[fix] Prevent command creation for devices without a DeviceConnection #1016

Added a check before creation to ensure device has credentials
via 'DeviceConnection'. To ensure only relevant connection and
command types are displayed modified their queryset in
serializer's 'init'.

Closes #1016

Signed-off-by: DragnEmperor <dragnemperor@gmail.com>

Author: DragnEmperor

openwisp_controller/connection/api/serializers.py

@@ -31,6 +31,21 @@ class CommandSerializer(ValidatedDeviceFieldSerializer):
         pk_field=serializers.UUIDField(format='hex_verbose'),
     )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # show only connections and command types available for the device
+        if (
+            device := Device.objects.filter(pk=self.context.get('device_id'))
+            .only('organization_id', 'id')
+            .first()
+        ):
+            self.fields['connection'].queryset = DeviceConnection.objects.filter(
+                device=device
+            )
+            self.fields['type'].choices = Command.get_org_choices(
+                device.organization_id
+            )
+
     def to_representation(self, instance):
         repr = super().to_representation(instance)
         repr['type'] = instance.get_type_display()

openwisp_controller/connection/api/views.py

@@ -66,6 +66,11 @@ class CommandListCreateView(BaseCommandView, ListCreateAPIView):
 
     def create(self, request, *args, **kwargs):
         self.assert_parent_exists()
+        if not DeviceConnection.objects.filter(
+            device_id=self.kwargs['device_pk'],
+            credentials__isnull=False,
+        ).exists():
+            raise NotFound(detail='Device has no credentials assigned.')
         return super().create(request, *args, **kwargs)