/openwisp_controller/connection/tests/test_selenium.py b/openwisp_controller/connection/tests/test_selenium.py
index 2128febc3..b1b48e43d 100644
--- a/openwisp_controller/connection/tests/test_selenium.py
+++ b/openwisp_controller/connection/tests/test_selenium.py
@@ -263,6 +263,13 @@ def _fill_wizard(
             self.open(self.execute_url)
             self._wait_for_url(self.execute_url)
         self.hide_loading_overlay()
+        # the editor is rebuilt when the schema request lands, discarding
+        # whatever was typed before it did
+        WebDriverWait(self.web_driver, 5).until(
+            lambda driver: driver.execute_script(
+                "return Object.keys(django._schemas).length > 0;"
+            )
+        )
         self.web_driver.execute_script(
             "django.jQuery('#id_group, #id_location').val('').trigger('change');"
         )
@@ -402,7 +409,7 @@ def _execute_mass_command_action(self, devices):
                 by=By.CSS_SELECTOR, value=f'.action-select[value="{device.pk}"]'
             ).click()
         Select(self.find_element(by=By.NAME, value="action")).select_by_value(
-            "execute_mass_command"
+            "execute_mass_command_admin_action"
         )
         self.find_element(by=By.CSS_SELECTOR, value='button[name="index"]').click()
         self.wait_for_visibility(By.ID, "review-command-btn", timeout=5)
@@ -720,7 +727,7 @@ def test_execute_batch_command_from_device_changelist(self):
         with self.subTest("the selection replaces the wider targets"):
             self.assertEqual(
                 self.find_element(
-                    by=By.CSS_SELECTOR, value=".selected-devices-message li"
+                    by=By.CSS_SELECTOR, value=".messagelist li.warning"
                 ).text,
                 "The command will run on the 2 devices you selected.",
             )
@@ -759,6 +766,172 @@ def test_execute_batch_command_from_device_changelist(self):
                 sorted(device.name for device in devices),
             )
 
+    def test_execute_system_wide_batch_command_from_device_changelist(self):
+        org1 = self._get_org()
+        org2 = self._create_org(name="org2", slug="org2")
+        devices = self._create_devices(
+            org1,
+            2,
+            credentials=self._create_credentials_with_key(
+                organization=org1, port=self.ssh_server.port
+            ),
+        ) + self._create_devices(
+            org2,
+            1,
+            credentials=self._create_credentials_with_key(
+                organization=org2, port=self.ssh_server.port
+            ),
+        )
+        self.login()
+        self._execute_mass_command_action(devices)
+
+        with self.subTest("the targets are hidden and the scope announced"):
+            self.assertEqual(
+                self.find_element(
+                    by=By.CSS_SELECTOR, value="ul.messagelist li.warning"
+                ).text,
+                "The command will run on all devices.",
+            )
+            self.assertEqual(
+                self.web_driver.find_elements(By.ID, "id_organization"), []
+            )
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_group"), [])
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_location"), [])
+            self.assertEqual(
+                self.find_element(
+                    by=By.ID, value="id_devices", wait_for="presence"
+                ).get_attribute("value"),
+                "",
+            )
+
+        with self.subTest("the command runs on every device"):
+            self._fill_wizard(
+                type="Custom commands",
+                label="system-wide-custom",
+                command_input={"command": "echo test"},
+                open_page=False,
+            )
+            # the editor commits what was typed only when the field is left
+            WebDriverWait(self.web_driver, 5).until(
+                lambda driver: not driver.execute_script(
+                    "return django._jsonEditors.id_input_jsoneditor.validate();"
+                )
+            )
+            self.find_element(by=By.ID, value="review-command-btn").click()
+            self._wait_for_review_page()
+            summary = self._summary()
+            self.assertEqual(summary["Targets"], "All devices")
+            self.assertEqual(summary["Will run on"], "3 devices")
+            self.assertEqual(
+                sorted(self._device_names()),
+                sorted(device.name for device in devices),
+            )
+            self.find_element(by=By.ID, value="execute-button").click()
+            self._wait_for_batch_result("system-wide-custom", "success", 3)
+
+        self.assertEqual(self.get_browser_errors(), [])
+
+    def test_device_action_organization_isolation_and_permissions(self):
+        org1 = self._get_org()
+        org2 = self._create_org(name="org2", slug="org2")
+        devices1 = self._create_devices(
+            org1,
+            2,
+            credentials=self._create_credentials_with_key(
+                organization=org1, port=self.ssh_server.port
+            ),
+        )
+        self._create_devices(org2, 1)
+        operator = self._create_operator(organizations=[org1])
+        self.login(username=operator.username, password="tester")
+        self._execute_mass_command_action(devices1)
+
+        with self.subTest("the selection is scoped to the managed organization"):
+            self.assertEqual(
+                self.find_element(
+                    by=By.CSS_SELECTOR, value="ul.messagelist li.warning"
+                ).text,
+                "The command will run on the 2 devices you selected.",
+            )
+            organization = self.find_element(
+                by=By.ID, value="id_organization", wait_for="presence"
+            )
+            self.assertTrue(organization.get_attribute("disabled"))
+            self.assertEqual(organization.get_attribute("value"), str(org1.pk))
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_group"), [])
+            self.assertEqual(self.web_driver.find_elements(By.ID, "id_location"), [])
+
+        with self.subTest("the command runs on the selected devices"):
+            self._fill_wizard(
+                type="Custom commands",
+                label="operator-selection",
+                command_input={"command": "echo test"},
+                open_page=False,
+            )
+            self.find_element(by=By.ID, value="review-command-btn").click()
+            self._wait_for_review_page()
+            summary = self._summary()
+            self.assertEqual(summary["Targets"], "2 selected devices")
+            self.assertEqual(self._device_names(), [device.name for device in devices1])
+            self.find_element(by=By.ID, value="execute-button").click()
+            self._wait_for_batch_result("operator-selection", "success", 2)
+            batch = BatchCommand.objects.get(label="operator-selection")
+            self.assertEqual(batch.organization_id, org1.pk)
+
+        with self.subTest("the batch command add permission is enforced"):
+            restricted = self._create_operator(
+                organizations=[org1],
+                username="restricted",
+                email="restricted@test.com",
+            )
+            restricted.groups.clear()
+            restricted.user_permissions.set(
+                Permission.objects.filter(codename__in=["view_device", "change_device"])
+            )
+            self.web_driver.delete_all_cookies()
+            self.login(username=restricted.username, password="tester")
+            self.open(self.device_changelist_url)
+            self._wait_for_url(self.device_changelist_url)
+            self.hide_loading_overlay()
+            self.find_element(
+                by=By.CSS_SELECTOR, value=f'.action-select[value="{devices1[0].pk}"]'
+            ).click()
+            Select(self.find_element(by=By.NAME, value="action")).select_by_value(
+                "execute_mass_command_admin_action"
+            )
+            self.find_element(by=By.CSS_SELECTOR, value='button[name="index"]').click()
+            self.assertEqual(
+                self.find_element(by=By.TAG_NAME, value="body").text,
+                "403 Forbidden",
+            )
+
+        with self.subTest("the view permission does not offer the action"):
+            viewer = self._create_operator(
+                organizations=[org1], username="viewer", email="viewer@test.com"
+            )
+            viewer.groups.clear()
+            viewer.user_permissions.set(
+                Permission.objects.filter(
+                    codename__in=["view_device", "view_batchcommand"]
+                )
+            )
+            self.web_driver.delete_all_cookies()
+            self.login(username=viewer.username, password="tester")
+            self.open(self.device_changelist_url)
+            self._wait_for_url(self.device_changelist_url)
+            self.hide_loading_overlay()
+            self.assertNotIn(
+                "Execute mass command",
+                [
+                    option.text
+                    for option in self.web_driver.find_elements(
+                        By.CSS_SELECTOR, "select[name='action'] option"
+                    )
+                ],
+            )
+
+        self.assertEqual(self.get_browser_errors(), [])
+
     def test_execute_large_batch(self):
         org1 = self._get_org()
         devices = self._create_devices(org1, 50)
diff --git a/openwisp_controller/connection/tests/utils.py b/openwisp_controller/connection/tests/utils.py
index 0e1f609a0..0f594145d 100644
--- a/openwisp_controller/connection/tests/utils.py
+++ b/openwisp_controller/connection/tests/utils.py
@@ -2,6 +2,7 @@
 
 from django.contrib.admin.helpers import ACTION_CHECKBOX_NAME
 from django.contrib.messages import get_messages
+from django.utils.http import urlencode
 from mockssh import Server
 from swapper import load_model
 
@@ -160,14 +161,23 @@ class BatchCommandMixin(TestAdminMixin, CreateConnectionsMixin):
     def _pk_list(devices):
         return ",".join(str(device.pk) for device in devices)
 
-    def _post_device_action(self, devices, action="execute_mass_command"):
-        return self.client.post(
-            self.device_changelist_url,
-            {
-                "action": action,
-                ACTION_CHECKBOX_NAME: [str(device.pk) for device in devices],
-            },
-        )
+    def _post_device_action(
+        self,
+        devices,
+        action="execute_mass_command_admin_action",
+        select_across=False,
+        query=None,
+    ):
+        data = {
+            "action": action,
+            ACTION_CHECKBOX_NAME: [str(device.pk) for device in devices],
+        }
+        if select_across:
+            data["select_across"] = "1"
+        url = self.device_changelist_url
+        if query:
+            url = f"{url}?{urlencode(query)}"
+        return self.client.post(url, data)
 
     def _post_execute(self, **overrides):
         data = {