From 5cf3e045496efad220eb9c4bf66243a62c35fb88 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 01/17] fix(security): escape untrusted LibreNMS data and gate
 verify endpoints

Escape untrusted LibreNMS/VLAN values in the interface table render (XSS), validate the
POSTed server_key and escape interface_name_field on the sync redirect, gate the
single-interface / IP / module / VLAN verify endpoints on object-view permission before
resolving the device, guard the CSRF-token lookups in the verify/persist JS handlers, and
give the NetBox-only modal checkboxes and the promote modal accessible names.
---
 .../js/librenms_sync.js                       | 155 ++++-
 netbox_librenms_plugin/tables/interfaces.py   |  89 +--
 .../_interface_sync.html                      |  13 +-
 .../_interface_sync_content.html              |   6 +-
 .../htmx/device_validation_details.html       |   4 +
 .../tests/test_coverage_sync_interfaces.py    | 132 +++++
 .../tests/test_interface_sync_button_type.py  |  53 ++
 .../tests/test_ip_verify.py                   |  66 +++
 .../tests/test_permissions.py                 |  22 +
 .../test_validation_template_server_key.py    |  37 ++
 .../tests/test_verify_views.py                | 543 ++++++++++++++++++
 .../tests/test_view_wiring.py                 |  67 ++-
 12 files changed, 1118 insertions(+), 69 deletions(-)
 create mode 100644 netbox_librenms_plugin/tests/test_interface_sync_button_type.py
 create mode 100644 netbox_librenms_plugin/tests/test_validation_template_server_key.py

diff --git a/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js b/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
index 9a9b0a0207..78a7685888 100644
--- a/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
+++ b/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
@@ -18,6 +18,17 @@
 const TOMSELECT_INIT_DELAY_MS = 100;
 const COUNTDOWN_UPDATE_INTERVAL_MS = 1000;
 
+/**
+ * Return the CSRF token value, or null when the hidden input is missing/empty.
+ * Callers MUST bail (running any needed UI cleanup) on null instead of reading
+ * `.value` off a missing element, which throws a TypeError and breaks the handler.
+ * @returns {string|null}
+ */
+function getCsrfToken() {
+    const input = document.querySelector('[name=csrfmiddlewaretoken]');
+    return input && input.value ? input.value : null;
+}
+
 /**
  * Show a Bootstrap modal, using native Bootstrap Modal when available,
  * falling back to manual DOM manipulation otherwise.
@@ -291,34 +302,59 @@ function initializeTableCheckboxes(tableId) {
     const table = document.getElementById(tableId);
     if (!table) return;
 
+    // Query the CURRENT checkboxes live inside every handler instead of closing over a snapshot.
+    // The master initializer re-runs on each htmx:afterSwap, but the dataset guards below keep the
+    // toggle/shift handlers from re-binding on a SURVIVING <thead> toggle; a NodeList captured once
+    // would then go stale, so select-all / shift-range would iterate detached checkboxes and miss
+    // the rows a later row-level swap injected.
+    const liveCheckboxes = () => Array.from(table.querySelectorAll('td input[name="select"]'));
     const toggleAll = table.querySelector('th input.toggle');
-    const checkboxes = table.querySelectorAll('td input[name="select"]');
-    let lastChecked = null;
+    // Persist the shift-range anchor on the TABLE element, not in a per-call closure. This
+    // initializer re-runs on every htmx:afterSwap: checkboxes bound in an earlier run keep their
+    // handlers (the dataset guard skips re-binding), so a closure-scoped anchor would leave old
+    // rows referencing a stale `lastChecked` while rows added by a later swap use a fresh one —
+    // shift-clicking between the two then uses disconnected anchors and selects nothing. One
+    // anchor on the shared table node keeps every row's handler in sync across swaps.
+    const getAnchor = () => table._lnmsLastChecked || null;
+    const setAnchor = (cb) => {
+        table._lnmsLastChecked = cb;
+    };
 
-    if (toggleAll) {
+    // Guard against stacked handlers: register each listener at most once per element (a dataset
+    // flag marks it done) since the master initializer re-runs on every htmx:afterSwap.
+    if (toggleAll && toggleAll.dataset.tableToggleInitialized !== 'true') {
+        toggleAll.dataset.tableToggleInitialized = 'true';
         toggleAll.addEventListener('change', function () {
-            checkboxes.forEach(checkbox => {
+            liveCheckboxes().forEach(checkbox => {
                 checkbox.checked = toggleAll.checked;
             });
         });
     }
 
-    checkboxes.forEach(checkbox => {
+    liveCheckboxes().forEach(checkbox => {
+        if (checkbox.dataset.tableClickInitialized === 'true') return;
+        checkbox.dataset.tableClickInitialized = 'true';
         checkbox.addEventListener('click', function (e) {
-            if (!lastChecked) {
-                lastChecked = checkbox;
+            const anchor = getAnchor();
+            if (!anchor) {
+                setAnchor(checkbox);
                 return;
             }
 
             if (e.shiftKey) {
-                const start = Array.from(checkboxes).indexOf(checkbox);
-                const end = Array.from(checkboxes).indexOf(lastChecked);
-                Array.from(checkboxes).slice(Math.min(start, end), Math.max(start, end) + 1).forEach(cb => {
-                    cb.checked = lastChecked.checked;
-                });
+                const current = liveCheckboxes();
+                const start = current.indexOf(checkbox);
+                const end = current.indexOf(anchor);
+                // Skip the range when the prior anchor was swapped out (indexOf -1) rather than
+                // slicing a bogus range off the live list.
+                if (start !== -1 && end !== -1) {
+                    current.slice(Math.min(start, end), Math.max(start, end) + 1).forEach(cb => {
+                        cb.checked = anchor.checked;
+                    });
+                }
             }
 
-            lastChecked = checkbox;
+            setAnchor(checkbox);
         });
     });
 }
@@ -589,11 +625,17 @@ function verifyVlanInGroup(select, deviceId, vid, vlanType, groupId) {
     const modal = document.getElementById('vlanDetailModal');
     const capturedSafeName = modal?.dataset.currentSafeName;
 
+    const csrfToken = getCsrfToken();
+    if (!csrfToken) {
+        _vlanVerifyEnd(saveBtn);  // don't leave the Save button stuck disabled
+        return;
+    }
+
     fetch('/plugins/librenms_plugin/verify-vlan-group/', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: deviceId,
@@ -774,11 +816,24 @@ function initializeVlanModalSave() {
         // Persist overrides in server cache so other table pages pick them up
         if (applyToAll && Object.keys(vidGroupMap).length > 0) {
             const deviceId = modalEl.dataset.currentDeviceId;
+            const csrfToken = getCsrfToken();
+            if (!csrfToken) {
+                // Can't persist without a CSRF token; surface it via the same error UI the
+                // fetch .catch uses rather than letting a `.value`-on-null TypeError abort silently.
+                let alertEl = modalEl.querySelector('.vlan-override-error');
+                if (!alertEl) {
+                    alertEl = document.createElement('div');
+                    alertEl.className = 'vlan-override-error alert alert-danger mt-2';
+                    modalEl.querySelector('.modal-body')?.appendChild(alertEl);
+                }
+                alertEl.textContent = 'Failed to save VLAN group overrides: CSRF token not found.';
+                return;
+            }
             fetch('/plugins/librenms_plugin/save-vlan-group-overrides/', {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+                    'X-CSRFToken': csrfToken
                 },
                 body: JSON.stringify({
                     device_id: deviceId,
@@ -916,11 +971,14 @@ function handleVRFChange(select, value) {
     }
     const deviceId = deviceInfo.id;
 
+    const csrfToken = getCsrfToken();
+    if (!csrfToken) return;  // missing token → abort rather than throw on `.value`
+
     fetch('/plugins/librenms_plugin/verify-ipaddress/', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: deviceId,
@@ -958,11 +1016,14 @@ function handleVRFChange(select, value) {
  * @param {string} value - Selected device ID
  */
 function handleInterfaceChange(select, value) {
+    const csrfToken = getCsrfToken();
+    if (!csrfToken) return;  // missing token → abort rather than throw on `.value`
+
     fetch('/plugins/librenms_plugin/verify-interface/', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: value,
@@ -1004,11 +1065,14 @@ function handleInterfaceChange(select, value) {
  * @param {string} value - Selected device ID
  */
 function handleCableChange(select, value) {
+    const csrfToken = getCsrfToken();
+    if (!csrfToken) return;  // missing token → abort rather than throw on `.value`
+
     fetch('/plugins/librenms_plugin/verify-cable/', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: value,
@@ -1058,11 +1122,14 @@ function handleModuleChange(select, value) {
     const controller = new AbortController();
     select._moduleVerifyController = controller;
 
+    const csrfToken = getCsrfToken();
+    if (!csrfToken) return;  // missing token → abort rather than throw on `.value`
+
     fetch('/plugins/librenms_plugin/verify-module/', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: value,
@@ -1159,15 +1226,22 @@ function initializeBulkEditApply() {
 function initializeCheckboxListeners() {
     const interfaceTable = document.getElementById('librenms-interface-table');
     if (!interfaceTable) return;
-    const checkboxes = interfaceTable.querySelectorAll('input[name="select"]');
-    checkboxes.forEach(checkbox => {
+    // Query live inside the handlers: the bulkToggle guard below keeps the toggle handler from
+    // re-binding on a surviving <thead> toggle across htmx:afterSwap, so a captured NodeList would
+    // go stale and select-all would skip rows added by later row-level swaps.
+    const liveCheckboxes = () => interfaceTable.querySelectorAll('input[name="select"]');
+    // Idempotent across htmx:afterSwap re-runs — register the change handler once per checkbox.
+    liveCheckboxes().forEach(checkbox => {
+        if (checkbox.dataset.bulkChangeInitialized === 'true') return;
+        checkbox.dataset.bulkChangeInitialized = 'true';
         checkbox.addEventListener('change', updateBulkActionButton);
     });
 
     const toggleAll = interfaceTable.querySelector('input.toggle');
-    if (toggleAll) {
+    if (toggleAll && toggleAll.dataset.bulkToggleInitialized !== 'true') {
+        toggleAll.dataset.bulkToggleInitialized = 'true';
         toggleAll.addEventListener('change', function () {
-            checkboxes.forEach(checkbox => {
+            liveCheckboxes().forEach(checkbox => {
                 checkbox.checked = toggleAll.checked;
             });
             updateBulkActionButton();
@@ -1629,6 +1703,14 @@ function initializeSyncFormSpinners() {
  * The form is separate from the table (to avoid nested forms), so we copy the
  * selected checkbox values into hidden inputs just before the form is submitted.
  * Guard against duplicate listeners on repeated HTMX swaps via a data attribute.
+ *
+ * NOTE: this submit-phase injection only reliably covers the NATIVE (no-htmx) submit
+ * fallback. When htmx drives the POST, its own submit listener can be registered on the
+ * form BEFORE this one (fresh page load: htmx's DOMContentLoaded processNode runs before
+ * initializeScripts), so it serializes the form first and these hidden inputs arrive too
+ * late. The htmx path is therefore injected at htmx:configRequest (see the
+ * DOMContentLoaded handler), which fires after serialization and replaces any
+ * select/device_selection values this handler managed to add.
  */
 function handleInstallSelectedSubmit() {
     // Remove any previously-injected hidden inputs to avoid duplicates
@@ -1943,6 +2025,33 @@ document.addEventListener('DOMContentLoaded', function () {
         if (csrfToken) {
             event.detail.headers['X-CSRFToken'] = csrfToken.value;
         }
+        // Install Selected: the checked rows live in the table OUTSIDE the form, and htmx's
+        // own submit listener (attached to the form at ITS DOMContentLoaded processNode,
+        // which on a fresh page load runs before initializeScripts registers the
+        // submit-phase injector on the same element — listener ORDER, not event phase,
+        // decides) serializes the form BEFORE the hidden inputs are injected. The first
+        // click after a full page load then POSTs no 'select' values and the view warns
+        // "No modules selected." while wiping the selection. configRequest fires AFTER
+        // htmx serialization, exactly to let listeners amend the outgoing parameters, so
+        // injecting here is ordering-independent. Replace (not append to) any
+        // select/device_selection values the submit-phase injector already serialized so
+        // rows are never posted twice.
+        if (event.detail.elt && event.detail.elt.id === 'install-selected-form') {
+            const params = event.detail.parameters;
+            Array.from(params.keys())
+                .filter((k) => k === 'select' || k.startsWith('device_selection_'))
+                .forEach((k) => params.delete(k));
+            const table = document.getElementById('librenms-module-table');
+            if (table) {
+                table.querySelectorAll('input[name="select"]:checked').forEach((cb) => {
+                    params.append('select', cb.value);
+                    const selectedDevice = table.querySelector(`#device_selection_${cb.value}`);
+                    if (selectedDevice) {
+                        params.append(`device_selection_${cb.value}`, selectedDevice.value);
+                    }
+                });
+            }
+        }
     });
 });
 
diff --git a/netbox_librenms_plugin/tables/interfaces.py b/netbox_librenms_plugin/tables/interfaces.py
index d99d2a7bfe..34dbc65794 100644
--- a/netbox_librenms_plugin/tables/interfaces.py
+++ b/netbox_librenms_plugin/tables/interfaces.py
@@ -52,7 +52,12 @@ def __init__(self, *args, device=None, interface_name_field=None, vlan_groups=No
         self.device = device
         self.interface_name_field = interface_name_field or get_interface_name_field()
         self.vlan_groups = vlan_groups or []
-        self.server_key = server_key
+        # Default the key so render_librenms_id's get_librenms_device_id(self.server_key) lookup
+        # falls back to the "default" server entry; a None key would miss {"default": 42} values.
+        self.server_key = server_key or "default"
+        # Lazily-built {(librenms_type, librenms_speed): mapping} cache so render_type doesn't run
+        # 1-2 InterfaceTypeMapping queries for every interface row (the table is small and static).
+        self._interface_type_mapping_cache = None
 
         # Update column accessors after initialization
         for column in ["selection", "name"]:
@@ -178,23 +183,31 @@ def render_vlans(self, value, record):
             else:
                 css = get_tagged_vlan_css_class(vid, netbox_tagged_vids, exists_in_netbox, missing_vlans, group_matches)
             warning = get_missing_vlan_warning(vid, missing_vlans)
-            inline_parts.append(f'<span class="{css}">{vid}({vlan_type}){warning}</span>')
+            # Escape the LibreNMS-sourced vid/vlan_type (XSS, issue #105 class). css is an
+            # internal class name; warning is the static icon HTML from get_missing_vlan_warning,
+            # so it is marked safe rather than escaped.
+            inline_parts.append(
+                format_html('<span class="{}">{}({}){}</span>', css, vid, vlan_type, mark_safe(warning))
+            )
 
-        summary = ", ".join(inline_parts)
+        # inline_parts are already escaped SafeStrings; join them and keep the result safe.
+        summary = mark_safe(", ".join(str(part) for part in inline_parts))
         if len(all_vlans) > MAX_INLINE:
             extra = len(all_vlans) - MAX_INLINE
-            summary += f' <span class="text-muted">+{extra} more</span>'
+            summary = format_html('{} <span class="text-muted">+{} more</span>', summary, extra)
 
-        # Build tooltip showing auto-selected VLAN group per VLAN
+        # Build tooltip showing auto-selected VLAN group per VLAN. Escape the LibreNMS-sourced
+        # vid/vlan_type and group_name; the "&#10;" separator is a literal newline entity for the
+        # title attribute, so join the escaped lines and mark the whole tooltip safe.
         tooltip_lines = []
         for vlan_type, vid in all_vlans:
             if vid in missing_vlans:
-                tooltip_lines.append(f"VLAN {vid}({vlan_type}) → ⚠ Not in NetBox")
+                tooltip_lines.append(format_html("VLAN {}({}) → ⚠ Not in NetBox", vid, vlan_type))
             else:
                 group_info = vlan_group_map.get(vid, {})
                 group_name = group_info.get("group_name", "Global")
-                tooltip_lines.append(f"VLAN {vid}({vlan_type}) → {escape(group_name)}")
-        tooltip_text = "&#10;".join(tooltip_lines)
+                tooltip_lines.append(format_html("VLAN {}({}) → {}", vid, vlan_type, group_name))
+        tooltip_text = mark_safe("&#10;".join(str(line) for line in tooltip_lines))
 
         # Build hidden inputs for per-VLAN group selections (submitted with form)
         hidden_inputs = []
@@ -282,8 +295,8 @@ def render_vlans(self, value, record):
 
         return format_html(
             '<span title="{}">{}</span>{}{}',
-            mark_safe(tooltip_text),
-            mark_safe(summary),
+            tooltip_text,
+            summary,
             edit_btn,
             hidden_inputs_html,
         )
@@ -355,29 +368,31 @@ def render_mtu(self, value, record):
     def render_librenms_id(self, value, record):
         """Render the 'librenms_id' field with appropriate styling based on comparison with NetBox."""
 
+        # Same XSS guard as _render_field: value/netbox_librenms_id originate outside NetBox, so
+        # use format_html to auto-escape both the body and the title attribute (issue #105).
         if not record.get("exists_in_netbox"):
-            return mark_safe(f'<span class="text-danger">{value}</span>')
+            return format_html('<span class="text-danger">{}</span>', value)
 
         netbox_interface = record.get("netbox_interface")
         if not netbox_interface:
-            return mark_safe(f'<span class="text-danger">{value}</span>')
+            return format_html('<span class="text-danger">{}</span>', value)
 
         netbox_librenms_id = get_librenms_device_id(netbox_interface, self.server_key, auto_save=False)
 
         if netbox_librenms_id is None:
-            return mark_safe(
-                f'<span class="text-danger" title="No librenms_id custom field value found">{value}</span>'
+            return format_html(
+                '<span class="text-danger" title="No librenms_id custom field value found">{}</span>', value
             )
 
         # Compare the IDs
         if str(value) != str(netbox_librenms_id):
             # IDs do not match
-            return mark_safe(
-                f'<span class="text-warning" title="Existing LibreNMS ID: {netbox_librenms_id}">{value}</span>'
+            return format_html(
+                '<span class="text-warning" title="Existing LibreNMS ID: {}">{}</span>', netbox_librenms_id, value
             )
         else:
             # IDs match
-            return mark_safe(f'<span class="text-success">{value}</span>')
+            return format_html('<span class="text-success">{}</span>', value)
 
     def _compare_mac_addresses(self, librenms_mac, netbox_interface):
         """
@@ -399,17 +414,20 @@ def _compare_mac_addresses(self, librenms_mac, netbox_interface):
     def _render_field(self, value, record, librenms_key, netbox_key):
         """Render a field value with appropriate styling based on the comparison with NetBox."""
 
+        # value is an untrusted LibreNMS field (ifName, description, MAC, …). Use format_html so
+        # it is auto-escaped — a device reporting e.g. ifName="<img src=x onerror=alert(1)>" must
+        # not render as live HTML (stored XSS, issue #105). The class names stay literal.
         if not record.get("exists_in_netbox"):
-            return mark_safe(f'<span class="text-danger">{value}</span>')
+            return format_html('<span class="text-danger">{}</span>', value)
 
         netbox_interface = record.get("netbox_interface")
         if not netbox_interface:
-            return mark_safe(f'<span class="text-danger">{value}</span>')
+            return format_html('<span class="text-danger">{}</span>', value)
 
         if librenms_key == "ifPhysAddress":
             mac_matches = self._compare_mac_addresses(value, netbox_interface)
             css_class = "text-success" if mac_matches else "text-warning"
-            return mark_safe(f'<span class="{css_class}">{value}</span>')
+            return format_html('<span class="{}">{}</span>', css_class, value)
 
         netbox_value = getattr(netbox_interface, netbox_key, None)
         librenms_value = record.get(librenms_key)
@@ -418,9 +436,9 @@ def _render_field(self, value, record, librenms_key, netbox_key):
             librenms_value = convert_speed_to_kbps(librenms_value)
 
         if librenms_value != netbox_value:
-            return mark_safe(f'<span class="text-warning">{value}</span>')
+            return format_html('<span class="text-warning">{}</span>', value)
 
-        return mark_safe(f'<span class="text-success">{value}</span>')
+        return format_html('<span class="text-success">{}</span>', value)
 
     def render_type(self, value, record):
         """Render interface type with appropriate styling based on comparison with NetBox"""
@@ -445,18 +463,23 @@ def render_type(self, value, record):
         return format_html('<span class="text-danger">{}</span>', combined_display)
 
     def get_interface_mapping(self, librenms_type, speed):
-        """Get interface type mapping based on type and speed"""
-
-        # First try exact match with type and speed
-        mapping = InterfaceTypeMapping.objects.filter(librenms_type=librenms_type, librenms_speed=speed).first()
-
-        # If no match found, fall back to type-only match
-        if not mapping:
-            mapping = InterfaceTypeMapping.objects.filter(
-                librenms_type=librenms_type, librenms_speed__isnull=True
-            ).first()
+        """Get interface type mapping based on type and speed.
 
-        return mapping
+        Resolves from a single in-memory snapshot of the (small, static)
+        InterfaceTypeMapping table, built on first use, so a table render doesn't
+        issue 1-2 queries per interface row.
+        """
+        if getattr(self, "_interface_type_mapping_cache", None) is None:
+            cache = {}
+            # Keep the FIRST mapping per key to match the previous .filter().first() semantics.
+            for m in InterfaceTypeMapping.objects.all():
+                cache.setdefault((m.librenms_type, m.librenms_speed), m)
+            self._interface_type_mapping_cache = cache
+
+        # Exact (type, speed) match, then the type-only (speed is NULL) fallback.
+        return self._interface_type_mapping_cache.get((librenms_type, speed)) or self._interface_type_mapping_cache.get(
+            (librenms_type, None)
+        )
 
     def render_mapping_tooltip(self, value, speed, mapping):
         """Render tooltip for interface type mapping"""
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
index fa1d3c0d73..7bb4aeca25 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
@@ -7,19 +7,24 @@ <h2>Interface Sync</h2>
     <div class="btn-list">
         <form method="post">
             {% csrf_token %}
+            {# Carry the active server_key so the refresh hits the right LibreNMS server/cache (else a non-default server tab uses the fallback). #}
+            {% if server_key %}<input type="hidden" name="server_key" value="{{ server_key }}">{% endif %}
             {% if has_librenms_id %}
                 {% with model_name=object|meta:"model_name" %}
                     {% if model_name == "device" %}
-                        <button hx-post="{% url 'plugins:netbox_librenms_plugin:device_interface_sync' pk=object.pk %}"
+                        {# type="button": HTMX drives the POST via hx-post; the default type="submit" would also fire a native form submit. #}
+                        <button type="button"
+                                hx-post="{% url 'plugins:netbox_librenms_plugin:device_interface_sync' pk=object.pk %}"
                                 hx-target="#interface-sync-content"
-                                hx-include="[name='interface_name_field']"
+                                hx-include="[name='interface_name_field'], [name='server_key']"
                                 class="btn btn-outline-primary">
                             Refresh Interfaces
                         </button>
                     {% elif model_name == "virtualmachine" %}
-                        <button hx-post="{% url 'plugins:netbox_librenms_plugin:vm_interface_sync' pk=object.pk %}"
+                        <button type="button"
+                                hx-post="{% url 'plugins:netbox_librenms_plugin:vm_interface_sync' pk=object.pk %}"
                                 hx-target="#interface-sync-content"
-                                hx-include="[name='interface_name_field']"
+                                hx-include="[name='interface_name_field'], [name='server_key']"
                                 class="btn btn-outline-primary">
                             Refresh Interfaces
                         </button>
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
index c8a51bdcad..5620026c9b 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
@@ -305,7 +305,8 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                                 <tr>
                                     <th>
                                         <input type="checkbox" id="select-all-netbox-interfaces"
-                                            class="form-check-input">
+                                            class="form-check-input"
+                                            aria-label="Select all NetBox-only interfaces">
                                     </th>
                                     <th>Interface Name</th>
                                     <th>Type</th>
@@ -318,7 +319,8 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                                 <tr>
                                     <td>
                                         <input type="checkbox" name="interface_ids" value="{{ interface.id }}"
-                                            class="form-check-input netbox-interface-checkbox">
+                                            class="form-check-input netbox-interface-checkbox"
+                                            aria-label="Select interface {{ interface.name }}">
                                     </td>
                                     <td>
                                         <a href="{{ interface.url }}" target="_blank">{{ interface.name }}</a>
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/device_validation_details.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/device_validation_details.html
index 7cedbc8c67..b9e2c3837a 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/device_validation_details.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/device_validation_details.html
@@ -497,6 +497,8 @@ <h6 class="card-header d-flex justify-content-between align-items-center">
               hx-swap="none"
               hx-include="#use-sysname-toggle, #strip-domain-toggle">
           {% csrf_token %}
+          {# server_key keeps the action scoped to the active LibreNMS server (issue #106). #}
+          <input type="hidden" name="server_key" value="{{ server_key }}">
           <input type="hidden" name="existing_device_id" value="{{ validation.existing_device.pk }}">
           <input type="hidden" name="existing_device_type" value="{{ existing_device_model_name|default:'device' }}">
           {% if validation.device_type_mismatch %}
@@ -546,6 +548,8 @@ <h6 class="card-header d-flex justify-content-between align-items-center">
               hx-swap="none"
               hx-include="#use-sysname-toggle, #strip-domain-toggle">
           {% csrf_token %}
+          {# server_key keeps the action scoped to the active LibreNMS server (issue #106). #}
+          <input type="hidden" name="server_key" value="{{ server_key }}">
           <input type="hidden" name="existing_device_id" value="{{ validation.existing_device.pk }}">
           <input type="hidden" name="existing_device_type" value="{{ existing_device_model_name|default:'device' }}">
           {% if validation.device_type_mismatch %}
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py b/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
index e3c91942b9..7406c76163 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
@@ -163,6 +163,46 @@ def test_cache_hit_returns_ports(self):
 
         assert result == ports
 
+    def test_malformed_cached_ports_treated_as_miss(self):
+        """A stale/malformed cache entry (ports not a list of dicts, e.g."""
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.get_cache_key = MagicMock(return_value="k")
+        req = _make_request()
+        mock_obj = MagicMock(pk=1)
+
+        for bad in ({"ports": None}, {"ports": "oops"}, {"ports": [None]}, ["not-a-dict"]):
+            with (
+                patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
+                patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
+            ):
+                mock_cache.get.return_value = bad
+                result = view.get_cached_ports_data(req, mock_obj, "default")
+
+            assert result is None, f"malformed {bad!r} should be a miss"
+            mock_msgs.warning.assert_called_once()
+
+    def test_dict_without_ports_key_is_noop_not_miss(self):
+        """A cached dict that simply lacks a 'ports' key is a harmless empty no-op (historical behavior), not a 'refresh first' abort — only PRESENT-but-malformed ports fail closed."""
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.get_cache_key = MagicMock(return_value="k")
+        req = _make_request()
+        mock_obj = MagicMock(pk=1)
+
+        for empty in ({}, {"librenms_id": 5}, {"ports": []}):
+            with (
+                patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
+                patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
+            ):
+                mock_cache.get.return_value = empty
+                result = view.get_cached_ports_data(req, mock_obj, "default")
+
+            assert result == [], f"{empty!r} should be an empty no-op, not a miss"
+            mock_msgs.warning.assert_not_called()
+
     def test_no_server_key_uses_librenms_api(self):
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
@@ -316,6 +356,57 @@ def test_vm_post_success(self):
         mock_redirect.assert_called_once()
 
 
+class TestSyncInterfacesViewServerKeyAndRedirect:
+    """Issues #107/#108/#109: the POST server_key must be validated against configured servers before it scopes cache/CF lookups, and interface_name_field must be URL-escaped in the post-sync redirect."""
+
+    def _make_view(self, configured_servers):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.require_all_permissions = MagicMock(return_value=None)
+        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
+        mock_api = MagicMock(server_key="default")
+        mock_api.get_available_servers.return_value = configured_servers
+        return view, mock_api
+
+    def _run_no_selection(self, view, mock_api, post_data, name_field="ifName"):
+        """Drive post() down the no-selection redirect path (server_key + redirect_url are set before that), returning the redirect call mock."""
+        with (
+            patch("netbox_librenms_plugin.views.sync.interfaces.get_object_or_404", return_value=MagicMock(pk=1)),
+            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value=name_field),
+            patch("netbox_librenms_plugin.views.sync.interfaces.messages"),
+            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
+            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
+            # The POSTed key is validated via the LibreNMSAPI classmethod (not the instance property)
+            # so a misconfigured default client is never built during validation — mock the classmethod.
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value=mock_api.get_available_servers.return_value,
+            ),
+            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
+        ):
+            view.post(_make_request(post_data=post_data), "device", 1)
+        return mock_redirect
+
+    def test_unconfigured_server_key_falls_back_to_active(self):
+        view, mock_api = self._make_view({"default": "Default", "secondary": "Secondary"})
+        self._run_no_selection(view, mock_api, {"server_key": "evil-server"})
+        # The forged key is not configured, so it is dropped in favour of the active server.
+        assert view._post_server_key == "default"
+
+    def test_configured_server_key_is_honoured(self):
+        view, mock_api = self._make_view({"default": "Default", "secondary": "Secondary"})
+        self._run_no_selection(view, mock_api, {"server_key": "secondary"})
+        assert view._post_server_key == "secondary"
+
+    def test_interface_name_field_is_url_escaped_in_redirect(self):
+        view, mock_api = self._make_view({"default": "Default"})
+        mock_redirect = self._run_no_selection(view, mock_api, {}, name_field="ifName&injected=1")
+        url = mock_redirect.call_args.args[0]
+        assert "ifName%26injected%3D1" in url
+        assert "ifName&injected=1" not in url
+
+
 # ===========================================================================
 # SyncInterfacesView.sync_interface — Device paths
 # ===========================================================================
@@ -1308,3 +1399,44 @@ class _DNE(Exception):
         assert data["deleted_count"] == 1
         assert "error" in data["message"]
         mock_interface_ok.delete.assert_called_once()
+
+
+class TestSyncInterfacesViewServerKeyValidation:
+    """A POSTed valid non-default server_key must be validated via the LibreNMSAPI classmethod.
+
+    Touching the ``self.librenms_api`` instance property builds the default/selected client, so a
+    misconfigured default would 500 a sync the user legitimately requested on a working non-default
+    server. The POSTed key only scopes cache + librenms_id CF reads, so validation must not build.
+    """
+
+    def test_valid_server_key_does_not_build_default_client(self):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.require_all_permissions = MagicMock(return_value=None)
+        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
+        view.get_object = MagicMock(return_value=MagicMock(pk=7))
+        # No selection → redirect right after server_key is resolved (keeps the test focused).
+        view.get_selected_interfaces = MagicMock(return_value=None)
+
+        def _boom(self):
+            raise RuntimeError("default LibreNMS client build must not happen during key validation")
+
+        request = _make_request(post_data={"server_key": "production"})
+
+        with (
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"production": {"url": "u", "token": "t"}},
+            ),
+            patch.object(type(view), "librenms_api", property(_boom)),
+            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
+            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
+            patch("netbox_librenms_plugin.views.sync.interfaces.redirect", side_effect=lambda url: url),
+        ):
+            result = view.post(request, object_type="device", object_id=7)
+
+        # Fixed: classmethod validates "production" without touching the property. Unfixed:
+        # self.librenms_api.get_available_servers() builds the misconfigured default → RuntimeError.
+        assert view._post_server_key == "production"
+        assert "server_key=production" in result
diff --git a/netbox_librenms_plugin/tests/test_interface_sync_button_type.py b/netbox_librenms_plugin/tests/test_interface_sync_button_type.py
new file mode 100644
index 0000000000..1c9ad42b58
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_interface_sync_button_type.py
@@ -0,0 +1,53 @@
+"""Issue #116 (CodeRabbit): the HTMX "Refresh Interfaces" buttons in _interface_sync.html
+must declare type="button". They live inside a <form method="post"> and drive their POST via
+hx-post; the HTML default of type="submit" would also fire a native form submit on click.
+
+The device branch is rendered for real against a real Device (the ``meta`` filter resolves
+model_name to "device"); a source-structure check covers the VM branch too without heavy VM
+scaffolding.
+"""
+
+import pathlib
+import re
+
+import pytest
+from django.contrib.auth.models import AnonymousUser
+from django.template.loader import get_template, render_to_string
+from django.test import RequestFactory
+
+TEMPLATE = "netbox_librenms_plugin/_interface_sync.html"
+
+
+def test_every_button_declares_type():
+    """Every <button> in the template declares an explicit type (no implicit submit)."""
+    src = pathlib.Path(get_template(TEMPLATE).origin.name).read_text()
+    buttons = re.findall(r"<button\b[^>]*>", src, re.DOTALL)
+    assert buttons, "expected at least one <button> in the template"
+    untyped = [b for b in buttons if not re.search(r'\btype\s*=\s*"[^"]+"', b)]
+    assert not untyped, f"buttons without an explicit type attribute: {untyped}"
+
+
+@pytest.mark.django_db
+def test_device_refresh_button_renders_type_button():
+    """The device Refresh-Interfaces button renders with type="button", not a submit."""
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="ACME-116b", slug="acme-116b")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-116b", slug="dt-116b")
+    role, _ = DeviceRole.objects.get_or_create(name="Role-116b", slug="role-116b")
+    site, _ = Site.objects.get_or_create(name="Site-116b", slug="site-116b")
+    device = Device.objects.create(name="btn-type-host", device_type=dt, role=role, site=site, status="active")
+
+    request = RequestFactory().get("/")
+    request.user = AnonymousUser()
+    html = render_to_string(
+        TEMPLATE,
+        {"object": device, "has_librenms_id": True, "server_key": "default"},
+        request=request,
+    )
+
+    # Scope to the Refresh Interfaces button(s) — the included content template renders other
+    # buttons (modal close etc.) that are out of scope for this finding.
+    refresh_buttons = [b for b in re.findall(r"<button\b.*?</button>", html, re.DOTALL) if "Refresh Interfaces" in b]
+    assert refresh_buttons, "device branch should render a Refresh Interfaces button"
+    assert all('type="button"' in b for b in refresh_buttons), refresh_buttons
diff --git a/netbox_librenms_plugin/tests/test_ip_verify.py b/netbox_librenms_plugin/tests/test_ip_verify.py
index c7971ad779..a469d2d132 100644
--- a/netbox_librenms_plugin/tests/test_ip_verify.py
+++ b/netbox_librenms_plugin/tests/test_ip_verify.py
@@ -19,6 +19,9 @@ def _make_view():
     from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
 
     view = object.__new__(SingleIPAddressVerifyView)
+    # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+    # gate; the gate itself is covered by TestSingleIPAddressVerifyObjectPermissionGate (real DB).
+    view.require_object_permissions_json = MagicMock(return_value=None)
     return view
 
 
@@ -88,6 +91,9 @@ def _run_post(self, body, device=None):
             device = _mock_device()
 
         request = _make_request(body)
+        # Direct post() bypasses dispatch(); _get_object reads self.request.user to object-scope the
+        # lookup, so supply the request the view would otherwise get from dispatch.
+        view.request = request
         captured_cache_key = {}
 
         def fake_cache_get(key):
@@ -99,6 +105,13 @@ def fake_cache_get(key):
                 "netbox_librenms_plugin.views.base.ip_addresses_view.get_object_or_404",
                 return_value=device,
             ),
+            # The verify gate validates server_key against configured servers before using it as a
+            # cache namespace; configure "prod" so a posted "prod" threads through, while an absent
+            # or unconfigured key still falls back to "default".
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"prod": "Prod"},
+            ),
             patch("netbox_librenms_plugin.views.base.ip_addresses_view.cache") as mock_cache,
         ):
             mock_cache.get.side_effect = fake_cache_get
@@ -135,3 +148,56 @@ def test_null_server_key_falls_back_to_default(self):
         )
 
         assert key == "librenms_ip_addresses_device_5_default"
+
+
+class TestVerifyPostRejectsNonObjectBody:
+    """A non-object JSON body must 400, not 500 on .get()."""
+
+    def test_non_dict_json_returns_400(self):
+        """A JSON array body returns 400 before any .get(), instead of raising AttributeError."""
+        view = _make_view()
+        request = _make_request([1, 2, 3])  # valid JSON, but an array — not an object
+
+        response = view.post(request)
+
+        assert response.status_code == 400
+        assert json.loads(response.content)["message"] == "JSON payload must be an object"
+
+
+class TestFindInCacheFailsClosed:
+    """SingleIPAddressVerifyView._find_in_cache treats a truthy non-dict entry as a miss, not a crash."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
+
+        return object.__new__(SingleIPAddressVerifyView)
+
+    def test_non_dict_cache_entry_returns_empty_triple(self):
+        """A list (legacy snapshot shape) must not raise AttributeError on .get()."""
+        view = self._make_view()
+        assert view._find_in_cache([{"ip_address": "10.0.0.1"}], "10.0.0.1", 32) == (None, None, None)
+
+    def test_dict_cache_entry_still_matches(self):
+        """Positive control: a well-formed dict entry still resolves normally."""
+        view = self._make_view()
+        cached = {"ip_addresses": [{"ip_address": "10.0.0.1", "prefix_length": 32, "vrf_id": 7, "port_id": 5}]}
+        entry, vrf_id, port_id = view._find_in_cache(cached, "10.0.0.1", 32)
+        assert entry is not None and vrf_id == 7 and port_id == 5
+
+    def test_malformed_row_among_ip_addresses_is_skipped(self):
+        """A non-dict row inside ip_addresses must be skipped (not TypeError'd) so a later good row still matches."""
+        view = self._make_view()
+        cached = {
+            "ip_addresses": [
+                "not-a-dict",
+                ["also", "bad"],
+                {"ip_address": "10.0.0.1", "prefix_length": 32, "vrf_id": 7, "port_id": 5},
+            ]
+        }
+        entry, vrf_id, port_id = view._find_in_cache(cached, "10.0.0.1", 32)
+        assert entry is not None and vrf_id == 7 and port_id == 5
+
+    def test_all_rows_malformed_returns_empty_triple(self):
+        """When every row is malformed, the lookup is a clean miss rather than a crash."""
+        view = self._make_view()
+        assert view._find_in_cache({"ip_addresses": ["x", 5, None]}, "10.0.0.1", 32) == (None, None, None)
diff --git a/netbox_librenms_plugin/tests/test_permissions.py b/netbox_librenms_plugin/tests/test_permissions.py
index e75d665e83..aee27e66b6 100644
--- a/netbox_librenms_plugin/tests/test_permissions.py
+++ b/netbox_librenms_plugin/tests/test_permissions.py
@@ -633,6 +633,18 @@ class TestView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin):
 class TestBulkImportPermissions:
     """Tests for permission checks in bulk import functions."""
 
+    def setup_method(self):
+        # bulk_import_devices_shared preloads device_type NormalizationRule once (issue #90);
+        # these are mock-based (no DB), so stub the preload to avoid real DB access.
+        self._norm_patcher = patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        )
+        self._norm_patcher.start()
+
+    def teardown_method(self):
+        self._norm_patcher.stop()
+
     @patch("netbox_librenms_plugin.import_utils.bulk_import.require_permissions")
     @patch("netbox_librenms_plugin.import_utils.bulk_import.LibreNMSAPI")
     def test_bulk_import_devices_checks_permissions(self, mock_api_class, mock_require):
@@ -874,6 +886,16 @@ def test_htmx_rejects_external_referrer(self):
 class TestBulkImportVCPermission:
     """Tests that bulk import checks virtualchassis permission."""
 
+    def setup_method(self):
+        self._norm_patcher = patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        )
+        self._norm_patcher.start()
+
+    def teardown_method(self):
+        self._norm_patcher.stop()
+
     @patch("netbox_librenms_plugin.import_utils.bulk_import.require_permissions")
     @patch("netbox_librenms_plugin.import_utils.bulk_import.LibreNMSAPI")
     def test_bulk_import_devices_checks_vc_permission(self, mock_api_class, mock_require):
diff --git a/netbox_librenms_plugin/tests/test_validation_template_server_key.py b/netbox_librenms_plugin/tests/test_validation_template_server_key.py
new file mode 100644
index 0000000000..73a9cf0122
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_validation_template_server_key.py
@@ -0,0 +1,37 @@
+"""Issue #106: device_conflict_action forms that write a server-scoped LibreNMS mapping
+(link / update / update_serial — the serial/hostname-match forms) must carry a server_key
+hidden input, or on a non-default server the POST rebind silently falls back to "default" and
+writes the wrong mapping/cache scope. Field-sync actions (sync_name, sync_device_type,
+sync_platform, …) only touch NetBox fields and need no server_key, so they are exempt.
+
+A structural check of the real template source (the htmx fragment is too branch-heavy to render
+standalone under the strict test template settings).
+"""
+
+import pathlib
+import re
+
+from django.template.loader import get_template
+
+TEMPLATE = "netbox_librenms_plugin/htmx/device_validation_details.html"
+
+# Actions that persist a server-scoped librenms_id mapping (need the active server_key).
+MAPPING_ACTIONS = {"link", "update", "update_serial", "migrate_librenms_id"}
+
+
+def _form_actions(form_html):
+    return set(
+        re.findall(r'name="action"\s+value="([^"]+)"', form_html)
+        + re.findall(r'value="([^"]+)"\s+name="action"', form_html)
+    )
+
+
+def test_mapping_writing_conflict_forms_include_server_key():
+    src = pathlib.Path(get_template(TEMPLATE).origin.name).read_text()
+    forms = [f for f in re.findall(r"<form\b.*?</form>", src, re.DOTALL) if "device_conflict_action" in f]
+
+    mapping_forms = [f for f in forms if _form_actions(f) & MAPPING_ACTIONS]
+    assert mapping_forms, "expected mapping-writing device_conflict_action forms in the template"
+
+    missing = [sorted(_form_actions(f)) for f in mapping_forms if 'name="server_key"' not in f]
+    assert not missing, f"mapping-writing forms missing a server_key hidden input: {missing}"
diff --git a/netbox_librenms_plugin/tests/test_verify_views.py b/netbox_librenms_plugin/tests/test_verify_views.py
index 683ecf18ed..580caf1f79 100644
--- a/netbox_librenms_plugin/tests/test_verify_views.py
+++ b/netbox_librenms_plugin/tests/test_verify_views.py
@@ -8,6 +8,9 @@
 import json
 from unittest.mock import MagicMock, patch
 
+import pytest
+from django.test import RequestFactory
+
 
 def _make_request(body: dict) -> MagicMock:
     """Create a mock POST request with JSON body."""
@@ -40,6 +43,9 @@ def _make_view(self):
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate; the gate itself is covered in test_coverage_base_views.py.
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
     @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
@@ -107,6 +113,47 @@ def test_no_device_id_returns_empty_row(self):
         assert data["status"] == "success"
         assert data["formatted_row"]["cable_status"] == "Missing Ports"
 
+    @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
+    @patch("netbox_librenms_plugin.views.base.cables_view.cache")
+    def test_malformed_cached_links_fail_closed(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
+        """A corrupt cached links entry must fail closed (empty row + purge), not 500 the verify path."""
+        mock_netbox_device.virtual_chassis = None
+        mock_get_obj.return_value = mock_netbox_device
+        # A non-dict link row: the old code iterates it and calls str.get(...) → AttributeError.
+        mock_cache.get.return_value = {"links": ["not-a-dict"]}
+
+        view = self._make_view()
+        request = _make_request({"device_id": 5, "local_port_id": "10"})
+        response = view.post(request)
+
+        data = json.loads(response.content)
+        assert data["status"] == "success"
+        assert data["formatted_row"]["cable_status"] == "Missing Ports"
+        # The corrupt entry is purged so the next verify doesn't keep serving garbage.
+        mock_cache.delete.assert_called_once()
+
+
+def test_extract_cached_links_fails_closed_and_purges_malformed_entries():
+    """_extract_cached_links (shared by the cached GET render and the verify path) must reject a corrupt entry and purge its key, using the REAL cache."""
+    from django.core.cache import cache as real_cache
+
+    from netbox_librenms_plugin.views.base.cables_view import _extract_cached_links
+
+    key = "test-cables-malformed-links-key"
+    for bad in (["junk"], "corrupt", {"links": None}, {"links": ["bad"]}, {"links": [{"ok": 1}, 5]}):
+        real_cache.set(key, bad)
+        assert _extract_cached_links(real_cache.get(key), key) is None
+        assert real_cache.get(key) is None  # purged
+
+    # A well-formed entry passes through unchanged (and is NOT purged).
+    real_cache.set(key, {"links": [{"local_port_id": 1}]})
+    try:
+        assert _extract_cached_links(real_cache.get(key), key) == [{"local_port_id": 1}]
+        assert real_cache.get(key) == {"links": [{"local_port_id": 1}]}
+    finally:
+        real_cache.delete(key)
+
 
 # ---------------------------------------------------------------------------
 # SingleInterfaceVerifyView
@@ -119,6 +166,9 @@ def _make_view(self):
 
         view = object.__new__(SingleInterfaceVerifyView)
         view._librenms_api = MagicMock()
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate; permission ordering is covered in test_coverage_devices.py.
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404")
@@ -203,3 +253,496 @@ def test_no_device_id_returns_400(self):
         assert response.status_code == 400
         data = json.loads(response.content)
         assert data["status"] == "error"
+
+
+# ---------------------------------------------------------------------------
+# SingleIPAddressVerifyView — object-permission gate (real DB, real has_perm)
+# ---------------------------------------------------------------------------
+def _make_gate_device(name="ipgate-dev"):
+    """Create a real Device for the IP-verify object-permission gate tests."""
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="IPGate-Mfr", slug="ipgate-mfr")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="IPGate-DT", slug="ipgate-dt")
+    role, _ = DeviceRole.objects.get_or_create(name="IPGate-Role", slug="ipgate-role")
+    site, _ = Site.objects.get_or_create(name="IPGate-Site", slug="ipgate-site")
+    return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
+
+
+def _make_gate_vm(name="ipgate-vm"):
+    """Create a real VirtualMachine for the IP-verify object-permission gate tests."""
+    from virtualization.models import Cluster, ClusterType, VirtualMachine
+
+    ct, _ = ClusterType.objects.get_or_create(name="IPGate-CT", slug="ipgate-ct")
+    cluster, _ = Cluster.objects.get_or_create(name="IPGate-Cluster", type=ct)
+    return VirtualMachine.objects.create(name=name, cluster=cluster, status="active")
+
+
+@pytest.mark.django_db
+class TestSingleIPAddressVerifyObjectPermissionGate:
+    """SingleIPAddressVerifyView must gate POST on dcim.view_device.
+
+    The read-only verify endpoint resolves an arbitrary ``device_id`` from the
+    JSON body and returns that object's name/url/cached rows. Without the gate a
+    caller with only plugin-view rights could probe and read back objects they
+    cannot see (mirrors the interface/module/cable verify views' hardening).
+
+    These exercise the REAL gate end-to-end: a real Device, a real (non-super)
+    user, real NetBox ObjectPermission grants and real ``has_perm`` — no mocks.
+    """
+
+    def _post(self, user, device_id, object_type=None):
+        from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
+
+        payload = {"device_id": device_id, "ip_address": "1.2.3.4/24"}
+        if object_type is not None:
+            payload["object_type"] = object_type
+        request = RequestFactory().post(
+            "/plugins/librenms_plugin/verify-ipaddress/",
+            data=json.dumps(payload),
+            content_type="application/json",
+        )
+        request.user = user
+        # Direct post() bypasses dispatch(); supply the request the gate reads.
+        view = SingleIPAddressVerifyView()
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+        return view.post(request)
+
+    def test_user_without_view_device_is_denied(self):
+        """A user lacking dcim.view_device is refused (403) before any object data is read."""
+        from django.contrib.auth import get_user_model
+
+        device = _make_gate_device()
+        user = get_user_model().objects.create_user(username="ipgate-noperm", password="x")
+
+        response = self._post(user, device.pk)
+
+        assert response.status_code == 403
+        # The denied response must NOT leak the hidden device's name.
+        assert device.name.encode() not in response.content
+
+    def test_user_with_view_device_passes_gate(self):
+        """A user granted dcim.view_device clears the gate (non-403, normal 200 path)."""
+        from core.models import ObjectType
+        from dcim.models import Device
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+
+        device = _make_gate_device(name="ipgate-dev2")
+        user = get_user_model().objects.create_user(username="ipgate-perm", password="x")
+        perm = ObjectPermission.objects.create(name="ipgate-view-device", actions=["view"])
+        perm.object_types.set([ObjectType.objects.get_for_model(Device)])
+        perm.users.set([user])
+        # Re-fetch to clear NetBox's per-request object-permission cache on the user.
+        user = get_user_model().objects.get(pk=user.pk)
+
+        response = self._post(user, device.pk)
+
+        assert response.status_code != 403
+
+    def test_device_view_only_user_denied_vm_data(self):
+        """A user with only dcim.view_device must NOT read VirtualMachine data through this endpoint."""
+        from core.models import ObjectType
+        from dcim.models import Device
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+
+        vm = _make_gate_vm()
+        user = get_user_model().objects.create_user(username="ipgate-devonly", password="x")
+        perm = ObjectPermission.objects.create(name="ipgate-view-dev-only", actions=["view"])
+        perm.object_types.set([ObjectType.objects.get_for_model(Device)])
+        perm.users.set([user])
+        user = get_user_model().objects.get(pk=user.pk)
+
+        # The static Device-only gate would have let this through (the user HAS dcim.view_device),
+        # leaking VM data; the per-object gate must require virtualization.view_virtualmachine.
+        response = self._post(user, vm.pk, object_type="virtualmachine")
+
+        assert response.status_code == 403
+        assert vm.name.encode() not in response.content
+
+    def test_vm_view_user_passes_gate_for_vm(self):
+        """A user granted virtualization.view_virtualmachine clears the gate for a VM target."""
+        from core.models import ObjectType
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+        from virtualization.models import VirtualMachine
+
+        vm = _make_gate_vm(name="ipgate-vm2")
+        user = get_user_model().objects.create_user(username="ipgate-vmperm", password="x")
+        perm = ObjectPermission.objects.create(name="ipgate-view-vm", actions=["view"])
+        perm.object_types.set([ObjectType.objects.get_for_model(VirtualMachine)])
+        perm.users.set([user])
+        user = get_user_model().objects.get(pk=user.pk)
+
+        response = self._post(user, vm.pk, object_type="virtualmachine")
+
+        assert response.status_code != 403
+
+    def test_vm_target_without_object_type_resolves_model_and_denies_device_only_user(self):
+        """Even with no object_type, a VM id resolves to its model so a Device-only user is denied."""
+        from core.models import ObjectType
+        from dcim.models import Device
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+
+        vm = _make_gate_vm(name="ipgate-vm3")
+        user = get_user_model().objects.create_user(username="ipgate-devonly2", password="x")
+        perm = ObjectPermission.objects.create(name="ipgate-view-dev-only2", actions=["view"])
+        perm.object_types.set([ObjectType.objects.get_for_model(Device)])
+        perm.users.set([user])
+        user = get_user_model().objects.get(pk=user.pk)
+
+        response = self._post(user, vm.pk)  # no object_type — server resolves the id to a VM
+
+        assert response.status_code == 403
+        assert vm.name.encode() not in response.content
+
+
+@pytest.mark.django_db
+class TestSingleIPAddressVerifyServerKeyCacheNamespace:
+    """The verify POST must validate server_key before using it as a cache namespace.
+
+    A forged/unconfigured key must not let a caller address an arbitrary server-key cache
+    namespace; it falls back to a configured server (mirrors the sync/cable hardening).
+    """
+
+    def test_forged_server_key_falls_back_to_configured_namespace(self):
+        from unittest.mock import patch
+
+        from django.contrib.auth import get_user_model
+
+        from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
+
+        device = _make_gate_device(name="ipgate-srvkey")
+        user = get_user_model().objects.create_user(username="ipgate-srvkey-su", password="x", is_superuser=True)
+        user = get_user_model().objects.get(pk=user.pk)
+
+        request = RequestFactory().post(
+            "/plugins/librenms_plugin/verify-ipaddress/",
+            data=json.dumps(
+                {
+                    "device_id": device.pk,
+                    "ip_address": "1.2.3.4/24",
+                    "object_type": "device",
+                    "server_key": "evil-namespace",  # not a configured server
+                }
+            ),
+            content_type="application/json",
+        )
+        request.user = user
+        view = SingleIPAddressVerifyView()
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+
+        captured = {}
+        original_get_cache_key = view.get_cache_key
+
+        def spy(obj, data_type="ports", server_key=None):
+            captured["server_key"] = server_key
+            return original_get_cache_key(obj, data_type, server_key)
+
+        view.get_cache_key = spy
+
+        servers = {
+            "alpha": {"librenms_url": "https://a.example.com", "api_token": "t"},
+            "beta": {"librenms_url": "https://b.example.com", "api_token": "t"},
+        }
+        with patch(
+            "netbox_librenms_plugin.librenms_api.get_plugin_config",
+            side_effect=lambda app, key, default=None: servers if key == "servers" else default,
+        ):
+            view.post(request)
+
+        # The forged key never reaches the cache namespace: it falls back to the fixed "default"
+        # (the only non-configured namespace a caller can ever address), never "evil-namespace".
+        assert captured.get("server_key") == "default"
+        assert captured.get("server_key") != "evil-namespace"
+
+
+# ---------------------------------------------------------------------------
+# server_key guards on the interface/module verify + VLAN overrides endpoints
+# (real DB, only the plugin-config boundary patched)
+# ---------------------------------------------------------------------------
+_GUARD_SERVERS = {
+    "alpha": {"librenms_url": "https://a.example.com", "api_token": "t"},
+    "beta": {"librenms_url": "https://b.example.com", "api_token": "t"},
+}
+
+
+def _patch_servers_config():
+    from unittest.mock import patch as _patch
+
+    return _patch(
+        "netbox_librenms_plugin.librenms_api.get_plugin_config",
+        side_effect=lambda app, key, default=None: _GUARD_SERVERS if key == "servers" else default,
+    )
+
+
+def _make_vc_member_device(name="srvkey-vc-dev"):
+    """A real VC-member Device: the unguarded views route its server_key into cf_dict.get()."""
+    from dcim.models import VirtualChassis
+
+    device = _make_gate_device(name=name)
+    vc = VirtualChassis.objects.create(name=f"vc-{name}")
+    device.virtual_chassis = vc
+    device.vc_position = 1
+    # A dict-form librenms_id mapping: get_librenms_sync_device reads this dict with the
+    # caller's server_key, so an unhashable key actually reaches cf_dict.get(["a"]).
+    device.custom_field_data["librenms_id"] = {"alpha": 4242}
+    device.save()
+    return device
+
+
+def _superuser(username):
+    from django.contrib.auth import get_user_model
+
+    user = get_user_model().objects.create_user(username=username, password="x", is_superuser=True)
+    return get_user_model().objects.get(pk=user.pk)
+
+
+def _json_post(url, body, user):
+    request = RequestFactory().post(url, data=json.dumps(body), content_type="application/json")
+    request.user = user
+    return request
+
+
+@pytest.mark.django_db
+class TestVerifyEndpointsServerKeyGuard:
+    """A forged/non-string server_key must fall back, not 500 (mirrors the cable/IP siblings).
+
+    A JSON array server_key is unhashable: routed into get_librenms_sync_device it reaches
+    cf_dict.get(["a"]) and raises TypeError, turning these endpoints into 500s where the
+    hardened siblings degrade. A forged string key must also never scope cache access.
+    """
+
+    def test_interface_verify_unhashable_server_key_degrades(self):
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
+        device = _make_vc_member_device(name="srvkey-if-dev")
+        request = _json_post(
+            "/plugins/librenms_plugin/verify-interface/",
+            {"device_id": device.pk, "interface_name": "eth0", "server_key": ["a"]},
+            _superuser("srvkey-if-su"),
+        )
+        view = SingleInterfaceVerifyView()
+        view.request = request
+
+        with _patch_servers_config():
+            response = view.post(request)
+
+        # JSON error/miss response — not a TypeError 500.
+        assert response.status_code in (200, 404)
+
+    def test_module_verify_unhashable_server_key_degrades(self):
+        from netbox_librenms_plugin.views.object_sync.devices import SingleModuleVerifyView
+
+        device = _make_vc_member_device(name="srvkey-mod-dev")
+        request = _json_post(
+            "/plugins/librenms_plugin/verify-module/",
+            {"device_id": device.pk, "ent_physical_index": 7, "server_key": ["a"]},
+            _superuser("srvkey-mod-su"),
+        )
+        view = SingleModuleVerifyView()
+        view.request = request
+
+        with _patch_servers_config():
+            response = view.post(request)
+
+        assert response.status_code in (200, 404)
+
+    def test_vlan_overrides_unhashable_server_key_degrades(self):
+        from netbox_librenms_plugin.views.object_sync.devices import SaveVlanGroupOverridesView
+
+        device = _make_vc_member_device(name="srvkey-vlan-dev")
+        request = _json_post(
+            "/plugins/librenms_plugin/vlan-group-overrides/",
+            {"device_id": device.pk, "vid_group_map": {"10": 1}, "server_key": ["a"]},
+            _superuser("srvkey-vlan-su"),
+        )
+        view = SaveVlanGroupOverridesView()
+        view.request = request
+
+        with _patch_servers_config():
+            response = view.post(request)
+
+        # Falls back and then 400s on the missing ports cache — never a TypeError 500.
+        assert response.status_code == 400
+
+    def test_interface_verify_forged_string_key_never_scopes_cache(self):
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
+        device = _make_gate_device(name="srvkey-forged-dev")
+        request = _json_post(
+            "/plugins/librenms_plugin/verify-interface/",
+            {"device_id": device.pk, "interface_name": "eth0", "server_key": "evil-namespace"},
+            _superuser("srvkey-forged-su"),
+        )
+        view = SingleInterfaceVerifyView()
+        view.request = request
+
+        captured = {}
+        original_get_cache_key = view.get_cache_key
+
+        def spy(obj, data_type="ports", server_key=None):
+            captured["server_key"] = server_key
+            return original_get_cache_key(obj, data_type, server_key)
+
+        view.get_cache_key = spy
+
+        with _patch_servers_config():
+            view.post(request)
+
+        assert captured.get("server_key") != "evil-namespace"
+
+
+@pytest.mark.django_db
+class TestParseRequestJsonRejectsNonObject:
+    """A valid-JSON non-object body must 400 centrally, not AttributeError-500 at data.get()."""
+
+    def test_helper_rejects_list_str_and_number(self):
+        from netbox_librenms_plugin.views.mixins import parse_request_json
+
+        for body in (b"[1]", b'"x"', b"7"):
+            request = MagicMock()
+            request.body = body
+            data, err = parse_request_json(request)
+            assert data is None
+            assert err is not None and err.status_code == 400
+
+    def test_cable_verify_returns_400_for_array_body(self):
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+        request = RequestFactory().post(
+            "/plugins/librenms_plugin/verify-cable/", data="[1]", content_type="application/json"
+        )
+        request.user = _superuser("nonobj-cable-su")
+        view = SingleCableVerifyView()
+        view.request = request
+
+        with _patch_servers_config():
+            response = view.post(request)
+
+        assert response.status_code == 400
+        assert json.loads(response.content)["message"] == "JSON payload must be an object"
+
+
+@pytest.mark.django_db
+class TestInterfaceVerifyMalformedPortsCache:
+    """A truthy but malformed ports cache entry must degrade to the 404 miss path and be purged."""
+
+    def test_corrupt_ports_cache_degrades_and_purges(self):
+        from django.core.cache import cache as real_cache
+
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
+        device = _make_gate_device(name="srvkey-corrupt-dev")
+        request = _json_post(
+            "/plugins/librenms_plugin/verify-interface/",
+            {"device_id": device.pk, "interface_name": "eth0", "server_key": "alpha"},
+            _superuser("srvkey-corrupt-su"),
+        )
+        view = SingleInterfaceVerifyView()
+        view.request = request
+
+        cache_key = view.get_cache_key(device, "ports", "alpha")
+        real_cache.set(cache_key, ["corrupt", "legacy", "shape"], timeout=60)
+        try:
+            with _patch_servers_config():
+                response = view.post(request)
+
+            # Degrades to the not-found miss path instead of AttributeError-500...
+            assert response.status_code == 404
+            # ...and the poisoned entry is purged so it isn't served again.
+            assert real_cache.get(cache_key) is None
+        finally:
+            real_cache.delete(cache_key)
+
+
+@pytest.mark.django_db
+class TestVerifyViewObjectScope:
+    """A *constrained* view_device grant must not resolve out-of-scope devices in the verify views.
+
+    require_object_permissions_json only checks the model-level view_device perm, so a pk/site-scoped
+    grant clears the gate. The device lookup must then object-scope via restrict() so an out-of-scope
+    pk 404s instead of leaking that device's cached verify payload — even when its cache is warm.
+    """
+
+    SERVER_KEY = "default"  # the only configured server in the test env
+
+    @staticmethod
+    def _constrained_user(in_scope_device):
+        from core.models import ObjectType
+        from dcim.models import Device
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+
+        user = get_user_model().objects.create_user(username="scoped-verify", password="x")
+        perm = ObjectPermission.objects.create(
+            name="scoped-view-device", actions=["view"], constraints={"pk": in_scope_device.pk}
+        )
+        perm.object_types.set([ObjectType.objects.get_for_model(Device)])
+        perm.users.set([user])
+        # Re-fetch to clear NetBox's per-request object-permission cache on the user.
+        return get_user_model().objects.get(pk=user.pk)
+
+    def _interface_verify_view(self, user):
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
+        view = SingleInterfaceVerifyView()
+        request = RequestFactory().post("/plugins/librenms_plugin/verify-interface/")
+        request.user = user
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+        return view
+
+    def test_out_of_scope_device_verify_raises_404(self):
+        """The verify endpoint 404s an out-of-scope device even with its ports cache warm (no data leak)."""
+        from django.core.cache import cache as real_cache
+        from django.http import Http404
+
+        in_scope = _make_gate_device(name="scope-in")
+        out_of_scope = _make_gate_device(name="scope-out")
+        user = self._constrained_user(in_scope)
+        view = self._interface_verify_view(user)
+
+        # Warm the OUT-OF-SCOPE device's ports cache: with the old raw get_object_or_404 the device
+        # resolves and the endpoint returns its cached row (the leak). restrict() drops it first.
+        real_cache.set(
+            view.get_cache_key(out_of_scope, "ports", self.SERVER_KEY),
+            {"ports": [{"ifName": "Gi0/0", "port_id": 1}]},
+        )
+        request = RequestFactory().post(
+            "/plugins/librenms_plugin/verify-interface/",
+            data=json.dumps(
+                {
+                    "device_id": out_of_scope.pk,
+                    "interface_name": "Gi0/0",
+                    "interface_name_field": "ifName",
+                    "server_key": self.SERVER_KEY,
+                }
+            ),
+            content_type="application/json",
+        )
+        request.user = user
+        view.request = request
+        # An out-of-scope pk 404s at the lookup like a nonexistent one — never reaching the cache
+        # read (Django's middleware renders Http404 as a 404 for a real request).
+        with pytest.raises(Http404):
+            view.post(request)
+
+    def test_grant_scopes_lookup_to_covered_device(self):
+        """The restricted queryset the endpoint uses covers the in-scope device and excludes others."""
+        from dcim.models import Device
+
+        in_scope = _make_gate_device(name="scope-in-2")
+        out_of_scope = _make_gate_device(name="scope-out-2")
+        user = self._constrained_user(in_scope)
+
+        scoped = Device.objects.restrict(user, "view")
+        assert scoped.filter(pk=in_scope.pk).exists() is True
+        assert scoped.filter(pk=out_of_scope.pk).exists() is False
diff --git a/netbox_librenms_plugin/tests/test_view_wiring.py b/netbox_librenms_plugin/tests/test_view_wiring.py
index 9591741fdd..3e92814efb 100644
--- a/netbox_librenms_plugin/tests/test_view_wiring.py
+++ b/netbox_librenms_plugin/tests/test_view_wiring.py
@@ -207,6 +207,16 @@ def test_remove_server_mapping_has_required_object_permissions(self):
         self._assert_has_mixins(RemoveServerMappingView)
         assert "POST" in RemoveServerMappingView.required_object_permissions
 
+    def test_single_cable_verify_has_object_permission_gate(self):
+        """The read-only verify-cable endpoint exposes device cable/topology rows, so it must gate on dcim.view_device like the interface/module verify views (object-permission mixin in MRO + declared perms)."""
+        from dcim.models import Device
+
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+        from netbox_librenms_plugin.views.mixins import NetBoxObjectPermissionMixin
+
+        assert NetBoxObjectPermissionMixin in SingleCableVerifyView.__mro__
+        assert ("view", Device) in SingleCableVerifyView.required_object_permissions.get("POST", [])
+
     def test_convert_legacy_id_has_required_object_permissions(self):
         from netbox_librenms_plugin.views.sync.device_fields import ConvertLegacyLibreNMSIdView
 
@@ -228,6 +238,38 @@ def test_delete_interfaces_has_required_object_permissions(self):
         assert ("delete", Interface) in perms_device
         assert ("delete", VMInterface) in perms_vm
 
+    def test_verify_views_have_object_permission_mixin_and_perms(self):
+        """Read-only verify endpoints must wire NetBoxObjectPermissionMixin so their declared gate enforces instead of raising AttributeError (a missing mixin 500s; mock-based perm tests mask it)."""
+        from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
+        from netbox_librenms_plugin.views.object_sync.devices import (
+            SingleInterfaceVerifyView,
+            SingleModuleVerifyView,
+            SingleVlanGroupVerifyView,
+            VerifyVlanSyncGroupView,
+        )
+
+        for view_class in (
+            SingleInterfaceVerifyView,
+            SingleModuleVerifyView,
+            SingleVlanGroupVerifyView,
+            VerifyVlanSyncGroupView,
+            SingleIPAddressVerifyView,
+        ):
+            self._assert_has_mixins(view_class)
+            assert "POST" in view_class.required_object_permissions, (
+                f"{view_class.__name__} must declare a POST object-permission requirement"
+            )
+
+    def test_single_ipaddress_verify_has_object_permission_gate(self):
+        """The read-only verify-ipaddress endpoint resolves an arbitrary device_id and returns its data, so it must gate on dcim.view_device like the other verify views."""
+        from dcim.models import Device
+
+        from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
+        from netbox_librenms_plugin.views.mixins import NetBoxObjectPermissionMixin
+
+        assert NetBoxObjectPermissionMixin in SingleIPAddressVerifyView.__mro__
+        assert ("view", Device) in SingleIPAddressVerifyView.required_object_permissions.get("POST", [])
+
 
 class TestViewPropertyLazyInit:
     """
@@ -299,7 +341,7 @@ class TestRenderDeviceSelectionEscape:
     """VCCableTable.render_device_selection must HTML-escape member.name."""
 
     def test_member_name_is_escaped(self):
-        from unittest.mock import MagicMock, patch
+        from unittest.mock import MagicMock
 
         from netbox_librenms_plugin.tables.cables import VCCableTable
 
@@ -312,14 +354,10 @@ def test_member_name_is_escaped(self):
         vc.members.all.return_value = [member]
         device.virtual_chassis = vc
 
+        # The dropdown options render from the member set cached in __init__.
         table = VCCableTable([], device=device)
         record = {"local_port": "eth0", "local_port_id": "42"}
-
-        with patch(
-            "netbox_librenms_plugin.tables.cables.get_virtual_chassis_member",
-            return_value=member,
-        ):
-            html = str(table.render_device_selection(None, record))
+        html = str(table.render_device_selection(None, record))
 
         assert "<script>" not in html
         assert "&lt;script&gt;" in html
@@ -395,6 +433,10 @@ def test_server_key_used_for_cache_lookup(self):
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
+        # dispatch() sets self.request in production; this direct post() call needs an authorized
+        # request for the object-permission gate (reads self.request.user.has_perm).
+        view.request = MagicMock()
+        view.request.user.has_perm.return_value = True
         view._librenms_api.server_key = "default-server"
 
         request = MagicMock()
@@ -407,6 +449,13 @@ def test_server_key_used_for_cache_lookup(self):
         ).encode()
 
         with (
+            # The posted key is honoured only when it names a configured server; post() checks the
+            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance) so it never builds a
+            # possibly-broken default client just to validate membership.
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"production": "Production"},
+            ),
             patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
@@ -434,6 +483,10 @@ def test_fallback_to_api_server_key(self):
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
+        # dispatch() sets self.request in production; this direct post() call needs an authorized
+        # request for the object-permission gate (reads self.request.user.has_perm).
+        view.request = MagicMock()
+        view.request.user.has_perm.return_value = True
         view._librenms_api.server_key = "fallback-server"
 
         request = MagicMock()

From 116dfeb4f3fc2f0a14484051a628e0a0f2355609 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 02/17] fix(hardening): fail closed on malformed payloads,
 caches, and server keys

Reject malformed-but-truthy LibreNMS payloads, treat a ports-less or corrupt cache dict as an
empty no-op instead of rendering or aborting a refresh, guard the IP/VLAN/cable cached
snapshots, reject non-int/float librenms_id behind one is_legacy_librenms_id helper, resolve
and degrade the GET-render server key deterministically, and guard cache.ttl on non-Redis
backends. Coverage rebuilt on real DB objects where feasible.
---
 netbox_librenms_plugin/tests/conftest.py      |  19 +
 .../tests/test_coverage_base_views.py         |  61 +++-
 .../tests/test_coverage_base_views2.py        | 296 ++++++++++------
 .../tests/test_coverage_device_fields.py      |  59 ++++
 .../tests/test_coverage_mixins.py             |  28 ++
 .../tests/test_coverage_sync_view.py          |  53 +++
 .../tests/test_coverage_sync_views.py         |  55 ++-
 .../tests/test_coverage_sync_views2.py        |  28 +-
 .../tests/test_coverage_utils.py              | 275 ++++++++++++++-
 .../test_id_lookup_lossy_coercion_realdb.py   |  76 ++++
 .../tests/test_librenms_id.py                 |  45 +++
 .../tests/test_mixins_helpers.py              |  89 +++++
 .../tests/test_payload_hardening.py           | 225 ++++++++++++
 .../tests/test_render_server_key_degrade.py   | 122 +++++++
 .../tests/test_reviewer_fixes.py              |  92 +++--
 netbox_librenms_plugin/tests/test_utils.py    | 309 +++++++++++++++++
 netbox_librenms_plugin/utils.py               | 327 ++++++++++++++++--
 .../views/base/interfaces_view.py             |  40 ++-
 .../views/base/ip_addresses_view.py           | 157 +++++++--
 .../views/base/librenms_sync_view.py          |  27 +-
 netbox_librenms_plugin/views/mixins.py        |  79 ++++-
 .../views/object_sync/devices.py              |  95 +++--
 .../views/sync/device_fields.py               |  38 +-
 .../views/sync/interfaces.py                  |  38 +-
 .../views/sync/ip_addresses.py                |  12 +-
 25 files changed, 2371 insertions(+), 274 deletions(-)
 create mode 100644 netbox_librenms_plugin/tests/test_id_lookup_lossy_coercion_realdb.py
 create mode 100644 netbox_librenms_plugin/tests/test_mixins_helpers.py
 create mode 100644 netbox_librenms_plugin/tests/test_payload_hardening.py
 create mode 100644 netbox_librenms_plugin/tests/test_render_server_key_degrade.py

diff --git a/netbox_librenms_plugin/tests/conftest.py b/netbox_librenms_plugin/tests/conftest.py
index a6bba487f7..05ca8062fd 100644
--- a/netbox_librenms_plugin/tests/conftest.py
+++ b/netbox_librenms_plugin/tests/conftest.py
@@ -4,6 +4,25 @@
 
 import pytest
 
+
+@pytest.fixture(autouse=True)
+def _clear_device_info_cache():
+    """Clear get_device_info()'s short-lived cache between tests.
+
+    get_device_info() caches successful lookups in the shared cache. Without this,
+    a cached success from one test leaks into another that reuses the same
+    (server_key, device_id) but mocks a different response — e.g. the failure-path
+    tests keyed on device_id=123 that run after test_get_device_info_success.
+    """
+    from django.core.cache import cache
+
+    try:
+        cache.delete_pattern("librenms_device_info_*")
+    except (AttributeError, NotImplementedError):
+        cache.clear()
+    yield
+
+
 # =============================================================================
 # Configuration Fixtures
 # =============================================================================
diff --git a/netbox_librenms_plugin/tests/test_coverage_base_views.py b/netbox_librenms_plugin/tests/test_coverage_base_views.py
index 5a691570a1..18d2258ad5 100644
--- a/netbox_librenms_plugin/tests/test_coverage_base_views.py
+++ b/netbox_librenms_plugin/tests/test_coverage_base_views.py
@@ -984,6 +984,30 @@ def test_cache_miss_returns_empty_table(self):
 
         assert ctx["table"] is None
 
+    def test_malformed_non_dict_cache_degrades_to_empty_table(self):
+        """A truthy but non-dict ports cache entry (legacy/older-shape or corrupt) must degrade to an empty table, not AttributeError-500 on .get('ports')."""
+        view = self._make_view()
+        obj = _mock_obj()
+        request = _mock_request()
+
+        with (
+            patch.object(view, "get_cache_key", return_value="key"),
+            patch.object(view, "get_last_fetched_key", return_value="last-key"),
+            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
+            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
+            patch.object(view, "_build_vlan_lookup_maps", return_value={}),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
+            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone"),
+        ):
+            # Truthy but wrong shape (a stale list-shaped snapshot). Unfixed `if cached_data:` calls
+            # .get("ports") on the list → AttributeError-500. Fixed isinstance(dict) guard skips it.
+            mock_cache.get.side_effect = lambda key: [{"ports": []}] if key == "key" else None
+            mock_cache.ttl.return_value = None
+            ctx = view.get_context_data(request, obj, "ifName")
+
+        assert ctx["table"] is None
+
     def test_cache_hit_non_vc_builds_table(self):
         """Cached data without VC produces table."""
         view = self._make_view()
@@ -998,7 +1022,7 @@ def test_cache_hit_non_vc_builds_table(self):
         mock_iface = MagicMock()
         mock_iface.name = "Gi0/0"
         mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value = [mock_iface]
+        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
 
         mock_table = MagicMock()
         mock_table.configure = MagicMock()
@@ -1046,7 +1070,7 @@ def test_cache_hit_with_vc_uses_vc_members(self):
         }
 
         mock_iface_qs = MagicMock()
-        mock_iface_qs.select_related.return_value = []
+        mock_iface_qs.select_related.return_value.prefetch_related.return_value = []
 
         mock_table = MagicMock()
         mock_table.configure = MagicMock()
@@ -1108,7 +1132,7 @@ def test_cache_hit_non_vc_ignores_duplicate_librenms_ids(self):
         interface_b.name = "Gi0/1"
 
         mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value = [interface_a, interface_b]
+        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [interface_a, interface_b]
 
         rows_store = {}
 
@@ -2124,7 +2148,7 @@ def test_ifalias_cleared_when_matches_ifdescr(self):
         mock_iface = MagicMock()
         mock_iface.name = "Gi0/0"
         mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value = [mock_iface]
+        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
 
         mock_table = MagicMock()
         mock_table.configure = MagicMock()
@@ -2179,7 +2203,7 @@ def test_netbox_only_interfaces_vc_device_name_lookup(self):
         netbox_only_iface.type = "1000base-t"
 
         mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value = [netbox_only_iface]
+        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [netbox_only_iface]
 
         mock_table = MagicMock()
         mock_table.configure = MagicMock()
@@ -2230,7 +2254,7 @@ def test_netbox_only_interfaces_non_vc_device_name_from_obj(self):
         netbox_only_iface.type = "1000base-t"
 
         mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value = [netbox_only_iface]
+        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [netbox_only_iface]
 
         mock_table = MagicMock()
         mock_table.configure = MagicMock()
@@ -2313,3 +2337,28 @@ def test_no_flag_when_mgmt_ip_blank(self):
         data = [{"ip_address": "10.0.0.1"}]
         view._flag_management_ip(data)
         assert data[0].get("is_mgmt_ip") is None
+
+
+class TestSingleCableVerifyViewPermissionGate:
+    """SingleCableVerifyView is a read-only JSON endpoint exposing a device's cable/topology rows; it must require dcim.view_device like the interface/module verify views."""
+
+    def test_checks_permission_before_resolving_device(self):
+        """The object-view gate must run BEFORE get_object_or_404 so an unauthorized caller can't probe arbitrary device IDs (existence via 404) or trigger LibreNMS work. Exercises the REAL require_object_permissions_json (only request.user.has_perm is mocked) — mocking the gate itself would mask a missing NetBoxObjectPermissionMixin base."""
+        import json
+        from unittest.mock import MagicMock, patch
+
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+        view = object.__new__(SingleCableVerifyView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 999, "local_port_id": "serial:1"}).encode()
+        request.user.has_perm.return_value = False  # unauthorized → real gate returns 403
+        view.request = request  # check_object_permissions reads self.request.user
+
+        with patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj:
+            response = view.post(request)
+
+        assert response.status_code == 403
+        mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
diff --git a/netbox_librenms_plugin/tests/test_coverage_base_views2.py b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
index 5e039a61d8..d79510efec 100644
--- a/netbox_librenms_plugin/tests/test_coverage_base_views2.py
+++ b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
@@ -14,6 +14,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 # =============================================================================
 # Helpers
@@ -106,6 +108,24 @@ def test_none_value_typeerror_caught(self):
         result = _librenms_id_q("default", None)
         assert result is not None
 
+    def test_float_value_returns_match_nothing_q(self):
+        """Issue #103: a float like 1.9 must NOT int()-truncate to 1 and match device id 1."""
+        from django.db.models import Q
+        from netbox_librenms_plugin.views.base.cables_view import _librenms_id_q
+
+        result = _librenms_id_q("default", 1.9)
+        expected = Q(pk__isnull=True) & Q(pk__isnull=False)
+        assert str(result) == str(expected)
+
+    def test_non_positive_int_returns_match_nothing_q(self):
+        """Zero / negative values can't be a valid librenms_id, so they match nothing."""
+        from django.db.models import Q
+        from netbox_librenms_plugin.views.base.cables_view import _librenms_id_q
+
+        expected = str(Q(pk__isnull=True) & Q(pk__isnull=False))
+        assert str(_librenms_id_q("default", 0)) == expected
+        assert str(_librenms_id_q("default", -5)) == expected
+
 
 # =============================================================================
 # TestGetObjectAndIpAddress  — BaseCableTableView trivial wrappers
@@ -661,8 +681,43 @@ def _make_view(self):
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # dispatch() sets self.request in production; tests call post() directly, so set an
+        # authorized request here for the object-permission gate (reads self.request.user).
+        view.request = _mock_request()
+        view.request.user.has_perm.return_value = True
         return view
 
+    def test_unconfigured_posted_server_key_falls_back_to_session(self):
+        """A posted server_key naming no configured server must not scope the links cache / _librenms_id_q ORM lookups — fall back to the active server."""
+        import json
+
+        view = self._make_view()
+        view._librenms_api.server_key = "good"
+        view._librenms_api.get_available_servers.return_value = {"good": "Good"}
+
+        mock_request = MagicMock()
+        mock_request.body = json.dumps({"device_id": 1, "local_port_id": 10, "server_key": "ghost"}).encode()
+
+        mock_device = MagicMock()
+        mock_device.virtual_chassis = None  # non-VC → primary_device = selected_device
+        mock_device.id = 1
+
+        captured = {}
+
+        def fake_cache_key(dev, kind, sk):
+            captured["server_key"] = sk
+            return "ck"
+
+        with (
+            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404", return_value=mock_device),
+            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
+            patch.object(view, "get_cache_key", side_effect=fake_cache_key),
+        ):
+            mock_cache.get.return_value = None  # no cached links → exits after building the (validated) key
+            view.post(mock_request)
+
+        assert captured["server_key"] == "good"  # "ghost" is unconfigured → session key used
+
     def test_vc_member_resolution_calls_get_virtual_chassis_member(self):
         """VC device → get_virtual_chassis_member called with device and local_port."""
         import json
@@ -764,6 +819,10 @@ def _make_view(self):
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # dispatch() sets self.request in production; tests call post() directly, so set an
+        # authorized request here for the object-permission gate (reads self.request.user).
+        view.request = _mock_request()
+        view.request.user.has_perm.return_value = True
         return view
 
     def test_interface_not_found_fills_formatted_row(self):
@@ -947,6 +1006,31 @@ def _make_view(self):
         view.model = MagicMock()
         return view
 
+    @pytest.mark.parametrize(
+        "payload",
+        [None, {"port": []}, {"port": ["bad"]}, "not-a-dict", {"port": "x"}],
+    )
+    def test_get_port_info_caches_none_for_malformed_payload(self, payload):
+        """Issue #111: a truthy success with a malformed get_port_by_id payload must cache None without raising (None -> 'port' in None TypeError; ['bad'] -> non-dict row that later crashes at port_info.get())."""
+        view = self._make_view()
+        view._librenms_api.get_port_by_id.return_value = (True, payload)
+        cache = {}
+
+        result = view._get_port_info(7, cache, "ifName")
+
+        assert result is None
+        assert cache[7] is None
+
+    def test_get_port_info_caches_first_dict_row(self):
+        """A well-formed payload caches the first port dict."""
+        view = self._make_view()
+        row = {"ifName": "eth0", "port_id": 7}
+        view._librenms_api.get_port_by_id.return_value = (True, {"port": [row]})
+        cache = {}
+
+        assert view._get_port_info(7, cache, "ifName") == row
+        assert cache[7] == row
+
     def test_get_object_calls_get_object_or_404(self):
         """get_object delegates to get_object_or_404 with the view's model."""
         view = self._make_view()
@@ -1107,99 +1191,92 @@ def test_calls_get_interface_name_field_when_none(self):
         mock_gif.assert_called_once_with(request)
         assert result is None  # returns None because cache miss
 
+    def test_non_dict_cached_entry_drops_to_none_not_500(self):
+        """A stale/corrupt non-dict cached entry (e.g. a list from a legacy snapshot shape) must drop to None and render empty, not 500 on a .get() against a list — mirrors the interfaces/modules cached-path isinstance guard."""
+        view = self._make_view()
+
+        obj = _mock_obj()
+        request = _mock_request()
+
+        with (
+            patch("netbox_librenms_plugin.views.base.ip_addresses_view.cache") as mock_cache,
+            patch.object(view, "get_cache_key", return_value="test-key"),
+        ):
+            mock_cache.get.return_value = ["not", "a", "dict"]  # corrupt non-dict cache entry
+            result = view._prepare_context(request, obj, "ifName", fetch_fresh=False)
+
+        assert result is None
+
 
 # =============================================================================
 # TestSingleIPAddressVerifyViewGetObject  — _get_object (lines 325-339)
 # =============================================================================
 
 
+@pytest.mark.django_db
 class TestSingleIPAddressVerifyViewGetObject:
-    """Tests for SingleIPAddressVerifyView._get_object."""
+    """_get_object resolves the right real object by type (and untyped), scoped to the caller's perms.
+
+    Rewritten from get_object_or_404/Device.objects.filter call-shape mocks to real Device/VM rows:
+    the object-scoping added in this PR routes the lookup through ``Model.objects.restrict`` and reads
+    ``self.request.user``, which the old call-signature assertions never exercised.
+    """
+
+    def _view(self):
+        from django.contrib.auth import get_user_model
+        from django.test import RequestFactory
 
-    def _make_view(self):
         from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
 
         view = object.__new__(SingleIPAddressVerifyView)
+        request = RequestFactory().get("/")
+        request.user = get_user_model().objects.create_superuser(username="ipverify-getobj", email="", password="x")
+        view.request = request
         return view
 
-    def test_device_type_calls_get_object_or_404_for_device(self):
-        """object_type='device' → get_object_or_404(Device, pk=object_id)."""
-        from dcim.models import Device
+    def _device(self, name="ipverify-dev"):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
 
-        view = self._make_view()
-        mock_device = MagicMock()
+        mfr, _ = Manufacturer.objects.get_or_create(name="IPV-Mfr", slug="ipv-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="IPV-DT", slug="ipv-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="IPV-Role", slug="ipv-role")
+        site, _ = Site.objects.get_or_create(name="IPV-Site", slug="ipv-site")
+        return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
 
-        with patch(
-            "netbox_librenms_plugin.views.base.ip_addresses_view.get_object_or_404",
-            return_value=mock_device,
-        ) as mock_get:
-            result = view._get_object(1, "device")
+    def _vm(self, name="ipverify-vm"):
+        from virtualization.models import Cluster, ClusterType, VirtualMachine
 
-        mock_get.assert_called_once_with(Device, pk=1)
-        assert result is mock_device
+        ct, _ = ClusterType.objects.get_or_create(name="IPV-CT", slug="ipv-ct")
+        cluster, _ = Cluster.objects.get_or_create(name="IPV-Cluster", type=ct)
+        return VirtualMachine.objects.create(name=name, cluster=cluster, status="active")
 
-    def test_vm_type_calls_get_object_or_404_for_vm(self):
-        """object_type='virtualmachine' → get_object_or_404(VirtualMachine, pk=object_id)."""
-        from virtualization.models import VirtualMachine
+    def test_device_type_resolves_real_device(self):
+        view = self._view()
+        device = self._device()
+        assert view._get_object(device.pk, "device").pk == device.pk
 
-        view = self._make_view()
-        mock_vm = MagicMock()
-
-        with patch(
-            "netbox_librenms_plugin.views.base.ip_addresses_view.get_object_or_404",
-            return_value=mock_vm,
-        ) as mock_get:
-            result = view._get_object(2, "virtualmachine")
-
-        mock_get.assert_called_once_with(VirtualMachine, pk=2)
-        assert result is mock_vm
+    def test_vm_type_resolves_real_vm(self):
+        view = self._view()
+        vm = self._vm()
+        assert view._get_object(vm.pk, "virtualmachine").pk == vm.pk
 
     def test_no_type_finds_device(self):
-        """No type given → tries Device.objects.filter; returns device when found."""
-        view = self._make_view()
-
-        mock_device = MagicMock()
-
-        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.Device") as MockDevice:
-            MockDevice.objects.filter.return_value.first.return_value = mock_device
-            result = view._get_object(1, None)
-
-        assert result is mock_device
-
-    def test_no_type_device_not_found_tries_vm(self):
-        """No type, Device not found → tries VirtualMachine; returns VM when found."""
-        view = self._make_view()
+        view = self._view()
+        device = self._device("ipverify-dev-nt")
+        assert view._get_object(device.pk, None).pk == device.pk
 
-        mock_vm = MagicMock()
-
-        with (
-            patch("netbox_librenms_plugin.views.base.ip_addresses_view.Device") as MockDevice,
-            patch("netbox_librenms_plugin.views.base.ip_addresses_view.VirtualMachine") as MockVM,
-        ):
-            MockDevice.objects.filter.return_value.first.return_value = None
-            MockVM.objects.filter.return_value.first.return_value = mock_vm
-            result = view._get_object(2, None)
-
-        assert result is mock_vm
+    def test_no_type_device_absent_finds_vm(self):
+        view = self._view()
+        vm = self._vm("ipverify-vm-nt")
+        # No Device exists with this pk, so the device lookup misses and the VM lookup resolves.
+        assert view._get_object(vm.pk, None).pk == vm.pk
 
     def test_no_type_neither_found_raises_http404(self):
-        """No type, nothing found → raises Http404."""
         from django.http import Http404
 
-        view = self._make_view()
-
-        with (
-            patch("netbox_librenms_plugin.views.base.ip_addresses_view.Device") as MockDevice,
-            patch("netbox_librenms_plugin.views.base.ip_addresses_view.VirtualMachine") as MockVM,
-        ):
-            MockDevice.objects.filter.return_value.first.return_value = None
-            MockVM.objects.filter.return_value.first.return_value = None
-
-            try:
-                view._get_object(99, None)
-                assert False, "Expected Http404"
-            except Http404:
-                pass
+        view = self._view()
+        with pytest.raises(Http404):
+            view._get_object(2_147_483_647, None)
 
 
 # =============================================================================
@@ -1297,8 +1374,14 @@ def test_no_match_returns_triple_none(self):
 # =============================================================================
 
 
+@pytest.mark.django_db
 class TestSingleIPAddressVerifyViewFindExistingIp:
-    """Tests for SingleIPAddressVerifyView._find_existing_ip."""
+    """Real-DB tests for SingleIPAddressVerifyView._find_existing_ip.
+
+    _find_existing_ip queries the real IPAddress model the plugin owns, so these exercise the
+    actual ORM lookup (address + vrf scoping). Mocking IPAddress.objects here left the exact
+    filter kwargs unverified — a change to the lookup fields would pass while the real query broke.
+    """
 
     def _make_view(self):
         from netbox_librenms_plugin.views.base.ip_addresses_view import SingleIPAddressVerifyView
@@ -1306,50 +1389,50 @@ def _make_view(self):
         return object.__new__(SingleIPAddressVerifyView)
 
     def test_ip_not_found_returns_false_false_none(self):
-        """IP not in NetBox → (False, False, None)."""
+        """An address absent from NetBox → (False, False, None)."""
         view = self._make_view()
 
-        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.IPAddress") as MockIP:
-            MockIP.objects.filter.return_value.first.return_value = None
-            result = view._find_existing_ip("192.168.1.1", 24, vrf_id=None)
+        assert view._find_existing_ip("192.168.1.1", 24, vrf_id=None) == (False, False, None)
 
-        assert result == (False, False, None)
+    def test_ip_found_global_vrf(self):
+        """A real global (no-VRF) IPAddress is found and reported as existing in the global VRF."""
+        from ipam.models import IPAddress
 
-    def test_ip_found_with_vrf_id_checks_specific_vrf(self):
-        """IP exists; vrf_id given → queries for specific VRF membership."""
+        ip = IPAddress.objects.create(address="10.0.0.1/8")
         view = self._make_view()
 
-        mock_ip = MagicMock()
-        mock_ip.get_absolute_url.return_value = "/ip/1/"
-
-        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.IPAddress") as MockIP:
-            MockIP.objects.filter.return_value.first.return_value = mock_ip
-            MockIP.objects.filter.return_value.exists.return_value = True
-            exists_any, exists_vrf, url = view._find_existing_ip("192.168.1.1", 24, vrf_id=5)
+        exists_any, exists_vrf, url = view._find_existing_ip("10.0.0.1", 8, vrf_id=None)
 
         assert exists_any is True
         assert exists_vrf is True
-        assert url == "/ip/1/"
-        # Verify VRF-scoped second query was made
-        MockIP.objects.filter.assert_any_call(address="192.168.1.1/24", vrf__id=5)
+        assert url == ip.get_absolute_url()
 
-    def test_ip_found_without_vrf_id_checks_global(self):
-        """IP exists; vrf_id=None → queries for global VRF (vrf__isnull=True)."""
-        view = self._make_view()
+    def test_ip_found_specific_vrf(self):
+        """A real IPAddress in a specific VRF is matched when that vrf_id is queried."""
+        from ipam.models import VRF, IPAddress
 
-        mock_ip = MagicMock()
-        mock_ip.get_absolute_url.return_value = "/ip/2/"
+        vrf = VRF.objects.create(name="cr116-vrf")
+        ip = IPAddress.objects.create(address="192.168.1.1/24", vrf=vrf)
+        view = self._make_view()
 
-        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.IPAddress") as MockIP:
-            MockIP.objects.filter.return_value.first.return_value = mock_ip
-            MockIP.objects.filter.return_value.exists.return_value = True
-            exists_any, exists_vrf, url = view._find_existing_ip("10.0.0.1", 8, vrf_id=None)
+        exists_any, exists_vrf, url = view._find_existing_ip("192.168.1.1", 24, vrf_id=vrf.pk)
 
         assert exists_any is True
         assert exists_vrf is True
-        assert url == "/ip/2/"
-        # Verify global VRF second query was made
-        MockIP.objects.filter.assert_any_call(address="10.0.0.1/8", vrf__isnull=True)
+        assert url == ip.get_absolute_url()
+
+    def test_ip_in_vrf_not_matched_as_global(self):
+        """An IP that exists only inside a VRF is present but NOT in the global VRF (vrf__isnull=True)."""
+        from ipam.models import VRF, IPAddress
+
+        vrf = VRF.objects.create(name="cr116-vrf2")
+        IPAddress.objects.create(address="172.16.0.1/24", vrf=vrf)
+        view = self._make_view()
+
+        exists_any, exists_vrf, _url = view._find_existing_ip("172.16.0.1", 24, vrf_id=None)
+
+        assert exists_any is True
+        assert exists_vrf is False
 
 
 # =============================================================================
@@ -1410,6 +1493,9 @@ def _make_view(self):
         view = object.__new__(SingleIPAddressVerifyView)
         # CacheMixin needs server_key attr indirectly via get_cache_key
         view._librenms_api = MagicMock()
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate; the gate itself is covered by TestSingleIPAddressVerifyObjectPermissionGate (real DB).
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
     def test_no_ip_address_returns_400(self):
@@ -1652,6 +1738,12 @@ def test_verify_with_non_default_server_key(self):
         mock_obj.interfaces.first.return_value = None
 
         with (
+            # "secondary" must be a configured server for the verify gate to honour it as the cache
+            # namespace (an unconfigured/forged key falls back to the active server).
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"secondary": "Secondary"},
+            ),
             patch.object(view, "_get_object", return_value=mock_obj),
             patch.object(view, "_parse_ip_address", return_value=("192.168.1.1", 24)),
             patch.object(view, "get_cache_key", return_value="secondary-cache-key") as mock_get_cache_key,
@@ -1836,6 +1928,10 @@ def _make_view(self):
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # dispatch() sets self.request in production; tests call post() directly, so set an
+        # authorized request here for the object-permission gate (reads self.request.user).
+        view.request = _mock_request()
+        view.request.user.has_perm.return_value = True
         return view
 
     def test_can_create_cable_adds_form_action(self):
@@ -1943,6 +2039,10 @@ def _make_view(self):
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # dispatch() sets self.request in production; tests call post() directly, so set an
+        # authorized request here for the object-permission gate (reads self.request.user).
+        view.request = _mock_request()
+        view.request.user.has_perm.return_value = True
         return view
 
     def _run_post(self, view, process_result):
diff --git a/netbox_librenms_plugin/tests/test_coverage_device_fields.py b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
index 9e6247faaa..67ec016b58 100644
--- a/netbox_librenms_plugin/tests/test_coverage_device_fields.py
+++ b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
@@ -2,6 +2,31 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
+
+@pytest.mark.parametrize(
+    "view_name",
+    ["UpdateDeviceNameView", "UpdateDeviceSerialView", "UpdateDeviceTypeView", "UpdateDevicePlatformView"],
+)
+def test_write_views_fetch_device_info_live_not_cached(view_name):
+    """The device-field write views must fetch LIVE LibreNMS info (use_cache=False) so a stale sync-tab cache snapshot is never persisted into NetBox."""
+    import netbox_librenms_plugin.views.sync.device_fields as df
+
+    view = _make_view(getattr(df, view_name))
+    view._librenms_api.get_librenms_id.return_value = 42
+    view._librenms_api.get_device_info.return_value = (False, None)  # short-circuit right after the call
+    mock_device = MagicMock()
+    mock_device.virtual_chassis = None
+    with (
+        patch("netbox_librenms_plugin.views.sync.device_fields.get_object_or_404", return_value=mock_device),
+        patch("netbox_librenms_plugin.views.sync.device_fields.messages"),
+        patch("netbox_librenms_plugin.views.sync.device_fields.redirect"),
+    ):
+        view.post(_make_request(), pk=1)
+    # Unfixed: called as get_device_info(42) → use_cache defaults True → reads the stale render cache.
+    assert view._librenms_api.get_device_info.call_args.kwargs.get("use_cache") is False
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -1847,6 +1872,40 @@ def test_virtualmachine_object_type_normalised(self):
         mock_locked.full_clean.assert_called_once()
         mock_locked.save.assert_called_once()
 
+    def test_whitespace_padded_legacy_id_is_convertible_not_dead_end(self):
+        """A padded legacy id (' 42 ') the badge shows via is_legacy_librenms_id must convert, not hit the isdigit() dead-end."""
+        view = self._view()
+        mock_obj = MagicMock()
+        mock_obj.custom_field_data = {"librenms_id": " 42 "}
+        mock_obj.serial = "SN-MATCH"
+        view._librenms_api.get_device_info.return_value = (True, {"serial": "SN-MATCH"})
+
+        DoesNotExist = type("DoesNotExist", (Exception,), {})
+        mock_locked = MagicMock()
+        mock_locked.custom_field_data = {"librenms_id": " 42 "}
+        mock_locked.serial = "SN-MATCH"
+        mock_dev_cls = MagicMock()
+        mock_dev_cls.DoesNotExist = DoesNotExist
+        mock_dev_cls.objects.select_for_update.return_value.get.return_value = mock_locked
+
+        with (
+            patch("netbox_librenms_plugin.views.sync.device_fields.get_object_or_404", return_value=mock_obj),
+            patch("netbox_librenms_plugin.views.sync.device_fields.Device", mock_dev_cls),
+            patch("netbox_librenms_plugin.views.sync.device_fields.find_by_librenms_id", return_value=None),
+            patch(
+                "netbox_librenms_plugin.views.sync.device_fields.migrate_legacy_librenms_id", return_value=True
+            ) as mock_migrate,
+            patch("netbox_librenms_plugin.views.sync.device_fields.transaction"),
+            patch("netbox_librenms_plugin.views.sync.device_fields.messages") as mock_msg,
+            patch("netbox_librenms_plugin.views.sync.device_fields.redirect"),
+        ):
+            view.post(_make_request({"object_type": "device"}), pk=1)
+        # Unfixed: ' 42 '.isdigit() is False → error "not a valid integer" and migrate NOT called.
+        mock_migrate.assert_called_once()
+        assert not any("not a valid integer" in str(c) for c in mock_msg.error.call_args_list)
+        # The serial gate must read live info (use_cache=False), not a stale sync-tab cache snapshot.
+        assert view._librenms_api.get_device_info.call_args.kwargs.get("use_cache") is False
+
     def test_permission_denied(self):
         view = self._view()
         err = MagicMock()
diff --git a/netbox_librenms_plugin/tests/test_coverage_mixins.py b/netbox_librenms_plugin/tests/test_coverage_mixins.py
index 5c38e7594e..24255b8b84 100644
--- a/netbox_librenms_plugin/tests/test_coverage_mixins.py
+++ b/netbox_librenms_plugin/tests/test_coverage_mixins.py
@@ -13,6 +13,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 # =============================================================================
 # LibreNMSAPIMixin.get_context_data
@@ -1045,3 +1047,29 @@ def test_return_dict_has_all_keys(self):
 
         for key in ("mode_set", "untagged_set", "tagged_set", "missing_vlans"):
             assert key in result
+
+
+class TestRenderServerKeyDegradation:
+    """LibreNMSAPIMixin._render_server_key degrades a misconfigured default to None and is shared across views."""
+
+    @pytest.mark.django_db
+    def test_render_server_key_returns_none_on_broken_default(self):
+        """A misconfigured default must not raise out of a render path; it degrades to None."""
+        from django.test import override_settings
+
+        from netbox_librenms_plugin.views.base.ip_addresses_view import BaseIPAddressTableView
+
+        view = object.__new__(BaseIPAddressTableView)
+        view._librenms_api = None  # live property -> LibreNMSAPI() would raise ValueError
+
+        with override_settings(PLUGINS_CONFIG={"netbox_librenms_plugin": {"servers": {"default": {}}}}):
+            assert view._render_server_key() is None
+
+    def test_render_server_key_is_shared_from_mixin(self):
+        """The IP and cable table views inherit ONE _render_server_key (no per-view duplicate)."""
+        from netbox_librenms_plugin.views.base.cables_view import BaseCableTableView
+        from netbox_librenms_plugin.views.base.ip_addresses_view import BaseIPAddressTableView
+        from netbox_librenms_plugin.views.mixins import LibreNMSAPIMixin
+
+        assert BaseIPAddressTableView._render_server_key is LibreNMSAPIMixin._render_server_key
+        assert BaseCableTableView._render_server_key is LibreNMSAPIMixin._render_server_key
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_view.py b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
index 36c6b0e7c5..18ef8ee58c 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_view.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 def _make_view():
     """Create a BaseLibreNMSSyncView instance bypassing __init__."""
@@ -871,3 +873,54 @@ def test_platform_does_not_exist(self):
 
         assert result["platform_exists"] is False
         assert result["matching_platform"] is None
+
+
+@pytest.mark.django_db
+class TestInterfaceSyncRefreshButtonServerKey:
+    """The 'Refresh Interfaces' buttons must carry the active server_key (hidden input + hx-include) so a non-default server tab refreshes from the right LibreNMS server/cache, not the fallback."""
+
+    def _render(self, *, server_key="prod"):
+        from django.contrib.auth.models import AnonymousUser
+        from django.template.loader import render_to_string
+        from django.test import RequestFactory
+        from django_tables2 import RequestConfig
+
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="ACME-ifsync", slug="acme-ifsync")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-ifsync", slug="dt-ifsync")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-ifsync", slug="role-ifsync")
+        site, _ = Site.objects.get_or_create(name="Site-ifsync", slug="site-ifsync")
+        device = Device.objects.create(name="ifsync-refresh-dev", device_type=dt, role=role, site=site, status="active")
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()
+        table = LibreNMSInterfaceTable([], device=device, server_key=server_key)
+        RequestConfig(request).configure(table)
+        ctx = {
+            "object": device,
+            "has_librenms_id": True,
+            "server_key": server_key,
+            "interface_name_field": "ifName",
+            "migrated_to_marker": None,
+            "migrated_to_winner": None,
+            "has_write_permission": False,
+            "interface_sync": {
+                "object": device,
+                "table": table,
+                "server_key": server_key,
+                "netbox_only_interfaces": [],
+                "virtual_chassis_members": [],
+                "cache_expiry": None,
+                "oob_incomplete": False,
+            },
+        }
+        return render_to_string("netbox_librenms_plugin/_interface_sync.html", ctx, request=request)
+
+    def test_refresh_button_includes_server_key(self):
+        html = self._render(server_key="prod")
+        # Hidden input carries the active server key...
+        assert '<input type="hidden" name="server_key" value="prod">' in html
+        # ...and the refresh button posts it alongside interface_name_field.
+        assert "[name='interface_name_field'], [name='server_key']" in html
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_views.py b/netbox_librenms_plugin/tests/test_coverage_sync_views.py
index 131b8abc07..0f2257e654 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_views.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_views.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 def _make_post(data):
     """Return a mock POST object backed by a real dict."""
@@ -1553,6 +1555,30 @@ def test_vrf_does_not_exist_returns_none(self):
         assert result is None
 
 
+class TestSyncIPAddressesViewGetManagementIp:
+    def test_non_string_ip_returns_none(self):
+        """A non-string ip in the device_info payload yields None via an explicit type guard (like _resolve_management_ip), not by raising AttributeError into the broad except."""
+        from netbox_librenms_plugin.views.sync.ip_addresses import SyncIPAddressesView
+
+        view = _make_view(SyncIPAddressesView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.get_librenms_id.return_value = 42
+        view._librenms_api.get_device_info.return_value = (True, {"ip": 167772163})  # int, not str
+
+        assert view.get_management_ip(MagicMock()) is None
+
+    def test_string_ip_is_returned_stripped(self):
+        """A normal string ip is returned (whitespace-stripped)."""
+        from netbox_librenms_plugin.views.sync.ip_addresses import SyncIPAddressesView
+
+        view = _make_view(SyncIPAddressesView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.get_librenms_id.return_value = 42
+        view._librenms_api.get_device_info.return_value = (True, {"ip": "  10.0.0.5  "})
+
+        assert view.get_management_ip(MagicMock()) == "10.0.0.5"
+
+
 class TestSyncIPAddressesViewGetCachedIpData:
     def test_cache_miss_returns_none(self):
         from netbox_librenms_plugin.views.sync.ip_addresses import SyncIPAddressesView
@@ -2524,30 +2550,25 @@ def test_skips_unchanged_vlan(self):
                                 view._handle_create_vlans(req, mock_obj, "device", 1)
         mock_vlan.save.assert_not_called()
 
-    def test_invalid_group_id_falls_back_to_global(self):
-        from ipam.models import VLANGroup
+    @pytest.mark.django_db
+    def test_invalid_group_id_is_rejected(self):
+        """A stale/tampered vlan_group_{vid} pointing at a missing group fails closed: the VID is skipped with an error, not persisted as a global VLAN in the wrong scope."""
+        from ipam.models import VLAN
 
         view = self._make_view()
-        req = _make_request({"select": ["10"], "vlan_group_10": "999"})
+        # Group 999999 does not exist → must NOT silently fall back to a global VLAN.
+        req = _make_request({"select": ["10"], "vlan_group_10": "999999"})
         mock_obj = MagicMock()
         cached_vlans = [{"vlan_vlan": 10, "vlan_name": "Management"}]
-        mock_vlan = MagicMock()
-        mock_vlan.name = "Management"
         with patch("netbox_librenms_plugin.views.sync.vlans.cache") as mock_cache:
             mock_cache.get.return_value = cached_vlans
             with patch.object(view, "get_cache_key", return_value="key"):
-                with patch("netbox_librenms_plugin.views.sync.vlans.transaction", _atomic_txn()):
-                    with patch("netbox_librenms_plugin.views.sync.vlans.VLANGroup") as mock_vg_cls:
-                        mock_vg_cls.DoesNotExist = VLANGroup.DoesNotExist
-                        mock_vg_cls.objects.get.side_effect = VLANGroup.DoesNotExist
-                        with patch("netbox_librenms_plugin.views.sync.vlans.VLAN") as mock_vlan_cls:
-                            mock_vlan_cls.objects.get_or_create.return_value = (mock_vlan, True)
-                            with patch("netbox_librenms_plugin.views.sync.vlans.messages"):
-                                with patch.object(view, "_redirect", return_value=MagicMock()):
-                                    view._handle_create_vlans(req, mock_obj, "device", 1)
-        # Falls back to group=None when VLANGroup.DoesNotExist
-        call_kwargs = mock_vlan_cls.objects.get_or_create.call_args[1]
-        assert call_kwargs["group"] is None
+                with patch("netbox_librenms_plugin.views.sync.vlans.messages") as mock_msg:
+                    with patch.object(view, "_redirect", return_value=MagicMock()):
+                        view._handle_create_vlans(req, mock_obj, "device", 1)
+        # Real VLAN model + real VLANGroup lookup: nothing created in any scope, error surfaced.
+        assert not VLAN.objects.filter(vid=10).exists()
+        mock_msg.error.assert_called()
 
     def test_summary_message_shows_counts(self):
         view = self._make_view()
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_views2.py b/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
index 12bc5464d7..ceddb37d82 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
@@ -971,6 +971,23 @@ def test_no_selection_redirects(self):
         mock_msgs.error.assert_called_once()
 
 
+class TestSyncIPAddressesGetManagementIp:
+    """get_management_ip feeds the Primary-IP write decision, so it must read live LibreNMS info."""
+
+    def test_fetches_live_device_info_not_cached(self):
+        from netbox_librenms_plugin.views.sync.ip_addresses import SyncIPAddressesView
+
+        view = object.__new__(SyncIPAddressesView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.get_librenms_id.return_value = 42
+        view._librenms_api.get_device_info.return_value = (True, {"ip": "10.0.0.9"})
+
+        assert view.get_management_ip(MagicMock()) == "10.0.0.9"
+        # Unfixed: get_device_info(42) → use_cache defaults True → a stale render snapshot could
+        # pick the wrong management IP as Primary. Fixed: use_cache=False.
+        assert view._librenms_api.get_device_info.call_args.kwargs.get("use_cache") is False
+
+
 class TestSyncIPAddressesViewCreateIP:
     def test_new_ip_is_created(self):
         from netbox_librenms_plugin.views.sync.ip_addresses import SyncIPAddressesView
@@ -1511,7 +1528,8 @@ def test_vlan_created_in_group(self):
             defaults={"name": "Production", "status": "active"},
         )
 
-    def test_invalid_vlan_group_id_falls_back_to_global(self):
+    def test_invalid_vlan_group_id_is_rejected(self):
+        """A requested-but-missing VLAN group fails closed: no VLAN is created (not even a global one) and an error is surfaced."""
         from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
 
         view = object.__new__(SyncVLANsView)
@@ -1531,7 +1549,7 @@ class _DNE(Exception):
         with (
             patch("netbox_librenms_plugin.views.sync.vlans.get_object_or_404", return_value=mock_device),
             patch("netbox_librenms_plugin.views.sync.vlans.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.vlans.messages"),
+            patch("netbox_librenms_plugin.views.sync.vlans.messages") as mock_messages,
             patch("netbox_librenms_plugin.views.sync.vlans.redirect"),
             patch("netbox_librenms_plugin.views.sync.vlans.transaction"),
             patch("netbox_librenms_plugin.views.sync.vlans.reverse", return_value="/sync/"),
@@ -1549,9 +1567,9 @@ class _DNE(Exception):
             )
             view.post(view.request, object_type="device", object_id=1)
 
-        # Falls back to global VLAN (group=None)
-        call_kwargs = mock_vlan_cls.objects.get_or_create.call_args[1]
-        assert call_kwargs.get("group") is None
+        # Fail closed: never create a VLAN in any scope, and surface an error.
+        mock_vlan_cls.objects.get_or_create.assert_not_called()
+        mock_messages.error.assert_called()
 
     def test_invalid_vid_string_skipped(self):
         from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
diff --git a/netbox_librenms_plugin/tests/test_coverage_utils.py b/netbox_librenms_plugin/tests/test_coverage_utils.py
index 5f0fa2e003..c1cc695348 100644
--- a/netbox_librenms_plugin/tests/test_coverage_utils.py
+++ b/netbox_librenms_plugin/tests/test_coverage_utils.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 class TestConvertSpeedToKbps:
     """Boundary and type tests for convert_speed_to_kbps."""
@@ -33,7 +35,6 @@ def test_1gbps(self):
         assert convert_speed_to_kbps(1_000_000_000) == 1_000_000
 
     def test_string_input_raises_type_error(self):
-        import pytest
         from netbox_librenms_plugin.utils import convert_speed_to_kbps
 
         with pytest.raises(TypeError):
@@ -321,6 +322,9 @@ def test_dash_hardware_returns_no_match(self):
         assert result["matched"] is False
 
 
+# match_librenms_hardware_to_device_type runs the device_type NormalizationRule query (issue
+# #90); django_db lets that real (empty) query run while the lookups stay mocked below.
+@pytest.mark.django_db
 class TestMatchLibrenmsHardwareDeviceTypeMappingPaths:
     """Tests for DeviceTypeMapping paths (lines 251-261)."""
 
@@ -372,6 +376,198 @@ def test_device_type_mapping_multiple_returns_logs_warning(self):
         assert result is None  # multiple DeviceTypeMapping matches returns None (ambiguous)
 
 
+@pytest.mark.django_db
+class TestMatchLibrenmsHardwareDeviceTypeNormalization:
+    """Issue #90: the documented ``device_type`` NormalizationRule scope must clean the raw LibreNMS hardware string before the DeviceTypeMapping / part_number / model lookups (docs/usage_tips/mapping_rules.md)."""
+
+    def _make_device_type(self):
+        from dcim.models import DeviceType, Manufacturer
+
+        mfr = Manufacturer.objects.create(name="Cisco-90", slug="cisco-90")
+        return DeviceType.objects.create(manufacturer=mfr, model="C9300-48P", slug="c9300-48p-90")
+
+    def test_device_type_scope_rule_normalizes_before_mapping_lookup(self):
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        dt = self._make_device_type()
+        # Mapping is keyed on the normalized hardware string (model lowercases on save).
+        DeviceTypeMapping.objects.create(librenms_hardware="C9300-48P", netbox_device_type=dt)
+        # A device_type-scoped rule strips the "WS-" prefix the raw LibreNMS string carries.
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+
+        result = match_librenms_hardware_to_device_type("WS-C9300-48P")
+
+        assert result is not None
+        assert result["matched"] is True
+        assert result["device_type"] == dt
+        assert result["match_type"] == "mapping"
+
+    def test_wrong_scope_rule_does_not_affect_device_type_matching(self):
+        """A module_type-scoped rule must NOT normalize device-type lookups: the raw string is used unchanged, so a WS-prefixed string does not match while the bare string does."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        dt = self._make_device_type()
+        DeviceTypeMapping.objects.create(librenms_hardware="C9300-48P", netbox_device_type=dt)
+        NormalizationRule.objects.create(
+            scope="module_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+
+        # Bare string matches the mapping directly; the wrong-scope WS- rule is not applied.
+        assert match_librenms_hardware_to_device_type("C9300-48P")["matched"] is True
+        assert match_librenms_hardware_to_device_type("WS-C9300-48P")["matched"] is False
+
+    def test_whitespace_padded_hardware_matches_stripped_mapping(self):
+        """Hardware with surrounding whitespace must still match the stripped-stored mapping (save() does .strip().lower(); iexact is not whitespace-insensitive, so the lookup must strip)."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        dt = self._make_device_type()
+        DeviceTypeMapping.objects.create(librenms_hardware="C9300-48P", netbox_device_type=dt)  # stored "c9300-48p"
+
+        # Unfixed: with no rules, search_name is the raw " C9300-48P " passed unstripped to iexact
+        # → never matches the stored "c9300-48p". Fixed: search_name is stripped before lookup.
+        result = match_librenms_hardware_to_device_type(" C9300-48P ")
+        assert result["matched"] is True
+        assert result["device_type"] == dt
+        assert result["match_type"] == "mapping"
+
+    def test_whitespace_only_hardware_never_matches_blank_part_number(self):
+        """A whitespace-only hardware string (truthy, so it passes the empty guard) must not match a DeviceType whose part_number is blank — part_number__iexact="" matches the field's default."""
+        from dcim.models import DeviceType
+
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        self._make_device_type()  # has no part number → a blank-part_number DeviceType exists
+        assert DeviceType.objects.filter(part_number="").exists()
+
+        result = match_librenms_hardware_to_device_type("   ")
+        assert result is not None
+        assert result["matched"] is False
+        assert result["device_type"] is None
+
+    def test_rule_emptied_hardware_does_not_match_blank_part_number(self):
+        """A rule that reduces the whole hardware string to empty must not turn the exact lookups into part_number__iexact="" — the raw string is what the exact lookups get, and it matches nothing here."""
+        from netbox_librenms_plugin.models import NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        self._make_device_type()  # blank part_number exists
+        # replacement may not be blank, so empty the string via an empty capture group.
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(\s*)$", replacement=r"\1", priority=10
+        )
+
+        result = match_librenms_hardware_to_device_type("WS-")
+        assert result is not None
+        assert result["matched"] is False
+
+    def test_crud_form_stored_mapping_still_matches_via_raw_fallback(self):
+        """A mapping created through the standard CRUD/CSV write path (model clean: .strip().lower() only, NO rule normalization) must still be found: the lookup falls back to the raw hardware string when the normalized key misses."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        dt = self._make_device_type()
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+        # The standard form/CSV path stores the entered string un-normalized → "ws-c9300-48p".
+        DeviceTypeMapping.objects.create(librenms_hardware="WS-C9300-48P", netbox_device_type=dt)
+
+        # Lookup normalizes to "C9300-48P" (miss) and must fall back to the raw key (hit).
+        result = match_librenms_hardware_to_device_type("WS-C9300-48P")
+        assert result is not None
+        assert result["matched"] is True
+        assert result["device_type"] == dt
+        assert result["match_type"] == "mapping"
+
+    def test_raw_exact_model_match_survives_rule_addition(self):
+        """The part_number/model exact lookups use the RAW LibreNMS string (the documented rule scope is the DeviceTypeMapping lookup only) — adding a rule must not break a previously-working literal model match."""
+        from dcim.models import DeviceType, Manufacturer
+
+        from netbox_librenms_plugin.models import NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        mfr = Manufacturer.objects.create(name="Cisco-raw-exact", slug="cisco-raw-exact")
+        dt = DeviceType.objects.create(manufacturer=mfr, model="WS-C9300-48P", slug="ws-c9300-48p-raw")
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+
+        # Raw string literally equals the DeviceType model; the rule must not hide it.
+        result = match_librenms_hardware_to_device_type("WS-C9300-48P")
+        assert result is not None
+        assert result["matched"] is True
+        assert result["device_type"] == dt
+        assert result["match_type"] == "exact"
+
+
+@pytest.mark.django_db
+class TestChassisFallbackHonorsPreloadedRules:
+    """Issue #90 / N+1: the chassis inventory fallback (_try_chassis_device_type_match) must thread the preloaded device_type rules into its own match call."""
+
+    def test_chassis_fallback_uses_preloaded_rules_no_per_call_query(self):
+        from unittest.mock import MagicMock
+
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from dcim.models import DeviceType, Manufacturer
+        from netbox_librenms_plugin.import_utils.device_operations import _try_chassis_device_type_match
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+        from netbox_librenms_plugin.utils import preload_normalization_rules
+
+        mfr = Manufacturer.objects.create(name="Cisco-chassis", slug="cisco-chassis")
+        dt = DeviceType.objects.create(manufacturer=mfr, model="C9300-48P", slug="c9300-48p-chassis")
+        DeviceTypeMapping.objects.create(librenms_hardware="C9300-48P", netbox_device_type=dt)
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+        preloaded = preload_normalization_rules("device_type")
+
+        # api is a true external boundary (LibreNMS HTTP): stub only the inventory call.
+        api = MagicMock()
+        api.get_inventory_filtered.return_value = (True, [{"entPhysicalName": "WS-C9300-48P"}])
+
+        with CaptureQueriesContext(connection) as ctx:
+            result = _try_chassis_device_type_match(api, 123, preloaded_device_type_rules=preloaded)
+
+        assert result is not None
+        assert result["matched"] is True
+        assert result["device_type"] == dt
+        assert result["match_type"] == "chassis"
+        # The preloaded rules must reach the inner matcher, so no NormalizationRule query fires here.
+        assert not any("normalizationrule" in q["sql"].lower() for q in ctx.captured_queries)
+
+    def test_preloaded_rules_skip_the_per_call_normalization_query(self):
+        """Perf (issue #90 / N+1): passing preloaded_rules must avoid the per-call device_type NormalizationRule query — the bulk-import loop preloads it once instead of per device."""
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from netbox_librenms_plugin.models import NormalizationRule
+        from netbox_librenms_plugin.utils import (
+            match_librenms_hardware_to_device_type,
+            preload_normalization_rules,
+        )
+
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+        preloaded = preload_normalization_rules("device_type")
+
+        with CaptureQueriesContext(connection) as preloaded_ctx:
+            match_librenms_hardware_to_device_type("WS-C9300-48P", preloaded_rules=preloaded)
+        assert not any("normalizationrule" in q["sql"].lower() for q in preloaded_ctx.captured_queries)
+
+        # Without preloading, the match does hit NormalizationRule (the per-device cost).
+        with CaptureQueriesContext(connection) as unpreloaded_ctx:
+            match_librenms_hardware_to_device_type("WS-C9300-48P")
+        assert any("normalizationrule" in q["sql"].lower() for q in unpreloaded_ctx.captured_queries)
+
+
+@pytest.mark.django_db
 class TestMatchLibrenmsHardwareDeviceTypeMultipleReturned:
     """Tests for DeviceType MultipleObjectsReturned — ambiguity surfaces as None."""
 
@@ -685,3 +881,80 @@ def test_returns_none_on_unparseable(self):
         fake_release = MagicMock(version="not-a-version")
         with patch("netbox.settings.RELEASE", fake_release):
             assert utils._get_netbox_version_tuple() is None
+
+
+class TestIsLegacyLibrenmsId:
+    """is_legacy_librenms_id: one place defining what counts as the legacy bare-integer form."""
+
+    def test_bare_int_is_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        assert is_legacy_librenms_id(42) is True
+
+    def test_int_parseable_string_is_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        # int()-based, unlike str.isdigit(): a whitespace-padded digit string is still legacy.
+        assert is_legacy_librenms_id("42") is True
+        assert is_legacy_librenms_id(" 42 ") is True
+
+    def test_bool_is_not_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        # bool is an int subclass; True/False must not be treated as a legacy id.
+        assert is_legacy_librenms_id(True) is False
+        assert is_legacy_librenms_id(False) is False
+
+    def test_dict_form_and_none_are_not_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        assert is_legacy_librenms_id({"default": {"id": 42}}) is False
+        assert is_legacy_librenms_id(None) is False
+
+    def test_non_numeric_string_is_not_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        assert is_legacy_librenms_id("abc") is False
+        assert is_legacy_librenms_id("") is False
+
+
+class TestValidateRegexField:
+    """validate_regex_field centralizes the re.compile -> ValidationError validator the mapping models share (NormalizationRule / CarrierAutoInstallRule / InventoryIgnoreRule / ModuleBayMapping / PortStackLagPattern)."""
+
+    def test_valid_pattern_returns_compiled(self):
+        import re
+
+        from netbox_librenms_plugin.utils import validate_regex_field
+
+        compiled = validate_regex_field(r"^Po\d+$", "lag_name_pattern")
+        assert isinstance(compiled, re.Pattern)
+        assert compiled.match("Po10")
+
+    def test_invalid_pattern_raises_field_scoped_validation_error(self):
+        from django.core.exceptions import ValidationError
+
+        from netbox_librenms_plugin.utils import validate_regex_field
+
+        with pytest.raises(ValidationError) as exc_info:
+            validate_regex_field("[unbalanced(", "device_type_pattern")
+        # Error attached to the named field with the shared "Invalid regex" wording.
+        assert "device_type_pattern" in exc_info.value.message_dict
+        assert "Invalid regex" in exc_info.value.message_dict["device_type_pattern"][0]
+
+    def test_model_clean_routes_bad_regex_through_the_shared_validator(self):
+        """A mapping model's clean() must reject an invalid regex via the shared helper — the bad-regex path through these models was previously untested."""
+        from django.core.exceptions import ValidationError
+
+        from netbox_librenms_plugin.models import ModuleBayMapping
+
+        mapping = ModuleBayMapping.__new__(ModuleBayMapping)
+        mapping.librenms_name = "[unbalanced("
+        mapping.librenms_class = ""
+        mapping.netbox_bay_name = "Slot 1"
+        mapping.is_regex = True
+        mapping.description = ""
+        with patch("netbox.models.NetBoxModel.clean"):
+            with pytest.raises(ValidationError) as exc_info:
+                mapping.clean()
+        assert "librenms_name" in exc_info.value.message_dict
+        assert "Invalid regex" in exc_info.value.message_dict["librenms_name"][0]
diff --git a/netbox_librenms_plugin/tests/test_id_lookup_lossy_coercion_realdb.py b/netbox_librenms_plugin/tests/test_id_lookup_lossy_coercion_realdb.py
new file mode 100644
index 0000000000..69a780fd60
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_id_lookup_lossy_coercion_realdb.py
@@ -0,0 +1,76 @@
+"""Real-DB guard against lossy librenms_id coercion in _refresh_existing_device.
+
+CodeRabbit (PR #116): ``_id_lookup`` did ``find_by_librenms_id(m, int(librenms_id), ...)``.
+``int(42.9)`` silently truncates to ``42`` and would bind an unrelated NetBox device whose
+librenms_id is 42. A float carries no exact integer id, so the refresh must fail closed
+instead of truncating into a different valid id.
+
+These tests exercise the real ORM: a real Device carrying ``librenms_id={"default": 42}``,
+with the libre_device hostname/sysName deliberately NOT matching the device name so a bind can
+only come from the id lookup. The float case must leave existing_device unset; the int case
+must bind it (positive control proving the lookup is genuinely exercised).
+"""
+
+import pytest
+
+
+def _make_device(name):
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="ACME-116", slug="acme-116")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-116", slug="dt-116")
+    role, _ = DeviceRole.objects.get_or_create(name="Role-116", slug="role-116")
+    site, _ = Site.objects.get_or_create(name="Site-116", slug="site-116")
+    return Device.objects.create(
+        name=name,
+        device_type=dt,
+        role=role,
+        site=site,
+        status="active",
+        custom_field_data={"librenms_id": {"default": 42}},
+    )
+
+
+@pytest.mark.django_db
+class TestIdLookupLossyCoercionRealDB:
+    def test_float_device_id_does_not_bind_by_truncated_id(self):
+        """A float device_id (42.9) must not truncate to 42 and bind the device linked to id 42."""
+        from netbox_librenms_plugin.import_utils.bulk_import import _refresh_existing_device
+
+        self._make_device_id_42()
+        validation = {"existing_device": None, "import_as_vm": False, "device_role": {}, "issues": []}
+        # hostname/sysName intentionally unmatched so a bind can only come from the id lookup.
+        libre_device = {"device_id": 42.9, "hostname": "no-such-host-116", "sysName": "no-such-sys-116"}
+
+        _refresh_existing_device(validation, libre_device=libre_device, server_key="default")
+
+        assert validation["existing_device"] is None
+
+    def test_int_device_id_binds(self):
+        """Positive control: an exact int device_id (42) binds the device — the lookup really runs."""
+        from netbox_librenms_plugin.import_utils.bulk_import import _refresh_existing_device
+
+        device = self._make_device_id_42()
+        validation = {"existing_device": None, "import_as_vm": False, "device_role": {}, "issues": []}
+        libre_device = {"device_id": 42, "hostname": "no-such-host-116", "sysName": "no-such-sys-116"}
+
+        _refresh_existing_device(validation, libre_device=libre_device, server_key="default")
+
+        assert validation["existing_device"] is not None
+        assert validation["existing_device"].pk == device.pk
+        assert validation["existing_match_type"] == "librenms_id"
+
+    def test_non_numeric_device_id_does_not_bind_by_id(self):
+        """A non-numeric device_id ("abc") yields no real id match → existing_device stays None."""
+        from netbox_librenms_plugin.import_utils.bulk_import import _refresh_existing_device
+
+        self._make_device_id_42()
+        validation = {"existing_device": None, "import_as_vm": False, "device_role": {}, "issues": []}
+        libre_device = {"device_id": "abc", "hostname": "no-such-host-116", "sysName": "no-such-sys-116"}
+
+        _refresh_existing_device(validation, libre_device=libre_device, server_key="default")
+
+        assert validation["existing_device"] is None
+
+    def _make_device_id_42(self):
+        return _make_device("lossy-coercion-host-116")
diff --git a/netbox_librenms_plugin/tests/test_librenms_id.py b/netbox_librenms_plugin/tests/test_librenms_id.py
index 5fa5559855..33a06ec6bb 100644
--- a/netbox_librenms_plugin/tests/test_librenms_id.py
+++ b/netbox_librenms_plugin/tests/test_librenms_id.py
@@ -4,6 +4,7 @@
 and migrate_legacy_librenms_id.
 """
 
+from types import SimpleNamespace
 from unittest.mock import MagicMock
 
 
@@ -372,3 +373,47 @@ def test_unexpected_cf_type_reset_to_empty(self):
         obj.custom_field_data = {"librenms_id": "unexpected-string"}
         set_librenms_device_id(obj, 5, server_key="primary")
         assert obj.custom_field_data["librenms_id"] == {"primary": 5}
+
+
+class TestIsLegacyLibreNMSIdPositivity:
+    """is_legacy_librenms_id must treat only a *positive* bare int / int-string as a legacy link."""
+
+    def test_positive_int_and_string_are_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        assert is_legacy_librenms_id(42) is True
+        assert is_legacy_librenms_id("42") is True
+        # int() coercion accepts surrounding whitespace / a leading +, so these stay legacy.
+        assert is_legacy_librenms_id(" 42 ") is True
+        assert is_legacy_librenms_id("+42") is True
+
+    def test_zero_and_negative_are_not_legacy(self):
+        """A LibreNMS device id is a positive PK; 0 / negative is not a real link and must not migrate."""
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        for value in (0, -1, "0", " 0 ", "-1", "-42", "+0"):
+            assert is_legacy_librenms_id(value) is False, value
+
+    def test_non_numeric_and_dict_and_bool_are_not_legacy(self):
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id
+
+        for value in (None, True, False, "abc", "", {"default": 42}):
+            assert is_legacy_librenms_id(value) is False, value
+
+
+class TestMigrateLegacyRejectsNonPositive:
+    """migrate_legacy_librenms_id must never canonicalise a non-positive id into the JSON form."""
+
+    def test_zero_is_not_migrated(self):
+        from netbox_librenms_plugin.utils import migrate_legacy_librenms_id
+
+        obj = SimpleNamespace(custom_field_data={"librenms_id": 0})
+        assert migrate_legacy_librenms_id(obj, "default") is False
+        assert obj.custom_field_data["librenms_id"] == 0  # left untouched, not {"default": 0}
+
+    def test_negative_is_not_migrated(self):
+        from netbox_librenms_plugin.utils import migrate_legacy_librenms_id
+
+        obj = SimpleNamespace(custom_field_data={"librenms_id": "-5"})
+        assert migrate_legacy_librenms_id(obj, "default") is False
+        assert obj.custom_field_data["librenms_id"] == "-5"
diff --git a/netbox_librenms_plugin/tests/test_mixins_helpers.py b/netbox_librenms_plugin/tests/test_mixins_helpers.py
new file mode 100644
index 0000000000..1893f7941e
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_mixins_helpers.py
@@ -0,0 +1,89 @@
+"""Real tests for the shared mixin helpers consolidated during the develop-hardening pass.
+
+- ``extract_cached_ports`` now reuses ``is_list_of_dicts`` for its ports-shape check (B7).
+- ``LibreNMSAPIMixin.resolve_requested_server_key`` centralises the "configured-string-key-or
+  -fallback" rule the device verify/render views each open-coded (B12).
+
+These exercise the real functions against the real Django cache / real plugin config — no mocks.
+"""
+
+from unittest.mock import patch
+
+import pytest
+from django.core.cache import cache as real_cache
+from django.test import RequestFactory
+
+from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+
+class TestExtractCachedPortsShapeCheck:
+    """extract_cached_ports must accept a valid ports payload and treat any malformed shape as a miss."""
+
+    def _fn(self):
+        from netbox_librenms_plugin.views.mixins import extract_cached_ports
+
+        return extract_cached_ports
+
+    def test_valid_payload_returned_unchanged(self):
+        payload = {"ports": [{"port_id": 1, "ifName": "eth0"}]}
+        assert self._fn()(payload) is payload
+
+    def test_empty_ports_list_is_valid(self):
+        # An empty list is a device that legitimately has no ports — still a valid payload.
+        payload = {"ports": []}
+        assert self._fn()(payload) is payload
+
+    def test_non_dict_cached_value_is_miss(self):
+        assert self._fn()(["legacy", "bare", "list"]) is None
+
+    def test_non_list_ports_is_miss(self):
+        assert self._fn()({"ports": "not-a-list"}) is None
+
+    def test_non_dict_port_row_is_miss_and_purges_cache(self):
+        key = "test-b7-extract-cached-ports"
+        bad = {"ports": [{"port_id": 1}, "not-a-dict"]}
+        real_cache.set(key, bad, timeout=60)
+        try:
+            assert self._fn()(bad, cache_key=key) is None
+            assert real_cache.get(key) is None  # the corrupt entry is purged, not re-served
+        finally:
+            real_cache.delete(key)
+
+
+@pytest.mark.django_db
+class TestResolveRequestedServerKey:
+    """resolve_requested_server_key honours only a configured string key, else degrades to _render_server_key.
+
+    The configured-server set (LibreNMSAPI.get_available_servers) is the external plugin-config
+    boundary; it's pinned per test so the assertion is deterministic (a session-wide autouse fixture
+    in the API-test helpers otherwise leaves get_plugin_config mocked to a default-only config). The
+    helper's own logic — isinstance guard, membership check, degrading fallback — runs for real.
+    """
+
+    def _view(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        view = DeviceInterfaceTableView()
+        view.request = RequestFactory().get("/")
+        return view
+
+    def test_configured_string_key_is_honoured(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"prod": "Prod", "default": "Default"}):
+            assert view.resolve_requested_server_key({"server_key": "prod"}) == "prod"
+
+    def test_unconfigured_key_falls_back_to_render_resolver(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"default": "Default"}):
+            # "prod" is not among the configured servers → degrade, don't address its namespace.
+            assert view.resolve_requested_server_key({"server_key": "prod"}) == view._render_server_key()
+
+    def test_non_string_key_falls_back_without_crashing(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"prod": "Prod"}):
+            # A JSON list is unhashable; the membership check must be skipped, not TypeError.
+            assert view.resolve_requested_server_key({"server_key": ["forged"]}) == view._render_server_key()
+
+    def test_missing_key_falls_back(self):
+        view = self._view()
+        assert view.resolve_requested_server_key({}) == view._render_server_key()
diff --git a/netbox_librenms_plugin/tests/test_payload_hardening.py b/netbox_librenms_plugin/tests/test_payload_hardening.py
new file mode 100644
index 0000000000..94b25a3fb9
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_payload_hardening.py
@@ -0,0 +1,225 @@
+"""Issue #100: base views must fail closed on malformed-but-truthy LibreNMS payloads.
+
+A LibreNMS ``success=True`` response can still carry a non-well-shaped body (a string, a
+list of scalars, a dict with a non-list ``ports``). Dereferencing it turned a refresh into a
+500 instead of the existing error/fallback path. These tests cover the shared
+``is_list_of_dicts`` guard and the three develop-owned sites that adopt it.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+def _make_real_device(tag):
+    """Create and return a real NetBox Device (with its required FKs) for DB-backed tests."""
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-{tag}", slug=f"mfr-{tag}")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-{tag}", slug=f"dt-{tag}")
+    role, _ = DeviceRole.objects.get_or_create(name=f"Role-{tag}", slug=f"role-{tag}")
+    site, _ = Site.objects.get_or_create(name=f"Site-{tag}", slug=f"site-{tag}")
+    return Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
+
+
+class TestIsListOfDicts:
+    """Unit tests for the shared payload-shape guard."""
+
+    def test_list_of_dicts_is_true(self):
+        from netbox_librenms_plugin.utils import is_list_of_dicts
+
+        assert is_list_of_dicts([{"a": 1}, {"b": 2}]) is True
+
+    def test_empty_list_is_true(self):
+        """A device legitimately with no rows is valid."""
+        from netbox_librenms_plugin.utils import is_list_of_dicts
+
+        assert is_list_of_dicts([]) is True
+
+    def test_non_list_is_false(self):
+        from netbox_librenms_plugin.utils import is_list_of_dicts
+
+        assert is_list_of_dicts("oops") is False
+        assert is_list_of_dicts({"a": 1}) is False
+        assert is_list_of_dicts(None) is False
+
+    def test_list_with_a_scalar_row_is_false(self):
+        from netbox_librenms_plugin.utils import is_list_of_dicts
+
+        assert is_list_of_dicts([{"a": 1}, "scalar"]) is False
+
+
+class TestInterfacePostMalformedPorts:
+    """Site 1: BaseInterfaceTableView.post must fail closed when get_ports returns a truthy-but-malformed payload, redirecting with an error instead of 500ing."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+
+        view = object.__new__(BaseInterfaceTableView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        view._librenms_api.cache_timeout = 300
+        return view
+
+    def test_non_dict_ports_payload_redirects_without_500(self):
+        view = self._make_view()
+        view._librenms_api.get_librenms_id.return_value = 1
+        # success=True but the body is a bare string (malformed).
+        view._librenms_api.get_ports.return_value = (True, "garbage-string")
+        view.get_object = MagicMock(return_value=MagicMock())
+        view.get_redirect_url = MagicMock(return_value="/redirect")
+
+        with (
+            patch(
+                "netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field",
+                return_value="ifName",
+            ),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.messages") as mock_messages,
+            patch(
+                "netbox_librenms_plugin.views.base.interfaces_view.redirect",
+                return_value="REDIRECT",
+            ) as mock_redirect,
+        ):
+            result = view.post(MagicMock(), pk=1)
+
+        assert result == "REDIRECT"
+        mock_redirect.assert_called_once_with("/redirect")
+        assert mock_messages.error.called  # error surfaced, not a 500
+
+
+class TestSyncViewDeviceInfoMalformed:
+    """Site 2: get_librenms_device_info must fall back to default details when get_device_info returns a truthy non-dict payload."""
+
+    def test_non_dict_device_info_falls_back_to_defaults(self):
+        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
+
+        view = object.__new__(BaseLibreNMSSyncView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        view.librenms_id = 1
+        view._librenms_api.get_device_info.return_value = (True, "garbage-string")
+
+        obj = MagicMock()
+        obj.name = "dev1"
+        obj.primary_ip = None
+
+        result = view.get_librenms_device_info(obj)
+
+        assert result["found_in_librenms"] is False
+        # Default details block (no fields read off the malformed payload).
+        assert result["librenms_device_details"]["librenms_device_hardware"] == "-"
+        assert result["librenms_device_details"]["librenms_device_serial"] == "-"
+
+
+class TestVLANFetchMalformedPayload:
+    """Site 3: _fetch_and_cache_vlan_data must reject a truthy non-list-of-dicts payload and not cache it (compare_vlans would later 500 on vlan.get(...))."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.base.vlan_table_view import BaseVLANTableView
+
+        view = object.__new__(BaseVLANTableView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        view._librenms_api.cache_timeout = 300
+        view.librenms_id = 1
+        return view
+
+    def test_malformed_vlan_payload_fails_closed_without_caching(self):
+        view = self._make_view()
+        view._librenms_api.get_device_vlans.return_value = (True, "garbage-string")
+
+        with patch("netbox_librenms_plugin.views.base.vlan_table_view.cache") as mock_cache:
+            success, msg = view._fetch_and_cache_vlan_data(MagicMock())
+
+        assert success is False
+        assert "malformed" in msg.lower()
+        mock_cache.set.assert_not_called()
+
+    def test_valid_vlan_payload_is_cached(self):
+        view = self._make_view()
+        view._librenms_api.get_device_vlans.return_value = (True, [{"vlan_vlan": 10}])
+
+        with patch("netbox_librenms_plugin.views.base.vlan_table_view.cache") as mock_cache:
+            success, msg = view._fetch_and_cache_vlan_data(MagicMock())
+
+        assert success is True
+        assert msg is None
+        assert mock_cache.set.called
+
+    @pytest.mark.django_db
+    def test_malformed_cached_vlans_fails_closed_on_render(self):
+        """A stale/corrupt cached VLAN snapshot must be dropped, purged and rendered empty rather than 500 compare_vlans() on a GET render (covers a pre-fix entry still in the cache; real Device, only the cache backend is stubbed)."""
+        from django.test import RequestFactory
+
+        device = _make_real_device("vlan-readguard")
+        view = self._make_view()
+        request = RequestFactory().get("/")
+        vlans_key = view.get_cache_key(device, "vlans", "default")
+
+        for bad in ("garbage-string", [42], [{"vlan_vlan": 1}, "scalar"]):
+            with patch("netbox_librenms_plugin.views.base.vlan_table_view.cache") as mock_cache:
+                mock_cache.get.side_effect = lambda key, bad=bad, vk=vlans_key: bad if key == vk else None
+                mock_cache.ttl.return_value = None
+                ctx = view.get_vlan_context(request, device)  # must not raise
+
+            assert ctx["vlan_table"] is None  # rendered empty, no 500 from compare_vlans
+            assert any(c.args and c.args[0] == vlans_key for c in mock_cache.delete.call_args_list)  # purged
+
+    @pytest.mark.django_db
+    def test_empty_cached_vlans_renders_empty_table(self):
+        """An empty-but-valid cached VLAN snapshot ([] — a device with no VLANs after a successful refresh) must still render a (empty) table, not be skipped by a truthy check and look like it never loaded."""
+        from django.test import RequestFactory
+
+        from django.contrib.auth.models import AnonymousUser
+
+        device = _make_real_device("vlan-empty-render")
+        view = self._make_view()
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()  # building the table reads request.user for paginate count
+        vlans_key = view.get_cache_key(device, "vlans", "default")
+
+        with patch("netbox_librenms_plugin.views.base.vlan_table_view.cache") as mock_cache:
+            mock_cache.get.side_effect = lambda key, vk=vlans_key: [] if key == vk else None
+            mock_cache.ttl.return_value = None
+            ctx = view.get_vlan_context(request, device)
+
+        assert ctx["vlan_table"] is not None  # the empty list still builds a table
+
+
+@pytest.mark.django_db
+class TestInterfaceCachedRenderMalformedPorts:
+    """Site 4: the cached interface render degrades a malformed cached ``ports`` to an empty table."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        view = DeviceInterfaceTableView()
+        # librenms_api is the external boundary this cached-render path never calls (it reads only the
+        # already-cached snapshot); stub only the server_key that get_table() reads.
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        return view
+
+    @pytest.mark.parametrize("bad_ports", [None, [{"port_id": 1}, "scalar"], "garbage-string"])
+    def test_malformed_cached_ports_renders_empty_without_500(self, bad_ports):
+        """A dict envelope carrying a non-list-of-dicts ``ports`` renders an empty table, not a 500."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        device = _make_real_device("iface-cache-readguard")
+        view = self._make_view()
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()  # table.configure paginates -> reads request.user
+        view.setup(request)  # sets self.request, which get_table() reads for the htmx_url
+        ports_key = view.get_cache_key(device, "ports", "default")
+        cache.set(ports_key, {"ports": bad_ports})
+        try:
+            # Pre-fix, `for port in ports_data` (ports_data=None) / `port.get(...)` (scalar row) 500s here.
+            ctx = view.get_context_data(request, device, "ifName", server_key="default")
+        finally:
+            cache.delete(ports_key)
+
+        assert ctx["table"] is not None  # degraded to an empty-but-real table built from []
+        assert len(list(ctx["table"].rows)) == 0
+        assert ctx["netbox_only_interfaces"] == []
diff --git a/netbox_librenms_plugin/tests/test_render_server_key_degrade.py b/netbox_librenms_plugin/tests/test_render_server_key_degrade.py
new file mode 100644
index 0000000000..893bdf8b28
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_render_server_key_degrade.py
@@ -0,0 +1,122 @@
+"""The modules/interfaces tab renders must degrade (not 500) when the client is unbuildable.
+
+The lazy ``librenms_api`` property raises KeyError/ValueError when the LibreNMS server
+config is missing or misconfigured. The cables and IP tabs resolve their render-path
+server key through ``_render_server_key`` (None fallback); these tests pin the same
+degrade on the modules and interfaces tabs, which resolved through the raising property.
+"""
+
+from unittest.mock import patch
+
+import pytest
+from django.test import RequestFactory
+
+
+def _make_device(name):
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="Degrade-Mfr", slug="degrade-mfr")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="Degrade-DT", slug="degrade-dt")
+    role, _ = DeviceRole.objects.get_or_create(name="Degrade-Role", slug="degrade-role")
+    site, _ = Site.objects.get_or_create(name="Degrade-Site", slug="degrade-site")
+    return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
+
+
+def _patch_unbuildable_config():
+    """No servers dict and no legacy url/token: LibreNMSAPI() raises ValueError."""
+    return patch(
+        "netbox_librenms_plugin.librenms_api.get_plugin_config",
+        side_effect=lambda app, key, default=None: default,
+    )
+
+
+@pytest.mark.django_db
+class TestModulesTabDegradesOnUnbuildableClient:
+    def test_get_context_data_returns_empty_panel_not_500(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+
+        device = _make_device("degrade-mod-dev")
+        request = RequestFactory().get("/")
+        view = DeviceModuleTableView()
+        view.request = request
+
+        with _patch_unbuildable_config():
+            context = view.get_context_data(request, device)
+
+        assert context["table"] is None
+        assert context["object"] == device
+        assert context["server_key"] is None
+
+
+@pytest.mark.django_db
+class TestInterfacesTabDegradesOnUnbuildableClient:
+    def test_get_context_data_renders_with_none_key_not_500(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        device = _make_device("degrade-if-dev")
+        request = RequestFactory().get("/")
+        view = DeviceInterfaceTableView()
+        view.request = request
+
+        with _patch_unbuildable_config():
+            context = view.get_context_data(request, device, interface_name_field="ifName")
+
+        # Degrades to the empty cached-table shape under the None (default) scope.
+        assert context["table"] is None
+
+
+@pytest.mark.django_db
+class TestCablesPortsCacheShapeGuard:
+    """get_ports_data must treat a truthy but malformed ports cache entry as a miss."""
+
+    def test_corrupt_ports_cache_falls_through_to_live_fetch(self):
+        from django.core.cache import cache as real_cache
+        from unittest.mock import MagicMock
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceCableTableView
+
+        device = _make_device("degrade-cable-dev")
+        view = DeviceCableTableView()
+        view.request = RequestFactory().get("/")
+        view.librenms_id = 4242
+        # The live-fetch boundary: a real call would hit LibreNMS over HTTP.
+        view._librenms_api = MagicMock(server_key="alpha")
+        view._librenms_api.get_ports.return_value = (True, {"ports": [{"port_id": 1, "ifName": "eth0"}]})
+
+        cache_key = view.get_cache_key(device, "ports", "alpha")
+        real_cache.set(cache_key, ["corrupt", "legacy", "shape"], timeout=60)
+        try:
+            ports_data = view.get_ports_data(device)
+
+            # The corrupt entry is not returned (get_links_data would .get("ports") on it)...
+            assert isinstance(ports_data, dict)
+            assert ports_data["ports"][0]["ifName"] == "eth0"
+            # ...and is purged so the next read doesn't serve it again.
+            assert real_cache.get(cache_key) is None
+        finally:
+            real_cache.delete(cache_key)
+
+
+@pytest.mark.django_db
+class TestVlanTabDegradesOnUnbuildableClient:
+    """The VLAN tab must resolve its render-path server key through _render_server_key too.
+
+    get_vlan_context read the key via getattr(self.librenms_api, "server_key", None); the lazy
+    librenms_api property raises ValueError (not AttributeError) on an unbuildable config, so getattr
+    could not swallow it and the VLAN tab 500'd where the sibling tabs already degraded.
+    """
+
+    def test_get_vlan_context_returns_none_key_not_500(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceVLANTableView
+
+        device = _make_device("degrade-vlan-dev")
+        request = RequestFactory().get("/")
+        view = DeviceVLANTableView()
+        view.request = request
+
+        with _patch_unbuildable_config():
+            context = view.get_vlan_context(request, device)
+
+        assert context["server_key"] is None
+        assert context["vlan_table"] is None
+        assert context["object"] == device
diff --git a/netbox_librenms_plugin/tests/test_reviewer_fixes.py b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
index bfb7632a59..06814c843e 100644
--- a/netbox_librenms_plugin/tests/test_reviewer_fixes.py
+++ b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
@@ -10,6 +10,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 # ---------------------------------------------------------------------------
 # _load_vc_member_name_pattern
@@ -195,14 +197,10 @@ def test_member_name_is_escaped(self):
         vc.members.all.return_value = [member]
         device.virtual_chassis = vc
 
+        # The dropdown options render from the member set cached in __init__.
         table = VCCableTable([], device=device)
         record = {"local_port": "eth0", "local_port_id": "42"}
-
-        with patch(
-            "netbox_librenms_plugin.tables.cables.get_virtual_chassis_member",
-            return_value=member,
-        ):
-            html = str(table.render_device_selection(None, record))
+        html = str(table.render_device_selection(None, record))
 
         # The raw <script> tag must NOT appear — it should be escaped
         assert "<script>" not in html
@@ -267,6 +265,10 @@ def test_server_key_used_for_cache_lookup(self):
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
+        # dispatch() sets self.request in production; this direct post() call needs an authorized
+        # request for the object-permission gate (reads self.request.user.has_perm).
+        view.request = MagicMock()
+        view.request.user.has_perm.return_value = True
         view._librenms_api.server_key = "default-server"
 
         request = MagicMock()
@@ -281,6 +283,13 @@ def test_server_key_used_for_cache_lookup(self):
         mock_device = MagicMock()
 
         with (
+            # The posted key is honoured only when it names a configured server; post() checks the
+            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance) so it never builds a
+            # possibly-broken default client just to validate membership.
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"production": "Production"},
+            ),
             patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
@@ -307,6 +316,10 @@ def test_fallback_to_api_server_key(self):
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
+        # dispatch() sets self.request in production; this direct post() call needs an authorized
+        # request for the object-permission gate (reads self.request.user.has_perm).
+        view.request = MagicMock()
+        view.request.user.has_perm.return_value = True
         view._librenms_api.server_key = "fallback-server"
 
         request = MagicMock()
@@ -382,45 +395,52 @@ def test_api_passed_to_validate(self):
 # CreateAndAssignPlatformView — full_clean before save
 # ---------------------------------------------------------------------------
 class TestCreatePlatformFullClean:
-    """CreateAndAssignPlatformView must call full_clean() so ValidationError is catchable."""
+    """CreateAndAssignPlatformView must surface a real Platform.full_clean() ValidationError, not 500."""
+
+    @staticmethod
+    def _make_device(name):
+        """Create a minimal real Device (this branch predates the conftest real-DB builders)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        site, _ = Site.objects.get_or_create(name="PFTestSite", slug="pf-test-site")
+        mfr, _ = Manufacturer.objects.get_or_create(name="PFTestMfr", slug="pf-test-mfr")
+        dtype, _ = DeviceType.objects.get_or_create(model="PFTestDT", slug="pf-test-dt", defaults={"manufacturer": mfr})
+        role, _ = DeviceRole.objects.get_or_create(name="PFTestRole", slug="pf-test-role", defaults={"color": "00ff00"})
+        return Device.objects.create(name=name, device_type=dtype, role=role, site=site, status="active")
 
-    def test_validation_error_caught_on_slug_collision(self):
-        """When full_clean raises ValidationError, user sees error message instead of 500."""
-        from django.core.exceptions import ValidationError
+    @pytest.mark.django_db
+    def test_real_slug_collision_is_caught_and_reported(self):
+        """A real slug collision (different name, same slugify) is rejected by Platform.full_clean() and reported, not 500'd."""
+        from dcim.models import Platform
 
         from netbox_librenms_plugin.views.sync.device_fields import CreateAndAssignPlatformView
 
-        view = object.__new__(CreateAndAssignPlatformView)
+        device = self._make_device("platform-collision-dev")
+        # An existing platform already owns the slug "test-platform".
+        Platform.objects.create(name="Existing Platform", slug="test-platform")
 
+        view = object.__new__(CreateAndAssignPlatformView)
+        view.require_all_permissions = MagicMock(return_value=None)  # the permission boundary
         request = MagicMock()
         request.method = "POST"
-        request.POST = {"platform_name": "test-platform"}
-        request.user.has_perm.return_value = True
+        # A DIFFERENT name that slugifies to the SAME slug: passes the name-exists short-circuit
+        # but trips the real Platform.full_clean() unique-slug validation.
+        request.POST = {"platform_name": "Test Platform"}
         view.request = request
 
         with (
-            patch("netbox_librenms_plugin.views.sync.device_fields.get_object_or_404"),
-            patch("netbox_librenms_plugin.views.sync.device_fields.Manufacturer"),
-            patch("netbox_librenms_plugin.views.sync.device_fields.Platform") as MockPlatform,
-            patch("netbox_librenms_plugin.views.sync.device_fields.transaction"),
             patch("netbox_librenms_plugin.views.sync.device_fields.messages") as mock_messages,
-            patch("netbox_librenms_plugin.views.sync.device_fields.redirect"),
+            patch("netbox_librenms_plugin.views.sync.device_fields.redirect", return_value="redirected"),
         ):
-            # objects.filter().exists() returns False (no existing platform)
-            MockPlatform.objects.filter.return_value.exists.return_value = False
-            # Simulate full_clean raising ValidationError (slug collision)
-            platform_instance = MagicMock()
-            platform_instance.full_clean.side_effect = ValidationError("Slug already exists")
-            MockPlatform.return_value = platform_instance
-
-            view.post(request, pk=1)
-
-            # full_clean must have been called (not just .create())
-            platform_instance.full_clean.assert_called_once()
-            # save must NOT have been called (ValidationError raised before save)
-            platform_instance.save.assert_not_called()
-            # Error message should be shown to user with the actual validation detail
-            mock_messages.error.assert_called_once()
-            error_msg = mock_messages.error.call_args[0][1]
-            assert "could not be created" in error_msg
-            assert "Slug already exists" in error_msg
+            result = view.post(request, pk=device.pk)
+
+        # The real full_clean() rejected the duplicate slug — no second platform was created...
+        assert Platform.objects.filter(slug="test-platform").count() == 1
+        assert not Platform.objects.filter(name="Test Platform").exists()
+        # ...and the device's platform was left unset (the create rolled back before assignment).
+        device.refresh_from_db()
+        assert device.platform_id is None
+        # The user is shown the caught error, not a 500.
+        assert result == "redirected"
+        mock_messages.error.assert_called_once()
+        assert "could not be created" in mock_messages.error.call_args[0][1]
diff --git a/netbox_librenms_plugin/tests/test_utils.py b/netbox_librenms_plugin/tests/test_utils.py
index 3c4acb5a79..fe1ef2baf9 100644
--- a/netbox_librenms_plugin/tests/test_utils.py
+++ b/netbox_librenms_plugin/tests/test_utils.py
@@ -8,11 +8,17 @@
 import json
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 # =============================================================================
 # TestDeviceTypeMatching - 5 tests
 # =============================================================================
 
 
+# match_librenms_hardware_to_device_type now runs the device_type NormalizationRule query
+# (issue #90); enabling django_db lets that real (empty) query run while the lookups below
+# stay mocked, so the matching assertions are unaffected.
+@pytest.mark.django_db
 class TestDeviceTypeMatching:
     """Test device type matching logic."""
 
@@ -1096,3 +1102,306 @@ def test_missing_catalog_value_renders_unknown(self):
         assert "Device type: _(unknown)_" in out
         # Template pairs section falls back to a no-templates note.
         assert "_(no templates)_" in out
+
+
+# =============================================================================
+# DeviceTypeMapping re-normalization data migration (0011)
+# =============================================================================
+@pytest.mark.django_db
+class TestRenormalizeDeviceTypeMappingsMigration:
+    """The 0011 data migration re-keys pre-existing DeviceTypeMapping rows through the
+    device_type NormalizationRule scope so they keep matching the normalized lookup.
+
+    Exercises the REAL objects end-to-end: a real NormalizationRule, a real
+    DeviceTypeMapping stored under its un-normalized key, the real
+    match_librenms_hardware_to_device_type lookup, and the real migration function.
+    """
+
+    @staticmethod
+    def _device_type(model="Renorm-DT"):
+        from dcim.models import DeviceType, Manufacturer
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Renorm-Mfr", slug="renorm-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=model, slug="renorm-dt")
+        return dt
+
+    @staticmethod
+    def _run_migration():
+        import importlib
+
+        from django.apps import apps
+
+        module = importlib.import_module("netbox_librenms_plugin.migrations.0011_renormalize_device_type_mappings")
+        module.renormalize_device_type_mappings(apps, None)
+
+    def test_existing_mapping_is_rekeyed_so_lookup_matches(self):
+        """A pre-normalization mapping only matches the normalized lookup after the migration re-keys it."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+        from netbox_librenms_plugin.utils import match_librenms_hardware_to_device_type
+
+        dt = self._device_type()
+        # device_type rule strips the 'acme-' vendor prefix (capture-group replacement, since
+        # the replacement field cannot be blank).
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^acme-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        # Pre-normalization row: stored under the raw (only lowercased) hardware key.
+        DeviceTypeMapping.objects.create(librenms_hardware="acme-router-x", netbox_device_type=dt)
+
+        # BEFORE the migration the normalized lookup ('router-x') misses the raw row, but the
+        # lookup's raw-key fallback still finds it — the migration's job is canonicalization,
+        # not rescue (a lookup for a DIFFERENT raw spelling, e.g. 'ACME-Router-X ', normalizes
+        # to 'router-x' and only matches once the row is re-keyed).
+        before = match_librenms_hardware_to_device_type("acme-router-x")
+        assert before["matched"] is True
+        assert not DeviceTypeMapping.objects.filter(librenms_hardware="router-x").exists()
+
+        self._run_migration()
+
+        # The row is re-keyed to the normalized value...
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="router-x").exists()
+        # ...so the same lookup now resolves to the mapped device type.
+        after = match_librenms_hardware_to_device_type("acme-router-x")
+        assert after["matched"] is True
+        assert after["match_type"] == "mapping"
+        assert after["device_type"] == dt
+
+    def test_noop_when_no_device_type_rules(self):
+        """With no device_type rules the migration leaves the stored key untouched."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping
+
+        dt = self._device_type(model="Renorm-DT2")
+        DeviceTypeMapping.objects.create(librenms_hardware="plain-hw-9000", netbox_device_type=dt)
+
+        self._run_migration()
+
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="plain-hw-9000").exists()
+
+    def test_collision_is_skipped_not_crashed(self):
+        """Two raw mappings normalizing to the same key are skipped, not crashed on the unique constraint."""
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT3")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^v\d+-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        # Both collapse to 'switch-1' after stripping the version prefix; plus an already-clean row.
+        DeviceTypeMapping.objects.create(librenms_hardware="switch-1", netbox_device_type=dt)
+        DeviceTypeMapping.objects.create(librenms_hardware="v2-switch-1", netbox_device_type=dt)
+
+        # Must not raise (IntegrityError) on the unique librenms_hardware constraint.
+        self._run_migration()
+
+        # The clean row survives; the colliding raw row is left as-is (not silently dropped).
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="switch-1").exists()
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="v2-switch-1").exists()
+
+    def test_row_save_failure_is_skipped_not_aborted(self, monkeypatch):
+        """An unexpected DB error on one row's save must skip that row and continue, not abort the upgrade.
+
+        The pre-check only guards the known uniqueness clash; a different write failure (e.g. an
+        over-length value) would otherwise propagate out of the migration and block the whole
+        upgrade. The bad row is left at its original key and the rest are still re-keyed.
+        """
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT5")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^x-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        DeviceTypeMapping.objects.create(librenms_hardware="x-boom", netbox_device_type=dt)
+        DeviceTypeMapping.objects.create(librenms_hardware="x-good", netbox_device_type=dt)
+
+        real_save = DeviceTypeMapping.save
+
+        def flaky_save(inst, *args, **kwargs):
+            # The migration mutates librenms_hardware to the normalized value before save, so the
+            # boom row reaches save() keyed "boom". Fail only that write; let every other save run.
+            if inst.librenms_hardware == "boom":
+                raise RuntimeError("simulated write failure (e.g. value too long)")
+            return real_save(inst, *args, **kwargs)
+
+        monkeypatch.setattr(DeviceTypeMapping, "save", flaky_save)
+
+        # Must NOT propagate the boom row's save error out of the migration.
+        self._run_migration()
+
+        # The failed row is left at its original key (skipped); the good row is still re-keyed.
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="x-boom").exists()
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="good").exists()
+
+    def test_db_error_on_one_row_does_not_poison_the_rest(self, monkeypatch):
+        """A real DB error on one row's save must be confined to that row's savepoint so the rest still migrate.
+
+        A plain try/except cannot recover from a database error: on PostgreSQL it aborts the whole
+        transaction, so the NEXT row's query raises "current transaction is aborted". Only a per-row
+        transaction.atomic() savepoint lets the migration skip the bad row and continue. This drives
+        a genuine DB error (SELECT 1/0), not a Python raise, so it actually exercises the savepoint.
+        """
+        from django.db import connection
+
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT6")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^y-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        # Iterated in librenms_hardware order, so 'y-boom' (→ 'boom') is processed before 'y-good'.
+        DeviceTypeMapping.objects.create(librenms_hardware="y-boom", netbox_device_type=dt)
+        DeviceTypeMapping.objects.create(librenms_hardware="y-good", netbox_device_type=dt)
+
+        real_save = DeviceTypeMapping.save
+
+        def poisoning_save(inst, *args, **kwargs):
+            if inst.librenms_hardware == "boom":
+                # A genuine DB error poisons the transaction the way a real IntegrityError/DataError
+                # mid-migration would — recoverable only by rolling back this row's savepoint.
+                with connection.cursor() as cur:
+                    cur.execute("SELECT 1 / 0")
+            return real_save(inst, *args, **kwargs)
+
+        monkeypatch.setattr(DeviceTypeMapping, "save", poisoning_save)
+
+        # Without the savepoint, the good row's query would raise "current transaction is aborted".
+        self._run_migration()
+
+        # The poisoned row is left at its original key (savepoint rolled back); the good row re-keyed.
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="y-boom").exists()
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="good").exists()
+
+    def test_db_error_in_normalization_does_not_poison_the_rest(self, monkeypatch):
+        """A DB error inside apply_normalization_rules must be confined to that row's savepoint too.
+
+        The rule queries (and the clash .exists()) run inside the migration's outer atomic
+        transaction just like the save: an unguarded DB failure there aborts the transaction on
+        PostgreSQL, so the NEXT row's query raises "current transaction is aborted" and the
+        upgrade crashes partway — the exact failure the per-save savepoint was added to prevent.
+        This drives a genuine DB error (SELECT 1/0) through the normalization call.
+        """
+        from django.db import connection
+
+        from netbox_librenms_plugin import utils as plugin_utils
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT7")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^z-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        # Iterated in librenms_hardware order, so 'z-boom' is processed before 'z-good'.
+        DeviceTypeMapping.objects.create(librenms_hardware="z-boom", netbox_device_type=dt)
+        DeviceTypeMapping.objects.create(librenms_hardware="z-good", netbox_device_type=dt)
+
+        real_apply = plugin_utils.apply_normalization_rules
+
+        def poisoned_apply(value, scope, *args, **kwargs):
+            if value == "z-boom":
+                with connection.cursor() as cur:
+                    cur.execute("SELECT 1 / 0")
+            return real_apply(value, scope, *args, **kwargs)
+
+        # The migration imports the symbol inside the function body, so patching the module
+        # attribute is exactly what its runtime import resolves.
+        monkeypatch.setattr(plugin_utils, "apply_normalization_rules", poisoned_apply)
+
+        # Without a per-row savepoint around the normalization, the good row's clash check
+        # would raise "current transaction is aborted".
+        self._run_migration()
+
+        # The poisoned row is left untouched; the good row is still re-keyed.
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="z-boom").exists()
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="good").exists()
+
+
+class TestCacheRemainingTtl:
+    """cache_remaining_ttl reads .ttl on django-redis and degrades to None on backends without it."""
+
+    def test_returns_none_when_backend_has_no_ttl(self):
+        """A backend without .ttl (e.g. LocMemCache) yields None instead of AttributeError."""
+        from django.core.cache.backends.locmem import LocMemCache
+
+        from netbox_librenms_plugin.utils import cache_remaining_ttl
+
+        backend = LocMemCache("cr116-ttl", {})
+        backend.set("k", "v")
+        # Precondition: this backend lacks the django-redis .ttl the bare call sites assumed.
+        assert not hasattr(backend, "ttl")
+        assert cache_remaining_ttl(backend, "k") is None
+
+    def test_delegates_to_ttl_when_present(self):
+        """When the backend exposes .ttl (django-redis), the helper returns its value for the key."""
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import cache_remaining_ttl
+
+        seen = {}
+
+        def _ttl(key):
+            seen["key"] = key
+            return 123
+
+        backend = SimpleNamespace(ttl=_ttl)
+        assert cache_remaining_ttl(backend, "librenms_ports_device_1_default") == 123
+        assert seen["key"] == "librenms_ports_device_1_default"
+
+    def test_returns_none_when_ttl_call_raises(self):
+        """A present-but-raising .ttl (transient Redis error) degrades to None, not a 500 up the render."""
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import cache_remaining_ttl
+
+        def _boom(key):
+            raise ConnectionError("redis unreachable")
+
+        backend = SimpleNamespace(ttl=_boom)
+        # Precondition: the backend DOES expose .ttl, so the absence-guard doesn't cover this.
+        assert hasattr(backend, "ttl")
+        assert cache_remaining_ttl(backend, "librenms_ports_device_1_default") is None
+
+
+class TestPredictModuleInterfaceRenameSignalGuard:
+    """predict_module_interface_rename must not 500 on a receiver that returns a non-list."""
+
+    @staticmethod
+    def _call_with_receiver(return_value):
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.utils import predict_module_interface_rename
+
+        class _Dev:
+            pass
+
+        class _Mod:
+            pass
+
+        @receiver(predict_module_interface_names)
+        def _bad(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return return_value
+
+        try:
+            return predict_module_interface_rename(_Dev(), _Mod(), ["Gi0/0", "Gi0/1"])
+        finally:
+            predict_module_interface_names.disconnect(_bad)
+
+    def test_non_iterable_return_is_ignored(self):
+        """A receiver returning a scalar int is dropped, keeping the caller's names (was a TypeError-500)."""
+        assert self._call_with_receiver(1) == ["Gi0/0", "Gi0/1"]
+
+    def test_scalar_string_return_is_ignored(self):
+        """A bare string is iterable but must not be exploded into characters and mispaired."""
+        assert self._call_with_receiver("Gi0/0") == ["Gi0/0", "Gi0/1"]
diff --git a/netbox_librenms_plugin/utils.py b/netbox_librenms_plugin/utils.py
index eb29a86acc..f7a2568a0b 100644
--- a/netbox_librenms_plugin/utils.py
+++ b/netbox_librenms_plugin/utils.py
@@ -1,10 +1,11 @@
 import logging
 import re
+import threading
 from typing import Optional
 
 from dcim.models import Device
-from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import Q
+from django.core.exceptions import ObjectDoesNotExist, ValidationError
+from django.db.models import Count, Max, Q
 from django.http import HttpRequest
 from netbox.config import get_config
 from netbox.plugins import get_plugin_config
@@ -13,6 +14,55 @@
 logger = logging.getLogger(__name__)
 
 
+def is_list_of_dicts(value) -> bool:
+    """
+    Return True only when *value* is a list whose every element is a dict.
+
+    Used to validate LibreNMS payloads at the API boundary: a ``success=True`` response can
+    still carry a malformed-but-truthy body (a string, a list of scalars, etc.), and blindly
+    dereferencing it turns a refresh into a 500 instead of the graceful error/fallback path.
+    An empty list is considered valid (a device legitimately with no rows).
+
+    Args:
+        value: The candidate payload to validate.
+
+    Returns:
+        bool: True if *value* is a list of dicts (the empty list included), False otherwise.
+    """
+    return isinstance(value, list) and all(isinstance(item, dict) for item in value)
+
+
+def cache_remaining_ttl(cache, key):
+    """
+    Return the remaining TTL (seconds) for *key*, degrading to ``None`` off Redis.
+
+    django-redis exposes ``cache.ttl(key)``; other backends (Django's ``LocMemCache`` in tests,
+    or any non-Redis deployment) do not, so a bare ``cache.ttl(...)`` raises ``AttributeError``
+    and 500s the cache-expiry render. Route every TTL read through here so the behaviour is
+    uniform across backends and lives in one place instead of drifting per view.
+
+    Args:
+        cache: The Django cache backend instance.
+        key: The cache key to inspect.
+
+    Returns:
+        int | None: The remaining TTL in seconds, ``None`` when the backend can't report it
+            (no ``ttl`` method) or the key has no expiry.
+    """
+    ttl = getattr(cache, "ttl", None)
+    if ttl is None:
+        return None
+    try:
+        return ttl(key)
+    except Exception:
+        # A backend that HAS .ttl (django-redis) can still raise at call time — e.g. a transient
+        # Redis connection error. Guarding only the method's ABSENCE would let that propagate into
+        # the cache-expiry render (modules/cables/IP/VLAN/interfaces _build_context) and 500 the very
+        # page this helper exists to protect. Degrade the cosmetic TTL to "unknown" instead.
+        logger.warning("cache.ttl(%r) failed; treating remaining TTL as unknown", key, exc_info=True)
+        return None
+
+
 _VC_MEMBER_INTERFACE_PATTERN = re.compile(r"^(?P<prefix>[A-Za-z][A-Za-z0-9]*)(?P<member>\d+)(?P<suffix>[/:].+)$")
 
 
@@ -64,6 +114,39 @@ def normalize_librenms_port_id(value) -> int | None:
     return int_value if int_value > 0 else None
 
 
+def validate_regex_field(value, field_name):
+    """
+    Compile ``value`` as a regex, raising a field-scoped ValidationError on failure.
+
+    Centralizes the ``re.compile`` / ``re.error`` -> ``ValidationError`` validator that was
+    copied across the plugin's pattern-bearing models (NormalizationRule,
+    CarrierAutoInstallRule, InventoryIgnoreRule, ModuleBayMapping, PortStackLagPattern), so the
+    wording stays consistent and any future hardening lives in one place.
+
+    ReDoS note (low severity, accepted): these patterns are admin-supplied (change permission)
+    and are later evaluated via ``re.search()`` / ``re.match()`` — including
+    ``lag_name_pattern``, run per port on every interface refresh. Python's ``re`` has no
+    per-evaluation timeout, so a catastrophic-backtracking pattern (e.g. ``^(a+)+$``) could
+    block the worker. This is accepted as an admin-only risk bounded by the fields'
+    ``max_length``; a real guard would need an out-of-process or timeout-capable regex engine
+    the plugin doesn't depend on.
+
+    Args:
+        value (str): The regex source to validate.
+        field_name (str): The model field name the error is attached to.
+
+    Returns:
+        re.Pattern: The compiled pattern (callers that need it for further checks reuse it).
+
+    Raises:
+        ValidationError: ``{field_name: "Invalid regex: <detail>"}`` when ``value`` won't compile.
+    """
+    try:
+        return re.compile(value)
+    except re.error as exc:
+        raise ValidationError({field_name: f"Invalid regex: {exc}"}) from exc
+
+
 def get_virtual_chassis_member(device: Device, port_name: str) -> Device:
     """
     Determines the likely virtual chassis member based on the device's vc_position and port name.
@@ -210,6 +293,64 @@ def get_module_template_interface_names(device: Device, module) -> list[str]:
     return template_names
 
 
+def predict_module_interface_rename(device: Device, module, names) -> list[str]:
+    """
+    Return the INR-predicted post-rename names for an explicit list of *names*.
+
+    Same receiver semantics as :func:`get_module_template_interface_names`
+    (``send_robust`` isolates a failing receiver and the last non-None list return
+    wins), but the input is a caller-supplied list of names rather than template
+    instantiations. Used to recognise when a standalone interface is the renamed
+    twin of a module's raw interface (the rename a naming plugin would apply but
+    skipped because the target name was already taken).
+    """
+    from netbox_librenms_plugin.signals import predict_module_interface_names
+
+    predicted = list(names)
+    for _receiver, returned in predict_module_interface_names.send_robust(
+        sender=type(module), device=device, module=module, names=list(names)
+    ):
+        if isinstance(returned, Exception):
+            logger.warning("predict_module_interface_names receiver failed: %s", returned)
+            continue
+        if returned is None:
+            continue
+        # send_robust only isolates a receiver that *raises*; a receiver that successfully returns a
+        # scalar still reaches here. A str/bytes is iterable but list("Gi0/0") would explode it into
+        # characters and mispair the rename, and a non-iterable (e.g. 1) would TypeError-500 the
+        # module sync path. Reject both and keep the previous prediction.
+        if isinstance(returned, (str, bytes)):
+            logger.warning(
+                "predict_module_interface_names receiver returned a scalar string result; "
+                "ignoring it to avoid mispairing a module interface rename"
+            )
+            continue
+        try:
+            returned = list(returned)
+        except TypeError:
+            logger.warning(
+                "predict_module_interface_names receiver returned a non-iterable result; "
+                "ignoring it to avoid mispairing a module interface rename"
+            )
+            continue
+        # Enforce the 1:1, order-preserving contract at the boundary: a receiver that returns a
+        # shorter/longer (or filtered) list would otherwise misalign the caller's
+        # ``zip(raw_ifaces, predicted)`` and fold a raw duplicate into the WRONG adopted interface —
+        # a silent wrong-object write of a LibreNMS binding. Reject a misaligned result and keep the
+        # previous prediction rather than trust it.
+        if len(returned) != len(names):
+            logger.warning(
+                "predict_module_interface_names receiver returned %d names for %d inputs; "
+                "ignoring its misaligned result to avoid mispairing a module interface rename",
+                len(returned),
+                len(names),
+            )
+            continue
+        predicted = returned
+
+    return predicted
+
+
 def detect_vc_normalization_noop(device: Device, module) -> Optional[dict]:
     """Return a diagnostic dict when VC member-name rewriting would no-op for this module.
 
@@ -580,7 +721,7 @@ def get_interface_name_field(request: Optional[HttpRequest] = None) -> str:
     return get_plugin_config("netbox_librenms_plugin", "interface_name_field")
 
 
-def match_librenms_hardware_to_device_type(hardware_name: str) -> dict | None:
+def match_librenms_hardware_to_device_type(hardware_name: str, *, preloaded_rules: dict | None = None) -> dict | None:
     """
     Match LibreNMS hardware string to a NetBox DeviceType.
 
@@ -589,6 +730,9 @@ def match_librenms_hardware_to_device_type(hardware_name: str) -> dict | None:
 
     Args:
         hardware_name (str): Hardware string from LibreNMS API (e.g., 'C9200L-48P-4X')
+        preloaded_rules: Optional dict from :func:`preload_normalization_rules` for the
+            ``device_type`` scope. When matching many devices in a loop (bulk import), pass it
+            so the device_type NormalizationRule set is fetched once instead of per device.
 
     Returns:
         dict | None: Dictionary containing:
@@ -613,28 +757,53 @@ def match_librenms_hardware_to_device_type(hardware_name: str) -> dict | None:
     if not hardware_name or hardware_name == "-":
         return {"matched": False, "device_type": None, "match_type": None}
 
-    # Check DeviceTypeMapping table first (when available)
+    # Normalize the raw LibreNMS hardware string per the documented ``device_type``
+    # NormalizationRule scope before the DeviceTypeMapping lookup (docs/usage_tips/
+    # mapping_rules.md: "normalizes LibreNMS hardware string before DeviceTypeMapping
+    # lookup"). With no device_type rules configured this returns the input unchanged.
+    # .strip() to match how DeviceTypeMapping stores the key: its save() does .strip().lower(), so
+    # an unstripped search_name (e.g. rule output or raw hardware carrying surrounding whitespace)
+    # would never satisfy librenms_hardware__iexact (case-, but not whitespace-, insensitive).
+    raw_name = hardware_name.strip()
+    search_name = apply_normalization_rules(
+        value=hardware_name, scope="device_type", preloaded_rules=preloaded_rules
+    ).strip()
+
+    # Check DeviceTypeMapping table first (when available). The normalized key is the
+    # canonical form; the raw key is a fallback for rows the standard mapping CRUD/CSV
+    # write paths stored un-normalized (their model clean() only does .strip().lower()).
+    # Blank candidates are skipped: librenms_hardware can never be blank, and a rule
+    # chain that empties the string must not query iexact="".
     if _has_device_type_mapping:
-        try:
-            mapping = DeviceTypeMapping.objects.get(librenms_hardware__iexact=hardware_name)
-            return {
-                "matched": True,
-                "device_type": mapping.netbox_device_type,
-                "match_type": "mapping",
-            }
-        except DeviceTypeMapping.DoesNotExist:
-            pass
-        except DeviceTypeMapping.MultipleObjectsReturned:
-            logger.warning(
-                "Multiple DeviceTypeMapping entries match hardware %r — skipping mapping lookup; "
-                "resolve the ambiguity by removing duplicate mappings.",
-                hardware_name,
-            )
-            return None
+        for candidate in dict.fromkeys(name for name in (search_name, raw_name) if name):
+            try:
+                mapping = DeviceTypeMapping.objects.get(librenms_hardware__iexact=candidate)
+                return {
+                    "matched": True,
+                    "device_type": mapping.netbox_device_type,
+                    "match_type": "mapping",
+                }
+            except DeviceTypeMapping.DoesNotExist:
+                continue
+            except DeviceTypeMapping.MultipleObjectsReturned:
+                logger.warning(
+                    "Multiple DeviceTypeMapping entries match hardware %r — skipping mapping lookup; "
+                    "resolve the ambiguity by removing duplicate mappings.",
+                    candidate,
+                )
+                return None
+
+    # The part_number/model exact matches use the RAW string: the documented rule scope is
+    # the DeviceTypeMapping lookup only, and DeviceTypes whose part_number/model literally
+    # equal the LibreNMS hardware string must keep matching after a rule is added. A blank
+    # raw string (whitespace-only hardware) must not run the lookups at all — part_number
+    # defaults to "" so part_number__iexact="" would match an arbitrary unrelated DeviceType.
+    if not raw_name:
+        return {"matched": False, "device_type": None, "match_type": None}
 
     # Try part number exact match
     try:
-        device_type = DeviceType.objects.get(part_number__iexact=hardware_name)
+        device_type = DeviceType.objects.get(part_number__iexact=raw_name)
         return {
             "matched": True,
             "device_type": device_type,
@@ -646,13 +815,13 @@ def match_librenms_hardware_to_device_type(hardware_name: str) -> dict | None:
         logger.warning(
             "Multiple DeviceType entries match part_number %r — cannot auto-select; "
             "resolve the ambiguity by ensuring part numbers are unique across manufacturers.",
-            hardware_name,
+            raw_name,
         )
         return None
 
     # Try exact model match (case-insensitive)
     try:
-        device_type = DeviceType.objects.get(model__iexact=hardware_name)
+        device_type = DeviceType.objects.get(model__iexact=raw_name)
         return {"matched": True, "device_type": device_type, "match_type": "exact"}
     except DeviceType.DoesNotExist:
         pass
@@ -660,7 +829,7 @@ def match_librenms_hardware_to_device_type(hardware_name: str) -> dict | None:
         logger.warning(
             "Multiple DeviceType entries match model %r — cannot auto-select; "
             "resolve the ambiguity by ensuring model names are unique across manufacturers.",
-            hardware_name,
+            raw_name,
         )
         return None
 
@@ -1093,6 +1262,35 @@ def find_by_librenms_id(model, librenms_id, server_key: str = "default"):
     return model.objects.filter(q).first()
 
 
+def is_legacy_librenms_id(value) -> bool:
+    """
+    Return ``True`` when a ``librenms_id`` custom-field value is the legacy bare-integer form.
+
+    Legacy = a bare integer (created before the multi-server JSON refactor) or a string that
+    parses as an integer, i.e. NOT the per-server dict form and not absent. Uses ``int()``
+    coercion (so a whitespace-padded ``" 42 "`` is legacy too), matching
+    :func:`coerce_librenms_id` / :func:`get_librenms_device_id` rather than a stricter
+    ``str.isdigit()`` check that would hide a valid legacy link.
+
+    Args:
+        value: The raw ``custom_field_data["librenms_id"]`` value.
+
+    Returns:
+        bool: ``True`` for a *positive* bare int (non-bool) or a positive int-parseable string;
+            ``False`` for ``None``, ``0``/negative, the dict form, a bool, or a non-numeric string.
+    """
+    if isinstance(value, bool):
+        return False
+    if isinstance(value, int):
+        return value > 0
+    if isinstance(value, str):
+        try:
+            return int(value) > 0
+        except (TypeError, ValueError):
+            return False
+    return False
+
+
 def migrate_legacy_librenms_id(obj, server_key: str = "default") -> bool:
     """
     Migrate a legacy bare-integer ``librenms_id`` custom field to the JSON dict format,
@@ -1117,10 +1315,23 @@ def migrate_legacy_librenms_id(obj, server_key: str = "default") -> bool:
         return False
     if isinstance(cf_value, int):
         int_value = cf_value
-    elif isinstance(cf_value, str) and cf_value.isdigit():
-        int_value = int(cf_value)
+    elif isinstance(cf_value, str):
+        # Coerce with int() (not str.isdigit()) so this writer accepts exactly what the
+        # is_legacy_librenms_id() gate — and coerce_librenms_id / get_librenms_device_id — accept:
+        # a whitespace-padded " 42 " or signed "+42" is legacy everywhere else, so gating the
+        # migration on the stricter isdigit() would offer the Convert-ID button, pass every
+        # precondition, then dead-end here with "could not be converted" (issue #99).
+        try:
+            int_value = int(cf_value)
+        except (TypeError, ValueError):
+            return False
     else:
         return False
+    if int_value <= 0:
+        # Keep the migration aligned with the positive-ID invariant (is_legacy_librenms_id /
+        # get_librenms_device_id treat <= 0 as no valid ID): never canonicalise 0 or a negative
+        # into the per-server JSON form.
+        return False
     obj.custom_field_data["librenms_id"] = {server_key: int_value}
     logger.info(
         "Migrated legacy librenms_id %r → {%r: %d} on %r",
@@ -1257,7 +1468,71 @@ def __init__(self, *args, mfr_mappings=None, **kwargs):
         self.mfr_mappings: dict = mfr_mappings or {}
 
 
+# (version, index) held as a single tuple so a lock-free reader always gets a CONSISTENT pair from
+# one atomic reference read — never a freshly-bumped version paired with a stale index, or vice
+# versa. Rebuilds are serialised by the lock so concurrent renders don't each rebuild.
+_MODULE_TYPES_INDEX_CACHE: tuple = (None, None)
+_MODULE_TYPES_INDEX_LOCK = threading.Lock()
+
+
+def _module_types_index_version():
+    """
+    Return a cheap fingerprint of the module-type index inputs.
+
+    Changes on any create/delete/edit (via ``save()``) of a ModuleType, a module-type
+    InterfaceTemplate, or a ModuleTypeMapping, so the cache below self-invalidates
+    (including across test transactions) with no signal wiring.
+
+    Limitation: a count-preserving bulk ``QuerySet.update()`` bypasses ``save()`` and so does
+    not bump ``last_updated`` (``auto_now``); such an edit leaves the fingerprint unchanged and
+    the cached index stale until the row count changes or the worker restarts. The plugin only
+    ever mutates these models via ``save()``, so this affects external bulk-update tooling only.
+    """
+    from dcim.models import InterfaceTemplate, ModuleType
+
+    from netbox_librenms_plugin.models import ModuleTypeMapping
+
+    def _fp(qs):
+        agg = qs.aggregate(n=Count("pk"), latest=Max("last_updated"))
+        return (agg["n"] or 0, agg["latest"].isoformat() if agg["latest"] else "")
+
+    return (
+        _fp(ModuleType.objects.all()),
+        _fp(InterfaceTemplate.objects.filter(module_type__isnull=False)),
+        _fp(ModuleTypeMapping.objects.all()),
+    )
+
+
 def get_module_types_indexed() -> dict:
+    """
+    Return the module-type index, rebuilt only when its inputs change.
+
+    The underlying build loads every ModuleType (with interface templates) and
+    ModuleTypeMapping — per-render work that dominates the module-sync render once
+    the rule-lookup cost is removed. Cache it keyed on a cheap fingerprint of those
+    tables so repeat renders reuse it.
+
+    Thread-safe: the (version, index) pair is read as one atomic tuple reference on the fast
+    path, and rebuilds happen under a lock so concurrent renders neither rebuild redundantly nor
+    observe a torn version/index swap.
+    """
+    global _MODULE_TYPES_INDEX_CACHE
+
+    version = _module_types_index_version()
+    cached_version, cached_index = _MODULE_TYPES_INDEX_CACHE  # single atomic read of the pair
+    if cached_index is not None and cached_version == version:
+        return cached_index
+
+    with _MODULE_TYPES_INDEX_LOCK:
+        # Re-check inside the lock: another thread may have rebuilt while we waited.
+        cached_version, cached_index = _MODULE_TYPES_INDEX_CACHE
+        if cached_index is None or cached_version != version:
+            cached_index = _build_module_types_index()
+            _MODULE_TYPES_INDEX_CACHE = (version, cached_index)
+        return cached_index
+
+
+def _build_module_types_index() -> dict:
     """
     Return all NetBox module types indexed by model (and part_number), with ModuleTypeMapping applied.
 
diff --git a/netbox_librenms_plugin/views/base/interfaces_view.py b/netbox_librenms_plugin/views/base/interfaces_view.py
index b3f3741b2f..a3faf024fc 100644
--- a/netbox_librenms_plugin/views/base/interfaces_view.py
+++ b/netbox_librenms_plugin/views/base/interfaces_view.py
@@ -5,8 +5,10 @@
 from django.views import View
 
 from netbox_librenms_plugin.utils import (
+    cache_remaining_ttl,
     get_interface_name_field,
     get_virtual_chassis_member,
+    is_list_of_dicts,
     normalize_librenms_port_id,
 )
 from netbox_librenms_plugin.views.mixins import (
@@ -83,7 +85,15 @@ def _build_interface_lookup_maps(self, obj):
         by_librenms_id = {}
         duplicate_librenms_ids = set()
 
-        for interface in self.get_interfaces(obj).select_related(self.get_select_related_field(obj)):
+        # Prefetch the M2M relations the table renderers dereference per matched row
+        # (render_vlans -> tagged_vlans, render_mac_address -> mac_addresses); without this each
+        # rendered interface row issues its own query for these.
+        interfaces = (
+            self.get_interfaces(obj)
+            .select_related(self.get_select_related_field(obj))
+            .prefetch_related("tagged_vlans", "tagged_vlans__group", "mac_addresses")
+        )
+        for interface in interfaces:
             by_name[interface.name] = interface
             librenms_id = self._get_object_librenms_id(interface)
             if librenms_id is None:
@@ -120,8 +130,15 @@ def post(self, request, pk):
             messages.error(request, librenms_data)
             return redirect(self.get_redirect_url(obj))
 
+        # A success=True response can still carry a malformed-but-truthy body (string/list/
+        # dict-with-non-list "ports"); dereferencing it would 500 the refresh. Fail closed like
+        # the not-success path instead (issue #100). An empty ports list stays valid.
+        ports = librenms_data.get("ports", []) if isinstance(librenms_data, dict) else None
+        if not is_list_of_dicts(ports):
+            messages.error(request, "Unexpected response from LibreNMS (malformed ports payload).")
+            return redirect(self.get_redirect_url(obj))
+
         # Enrich ports with VLAN data for trunk ports
-        ports = librenms_data.get("ports", [])
         enriched_ports = self._enrich_ports_with_vlan_data(ports, interface_name_field)
         librenms_data["ports"] = enriched_ports
 
@@ -181,7 +198,10 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None):
             interface_name_field = get_interface_name_field(request)
 
         if server_key is None:
-            server_key = getattr(self.librenms_api, "server_key", None)
+            # getattr does NOT protect this: the lazy librenms_api property RAISES
+            # KeyError/ValueError (not AttributeError) on a misconfigured server config,
+            # 500ing the cached tab render. Use the degrading resolve like cables/IP.
+            server_key = self._render_server_key()
 
         cached_data = cache.get(self.get_cache_key(obj, "ports", server_key))
         last_fetched = cache.get(self.get_last_fetched_key(obj, "ports", server_key))
@@ -193,8 +213,18 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None):
         # Load any user VLAN group overrides from cache (set by "apply to all")
         vlan_group_overrides = cache.get(self.get_vlan_overrides_key(obj, server_key)) or {}
 
-        if cached_data:
+        # isinstance(dict) guard (mirroring the IP/VLAN/Cables/Modules render paths and the
+        # interfaces SYNC path): a truthy-but-malformed cache entry — a legacy/older-shape snapshot
+        # or corrupt value — must degrade to an empty table, not AttributeError-500 on .get("ports").
+        if isinstance(cached_data, dict):
             ports_data = cached_data.get("ports", [])
+            # The isinstance(dict) guard above only proves the ENVELOPE is a dict; "ports" itself can
+            # still be a present-but-null value or a list with non-dict items (legacy/corrupt snapshot).
+            # `for port in ports_data` would then TypeError on None, and `port.get(...)`/`port["enabled"] = `
+            # would AttributeError/TypeError on a non-dict item — 500ing the cached render. Reuse the
+            # shared is_list_of_dicts guard (as the SYNC path does) and degrade to an empty table instead.
+            if not is_list_of_dicts(ports_data):
+                ports_data = []
             matched_interface_ids = set()
 
             # Pre-fetch all interfaces for all potential chassis members
@@ -284,7 +314,7 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None):
         if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
             virtual_chassis_members = obj.virtual_chassis.members.all()
 
-        cache_ttl = cache.ttl(self.get_cache_key(obj, "ports", server_key))
+        cache_ttl = cache_remaining_ttl(cache, self.get_cache_key(obj, "ports", server_key))
         cache_expiry = (
             timezone.now() + timezone.timedelta(seconds=cache_ttl) if cache_ttl is not None and cache_ttl > 0 else None
         )
diff --git a/netbox_librenms_plugin/views/base/ip_addresses_view.py b/netbox_librenms_plugin/views/base/ip_addresses_view.py
index 810f790778..6b30f54f06 100644
--- a/netbox_librenms_plugin/views/base/ip_addresses_view.py
+++ b/netbox_librenms_plugin/views/base/ip_addresses_view.py
@@ -13,12 +13,18 @@
 
 from netbox_librenms_plugin.tables.ipaddresses import IPAddressTable
 from netbox_librenms_plugin.utils import (
+    cache_remaining_ttl,
     get_interface_name_field,
     get_librenms_device_id,
     resolve_set_primary_ip,
     same_host,
 )
-from netbox_librenms_plugin.views.mixins import CacheMixin, LibreNMSAPIMixin, LibreNMSPermissionMixin
+from netbox_librenms_plugin.views.mixins import (
+    CacheMixin,
+    LibreNMSAPIMixin,
+    LibreNMSPermissionMixin,
+    NetBoxObjectPermissionMixin,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -137,7 +143,7 @@ def _prefetch_netbox_data(self, obj):
         all_interfaces = list(obj.interfaces.all())
 
         # Create maps for efficient lookups
-        server_key = self.librenms_api.server_key
+        server_key = self._render_server_key()
         interfaces_by_librenms_id = {}
         for interface in all_interfaces:
             lib_id = get_librenms_device_id(interface, server_key, auto_save=False)
@@ -167,10 +173,13 @@ def _get_port_info(self, port_id, port_data_cache, interface_name_field):
         """Get port info from LibreNMS with caching to minimize API calls"""
         if port_id not in port_data_cache:
             success, port_data = self.librenms_api.get_port_by_id(port_id)
-            if success and "port" in port_data and port_data["port"]:
-                port_data_cache[port_id] = port_data["port"][0]
-            else:
-                port_data_cache[port_id] = None
+            # A truthy success can still carry a malformed payload: port_data=None ("port" in
+            # None raises), {"port": ["bad"]} (a non-dict row that later crashes at
+            # port_info.get(...)). Validate the shape and cache only a real dict row, else None
+            # (issue #111, same class as #100).
+            ports = port_data.get("port") if success and isinstance(port_data, dict) else None
+            first_port = ports[0] if isinstance(ports, list) and ports else None
+            port_data_cache[port_id] = first_port if isinstance(first_port, dict) else None
 
         return port_data_cache[port_id]
 
@@ -256,7 +265,7 @@ def _add_interface_info_to_ip(self, enriched_ip, port_id, librenms_interface_nam
     def get_table(self, data, obj, request):
         """Get the table instance for the view."""
         table = IPAddressTable(data)
-        server_key = self.librenms_api.server_key
+        server_key = self._render_server_key()
         table.htmx_url = f"{request.path}?tab=ipaddresses" + (f"&server_key={server_key}" if server_key else "")
         return table
 
@@ -264,7 +273,7 @@ def _prepare_context(self, request, obj, interface_name_field, fetch_fresh=False
         """Helper method to prepare the context data for IP address sync views."""
         table = None
         cache_expiry = None
-        server_key = self.librenms_api.server_key
+        server_key = self._render_server_key()
 
         if interface_name_field is None:
             interface_name_field = get_interface_name_field(request)
@@ -273,9 +282,12 @@ def _prepare_context(self, request, obj, interface_name_field, fetch_fresh=False
             success, ip_data = self.get_ip_addresses(obj)
         else:
             cached_ip_data = cache.get(self.get_cache_key(obj, "ip_addresses", server_key))
-            if cached_ip_data:
+            if isinstance(cached_ip_data, dict):
                 ip_data = cached_ip_data.get("ip_addresses", [])
             else:
+                # Missing, or a stale/corrupt non-dict entry (legacy snapshot shape): drop it and
+                # render empty rather than 500 on a .get() against a list/str. Mirrors the
+                # isinstance fail-closed guard the interfaces/modules cached paths use.
                 return None
 
         # Enrich data in both cases to ensure current NetBox state
@@ -290,7 +302,7 @@ def _prepare_context(self, request, obj, interface_name_field, fetch_fresh=False
             )
 
         # Calculate cache expiry
-        cache_ttl = cache.ttl(self.get_cache_key(obj, "ip_addresses", server_key))
+        cache_ttl = cache_remaining_ttl(cache, self.get_cache_key(obj, "ip_addresses", server_key))
         if cache_ttl is not None and cache_ttl > 0:
             cache_expiry = timezone.now() + timezone.timedelta(seconds=cache_ttl)
 
@@ -314,7 +326,7 @@ def get_context_data(self, request, obj):
         context = self._prepare_context(request, obj, interface_name_field, fetch_fresh=False)
         if context is None:
             # No data found; return context with empty table
-            context = {"table": None, "object": obj, "cache_expiry": None, "server_key": self.librenms_api.server_key}
+            context = {"table": None, "object": obj, "cache_expiry": None, "server_key": self._render_server_key()}
         return context
 
     def post(self, request, pk):
@@ -333,7 +345,7 @@ def post(self, request, pk):
                         "object": obj,
                         "table": None,
                         "cache_expiry": None,
-                        "server_key": self.librenms_api.server_key,
+                        "server_key": self._render_server_key(),
                     }
                 },
             )
@@ -346,27 +358,83 @@ def post(self, request, pk):
         )
 
 
-class SingleIPAddressVerifyView(LibreNMSPermissionMixin, CacheMixin, View):
+class SingleIPAddressVerifyView(NetBoxObjectPermissionMixin, LibreNMSPermissionMixin, CacheMixin, View):
     """
     View for verifying single IP address data with different VRF.
     """
 
+    # Read-only verify endpoint: require object-view permission (mirrors the interface/module/
+    # cable verify views). Without it any user with mere plugin-view rights could POST an
+    # arbitrary device id and read back that object's name/url/cached IP rows. The effective
+    # requirement is narrowed per-request in post() to the model the request actually targets
+    # (Device vs VirtualMachine); this class-level default (both) is the fail-closed fallback the
+    # permission-wiring test asserts.
+    required_object_permissions = {"POST": [("view", Device), ("view", VirtualMachine)]}
+
+    def require_object_permissions_json(self, method, *, object_id=None, object_type=None):
+        """
+        Resolve the per-object view permission for this verify request, then run the base gate.
+
+        Computing the requirement here (rather than inline in :meth:`post`) keeps the DB
+        model-resolution behind the same method the post-flow tests mock out — so those tests
+        exercise the request flow without a DB hit, while the real gate path resolves Device vs
+        VirtualMachine and checks the matching view permission.
+
+        Args:
+            method: HTTP method to gate (``"POST"``).
+            object_id: The posted object id, used to resolve the model when no type is given.
+            object_type: The posted ``object_type`` (``"device"``/``"virtualmachine"``), if any.
+
+        Returns:
+            None if permitted, or a 403 JsonResponse if denied.
+        """
+        self.required_object_permissions = {method: self._required_perms_for_object(object_id, object_type)}
+        return super().require_object_permissions_json(method)
+
+    def _required_perms_for_object(self, object_id, object_type):
+        """
+        Object-view perms a verify POST must hold for the object it targets.
+
+        Mirrors :meth:`_get_object`'s resolution so the gate matches the model whose name/url/cache
+        the response would expose: an explicit ``object_type`` gates on exactly that model; with no
+        type, resolve the id to its model (an existence check that reads no object data) — Device
+        first, then VirtualMachine. Fall back to requiring BOTH view perms (fail closed) when the id
+        is unusable or resolves to neither, so a Device-only (or VM-only) caller can never read the
+        other model's data through this endpoint.
+        """
+        if object_type == "device":
+            return [("view", Device)]
+        if object_type == "virtualmachine":
+            return [("view", VirtualMachine)]
+        try:
+            if Device.objects.filter(pk=object_id).exists():
+                return [("view", Device)]
+            if VirtualMachine.objects.filter(pk=object_id).exists():
+                return [("view", VirtualMachine)]
+        except (ValueError, TypeError):
+            pass
+        return [("view", Device), ("view", VirtualMachine)]
+
     def _get_object(self, object_id, object_type=None):
         """
         Retrieve the object (Device or VirtualMachine) based on ID and optional type.
-        If type is not provided, tries to determine it by checking both Device and VM models.
+
+        Resolves through permission-restricted querysets: the POST gate only checks model-level
+        view perms, so a constrained grant must not resolve an out-of-scope id here — it 404s
+        instead of exposing the object's cached IP verify payload.
         """
+        user = self.request.user
         if object_type == "device":
-            return get_object_or_404(Device, pk=object_id)
+            return get_object_or_404(Device.objects.restrict(user, "view"), pk=object_id)
         elif object_type == "virtualmachine":
-            return get_object_or_404(VirtualMachine, pk=object_id)
+            return get_object_or_404(VirtualMachine.objects.restrict(user, "view"), pk=object_id)
         else:
-            # Try to find object without knowing its type
-            obj = Device.objects.filter(pk=object_id).first()
+            # Try to find object without knowing its type (scoped to the caller's viewable objects).
+            obj = Device.objects.restrict(user, "view").filter(pk=object_id).first()
             if obj:
                 return obj
 
-            obj = VirtualMachine.objects.filter(pk=object_id).first()
+            obj = VirtualMachine.objects.restrict(user, "view").filter(pk=object_id).first()
             if obj:
                 return obj
 
@@ -391,11 +459,22 @@ def _parse_ip_address(self, ip_address):
 
     def _find_in_cache(self, cached_data, address, prefix_len):
         """Find IP address in cache data using unified fields only."""
-        if not cached_data:
+        # Fail closed on a missing OR truthy-but-malformed entry (a legacy/corrupt non-dict such
+        # as a list from an older snapshot shape): a bare ``cached_data.get(...)`` would raise
+        # AttributeError on a list -> the verify POST's broad except returns 500 on every retry
+        # until the entry expires. Treat it as a cache miss instead, mirroring the isinstance
+        # fail-closed guard the GET-render path (_prepare_context) already uses.
+        if not isinstance(cached_data, dict):
             return None, None, None
 
         for ip_entry in cached_data.get("ip_addresses", []):
-            if ip_entry["ip_address"] == address and str(ip_entry["prefix_length"]) == str(prefix_len):
+            # Per-item shape guard: a non-dict row (or one missing the unified fields) in a
+            # corrupt/legacy snapshot would otherwise TypeError/KeyError here and be swallowed by
+            # post()'s broad except as a 500. Skip it, mirroring _extract_cached_links /
+            # extract_cached_ports which validate each row.
+            if not isinstance(ip_entry, dict):
+                continue
+            if ip_entry.get("ip_address") == address and str(ip_entry.get("prefix_length")) == str(prefix_len):
                 return (ip_entry, ip_entry.get("vrf_id"), ip_entry.get("port_id"))
 
         return None, None, None
@@ -441,16 +520,38 @@ def post(self, request):
         """
         POST request to return json response with formatted IP address status.
         """
+        # Parse the (caller-supplied) body first — this reads no object data — so the permission
+        # gate can target the model the request actually addresses. _get_object() resolves a Device
+        # OR a VirtualMachine, so a static Device-only gate would let a user with only
+        # dcim.view_device read VM name/url/cache data (and vice versa). Gate BELOW still runs
+        # before any object is resolved or any cached row is read.
         try:
-            try:
-                data = json.loads(request.body)
-            except json.JSONDecodeError:
-                return JsonResponse({"status": "error", "message": "Invalid JSON payload"}, status=400)
+            data = json.loads(request.body)
+        except json.JSONDecodeError:
+            return JsonResponse({"status": "error", "message": "Invalid JSON payload"}, status=400)
+        # json.loads accepts a bare list/string/number; calling .get() on those raises before the
+        # permission gate and the broad handler below, so 500s on a non-object body. Reject it.
+        if not isinstance(data, dict):
+            return JsonResponse({"status": "error", "message": "JSON payload must be an object"}, status=400)
+        object_id = data.get("device_id")
+        object_type = data.get("object_type")
+        if error := self.require_object_permissions_json("POST", object_id=object_id, object_type=object_type):
+            return error
+        try:
+            from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
             ip_address = data.get("ip_address")
             vrf_id = data.get("vrf_id")
-            object_id = data.get("device_id")
-            object_type = data.get("object_type")
-            server_key = data.get("server_key") or "default"
+            # Validate the requested server key before using it as a cache namespace: an
+            # unconfigured/forged key would otherwise let a caller probe arbitrary server-key cache
+            # namespaces via get_cache_key(). Mirror the sync/cable membership check; anything
+            # unrecognized falls back to "default" (the prior missing-key behaviour), so a caller
+            # can only ever address a configured key or the fixed default — never an arbitrary one.
+            requested_server_key = data.get("server_key")
+            if isinstance(requested_server_key, str) and requested_server_key in LibreNMSAPI.get_available_servers():
+                server_key = requested_server_key
+            else:
+                server_key = "default"
 
             if not ip_address:
                 return JsonResponse({"status": "error", "message": "No IP address provided"}, status=400)
diff --git a/netbox_librenms_plugin/views/base/librenms_sync_view.py b/netbox_librenms_plugin/views/base/librenms_sync_view.py
index ee9bf57fbc..4e2840f7b5 100644
--- a/netbox_librenms_plugin/views/base/librenms_sync_view.py
+++ b/netbox_librenms_plugin/views/base/librenms_sync_view.py
@@ -12,6 +12,7 @@
     get_interface_name_field,
     get_librenms_device_id,
     get_librenms_sync_device,
+    is_legacy_librenms_id,
     match_librenms_hardware_to_device_type,
     resolve_naming_preferences,
 )
@@ -112,9 +113,7 @@ def get_context_data(self, request, obj):
         # Detect legacy bare-int librenms_id format for conversion badge
         _lookup_device = getattr(self, "_librenms_lookup_device", obj)
         _raw_cf = _lookup_device.cf.get("librenms_id") if _lookup_device else None
-        librenms_id_is_legacy = (isinstance(_raw_cf, int) and not isinstance(_raw_cf, bool)) or (
-            isinstance(_raw_cf, str) and _raw_cf.isdigit()
-        )
+        librenms_id_is_legacy = is_legacy_librenms_id(_raw_cf)
 
         # Determine if serial match allows legacy ID conversion.
         # VMs have no serial field in NetBox; skip the gate so the Convert ID button is enabled.
@@ -189,15 +188,26 @@ def _build_all_server_mappings(obj, active_server_key):
 
         result = []
         for sk, did in cf_value.items():
-            # Validate device ID — accept int or digit-string, skip bool/None/junk.
+            # Validate device ID consistently with the int()-based coercion used everywhere
+            # else for librenms_id: int() strips surrounding whitespace, so a value written as
+            # " 42 " (hand-edited, or from a path that doesn't normalize) resolves fine in the
+            # rest of the app but str.isdigit() wrongly rejected it here, hiding a valid link
+            # from the per-server mappings UI (issue #99). Reject bool/None/non-numeric and
+            # non-positive ids.
             if isinstance(did, bool) or did is None:
                 continue
+            # Only str/int are valid stored shapes; coercing a float here would silently
+            # truncate (1.9 → 1) and surface a link to the wrong device. This mirrors
+            # get_librenms_device_id() in utils.py, which rejects non-str/int before int() (#99).
             if isinstance(did, str):
-                if not did.isdigit():
+                try:
+                    did = int(did)
+                except (TypeError, ValueError):
                     continue
-                did = int(did)
             elif not isinstance(did, int):
                 continue
+            if did <= 0:
+                continue
             srv_cfg = servers_config.get(sk)
             # Legacy single-server config: "default" key with no matching servers entry —
             # fall back to root-level librenms_url/display_name in plugins_cfg.
@@ -250,7 +260,10 @@ def get_librenms_device_info(self, obj, request=None):
 
         if self.librenms_id:
             success, device_info = self.librenms_api.get_device_info(self.librenms_id)
-            if success and device_info:
+            # isinstance(dict) guard: a truthy non-dict payload (string/list) would 500 on the
+            # device_info.get(...) calls below; fall back to the default details block instead
+            # of trusting success=True alone (issue #100).
+            if success and isinstance(device_info, dict):
                 # Get NetBox device details
                 netbox_ip = str(obj.primary_ip.address.ip).lower() if obj.primary_ip else None
                 netbox_name = obj.name
diff --git a/netbox_librenms_plugin/views/mixins.py b/netbox_librenms_plugin/views/mixins.py
index 9d67289b79..71aa4a37fa 100644
--- a/netbox_librenms_plugin/views/mixins.py
+++ b/netbox_librenms_plugin/views/mixins.py
@@ -2,6 +2,7 @@
 
 from django.contrib import messages
 from django.contrib.auth.mixins import PermissionRequiredMixin
+from django.core.cache import cache
 from django.http import HttpResponse, JsonResponse
 from django.shortcuts import redirect
 from django.utils.http import url_has_allowed_host_and_scheme
@@ -9,17 +10,51 @@
 
 from netbox_librenms_plugin.constants import PERM_CHANGE_PLUGIN, PERM_VIEW_PLUGIN
 from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+from netbox_librenms_plugin.utils import is_list_of_dicts
 
 
 def parse_request_json(request):
     """Parse JSON from request.body, returning (data, error_response).
 
     On success returns (dict, None). On malformed input returns (None, JsonResponse 400).
+    json.loads happily returns a bare list/str/number for a valid-JSON non-object body;
+    every caller immediately does ``data.get(...)``, which would 500 on those — so a
+    non-dict payload is rejected here with a 400, keeping the (dict, None) contract true
+    for every endpoint instead of only the ones that added their own guard.
     """
     try:
-        return json.loads(request.body), None
+        data = json.loads(request.body)
     except (TypeError, ValueError):
         return None, JsonResponse({"status": "error", "message": "Invalid JSON payload"}, status=400)
+    if not isinstance(data, dict):
+        return None, JsonResponse({"status": "error", "message": "JSON payload must be an object"}, status=400)
+    return data, None
+
+
+def extract_cached_ports(cached, cache_key=None):
+    """
+    Return the validated dict payload of a cached "ports" entry, or None when malformed.
+
+    Mirrors the cables view's ``_extract_cached_links``: a stale/corrupt but truthy cache
+    value — a non-dict snapshot (e.g. a legacy bare list), a non-list ``ports``, or a
+    non-dict port row — would AttributeError-500 the consumer's ``.get()``/row reads.
+    Treat those as a cache miss; when ``cache_key`` is given, purge the bad entry so the
+    next read doesn't keep serving garbage.
+
+    Args:
+        cached: The raw value read from the ports cache key.
+        cache_key: Optional cache key to delete when the entry is malformed.
+
+    Returns:
+        dict | None: The cached payload with a list of dict port rows, or None.
+    """
+    # ``is_list_of_dicts`` is the same shape check the VLAN/interface read-paths use: ports must
+    # be a list whose every row is a dict (an empty list is valid — a device with no ports).
+    if not isinstance(cached, dict) or not is_list_of_dicts(cached.get("ports")):
+        if cache_key is not None:
+            cache.delete(cache_key)
+        return None
+    return cached
 
 
 def _get_safe_redirect_url(request):
@@ -275,6 +310,48 @@ def librenms_api(self):
             self._librenms_api = LibreNMSAPI()
         return self._librenms_api
 
+    def _render_server_key(self):
+        """
+        Resolve the LibreNMS ``server_key`` for cache/query scoping, degrading to ``None``.
+
+        The lazy ``librenms_api`` property builds ``LibreNMSAPI()``, whose constructor raises
+        KeyError/ValueError on a missing/misconfigured default server. A cached GET render (any sync
+        tab) must not 500 on that: fall back to ``None`` (default scope) so cached rows still render
+        and per-server lookups degrade to their bare-key clause instead of crashing during render.
+
+        Shared by the cables and IP-address table views so the degradation lives in one place
+        rather than being maintained per view.
+
+        Returns:
+            str | None: The active server key, or ``None`` when the client can't be constructed.
+        """
+        try:
+            return self.librenms_api.server_key
+        except (KeyError, ValueError):
+            return None
+
+    def resolve_requested_server_key(self, data):
+        """
+        Resolve a request payload's server key, degrading to the active-server resolve.
+
+        Honour an explicitly-posted CONFIGURED key only.
+        ``data["server_key"]`` is untrusted. A non-string (e.g. a JSON list) is unhashable and would
+        TypeError-500 a later ``cf_dict.get(server_key)``; a stale/forged string must not address
+        another server's cache namespace. Only a string that names a configured server is honoured —
+        anything else falls back to :meth:`_render_server_key` (default scope). Shared by the device
+        verify/render views so this "configured-string-key-or-fallback" rule lives in one place.
+
+        Args:
+            data: The parsed request payload (dict-like) carrying an optional ``server_key``.
+
+        Returns:
+            str | None: The validated posted key, or the degrading active-server key.
+        """
+        requested_server_key = data.get("server_key")
+        if isinstance(requested_server_key, str) and requested_server_key in LibreNMSAPI.get_available_servers():
+            return requested_server_key
+        return self._render_server_key()
+
     def get_server_info(self):
         """
         Get information about the currently active LibreNMS server.
diff --git a/netbox_librenms_plugin/views/object_sync/devices.py b/netbox_librenms_plugin/views/object_sync/devices.py
index 66f9fafd2a..851afb3e4c 100644
--- a/netbox_librenms_plugin/views/object_sync/devices.py
+++ b/netbox_librenms_plugin/views/object_sync/devices.py
@@ -6,6 +6,7 @@
 from django.shortcuts import get_object_or_404
 from django.urls import reverse
 from django.views import View
+from ipam.models import VLAN
 from utilities.views import ViewTab, register_model_view
 
 from netbox_librenms_plugin.constants import PERM_VIEW_PLUGIN
@@ -19,6 +20,7 @@
 )
 from netbox_librenms_plugin.tables.modules import LibreNMSModuleTable, VCModuleTable
 from netbox_librenms_plugin.utils import (
+    cache_remaining_ttl,
     get_interface_name_field,
     get_librenms_sync_device,
     get_missing_vlan_warning,
@@ -38,6 +40,7 @@
     LibreNMSAPIMixin,
     LibreNMSPermissionMixin,
     NetBoxObjectPermissionMixin,
+    extract_cached_ports,
     parse_request_json,
 )
 
@@ -117,25 +120,40 @@ def get_table(self, data, obj, interface_name_field, vlan_groups=None):
         return table
 
 
-class SingleInterfaceVerifyView(LibreNMSPermissionMixin, LibreNMSAPIMixin, CacheMixin, View):
+class SingleInterfaceVerifyView(
+    LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View
+):
     """Verify single interface data for a device via cached LibreNMS payload."""
 
+    # Read-only verify endpoint: require object-view permission (mirrors SingleModuleVerifyView).
+    required_object_permissions = {"POST": [("view", Device)]}
+
     def post(self, request):
         """Verify interface data against cached LibreNMS ports for a device."""
         data, err = parse_request_json(request)
         if err:
             return err
+        # Gate BEFORE resolving the device: without this an unauthorized caller could probe
+        # arbitrary device IDs (existence via 404) through this endpoint.
+        if error := self.require_object_permissions_json("POST"):
+            return error
         selected_device_id = data.get("device_id")
         interface_name = data.get("interface_name")
         interface_name_field = data.get("interface_name_field") or get_interface_name_field()
-        server_key = data.get("server_key")
 
         if not selected_device_id:
             return JsonResponse({"status": "error", "message": "No device ID provided"}, status=400)
-        if not server_key:
-            server_key = self.librenms_api.server_key
-
-        selected_device = get_object_or_404(Device, pk=selected_device_id)
+        # Only honour a CONFIGURED string server_key (mirrors the cable/IP verify siblings):
+        # the raw value scopes cache reads and the per-server cf lookups below, so a forged
+        # key must not address another server's namespace — and a non-string value (e.g. a
+        # JSON list) is unhashable, so cf_dict.get(server_key) would TypeError-500 this
+        # endpoint. Anything unrecognized falls back to the degrading active-server resolve.
+        server_key = self.resolve_requested_server_key(data)
+
+        # Restrict the lookup to the caller's viewable devices: the gate above only checked the
+        # model-level view_device perm, so a site-scoped grant would otherwise read another
+        # device's cached verify payload by raw pk.
+        selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
 
         # Normalise to the VC sync device so cache keys match what the sync view stored
         if selected_device.virtual_chassis:
@@ -147,7 +165,10 @@ def post(self, request):
         else:
             primary_device = selected_device
 
-        cached_data = cache.get(self.get_cache_key(primary_device, "ports", server_key))
+        ports_cache_key = self.get_cache_key(primary_device, "ports", server_key)
+        # Shape-guard the cached entry: a truthy but malformed snapshot must degrade to the
+        # "Interface data not found" 404 below, not AttributeError-500 on .get("ports").
+        cached_data = extract_cached_ports(cache.get(ports_cache_key), ports_cache_key)
 
         if cached_data:
             port_data = next(
@@ -186,9 +207,16 @@ def post(self, request):
         data, err = parse_request_json(request)
         if err:
             return err
+        # Gate BEFORE resolving the device: without this an unauthorized caller could probe
+        # arbitrary device IDs (existence via 404) through this endpoint (mirrors
+        # SingleInterfaceVerifyView).
+        if error := self.require_object_permissions_json("POST"):
+            return error
         selected_device_id = data.get("device_id")
         ent_physical_index = data.get("ent_physical_index")
-        server_key = data.get("server_key") or self.librenms_api.server_key
+        # Configured-string-key-or-fallback, mirroring SingleInterfaceVerifyView above: a
+        # forged/non-string key must neither probe another namespace nor TypeError-500.
+        server_key = self.resolve_requested_server_key(data)
         row_depth = data.get("depth", 0)
 
         if not selected_device_id:
@@ -206,12 +234,10 @@ def post(self, request):
         except (TypeError, ValueError):
             row_depth = 0
 
-        selected_device = get_object_or_404(Device, pk=selected_device_id)
-
-        # Read-only verify endpoint: only require object-view permission, not
-        # plugin write (which require_all_permissions_json would enforce).
-        if error := self.require_object_permissions_json("POST"):
-            return error
+        # Restrict the lookup to the caller's viewable devices: the gate above only checked the
+        # model-level view_device perm, so a site-scoped grant would otherwise read another
+        # device's cached verify payload by raw pk.
+        selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
 
         if selected_device.virtual_chassis:
             sync_device = get_librenms_sync_device(selected_device, server_key=server_key)
@@ -333,7 +359,7 @@ def post(self, request):
         return JsonResponse({"status": "success", "formatted_row": formatted_row})
 
 
-class SingleVlanGroupVerifyView(LibreNMSPermissionMixin, CacheMixin, View):
+class SingleVlanGroupVerifyView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, CacheMixin, View):
     """
     Verify VLAN assignments for an interface against a specific VLAN group.
 
@@ -342,12 +368,20 @@ class SingleVlanGroupVerifyView(LibreNMSPermissionMixin, CacheMixin, View):
     updated HTML for the VLANs cell with correct colors.
     """
 
+    # Read-only verify endpoint that surfaces a device's interface VLAN assignments —
+    # require object-view permission on the underlying Device (mirrors the other verify views).
+    required_object_permissions = {"POST": [("view", Device)]}
+
     def post(self, request):
-        from ipam.models import VLAN, VLANGroup
+        from ipam.models import VLANGroup
 
         data, err = parse_request_json(request)
         if err:
             return err
+        # Gate BEFORE resolving the device/VLAN group so an unauthorized caller can't probe
+        # device IDs (existence via 404) through this endpoint.
+        if error := self.require_object_permissions_json("POST"):
+            return error
         device_id = data.get("device_id")
         interface_name = data.get("interface_name")
         vlan_group_id = data.get("vlan_group_id")
@@ -359,7 +393,9 @@ def post(self, request):
         if not vid_str:
             return JsonResponse({"status": "error", "message": "No VID provided"}, status=400)
 
-        device = get_object_or_404(Device, pk=device_id)
+        # Object-scope the lookup (see SingleInterfaceVerifyView): the gate only checked model-level
+        # view_device, so an out-of-scope pk must 404 rather than expose the device.
+        device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=device_id)
         try:
             vid = int(vid_str)
         except (ValueError, TypeError):
@@ -461,7 +497,7 @@ def _render_vlans_cell(
         return mark_safe(", ".join(parts))
 
 
-class VerifyVlanSyncGroupView(LibreNMSPermissionMixin, View):
+class VerifyVlanSyncGroupView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, View):
     """
     Verify whether a VLAN (by VID) exists in a selected VLAN group.
 
@@ -470,12 +506,20 @@ class VerifyVlanSyncGroupView(LibreNMSPermissionMixin, View):
     update row colors without a full page reload.
     """
 
+    # Read-only verify endpoint that surfaces NetBox VLAN existence + names — require
+    # object-view permission on VLAN (there is no device in scope here, unlike the other
+    # verify views), so an unauthorized caller can't enumerate VLANs/groups.
+    required_object_permissions = {"POST": [("view", VLAN)]}
+
     def post(self, request):
-        from ipam.models import VLAN, VLANGroup
+        from ipam.models import VLANGroup
 
         data, err = parse_request_json(request)
         if err:
             return err
+        # Gate BEFORE resolving the VLAN group / querying VLANs (mirrors the other verify views).
+        if error := self.require_object_permissions_json("POST"):
+            return error
         vlan_group_id = data.get("vlan_group_id")
         vid_str = data.get("vid", "")
         librenms_name = data.get("name", "")
@@ -532,12 +576,13 @@ def post(self, request):
             return err
         device_id = data.get("device_id")
         vid_group_map = data.get("vid_group_map", {})
-        server_key = data.get("server_key")
 
         if not device_id:
             return JsonResponse({"status": "error", "message": "No device ID provided"}, status=400)
-        if not server_key:
-            server_key = self.librenms_api.server_key
+        # Configured-string-key-or-fallback, mirroring the verify views: this WRITES the
+        # overrides into a server-scoped cache namespace, so a forged/non-string key must
+        # neither address an arbitrary namespace nor TypeError-500 the cf lookups below.
+        server_key = self.resolve_requested_server_key(data)
 
         device = get_object_or_404(Device, pk=device_id)
 
@@ -546,8 +591,10 @@ def post(self, request):
         if sync_device is None:
             sync_device = device
 
-        # Use the remaining TTL of the ports cache so both expire together
-        ports_ttl = cache.ttl(self.get_cache_key(sync_device, "ports", server_key))
+        # Use the remaining TTL of the ports cache so both expire together. .ttl() is a
+        # django-redis extension; degrade to None on a backend without it (e.g. LocMemCache)
+        # so a non-Redis deployment gets a graceful "refresh first" 400 instead of a 500.
+        ports_ttl = cache_remaining_ttl(cache, self.get_cache_key(sync_device, "ports", server_key))
         if ports_ttl is None or ports_ttl <= 0:
             return JsonResponse(
                 {"status": "error", "message": "No cached port data; refresh interfaces first"},
diff --git a/netbox_librenms_plugin/views/sync/device_fields.py b/netbox_librenms_plugin/views/sync/device_fields.py
index 68f6e855ad..d0222a9dd7 100644
--- a/netbox_librenms_plugin/views/sync/device_fields.py
+++ b/netbox_librenms_plugin/views/sync/device_fields.py
@@ -19,6 +19,7 @@
     find_by_librenms_id,
     find_matching_platform,
     get_librenms_sync_device,
+    is_legacy_librenms_id,
     match_librenms_hardware_to_device_type,
     migrate_legacy_librenms_id,
     resolve_naming_preferences,
@@ -56,7 +57,9 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id)
+        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
+        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
+        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -130,7 +133,9 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id)
+        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
+        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
+        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -184,7 +189,9 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id)
+        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
+        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
+        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -252,7 +259,9 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id)
+        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
+        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
+        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -699,14 +708,17 @@ def post(self, request, pk):
         if not isinstance(cf_value, (int, str)):
             messages.warning(request, "librenms_id is already in the server-scoped JSON format.")
             return self._sync_url(object_type, pk)
-        if isinstance(cf_value, str):
-            if not cf_value.isdigit():
-                messages.error(request, "librenms_id is not a valid integer; cannot convert.")
-                return self._sync_url(object_type, pk)
+        # Gate with is_legacy_librenms_id() (not str.isdigit()) so this handler accepts exactly the
+        # values the "Convert ID" badge shows — a whitespace-padded legacy int (" 42 ") is legacy
+        # via int() coercion, so it must not be a dead-end button (issue #99).
+        if not is_legacy_librenms_id(cf_value):
+            messages.error(request, "librenms_id is not a valid integer; cannot convert.")
+            return self._sync_url(object_type, pk)
+        librenms_id = int(cf_value)
 
-        # Verify serial match before converting
-        librenms_id = int(cf_value) if isinstance(cf_value, str) else cf_value
-        success, device_info = self.librenms_api.get_device_info(librenms_id)
+        # Verify serial match before converting — live fetch (use_cache=False): the serial gate
+        # decides whether to rewrite the id, so it must not read a stale sync-tab cache snapshot.
+        success, device_info = self.librenms_api.get_device_info(librenms_id, use_cache=False)
         if not success or not device_info:
             messages.error(request, "Could not retrieve device info from LibreNMS to verify serial.")
             return self._sync_url(object_type, pk)
@@ -734,10 +746,10 @@ def post(self, request, pk):
             if not isinstance(locked_cf, (int, str)) or isinstance(locked_cf, bool):
                 messages.warning(request, "librenms_id is already in the server-scoped JSON format.")
                 return self._sync_url(object_type, pk)
-            locked_id = int(locked_cf) if isinstance(locked_cf, str) and locked_cf.isdigit() else locked_cf
-            if not isinstance(locked_id, int):
+            if not is_legacy_librenms_id(locked_cf):
                 messages.error(request, "librenms_id changed before lock was acquired; aborting.")
                 return self._sync_url(object_type, pk)
+            locked_id = int(locked_cf)
             locked_serial = (getattr(locked, "serial", None) or "").strip()
             if locked_id != librenms_id or locked_serial != netbox_serial:
                 messages.error(request, "Device data changed before lock was acquired; aborting conversion.")
diff --git a/netbox_librenms_plugin/views/sync/interfaces.py b/netbox_librenms_plugin/views/sync/interfaces.py
index 07421a6640..5fc2482840 100644
--- a/netbox_librenms_plugin/views/sync/interfaces.py
+++ b/netbox_librenms_plugin/views/sync/interfaces.py
@@ -65,8 +65,22 @@ def post(self, request, object_type, object_id):
         obj = self.get_object(object_type, object_id)
         self.object = obj  # Store for use in sync methods
 
-        # Read server_key from POST so we use the exact server the user was viewing
-        server_key = request.POST.get("server_key") or self.librenms_api.server_key
+        # Read server_key from POST so we use the exact server the user was viewing, but only
+        # honour it when it names a configured server: the raw value scopes cache entries and
+        # librenms_id custom-field reads/writes (find_by_librenms_id / set_librenms_device_id),
+        # so a forged/unconfigured key must not address another server's namespace (issues
+        # #108/#109). Fall back to the active server when the POSTed key isn't configured.
+        # Validate via the LibreNMSAPI classmethod (like the cables/module/import sibling paths),
+        # NOT the self.librenms_api instance: touching the property builds the default/selected
+        # client, so a misconfigured default would 500 a sync the user requested on a working
+        # non-default server (the POSTed key only scopes cache + librenms_id CF reads).
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        requested_server_key = request.POST.get("server_key")
+        if requested_server_key and requested_server_key in LibreNMSAPI.get_available_servers():
+            server_key = requested_server_key
+        else:
+            server_key = self.librenms_api.server_key
         self._post_server_key = server_key
 
         interface_name_field = get_interface_name_field(request)
@@ -76,7 +90,9 @@ def post(self, request, object_type, object_id):
 
         redirect_url = (
             reverse(url_name, kwargs={"pk": object_id})
-            + f"?tab=interfaces&interface_name_field={interface_name_field}"
+            # quote_plus the field too: it comes from the request, so unescaped special chars
+            # could corrupt the redirect or inject extra query params (issue #107).
+            + f"?tab=interfaces&interface_name_field={quote_plus(interface_name_field)}"
             + (f"&server_key={quote_plus(server_key)}" if server_key else "")
         )
 
@@ -125,13 +141,25 @@ def get_cached_ports_data(self, request, obj, server_key=None):
             if sync_device is not None:
                 cache_obj = sync_device
         cached_data = cache.get(self.get_cache_key(cache_obj, "ports", server_key))
-        if not cached_data:
+        # No cached entry at all (or a non-dict one) → ask the user to refresh before syncing.
+        if not isinstance(cached_data, dict):
+            messages.warning(
+                request,
+                "No cached data found. Please refresh the data before syncing.",
+            )
+            return None
+        # A dict that simply lacks a 'ports' key is treated as 'no ports to sync' — a harmless
+        # empty no-op (matching the historical behavior). But a PRESENT-but-malformed ports value
+        # (None, a non-list, or a list with non-dict entries) is failed closed so the sync loops
+        # don't 500 mid-sync.
+        ports_data = cached_data.get("ports", [])
+        if not isinstance(ports_data, list) or any(not isinstance(port, dict) for port in ports_data):
             messages.warning(
                 request,
                 "No cached data found. Please refresh the data before syncing.",
             )
             return None
-        return cached_data.get("ports", [])
+        return ports_data
 
     def sync_selected_interfaces(
         self,
diff --git a/netbox_librenms_plugin/views/sync/ip_addresses.py b/netbox_librenms_plugin/views/sync/ip_addresses.py
index e1b602af3e..3e252acfca 100644
--- a/netbox_librenms_plugin/views/sync/ip_addresses.py
+++ b/netbox_librenms_plugin/views/sync/ip_addresses.py
@@ -115,10 +115,18 @@ def get_management_ip(self, obj):
             librenms_id = self.librenms_api.get_librenms_id(obj)
             if not librenms_id:
                 return None
-            success, info = self.librenms_api.get_device_info(librenms_id)
+            # use_cache=False: this feeds the Primary-IP write decision, so it must read the live
+            # management IP, not a stale snapshot the sync-tab render may have cached.
+            success, info = self.librenms_api.get_device_info(librenms_id, use_cache=False)
             if not success or not isinstance(info, dict):
                 return None
-            return (info.get("ip") or "").strip() or None
+            ip = info.get("ip")
+            # Guard the type explicitly (like _resolve_management_ip in ip_addresses_view) rather
+            # than letting a non-string ip raise AttributeError into the broad except below: a
+            # malformed non-string ip is "no management IP", not an unexpected failure to swallow.
+            if not isinstance(ip, str):
+                return None
+            return ip.strip() or None
         except Exception:  # pragma: no cover - defensive
             return None
 

From aec0360a1722bbf90a79b9f23b144679e5517d77 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 03/17] fix(imports): harden bulk import and re-key device-type
 mappings

Require a unique serial match before binding an existing device, force Device mode when a
Device match wins, carry server_key through the conflict-action forms, re-key existing
DeviceTypeMapping rows to the normalized form behind a guarded migration, report
platform-assignment failures instead of a false success, reject a numeric-like VM device_id
instead of int()-truncating it, and preload/seed the device cache once for both the
background and synchronous paths.
---
 .../import_utils/bulk_import.py               |  66 +-
 .../import_utils/device_operations.py         |  80 +-
 .../import_utils/vm_operations.py             |  11 +-
 .../0011_renormalize_device_type_mappings.py  |  90 ++
 .../htmx/bulk_import_confirm.html             |   9 +
 .../tests/test_coverage_actions.py            | 777 ++++++++++++++++--
 .../tests/test_coverage_bulk_import.py        |  61 +-
 .../tests/test_coverage_device_operations.py  | 201 ++++-
 .../tests/test_coverage_devices.py            | 353 ++++----
 .../tests/test_import_utils.py                | 222 +++++
 .../tests/test_sync_devices.py                |  40 -
 .../tests/test_vm_operations.py               |  31 +
 .../views/imports/actions.py                  | 364 +++++---
 13 files changed, 1857 insertions(+), 448 deletions(-)
 create mode 100644 netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py

diff --git a/netbox_librenms_plugin/import_utils/bulk_import.py b/netbox_librenms_plugin/import_utils/bulk_import.py
index 93962432e7..d4fde87631 100644
--- a/netbox_librenms_plugin/import_utils/bulk_import.py
+++ b/netbox_librenms_plugin/import_utils/bulk_import.py
@@ -8,7 +8,7 @@
 
 from ..import_validation_helpers import apply_role_to_validation, recalculate_validation_status, remove_validation_issue
 from ..librenms_api import LibreNMSAPI
-from ..utils import find_by_librenms_id
+from ..utils import find_by_librenms_id, preload_normalization_rules
 from .cache import get_cache_metadata_key, get_import_device_cache_key, get_validated_device_cache_key
 from .device_operations import import_single_device, validate_device_for_import
 from .filters import _safe_disabled, get_librenms_devices_for_import
@@ -117,6 +117,10 @@ def bulk_import_devices_shared(
     # Initialize API client once for all devices to avoid repeated config parsing
     api = LibreNMSAPI(server_key=server_key)
 
+    # Preload the device_type NormalizationRule set once so the per-device hardware→device-type
+    # match doesn't re-query it for every device in the loop (issue #90 / N+1 avoidance, #92).
+    device_type_norm_rules = preload_normalization_rules("device_type")
+
     for idx, device_id in enumerate(device_ids, start=1):
         # Check for job cancellation on first iteration and every 5th thereafter.
         if job and (idx == 1 or idx % 5 == 0) and _is_job_cancelled(job):
@@ -133,7 +137,16 @@ def bulk_import_devices_shared(
                 libre_device = libre_devices_cache[device_id]
                 success = True
             else:
-                success, libre_device = api.get_device_info(device_id)
+                # Import decisions (DeviceType match, serial-conflict, hostname) must run against
+                # live LibreNMS data: bypass the short device-info read cache so a value the user
+                # just corrected in LibreNMS isn't read back stale within the cache window.
+                success, libre_device = api.get_device_info(device_id, use_cache=False)
+                # Backfill the shared cache so the synchronous import's post-import row re-render
+                # (which reads the same dict via fetch_device_with_cache) doesn't issue a second
+                # LibreNMS round-trip per device on a cold cache. The background path passes a
+                # serialized copy and skips that re-render, so this is a harmless no-op there.
+                if success and libre_device is not None and libre_devices_cache is not None:
+                    libre_devices_cache[device_id] = libre_device
 
             if not success or not libre_device:
                 error_msg = f"Failed to retrieve device {device_id} from LibreNMS"
@@ -156,6 +169,7 @@ def bulk_import_devices_shared(
                 # LibreNMS inventory so stack members are created even when preview
                 # flags are stale or omitted.
                 include_vc_detection=True,
+                preloaded_device_type_rules=device_type_norm_rules,
             )
 
             vc_data = validation.get("virtual_chassis", {})
@@ -410,15 +424,21 @@ def _refresh_existing_device(validation: dict, libre_device: dict = None, server
         match_type = None
         found_as_cross_model = False
 
-        def _lookup_in_model(m):
-            """Return (device, match_type) for model m, or (None, None)."""
+        def _id_lookup(m):
+            """librenms_id match in model m, or None."""
             if librenms_id is not None and not isinstance(librenms_id, bool):
-                try:
-                    dev = find_by_librenms_id(m, int(librenms_id), server_key)
-                    if dev:
-                        return dev, "librenms_id"
-                except (ValueError, TypeError):
-                    pass
+                # int/str only (find_by_librenms_id's contract). Don't int()-coerce:
+                # int(42.9) -> 42 would bind an unrelated object by a truncated id. A float
+                # (or any other type) carries no exact id, so fail closed; str-digit ids are
+                # canonicalized by find_by_librenms_id itself (mirrors _librenms_id_q's
+                # lossy-coercion guard, #103).
+                if not isinstance(librenms_id, (int, str)):
+                    return None
+                return find_by_librenms_id(m, librenms_id, server_key)
+            return None
+
+        def _name_lookup(m):
+            """name-based match in model m → (device, match_type) or (None, None)."""
             resolved_name = validation.get("resolved_name")
             if resolved_name:
                 dev = m.objects.filter(name__iexact=resolved_name).first()
@@ -434,14 +454,24 @@ def _lookup_in_model(m):
                     return dev, "sysname"
             return None, None
 
-        new_device, match_type = _lookup_in_model(Model)
-
-        if not new_device:
-            # Try the opposite model: catches cross-model imports that happened
-            # after the cache was built (e.g. LibreNMS device imported as VM).
-            new_device, match_type = _lookup_in_model(CrossModel)
-            if new_device:
-                found_as_cross_model = True
+        # An exact librenms_id match wins across BOTH models before any name fallback. Otherwise a
+        # refresh could bind a name-colliding object in the preferred model even when the scanned
+        # LibreNMS id is already linked to the *other* model (e.g. a VM), disagreeing with
+        # validation and rendering actions for the wrong object.
+        dev = _id_lookup(Model)
+        if dev:
+            new_device, match_type = dev, "librenms_id"
+        else:
+            dev = _id_lookup(CrossModel)
+            if dev:
+                new_device, match_type, found_as_cross_model = dev, "librenms_id", True
+            else:
+                new_device, match_type = _name_lookup(Model)
+                if not new_device:
+                    # Catches cross-model imports made after the cache was built.
+                    new_device, match_type = _name_lookup(CrossModel)
+                    if new_device:
+                        found_as_cross_model = True
 
         if new_device:
             validation["existing_device"] = new_device
diff --git a/netbox_librenms_plugin/import_utils/device_operations.py b/netbox_librenms_plugin/import_utils/device_operations.py
index 6b87935b03..948f9a9e6f 100644
--- a/netbox_librenms_plugin/import_utils/device_operations.py
+++ b/netbox_librenms_plugin/import_utils/device_operations.py
@@ -15,6 +15,7 @@
     find_by_librenms_id,
     find_matching_platform,
     find_matching_site,
+    is_legacy_librenms_id,
     match_librenms_hardware_to_device_type,
     set_librenms_device_id,
 )
@@ -29,7 +30,7 @@
 logger = logging.getLogger(__name__)
 
 
-def _try_chassis_device_type_match(api, device_id):
+def _try_chassis_device_type_match(api, device_id, preloaded_device_type_rules: dict | None = None):
     """
     Attempt device type matching using chassis inventory fields.
 
@@ -41,8 +42,15 @@ def _try_chassis_device_type_match(api, device_id):
     Tries entPhysicalName first (typically the chassis part number),
     then entPhysicalModelName as fallback.
 
+    Args:
+        api (LibreNMSAPI): API client used to fetch the chassis inventory.
+        device_id (int): LibreNMS device ID whose chassis inventory to inspect.
+        preloaded_device_type_rules (dict | None): Optional device_type NormalizationRule set from
+            :func:`preload_normalization_rules`, threaded into the inner match so bulk imports don't
+            reissue the rule query per device.
+
     Returns:
-        dict with matched/device_type/match_type keys, or None on failure.
+        dict | None: Dict with matched/device_type/match_type keys, or None on failure.
     """
     skip_values = {"", "-", "Unspecified", "BUILTIN", "None"}
 
@@ -56,7 +64,9 @@ def _try_chassis_device_type_match(api, device_id):
             for field in ("entPhysicalName", "entPhysicalModelName"):
                 value = item.get(field) or ""
                 if value and value not in skip_values:
-                    chassis_match = match_librenms_hardware_to_device_type(value)
+                    chassis_match = match_librenms_hardware_to_device_type(
+                        value, preloaded_rules=preloaded_device_type_rules
+                    )
                     if chassis_match is None:
                         continue
                     if chassis_match["matched"]:
@@ -135,6 +145,7 @@ def validate_device_for_import(
     force_vc_refresh: bool = False,
     use_sysname: bool = True,
     strip_domain: bool = False,
+    preloaded_device_type_rules: dict | None = None,
 ) -> dict:
     """
     Validate if a LibreNMS device can be imported to NetBox.
@@ -301,9 +312,7 @@ def validate_device_for_import(
             # LibreNMSAPI.get_librenms_id() returns an int in both formats, so only the
             # raw type check on custom_field_data reveals whether migration is needed.
             _vm_cf_id = existing_vm.custom_field_data.get("librenms_id")
-            if (isinstance(_vm_cf_id, int) and not isinstance(_vm_cf_id, bool)) or (
-                isinstance(_vm_cf_id, str) and _vm_cf_id.isdigit()
-            ):
+            if is_legacy_librenms_id(_vm_cf_id):
                 result["librenms_id_needs_migration"] = True
 
             # Check if name matches resolved name (accounts for use_sysname/strip_domain)
@@ -323,6 +332,10 @@ def validate_device_for_import(
                 logger.info(f"Found existing device: {existing_device.name} (matched by librenms_id={librenms_id})")
                 result["existing_device"] = existing_device
                 result["existing_match_type"] = "librenms_id"
+                # A Device matched: force Device mode so a user-selected VM mode doesn't carry a
+                # Device-mapped row into the VM validation/UI path (the VM branches above set
+                # import_as_vm=True; the Device branches must symmetrically set it False).
+                result["import_as_vm"] = False
                 result["can_import"] = False
 
                 # Detect legacy bare-integer or string-digit format so UI can offer a migration action.
@@ -330,9 +343,7 @@ def validate_device_for_import(
                 # LibreNMSAPI.get_librenms_id() returns an int in both formats, so only the
                 # raw type check on custom_field_data reveals whether migration is needed.
                 _dev_cf_id = existing_device.custom_field_data.get("librenms_id")
-                if (isinstance(_dev_cf_id, int) and not isinstance(_dev_cf_id, bool)) or (
-                    isinstance(_dev_cf_id, str) and _dev_cf_id.isdigit()
-                ):
+                if is_legacy_librenms_id(_dev_cf_id):
                     result["librenms_id_needs_migration"] = True
 
                 # Check if name matches resolved name (VC-aware: compare against VC member name)
@@ -411,6 +422,9 @@ def validate_device_for_import(
                 logger.info(f"Found existing device by hostname: {existing_device.name}")
                 result["existing_device"] = existing_device
                 result["existing_match_type"] = "hostname"
+                # Force Device mode (see the librenms_id branch above): a hostname match to a
+                # Device must not leave a user-selected VM mode active.
+                result["import_as_vm"] = False
 
                 # Check for serial conflict on hostname-matched device
                 incoming_serial = libre_device.get("serial") or ""
@@ -443,7 +457,26 @@ def validate_device_for_import(
             if not result["existing_device"]:
                 serial = libre_device.get("serial") or ""
                 if serial and serial != "-" and not import_as_vm:
-                    existing_by_serial = Device.objects.filter(serial=serial).first()
+                    # Serial is not unique in NetBox, so .first() would bind an arbitrary row
+                    # and the downstream serial/OOB/merge flow would derive its guidance from a
+                    # random device. Require a unique match before binding, mirroring the
+                    # merge-peer [:2] guard (issue #101).
+                    serial_matches = list(Device.objects.filter(serial=serial)[:2])
+                    if len(serial_matches) > 1:
+                        # Device.serial is not unique in NetBox, so several rows already share it.
+                        # Binding to an arbitrary one is wrong, and importing anyway would mint YET
+                        # ANOTHER same-serial device. Make it a blocking issue (issue -> can_import
+                        # False) and flag the duplicate, rather than only warning and letting the row
+                        # import. Not serial_action="conflict": there is no single peer to resolve
+                        # against, so the sync-serial UI (which needs one existing_device) can't apply.
+                        result["serial_duplicate"] = True
+                        result["issues"].append(
+                            f"Multiple NetBox devices share serial '{serial}'; resolve the duplicate "
+                            "serial before importing."
+                        )
+                        existing_by_serial = None
+                    else:
+                        existing_by_serial = serial_matches[0] if serial_matches else None
                     if existing_by_serial:
                         logger.info(f"Found existing device by serial: {existing_by_serial.name} (serial={serial})")
                         result["existing_device"] = existing_by_serial
@@ -528,7 +561,7 @@ def validate_device_for_import(
 
             # 3. Validate DeviceType (required)
             hardware = libre_device.get("hardware", "")
-            dt_match = match_librenms_hardware_to_device_type(hardware)
+            dt_match = match_librenms_hardware_to_device_type(hardware, preloaded_rules=preloaded_device_type_rules)
 
             if dt_match is None:
                 result["device_type"]["found"] = False
@@ -544,7 +577,9 @@ def validate_device_for_import(
                 if not dt_match["matched"] and api:
                     device_id = libre_device.get("device_id")
                     if device_id:
-                        chassis_match = _try_chassis_device_type_match(api, device_id)
+                        chassis_match = _try_chassis_device_type_match(
+                            api, device_id, preloaded_device_type_rules=preloaded_device_type_rules
+                        )
                         if chassis_match and chassis_match["matched"]:
                             dt_match = chassis_match
 
@@ -755,9 +790,12 @@ def import_single_device(
     try:
         api = LibreNMSAPI(server_key=server_key)
 
-        # Use pre-fetched device data if provided, otherwise fetch from API
+        # Use pre-fetched device data if provided, otherwise fetch from API. Read LIVE
+        # (use_cache=False): this is the device-CREATION path — name/serial/status/hardware are
+        # derived from libre_device — so it must not build a NetBox device from the 60s get_device_info
+        # snapshot a sync-tab render may have seeded, mirroring the import flow's live-read policy.
         if libre_device is None:
-            success, libre_device = api.get_device_info(device_id)
+            success, libre_device = api.get_device_info(device_id, use_cache=False)
             if not success or not libre_device:
                 return {
                     "success": False,
@@ -936,20 +974,23 @@ def import_single_device(
         }
 
 
-def get_librenms_device_by_id(api: LibreNMSAPI, device_id: int) -> dict:
+def get_librenms_device_by_id(api: LibreNMSAPI, device_id: int, use_cache: bool = True) -> dict:
     """
     Retrieve a single device from LibreNMS by ID.
 
     Args:
         api: LibreNMSAPI instance
         device_id: LibreNMS device ID
+        use_cache: Passed through to ``get_device_info``. The import fallback passes ``False`` so
+            that when ``fetch_device_with_cache``'s own caches miss, the API fallback returns live
+            data rather than the 60s get_device_info snapshot a sync-tab render may have seeded.
 
     Returns:
         Device dictionary or None if not found
     """
     try:
         # Use the dedicated API endpoint to get device by ID
-        success, device = api.get_device_info(device_id)
+        success, device = api.get_device_info(device_id, use_cache=use_cache)
         if success and device:
             return device
 
@@ -1005,8 +1046,11 @@ def fetch_device_with_cache(
     libre_device = cache.get(cache_key)
 
     if not libre_device:
-        # Fallback to API fetch
-        libre_device = get_librenms_device_by_id(api, device_id)
+        # Fallback to API fetch. Read LIVE: both this function's caches (the pre-fetched dict and the
+        # import Django cache) have already missed, so the fallback must reflect current LibreNMS
+        # state — not the separate 60s get_device_info snapshot a sync-tab render may have populated —
+        # or the confirm modal / re-rendered row shows metadata that disagrees with what import uses.
+        libre_device = get_librenms_device_by_id(api, device_id, use_cache=False)
         if libre_device:
             # Cache for future use
             cache.set(cache_key, libre_device, timeout=api.cache_timeout)
diff --git a/netbox_librenms_plugin/import_utils/vm_operations.py b/netbox_librenms_plugin/import_utils/vm_operations.py
index 99ae10a8af..99f1fa0a05 100644
--- a/netbox_librenms_plugin/import_utils/vm_operations.py
+++ b/netbox_librenms_plugin/import_utils/vm_operations.py
@@ -65,9 +65,16 @@ def create_vm_from_librenms(
     # Validate device_id before creating the VM so a missing/invalid value
     # never leaves a VM without a librenms_id (partial persistence).
     raw_device_id = libre_device["device_id"]
-    if isinstance(raw_device_id, bool):
-        raise ValueError(f"device_id is a boolean ({raw_device_id!r}); expected an integer")
+    # Reject bool (a subclass of int → int(True) == 1) AND floats/Decimals (int(1.9) would truncate
+    # to a valid-looking but WRONG pk), accepting only a real int or a plain digit string. Without
+    # this a numeric-like device_id would create a VM with a truncated/garbage librenms_id mapping.
+    if isinstance(raw_device_id, bool) or not (
+        isinstance(raw_device_id, int) or (isinstance(raw_device_id, str) and raw_device_id.strip().isdecimal())
+    ):
+        raise ValueError(f"device_id {raw_device_id!r} is not a valid integer id")
     librenms_device_id = int(raw_device_id)
+    if librenms_device_id <= 0:
+        raise ValueError(f"device_id {raw_device_id!r} must be a positive integer")
 
     from ..utils import set_librenms_device_id
 
diff --git a/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
new file mode 100644
index 0000000000..b13f13f1bd
--- /dev/null
+++ b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
@@ -0,0 +1,90 @@
+"""Re-key existing DeviceTypeMapping rows through the device_type NormalizationRule scope.
+
+The hardware→DeviceType lookup (``utils.match_librenms_hardware_to_device_type``) now normalizes
+the LibreNMS hardware string via the ``device_type`` NormalizationRule scope *before* querying
+``librenms_hardware__iexact``, and newly created mappings are stored normalized. Mappings created
+before that change hold the un-normalized value, so once any ``device_type`` rule exists they no
+longer match the normalized lookup. This data migration applies the same normalization the runtime
+uses to existing rows so they keep matching after upgrade.
+"""
+
+import logging
+
+from django.db import migrations, transaction
+
+logger = logging.getLogger(__name__)
+
+
+def renormalize_device_type_mappings(apps, schema_editor):
+    """Apply the device_type normalization to each existing DeviceTypeMapping's hardware key."""
+    DeviceTypeMapping = apps.get_model("netbox_librenms_plugin", "DeviceTypeMapping")
+
+    # Use the runtime normalizer so re-keyed values mirror the lookup path exactly. Guard the
+    # import/normalization: if anything is unavailable, leave rows untouched rather than corrupt
+    # them (a fresh install has no rows to migrate anyway).
+    try:
+        from netbox_librenms_plugin.utils import apply_normalization_rules
+    except Exception:  # pragma: no cover - defensive
+        return
+
+    for mapping in DeviceTypeMapping.objects.all().iterator():
+        raw = mapping.librenms_hardware or ""
+        rekeyed = None
+        # One savepoint per ROW, wrapping every DB touch — the NormalizationRule queries
+        # inside apply_normalization_rules, the clash .exists(), AND the save. Under the
+        # migration's default atomic transaction, a DB-level failure in ANY of them poisons
+        # the whole transaction on PostgreSQL, so a bare try/except could not actually
+        # continue — the next row's query would error with "current transaction is
+        # aborted". Rolling back only this row's savepoint keeps the loop going, mirroring
+        # the "leave it for manual fixup" path. (The row iterator's cursor predates the
+        # savepoint, so a rollback doesn't invalidate it.)
+        try:
+            with transaction.atomic():
+                normalized = (apply_normalization_rules(value=raw, scope="device_type") or "").strip().lower()
+
+                # Stored values are already lowercased (the model lowercases on save); skip when
+                # the normalization is a no-op so we don't issue pointless writes or fire signals.
+                if not normalized or normalized == raw.strip().lower():
+                    continue
+
+                # The lookup is case-insensitive (__iexact). If another row already holds the
+                # normalized key, re-keying this one would trip the unique constraint — and
+                # signals that two raw mappings collapse to the same normalized value. Leave the
+                # original and warn so the operator can resolve the duplicate by hand.
+                clash = (
+                    DeviceTypeMapping.objects.exclude(pk=mapping.pk)
+                    .filter(librenms_hardware__iexact=normalized)
+                    .exists()
+                )
+                if clash:
+                    logger.warning(
+                        "renormalize_device_type_mappings: %r normalizes to %r which already maps to a "
+                        "device type; leaving the original and skipping to avoid a unique-constraint clash "
+                        "— resolve the duplicate DeviceTypeMapping manually.",
+                        raw,
+                        normalized,
+                    )
+                    continue
+
+                mapping.librenms_hardware = normalized
+                mapping.save(update_fields=["librenms_hardware"])
+                rekeyed = normalized
+        except Exception:
+            logger.exception(
+                "renormalize_device_type_mappings: failed to re-key %r; leaving the original value.",
+                raw,
+            )
+            continue
+        if rekeyed is not None:
+            logger.info("renormalize_device_type_mappings: re-keyed %r → %r", raw, rekeyed)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("netbox_librenms_plugin", "0010_inventory_and_mapping_models"),
+    ]
+
+    operations = [
+        # Irreversible: the original (un-normalized) hardware strings cannot be reconstructed.
+        migrations.RunPython(renormalize_device_type_mappings, migrations.RunPython.noop),
+    ]
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
index a83ff7c0ff..fdefd45935 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
@@ -15,6 +15,15 @@ <h5 class="modal-title">
     </div>
   {% endif %}
 
+  {% if cache_expired_count %}
+    <div class="alert alert-warning" role="alert">
+      <i class="mdi mdi-clock-alert"></i>
+      {{ cache_expired_count }} of {{ selected_count }} selected device{{ selected_count|pluralize }} had expired cache data
+      and {{ cache_expired_count|pluralize:"was,were" }} dropped or may be missing role/rack selections.
+      <a href="javascript:window.location.reload();" class="alert-link">Refresh</a> or re-run your filter to reload device data.
+    </div>
+  {% endif %}
+
   {% for entry in devices %}
     {% with vc=entry.validation.virtual_chassis %}
       <div class="border rounded-3 p-2 mb-2">
diff --git a/netbox_librenms_plugin/tests/test_coverage_actions.py b/netbox_librenms_plugin/tests/test_coverage_actions.py
index 36da3e5f8f..fe4f21d372 100644
--- a/netbox_librenms_plugin/tests/test_coverage_actions.py
+++ b/netbox_librenms_plugin/tests/test_coverage_actions.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 def _make_request(post=None, get=None, headers=None, user_is_superuser=False):
     """Build a mock request object with QueryDict-like POST/GET."""
@@ -854,6 +856,18 @@ def test_invalid_key_returns_400(self):
             result = view.post(request)
         assert result.status_code == 400
 
+    def test_non_object_json_returns_400(self):
+        """Valid JSON that is not an object (list/str/number) must be rejected as 400, not 500 on data.get()."""
+        import json
+
+        view = self._make_view()
+        for payload in ([1, 2, 3], "hello", 42):
+            with patch.object(view, "require_write_permission", return_value=None):
+                request = MagicMock()
+                request.body = json.dumps(payload).encode()
+                result = view.post(request)  # must not raise AttributeError
+            assert result.status_code == 400
+
     def test_valid_pref_saved(self):
         import json
 
@@ -937,40 +951,6 @@ def test_should_use_background_job_superuser_without_flag(self):
         assert result is False
 
 
-class TestShouldEnableVCDetection:
-    """Tests for DeviceImportHelperMixin._should_enable_vc_detection."""
-
-    def _make_view(self):
-        from netbox_librenms_plugin.views.imports.actions import DeviceRoleUpdateView
-
-        view = object.__new__(DeviceRoleUpdateView)
-        view._librenms_api = _make_api()
-        return view
-
-    def test_enable_vc_detection_from_get(self):
-        view = self._make_view()
-        request = _make_request(get={"enable_vc_detection": "true"})
-        assert view._should_enable_vc_detection(1, request) is True
-
-    def test_no_explicit_vc_detection_still_returns_true(self):
-        """Function always returns True (smart caching fallback)."""
-        view = self._make_view()
-        request = _make_request(get={"enable_vc_detection": "false"})
-        # The function checks cache, and without cached data it still returns True
-        with patch("netbox_librenms_plugin.views.imports.actions.cache") as mock_cache:
-            mock_cache.get.return_value = None
-            result = view._should_enable_vc_detection(1, request)
-        assert result is True
-
-    def test_enable_vc_detection_from_post(self):
-        view = self._make_view()
-        request = _make_request(post={"enable_vc_detection": "on"})
-        with patch("netbox_librenms_plugin.views.imports.actions.cache") as mock_cache:
-            mock_cache.get.return_value = None
-            result = view._should_enable_vc_detection(1, request)
-        assert result is True
-
-
 class TestBuildSyncInfoNoPlatform:
     """Tests for _build_sync_info when no platform on either side."""
 
@@ -1162,6 +1142,9 @@ def test_server_key_override_creates_new_api(self):
 
         with patch.object(view, "require_all_permissions", return_value=None):
             with patch("netbox_librenms_plugin.librenms_api.LibreNMSAPI") as MockAPI:
+                # The posted key is honoured only when it names a CONFIGURED server: the rebind guard
+                # consults get_available_servers() first, so a forged/stale key can't 500 the action.
+                MockAPI.get_available_servers.return_value = {"secondary": "Secondary"}
                 with patch("dcim.models.Device") as MockDevice:
                     mock_device_obj = MagicMock()
                     MockDevice.objects.get.return_value = mock_device_obj
@@ -2299,6 +2282,9 @@ def test_vm_with_cluster_and_role_applies_both(self):
             "status": "importable",
             "resolved_name": "vm01",
             "virtual_chassis": {},
+            # is_vm is recomputed from import_as_vm; set it so the VM cluster path actually runs
+            # (the prior weak assertion masked that this branch was never exercised).
+            "import_as_vm": True,
         }
         mock_cluster = MagicMock()
         mock_role = MagicMock()
@@ -2321,7 +2307,10 @@ def test_vm_with_cluster_and_role_applies_both(self):
                         ):
                             with patch(
                                 "netbox_librenms_plugin.views.imports.actions.fetch_model_by_id",
-                                side_effect=[mock_role, mock_cluster, MagicMock()],
+                                # Issue #112: key the stub by the submitted id (cluster_id=1,
+                                # role_id=2), not call order — so a wrong-id fetch returns the
+                                # wrong mock and the swap asserts below fail.
+                                side_effect=lambda _model, id_: {"1": mock_cluster, "2": mock_role}.get(str(id_)),
                             ):
                                 with patch(
                                     "netbox_librenms_plugin.views.imports.actions.apply_cluster_to_validation"
@@ -2335,8 +2324,10 @@ def test_vm_with_cluster_and_role_applies_both(self):
                                         ):
                                             response = view.post(request)
 
-        # Cluster and role should have been applied
-        assert mock_apply_c.called or mock_apply_r.called or response is not None
+        assert response is not None
+        # The cluster (id 1) and role (id 2) each reached the correct apply_* helper.
+        assert mock_apply_c.call_args.args[1] is mock_cluster
+        assert mock_apply_r.call_args.args[1] is mock_role
 
     def test_device_with_role_and_rack_applies_both(self):
         """Lines 390, 393: Device with role + rack applies both."""
@@ -2373,19 +2364,25 @@ def test_device_with_role_and_rack_applies_both(self):
                         ):
                             with patch(
                                 "netbox_librenms_plugin.views.imports.actions.fetch_model_by_id",
-                                side_effect=[mock_role, mock_rack],
+                                # Issue #112: key by submitted id (role_id=1, rack_id=2), not call order.
+                                side_effect=lambda _model, id_: {"1": mock_role, "2": mock_rack}.get(str(id_)),
                             ):
                                 with patch(
                                     "netbox_librenms_plugin.views.imports.actions.apply_role_to_validation"
                                 ) as mock_apply_r:
-                                    with patch("netbox_librenms_plugin.views.imports.actions.apply_rack_to_validation"):
+                                    with patch(
+                                        "netbox_librenms_plugin.views.imports.actions.apply_rack_to_validation"
+                                    ) as mock_apply_rack:
                                         with patch(
                                             "netbox_librenms_plugin.views.imports.actions.render",
                                             return_value=MagicMock(status_code=200),
                                         ):
                                             response = view.post(request)
 
-        assert mock_apply_r.called or response is not None
+        assert response is not None
+        # The role (id 1) and rack (id 2) each reached the correct apply_* helper.
+        assert mock_apply_r.call_args.args[1] is mock_role
+        assert mock_apply_rack.call_args.args[1] is mock_rack
 
 
 class TestSaveDevicePath:
@@ -2418,31 +2415,6 @@ def test_save_device_integrity_error(self):
         assert result.status_code == 200
         assert result.headers.get("HX-Reswap") == "none"
 
-    def test_should_enable_vc_detection_when_cached(self):
-        """Line 168: VC data already cached → returns True."""
-        from netbox_librenms_plugin.views.imports.actions import DeviceImportHelperMixin
-
-        view = object.__new__(DeviceImportHelperMixin)
-        api = _make_api()
-        # Set librenms_api as a regular attribute to bypass property lookup
-        type(view).librenms_api = property(lambda self: api)
-
-        request = _make_request(post={})
-        request.GET = MagicMock()
-        request.GET.get = MagicMock(return_value=None)  # enable_vc_detection not set
-
-        with patch("netbox_librenms_plugin.views.imports.actions.cache") as mock_cache:
-            mock_cache.get.return_value = {"some": "data"}  # Data in cache
-            with patch("netbox_librenms_plugin.import_utils._vc_cache_key", return_value="vc_key"):
-                result = view._should_enable_vc_detection(device_id=1, request=request)
-
-        assert result is True
-        # Reset the property
-        try:
-            del type(view).librenms_api
-        except AttributeError:
-            pass
-
 
 class TestDeviceConflictSelectForUpdateDoesNotExist:
     """Tests for select_for_update DoesNotExist (lines 1069-1070)."""
@@ -4080,3 +4052,678 @@ def get_side_effect(k, d=None):
                                     view.post(request)
 
         mock_redirect.assert_called()
+
+    def test_cold_cache_seed_does_not_fetch_from_librenms_before_enqueue(self):
+        """On a cold cache + background path, the pre-enqueue seed reads the Django cache only (no fetch_device_with_cache, which HTTP-fetches on a miss) and enqueues an empty libre_devices_cache."""
+        view = self._make_view()
+        request = _make_request(post={})
+        request.POST.getlist = MagicMock(return_value=["1"])
+        request.user = MagicMock()
+        request.user.is_superuser = True
+        request.headers = {}
+        request.POST.get = MagicMock(side_effect=lambda k, d=None: "on" if k == "use_background_job" else None)
+
+        mock_job = MagicMock(pk=123, job_id="uuid-cold")
+
+        with (
+            patch.object(view, "require_write_permission", return_value=None),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.resolve_naming_preferences",
+                return_value=(True, False),
+            ),
+            patch("utilities.rqworker.get_workers_for_queue", return_value=2),
+            # Cold cache: every import-device key misses. The pre-enqueue seed batches its reads
+            # via cache.get_many (one round-trip for N devices), so stub that too.
+            patch("netbox_librenms_plugin.views.imports.actions.cache.get", return_value=None),
+            patch("netbox_librenms_plugin.views.imports.actions.cache.get_many", return_value={}),
+            # The HTTP-fetching helper must NOT be reached by the pre-enqueue seed.
+            patch("netbox_librenms_plugin.views.imports.actions.fetch_device_with_cache") as mock_fetch,
+            patch("netbox_librenms_plugin.views.imports.actions.messages"),
+            patch("netbox_librenms_plugin.views.imports.actions.redirect", return_value=MagicMock()),
+            patch("netbox_librenms_plugin.jobs.ImportDevicesJob") as MockJob,
+        ):
+            MockJob.enqueue.return_value = mock_job
+            view.post(request)
+
+        # The seed read the Django cache directly and never reached the API-fetching helper.
+        mock_fetch.assert_not_called()
+        # Cold cache → nothing pre-warmed; the async job fetches misses itself.
+        MockJob.enqueue.assert_called_once()
+        assert MockJob.enqueue.call_args.kwargs["libre_devices_cache"] == {}
+
+
+@pytest.mark.django_db
+class TestAddDeviceTypeMappingNoSecondRoundTrip:
+    """Issue #66: AddDeviceTypeMappingView.post must reuse the LibreNMS device it already fetched for the modal/row refresh, never issuing a second LibreNMS round-trip after the DB write."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.imports.actions import AddDeviceTypeMappingView
+
+        view = object.__new__(AddDeviceTypeMappingView)
+        view._librenms_api = _make_api()
+        return view
+
+    def _make_device_type(self):
+        from dcim.models import DeviceType, Manufacturer
+
+        mfr = Manufacturer.objects.create(name="Cisco-66", slug="cisco-66")
+        return DeviceType.objects.create(manufacturer=mfr, model="C9300-66", slug="c9300-66")
+
+    def test_post_reuses_cached_device_no_second_librenms_call(self):
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.import_utils.cache import get_import_device_cache_key
+        from netbox_librenms_plugin.models import DeviceTypeMapping
+
+        device_id = 4242
+        dt = self._make_device_type()
+        view = self._make_view()
+
+        # Pre-seed the cache exactly as the table load would (so the first fetch is a cache hit).
+        libre_device = {
+            "device_id": device_id,
+            "hardware": "WS-C9300-66",
+            "sysName": "switch-66",
+            "hostname": "switch-66",
+            "os": "ios",
+            "serial": "SN66",
+        }
+        cache_key = get_import_device_cache_key(device_id, "default")
+        cache.set(cache_key, libre_device, timeout=300)
+
+        User = get_user_model()
+        user = User.objects.create_user(username="u66", password="x")
+        user.is_superuser = True
+        user.save()
+
+        request = RequestFactory().post(
+            f"/device-import/add-device-type-mapping/{device_id}/",
+            data={"device_type_id": str(dt.pk)},
+        )
+        request.user = user
+
+        # Mock ONLY the LibreNMS HTTP boundary; have it raise if ever called after the cache hit,
+        # so a second round-trip would be unmistakable. Also stub the auth gates and VC detection.
+        with (
+            patch("netbox_librenms_plugin.import_utils.device_operations.get_librenms_device_by_id") as mock_http,
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.import_utils.device_operations.get_virtual_chassis_data",
+                return_value={"is_stack": False, "member_count": 0, "members": []},
+            ),
+        ):
+            mock_http.return_value = None  # simulate LibreNMS unavailable on any fresh fetch
+            response = view.post(request, device_id=device_id)
+
+        # The mapping was actually written to the DB...
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="ws-c9300-66").exists()
+        # ...the refresh succeeded without ever touching the LibreNMS HTTP boundary...
+        assert mock_http.call_count == 0
+        # ...and the cached device is still present (repopulated, not cleared).
+        assert cache.get(cache_key) is not None
+        assert response.status_code == 200
+
+    def test_cache_repopulation_preserves_remaining_ttl_on_ttl_backends(self):
+        """On a TTL-reporting backend (Redis in prod) the repopulated snapshot must keep the entry's REMAINING TTL — a fresh full timeout would re-arm a minutes-old snapshot for another whole window (the bulk-import seed reads this key)."""
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.import_utils.cache import get_import_device_cache_key
+
+        device_id = 4444
+        dt = self._make_device_type()
+        view = self._make_view()
+        view._librenms_api.cache_timeout = 300
+
+        libre_device = {
+            "device_id": device_id,
+            "hardware": "WS-C9300-TTL",
+            "sysName": "switch-ttl",
+            "hostname": "switch-ttl",
+            "os": "ios",
+            "serial": "SNTTL",
+        }
+        cache_key = get_import_device_cache_key(device_id, "default")
+        cache.set(cache_key, libre_device, timeout=300)
+
+        User = get_user_model()
+        user = User.objects.create_user(username="u66ttl", password="x")
+        user.is_superuser = True
+        user.save()
+
+        request = RequestFactory().post(
+            f"/device-import/add-device-type-mapping/{device_id}/",
+            data={"device_type_id": str(dt.pk)},
+        )
+        request.user = user
+
+        spy_cache = MagicMock(wraps=cache)
+        with (
+            patch("netbox_librenms_plugin.views.imports.actions.cache", spy_cache),
+            # LocMemCache can't report TTLs; simulate the Redis behaviour at that boundary.
+            patch("netbox_librenms_plugin.utils.cache_remaining_ttl", return_value=120),
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.import_utils.device_operations.get_virtual_chassis_data",
+                return_value={"is_stack": False, "member_count": 0, "members": []},
+            ),
+        ):
+            response = view.post(request, device_id=device_id)
+
+        assert response.status_code == 200
+        set_calls = [c for c in spy_cache.set.call_args_list if c.args and c.args[0] == cache_key]
+        assert set_calls, "the snapshot was not repopulated at all"
+        assert set_calls[-1].kwargs.get("timeout") == 120  # remaining TTL, not a fresh full 300
+
+    def test_mapping_persisted_under_normalised_hardware_key(self):
+        """The mapping must be keyed on the NORMALISED hardware string."""
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.import_utils.cache import get_import_device_cache_key
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        device_id = 4343
+        dt = self._make_device_type()
+        view = self._make_view()
+
+        # A device_type rule strips the "WS-" prefix the raw LibreNMS string carries.
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r"\1", priority=10
+        )
+
+        libre_device = {
+            "device_id": device_id,
+            "hardware": "WS-C9300-66",  # normalises to "C9300-66"
+            "sysName": "switch-43",
+            "hostname": "switch-43",
+            "os": "ios",
+            "serial": "SN43",
+        }
+        cache.set(get_import_device_cache_key(device_id, "default"), libre_device, timeout=300)
+
+        User = get_user_model()
+        user = User.objects.create_user(username="u43", password="x")
+        user.is_superuser = True
+        user.save()
+
+        request = RequestFactory().post(
+            f"/device-import/add-device-type-mapping/{device_id}/",
+            data={"device_type_id": str(dt.pk)},
+        )
+        request.user = user
+
+        with (
+            patch("netbox_librenms_plugin.import_utils.device_operations.get_librenms_device_by_id", return_value=None),
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.import_utils.device_operations.get_virtual_chassis_data",
+                return_value={"is_stack": False, "member_count": 0, "members": []},
+            ),
+        ):
+            view.post(request, device_id=device_id)
+
+        # Saved under the normalised, lowercased key — NOT the raw "ws-c9300-66".
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="c9300-66").exists()
+        assert not DeviceTypeMapping.objects.filter(librenms_hardware="ws-c9300-66").exists()
+
+    def test_normalised_hardware_is_trimmed_before_lookup(self):
+        """The normalised key must be trimmed."""
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from dcim.models import DeviceType, Manufacturer
+        from netbox_librenms_plugin.import_utils.cache import get_import_device_cache_key
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        device_id = 4444
+        mfr = Manufacturer.objects.create(name="Cisco-trim", slug="cisco-trim")
+        dt_old = DeviceType.objects.create(manufacturer=mfr, model="C9300-old", slug="c9300-old")
+        dt_new = DeviceType.objects.create(manufacturer=mfr, model="C9300-new", slug="c9300-new")
+        view = self._make_view()
+
+        # A pre-existing mapping (stored stripped+lowercased by clean()).
+        existing = DeviceTypeMapping.objects.create(librenms_hardware="c9300-44", netbox_device_type=dt_old)
+
+        # A rule that pads the value with spaces — the untrimmed output is " C9300-44 ".
+        NormalizationRule.objects.create(
+            scope="device_type", match_pattern=r"^WS-(.+)$", replacement=r" \1 ", priority=10
+        )
+
+        libre_device = {
+            "device_id": device_id,
+            "hardware": "WS-C9300-44",
+            "sysName": "switch-44",
+            "hostname": "switch-44",
+            "os": "ios",
+            "serial": "SN44",
+        }
+        cache.set(get_import_device_cache_key(device_id, "default"), libre_device, timeout=300)
+
+        User = get_user_model()
+        user = User.objects.create_user(username="u44", password="x")
+        user.is_superuser = True
+        user.save()
+
+        request = RequestFactory().post(
+            f"/device-import/add-device-type-mapping/{device_id}/",
+            data={"device_type_id": str(dt_new.pk)},
+        )
+        request.user = user
+
+        with (
+            patch("netbox_librenms_plugin.import_utils.device_operations.get_librenms_device_by_id", return_value=None),
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.import_utils.device_operations.get_virtual_chassis_data",
+                return_value={"is_stack": False, "member_count": 0, "members": []},
+            ),
+        ):
+            view.post(request, device_id=device_id)
+
+        # The trimmed key matched the existing mapping → it was UPDATED, not duplicated.
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="c9300-44").count() == 1
+        existing.refresh_from_db()
+        assert existing.netbox_device_type_id == dt_new.pk
+
+
+@pytest.mark.django_db
+class TestCreatePlatformAssignmentIndependence:
+    """CreatePlatformFromImportView commits the platform independently of the optional assignment."""
+
+    @staticmethod
+    def _infra():
+        from dcim.models import DeviceRole, DeviceType, Manufacturer, Site
+
+        site, _ = Site.objects.get_or_create(name="PFSite", slug="pf-site")
+        mfr, _ = Manufacturer.objects.get_or_create(name="PFMfr", slug="pf-mfr")
+        dt, _ = DeviceType.objects.get_or_create(model="PFDT", slug="pf-dt", defaults={"manufacturer": mfr})
+        role, _ = DeviceRole.objects.get_or_create(name="PFRole", slug="pf-role", defaults={"color": "00ff00"})
+        return site, dt, role
+
+    def test_platform_persists_when_target_assignment_fails(self):
+        """A non-DoesNotExist failure assigning the platform (e.g. full_clean tripping on unrelated legacy data on the target) must not roll back the just-created platform."""
+        from django.core.exceptions import ValidationError
+
+        from dcim.models import Device, Platform
+
+        from netbox_librenms_plugin.views.imports.actions import CreatePlatformFromImportView
+
+        site, dt, role = self._infra()
+        target = Device.objects.create(name="pf-target", device_type=dt, role=role, site=site, status="active")
+
+        view = object.__new__(CreatePlatformFromImportView)
+        view._librenms_api = MagicMock(server_key="default")
+
+        request = MagicMock()
+        request.POST = {"platform_name": "NewPlatPF"}
+
+        validation = {"existing_device": target}
+        dvdv = MagicMock()
+        dvdv.return_value.get.return_value.content.decode.return_value = "<div></div>"
+
+        with (
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch.object(view, "get_validated_device_with_selections", return_value=(None, validation, {})),
+            patch("netbox_librenms_plugin.views.imports.actions.cache"),
+            patch("netbox_librenms_plugin.views.imports.actions.DeviceValidationDetailsView", dvdv),
+            # Simulate legacy data on the target: its full_clean trips, so the assignment must be
+            # skipped WITHOUT rolling back the platform that was already created.
+            patch("dcim.models.Device.full_clean", side_effect=ValidationError("legacy data on target")),
+        ):
+            view.post(request, device_id=999)
+
+        # The platform create is the primary action: it must survive the failed assignment.
+        assert Platform.objects.filter(name="NewPlatPF").exists()
+        # ...and the target must be left unassigned (the failed full_clean must not partially apply).
+        target.refresh_from_db()
+        assert target.platform is None
+
+    def test_assignment_failure_is_surfaced_not_silent_success(self):
+        """A failed assignment must be reported to the user (error toast), not hidden behind a success swap that implies the device received the platform."""
+        from django.core.exceptions import ValidationError
+
+        from dcim.models import Device, Platform
+
+        from netbox_librenms_plugin.views.imports.actions import CreatePlatformFromImportView
+
+        site, dt, role = self._infra()
+        target = Device.objects.create(name="pf-target2", device_type=dt, role=role, site=site, status="active")
+
+        view = object.__new__(CreatePlatformFromImportView)
+        view._librenms_api = MagicMock(server_key="default")
+
+        request = MagicMock()
+        request.POST = {"platform_name": "NewPlatPF2"}
+
+        validation = {"existing_device": target}
+        # Patched so the UNFIXED success path can still render its OOB modal swap cleanly,
+        # making the difference observable: success swap (unfixed) vs error toast (fixed).
+        dvdv = MagicMock()
+        dvdv.return_value.get.return_value.content.decode.return_value = "<div></div>"
+
+        with (
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "require_object_permissions", return_value=None),
+            patch.object(view, "get_validated_device_with_selections", return_value=(None, validation, {})),
+            patch("netbox_librenms_plugin.views.imports.actions.cache"),
+            patch("netbox_librenms_plugin.views.imports.actions.DeviceValidationDetailsView", dvdv),
+            patch("dcim.models.Device.full_clean", side_effect=ValidationError("legacy data on target")),
+        ):
+            response = view.post(request, device_id=999)
+
+        # Platform still created (deliberate "don't roll back" invariant preserved)...
+        assert Platform.objects.filter(name="NewPlatPF2").exists()
+        # ...but the response must tell the user the assignment failed, NOT render a success swap.
+        body = response.content
+        assert b"could not be assigned" in body
+        assert b"htmx-modal-content" not in body
+
+
+class TestValidateAndApplySelectionsRevalidatesOnVmToDeviceFlip:
+    """validate_and_apply_selections must re-validate in device mode when a VM-requested row flips.
+
+    When the user submitted a cluster (VM mode) but validate_device_for_import binds an existing
+    Device by librenms_id/hostname/IP and flips import_as_vm back to False, the first pass skipped
+    VC detection / chassis-fallback device-type matching (api=None, include_vc_detection=False).
+    The helper must re-run validate_device_for_import in device mode so those apply to the device
+    the row actually resolved to.
+    """
+
+    def test_flip_triggers_device_mode_revalidation(self):
+        from netbox_librenms_plugin.views.imports.actions import DeviceImportHelperMixin
+
+        helper = object.__new__(DeviceImportHelperMixin)
+        helper.librenms_api = MagicMock(server_key="default")
+
+        calls = []
+
+        def fake_validate(libre_device, **kwargs):
+            calls.append(kwargs)
+            # VM mode was requested, but the device matched an existing Device → flip to device mode.
+            return {"import_as_vm": False}
+
+        libre_device = {"device_id": 42, "hostname": "h"}
+        request = MagicMock()
+        with (
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.extract_device_selections",
+                return_value={"cluster_id": 5, "role_id": None, "rack_id": None},
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.resolve_naming_preferences",
+                return_value=(True, False),
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.validate_device_for_import",
+                side_effect=fake_validate,
+            ),
+            patch("netbox_librenms_plugin.views.imports.actions._apply_user_selections_to_validation"),
+        ):
+            helper.validate_and_apply_selections(42, request, libre_device)
+
+        # Two passes: the VM-requested first pass, then a device-mode re-validation after the flip.
+        assert len(calls) == 2
+        first, second = calls
+        assert first["import_as_vm"] is True
+        assert first["include_vc_detection"] is False
+        assert first["api"] is None
+        assert second["import_as_vm"] is False
+        assert second["include_vc_detection"] is True
+        assert second["api"] is helper.librenms_api
+
+    def test_no_revalidation_when_vm_import_stays_vm(self):
+        """A VM that stays a VM must NOT trigger a second validation pass (no wasted API round-trip)."""
+        from netbox_librenms_plugin.views.imports.actions import DeviceImportHelperMixin
+
+        helper = object.__new__(DeviceImportHelperMixin)
+        helper.librenms_api = MagicMock(server_key="default")
+
+        calls = []
+
+        def fake_validate(libre_device, **kwargs):
+            calls.append(kwargs)
+            return {"import_as_vm": True}  # stays a VM
+
+        with (
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.extract_device_selections",
+                return_value={"cluster_id": 5, "role_id": None, "rack_id": None},
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.resolve_naming_preferences",
+                return_value=(True, False),
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.validate_device_for_import",
+                side_effect=fake_validate,
+            ),
+            patch("netbox_librenms_plugin.views.imports.actions._apply_user_selections_to_validation"),
+        ):
+            helper.validate_and_apply_selections(42, MagicMock(), {"device_id": 42})
+
+        assert len(calls) == 1
+
+
+@pytest.mark.django_db
+class TestBulkImportRerenderVMClassification:
+    """The HTMX re-render loop must classify each imported row as VM or device from a prefetched set, not by rebuilding the VM-id list per row."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.imports.actions import BulkImportDevicesView
+
+        view = object.__new__(BulkImportDevicesView)
+        view._librenms_api = _make_api()
+        return view
+
+    def test_rerender_classifies_vms_from_prefetched_set_without_per_row_rebuild(self):
+        from django.contrib.auth import get_user_model
+        from django.contrib.messages.storage.fallback import FallbackStorage
+        from django.contrib.sessions.middleware import SessionMiddleware
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.import_utils.cache import get_import_device_cache_key
+
+        class _CountingList(list):
+            """A list that records how many times it is iterated."""
+
+            def __init__(self, *args):
+                super().__init__(*args)
+                self.iter_count = 0
+
+            def __iter__(self):
+                self.iter_count += 1
+                return super().__iter__()
+
+        view = self._make_view()
+        User = get_user_model()
+        user = User.objects.create_user(username="u-rerender", password="x")
+
+        # device 1 → Device import; devices 2 & 3 → VM imports (a cluster is selected for them).
+        request = RequestFactory().post(
+            "/device-import/bulk/",
+            data={"select": ["1", "2", "3"], "cluster_2": "99", "cluster_3": "99"},
+            HTTP_HX_REQUEST="true",
+        )
+        request.user = user
+        # The view emits success/skip toasts via django.contrib.messages, which needs a real
+        # session + message store on a RequestFactory request.
+        SessionMiddleware(lambda req: None).process_request(request)
+        request.session.save()
+        request._messages = FallbackStorage(request)
+
+        vm_success = _CountingList([{"device_id": 2}, {"device_id": 3}])
+
+        def _fetch(device_id, *a, **k):
+            # A minimal-but-realistic LibreNMS device so the REAL validate_device_for_import runs
+            # (unique serial/hostname → no existing match; empty hardware/os → no type/platform work).
+            return {
+                "device_id": device_id,
+                "hostname": f"host{device_id}",
+                "sysName": f"host{device_id}",
+                "serial": f"SN{device_id}",
+                "hardware": "",
+                "os": "",
+            }
+
+        # Mock ONLY genuine boundaries: the import process, the LibreNMS fetch, the template render,
+        # and the permission/background-job gates. validate_device_for_import, the cache and the
+        # request routing all run for real.
+        with (
+            patch.object(view, "require_write_permission", return_value=None),
+            patch.object(view, "should_use_background_job_for_import", return_value=False),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.bulk_import_devices",
+                return_value={"success": [{"device_id": 1}], "failed": [], "skipped": [], "virtual_chassis_created": 0},
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.bulk_import_vms",
+                return_value={"success": vm_success, "failed": [], "skipped": []},
+            ),
+            patch("netbox_librenms_plugin.views.imports.actions.fetch_device_with_cache", side_effect=_fetch),
+            patch("netbox_librenms_plugin.views.imports.actions.render") as mock_render,
+        ):
+            mock_render.return_value = MagicMock(content=b"<tr></tr>")
+            response = view.post(request)
+
+        assert response.status_code == 200
+
+        def _cached_is_vm(device_id):
+            cached = cache.get(get_import_device_cache_key(device_id, "default"))
+            return cached["_validation"]["import_as_vm"]
+
+        # The re-render loop classified each row correctly (read back from the REAL cache write).
+        assert _cached_is_vm(1) is False
+        assert _cached_is_vm(2) is True
+        assert _cached_is_vm(3) is True
+        # Perf: the VM-success ids are hoisted into a set once, so the list is NOT re-iterated per
+        # imported row. Old code rebuilt `[... for item in vm_result["success"]]` inside the loop
+        # (one iteration per row → 4 for these 3 rows); the set prefetch keeps it at 2.
+        assert vm_success.iter_count <= 2
+
+
+@pytest.mark.django_db
+class TestBulkImportConfirmPartialCacheExpiry:
+    """The confirm modal must surface partial cache-expiry: when some rows survive, the dropped-to-expired-cache count must still reach the template."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.imports.actions import BulkImportConfirmView
+
+        view = object.__new__(BulkImportConfirmView)
+        view._librenms_api = _make_api()
+        return view
+
+    def test_partial_cache_expiry_notice_rendered_with_survivors(self):
+        from django.contrib.auth import get_user_model
+        from django.test import RequestFactory
+
+        view = self._make_view()
+        User = get_user_model()
+        user = User.objects.create_user(username="u-confirm-expiry", password="x")
+
+        # Device 1 is still cached (survives into the confirm list); device 2's cache has expired.
+        survivor = {
+            "device_id": 1,
+            "hostname": "router01",
+            "sysName": "router01",
+            "serial": "SN-CONF-1",
+            "hardware": "",
+            "os": "",
+        }
+
+        def _fetch(device_id, *a, **k):
+            return survivor if device_id == 1 else None
+
+        request = RequestFactory().post("/device-import/bulk/confirm/", data={"select": ["1", "2"]})
+        request.user = user
+
+        # Mock only boundaries: the LibreNMS fetch, the VC-detection LibreNMS call, and the perm gate.
+        # validate_device_for_import and the bulk_import_confirm.html render run for real.
+        with (
+            patch.object(view, "require_write_permission", return_value=None),
+            patch("netbox_librenms_plugin.views.imports.actions.fetch_device_with_cache", side_effect=_fetch),
+            patch(
+                "netbox_librenms_plugin.import_utils.device_operations.get_virtual_chassis_data",
+                return_value={"is_stack": False, "member_count": 0, "members": []},
+            ),
+        ):
+            response = view.post(request)
+
+        # Partial expiry → 200 (survivors render), NOT the all-expired 400.
+        assert response.status_code == 200
+        html = response.content.decode("utf-8")
+        # The survivor renders AND the dropped-to-expired-cache row is surfaced (1 of 2).
+        assert "router01" in html
+        assert "1 of 2 selected device" in html
+        assert "expired cache data" in html
+
+
+class TestBuildIdServerInfoPaddedId:
+    """DeviceValidationDetailsView._build_id_server_info coerces ids with int() so ' 42 ' isn't dropped."""
+
+    def test_whitespace_padded_id_is_included(self):
+        """A device linked via {'prod': ' 42 '} appears in the per-server panel with id 42 (issue #99)."""
+        from types import SimpleNamespace
+
+        from django.test import override_settings
+
+        from netbox_librenms_plugin.views.imports.actions import DeviceValidationDetailsView
+
+        cfg = {"netbox_librenms_plugin": {"servers": {"prod": {"librenms_url": "http://p", "api_token": "t"}}}}
+        device = SimpleNamespace(custom_field_data={"librenms_id": {"prod": " 42 "}})
+        with override_settings(PLUGINS_CONFIG=cfg):
+            result = DeviceValidationDetailsView._build_id_server_info(device)
+
+        assert result is not None
+        prod = [row for row in result if row["server_key"] == "prod"]
+        assert prod and prod[0]["device_id"] == 42
+
+    def test_non_numeric_id_is_dropped(self):
+        """A non-numeric id is not a valid link and is excluded."""
+        from types import SimpleNamespace
+
+        from django.test import override_settings
+
+        from netbox_librenms_plugin.views.imports.actions import DeviceValidationDetailsView
+
+        cfg = {"netbox_librenms_plugin": {"servers": {"prod": {"librenms_url": "http://p", "api_token": "t"}}}}
+        device = SimpleNamespace(custom_field_data={"librenms_id": {"prod": "abc"}})
+        with override_settings(PLUGINS_CONFIG=cfg):
+            result = DeviceValidationDetailsView._build_id_server_info(device)
+
+        assert not result or all(row["server_key"] != "prod" for row in result)
+
+
+@pytest.mark.django_db
+class TestImportActionRebindGuard:
+    """Import-action views only rebind to a CONFIGURED posted server_key, so a stale key can't 500."""
+
+    def test_unconfigured_key_does_not_raise_keyerror(self):
+        """Posting an unconfigured server_key must not construct LibreNMSAPI(that_key) and KeyError-500."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.test import RequestFactory, override_settings
+
+        from netbox_librenms_plugin.views.imports.actions import BulkImportConfirmView
+
+        cfg = {"netbox_librenms_plugin": {"servers": {"default": {"librenms_url": "http://d", "api_token": "t"}}}}
+        view = object.__new__(BulkImportConfirmView)
+        view._librenms_api = None
+        request = RequestFactory().post("/import/confirm/", data={"server_key": "ghost-not-configured"})
+        request.user = AnonymousUser()
+        view.request = request
+
+        with override_settings(PLUGINS_CONFIG=cfg), patch.object(view, "has_write_permission", return_value=True):
+            response = view.post(request)
+
+        assert response.status_code != 500
diff --git a/netbox_librenms_plugin/tests/test_coverage_bulk_import.py b/netbox_librenms_plugin/tests/test_coverage_bulk_import.py
index 2c92406b7f..3f2645eb84 100644
--- a/netbox_librenms_plugin/tests/test_coverage_bulk_import.py
+++ b/netbox_librenms_plugin/tests/test_coverage_bulk_import.py
@@ -129,6 +129,15 @@ def test_delegates_to_shared_with_job_none(self):
 class TestBulkImportDevicesShared:
     """Tests for ``bulk_import_devices_shared``."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_norm_preload(self):
+        """bulk_import_devices_shared preloads device_type NormalizationRule once (issue #90); these are mock-based (no DB), so stub the preload to avoid real DB access."""
+        with patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        ):
+            yield
+
     # ------------------------------------------------------------------
     # Lines 129 & 140 – "else: logger.warning(...)" when job.logger=None
     # ------------------------------------------------------------------
@@ -942,7 +951,10 @@ def test_exception_during_refresh_logs_error(self):
             _refresh_existing_device(validation)  # must not raise
 
         mock_logger.error.assert_called_once()
-        assert "99" in mock_logger.error.call_args[0][0]
+        # Inspect every positional arg, not just the format string, so this still passes if the
+        # production call switches to parameterized logging (logger.error("... %s", pk)) — the
+        # id would then land in a separate arg (issue #98).
+        assert any("99" in str(a) for a in mock_logger.error.call_args.args)
 
     # ------------------------------------------------------------------
     # Line 373: no existing_device, no libre_device → early return
@@ -1054,13 +1066,12 @@ def test_exception_during_new_device_lookup_logs_error(self):
 
         mock_logger.error.assert_called()
 
-    def test_no_existing_device_non_numeric_librenms_id_skips_id_lookup(self):
-        """Non-numeric device_id raises ValueError → except pass, falls back to name."""
+    def test_no_existing_device_non_numeric_librenms_id_falls_back_to_name(self):
+        """Non-numeric device_id yields no id match → falls back to resolved_name."""
         from netbox_librenms_plugin.import_utils.bulk_import import _refresh_existing_device
 
         new_device = MagicMock()
         new_device.role = None
-        # Non-numeric device_id triggers ValueError inside int() → except (ValueError, TypeError): pass
         libre_device = {"device_id": "not-an-int", "hostname": "sw05", "sysName": "sw05"}
 
         validation = {
@@ -1071,17 +1082,18 @@ def test_no_existing_device_non_numeric_librenms_id_skips_id_lookup(self):
 
         with (
             patch("dcim.models.Device") as mock_Device,
-            patch("netbox_librenms_plugin.import_utils.bulk_import.find_by_librenms_id") as mock_find,
+            # find_by_librenms_id returns None for a non-numeric id (its real contract), so the
+            # id lookup misses and the flow falls back to the resolved_name match.
+            patch(
+                "netbox_librenms_plugin.import_utils.bulk_import.find_by_librenms_id",
+                return_value=None,
+            ),
         ):
             mock_Device.objects.filter.return_value.first.return_value = new_device
             _refresh_existing_device(validation, libre_device=libre_device, server_key="default")
 
-        # Should find via resolved_name (librenms_id lookup was skipped due to ValueError)
         assert validation["existing_device"] is new_device
         assert validation["existing_match_type"] == "resolved_name"
-        # Crucially: find_by_librenms_id must never have been called — int("not-an-int")
-        # raises ValueError before the call site is reached.
-        mock_find.assert_not_called()
 
     def test_no_existing_device_hostname_fallback(self):
         """existing=None, not found by id or resolved_name → hostname fallback."""
@@ -2302,6 +2314,37 @@ def test_vm_found_when_device_imported_as_vm(self):
         assert validation["can_import"] is False
         assert validation["is_ready"] is False
 
+    def test_id_match_in_cross_model_wins_over_name_in_preferred_model(self):
+        """When the scanned LibreNMS id is linked to the cross model (VM) while the preferred model (Device) merely shares the name, the id-linked object must win — binding the name-colliding Device would disagree with validation and render actions for the wrong object."""
+        from netbox_librenms_plugin.import_utils.bulk_import import _refresh_existing_device
+
+        validation = _make_validation(import_as_vm=False)  # Model=Device, CrossModel=VM
+        validation["existing_device"] = None
+        libre_device = {"device_id": 99, "hostname": "shared-name", "sysName": "shared-name"}
+
+        mock_vm = MagicMock()
+        mock_vm.role = None  # the id-linked VM
+        mock_device = MagicMock()
+        mock_device.role = MagicMock()  # a Device that merely shares the name
+
+        with (
+            patch("netbox_librenms_plugin.import_utils.bulk_import.find_by_librenms_id") as fbi,
+            patch("dcim.models.Device") as mock_dev_cls,
+            patch("virtualization.models.VirtualMachine") as mock_vm_cls,
+        ):
+            # id 99 is linked to the VM (cross model), not the Device (preferred model).
+            fbi.side_effect = lambda m, lid, sk: mock_vm if m is mock_vm_cls else None
+            # The Device shares the name → a name fallback would (wrongly) match it.
+            mock_dev_cls.objects.filter.return_value.first.return_value = mock_device
+            mock_vm_cls.objects.filter.return_value.first.return_value = None
+
+            _refresh_existing_device(validation, libre_device, server_key="default")
+
+        # The id-linked VM wins across models, not the name-colliding Device.
+        assert validation["existing_device"] is mock_vm
+        assert validation["existing_match_type"] == "librenms_id"
+        assert validation["import_as_vm"] is True  # cross-model → flipped
+
     def test_device_found_when_vm_imported_as_device(self):
         """
         import_as_vm=True but the object was imported as a Device.
diff --git a/netbox_librenms_plugin/tests/test_coverage_device_operations.py b/netbox_librenms_plugin/tests/test_coverage_device_operations.py
index 22b5c86fe9..fe97490217 100644
--- a/netbox_librenms_plugin/tests/test_coverage_device_operations.py
+++ b/netbox_librenms_plugin/tests/test_coverage_device_operations.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 class TestTryChassisDeviceTypeMatch:
     """Tests for _try_chassis_device_type_match (lines 45-65)."""
@@ -78,7 +80,8 @@ def test_fallback_to_model_name_when_name_not_matched(self):
 
         call_count = [0]
 
-        def match_side_effect(value):
+        def match_side_effect(value, **kwargs):
+            # **kwargs accepts the preloaded_rules the chassis fallback now threads through (#90 N+1).
             call_count[0] += 1
             if value == "Unrecognized":
                 return {"matched": False}
@@ -862,6 +865,67 @@ def test_vm_with_legacy_librenms_id_flags_migration(self):
         assert result.get("existing_device") is existing_vm
         assert result.get("librenms_id_needs_migration") is True
 
+    def test_vm_whitespace_padded_legacy_id_flags_migration(self):
+        """A whitespace-padded legacy id (' 42 ') is detected via the shared int-coercion helper, not the stricter isdigit()."""
+        from netbox_librenms_plugin.import_utils.device_operations import validate_device_for_import
+
+        libre_device = {
+            "device_id": 42,
+            "hostname": "vm01",
+            "sysName": "vm01",
+            "hardware": "-",
+            "serial": "-",
+            "os": "-",
+            "location": "-",
+        }
+        api = self._make_api()
+
+        existing_vm = MagicMock()
+        existing_vm.name = "vm01"
+        existing_vm.serial = ""
+        existing_vm.custom_field_data = {"librenms_id": " 42 "}  # legacy, whitespace-padded → isdigit() is False
+
+        patches, _ = self._start_patches()
+        try:
+            with patch("netbox_librenms_plugin.import_utils.device_operations.find_by_librenms_id") as mock_find:
+                mock_find.side_effect = [existing_vm, None]  # VM found, then no Device
+                result = validate_device_for_import(libre_device, import_as_vm=True, api=api)
+        finally:
+            self._stop_patches(patches)
+
+        assert result.get("librenms_id_needs_migration") is True
+
+    def test_device_whitespace_padded_legacy_id_flags_migration(self):
+        """The Device branch also uses the shared helper, so a padded legacy id flags migration consistently with the VM branch."""
+        from netbox_librenms_plugin.import_utils.device_operations import validate_device_for_import
+
+        libre_device = {
+            "device_id": 42,
+            "hostname": "sw01",
+            "sysName": "sw01",
+            "hardware": "-",
+            "serial": "-",
+            "os": "-",
+            "location": "-",
+        }
+        api = self._make_api()
+
+        existing_device = MagicMock()
+        existing_device.name = "sw01"
+        existing_device.serial = ""
+        existing_device.virtual_chassis = None
+        existing_device.custom_field_data = {"librenms_id": " 42 "}  # legacy, whitespace-padded
+
+        patches, _ = self._start_patches()
+        try:
+            with patch("netbox_librenms_plugin.import_utils.device_operations.find_by_librenms_id") as mock_find:
+                mock_find.side_effect = [None, existing_device]  # no VM, then Device found
+                result = validate_device_for_import(libre_device, api=api)
+        finally:
+            self._stop_patches(patches)
+
+        assert result.get("librenms_id_needs_migration") is True
+
     def test_vc_detection_called_for_device_with_api(self):
         """Lines 616-638: VC detection executed when include_vc_detection=True and api provided."""
         from netbox_librenms_plugin.import_utils.device_operations import validate_device_for_import
@@ -1679,3 +1743,138 @@ def test_chassis_match_overrides_hardware_match(self):
             device_patch.stop()
 
         assert result["device_type"].get("device_type") is chassis_dt
+
+
+@pytest.mark.django_db
+class TestValidateForcesDeviceModeRealDB:
+    """A Device match must force import_as_vm=False even when VM mode was selected (real DB)."""
+
+    def _api(self):
+        api = MagicMock()
+        api.server_key = "default"
+        api.cache_timeout = 300
+        api.get_device_info.return_value = (True, {"device_id": 50})
+        return api
+
+    def _make_device(self, name, librenms_cf=None):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="ACME-114d", slug="acme-114d")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-114d", slug="dt-114d")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-114d", slug="role-114d")
+        site, _ = Site.objects.get_or_create(name="Site-114d", slug="site-114d")
+        cf = {"librenms_id": librenms_cf} if librenms_cf else {}
+        return Device.objects.create(
+            name=name, device_type=dt, role=role, site=site, status="active", custom_field_data=cf
+        )
+
+    def test_librenms_id_device_match_forces_device_mode(self):
+        """A librenms_id Device match flips a user-selected VM mode back to Device mode."""
+        from netbox_librenms_plugin.import_utils.device_operations import validate_device_for_import
+
+        device = self._make_device("force-dev-mode", librenms_cf={"default": 50})
+        libre_device = {
+            "device_id": 50,
+            "hostname": "force-dev-mode",
+            "sysName": "force-dev-mode",
+            "serial": "-",
+            "hardware": "-",
+            "os": "-",
+            "location": "-",
+        }
+
+        result = validate_device_for_import(
+            libre_device, import_as_vm=True, api=self._api(), include_vc_detection=False
+        )
+
+        assert result["existing_match_type"] == "librenms_id"
+        assert result["existing_device"].pk == device.pk
+        assert result["import_as_vm"] is False
+
+    def test_hostname_device_match_forces_device_mode(self):
+        """A hostname Device match (no librenms_id) also flips selected VM mode back to Device mode."""
+        from netbox_librenms_plugin.import_utils.device_operations import validate_device_for_import
+
+        device = self._make_device("force-dev-host")
+        libre_device = {
+            "device_id": 777,
+            "hostname": "force-dev-host",
+            "sysName": "force-dev-host",
+            "serial": "-",
+            "hardware": "-",
+            "os": "-",
+            "location": "-",
+        }
+
+        result = validate_device_for_import(
+            libre_device, import_as_vm=True, api=self._api(), include_vc_detection=False
+        )
+
+        assert result["existing_match_type"] == "hostname"
+        assert result["existing_device"].pk == device.pk
+        assert result["import_as_vm"] is False
+
+
+@pytest.mark.django_db
+class TestImportFallbackReadsLive:
+    """Import fallbacks read LibreNMS live (use_cache=False) rather than the 60s get_device_info snapshot."""
+
+    def _seed_stale(self, server_key="default", device_id=4242):
+        from django.core.cache import cache
+
+        cache.set(
+            f"librenms_device_info_{server_key}_{device_id}",
+            (True, {"hostname": "STALE-HOST", "device_id": device_id}),
+            60,
+        )
+
+    def test_get_librenms_device_by_id_bypasses_stale_cache(self):
+        """use_cache=False skips the seeded snapshot and does a (here-failing) live fetch."""
+        from django.test import override_settings
+        from requests.exceptions import ConnectionError as RequestsConnectionError
+
+        from netbox_librenms_plugin.import_utils.device_operations import get_librenms_device_by_id
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        cfg = {"netbox_librenms_plugin": {"servers": {"default": {"librenms_url": "http://d", "api_token": "t"}}}}
+        # Mock the live HTTP boundary instead of relying on a real request to "http://d" failing:
+        # a real call is non-deterministic and slow (DNS/timeout, and behind a proxy it can 503 or
+        # hang rather than refuse). RequestsConnectionError subclasses requests.RequestException, so
+        # get_device_info's `except requests.exceptions.RequestException` catches it → (False, ...).
+        with (
+            override_settings(PLUGINS_CONFIG=cfg),
+            patch(
+                "netbox_librenms_plugin.librenms_api.requests.get",
+                side_effect=RequestsConnectionError("offline"),
+            ),
+        ):
+            self._seed_stale()
+            api = LibreNMSAPI(server_key="default")
+            # Positive control: the cache IS populated and use_cache=True returns the stale snapshot.
+            assert get_librenms_device_by_id(api, 4242, use_cache=True)["hostname"] == "STALE-HOST"
+            # The fix: the import fallback reads live, so it does NOT serve the stale snapshot; the
+            # live HTTP call fails in-test (mocked offline) -> None, proving the cache was bypassed.
+            assert get_librenms_device_by_id(api, 4242, use_cache=False) is None
+
+    def test_import_single_device_does_not_build_from_stale_snapshot(self):
+        """import_single_device's None-branch fallback reads live, so a stale snapshot can't seed a device."""
+        from django.test import override_settings
+        from requests.exceptions import ConnectionError as RequestsConnectionError
+
+        from netbox_librenms_plugin.import_utils.device_operations import import_single_device
+
+        cfg = {"netbox_librenms_plugin": {"servers": {"default": {"librenms_url": "http://d", "api_token": "t"}}}}
+        # Mock the live HTTP boundary (see the sibling test): deterministic offline failure instead of
+        # depending on a real request to "http://d" refusing.
+        with (
+            override_settings(PLUGINS_CONFIG=cfg),
+            patch(
+                "netbox_librenms_plugin.librenms_api.requests.get",
+                side_effect=RequestsConnectionError("offline"),
+            ),
+        ):
+            self._seed_stale()
+            result = import_single_device(4242, server_key="default", libre_device=None)
+
+        assert result["success"] is False
+        assert "retrieve" in (result.get("error") or "").lower()
diff --git a/netbox_librenms_plugin/tests/test_coverage_devices.py b/netbox_librenms_plugin/tests/test_coverage_devices.py
index dc5ed98b3e..2e285c3f44 100644
--- a/netbox_librenms_plugin/tests/test_coverage_devices.py
+++ b/netbox_librenms_plugin/tests/test_coverage_devices.py
@@ -2,6 +2,19 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
+
+def _make_real_device(tag):
+    """Create and return a real NetBox Device (with its required FKs) for DB-backed tests."""
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-{tag}", slug=f"mfr-{tag}")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-{tag}", slug=f"dt-{tag}")
+    role, _ = DeviceRole.objects.get_or_create(name=f"Role-{tag}", slug=f"role-{tag}")
+    site, _ = Site.objects.get_or_create(name=f"Site-{tag}", slug=f"site-{tag}")
+    return Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
+
 
 def _make_device_view():
     """Create a DeviceLibreNMSSyncView instance bypassing __init__."""
@@ -231,6 +244,9 @@ def _make_view(self):
         view = object.__new__(SingleInterfaceVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate here; the dedicated perm test overrides it. Mirrors the other verify-view harnesses.
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
     def test_returns_400_when_no_device_id(self):
@@ -247,6 +263,27 @@ def test_returns_400_when_no_device_id(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    def test_checks_permission_before_resolving_device(self):
+        """The object-view gate must run BEFORE get_object_or_404 so an unauthorized caller can't probe arbitrary device IDs (existence via 404). Exercises the REAL require_object_permissions_json (only request.user.has_perm is mocked) — mocking the gate itself would mask a missing NetBoxObjectPermissionMixin base (AttributeError/500 in production)."""
+        import json
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
+        view = object.__new__(SingleInterfaceVerifyView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 999, "interface_name": "eth0"}).encode()
+        request.user.has_perm.return_value = False  # unauthorized → real gate returns 403
+        view.request = request  # check_object_permissions reads self.request.user
+
+        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
+            response = view.post(request)
+
+        assert response.status_code == 403
+        mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
+
     def test_returns_404_when_no_cached_data(self):
         """Returns 404 when cached ports data not found."""
         import json
@@ -389,6 +426,27 @@ def _make_view(self):
         view.get_cache_key = MagicMock(return_value="test_key")
         return view
 
+    def test_checks_permission_before_resolving_device(self):
+        """The object-view gate must run BEFORE get_object_or_404 so an unauthorized caller can't probe arbitrary device IDs (existence via 404). Exercises the real require_object_permissions_json (only request.user.has_perm is mocked)."""
+        import json
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.object_sync.devices import SingleModuleVerifyView
+
+        view = object.__new__(SingleModuleVerifyView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 999, "ent_physical_index": 10}).encode()
+        request.user.has_perm.return_value = False  # unauthorized → real gate returns 403
+        view.request = request  # check_object_permissions reads self.request.user
+
+        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
+            response = view.post(request)
+
+        assert response.status_code == 403
+        mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
+
     def test_success_propagates_can_change_interface_to_verify_table(self):
         """Verify-row table keeps Update Interface available for users with change permission."""
         import json
@@ -486,8 +544,32 @@ def _make_view(self):
         view = object.__new__(SingleVlanGroupVerifyView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate here; the dedicated perm test exercises the real gate. Mirrors the other harnesses.
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
+    def test_checks_permission_before_resolving_device(self):
+        """The object-view gate must run BEFORE get_object_or_404 so an unauthorized caller can't probe arbitrary device IDs (existence via 404). Exercises the real require_object_permissions_json (only request.user.has_perm is mocked)."""
+        import json
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.object_sync.devices import SingleVlanGroupVerifyView
+
+        view = object.__new__(SingleVlanGroupVerifyView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 999, "vid": "100"}).encode()
+        request.user.has_perm.return_value = False  # unauthorized → real gate returns 403
+        view.request = request
+
+        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
+            response = view.post(request)
+
+        assert response.status_code == 403
+        mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
+
     def test_returns_400_when_no_device_id(self):
         """Returns 400 when no device_id provided."""
         import json
@@ -533,174 +615,84 @@ def test_returns_400_when_invalid_vid(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
     def test_returns_success_with_vlan_group(self):
-        """Returns success with css_class when valid vlan_group_id provided."""
+        """A VID present in the selected group is reported not-missing — real Device/Interface/VLAN/VLANGroup, no mocks."""
         import json
 
+        from dcim.models import Interface
         from django.http import JsonResponse
+        from ipam.models import VLAN, VLANGroup
+
+        device = _make_real_device("vg-with")
+        Interface.objects.create(device=device, name="eth0", type="1000base-t")
+        group = VLANGroup.objects.create(name="Grp-vg-with", slug="grp-vg-with")
+        VLAN.objects.create(vid=10, name="ten", group=group)
 
         view = self._make_view()
         request = MagicMock()
         request.body = json.dumps(
-            {
-                "device_id": 1,
-                "vid": "10",
-                "vlan_group_id": "5",
-                "vlan_type": "U",
-            }
+            {"device_id": device.pk, "interface_name": "eth0", "vid": "10", "vlan_group_id": group.pk, "vlan_type": "U"}
         ).encode()
-
-        mock_device = MagicMock()
-        mock_netbox_iface = MagicMock()
-        mock_netbox_iface.untagged_vlan = None
-        mock_netbox_iface.tagged_vlans.all.return_value = []
-        mock_device.interfaces.filter.return_value.first.return_value = mock_netbox_iface
-
-        mock_vlan_group = MagicMock()
-        mock_vlan_qs = MagicMock()
-        mock_vlan_qs.values_list.return_value = [10]
-        mock_global_qs = MagicMock()
-        mock_global_qs.values_list.return_value = []
-
-        mock_vlan_model = MagicMock()
-        mock_vlan_model.objects.filter.return_value = mock_vlan_qs
-        mock_vlan_group_model = MagicMock()
-        mock_vlan_group_model.objects.filter.return_value = mock_global_qs
-
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
-            mock_get_obj.side_effect = [mock_device, mock_vlan_group]
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_untagged_vlan_css_class",
-                return_value="text-success",
-            ):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_tagged_vlan_css_class",
-                    return_value="text-success",
-                ):
-                    with patch(
-                        "netbox_librenms_plugin.views.object_sync.devices.get_missing_vlan_warning", return_value=""
-                    ):
-                        # Patch the VLAN/VLANGroup imports inside the method
-                        mock_ipam = MagicMock()
-                        mock_ipam.VLAN = mock_vlan_model
-                        mock_ipam.VLANGroup = mock_vlan_group_model
-
-                        with patch.dict("sys.modules", {"ipam.models": mock_ipam}):
-                            response = view.post(request)
+        response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
         data = json.loads(response.content)
         assert data["status"] == "success"
-        assert data["css_class"] == "text-success"
-        assert data["is_missing"] is False
+        assert data["is_missing"] is False  # vid 10 exists in the selected group
+        assert data["css_class"]  # a real CSS class was computed
 
+    @pytest.mark.django_db
     def test_returns_success_without_vlan_group(self):
-        """Returns success with global VLANs when no vlan_group_id provided."""
+        """With no group selected and no global VLANs, the VID is reported missing — real DB, no mocks."""
         import json
 
         from django.http import JsonResponse
 
+        device = _make_real_device("vg-without")
+
         view = self._make_view()
         request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "vid": "100",
-                "vlan_type": "T",
-            }
-        ).encode()
-
-        mock_device = MagicMock()
-        mock_device.interfaces.filter.return_value.first.return_value = None
-
-        mock_vlan_qs = MagicMock()
-        mock_vlan_qs.values_list.return_value = []
-        mock_vlan_model = MagicMock()
-        mock_vlan_model.objects.filter.return_value = mock_vlan_qs
-
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_untagged_vlan_css_class",
-                return_value="text-danger",
-            ):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_tagged_vlan_css_class",
-                    return_value="text-danger",
-                ):
-                    with patch(
-                        "netbox_librenms_plugin.views.object_sync.devices.get_missing_vlan_warning", return_value=""
-                    ):
-                        mock_ipam = MagicMock()
-                        mock_ipam.VLAN = mock_vlan_model
-                        mock_ipam.VLANGroup = MagicMock()
-
-                        with patch.dict("sys.modules", {"ipam.models": mock_ipam}):
-                            response = view.post(request)
+        request.body = json.dumps({"device_id": device.pk, "vid": "100", "vlan_type": "T"}).encode()
+        response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
         data = json.loads(response.content)
         assert data["status"] == "success"
-        assert data["css_class"] == "text-danger"
-        assert data["is_missing"] is True  # vid=100 not in empty group VID list
+        assert data["is_missing"] is True  # vid 100 not present in any global VLAN
 
+    @pytest.mark.django_db
     def test_existing_interface_with_untagged_and_tagged_vlans(self):
-        """Covers NetBox VLAN extraction branches for untagged and tagged VLANs."""
+        """The NetBox untagged + tagged VLAN assignments are read off a real interface (no mocks)."""
         import json
 
+        from dcim.models import Interface
         from django.http import JsonResponse
+        from ipam.models import VLAN, VLANGroup
+
+        device = _make_real_device("vg-iface")
+        group = VLANGroup.objects.create(name="Grp-vg-iface", slug="grp-vg-iface")
+        untagged = VLAN.objects.create(vid=1, name="native", group=group)
+        tagged = VLAN.objects.create(vid=10, name="ten", group=group)
+        iface = Interface.objects.create(device=device, name="eth0", type="1000base-t", mode="tagged")
+        iface.untagged_vlan = untagged
+        iface.save()
+        iface.tagged_vlans.add(tagged)
 
         view = self._make_view()
         request = MagicMock()
         request.body = json.dumps(
-            {
-                "device_id": 1,
-                "vid": "10",
-                "vlan_group_id": "5",
-                "vlan_type": "T",
-                "interface_name": "eth0",
-            }
+            {"device_id": device.pk, "vid": "10", "vlan_group_id": group.pk, "vlan_type": "T", "interface_name": "eth0"}
         ).encode()
-
-        untagged = MagicMock()
-        untagged.vid = 1
-        untagged.group_id = 9
-        tagged = MagicMock()
-        tagged.vid = 10
-        tagged.group_id = 5
-
-        mock_iface = MagicMock()
-        mock_iface.untagged_vlan = untagged
-        mock_iface.tagged_vlans.all.return_value = [tagged]
-        mock_device = MagicMock()
-        mock_device.interfaces.filter.return_value.first.return_value = mock_iface
-
-        mock_vlan_group = MagicMock()
-        mock_group_qs = MagicMock()
-        mock_group_qs.values_list.return_value = [10]
-        mock_global_qs = MagicMock()
-        mock_global_qs.values_list.return_value = []
-        mock_vlan_model = MagicMock()
-        mock_vlan_model.objects.filter.side_effect = [mock_group_qs, mock_global_qs]
-
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
-            mock_get_obj.side_effect = [mock_device, mock_vlan_group]
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_tagged_vlan_css_class",
-                return_value="text-success",
-            ):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_missing_vlan_warning", return_value=""
-                ):
-                    mock_ipam = MagicMock()
-                    mock_ipam.VLAN = mock_vlan_model
-                    mock_ipam.VLANGroup = MagicMock()
-                    with patch.dict("sys.modules", {"ipam.models": mock_ipam}):
-                        response = view.post(request)
+        response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
+        data = json.loads(response.content)
+        assert data["status"] == "success"
+        assert data["is_missing"] is False  # tagged vid 10 exists in the selected group
 
     def test_render_vlans_cell_returns_dash_for_empty_values(self):
         """Empty VLAN inputs render em dash placeholder."""
@@ -717,8 +709,32 @@ def _make_view(self):
         view = object.__new__(VerifyVlanSyncGroupView)
         view._librenms_api = MagicMock()
         view._librenms_api.server_key = "default"
+        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
+        # gate here; the dedicated perm test exercises the real gate. Mirrors the other harnesses.
+        view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
+    def test_checks_permission_before_resolving_group(self):
+        """The object-view gate (on VLAN — no device here) must run BEFORE get_object_or_404 so an unauthorized caller can't enumerate VLANs/groups (existence via 404). Exercises the real require_object_permissions_json (only request.user.has_perm is mocked)."""
+        import json
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.object_sync.devices import VerifyVlanSyncGroupView
+
+        view = object.__new__(VerifyVlanSyncGroupView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = MagicMock()
+        request.body = json.dumps({"vlan_group_id": 5, "vid": "100"}).encode()
+        request.user.has_perm.return_value = False  # unauthorized → real gate returns 403
+        view.request = request
+
+        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
+            response = view.post(request)
+
+        assert response.status_code == 403
+        mock_get_obj.assert_not_called()  # group never resolved → no enumeration
+
     def test_returns_400_when_no_vid(self):
         """Returns 400 when no vid provided."""
         import json
@@ -747,43 +763,33 @@ def test_returns_400_when_invalid_vid(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
     def test_returns_success_with_vlan_group(self):
-        """Returns success with exists_in_netbox and css_class for vlan_group_id path."""
+        """A VLAN that exists in the selected group with a matching name reports exists_in_netbox — real DB, no mocks."""
         import json
 
         from django.http import JsonResponse
+        from ipam.models import VLAN, VLANGroup
+
+        group = VLANGroup.objects.create(name="Grp-sync-with", slug="grp-sync-with")
+        VLAN.objects.create(vid=10, name="vlan10", group=group)
 
         view = self._make_view()
         request = MagicMock()
-        request.body = json.dumps({"vid": "10", "vlan_group_id": "3", "name": "vlan10"}).encode()
-
-        mock_vlan = MagicMock()
-        mock_vlan.name = "vlan10"
-        mock_vlan_group = MagicMock()
-
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404") as mock_get_obj:
-            mock_get_obj.return_value = mock_vlan_group
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_vlan_sync_css_class", return_value="text-success"
-            ):
-                mock_ipam = MagicMock()
-                mock_vlan_model = MagicMock()
-                mock_vlan_model.objects.filter.return_value.first.return_value = mock_vlan
-                mock_ipam.VLAN = mock_vlan_model
-                mock_ipam.VLANGroup = MagicMock()
-
-                with patch.dict("sys.modules", {"ipam.models": mock_ipam}):
-                    response = view.post(request)
+        request.body = json.dumps({"vid": "10", "vlan_group_id": group.pk, "name": "vlan10"}).encode()
+        response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         data = json.loads(response.content)
         assert response.status_code == 200
         assert data["status"] == "success"
-        assert "exists_in_netbox" in data
-        assert data["css_class"] == "text-success"
+        assert data["exists_in_netbox"] is True
+        assert data["name_matches"] is True
+        assert data["css_class"]  # a real CSS class was computed
 
+    @pytest.mark.django_db
     def test_returns_success_without_vlan_group(self):
-        """Returns success with global VLAN lookup when no vlan_group_id."""
+        """With no group and no matching global VLAN, exists_in_netbox is False — real DB, no mocks."""
         import json
 
         from django.http import JsonResponse
@@ -791,25 +797,14 @@ def test_returns_success_without_vlan_group(self):
         view = self._make_view()
         request = MagicMock()
         request.body = json.dumps({"vid": "20", "name": "vlan20"}).encode()
-
-        with patch(
-            "netbox_librenms_plugin.views.object_sync.devices.get_vlan_sync_css_class", return_value="text-danger"
-        ):
-            mock_ipam = MagicMock()
-            mock_vlan_model = MagicMock()
-            mock_vlan_model.objects.filter.return_value.first.return_value = None
-            mock_ipam.VLAN = mock_vlan_model
-            mock_ipam.VLANGroup = MagicMock()
-
-            with patch.dict("sys.modules", {"ipam.models": mock_ipam}):
-                response = view.post(request)
+        response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         data = json.loads(response.content)
         assert response.status_code == 200
         assert data["status"] == "success"
         assert data["exists_in_netbox"] is False
-        assert data["css_class"] == "text-danger"
+        assert data["css_class"]  # a real CSS class was computed
 
 
 class TestSaveVlanGroupOverridesView:
@@ -879,6 +874,36 @@ def test_returns_error_when_no_cached_ports(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    def test_post_does_not_500_on_cache_backend_without_ttl(self):
+        """A cache backend without .ttl() (e.g. the default LocMemCache) must degrade gracefully, not AttributeError-500."""
+        import json
+        from django.core.cache.backends.locmem import LocMemCache
+        from django.http import JsonResponse
+
+        view = self._make_view()
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 1, "vid_group_map": {"10": "5"}, "server_key": "default"}).encode()
+        mock_device = MagicMock()
+        # A REAL LocMemCache genuinely has no .ttl() — unlike the MagicMock cache other tests use,
+        # which fabricates one and so masks this exact AttributeError.
+        real_locmem = LocMemCache("test-no-ttl", {})
+
+        with (
+            patch.object(view, "require_write_permission_json", return_value=None),
+            patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device),
+            patch(
+                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device",
+                return_value=mock_device,
+            ),
+            patch("netbox_librenms_plugin.views.object_sync.devices.cache", real_locmem),
+            patch.object(view, "get_cache_key", return_value="ports_key"),
+        ):
+            response = view.post(request)  # must not raise AttributeError
+
+        # No ttl available → treated as "no cached ports" → graceful 400, never a 500.
+        assert isinstance(response, JsonResponse)
+        assert response.status_code == 400
+
     def test_saves_overrides_to_cache(self):
         """Successfully saves VLAN group overrides to cache."""
         import json
diff --git a/netbox_librenms_plugin/tests/test_import_utils.py b/netbox_librenms_plugin/tests/test_import_utils.py
index f7d8620c01..d0031d3023 100644
--- a/netbox_librenms_plugin/tests/test_import_utils.py
+++ b/netbox_librenms_plugin/tests/test_import_utils.py
@@ -7,6 +7,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 # =============================================================================
 # TestCacheKeyGeneration - 4 tests
 # =============================================================================
@@ -1622,6 +1624,56 @@ def test_name_matches_exact_without_vc(self):
         assert result["name_sync_available"] is False
 
 
+@pytest.mark.django_db
+class TestSerialNumberMatchingRealDB:
+    """Real-DB coverage for the serial-match path (issue #101): serial is not unique in NetBox, so the match must run against real rows."""
+
+    @staticmethod
+    def _make_device(name, serial):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="ACME-101", slug="acme-101")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-101", slug="dt-101")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-101", slug="role-101")
+        site, _ = Site.objects.get_or_create(name="Site-101", slug="site-101")
+        return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active", serial=serial)
+
+    def test_duplicate_serials_block_import(self):
+        """Two real devices share the incoming serial → no arbitrary bind AND the row is blocked from import."""
+        from netbox_librenms_plugin.import_utils import validate_device_for_import
+
+        self._make_device("dup-a-101", "DUP123")
+        self._make_device("dup-b-101", "DUP123")
+
+        result = validate_device_for_import(
+            # device_id matches no NetBox librenms_id, so the flow reaches the serial block.
+            {"device_id": 99999, "hostname": "new-host-101", "serial": "DUP123"},
+            include_vc_detection=False,
+        )
+
+        assert result["existing_device"] is None
+        assert result.get("existing_match_type") != "serial"
+        # Ambiguity is a blocking issue, not a mere warning: importing anyway would mint a THIRD
+        # device with the same serial.
+        assert any("share serial" in i for i in result["issues"])
+        assert result["serial_duplicate"] is True
+        assert result["can_import"] is False
+
+    def test_unique_serial_still_binds(self):
+        """A single device with the serial still binds via the serial path (guards against the unique guard over-rejecting)."""
+        from netbox_librenms_plugin.import_utils import validate_device_for_import
+
+        dev = self._make_device("solo-101", "SOLO123")
+
+        result = validate_device_for_import(
+            {"device_id": 99998, "hostname": "new-host-101b", "serial": "SOLO123"},
+            include_vc_detection=False,
+        )
+
+        assert result["existing_device"] == dev
+        assert result["existing_match_type"] == "serial"
+
+
 class TestSerialNumberMatching:
     """Test serial number matching in device validation."""
 
@@ -1679,6 +1731,11 @@ def test_serial_match_blocks_import(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1706,6 +1763,11 @@ def test_serial_match_same_hostname_offers_link(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1733,6 +1795,11 @@ def test_serial_match_diff_hostname_offers_hostname_differs(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1760,6 +1827,11 @@ def test_hostname_match_diff_serial_offers_update(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "name__iexact" in kwargs:
                 result.first.return_value = existing
             elif "serial" in kwargs:
@@ -1840,6 +1912,11 @@ def test_hostname_match_serial_conflict_warns(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "name__iexact" in kwargs:
                 result.first.return_value = hostname_device
             elif "serial" in kwargs:
@@ -1871,6 +1948,11 @@ def test_librenms_id_match_shows_serial_confirmed(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -1915,6 +1997,11 @@ def test_librenms_id_match_detects_serial_drift(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -1961,6 +2048,11 @@ def test_librenms_id_match_still_validates_site(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -2008,6 +2100,11 @@ def test_existing_device_role_populated(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2061,6 +2158,11 @@ def test_device_type_mismatch_flagged(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2112,6 +2214,11 @@ def test_no_device_type_mismatch_when_types_match(self):
 
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2204,6 +2311,11 @@ def _make_existing(self, name, serial="SN001", virtual_chassis=None, vc_position
     def _setup_librenms_id_filter(self, existing):
         def device_filter(*args, **kwargs):
             result = MagicMock()
+            # Support the unique-serial guard's [:2] slice: derive the slice from the
+            # .first() stub so a single match -> [match], no match -> [] (issue #101).
+            result.__getitem__.side_effect = lambda _s: (
+                [result.first.return_value] if result.first.return_value is not None else []
+            )
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -2544,6 +2656,41 @@ def test_migrate_legacy_librenms_id_noop_for_none(self):
 
         assert result is False
 
+    def test_migrate_legacy_librenms_id_whitespace_padded_string_migrates(self):
+        """A whitespace-padded ' 42 ' migrates (issue #99): the writer must accept what the gate does."""
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import migrate_legacy_librenms_id
+
+        obj = SimpleNamespace(custom_field_data={"librenms_id": " 42 "})
+        result = migrate_legacy_librenms_id(obj, "primary")
+
+        assert result is True
+        assert obj.custom_field_data["librenms_id"] == {"primary": 42}
+
+    def test_migrate_gate_and_writer_agree_on_padded_id(self):
+        """The Convert-ID gate (is_legacy) and the writer (migrate) must not disagree on ' 42 '."""
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import is_legacy_librenms_id, migrate_legacy_librenms_id
+
+        # The gate reports ' 42 ' as legacy, so the UI offers the Convert-ID button...
+        assert is_legacy_librenms_id(" 42 ") is True
+        # ...and the writer must actually migrate it, not dead-end with "could not be converted".
+        obj = SimpleNamespace(custom_field_data={"librenms_id": " 42 "})
+        assert migrate_legacy_librenms_id(obj, "primary") is True
+        assert obj.custom_field_data["librenms_id"] == {"primary": 42}
+
+    def test_migrate_legacy_librenms_id_non_numeric_string_noop(self):
+        """A non-numeric string is not a legacy id and must not migrate (matches the gate)."""
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import migrate_legacy_librenms_id
+
+        obj = SimpleNamespace(custom_field_data={"librenms_id": "abc"})
+        assert migrate_legacy_librenms_id(obj, "primary") is False
+        assert obj.custom_field_data["librenms_id"] == "abc"
+
 
 class TestDeviceConflictActionView:
     """Test DeviceConflictActionView conflict resolution actions."""
@@ -3581,6 +3728,16 @@ def test_backward_compatible_defaults(self, *mocks):
 class TestProcessDeviceFilters:
     """Tests for process_device_filters and related bulk_import utilities."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_norm_preload(self):
+        # bulk_import_devices_shared preloads device_type NormalizationRule once (issue #90);
+        # these are mock-based (no DB), so stub the preload to avoid real DB access.
+        with patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        ):
+            yield
+
     def test_show_disabled_filters_integer_disabled_1(self):
         """show_disabled=False should exclude devices with disabled==1 (int)."""
         from unittest.mock import MagicMock, patch
@@ -4786,6 +4943,14 @@ def test_no_op_when_counter_matches(self):
 class TestBulkImportCancellation:
     """Test that bulk_import_devices_shared respects RQ and DB cancellation."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_norm_preload(self):
+        with patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        ):
+            yield
+
     def _run_bulk_import(self, mock_rq_job=None, db_status="running", device_ids=None):
         """Helper: run bulk_import with provided mocks, return import call count."""
         from unittest.mock import MagicMock, patch
@@ -4882,6 +5047,14 @@ def test_healthy_job_runs_all_devices(self):
 class TestBulkImportVCPermission:
     """Test VC creation behavior during bulk import."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_norm_preload(self):
+        with patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        ):
+            yield
+
     def _make_stack_validation(self):
         from unittest.mock import MagicMock
 
@@ -5962,3 +6135,52 @@ def test_user_pref_bool_used_when_no_toggle(self):
         request = self._make_request()
         with patch("netbox_librenms_plugin.utils.get_user_pref", return_value=True):
             assert resolve_set_primary_ip(request) is True
+
+
+class TestBulkImportColdCacheBackfill:
+    """bulk_import_devices_shared backfills the shared device cache for the post-import render loop."""
+
+    def setup_method(self):
+        self._norm = patch(
+            "netbox_librenms_plugin.import_utils.bulk_import.preload_normalization_rules",
+            return_value={},
+        )
+        self._norm.start()
+
+    def teardown_method(self):
+        self._norm.stop()
+
+    @patch("netbox_librenms_plugin.import_utils.bulk_import.import_single_device")
+    @patch("netbox_librenms_plugin.import_utils.bulk_import.validate_device_for_import")
+    @patch("netbox_librenms_plugin.import_utils.bulk_import.require_permissions")
+    @patch("netbox_librenms_plugin.import_utils.bulk_import.LibreNMSAPI")
+    def test_cold_cache_miss_is_backfilled_after_fetch(self, mock_api_cls, mock_require, mock_validate, mock_import):
+        """A device fetched on a cold-cache miss is written back so the render loop won't re-fetch it."""
+        from netbox_librenms_plugin.import_utils import bulk_import_devices_shared
+
+        payload = {"device_id": 123, "hostname": "host-123", "sysName": "host-123"}
+        api = MagicMock(server_key="default")
+        api.get_device_info.return_value = (True, payload)
+        mock_api_cls.return_value = api
+
+        mock_validate.return_value = {
+            "virtual_chassis": {},
+            "site": {"found": False},
+            "device_type": {"found": False},
+            "platform": {"found": False},
+        }
+        mock_import.return_value = {"success": True, "device": MagicMock(), "message": "ok"}
+
+        cold_cache = {}  # nothing pre-seeded — the seed loop left misses out on purpose
+        bulk_import_devices_shared(
+            device_ids=[123],
+            server_key="default",
+            libre_devices_cache=cold_cache,
+            user=MagicMock(),
+        )
+
+        # The fetched payload is backfilled so the synchronous import's post-import row re-render
+        # (fetch_device_with_cache) hits the dict instead of issuing a second LibreNMS round-trip.
+        assert cold_cache.get(123) == payload
+        # Import decisions must run against live data, so the short device-info cache is bypassed.
+        api.get_device_info.assert_called_once_with(123, use_cache=False)
diff --git a/netbox_librenms_plugin/tests/test_sync_devices.py b/netbox_librenms_plugin/tests/test_sync_devices.py
index 154b4158c0..4e162d0ca6 100644
--- a/netbox_librenms_plugin/tests/test_sync_devices.py
+++ b/netbox_librenms_plugin/tests/test_sync_devices.py
@@ -232,46 +232,6 @@ def test_requires_change_device_permission(self):
         assert any(action == "change" and model == Device for action, model in perms["POST"])
 
 
-class TestCreatePlatformFullClean:
-    """CreateAndAssignPlatformView must call full_clean() so ValidationError is catchable."""
-
-    def test_validation_error_caught_on_slug_collision(self):
-        """When full_clean raises ValidationError, user sees error message instead of 500."""
-        from django.core.exceptions import ValidationError
-
-        from netbox_librenms_plugin.views.sync.device_fields import CreateAndAssignPlatformView
-
-        view = object.__new__(CreateAndAssignPlatformView)
-
-        request = MagicMock()
-        request.method = "POST"
-        request.POST = {"platform_name": "test-platform"}
-        request.user.has_perm.return_value = True
-        view.request = request
-
-        with (
-            patch("netbox_librenms_plugin.views.sync.device_fields.get_object_or_404"),
-            patch("netbox_librenms_plugin.views.sync.device_fields.Manufacturer"),
-            patch("netbox_librenms_plugin.views.sync.device_fields.Platform") as MockPlatform,
-            patch("netbox_librenms_plugin.views.sync.device_fields.transaction"),
-            patch("netbox_librenms_plugin.views.sync.device_fields.messages") as mock_messages,
-            patch("netbox_librenms_plugin.views.sync.device_fields.redirect"),
-        ):
-            MockPlatform.objects.filter.return_value.exists.return_value = False
-            platform_instance = MagicMock()
-            platform_instance.full_clean.side_effect = ValidationError({"slug": ["Slug already exists"]})
-            MockPlatform.return_value = platform_instance
-
-            view.post(request, pk=1)
-
-            platform_instance.full_clean.assert_called_once()
-            platform_instance.save.assert_not_called()
-            mock_messages.error.assert_called_once()
-            error_msg = mock_messages.error.call_args[0][1]
-            assert "could not be created" in error_msg
-            assert "Slug already exists" in error_msg
-
-
 class TestRemoveServerMappingViewWiring:
     def test_does_not_have_librenms_api_mixin(self):
         """RemoveServerMappingView does not call LibreNMS API — it only modifies NetBox."""
diff --git a/netbox_librenms_plugin/tests/test_vm_operations.py b/netbox_librenms_plugin/tests/test_vm_operations.py
index 6fe449ed1c..28481ad99a 100644
--- a/netbox_librenms_plugin/tests/test_vm_operations.py
+++ b/netbox_librenms_plugin/tests/test_vm_operations.py
@@ -95,6 +95,37 @@ def test_can_import_false_raises_value_error(self):
         with pytest.raises(ValueError, match="VM cannot be imported"):
             create_vm_from_librenms(libre_device, validation)
 
+    def test_numeric_like_device_id_rejected_before_vm_creation(self):
+        """A numeric-like device_id (1.9 / Decimal('1.9') / '1.9' / True) must be rejected — int() would truncate a float to a valid-looking but WRONG pk, creating a VM with a garbage librenms_id mapping. The guard runs before any VM is created."""
+        from decimal import Decimal
+
+        from netbox_librenms_plugin.import_utils.vm_operations import create_vm_from_librenms
+
+        validation = {"can_import": True, "cluster": {"cluster": MagicMock()}, "platform": {"platform": None}}
+        for bad in (1.9, Decimal("1.9"), "1.9", True):
+            libre_device = {"device_id": bad, "hostname": "vm-bad", "_computed_name": "vm-bad"}
+            with patch("virtualization.models.VirtualMachine") as mock_vm_class:
+                with pytest.raises(ValueError):
+                    create_vm_from_librenms(libre_device, validation)
+                mock_vm_class.objects.create.assert_not_called()  # no VM created on an invalid id
+
+    def test_digit_string_device_id_accepted(self):
+        """A plain digit string ('42') is still accepted and coerced to int (so a JSON-string id from LibreNMS keeps working)."""
+        from netbox_librenms_plugin.import_utils.vm_operations import create_vm_from_librenms
+
+        libre_device = {"device_id": "42", "hostname": "vm42", "_computed_name": "vm42"}
+        validation = {"can_import": True, "cluster": {"cluster": MagicMock()}, "platform": {"platform": None}}
+        mock_vm = MagicMock()
+
+        with (
+            patch("virtualization.models.VirtualMachine") as mock_vm_class,
+            patch("netbox_librenms_plugin.utils.set_librenms_device_id") as mock_setter,
+        ):
+            mock_vm_class.objects.create.return_value = mock_vm
+            create_vm_from_librenms(libre_device, validation)
+
+        assert mock_setter.call_args[0][1] == 42  # coerced to int, not left as "42"
+
     def test_server_key_stored_in_custom_field(self):
         """librenms_id custom field uses the provided server_key via set_librenms_device_id."""
         from unittest.mock import patch
diff --git a/netbox_librenms_plugin/views/imports/actions.py b/netbox_librenms_plugin/views/imports/actions.py
index f0ccd016c5..cb2e9fadec 100644
--- a/netbox_librenms_plugin/views/imports/actions.py
+++ b/netbox_librenms_plugin/views/imports/actions.py
@@ -36,6 +36,7 @@
 )
 from netbox_librenms_plugin.tables.device_status import DeviceImportTable
 from netbox_librenms_plugin.utils import (
+    is_legacy_librenms_id,
     resolve_naming_preferences,
     save_user_pref,
     set_librenms_device_id,
@@ -169,87 +170,62 @@ def _get_hostname_for_action(request, validation: dict, libre_device: dict) -> s
 class DeviceImportHelperMixin:
     """Mixin providing common validation and rendering helpers for device import views."""
 
-    def _should_enable_vc_detection(self, device_id: int, request) -> bool:
+    def get_validated_device_with_selections(self, device_id: int, request) -> tuple[dict | None, dict | None, dict]:
         """
-        Determine if VC detection should be enabled for this request.
-
-        VC detection is always enabled for role/rack changes and detail views,
-        regardless of the initial user preference. This implements smart caching:
-
-        1. If user originally requested VC detection: Uses cached data from initial load
-        2. If VC data is already cached: Reuses cached data (no API call)
-        3. Otherwise: Fetches VC data from LibreNMS API and caches it
+        Get LibreNMS device, validate it, and apply user selections.
 
-        This approach ensures:
-        - Role/rack changes always have VC context available (required for import)
-        - No redundant API calls when VC data is already cached
-        - Consistent VC detection behavior across dropdowns and detail modals
-        - Since role assignment is required before import, VC data is always
-          available by the time bulk import/confirm operations run
+        Consolidates the common pattern across all device import update views.
 
         Args:
             device_id: LibreNMS device ID
             request: Django request object
 
         Returns:
-            bool: Always returns True to enable VC detection with smart caching
+            Tuple of (libre_device, validation, selections)
+            Returns (None, None, selections) if device not found
         """
-        # Check if user originally requested VC detection
-        vc_requested = _resolve_vc_detection_enabled(request)
-
-        if vc_requested:
-            # User explicitly enabled it - use it (will use cache if available)
-            return True
-
-        # Check if VC data is already cached (no API call will be made)
-        from netbox_librenms_plugin.import_utils import _vc_cache_key
-
-        cache_key = _vc_cache_key(self.librenms_api, device_id)
-        vc_cached = cache.get(cache_key) is not None
+        # Try to use cached device data from table load (eliminates redundant API calls)
+        libre_device = fetch_device_with_cache(device_id, self.librenms_api)
 
-        if vc_cached:
-            # Data already in cache - enable detection (no API call)
-            return True
+        if not libre_device:
+            return None, None, extract_device_selections(request, device_id)
 
-        # Not requested and not cached - make API call to get VC data
-        # This handles the case where user didn't initially request it
-        # but is now changing role/rack (so we fetch it now)
-        return True
+        validation, selections = self.validate_and_apply_selections(device_id, request, libre_device)
+        return libre_device, validation, selections
 
-    def get_validated_device_with_selections(self, device_id: int, request) -> tuple[dict | None, dict | None, dict]:
+    def validate_and_apply_selections(self, device_id: int, request, libre_device: dict) -> tuple[dict, dict]:
         """
-        Get LibreNMS device, validate it, and apply user selections.
+        Validate an already-fetched LibreNMS device and apply user selections.
 
-        Consolidates the common pattern across all device import update views.
+        Split out of :meth:`get_validated_device_with_selections` so callers that already hold
+        the LibreNMS device dict (e.g. ``AddDeviceTypeMappingView.post`` right after a mapping
+        write) can re-validate without a second LibreNMS round-trip (issue #66). Re-validation
+        still reflects NetBox-side changes — a freshly created ``DeviceTypeMapping``, role, etc.
+        — because :func:`validate_device_for_import` reads those from the database, not from the
+        cached ``libre_device``.
 
         Args:
-            device_id: LibreNMS device ID
-            request: Django request object
+            device_id (int): LibreNMS device ID.
+            request: Django request object.
+            libre_device (dict): Already-fetched LibreNMS device dict.
 
         Returns:
-            Tuple of (libre_device, validation, selections)
-            Returns (None, None, selections) if device not found
+            tuple[dict, dict]: The (validation, selections) pair.
         """
         selections = extract_device_selections(request, device_id)
         cluster_id = selections["cluster_id"]
-        is_vm = bool(cluster_id)
-
-        # Try to use cached device data from table load (eliminates redundant API calls)
-        libre_device = fetch_device_with_cache(device_id, self.librenms_api)
-
-        if not libre_device:
-            return None, None, selections
+        requested_vm = bool(cluster_id)
 
-        # Determine if we should enable VC detection for this request
-        # This checks: user preference, cache status, and VM vs Device
-        enable_vc = not is_vm and self._should_enable_vc_detection(device_id, request)
+        # VC detection runs for every non-VM import: role/rack changes and detail views need
+        # VC context (served from cache when already fetched), so it's gated purely on not-a-VM.
+        enable_vc = not requested_vm
 
         # Extract naming preferences: POST data (hx-include) → user pref → plugin settings.
         use_sysname, strip_domain = resolve_naming_preferences(request)
 
         validation = validate_device_for_import(
             libre_device,
-            import_as_vm=is_vm,
+            import_as_vm=requested_vm,
             api=self.librenms_api if enable_vc else None,
             include_vc_detection=enable_vc,
             use_sysname=use_sysname,
@@ -257,13 +233,28 @@ def get_validated_device_with_selections(self, device_id: int, request) -> tuple
             server_key=self.librenms_api.server_key,
         )
         # Recompute is_vm from validate_device_for_import's own detection
-        # (it may have found an existing VM via hostname/IP lookup)
+        # (it may have bound an existing Device by librenms_id/hostname/IP and flipped
+        # import_as_vm back to False).
         is_vm = bool(validation.get("import_as_vm"))
+        if requested_vm and not is_vm:
+            # The row flipped VM→Device, but the first pass skipped VC detection / chassis-fallback
+            # device-type matching because VM mode was requested (api=None, include_vc_detection=
+            # False). Re-validate in device mode so VC metadata and chassis device-type matching are
+            # applied for the device it actually resolved to.
+            validation = validate_device_for_import(
+                libre_device,
+                import_as_vm=False,
+                api=self.librenms_api,
+                include_vc_detection=True,
+                use_sysname=use_sysname,
+                strip_domain=strip_domain,
+                server_key=self.librenms_api.server_key,
+            )
 
         # Apply user selections (cluster, role, rack) to validation
         _apply_user_selections_to_validation(validation, selections, is_vm)
 
-        return libre_device, validation, selections
+        return validation, selections
 
     def render_device_row(self, request, libre_device: dict, validation: dict, selections: dict):
         """
@@ -360,7 +351,12 @@ def post(self, request):
         if post_server_key:
             from netbox_librenms_plugin.librenms_api import LibreNMSAPI
 
-            self._librenms_api = LibreNMSAPI(server_key=post_server_key)
+            # Only rebind to a CONFIGURED server: a stale/forged key passed straight into
+            # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and 500s this
+            # HTMX action (the hidden server_key form field widened where this fires). When the key
+            # isn't configured, keep the default-server client — mirrors the sync/cables/ip check.
+            if post_server_key in LibreNMSAPI.get_available_servers():
+                self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         device_ids = request.POST.getlist("select")
         if not device_ids:
@@ -502,6 +498,11 @@ def post(self, request):
             "devices": devices,
             "device_count": len(devices),
             "errors": errors,
+            # Surface partial cache-expiry: when SOME rows survive (devices non-empty) the
+            # all-expired / partial-expired warnings above are skipped, so without this the modal
+            # hides that N selected rows were dropped to stale cache and shows only generic errors.
+            "cache_expired_count": cache_expired_count,
+            "selected_count": len(seen_ids),
             "use_sysname": use_sysname,
             "strip_domain": strip_domain,
             "server_key": self.librenms_api.server_key,
@@ -549,7 +550,12 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
         if post_server_key:
             from netbox_librenms_plugin.librenms_api import LibreNMSAPI
 
-            self._librenms_api = LibreNMSAPI(server_key=post_server_key)
+            # Only rebind to a CONFIGURED server: a stale/forged key passed straight into
+            # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and 500s this
+            # HTMX action (the hidden server_key form field widened where this fires). When the key
+            # isn't configured, keep the default-server client — mirrors the sync/cables/ip check.
+            if post_server_key in LibreNMSAPI.get_available_servers():
+                self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         device_ids = request.POST.getlist("select")
         if not device_ids:
@@ -625,12 +631,23 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
         device_ids_to_import = [d for d in parsed_ids if d not in vm_imports]
         vm_ids_to_import = list(vm_imports.keys())
 
-        # Build cache of already-fetched device data to avoid redundant API calls
-        libre_devices_cache = {}
-        for device_id in parsed_ids:
-            cached_device = fetch_device_with_cache(device_id, self.librenms_api)
-            if cached_device:
-                libre_devices_cache[device_id] = cached_device
+        # Seed the shared device cache from ALREADY-cached entries only, before the
+        # background-vs-sync decision. Reading the Django cache directly (not
+        # fetch_device_with_cache, which falls through to the LibreNMS HTTP API on a miss)
+        # keeps this request handler from making one synchronous LibreNMS round-trip per
+        # selected device on a cold/expired cache — which would defeat the background path's
+        # whole point of returning fast. Misses are left out and fetched by whichever path
+        # runs: the background job (async, off the request) or the synchronous import (inline).
+        # One batched round-trip instead of one cache.get() per selected device: on Redis a bulk
+        # import of N devices otherwise issues N sequential GETs before the fast background path
+        # even starts. Map each cache key back to its device_id, then keep only the hits.
+        server_key = self.librenms_api.server_key
+        key_to_device_id = {get_import_device_cache_key(device_id, server_key): device_id for device_id in parsed_ids}
+        libre_devices_cache = {
+            key_to_device_id[key]: cached_device
+            for key, cached_device in cache.get_many(list(key_to_device_id)).items()
+            if cached_device
+        }
 
         # Check if we should use background job for import
         total_import_count = len(parsed_ids)
@@ -684,14 +701,7 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
                     f"Background job requested but no workers available. Importing {total_import_count} devices synchronously...",
                 )
 
-        # Synchronous import execution
-        # Build cache of already-fetched device data to avoid redundant API calls
-        libre_devices_cache_sync = {}
-        for device_id in parsed_ids:
-            cached_device = fetch_device_with_cache(device_id, self.librenms_api)
-            if cached_device:
-                libre_devices_cache_sync[device_id] = cached_device
-
+        # Synchronous import execution (reuses libre_devices_cache built above).
         # Import devices and VMs separately
         device_result = {
             "success": [],
@@ -709,7 +719,7 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
                     server_key=self.librenms_api.server_key,
                     sync_options=sync_options,
                     manual_mappings_per_device=manual_mappings_per_device,  # type: ignore
-                    libre_devices_cache=libre_devices_cache_sync,
+                    libre_devices_cache=libre_devices_cache,
                     user=request.user,  # Pass user for permission checks
                 )
 
@@ -719,7 +729,7 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
                     vm_imports,
                     self.librenms_api,
                     sync_options,
-                    libre_devices_cache_sync,
+                    libre_devices_cache,
                     user=request.user,  # Pass user for permission checks
                 )
 
@@ -774,6 +784,9 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
             imported_device_ids = [item["device_id"] for item in device_result.get("success", [])] + [
                 item["device_id"] for item in vm_result.get("success", [])
             ]
+            # VM-success ids as a set so the per-row is_vm check below is O(1). Rebuilding the list
+            # inside the loop made re-render O(n*m) for an import of n devices and m VM successes.
+            imported_vm_ids = {item["device_id"] for item in vm_result.get("success", [])}
 
             # Re-validate and render each imported device with fresh status
             for device_id in imported_device_ids:
@@ -781,12 +794,12 @@ def post(self, request):  # noqa: PLR0912 - branching keeps responses explicit
                 libre_device = fetch_device_with_cache(
                     device_id,
                     self.librenms_api,
-                    libre_devices_cache=libre_devices_cache_sync,
+                    libre_devices_cache=libre_devices_cache,
                 )
 
                 if libre_device:
                     # Determine if this was imported as VM or device
-                    is_vm = device_id in [item["device_id"] for item in vm_result.get("success", [])]
+                    is_vm = device_id in imported_vm_ids
 
                     # Re-validate with fresh status (will now show as imported)
                     # Pass naming preferences so name comparison uses the same
@@ -1012,12 +1025,22 @@ def _build_id_server_info(existing_device):
             servers_config = {}
         result = []
         for sk, did in cf_value.items():
-            if isinstance(did, bool) or not isinstance(did, (int, str)):
+            # Coerce with int() (not str.isdigit()) so this per-server panel accepts exactly what
+            # librenms_sync_view._build_all_server_mappings accepts over the SAME CF dict: a value
+            # written as " 42 " is a valid link everywhere else, so isdigit() here silently dropped
+            # it and the sync page and import-conflict panel reported contradictory server links
+            # for one device (issue #99). Reject bool/None/non-numeric and non-positive ids to match.
+            if isinstance(did, bool) or did is None:
                 continue
             if isinstance(did, str):
-                if not did.isdigit():
+                try:
+                    did = int(did)
+                except (TypeError, ValueError):
                     continue
-                did = int(did)
+            elif not isinstance(did, int):
+                continue
+            if did <= 0:
+                continue
             srv_cfg = servers_config.get(sk)
             # Legacy single-server config: "default" key with no matching servers entry —
             # fall back to root-level display_name in plugins_config.
@@ -1090,7 +1113,10 @@ def post(self, request, device_id):
         # If the form submitted a specific server_key, honour it so the handler uses
         # the same server context as the import page when the user clicked the button.
         post_server_key = (request.POST.get("server_key") or "").strip()
-        if post_server_key:
+        # Only rebind to a CONFIGURED server: a stale/forged key would raise KeyError in a
+        # multi-server config and 500 this action; keep the default client otherwise (mirrors
+        # the membership check used across the sync/cables/ip paths).
+        if post_server_key and post_server_key in LibreNMSAPI.get_available_servers():
             self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         if not action or not existing_device_id:
@@ -1182,14 +1208,7 @@ def post(self, request, device_id):
                 # silently skips writes for legacy formats, leaving the device partially
                 # updated. User must run "Convert mapping" migration first.
                 stored_id = existing_device.custom_field_data.get("librenms_id")
-                _is_legacy = isinstance(stored_id, int) and not isinstance(stored_id, bool)
-                if not _is_legacy and isinstance(stored_id, str):
-                    try:
-                        int(stored_id)
-                        _is_legacy = True
-                    except (ValueError, TypeError):
-                        pass
-                if _is_legacy:
+                if is_legacy_librenms_id(stored_id):
                     return _htmx_error_response(
                         "Device has a legacy bare-integer librenms_id; use 'Convert mapping' "
                         "to migrate to the multi-server format before linking."
@@ -1369,9 +1388,7 @@ def post(self, request, device_id):
             # LibreNMSAPI.get_librenms_id() returns an int in both formats; only the raw
             # type check on custom_field_data reveals whether migration is needed.
             cf_value = existing_device.custom_field_data.get("librenms_id")
-            if isinstance(cf_value, bool) or not (
-                isinstance(cf_value, int) or (isinstance(cf_value, str) and cf_value.isdigit())
-            ):
+            if not is_legacy_librenms_id(cf_value):
                 return _htmx_error_response("Device librenms_id is already in JSON format; no migration needed.")
             # Normalise string-digit to int for consistent comparison
             cf_int = int(cf_value) if isinstance(cf_value, str) else cf_value
@@ -1393,9 +1410,7 @@ def post(self, request, device_id):
                     return _htmx_error_response("Object no longer exists; it may have been deleted concurrently.")
                 # Re-check under lock — another request may have already migrated it
                 cf_locked = locked_device.custom_field_data.get("librenms_id")
-                if isinstance(cf_locked, bool) or not (
-                    isinstance(cf_locked, int) or (isinstance(cf_locked, str) and cf_locked.isdigit())
-                ):
+                if not is_legacy_librenms_id(cf_locked):
                     return _htmx_error_response("Device librenms_id is already in JSON format; no migration needed.")
                 cf_locked_int = int(cf_locked) if isinstance(cf_locked, str) else cf_locked
                 if cf_locked_int != librenms_id:
@@ -1468,7 +1483,12 @@ def post(self, request, device_id):
         if post_server_key:
             from netbox_librenms_plugin.librenms_api import LibreNMSAPI
 
-            self._librenms_api = LibreNMSAPI(server_key=post_server_key)
+            # Only rebind to a CONFIGURED server: a stale/forged key passed straight into
+            # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and 500s this
+            # HTMX action (the hidden server_key form field widened where this fires). When the key
+            # isn't configured, keep the default-server client — mirrors the sync/cables/ip check.
+            if post_server_key in LibreNMSAPI.get_available_servers():
+                self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         from dcim.models import DeviceType
 
@@ -1480,6 +1500,18 @@ def post(self, request, device_id):
         if not hardware or hardware == "-":
             return _htmx_error_response("Device has no hardware string — cannot create mapping.")
 
+        # Key the mapping on the NORMALISED hardware string. match_librenms_hardware_to_device_type
+        # normalises via the device_type rules before the DeviceTypeMapping lookup, so a mapping
+        # saved under the raw value (e.g. "WS-C9300" when a rule strips it to "C9300") would never
+        # be found by the revalidation below. Strip the rule output too: DeviceTypeMapping.clean()
+        # strips before save, so an untrimmed key (e.g. " C9300 ") would miss the stored "c9300"
+        # mapping and take the add path, then fail uniqueness validation generically on save.
+        from netbox_librenms_plugin.utils import apply_normalization_rules
+
+        mapping_hardware = (apply_normalization_rules(value=hardware, scope="device_type") or "").strip()
+        if not mapping_hardware or mapping_hardware == "-":
+            return _htmx_error_response("Device hardware normalised to an empty value — cannot create mapping.")
+
         device_type_id = request.POST.get("device_type_id", "").strip()
         if not device_type_id:
             return _htmx_error_response("Please select a device type before submitting.")
@@ -1496,7 +1528,7 @@ def post(self, request, device_id):
 
         # Resolve the existing mapping first so we only require the permission
         # actually needed: "add" for a new mapping, "change" for an update.
-        existing_mapping = DeviceTypeMapping.objects.filter(librenms_hardware__iexact=hardware).first()
+        existing_mapping = DeviceTypeMapping.objects.filter(librenms_hardware__iexact=mapping_hardware).first()
         if existing_mapping:
             self.required_object_permissions = {"POST": [("change", DeviceTypeMapping)]}
         else:
@@ -1510,7 +1542,9 @@ def post(self, request, device_id):
                 # check and the actual write (select_for_update prevents a concurrent
                 # INSERT from slipping through undetected).
                 locked = (
-                    DeviceTypeMapping.objects.select_for_update().filter(librenms_hardware__iexact=hardware).first()
+                    DeviceTypeMapping.objects.select_for_update()
+                    .filter(librenms_hardware__iexact=mapping_hardware)
+                    .first()
                 )
                 if locked and not existing_mapping:
                     # A concurrent request created the mapping after our upfront read.
@@ -1535,7 +1569,7 @@ def post(self, request, device_id):
                 else:
                     try:
                         DeviceTypeMapping.objects.create(
-                            librenms_hardware=hardware.lower(),
+                            librenms_hardware=mapping_hardware.lower(),
                             netbox_device_type=device_type,
                         )
                     except IntegrityError:
@@ -1548,14 +1582,32 @@ def post(self, request, device_id):
             logger.exception("AddDeviceTypeMappingView: failed to save mapping: %s", exc)
             return _htmx_error_response("Error saving mapping. Please try again.")
 
-        # Clear cached LibreNMS device data so re-validation picks up the new mapping
+        # Repopulate (rather than clear) the cache with the LibreNMS device we already fetched
+        # at the top of this request. Re-validation reads the new mapping from the NetBox DB, so
+        # the cached LibreNMS payload stays correct; keeping it means the modal/row refresh below
+        # never issues a second LibreNMS round-trip — and a transient LibreNMS outage after the
+        # commit can no longer downgrade the refresh to a stale/"not found" state (issue #66).
+        # Preserve the entry's REMAINING TTL rather than granting a fresh full window: the
+        # snapshot may be minutes old, and re-arming it full-length would keep serving it to
+        # the bulk-import seed long after the original expiry. When the entry has already
+        # expired mid-request, leave it expired (next read fetches live); when the backend
+        # can't report TTLs (non-Redis, e.g. tests' LocMemCache), keep the full-timeout
+        # repopulate — NetBox deployments are Redis-backed, so that branch is test-only.
+        from netbox_librenms_plugin.utils import cache_remaining_ttl
+
         cache_key = get_import_device_cache_key(device_id, self.librenms_api.server_key)
-        cache.delete(cache_key)
+        remaining_ttl = cache_remaining_ttl(cache, cache_key)
+        if remaining_ttl is None:
+            cache.set(cache_key, libre_device, timeout=self.librenms_api.cache_timeout)
+        elif remaining_ttl > 0:
+            cache.set(cache_key, libre_device, timeout=remaining_ttl)
 
         # Re-render the modal content as an OOB swap so it updates in place.
         # The inner views render via Django templates (auto-escaped), so the
         # decoded content is already safe HTML; wrap with format_html + mark_safe
         # to compose the OOB envelope without introducing new escape boundaries.
+        # The cache repopulation above keeps DeviceValidationDetailsView.get's
+        # fetch_device_with_cache a cache hit, so no extra LibreNMS call is made.
         detail_view = DeviceValidationDetailsView()
         detail_view._librenms_api = self._librenms_api
         modal_html = detail_view.get(request, device_id).content.decode("utf-8")
@@ -1566,7 +1618,8 @@ def post(self, request, device_id):
 
         # Re-validate and include the background table row as a second OOB swap so the
         # row reflects the new mapping immediately without a secondary JS-triggered request.
-        libre_device, validation, selections = self.get_validated_device_with_selections(device_id, request)
+        # Reuse the in-memory libre_device directly (no re-fetch) via validate_and_apply_selections.
+        validation, selections = self.validate_and_apply_selections(device_id, request, libre_device)
         if libre_device is not None and validation is not None:
             row_response = self.render_device_row(request, libre_device, validation, selections)
             row_html = row_response.content.decode("utf-8")
@@ -1599,7 +1652,12 @@ def get(self, request, device_id):
         if post_server_key:
             from netbox_librenms_plugin.librenms_api import LibreNMSAPI
 
-            self._librenms_api = LibreNMSAPI(server_key=post_server_key)
+            # Only rebind to a CONFIGURED server: a stale/forged key passed straight into
+            # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and 500s this
+            # HTMX action (the hidden server_key form field widened where this fires). When the key
+            # isn't configured, keep the default-server client — mirrors the sync/cables/ip check.
+            if post_server_key in LibreNMSAPI.get_available_servers():
+                self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         libre_device = fetch_device_with_cache(device_id, self.librenms_api)
         if not libre_device:
@@ -1661,7 +1719,12 @@ def post(self, request, device_id):
         if post_server_key:
             from netbox_librenms_plugin.librenms_api import LibreNMSAPI
 
-            self._librenms_api = LibreNMSAPI(server_key=post_server_key)
+            # Only rebind to a CONFIGURED server: a stale/forged key passed straight into
+            # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and 500s this
+            # HTMX action (the hidden server_key form field widened where this fires). When the key
+            # isn't configured, keep the default-server client — mirrors the sync/cables/ip check.
+            if post_server_key in LibreNMSAPI.get_available_servers():
+                self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         create_mapping = _parse_boolish(request.POST.get("create_mapping")) is True
         device_pk_str = (request.POST.get("device_pk") or "").strip()
@@ -1735,34 +1798,6 @@ def post(self, request, device_id):
                 platform.full_clean()
                 platform.save()
 
-                if target_model is not None and target_pk is not None:
-                    try:
-                        target = target_model.objects.select_for_update().get(pk=target_pk)
-                        target.platform = platform
-                        target.full_clean()
-                        target.save()
-                        logger.info(
-                            "CreatePlatformFromImportView: assigned platform '%s' to %s pk=%s",
-                            platform.name,
-                            target_model.__name__,
-                            target_pk,
-                        )
-                    except target_model.DoesNotExist:
-                        logger.warning(
-                            "CreatePlatformFromImportView: %s pk=%s not found; platform "
-                            "'%s' created but not assigned to any object",
-                            target_model.__name__,
-                            target_pk,
-                            platform.name,
-                        )
-                else:
-                    logger.info(
-                        "CreatePlatformFromImportView: no existing NetBox object matched "
-                        "for LibreNMS device_id=%s; platform '%s' created without assignment",
-                        device_id,
-                        platform.name,
-                    )
-
                 if create_mapping and librenms_os:
                     if not PlatformMapping.objects.filter(librenms_os__iexact=librenms_os).exists():
                         try:
@@ -1778,9 +1813,69 @@ def post(self, request, device_id):
             logger.exception("CreatePlatformFromImportView: failed to create platform: %s", exc)
             return _htmx_error_response("Error creating platform. Please try again.")
 
+        # Assign the new platform to the existing object as a best-effort side effect, in its
+        # OWN transaction. The platform create above is the primary action and is already
+        # committed; a failure here — the target vanishing before the lock, or full_clean()
+        # tripping on unrelated legacy data on that record — must NOT roll back the platform.
+        # It must, however, be reported to the user (see assignment_error below): silently
+        # rendering the success swap would imply the device received the platform when it did not.
+        assignment_error = None
+        if target_model is not None and target_pk is not None:
+            try:
+                with transaction.atomic():
+                    target = target_model.objects.select_for_update().get(pk=target_pk)
+                    target.platform = platform
+                    target.full_clean()
+                    target.save()
+                logger.info(
+                    "CreatePlatformFromImportView: assigned platform '%s' to %s pk=%s",
+                    platform.name,
+                    target_model.__name__,
+                    target_pk,
+                )
+            except target_model.DoesNotExist:
+                logger.warning(
+                    "CreatePlatformFromImportView: %s pk=%s not found; platform "
+                    "'%s' created but not assigned to any object",
+                    target_model.__name__,
+                    target_pk,
+                    platform.name,
+                )
+                assignment_error = (
+                    f'Platform "{platform.name}" was created, but the target '
+                    f"{target_model._meta.verbose_name} no longer exists, so it could not be "
+                    "assigned. Assign the platform manually if it is still needed."
+                )
+            except (ValidationError, IntegrityError) as exc:
+                logger.warning(
+                    "CreatePlatformFromImportView: platform '%s' created but assignment to "
+                    "%s pk=%s failed and was skipped: %s",
+                    platform.name,
+                    target_model.__name__,
+                    target_pk,
+                    exc,
+                )
+                assignment_error = (
+                    f'Platform "{platform.name}" was created, but could not be assigned to the '
+                    f"{target_model._meta.verbose_name}. Assign the platform manually if needed."
+                )
+        else:
+            logger.info(
+                "CreatePlatformFromImportView: no existing NetBox object matched "
+                "for LibreNMS device_id=%s; platform '%s' created without assignment",
+                device_id,
+                platform.name,
+            )
+
         cache_key = get_import_device_cache_key(device_id, self.librenms_api.server_key)
         cache.delete(cache_key)
 
+        if assignment_error:
+            # The platform (and any mapping) were intentionally kept, but the device assignment
+            # failed. Surface that to the user instead of a success swap — the failure detail is
+            # already logged above; the toast carries a fixed, non-sensitive message.
+            return _htmx_error_response(assignment_error)
+
         # Re-render the modal content as an OOB swap so it updates in place.
         # The inner views render via Django templates (auto-escaped), so the
         # decoded content is already safe HTML; wrap with format_html + mark_safe
@@ -1822,6 +1917,10 @@ def post(self, request):
             data = json.loads(request.body)
         except (json.JSONDecodeError, ValueError):
             return JsonResponse({"error": "Invalid JSON"}, status=400)
+        # json.loads can return any JSON type (list, str, number, null); a non-object payload would
+        # AttributeError on data.get() below. Reject it as a 400 rather than 500.
+        if not isinstance(data, dict):
+            return JsonResponse({"error": "Invalid JSON payload"}, status=400)
 
         key = data.get("key")
         value = data.get("value")
@@ -1848,7 +1947,10 @@ def post(self, request, device_id):
         from netbox_librenms_plugin.models import PlatformMapping
 
         post_server_key = (request.POST.get("server_key") or "").strip()
-        if post_server_key:
+        # Only rebind to a CONFIGURED server: a stale/forged key would raise KeyError in a
+        # multi-server config and 500 this action; keep the default client otherwise (mirrors
+        # the membership check used across the sync/cables/ip paths).
+        if post_server_key and post_server_key in LibreNMSAPI.get_available_servers():
             self._librenms_api = LibreNMSAPI(server_key=post_server_key)
 
         libre_device = fetch_device_with_cache(device_id, self.librenms_api)

From 4dabad58aa5056f573dfaa957ef4714e9c4033ee Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 04/17] fix(modules): harden module sync and swap the table in
 place over HTMX

Adopt the externally-named interface on Update Interface (was a no-op), preserve MACs and
scope the render partial to the server, batch renames, lock and cache the module-type index,
do in-place HTMX swaps for the install / update-serial / update-interface / carrier flows
with an "Installing..." spinner, prefetch installed module relations for the sync table and
adoptable count, normalize entity indices before merging transceiver data, and badge a
recognised LibreNMS model as its NetBox type in the mismatch modal.
---
 netbox_librenms_plugin/tables/modules.py      |  127 +-
 .../netbox_librenms_plugin/_module_sync.html  |   32 +
 .../_module_sync_content.html                 |    9 +-
 .../htmx/module_mismatch_modal.html           |   18 +-
 .../tests/test_coverage_tables.py             |   96 +-
 .../test_module_interface_bind_message.py     |   94 +
 .../tests/test_module_replace.py              |  124 ++
 .../tests/test_modules_view.py                |   38 +-
 .../tests/test_sync_modules.py                | 1548 +++++++++++++++--
 .../tests/test_sync_view_mismatch.py          |   32 +
 .../tests/test_tables_modules.py              |   91 +
 .../views/base/modules_view.py                |   81 +-
 netbox_librenms_plugin/views/sync/modules.py  |  333 +++-
 13 files changed, 2416 insertions(+), 207 deletions(-)
 create mode 100644 netbox_librenms_plugin/tests/test_module_interface_bind_message.py

diff --git a/netbox_librenms_plugin/tables/modules.py b/netbox_librenms_plugin/tables/modules.py
index b3f7f72f80..318c73b866 100644
--- a/netbox_librenms_plugin/tables/modules.py
+++ b/netbox_librenms_plugin/tables/modules.py
@@ -81,6 +81,40 @@ def __init__(
         self.can_add_module_bay_mapping = can_add_module_bay_mapping
         self.can_add_module_type_mapping = can_add_module_type_mapping
         super().__init__(*args, **kwargs)
+        # Batch-load the installed modules (with module_type + interface templates) referenced by
+        # the rows, so render_actions' VC "Report VC issue" diagnostic doesn't run a per-row
+        # Module.objects.get() + interfacetemplates.all() — an N+1 over the whole module table.
+        # Only VC devices reach that branch, so skip the query otherwise.
+        self._installed_modules_by_id = {}
+        if isinstance(getattr(self.device, "virtual_chassis_id", None), int):
+            data_rows = args[0] if args else kwargs.get("data") or []
+            installed_ids = {
+                row["installed_module_id"]
+                for row in data_rows
+                if isinstance(row, dict) and row.get("installed_module_id")
+            }
+            if installed_ids:
+                from dcim.models import Module
+                from django.db import DatabaseError
+
+                try:
+                    self._installed_modules_by_id = {
+                        m.pk: m
+                        for m in Module.objects.select_related(
+                            "module_type",
+                            "module_type__manufacturer",
+                            "module_bay",
+                            "device",
+                            "device__device_type",
+                            "device__virtual_chassis",
+                        )
+                        .prefetch_related("module_type__interfacetemplates")
+                        .filter(pk__in=installed_ids)
+                    }
+                except (DatabaseError, RuntimeError):
+                    # RuntimeError: pytest "Database access not allowed" in unit-test contexts
+                    # whose self.device is a MagicMock with a real-looking virtual_chassis_id.
+                    self._installed_modules_by_id = {}
         if not (has_write_permission and can_add_module) and hasattr(self, "columns"):
             self.columns["selection"].column.visible = False
         self.tab = "modules"
@@ -227,6 +261,42 @@ def render_module_type(self, value, record):
         return format_html("{}", value)
 
     def render_status(self, value, record):
+        """
+        Render the sync-status badge alongside a hidden in-flight spinner badge.
+
+        The live badge is wrapped so CSS (see ``_module_sync.html``) can swap it
+        for the spinner badge while a row-action POST is in flight — the row forms
+        set ``hx-indicator="closest tr"``, so HTMX marks the row with ``htmx-request``
+        for the duration. The spinner label tracks the row's action: "Updating…" on an
+        installed-module row offering Update Serial / Update Interface, "Installing…"
+        on an install / install-branch / carrier-install row. It stays hidden in every
+        other state, including the inline verify-endpoint cell updates.
+        """
+        # An update action (Update Serial / Update Interface) acts on an already-installed module
+        # and a row never offers it alongside an install-flavoured action, so a row with an update
+        # flag and no install/branch/carrier action shows "Updating…"; everything else "Installing…".
+        in_flight_label = (
+            "Updating"
+            if (
+                record.get("installed_module_id")
+                and (record.get("can_update_serial") or record.get("can_update_interface_binding"))
+                and not record.get("can_install")
+                and not record.get("has_installable_children")
+                and not record.get("carrier_install_options")
+            )
+            else "Installing"
+        )
+        badge = self._status_badge_html(value, record)
+        return format_html(
+            '<span class="lnms-status-live">{}</span>'
+            '<span class="lnms-installing badge bg-primary text-white" role="status" title="{}…">'
+            '<span class="spinner-border spinner-border-sm" aria-hidden="true"></span>{}…</span>',
+            badge,
+            in_flight_label,
+            in_flight_label,
+        )
+
+    def _status_badge_html(self, value, record):
         """Render sync status with badge."""
         # Promote No Bay → Missing Carrier when concrete carrier-install rules
         # produced suggestions for this row (one-click install offered below).
@@ -429,7 +499,11 @@ def render_actions(self, value, record):
             url = reverse("plugins:netbox_librenms_plugin:install_module", kwargs={"pk": self.device.pk})
             buttons.append(
                 format_html(
-                    '<form method="post" action="{}" style="display:inline">'
+                    # hx-post swaps just the module table in place (the view returns the
+                    # table partial for HTMX); method/action keep it working without JS.
+                    '<form method="post" action="{}" hx-post="{}"'
+                    ' hx-target="#module-sync-content" hx-swap="innerHTML"'
+                    ' hx-indicator="closest tr" hx-disabled-elt="find button" style="display:inline">'
                     '<input type="hidden" name="csrfmiddlewaretoken" value="{}">'
                     '<input type="hidden" name="server_key" value="{}">'
                     '<input type="hidden" name="selected_device_id" value="{}">'
@@ -446,6 +520,7 @@ def render_actions(self, value, record):
                     '<i class="mdi mdi-download"></i> Install'
                     "</button></form>",
                     url,
+                    url,
                     self.csrf_token,
                     self.server_key,
                     record.get("selected_device_id") or self.device.pk,
@@ -466,7 +541,11 @@ def render_actions(self, value, record):
             url = reverse("plugins:netbox_librenms_plugin:install_branch", kwargs={"pk": self.device.pk})
             buttons.append(
                 format_html(
-                    '<form method="post" action="{}" style="display:inline">'
+                    # hx-post swaps just the module table in place (the view returns the
+                    # table partial for HTMX); method/action keep it working without JS.
+                    '<form method="post" action="{}" hx-post="{}"'
+                    ' hx-target="#module-sync-content" hx-swap="innerHTML"'
+                    ' hx-indicator="closest tr" hx-disabled-elt="find button" style="display:inline">'
                     '<input type="hidden" name="csrfmiddlewaretoken" value="{}">'
                     '<input type="hidden" name="server_key" value="{}">'
                     '<input type="hidden" name="selected_device_id" value="{}">'
@@ -476,6 +555,7 @@ def render_actions(self, value, record):
                     '<i class="mdi mdi-file-tree"></i> Install Branch'
                     "</button></form>",
                     url,
+                    url,
                     self.csrf_token,
                     self.server_key,
                     record.get("selected_device_id") or self.device.pk,
@@ -488,7 +568,11 @@ def render_actions(self, value, record):
             url = reverse("plugins:netbox_librenms_plugin:update_module_serial", kwargs={"pk": self.device.pk})
             buttons.append(
                 format_html(
-                    '<form method="post" action="{}" style="display:inline">'
+                    # hx-post swaps just the module table in place (the view returns the
+                    # table partial for HTMX); method/action keep it working without JS.
+                    '<form method="post" action="{}" hx-post="{}"'
+                    ' hx-target="#module-sync-content" hx-swap="innerHTML"'
+                    ' hx-indicator="closest tr" hx-disabled-elt="find button" style="display:inline">'
                     '<input type="hidden" name="csrfmiddlewaretoken" value="{}">'
                     '<input type="hidden" name="server_key" value="{}">'
                     '<input type="hidden" name="selected_device_id" value="{}">'
@@ -499,6 +583,7 @@ def render_actions(self, value, record):
                     '<i class="mdi mdi-sync"></i> Update Serial'
                     "</button></form>",
                     url,
+                    url,
                     self.csrf_token,
                     self.server_key,
                     record.get("selected_device_id") or self.device.pk,
@@ -515,7 +600,11 @@ def render_actions(self, value, record):
             url = reverse("plugins:netbox_librenms_plugin:update_module_interface", kwargs={"pk": self.device.pk})
             buttons.append(
                 format_html(
-                    '<form method="post" action="{}" style="display:inline">'
+                    # hx-post swaps just the module table in place (the view returns the
+                    # table partial for HTMX); method/action keep it working without JS.
+                    '<form method="post" action="{}" hx-post="{}"'
+                    ' hx-target="#module-sync-content" hx-swap="innerHTML"'
+                    ' hx-indicator="closest tr" hx-disabled-elt="find button" style="display:inline">'
                     '<input type="hidden" name="csrfmiddlewaretoken" value="{}">'
                     '<input type="hidden" name="server_key" value="{}">'
                     '<input type="hidden" name="selected_device_id" value="{}">'
@@ -531,6 +620,7 @@ def render_actions(self, value, record):
                     '<i class="mdi mdi-link-variant"></i> Update Interface'
                     "</button></form>",
                     url,
+                    url,
                     self.csrf_token,
                     self.server_key,
                     record.get("selected_device_id") or self.device.pk,
@@ -613,7 +703,11 @@ def render_actions(self, value, record):
             for opt in record["carrier_install_options"]:
                 buttons.append(
                     format_html(
-                        '<form method="post" action="{}" style="display:inline">'
+                        # hx-post swaps just the module table in place (install_module returns the
+                        # table partial for HTMX); method/action keep it working without JS.
+                        '<form method="post" action="{}" hx-post="{}"'
+                        ' hx-target="#module-sync-content" hx-swap="innerHTML"'
+                        ' hx-indicator="closest tr" hx-disabled-elt="find button" style="display:inline">'
                         '<input type="hidden" name="csrfmiddlewaretoken" value="{}">'
                         '<input type="hidden" name="server_key" value="{}">'
                         '<input type="hidden" name="selected_device_id" value="{}">'
@@ -625,6 +719,7 @@ def render_actions(self, value, record):
                         '<i class="mdi mdi-puzzle-plus-outline"></i> Install {} into &#39;{}&#39;'
                         "</button></form>",
                         install_url,
+                        install_url,
                         self.csrf_token,
                         self.server_key,
                         record.get("selected_device_id") or self.device.pk,
@@ -791,26 +886,12 @@ def render_actions(self, value, record):
         # `virtual_chassis_id` is an int in production (or None); MagicMock-only tests
         # see a MagicMock here, which the isinstance check correctly skips.
         if record.get("installed_module_id") and isinstance(getattr(self.device, "virtual_chassis_id", None), int):
-            from dcim.models import Module
-            from django.db import DatabaseError
-
             from netbox_librenms_plugin.utils import detect_vc_normalization_noop
 
-            installed_module = None
-            try:
-                installed_module = Module.objects.select_related(
-                    "module_type",
-                    "module_type__manufacturer",
-                    "module_bay",
-                    "device",
-                    "device__device_type",
-                    "device__virtual_chassis",
-                ).get(pk=record["installed_module_id"])
-            except (Module.DoesNotExist, DatabaseError, RuntimeError):
-                # RuntimeError: pytest's "Database access not allowed" in unit-test
-                # contexts that supply self.device as a MagicMock with a real-looking
-                # virtual_chassis_id. Production rows wouldn't reach here.
-                installed_module = None
+            # Served from the __init__ batch prefetch (with interface templates), so this
+            # diagnostic adds no per-row query. A missing id (deleted concurrently, or a
+            # unit-test MagicMock device that skipped the prefetch) yields None → no button.
+            installed_module = self._installed_modules_by_id.get(record["installed_module_id"])
 
             if installed_module is not None and detect_vc_normalization_noop(installed_module.device, installed_module):
                 report_url = reverse(
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync.html
index cae8c2c547..ceb06846dd 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync.html
@@ -22,6 +22,38 @@ <h2>Module Sync</h2>
     </div>
 </div>
 
+<style>
+/*
+ * In-flight row-action feedback (HTMX).
+ *
+ * The per-row action forms (Install / Install Branch / carrier-install / Update Serial /
+ * Update Interface) set hx-indicator="closest tr", so HTMX adds .htmx-request to the row
+ * while its POST is in flight. The status cell then swaps its live badge for a spinner
+ * badge ("Installing…" or "Updating…" per the row's action, see render_status) and the
+ * row's buttons dim, making the ~1s table rebuild feel responsive (and preventing a
+ * double-submit). When the response swaps the fresh table in, the row is replaced and
+ * shows its new status. The bulk "Install Selected" form carries .htmx-request on the
+ * form itself and swaps its own button label.
+ */
+#module-sync-content .lnms-installing { display: none; }
+#module-sync-content tr.htmx-request .lnms-status-live { display: none; }
+#module-sync-content tr.htmx-request .lnms-installing {
+    display: inline-flex;
+    align-items: center;
+    gap: .35rem;
+}
+#module-sync-content tr.htmx-request .lnms-installing .spinner-border {
+    width: .85rem;
+    height: .85rem;
+    border-width: .15em;
+}
+#module-sync-content tr.htmx-request form[hx-post] button { opacity: .55; }
+
+/* Bulk "Install Selected": its own button shows the spinner + label swap. */
+#install-selected-form.htmx-request .lnms-installing { display: inline-block; }
+#install-selected-form.htmx-request .lnms-btn-idle { display: none; }
+</style>
+
 <!-- Container for the module sync content -->
 <div id="module-sync-content">
     {% include 'netbox_librenms_plugin/_module_sync_content.html' %}
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync_content.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync_content.html
index eccff430e8..5b2c8d0776 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync_content.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_module_sync_content.html
@@ -17,14 +17,17 @@
 </div>
 
 {% if has_write_permission %}
-{# Separate form for Install Selected — uses JS to collect checked rows before submit #}
+{# Install Selected: checked rows are injected into the HTMX POST at htmx:configRequest (ordering-independent — htmx's own submit listener serializes first on a fresh load); the submit-phase injector covers only the native no-JS fallback. hx-post swaps the table in place. #}
 <form id="install-selected-form" method="post"
-    action="{% url 'plugins:netbox_librenms_plugin:install_selected' pk=module_sync.object.pk %}">
+    action="{% url 'plugins:netbox_librenms_plugin:install_selected' pk=module_sync.object.pk %}"
+    hx-post="{% url 'plugins:netbox_librenms_plugin:install_selected' pk=module_sync.object.pk %}"
+    hx-target="#module-sync-content" hx-swap="innerHTML" hx-disabled-elt="find button">
     {% csrf_token %}
     <input type="hidden" name="server_key" value="{{ module_sync.server_key|default:'' }}">
     <div class="noprint mb-3">
         <button type="submit" class="btn btn-primary" id="install-selected-btn">
-            <i class="mdi mdi-package-down"></i> Install Selected
+            <span class="lnms-btn-idle"><i class="mdi mdi-package-down"></i> Install Selected</span>
+            <span class="lnms-installing"><span class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>Installing…</span>
         </button>
     </div>
 </form>
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/module_mismatch_modal.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/module_mismatch_modal.html
index 98dc0d013a..1f7206aa59 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/module_mismatch_modal.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/module_mismatch_modal.html
@@ -24,7 +24,10 @@
                     <a href="{{ installed_module.module_type.get_absolute_url }}">{{ installed_module.module_type.model }}</a>
                 {% else %}-{% endif %}
             </td>
-            <td{% if type_mismatch %} class="text-danger fw-semibold"{% endif %}>{{ librenms_model }}</td>
+            <td{% if type_mismatch %} class="text-danger fw-semibold"{% endif %}>
+                {{ librenms_model }}
+                {% if type_matched %}<i class="mdi mdi-check-decagram text-success ms-1" title="Recognised as NetBox module type {{ installed_module.module_type.model }}"></i>{% endif %}
+            </td>
         </tr>
         <tr>
             <td><strong>Serial</strong></td>
@@ -40,10 +43,17 @@
     <strong>Different module type</strong> — the installed module type does not match LibreNMS.
     Replacing will delete the current module and install <strong>{{ librenms_model }}</strong>.
 </div>
-{% elif serial_mismatch %}
+{% elif serial_mismatch and type_matched %}
 <div class="alert alert-info py-2 mb-3">
-    <i class="mdi mdi-information me-1"></i>
-    Same module type, different serial — the module may have been physically replaced.
+    <i class="mdi mdi-check-decagram me-1"></i>
+    Same module type — the LibreNMS model is recognised as this module type (see the badge above).
+    Only the serial differs, so the module may have been physically replaced.
+</div>
+{% elif serial_mismatch %}
+<div class="alert alert-secondary py-2 mb-3">
+    <i class="mdi mdi-help-circle-outline me-1"></i>
+    The LibreNMS model isn't recognised as a NetBox module type, so only the serial can be compared —
+    it differs from the installed module.
 </div>
 {% endif %}
 
diff --git a/netbox_librenms_plugin/tests/test_coverage_tables.py b/netbox_librenms_plugin/tests/test_coverage_tables.py
index 5f6011b8ff..677169de9a 100644
--- a/netbox_librenms_plugin/tests/test_coverage_tables.py
+++ b/netbox_librenms_plugin/tests/test_coverage_tables.py
@@ -1445,6 +1445,16 @@ def test_server_key_stored(self):
 
         assert table.server_key == "prod"
 
+    def test_server_key_defaults_when_none(self):
+        """A None server_key must default to "default" — render_librenms_id passes self.server_key into get_librenms_device_id, and a None key would miss {"default": 42} custom-field values."""
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        mock_device = MagicMock()
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(data=[], device=mock_device, server_key=None)
+
+        assert table.server_key == "default"
+
 
 # ===========================================================================
 # LibreNMSInterfaceTable._parse_group_id tests
@@ -2158,14 +2168,21 @@ def _table(self):
 
         return object.__new__(LibreNMSInterfaceTable)
 
+    def _mapping(self, librenms_type, librenms_speed):
+        m = MagicMock()
+        m.librenms_type = librenms_type
+        m.librenms_speed = librenms_speed
+        return m
+
     def test_exact_match_returned(self):
         from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
 
         table = object.__new__(LibreNMSInterfaceTable)
-        mapping = MagicMock()
+        mapping = self._mapping("ethernetCsmacd", 1000000)
 
+        # The mappings are snapshotted once via .all() and resolved in memory.
         with patch("netbox_librenms_plugin.tables.interfaces.InterfaceTypeMapping") as mock_model:
-            mock_model.objects.filter.return_value.first.return_value = mapping
+            mock_model.objects.all.return_value = [mapping]
             result = table.get_interface_mapping("ethernetCsmacd", 1000000)
 
         assert result is mapping
@@ -2174,20 +2191,11 @@ def test_fallback_type_only_match(self):
         from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
 
         table = object.__new__(LibreNMSInterfaceTable)
-        fallback_mapping = MagicMock()
-
-        def mock_filter_side_effect(**kwargs):
-            mock_qs = MagicMock()
-            if "librenms_speed" in kwargs and kwargs["librenms_speed"] is not None:
-                # Exact match with speed → returns None
-                mock_qs.first.return_value = None
-            else:
-                # Type-only match
-                mock_qs.first.return_value = fallback_mapping
-            return mock_qs
+        # Only a type-only (speed is None) mapping exists; the exact (type, speed) lookup misses.
+        fallback_mapping = self._mapping("ethernetCsmacd", None)
 
         with patch("netbox_librenms_plugin.tables.interfaces.InterfaceTypeMapping") as mock_model:
-            mock_model.objects.filter.side_effect = mock_filter_side_effect
+            mock_model.objects.all.return_value = [fallback_mapping]
             result = table.get_interface_mapping("ethernetCsmacd", 1000000)
 
         assert result is fallback_mapping
@@ -2198,11 +2206,26 @@ def test_no_match_returns_none(self):
         table = object.__new__(LibreNMSInterfaceTable)
 
         with patch("netbox_librenms_plugin.tables.interfaces.InterfaceTypeMapping") as mock_model:
-            mock_model.objects.filter.return_value.first.return_value = None
+            mock_model.objects.all.return_value = []
             result = table.get_interface_mapping("unknown_type", 0)
 
         assert result is None
 
+    def test_mappings_snapshotted_once_for_repeated_lookups(self):
+        """The mapping table is read once (InterfaceTypeMapping.objects.all()), not per lookup, so a multi-row render doesn't re-query the static table."""
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        table = object.__new__(LibreNMSInterfaceTable)
+        m1 = self._mapping("ethernetCsmacd", 1000000)
+        m2 = self._mapping("ethernetCsmacd", None)
+
+        with patch("netbox_librenms_plugin.tables.interfaces.InterfaceTypeMapping") as mock_model:
+            mock_model.objects.all.return_value = [m1, m2]
+            for _ in range(5):
+                table.get_interface_mapping("ethernetCsmacd", 1000000)
+
+        assert mock_model.objects.all.call_count == 1
+
 
 # ===========================================================================
 # LibreNMSInterfaceTable render_mapping_tooltip tests
@@ -2647,3 +2670,46 @@ def test_tagged_vlans_from_netbox_interface_stored(self):
 
         assert "200" in result
         assert "300" in result
+
+
+class TestInterfaceTableXSSEscaping:
+    """Issue #105: _render_field / render_librenms_id must escape untrusted LibreNMS values (ifName, description, MAC, …) instead of rendering them as live HTML (stored XSS)."""
+
+    XSS = "<img src=x onerror=alert(1)>"
+
+    def test_render_field_escapes_value_when_not_in_netbox(self):
+        table = _make_interface_table()
+        rendered = str(table._render_field(self.XSS, {"exists_in_netbox": False}, "ifName", "name"))
+        assert "<img" not in rendered
+        assert "&lt;img" in rendered
+
+    def test_render_field_escapes_value_on_mismatch(self):
+        table = _make_interface_table()
+        nb = MagicMock()
+        nb.name = "eth0"
+        record = {"exists_in_netbox": True, "netbox_interface": nb, "ifName": self.XSS}
+        rendered = str(table._render_field(self.XSS, record, "ifName", "name"))
+        assert "<img" not in rendered
+        assert "&lt;img" in rendered
+
+    def test_render_librenms_id_escapes_value(self):
+        table = _make_interface_table()
+        rendered = str(table.render_librenms_id(self.XSS, {"exists_in_netbox": False}))
+        assert "<img" not in rendered
+        assert "&lt;img" in rendered
+
+    def test_render_vlans_escapes_malicious_vid(self):
+        """Sibling sink to #105: a malicious VLAN id from LibreNMS must be escaped in both the inline summary and the tooltip rather than rendered as live HTML."""
+        table = _make_interface_table()
+        record = {
+            "untagged_vlan": self.XSS,
+            "tagged_vlans": [],
+            "missing_vlans": [],
+            "exists_in_netbox": False,
+            "netbox_interface": None,
+            "vlan_group_map": {},
+            "ifName": "eth0",
+        }
+        rendered = str(table.render_vlans(value=None, record=record))
+        assert "<img" not in rendered
+        assert "&lt;img" in rendered
diff --git a/netbox_librenms_plugin/tests/test_module_interface_bind_message.py b/netbox_librenms_plugin/tests/test_module_interface_bind_message.py
new file mode 100644
index 0000000000..ba53ff39b8
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_module_interface_bind_message.py
@@ -0,0 +1,94 @@
+"""Real-DB e2e: UpdateModuleInterfaceView must not announce "Updated interface" for a no-op rebind.
+
+When the clicked row's LibreNMS port already sits on the module's interface, ``_bind_interface_librenms_id``
+returns ``{"status": "bound", "changed": False, ...}`` — nothing was written. The success message
+must gate on ``changed`` so a no-op click doesn't tell the user an interface was updated when it wasn't.
+
+These drive the real view end-to-end: real Device/ModuleType/ModuleBay/Module/Interface, real request,
+real message framework. The LibreNMS HTTP boundary is never touched (server_key is posted, and the
+module type carries no interface templates so adoption resolves to a real no-op).
+"""
+
+import pytest
+from django.contrib.auth import get_user_model
+from django.contrib.messages.storage.fallback import FallbackStorage
+from django.test import RequestFactory
+
+
+def _seed(name, *, port_id_on_interface):
+    from dcim.models import (
+        Device,
+        DeviceRole,
+        DeviceType,
+        Interface,
+        Manufacturer,
+        Module,
+        ModuleBay,
+        ModuleType,
+        Site,
+    )
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="MIB-Mfr", slug="mib-mfr")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="MIB-DT", slug="mib-dt")
+    role, _ = DeviceRole.objects.get_or_create(name="MIB-Role", slug="mib-role")
+    site, _ = Site.objects.get_or_create(name="MIB-Site", slug="mib-site")
+    device = Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
+
+    # A module type with NO interface templates: _adopt_existing_template_interfaces resolves to a
+    # real "skipped" (nothing to adopt), leaving the port-bind result as the summary.
+    mtype = ModuleType.objects.create(manufacturer=mfr, model=f"MT-{name}")
+    bay = ModuleBay.objects.create(device=device, name=f"Bay-{name}")
+    module = Module.objects.create(device=device, module_bay=bay, module_type=mtype)
+
+    iface = Interface.objects.create(device=device, name="Gi0/1", type="1000base-t", module=module)
+    if port_id_on_interface is not None:
+        # Pre-bind the LibreNMS port_id for server_key "default" so the rebind is a genuine no-op.
+        iface.custom_field_data = {"librenms_id": {"default": port_id_on_interface}}
+        iface.save()
+    return device, module, iface
+
+
+def _post(device, module, *, port_id, ifname):
+    request = RequestFactory().post(
+        f"/modules/{device.pk}/interface/",
+        data={
+            "module_id": str(module.pk),
+            "server_key": "default",
+            "librenms_port_id": str(port_id),
+            "librenms_ifname": ifname,
+        },
+    )
+    request.user = get_user_model().objects.create_superuser(username=f"mib-{device.pk}", email="", password="x")
+    request.session = {}
+    setattr(request, "_messages", FallbackStorage(request))
+    return request
+
+
+def _drive(device, module, *, port_id, ifname):
+    from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+    view = UpdateModuleInterfaceView()
+    request = _post(device, module, port_id=port_id, ifname=ifname)
+    view.request = request  # dispatch() normally wires this; we call post() directly
+    view.post(request, pk=device.pk)
+    return [(m.level_tag, m.message) for m in request._messages]
+
+
+@pytest.mark.django_db
+class TestUpdateModuleInterfaceBindMessage:
+    def test_noop_rebind_shows_no_updated_interface_message(self):
+        # Interface already mapped to port_id 500 → posting the same port_id is a no-op.
+        device, module, _iface = _seed("mib-noop", port_id_on_interface=500)
+        messages = _drive(device, module, port_id=500, ifname="Gi0/1")
+
+        joined = " || ".join(msg for _, msg in messages)
+        assert not any("Updated interface" in msg for _, msg in messages), joined
+
+    def test_real_rebind_still_announces_updated_interface(self):
+        # Positive control: the interface has NO port binding yet, so posting a port_id actually
+        # writes it (changed=True) and the confirmation message must appear.
+        device, module, _iface = _seed("mib-real", port_id_on_interface=None)
+        messages = _drive(device, module, port_id=600, ifname="Gi0/1")
+
+        joined = " || ".join(msg for _, msg in messages)
+        assert any("Updated interface" in msg for _, msg in messages), joined
diff --git a/netbox_librenms_plugin/tests/test_module_replace.py b/netbox_librenms_plugin/tests/test_module_replace.py
index 802f88cad8..353e95415a 100644
--- a/netbox_librenms_plugin/tests/test_module_replace.py
+++ b/netbox_librenms_plugin/tests/test_module_replace.py
@@ -2,6 +2,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -204,6 +206,128 @@ def test_serial_conflict_passed_to_template(self):
         assert ctx["serial_conflict"] is conflict_module
 
 
+@pytest.mark.django_db
+class TestModuleMismatchTypeMatchedBadge:
+    """The mismatch modal badges the LibreNMS model as matched when it resolves to the installed type.
+
+    DB-backed and rendering the REAL template (the sibling tests above patch render/resolve): builds a
+    real ModuleTypeMapping so a LibreNMS model string that DIFFERS from the NetBox type still resolves
+    to it — the user's serial-mismatch case where only text said "same type".
+    """
+
+    def _build(self, *, installed_type_model, mapped_type_model, librenms_model, installed_serial, librenms_serial):
+        from dcim.models import (
+            Device,
+            DeviceRole,
+            DeviceType,
+            Manufacturer,
+            Module,
+            ModuleBay,
+            ModuleType,
+            Site,
+        )
+
+        from netbox_librenms_plugin.models import ModuleTypeMapping
+
+        tag = mapped_type_model.lower().replace(" ", "-")
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-mmb-{tag}", slug=f"mfr-mmb-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-mmb-{tag}", slug=f"dt-mmb-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name=f"Role-mmb-{tag}", slug=f"role-mmb-{tag}")
+        site, _ = Site.objects.get_or_create(name=f"Site-mmb-{tag}", slug=f"site-mmb-{tag}")
+        device = Device.objects.create(name=f"host-mmb-{tag}", device_type=dt, role=role, site=site, status="active")
+
+        installed_type = ModuleType.objects.create(manufacturer=mfr, model=installed_type_model)
+        mapped_type = (
+            installed_type
+            if mapped_type_model == installed_type_model
+            else ModuleType.objects.create(manufacturer=mfr, model=mapped_type_model)
+        )
+        # The LibreNMS model string DIFFERS from the NetBox type model but maps to it (the user's case).
+        ModuleTypeMapping.objects.create(
+            librenms_model=librenms_model, netbox_module_type=mapped_type, manufacturer=mfr
+        )
+
+        bay = ModuleBay.objects.create(device=device, name="Slot 1")
+        module = Module.objects.create(
+            device=device, module_bay=bay, module_type=installed_type, serial=installed_serial
+        )
+        return device, module
+
+    def _render_modal(self, device, module, librenms_model, librenms_serial):
+        from unittest.mock import MagicMock
+
+        from django.contrib.auth.models import AnonymousUser
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.sync.modules import (
+            ModuleMismatchPreviewView,
+            _get_sync_device_for_inventory,
+        )
+
+        view = object.__new__(ModuleMismatchPreviewView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        request = RequestFactory().get("/", {"module_id": str(module.pk), "ent_index": "100", "server_key": "default"})
+        request.user = AnonymousUser()
+        view.setup(request)
+
+        sync_device = _get_sync_device_for_inventory(device, "default")
+        ckey = view.get_cache_key(sync_device, "inventory", server_key="default")
+        cache.set(
+            ckey,
+            {
+                "inventory": [
+                    {
+                        "entPhysicalIndex": 100,
+                        "entPhysicalModelName": librenms_model,
+                        "entPhysicalSerialNum": librenms_serial,
+                    }
+                ],
+                "librenms_id": 1,
+            },
+        )
+        try:
+            with patch.object(view, "require_object_permissions", return_value=None):
+                resp = view.get(request, pk=device.pk)
+        finally:
+            cache.delete(ckey)
+        return resp
+
+    def test_matched_model_shows_check_badge(self):
+        """A mapped LibreNMS model (different string, same type) renders the matched check badge."""
+        device, module = self._build(
+            installed_type_model="MDA-s36-400gb-qsfpdd",
+            mapped_type_model="MDA-s36-400gb-qsfpdd",
+            librenms_model="3HE12391AARK01",
+            installed_serial="",  # NetBox has no serial (the user's exact case)
+            librenms_serial="NS2217F6334",
+        )
+        resp = self._render_modal(device, module, "3HE12391AARK01", "NS2217F6334")
+
+        assert resp.status_code == 200
+        html = resp.content.decode()
+        assert "mdi-check-decagram" in html  # the matched badge is present
+        assert "Recognised as NetBox module type MDA-s36-400gb-qsfpdd" in html
+        assert "3HE12391AARK01" in html  # the differing LibreNMS string is still shown
+
+    def test_mismatched_type_has_no_check_badge(self):
+        """When the LibreNMS model maps to a DIFFERENT type, no matched badge — the danger path shows."""
+        device, module = self._build(
+            installed_type_model="MDA-s36-400gb-qsfpdd",
+            mapped_type_model="XMA-other-type",
+            librenms_model="3HE-OTHER-PN",
+            installed_serial="EXISTING",
+            librenms_serial="NS-NEW",
+        )
+        resp = self._render_modal(device, module, "3HE-OTHER-PN", "NS-NEW")
+
+        assert resp.status_code == 200
+        html = resp.content.decode()
+        assert "mdi-check-decagram" not in html  # type mismatch → no matched badge
+        assert "Different module type" in html
+
+
 # ---------------------------------------------------------------------------
 # ReplaceModuleView
 # ---------------------------------------------------------------------------
diff --git a/netbox_librenms_plugin/tests/test_modules_view.py b/netbox_librenms_plugin/tests/test_modules_view.py
index 1284eabd6e..f38776dfd9 100644
--- a/netbox_librenms_plugin/tests/test_modules_view.py
+++ b/netbox_librenms_plugin/tests/test_modules_view.py
@@ -167,6 +167,36 @@ def test_existing_inventory_item_gets_port_identity_metadata(self):
         assert item["_librenms_port_id"] == 99
         assert item["_librenms_ifname"] == "Eth2/1"
 
+    def test_string_index_matches_int_transceiver_index_no_duplicate(self):
+        # LibreNMS may report the ENTITY index as a string ("300") while the transceiver API
+        # returns it as an int (300). Without normalization the merge misses the existing ENTITY
+        # row and caches a duplicate synthetic transceiver; coercing both sides to int matches it.
+        view = _make_view()
+        view.librenms_id = 103
+        view._librenms_api.get_device_transceivers.return_value = (
+            True,
+            [{"entity_physical_index": 300, "model": "SFP-10G-SR", "serial": "TX-300", "type": "SFP", "port_id": 7}],
+        )
+        view._librenms_api.get_ports.return_value = (True, {"ports": [{"port_id": 7, "ifName": "Eth3/1"}]})
+        inventory_seed = [
+            {
+                "entPhysicalIndex": "300",  # string index from ENTITY-MIB
+                "entPhysicalName": "Transceiver slot",
+                "entPhysicalModelName": "builtin",
+                "entPhysicalSerialNum": "-",
+                "entPhysicalClass": "port",
+                "entPhysicalContainedIn": 0,
+            }
+        ]
+
+        inventory, error = view._merge_transceiver_data(inventory_seed)
+
+        assert error is None
+        assert len(inventory) == 1  # supplemented in place, NOT duplicated
+        item = inventory[0]
+        assert item["entPhysicalModelName"] == "SFP-10G-SR"
+        assert item["_librenms_port_id"] == 7
+
     def test_enrich_inventory_port_identity_backfills_port_rows_from_ports_api(self):
         view = _make_view()
         view.librenms_id = 102
@@ -3400,7 +3430,7 @@ def test_no_fix_badge_without_model_incomplete(self):
 class TestMatchedInterfaceLinking:
     """Rows should expose matched NetBox interface metadata and render as links."""
 
-    def test_get_interfaces_by_port_id_ignores_duplicate_port_ids(self):
+    def test_build_interface_indexes_ignores_duplicate_port_ids(self):
         view = _make_view()
         interface_a = MagicMock()
         interface_b = MagicMock()
@@ -3410,13 +3440,13 @@ def test_get_interfaces_by_port_id_ignores_duplicate_port_ids(self):
 
         view._librenms_api.get_stored_librenms_id.side_effect = [42, 42, 43]
 
-        interface_map = view._get_interfaces_by_port_id(member)
+        interface_map, _ = view._build_interface_indexes(member)
 
         assert 42 not in interface_map
         assert interface_map[43] is interface_c
         view._librenms_api.get_librenms_id.assert_not_called()
 
-    def test_get_interfaces_by_name_ignores_duplicate_names(self):
+    def test_build_interface_indexes_ignores_duplicate_names(self):
         view = _make_view()
         interface_a = MagicMock()
         interface_a.name = "Te1/1/1"
@@ -3427,7 +3457,7 @@ def test_get_interfaces_by_name_ignores_duplicate_names(self):
         member = MagicMock()
         member.interfaces.all.return_value = [interface_a, interface_b, interface_c]
 
-        interface_map = view._get_interfaces_by_name(member)
+        _, interface_map = view._build_interface_indexes(member)
 
         assert "Te1/1/1" not in interface_map
         assert interface_map["Te1/1/2"] is interface_c
diff --git a/netbox_librenms_plugin/tests/test_sync_modules.py b/netbox_librenms_plugin/tests/test_sync_modules.py
index 1931f83b2d..1f74626602 100644
--- a/netbox_librenms_plugin/tests/test_sync_modules.py
+++ b/netbox_librenms_plugin/tests/test_sync_modules.py
@@ -10,6 +10,8 @@
 from contextlib import contextmanager
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 @contextmanager
 def _patch_build_row_deps(view, match_bay_return=None):
@@ -122,110 +124,73 @@ def test_self_reference_does_not_loop(self):
         assert len(items) == 0
 
 
+@pytest.mark.django_db
 class TestGetModuleTypesIndexed:
-    """get_module_types_indexed builds a dict keyed by model name, part number, and mappings."""
-
-    def test_indexes_by_model_and_part_number(self):
-        from netbox_librenms_plugin.utils import get_module_types_indexed
-
-        mt1 = MagicMock()
-        mt1.model = "WS-X4748"
-        mt1.part_number = "ALT-PART-4748"
+    """get_module_types_indexed keys real ModuleTypes by model/part-number with ModuleTypeMappings applied."""
 
-        mt2 = MagicMock()
-        mt2.model = "WS-X4516"
-        mt2.part_number = "WS-X4516"  # same as model → no extra key
+    @staticmethod
+    def _mfr(name):
+        from dcim.models import Manufacturer
 
-        mock_mapping = MagicMock()
-        mock_mapping.librenms_model = "libre-model-a"
-        mock_mapping.netbox_module_type = mt1
-        mock_mapping.manufacturer_id = None
+        return Manufacturer.objects.create(name=name, slug=name.lower())
 
-        mock_mt_cls = MagicMock()
-        mock_mt_cls.objects.all.return_value.select_related.return_value.prefetch_related.return_value = [mt1, mt2]
+    @staticmethod
+    def _mtype(mfr, model, part_number=""):
+        from dcim.models import ModuleType
 
-        mock_map_cls = MagicMock()
-        mock_map_cls.objects.select_related.return_value.prefetch_related.return_value = [mock_mapping]
+        return ModuleType.objects.create(manufacturer=mfr, model=model, part_number=part_number)
 
-        with patch.dict(
-            "sys.modules",
-            {
-                "dcim.models": type("m", (), {"ModuleType": mock_mt_cls})(),
-            },
-        ):
-            with patch("netbox_librenms_plugin.models.ModuleTypeMapping", mock_map_cls):
-                result = get_module_types_indexed()
+    @staticmethod
+    def _mapping(librenms_model, netbox_module_type, manufacturer=None):
+        from netbox_librenms_plugin.models import ModuleTypeMapping
 
-        assert result["WS-X4748"] is mt1
-        assert result["ALT-PART-4748"] is mt1
-        assert result["WS-X4516"] is mt2
-        assert result["libre-model-a"] is mt1
+        return ModuleTypeMapping.objects.create(
+            librenms_model=librenms_model, netbox_module_type=netbox_module_type, manufacturer=manufacturer
+        )
 
-    def test_mapping_overrides_ambiguous_base_key(self):
-        """A unique ModuleTypeMapping entry overrides a base key that became ambiguous."""
+    def test_indexes_by_model_and_part_number(self):
+        """ModuleTypes are keyed by model and part_number, and a global mapping adds its librenms_model key."""
         from netbox_librenms_plugin.utils import get_module_types_indexed
 
-        # Two ModuleTypes share the same model name → base key becomes ambiguous
-        mt1 = MagicMock()
-        mt1.model = "SFP-1G-LX"
-        mt1.part_number = ""
+        mfr = self._mfr("IdxA")
+        mt1 = self._mtype(mfr, "WS-X4748-IDX", "ALT-PART-4748-IDX")
+        mt2 = self._mtype(mfr, "WS-X4516-IDX", "WS-X4516-IDX")  # part_number == model → single key
+        self._mapping("libre-model-a-idx", mt1)
 
-        mt2 = MagicMock()
-        mt2.model = "SFP-1G-LX"  # same → ambiguous in base pass
-        mt2.part_number = ""
+        result = get_module_types_indexed()
 
-        # Explicit mapping for a distinct key → should be present despite base ambiguity
-        mock_mapping = MagicMock()
-        mock_mapping.librenms_model = "SFP-1G-LX-EXPLICIT"
-        mock_mapping.netbox_module_type = mt1
-        mock_mapping.manufacturer_id = None
+        assert result["WS-X4748-IDX"] == mt1
+        assert result["ALT-PART-4748-IDX"] == mt1
+        assert result["WS-X4516-IDX"] == mt2
+        assert result["libre-model-a-idx"] == mt1
 
-        mock_mt_cls = MagicMock()
-        mock_mt_cls.objects.all.return_value.select_related.return_value.prefetch_related.return_value = [mt1, mt2]
+    def test_mapping_overrides_ambiguous_base_key(self):
+        """A unique ModuleTypeMapping survives even though the colliding base model key is dropped."""
+        from netbox_librenms_plugin.utils import get_module_types_indexed
 
-        mock_map_cls = MagicMock()
-        mock_map_cls.objects.select_related.return_value.prefetch_related.return_value = [mock_mapping]
+        # Two ModuleTypes (distinct manufacturers, since (manufacturer, model) is unique) share a
+        # model name → that base key collides and is dropped from the index.
+        mt1 = self._mtype(self._mfr("AmbA"), "SFP-1G-LX-IDX")
+        self._mtype(self._mfr("AmbB"), "SFP-1G-LX-IDX")
+        self._mapping("SFP-1G-LX-EXPLICIT-IDX", mt1)
 
-        with patch.dict(
-            "sys.modules",
-            {
-                "dcim.models": type("m", (), {"ModuleType": mock_mt_cls})(),
-            },
-        ):
-            with patch("netbox_librenms_plugin.models.ModuleTypeMapping", mock_map_cls):
-                result = get_module_types_indexed()
+        result = get_module_types_indexed()
 
-        # Base key was ambiguous and must be absent; explicit mapping key must be present
-        assert "SFP-1G-LX" not in result
-        assert result["SFP-1G-LX-EXPLICIT"] is mt1
+        assert "SFP-1G-LX-IDX" not in result  # ambiguous base key dropped
+        assert result["SFP-1G-LX-EXPLICIT-IDX"] == mt1  # explicit mapping still resolves
 
     def test_manufacturer_scoped_mapping_kept_separate_from_base_index(self):
-        """A manufacturer-scoped ModuleTypeMapping must not pollute the global key space."""
+        """A manufacturer-scoped mapping lives only in mfr_mappings, never the global key space."""
         from netbox_librenms_plugin.utils import get_module_types_indexed
 
-        mt_juniper = MagicMock()
-        mt_juniper.model = "QSFP-100G-LR4-JUNIPER"
-        mt_juniper.part_number = ""
-
-        mock_mapping = MagicMock()
-        mock_mapping.librenms_model = "1F3QAA"
-        mock_mapping.netbox_module_type = mt_juniper
-        mock_mapping.manufacturer_id = 42  # scoped → must NOT enter the global dict
+        mfr = self._mfr("JuniperIdx")
+        mt = self._mtype(mfr, "QSFP-100G-LR4-JUNIPER-IDX")
+        self._mapping("1F3QAA-IDX", mt, manufacturer=mfr)
 
-        mock_mt_cls = MagicMock()
-        mock_mt_cls.objects.all.return_value.select_related.return_value.prefetch_related.return_value = [mt_juniper]
+        result = get_module_types_indexed()
 
-        mock_map_cls = MagicMock()
-        mock_map_cls.objects.select_related.return_value.prefetch_related.return_value = [mock_mapping]
-
-        with patch.dict("sys.modules", {"dcim.models": type("m", (), {"ModuleType": mock_mt_cls})()}):
-            with patch("netbox_librenms_plugin.models.ModuleTypeMapping", mock_map_cls):
-                result = get_module_types_indexed()
-
-        # The vendor-scoped librenms_model must NOT leak into the global lookup
-        assert "1F3QAA" not in result
-        # …but it must be reachable via the per-manufacturer side index
-        assert result.mfr_mappings[(42, "1F3QAA")] is mt_juniper
+        assert "1F3QAA-IDX" not in result  # vendor-scoped key must not leak globally
+        assert result.mfr_mappings[(mfr.pk, "1F3QAA-IDX")] == mt
 
 
 class TestResolveModuleTypeManufacturerScope:
@@ -299,6 +264,13 @@ def test_install_module_view_not_in_base(self):
             "InstallModuleView must be defined in views/sync/modules.py, not views/base/"
         )
 
+    def test_has_librenms_api_mixin(self):
+        """InstallModuleView needs LibreNMSAPIMixin so a blank posted server_key can fall back to the client key (like InstallBranchView)."""
+        from netbox_librenms_plugin.views.mixins import LibreNMSAPIMixin
+        from netbox_librenms_plugin.views.sync.modules import InstallModuleView
+
+        assert LibreNMSAPIMixin in InstallModuleView.__mro__
+
 
 class TestInstallBranchViewWiring:
     """InstallBranchView must have CacheMixin for cache key generation."""
@@ -1241,7 +1213,9 @@ def noop_atomic():
         assert result["status"] == "bound"
         assert result["adopted_count"] == 1
         assert result["interfaces"] == ["TenGigabitEthernet3/1/1"]
-        mock_interface_model.objects.filter.assert_called_once_with(
+        # The standalone lookup is still issued (the function now also queries the module's
+        # own interfaces to detect raw duplicates, so it is no longer the only filter call).
+        mock_interface_model.objects.filter.assert_any_call(
             device=device,
             module__isnull=True,
             name__in=["TenGigabitEthernet3/1/1"],
@@ -1494,6 +1468,499 @@ def test_coordinate_fallback_skips_when_top_score_is_ambiguous(self):
         assert "multiple module interfaces found" in result["reason"]
 
 
+@pytest.mark.django_db
+class TestAdoptMergesRawDuplicateInterface:
+    """Real-DB: adopting folds the module's raw twin into the externally-created interface.
+
+    Reproduces the Nokia/INR scenario: the module owns a raw interface (``2/x1/1/c28``)
+    bound to a LibreNMS port, while a separate standalone interface already carries the
+    INR-renamed name (``2/x1/1/c28/1``) plus a cable — so INR's rename was skipped on the
+    name collision. Adopting must claim the standalone (keeping its cable), move the
+    LibreNMS port binding off the raw twin, and delete the now-redundant raw twin.
+    """
+
+    def _build(self):
+        from dcim.models import (
+            Cable,
+            Device,
+            DeviceRole,
+            DeviceType,
+            Interface,
+            InterfaceTemplate,
+            Manufacturer,
+            Module,
+            ModuleBay,
+            ModuleType,
+            Site,
+        )
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Nokia-adopt", slug="nokia-adopt")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="7750-adopt", slug="7750-adopt")
+        role, _ = DeviceRole.objects.get_or_create(name="rtr-adopt", slug="rtr-adopt")
+        site, _ = Site.objects.get_or_create(name="site-adopt", slug="site-adopt")
+        device = Device.objects.create(name="adopt-host", device_type=dt, role=role, site=site, status="active")
+
+        mt = ModuleType.objects.create(manufacturer=mfr, model="QSFP-DD-adopt")
+        InterfaceTemplate.objects.create(module_type=mt, name="2/x1/1/c28", type="other")
+        bay = ModuleBay.objects.create(device=device, name="2/x1/1/c28")
+        module = Module.objects.create(device=device, module_bay=bay, module_type=mt)
+
+        # Deterministic interface set: clear any auto-instantiated module components.
+        Interface.objects.filter(device=device).delete()
+
+        # Raw module interface (template name) bound to LibreNMS port 627.
+        raw = Interface.objects.create(device=device, module=module, name="2/x1/1/c28", type="other")
+        raw.custom_field_data["librenms_id"] = {"production": 627}
+        raw.save(update_fields=["custom_field_data"])
+
+        # Externally-created standalone with the INR-renamed name, carrying a cable.
+        standalone = Interface.objects.create(device=device, name="2/x1/1/c28/1", type="other")
+        peer = Interface.objects.create(device=device, name="peer", type="other")
+        cable = Cable(a_terminations=[standalone], b_terminations=[peer])
+        cable.save()
+
+        return device, module, raw, standalone, cable
+
+    def test_adopt_merges_raw_twin_preserving_cable_and_binding(self):
+        from django.dispatch import receiver
+
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.utils import get_librenms_device_id
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        device, module, raw, standalone, cable = self._build()
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            # Mirrors the real INR rule '/QSFP-DD.*/ [timos] → {base}/1'.
+            return [f"{n}/1" for n in names]
+
+        try:
+            result = _adopt_existing_template_interfaces(device, module, "production")
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The externally-created standalone is now the module's interface...
+        standalone.refresh_from_db()
+        assert standalone.module_id == module.pk
+        # ...and keeps its cable (its external relations survive the adopt).
+        assert standalone.cable_id == cable.pk
+        # The raw template twin is folded in, not left as a duplicate.
+        assert not Interface.objects.filter(pk=raw.pk).exists()
+        # The LibreNMS port binding moved from the raw twin onto the adopted interface.
+        assert get_librenms_device_id(standalone, "production") == 627
+
+        assert result["status"] == "bound"
+        assert result["adopted_count"] == 1
+        assert result["merged_count"] == 1
+        assert result["interfaces"] == ["2/x1/1/c28/1"]
+
+    def test_cabled_raw_twin_is_left_in_place(self):
+        """A raw twin that itself carries a cable is not deleted (no silent connection loss)."""
+        from django.dispatch import receiver
+
+        from dcim.models import Cable, Interface
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        device, module, raw, standalone, _cable = self._build()
+        # Give the raw twin its own cable so deleting it would drop a connection.
+        raw_peer = Interface.objects.create(device=device, name="raw-peer", type="other")
+        raw_cable = Cable(a_terminations=[raw], b_terminations=[raw_peer])
+        raw_cable.save()
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            result = _adopt_existing_template_interfaces(device, module, "production")
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The standalone is still adopted, but the cabled raw twin survives and is reported.
+        standalone.refresh_from_db()
+        assert standalone.module_id == module.pk
+        assert Interface.objects.filter(pk=raw.pk).exists()
+        assert result.get("merged_count") is None
+        assert result["cabled_duplicates"] == ["2/x1/1/c28"]
+
+    def test_update_interface_view_reconciles_when_port_bind_is_noop(self):
+        """The reported bug: the view must adopt/merge even when the LibreNMS port-bind is a no-op.
+
+        Posting the port id that already sits on the module's raw interface makes
+        ``_bind_interface_librenms_id`` return a no-op "bound" result. Previously that
+        short-circuited the adopt; now the adopt/merge still runs end-to-end.
+        """
+        from django.dispatch import receiver
+
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, raw, standalone, _cable = self._build()
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        request = _make_request(
+            "POST",
+            data={
+                "module_id": str(module.pk),
+                "server_key": "production",
+                # Port 627 already sits on the module's raw interface → the port-bind no-ops.
+                "librenms_port_id": "627",
+                "librenms_ifname": "2/x1/1/c28",
+            },
+        )
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            with (
+                patch.object(view, "require_all_permissions", return_value=None),
+                patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_msg,
+            ):
+                view.post(request, pk=device.pk)
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The standalone is adopted and the raw twin folded in (was a silent no-op before).
+        standalone.refresh_from_db()
+        assert standalone.module_id == module.pk
+        assert not Interface.objects.filter(pk=raw.pk).exists()
+        # The success message reports the real outcome, not a misleading no-op "bound".
+        assert mock_msg.success.called
+        success_text = mock_msg.success.call_args[0][1]
+        assert "adopted 1" in success_text
+        assert "removed 1 duplicate" in success_text
+
+    def test_real_port_bind_confirmation_survives_concurrent_adopt(self):
+        """A click that BOTH (re)binds a port AND adopts standalones must surface the port-bind
+        confirmation, not let the adopt summary swallow it.
+
+        Before the fix, ``bind_result = adopt_result`` discarded the port-bind's
+        interface/port_id detail whenever adoption also reported "bound", so the user never
+        saw which port_id was bound.
+        """
+        from django.dispatch import receiver
+
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, raw, standalone, _cable = self._build()
+        # A separate module interface that is not yet bound: the POSTed port 999 REALLY binds it
+        # (update_fields set → changed=True), distinct from the adopt of the template twin.
+        Interface.objects.create(device=device, module=module, name="extra-port", type="other")
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        request = _make_request(
+            "POST",
+            data={
+                "module_id": str(module.pk),
+                "server_key": "production",
+                "librenms_port_id": "999",
+                "librenms_ifname": "extra-port",
+            },
+        )
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            with (
+                patch.object(view, "require_all_permissions", return_value=None),
+                patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_msg,
+            ):
+                view.post(request, pk=device.pk)
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        success_texts = [call.args[1] for call in mock_msg.success.call_args_list]
+        # The real port-bind confirmation is present (dropped before the fix)...
+        assert any("extra-port" in t and "999" in t for t in success_texts), success_texts
+        # ...and the adopt summary is still present.
+        assert any("adopted 1" in t for t in success_texts), success_texts
+
+    def test_adopt_moves_assigned_ips_to_adopted_interface(self):
+        """An IP assigned to the raw twin (even the device's primary IP) must be MOVED to the adopted interface — Interface.ip_addresses cascade-deletes on interface delete, so the old code silently destroyed it and SET_NULL wiped Device.primary_ip4."""
+        from django.dispatch import receiver
+
+        from dcim.models import Interface
+        from ipam.models import IPAddress
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        device, module, raw, standalone, _cable = self._build()
+        ip = IPAddress.objects.create(address="192.0.2.10/24", assigned_object=raw)
+        device.primary_ip4 = ip
+        device.save(update_fields=["primary_ip4"])
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            result = _adopt_existing_template_interfaces(device, module, "production")
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The raw twin is still folded in...
+        assert not Interface.objects.filter(pk=raw.pk).exists()
+        assert result.get("merged_count") == 1
+        # ...but its IP survives, reassigned to the authoritative adopted interface...
+        ip.refresh_from_db()
+        assert ip.assigned_object_id == standalone.pk
+        # ...so the device's primary IP is intact (on_delete=SET_NULL would have nulled it).
+        device.refresh_from_db()
+        assert device.primary_ip4_id == ip.pk
+
+    def test_blank_server_key_never_deletes_a_bound_raw_twin(self):
+        """With no server scope the raw twin's LibreNMS binding cannot be transferred; the twin must be left in place for review (fail closed), not deleted with its binding silently destroyed."""
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        device, module, raw, standalone, _cable = self._build()
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            result = _adopt_existing_template_interfaces(device, module, "")
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The standalone is still adopted...
+        standalone.refresh_from_db()
+        assert standalone.module_id == module.pk
+        # ...but the bound raw twin survives with its binding untouched, reported for review.
+        raw.refresh_from_db()
+        assert raw.custom_field_data.get("librenms_id") == {"production": 627}
+        assert result.get("merged_count") is None
+        assert result["cabled_duplicates"] == ["2/x1/1/c28"]
+
+    def test_update_interface_view_blank_server_key_falls_back_and_transfers_binding(self):
+        """e2e: a POST without server_key (stale tab / fallback-rendered pane) must resolve the active server so the merge still transfers the raw twin's binding — the unfixed view passed the blank key straight through and the binding was destroyed with the twin."""
+        from django.dispatch import receiver
+
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.utils import get_librenms_device_id
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, raw, standalone, _cable = self._build()
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="production")  # blank posted server_key falls back to this
+        request = _make_request("POST", data={"module_id": str(module.pk)})  # NO server_key posted
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            with (
+                patch.object(view, "require_all_permissions", return_value=None),
+                patch("netbox_librenms_plugin.views.sync.modules.messages"),
+            ):
+                view.post(request, pk=device.pk)
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The merge ran under the resolved active server: twin folded, binding transferred.
+        standalone.refresh_from_db()
+        assert standalone.module_id == module.pk
+        assert not Interface.objects.filter(pk=raw.pk).exists()
+        assert get_librenms_device_id(standalone, "production") == 627
+
+    def test_failed_port_bind_reason_survives_successful_adoption(self):
+        """A non-bound port-bind outcome (conflict/skipped/failed) must be surfaced even when adoption succeeds — the adopt summary used to silently replace it, hiding e.g. a port-conflict from the user."""
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, raw, standalone, _cable = self._build()
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        request = _make_request(
+            "POST",
+            data={
+                "module_id": str(module.pk),
+                "server_key": "production",
+                # Port 641 resolves to the module's sole raw interface (single-module-interface
+                # fallback), which is already mapped to 627 → deterministic bind CONFLICT.
+                "librenms_port_id": "641",
+                "librenms_ifname": "no-such-interface",
+            },
+        )
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            with (
+                patch.object(view, "require_all_permissions", return_value=None),
+                patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_msg,
+            ):
+                view.post(request, pk=device.pk)
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        # The bind conflict is surfaced (silently dropped before the fix)...
+        warning_texts = [call.args[1] for call in mock_msg.warning.call_args_list]
+        assert any("Could not update interface association" in t and "627" in t for t in warning_texts), warning_texts
+        # ...and the adoption summary is still reported.
+        success_texts = [call.args[1] for call in mock_msg.success.call_args_list]
+        assert any("adopted 1" in t for t in success_texts), success_texts
+
+    def test_merge_locks_raw_twin_before_delete(self):
+        """The destructive delete must re-verify its preconditions from a locked row (select_for_update) so a concurrent cabling between the caller's read and the delete is not cascaded away."""
+        from django.db import connection
+        from django.dispatch import receiver
+        from django.test.utils import CaptureQueriesContext
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        device, module, _raw, _standalone, _cable = self._build()
+
+        @receiver(predict_module_interface_names)
+        def _append_channel(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            with CaptureQueriesContext(connection) as ctx:
+                result = _adopt_existing_template_interfaces(device, module, "production")
+        finally:
+            predict_module_interface_names.disconnect(_append_channel)
+
+        assert result.get("merged_count") == 1
+        assert any(
+            "for update" in q["sql"].lower() and "dcim_interface" in q["sql"].lower() for q in ctx.captured_queries
+        ), "raw twin was deleted without a select_for_update re-verify"
+
+    def test_htmx_swap_renders_page_device_panel_not_vc_member(self):
+        """The HTMX table swap replaces the PAGE device's module panel, so it must re-render for the page device even when the row action targeted a VC member — rendering the member's panel flips unrelated rows' bay matching (the page's own bays vanish)."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.contrib.messages.storage.fallback import FallbackStorage
+        from django.test import RequestFactory
+
+        from dcim.models import Device, Module, ModuleBay, VirtualChassis
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, _raw, _standalone, _cable = self._build()
+        # Make the page device a VC master with a member that owns its own module.
+        vc = VirtualChassis.objects.create(name="vc-panel-scope")
+        Device.objects.filter(pk=device.pk).update(virtual_chassis=vc, vc_position=1)
+        member = Device.objects.create(
+            name="panel-member",
+            device_type=device.device_type,
+            role=device.role,
+            site=device.site,
+            status="active",
+            virtual_chassis=vc,
+            vc_position=2,
+        )
+        member_bay = ModuleBay.objects.create(device=member, name="member-bay")
+        member_module = Module.objects.create(device=member, module_bay=member_bay, module_type=module.module_type)
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="production")
+        view.has_write_permission = MagicMock(return_value=True)
+
+        request = RequestFactory().post(
+            "/",
+            data={
+                "module_id": str(member_module.pk),
+                "selected_device_id": str(member.pk),
+                "server_key": "production",
+            },
+            HTTP_HX_REQUEST="true",
+        )
+        request.user = AnonymousUser()
+        request.session = "session"
+        request._messages = FallbackStorage(request)
+
+        rendered_for = []
+        original_get_context = DeviceModuleTableView.get_context_data
+
+        def _spy(self, request, obj, *args, **kwargs):
+            rendered_for.append(obj)
+            return original_get_context(self, request, obj, *args, **kwargs)
+
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.modules.messages"),
+            patch.object(DeviceModuleTableView, "get_context_data", _spy),
+        ):
+            response = view.post(request, pk=device.pk)
+
+        assert response.status_code == 200
+        # The action ran against the member, but the swapped panel is the page device's.
+        assert [d.pk for d in rendered_for] == [device.pk]
+
+
+class TestPredictModuleInterfaceRenameLengthGuard:
+    """predict_module_interface_rename enforces the 1:1, order-preserving receiver contract."""
+
+    def test_misaligned_receiver_result_is_ignored(self):
+        """A receiver returning fewer names than asked is rejected; identity names are kept."""
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.utils import predict_module_interface_rename
+
+        @receiver(predict_module_interface_names)
+        def _drop_one(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return list(names)[:-1]  # misaligned: one fewer than the input
+
+        try:
+            result = predict_module_interface_rename(object(), object(), ["a", "b", "c"])
+        finally:
+            predict_module_interface_names.disconnect(_drop_one)
+
+        assert result == ["a", "b", "c"]
+
+    def test_aligned_receiver_result_is_applied(self):
+        """Positive control: a correctly-sized receiver result IS used (guard isn't over-broad)."""
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.utils import predict_module_interface_rename
+
+        @receiver(predict_module_interface_names)
+        def _rename(sender, device, module, names, **kwargs):  # noqa: ARG001
+            return [f"{n}/1" for n in names]
+
+        try:
+            result = predict_module_interface_rename(object(), object(), ["a", "b"])
+        finally:
+            predict_module_interface_names.disconnect(_rename)
+
+        assert result == ["a/1", "b/1"]
+
+
 class TestSingleInstallInterfaceBinding:
     """Single-row install should resolve inventory identity and bind interfaces."""
 
@@ -1599,6 +2066,7 @@ def test_install_module_view_warns_when_binding_uses_post_fallback(self):
 
         view = object.__new__(InstallModuleView)
         view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
         device = _make_device()
 
         module_bay = MagicMock()
@@ -1646,34 +2114,123 @@ def noop_atomic():
             patch.object(ModuleBay, "objects") as mock_objects,
             patch.object(view, "get_cache_key", return_value="inv-key"),
             patch("netbox_librenms_plugin.views.sync.modules.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.modules.get_librenms_device_id", return_value=999),
+            patch("netbox_librenms_plugin.views.sync.modules.get_librenms_device_id", return_value=999),
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id",
+                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42},
+            ),
+        ):
+            mock_tx.atomic = noop_atomic
+            mock_module_cls.return_value = new_module
+            mock_objects.select_for_update.return_value = mock_qs
+            # Mismatched cache context triggers posted fallback path.
+            mock_cache.get.return_value = {
+                "librenms_id": 555,
+                "inventory": [
+                    {
+                        "entPhysicalIndex": 77,
+                        "_librenms_port_id": 42,
+                        "_librenms_ifname": "Te1/1/1",
+                    }
+                ],
+            }
+            view.post(request, pk=24)
+
+        assert any(
+            "Interface identity fallback used posted row metadata" in str(call)
+            for call in mock_messages.warning.call_args_list
+        )
+
+    def test_install_module_view_binds_interface_after_install(self):
+        from contextlib import contextmanager
+
+        from dcim.models import ModuleBay
+
+        from netbox_librenms_plugin.views.sync.modules import InstallModuleView
+
+        view = object.__new__(InstallModuleView)
+        view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
+        device = _make_device()
+
+        module_bay = MagicMock()
+        module_bay.name = "Slot 1"
+        module_bay.installed_module = None
+
+        module_type = MagicMock()
+        module_type.pk = 5
+        module_type.model = "SFP-10G-SR"
+
+        new_module = MagicMock()
+        new_module.pk = 321
+
+        request = _make_request(
+            "POST",
+            data={
+                "module_bay_id": "10",
+                "module_type_id": "5",
+                "serial": "SN1",
+                "server_key": "production",
+                "ent_index": "77",
+            },
+        )
+
+        @contextmanager
+        def noop_atomic():
+            yield
+
+        mock_qs = MagicMock()
+        mock_qs.get.return_value = module_bay
+
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.views.sync.modules.get_object_or_404",
+                side_effect=[device, module_bay, module_type],
+            ),
+            patch("netbox_librenms_plugin.views.sync.modules.reverse", return_value="/sync/"),
+            patch("netbox_librenms_plugin.views.sync.modules.transaction") as mock_tx,
+            patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_messages,
+            patch("netbox_librenms_plugin.views.sync.modules.redirect"),
+            patch("dcim.models.Module") as mock_module_cls,
+            patch.object(ModuleBay, "objects") as mock_objects,
+            patch.object(view, "get_cache_key", return_value="inv-key"),
+            patch("netbox_librenms_plugin.views.sync.modules.cache") as mock_cache,
             patch(
                 "netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id",
-                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42},
-            ),
+                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42, "changed": True},
+            ) as mock_bind,
         ):
             mock_tx.atomic = noop_atomic
             mock_module_cls.return_value = new_module
             mock_objects.select_for_update.return_value = mock_qs
-            # Mismatched cache context triggers posted fallback path.
             mock_cache.get.return_value = {
-                "librenms_id": 555,
                 "inventory": [
                     {
                         "entPhysicalIndex": 77,
                         "_librenms_port_id": 42,
                         "_librenms_ifname": "Te1/1/1",
                     }
-                ],
+                ]
             }
             view.post(request, pk=24)
 
-        assert any(
-            "Interface identity fallback used posted row metadata" in str(call)
-            for call in mock_messages.warning.call_args_list
-        )
+        mock_bind.assert_called_once()
+        bind_call = mock_bind.call_args
+        assert bind_call.args[0] is device
+        assert bind_call.args[2] == 321
+        assert bind_call.args[3] == "production"
+        assert bind_call.args[1]["_librenms_port_id"] == 42
+        mock_messages.info.assert_called()
 
-    def test_install_module_view_binds_interface_after_install(self):
+    def test_install_module_view_binds_with_blank_server_key_via_client_fallback(self):
+        """A blank posted server_key falls back to the resolved client server so the interface still binds.
+
+        The install form posts server_key="{{ module_sync.server_key|default:'' }}", so a fallback
+        render sends an empty server_key. Without LibreNMSAPIMixin + the `or self.librenms_api.server_key`
+        fallback (like InstallBranchView), `if bind_item and server_key` was skipped and the module
+        installed with its interface silently never bound. This pins the fallback.
+        """
         from contextlib import contextmanager
 
         from dcim.models import ModuleBay
@@ -1682,6 +2239,8 @@ def test_install_module_view_binds_interface_after_install(self):
 
         view = object.__new__(InstallModuleView)
         view.required_object_permissions = {}
+        # No POST server_key → must fall back to the bound client's server ("default").
+        view._librenms_api = MagicMock(server_key="default")
         device = _make_device()
 
         module_bay = MagicMock()
@@ -1701,7 +2260,7 @@ def test_install_module_view_binds_interface_after_install(self):
                 "module_bay_id": "10",
                 "module_type_id": "5",
                 "serial": "SN1",
-                "server_key": "production",
+                "server_key": "",  # blank — as a fallback render would post
                 "ent_index": "77",
             },
         )
@@ -1721,12 +2280,13 @@ def noop_atomic():
             ),
             patch("netbox_librenms_plugin.views.sync.modules.reverse", return_value="/sync/"),
             patch("netbox_librenms_plugin.views.sync.modules.transaction") as mock_tx,
-            patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_messages,
+            patch("netbox_librenms_plugin.views.sync.modules.messages"),
             patch("netbox_librenms_plugin.views.sync.modules.redirect"),
             patch("dcim.models.Module") as mock_module_cls,
             patch.object(ModuleBay, "objects") as mock_objects,
             patch.object(view, "get_cache_key", return_value="inv-key"),
             patch("netbox_librenms_plugin.views.sync.modules.cache") as mock_cache,
+            patch("netbox_librenms_plugin.views.sync.modules._get_sync_device_for_inventory", return_value=device),
             patch(
                 "netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id",
                 return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42},
@@ -1746,19 +2306,16 @@ def noop_atomic():
             }
             view.post(request, pk=24)
 
+        # The bind ran under the fallback server key, not the blank posted one.
         mock_bind.assert_called_once()
-        bind_call = mock_bind.call_args
-        assert bind_call.args[0] is device
-        assert bind_call.args[2] == 321
-        assert bind_call.args[3] == "production"
-        assert bind_call.args[1]["_librenms_port_id"] == 42
-        mock_messages.info.assert_called()
+        assert mock_bind.call_args.args[3] == "default"
 
     def test_install_module_view_rejects_missing_bay_id_for_interface_child(self):
         from netbox_librenms_plugin.views.sync.modules import InstallModuleView
 
         view = object.__new__(InstallModuleView)
         view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
         device = _make_device()
 
         request = _make_request(
@@ -1818,7 +2375,10 @@ def test_update_module_interface_view_binds_existing_interface(self):
             patch("netbox_librenms_plugin.views.sync.modules.get_librenms_device_id", return_value=999),
             patch(
                 "netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id",
-                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42},
+                # Real _bind_interface_librenms_id always returns "changed" (bool(update_fields));
+                # binding an unbound interface actually writes, so changed=True. The success message
+                # now gates on it, so the mock must carry the field the production branch reads.
+                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42, "changed": True},
             ) as mock_bind,
             patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_messages,
             patch("netbox_librenms_plugin.views.sync.modules._modules_redirect_response", return_value="redirected"),
@@ -1883,7 +2443,7 @@ def test_update_module_interface_view_adopts_template_interfaces_when_no_port_bi
             response = view.post(request, pk=24)
 
         mock_bind.assert_called_once()
-        mock_adopt.assert_called_once_with(device, module)
+        mock_adopt.assert_called_once_with(device, module, "production")
         mock_messages.success.assert_called_once()
         assert "adopted 2 existing standalone interface(s)" in mock_messages.success.call_args[0][1]
         assert response is not None
@@ -1954,7 +2514,7 @@ def noop_atomic():
             ) as mock_normalize,
             patch(
                 "netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id",
-                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42},
+                return_value={"status": "bound", "interface": "Te1/1/1", "port_id": 42, "changed": True},
             ) as mock_bind,
             patch("dcim.models.Module") as mock_module_cls,
         ):
@@ -2467,6 +3027,7 @@ def test_install_module_view_no_cache_delete(self):
 
         view = object.__new__(InstallModuleView)
         view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
         device = _make_device()
 
         module_bay = MagicMock()
@@ -3656,6 +4217,7 @@ def test_install_module_non_numeric_bay_id(self):
 
         view = object.__new__(InstallModuleView)
         view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
         device = _make_device()
         request = _make_request(
             "POST",
@@ -3788,6 +4350,7 @@ def _view(self):
 
         v = object.__new__(InstallModuleView)
         v.required_object_permissions = {}
+        v._librenms_api = MagicMock(server_key="default")  # blank posted server_key falls back to this
         return v
 
     def test_bay_already_occupied_warns(self):
@@ -5314,3 +5877,778 @@ def boom(sender, device, module, names, **kwargs):
             assert get_module_template_interface_names(device, module) == ["Gi1/0/1"]
         finally:
             predict_module_interface_names.disconnect(boom)
+
+
+def _make_install_device():
+    """Create a real device with one empty module bay and a matching module type."""
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, ModuleBay, ModuleType, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="HTMX-Mfr", slug="htmx-mfr")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="HTMX-DT", slug="htmx-dt")
+    role, _ = DeviceRole.objects.get_or_create(name="HTMX-Role", slug="htmx-role")
+    site, _ = Site.objects.get_or_create(name="HTMX-Site", slug="htmx-site")
+    device = Device.objects.create(name="htmx-install-dev", device_type=dt, role=role, site=site, status="active")
+    bay = ModuleBay.objects.create(device=device, name="Slot1")
+    mtype = ModuleType.objects.create(manufacturer=mfr, model="HTMX-SFP")
+    return device, bay, mtype
+
+
+@pytest.mark.django_db
+class TestInstallModuleHTMXSwap:
+    """InstallModuleView returns an in-place table partial for HTMX, a full redirect otherwise."""
+
+    def _login(self, client):
+        from django.contrib.auth import get_user_model
+
+        user = get_user_model().objects.create_superuser(username="htmx-admin", email="a@b.c", password="x")
+        client.force_login(user)
+
+    def test_htmx_install_returns_table_partial_not_redirect(self, client):
+        """An HX-Request install installs the module and swaps back the table partial (200), not a redirect."""
+        from django.urls import reverse
+        from dcim.models import Module
+
+        device, bay, mtype = _make_install_device()
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:install_module", kwargs={"pk": device.pk})
+        resp = client.post(
+            url,
+            {"module_bay_id": bay.pk, "module_type_id": mtype.pk, "server_key": "", "serial": "SN-HTMX-1"},
+            HTTP_HX_REQUEST="true",
+        )
+
+        # In-place swap: a 200 carrying the rendered table partial + its flash message,
+        # NOT the 204/HX-Redirect (which would full-reload the whole sync page).
+        assert resp.status_code == 200
+        assert "HX-Redirect" not in resp
+        assert b"Installed" in resp.content
+        assert Module.objects.filter(module_bay=bay, module_type=mtype).exists()
+
+    def test_non_htmx_install_still_redirects(self, client):
+        """A classic (non-HTMX) install still 302-redirects, so the button degrades without JS."""
+        from django.urls import reverse
+        from dcim.models import Module
+
+        device, bay, mtype = _make_install_device()
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:install_module", kwargs={"pk": device.pk})
+        resp = client.post(
+            url,
+            {"module_bay_id": bay.pk, "module_type_id": mtype.pk, "server_key": "", "serial": "SN-HTMX-2"},
+        )
+
+        assert resp.status_code == 302
+        assert Module.objects.filter(module_bay=bay, module_type=mtype).exists()
+
+
+@pytest.mark.django_db
+class TestInstallBranchSelectedHTMXSwap:
+    """InstallBranchView/InstallSelectedView also swap the table in place for HTMX, redirect otherwise."""
+
+    def _login(self, client):
+        from django.contrib.auth import get_user_model
+
+        user = get_user_model().objects.create_superuser(username="htmx-admin2", email="a@b.c", password="x")
+        client.force_login(user)
+
+    def test_branch_htmx_returns_partial_not_redirect(self, client):
+        """A branch install via HX-Request renders the table partial (200), not a 204/redirect."""
+        from django.urls import reverse
+
+        device = _make_install_device()[0]
+        self._login(client)
+        url = reverse("plugins:netbox_librenms_plugin:install_branch", kwargs={"pk": device.pk})
+        # Missing parent_index → early exit, routed through the partial helper.
+        resp = client.post(url, {"server_key": ""}, HTTP_HX_REQUEST="true")
+        assert resp.status_code == 200
+        assert "HX-Redirect" not in resp
+        assert b"parent inventory index" in resp.content
+
+    def test_branch_non_htmx_redirects(self, client):
+        """A classic branch install still 302-redirects."""
+        from django.urls import reverse
+
+        device = _make_install_device()[0]
+        self._login(client)
+        url = reverse("plugins:netbox_librenms_plugin:install_branch", kwargs={"pk": device.pk})
+        resp = client.post(url, {"server_key": ""})
+        assert resp.status_code == 302
+
+    def test_selected_htmx_returns_partial_not_redirect(self, client):
+        """An install-selected via HX-Request renders the table partial (200), not a 204/redirect."""
+        from django.urls import reverse
+
+        device = _make_install_device()[0]
+        self._login(client)
+        url = reverse("plugins:netbox_librenms_plugin:install_selected", kwargs={"pk": device.pk})
+        # No selection → early exit, routed through the partial helper.
+        resp = client.post(url, {"server_key": ""}, HTTP_HX_REQUEST="true")
+        assert resp.status_code == 200
+        assert "HX-Redirect" not in resp
+        assert b"No modules selected" in resp.content
+
+    def test_selected_non_htmx_redirects(self, client):
+        """A classic install-selected still 302-redirects."""
+        from django.urls import reverse
+
+        device = _make_install_device()[0]
+        self._login(client)
+        url = reverse("plugins:netbox_librenms_plugin:install_selected", kwargs={"pk": device.pk})
+        resp = client.post(url, {"server_key": ""})
+        assert resp.status_code == 302
+
+
+def _make_device_with_installed_module(name_suffix, *, with_template_standalone=False):
+    """Create a real device with one installed module.
+
+    When ``with_template_standalone`` is set, give the module type one interface template
+    and a matching standalone (module-less) interface so an Update-Interface adopt succeeds.
+    """
+    from dcim.models import (
+        Device,
+        DeviceRole,
+        DeviceType,
+        Interface,
+        InterfaceTemplate,
+        Manufacturer,
+        Module,
+        ModuleBay,
+        ModuleType,
+        Site,
+    )
+
+    mfr, _ = Manufacturer.objects.get_or_create(name=f"HMod-Mfr-{name_suffix}", slug=f"hmod-mfr-{name_suffix}")
+    dt, _ = DeviceType.objects.get_or_create(
+        manufacturer=mfr, model=f"HMod-DT-{name_suffix}", slug=f"hmod-dt-{name_suffix}"
+    )
+    role, _ = DeviceRole.objects.get_or_create(name=f"HMod-Role-{name_suffix}", slug=f"hmod-role-{name_suffix}")
+    site, _ = Site.objects.get_or_create(name=f"HMod-Site-{name_suffix}", slug=f"hmod-site-{name_suffix}")
+    device = Device.objects.create(
+        name=f"hmod-dev-{name_suffix}", device_type=dt, role=role, site=site, status="active"
+    )
+    mtype = ModuleType.objects.create(manufacturer=mfr, model=f"HMod-MT-{name_suffix}")
+    if with_template_standalone:
+        InterfaceTemplate.objects.create(module_type=mtype, name="Gi0/1", type="1000base-t")
+    bay = ModuleBay.objects.create(device=device, name="Slot1")
+    module = Module.objects.create(device=device, module_bay=bay, module_type=mtype, serial="OLD-SN")
+    if with_template_standalone:
+        # Clear the auto-instantiated module component so the standalone owns the template name,
+        # then create the module-less interface the adopt should claim.
+        Interface.objects.filter(device=device).delete()
+        Interface.objects.create(device=device, name="Gi0/1", type="1000base-t", module=None)
+    return device, module
+
+
+@pytest.mark.django_db
+class TestUpdateModuleSerialHTMXSwap:
+    """UpdateModuleSerialView returns an HX-Redirect for HTMX (the mismatch modal expects it), redirects otherwise."""
+
+    def _login(self, client):
+        from django.contrib.auth import get_user_model
+
+        user = get_user_model().objects.create_superuser(username="htmx-serial", email="a@b.c", password="x")
+        client.force_login(user)
+
+    def test_htmx_update_serial_returns_hx_redirect_not_table_partial(self, client):
+        """An HX-Request serial update persists the serial and returns an empty HX-Redirect response.
+
+        The 'Update Serial Only' modal form posts hx-swap='none', so a table partial would be
+        thrown away, leaving the modal open on stale data — it needs the HX-Redirect to close and
+        reload (like the sibling MoveModuleView).
+        """
+        from django.urls import reverse
+
+        device, module = _make_device_with_installed_module("serial-hx")
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:update_module_serial", kwargs={"pk": device.pk})
+        resp = client.post(
+            url,
+            {"module_id": module.pk, "serial": "NEW-SN", "selected_device_id": device.pk},
+            HTTP_HX_REQUEST="true",
+        )
+
+        # Empty HX-Redirect response back to the modules tab, NOT an in-place 200 table partial.
+        assert resp.status_code == 204
+        assert "tab=modules" in resp["HX-Redirect"]
+        module.refresh_from_db()
+        assert module.serial == "NEW-SN"
+
+    def test_non_htmx_update_serial_still_redirects(self, client):
+        """A classic (non-HTMX) serial update still 302-redirects, so the button degrades without JS."""
+        from django.urls import reverse
+
+        device, module = _make_device_with_installed_module("serial-classic")
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:update_module_serial", kwargs={"pk": device.pk})
+        resp = client.post(url, {"module_id": module.pk, "serial": "NEW-SN", "selected_device_id": device.pk})
+
+        assert resp.status_code == 302
+        module.refresh_from_db()
+        assert module.serial == "NEW-SN"
+
+
+@pytest.mark.django_db
+class TestUpdateModuleInterfaceHTMXSwap:
+    """UpdateModuleInterfaceView swaps the table partial in place for HTMX, redirects otherwise."""
+
+    def _login(self, client):
+        from django.contrib.auth import get_user_model
+
+        user = get_user_model().objects.create_superuser(username="htmx-iface", email="a@b.c", password="x")
+        client.force_login(user)
+
+    def test_htmx_update_interface_adopts_and_returns_table_partial(self, client):
+        """An HX-Request interface update adopts the matching standalone and swaps back the partial (200)."""
+        from django.urls import reverse
+
+        from dcim.models import Interface
+
+        device, module = _make_device_with_installed_module("iface-hx", with_template_standalone=True)
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:update_module_interface", kwargs={"pk": device.pk})
+        resp = client.post(
+            url,
+            {"module_id": module.pk, "server_key": "", "selected_device_id": device.pk},
+            HTTP_HX_REQUEST="true",
+        )
+
+        assert resp.status_code == 200
+        assert "HX-Redirect" not in resp
+        assert b"adopted 1 existing standalone" in resp.content
+        # The standalone "Gi0/1" is now owned by the module.
+        assert Interface.objects.get(device=device, name="Gi0/1").module_id == module.pk
+
+    def test_non_htmx_update_interface_still_redirects(self, client):
+        """A classic (non-HTMX) interface update still 302-redirects."""
+        from django.urls import reverse
+
+        from dcim.models import Interface
+
+        device, module = _make_device_with_installed_module("iface-classic", with_template_standalone=True)
+        self._login(client)
+
+        url = reverse("plugins:netbox_librenms_plugin:update_module_interface", kwargs={"pk": device.pk})
+        resp = client.post(url, {"module_id": module.pk, "server_key": "", "selected_device_id": device.pk})
+
+        assert resp.status_code == 302
+        assert Interface.objects.get(device=device, name="Gi0/1").module_id == module.pk
+
+
+@pytest.mark.django_db
+class TestAdoptableCountStandaloneGate:
+    """_count_adoptable_template_interfaces skips the INR prediction when nothing can be adopted."""
+
+    def _view(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+
+        return object.__new__(DeviceModuleTableView)
+
+    def _device_with_module(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Module, ModuleBay, ModuleType, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="GateMfr", slug="gatemfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="GateDT", slug="gatedt")
+        role, _ = DeviceRole.objects.get_or_create(name="GateRole", slug="gaterole")
+        site, _ = Site.objects.get_or_create(name="GateSite", slug="gatesite")
+        device = Device.objects.create(name="gate-dev", device_type=dt, role=role, site=site, status="active")
+        bay = ModuleBay.objects.create(device=device, name="Slot1")
+        mtype = ModuleType.objects.create(manufacturer=mfr, model="GateMT")
+        module = Module.objects.create(device=device, module_bay=bay, module_type=mtype, status="active")
+        return device, module
+
+    def test_skips_prediction_when_no_standalone_interfaces(self):
+        """A fully-adopted device (no module-less interfaces) returns 0 without calling the INR prediction."""
+        from dcim.models import Interface
+
+        device, module = self._device_with_module()
+        # The only interface is already adopted into the module → no standalone interfaces remain.
+        Interface.objects.create(device=device, name="Gi1/0/1", type="1000base-t", module=module)
+
+        view = self._view()
+        with patch("netbox_librenms_plugin.views.base.modules_view.get_module_template_interface_names") as mock_pred:
+            count = view._count_adoptable_template_interfaces(module)
+
+        assert count == 0
+        mock_pred.assert_not_called()  # gated out before the per-row prediction signal
+
+    def test_counts_when_standalone_interface_matches(self):
+        """With a standalone interface matching a predicted template name, the count still works."""
+        from dcim.models import Interface
+
+        device, module = self._device_with_module()
+        Interface.objects.create(device=device, name="Gi1/0/2", type="1000base-t")  # module=None → standalone
+
+        view = self._view()
+        with patch(
+            "netbox_librenms_plugin.views.base.modules_view.get_module_template_interface_names",
+            return_value=["Gi1/0/2"],
+        ) as mock_pred:
+            count = view._count_adoptable_template_interfaces(module)
+
+        assert count == 1
+        mock_pred.assert_called_once()
+
+
+@pytest.mark.django_db
+class TestModuleTypesIndexCache:
+    """get_module_types_indexed caches the index and rebuilds only when its inputs change."""
+
+    def test_repeated_calls_reuse_cached_index(self):
+        """A second call returns the same cached index object instead of rebuilding it."""
+        from netbox_librenms_plugin.utils import get_module_types_indexed
+
+        idx1 = get_module_types_indexed()
+        idx2 = get_module_types_indexed()
+        assert idx1 is idx2  # served from cache, not rebuilt
+
+    def test_module_type_change_invalidates_cache(self):
+        """Creating a ModuleType changes the fingerprint, so the next call rebuilds and indexes it."""
+        from dcim.models import Manufacturer, ModuleType
+
+        from netbox_librenms_plugin.utils import get_module_types_indexed
+
+        idx1 = get_module_types_indexed()
+        mfr, _ = Manufacturer.objects.get_or_create(name="IdxMfr", slug="idxmfr")
+        ModuleType.objects.create(manufacturer=mfr, model="IDX-NEW", part_number="IDX-NEW")
+        idx2 = get_module_types_indexed()
+
+        assert idx1 is not idx2  # rebuilt after the change
+        assert idx2.get("IDX-NEW") is not None  # the new type is indexed
+
+    def test_concurrent_cold_access_builds_index_once(self):
+        """Under concurrent cold-cache access the index is built exactly once (lock-serialised) and every caller gets the same object."""
+        import threading
+        from unittest.mock import patch
+
+        import netbox_librenms_plugin.utils as u
+
+        sentinel = u._ModuleTypeIndex()
+        # Cold cache + a pinned fingerprint so all threads race into the rebuild path together.
+        u._MODULE_TYPES_INDEX_CACHE = (None, None)
+        results = []
+        barrier = threading.Barrier(8)
+
+        with (
+            patch.object(u, "_module_types_index_version", return_value=("v",)),
+            patch.object(u, "_build_module_types_index", return_value=sentinel) as mock_build,
+        ):
+
+            def worker():
+                barrier.wait(timeout=10)
+                results.append(u.get_module_types_indexed())
+
+            threads = [threading.Thread(target=worker) for _ in range(8)]
+            for t in threads:
+                t.start()
+            for t in threads:
+                t.join(timeout=10)
+
+        # The lock prevents the redundant concurrent rebuilds the unsynchronised version allowed...
+        assert mock_build.call_count == 1
+        # ...and every caller observes the one consistent index object.
+        assert len(results) == 8
+        assert all(r is sentinel for r in results)
+
+
+@pytest.mark.django_db
+class TestAdoptableTemplateInterfaceQueryCost:
+    """Real-DB: the module-sync adoptable-interface count keeps its per-row query cost low."""
+
+    def _view(self):
+        from netbox_librenms_plugin.views.base.modules_view import BaseModuleTableView
+
+        return object.__new__(BaseModuleTableView)
+
+    def _device_with_installed_module(self):
+        from dcim.models import (
+            Device,
+            DeviceRole,
+            DeviceType,
+            Interface,
+            InterfaceTemplate,
+            Manufacturer,
+            Module,
+            ModuleBay,
+            ModuleType,
+            Site,
+        )
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="qcost-mfr", slug="qcost-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="qcost-dt", slug="qcost-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="qcost-role", slug="qcost-role")
+        site, _ = Site.objects.get_or_create(name="qcost-site", slug="qcost-site")
+        device = Device.objects.create(name="qcost-dev", device_type=dt, role=role, site=site, status="active")
+        mt = ModuleType.objects.create(manufacturer=mfr, model="qcost-mt")
+        for i in range(1, 4):
+            InterfaceTemplate.objects.create(module_type=mt, name=f"Gi0/{i}", type="1000base-t")
+        bay = ModuleBay.objects.create(device=device, name="Bay 1")
+        Module.objects.create(device=device, module_bay=bay, module_type=mt)
+        Interface.objects.create(device=device, name="standalone0", type="1000base-t", module=None)
+        return device
+
+    def test_get_module_bays_prefetches_installed_module_interface_templates(self, django_assert_num_queries):
+        """_get_module_bays prefetches the installed module's interface templates, so the per-row
+        adoptable-interface count does not re-query them once per row."""
+        device = self._device_with_installed_module()
+        view = self._view()
+        device_bays, _ = view._get_module_bays(device)
+        bay = device_bays["Bay 1"]
+        with django_assert_num_queries(0):
+            list(bay.installed_module.module_type.interfacetemplates.all())
+
+
+@pytest.mark.django_db
+class TestModulePartialUsesPostedServerKey:
+    """The post-action HTMX partial re-renders the module table for the POSTed server_key."""
+
+    def test_partial_resolves_posted_server_key_not_global(self):
+        """The partial builds its table view for the POSTed server_key ('alpha'), not the globally-selected one ('beta')."""
+        from unittest.mock import patch
+
+        from django.contrib.auth.models import AnonymousUser
+        from django.http import HttpResponse
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.models import LibreNMSSettings
+        from netbox_librenms_plugin.views.sync.modules import _render_modules_partial_after_action
+
+        device = _make_install_device()[0]
+
+        # Two configured servers; the GLOBAL active server is 'beta', but the form POSTs 'alpha'.
+        multi = {
+            "alpha": {"librenms_url": "http://alpha", "api_token": "ta", "cache_timeout": 300, "verify_ssl": True},
+            "beta": {"librenms_url": "http://beta", "api_token": "tb", "cache_timeout": 300, "verify_ssl": True},
+        }
+        LibreNMSSettings.objects.create(selected_server="beta")
+
+        request = RequestFactory().post("/x/", {"server_key": "alpha"}, HTTP_HX_REQUEST="true")
+        request.user = AnonymousUser()
+
+        captured = {}
+
+        def fake_render(req, template, context):
+            captured["context"] = context
+            return HttpResponse("ok")
+
+        # Patch only the external config boundary (server catalogue) and the template render
+        # (to capture the resolved context); the server_key resolution itself is real.
+        with (
+            patch("netbox_librenms_plugin.librenms_api.get_plugin_config", return_value=multi),
+            patch("netbox_librenms_plugin.views.sync.modules.render", side_effect=fake_render),
+        ):
+            _render_modules_partial_after_action(request, device, "/sync/", lambda: True)
+
+        # get_context_data returns server_key from the table view's LibreNMSAPI; it must be the
+        # POSTed 'alpha' (the cache namespace the install acted on), not the global 'beta'.
+        assert captured["context"]["module_sync"]["server_key"] == "alpha"
+
+
+@pytest.mark.django_db
+class TestMergeRawDuplicatePreservesMac:
+    """Folding a module's raw template interface into its adopted twin must not lose MAC data."""
+
+    @staticmethod
+    def _device():
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Merge-Mfr", slug="merge-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="Merge-DT", slug="merge-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="Merge-Role", slug="merge-role")
+        site, _ = Site.objects.get_or_create(name="Merge-Site", slug="merge-site")
+        return Device.objects.create(name="merge-dev", device_type=dt, role=role, site=site, status="active")
+
+    def test_raw_twin_mac_is_reassigned_to_adopted_before_delete(self):
+        """The raw twin's MAC (and primary-MAC) move to the adopted interface instead of being deleted with it."""
+        from dcim.models import Interface, MACAddress
+
+        from netbox_librenms_plugin.views.sync.modules import _merge_raw_duplicate_interface
+
+        device = self._device()
+        # Authoritative externally-named interface (adopted); no MAC of its own yet.
+        adopted = Interface.objects.create(device=device, name="GigabitEthernet0/1", type="1000base-t")
+        # Module's raw template twin that accumulated a MAC from a prior partial sync.
+        raw = Interface.objects.create(device=device, name="1/1", type="1000base-t")
+        mac = MACAddress.objects.create(mac_address="00:11:22:33:44:55", assigned_object=raw)
+        raw.primary_mac_address = mac
+        raw.save()
+
+        result = _merge_raw_duplicate_interface(raw, adopted, server_key="default")
+
+        assert result is True
+        assert not Interface.objects.filter(pk=raw.pk).exists()
+        # The MAC survives and is now assigned to the adopted interface...
+        assert MACAddress.objects.filter(pk=mac.pk).exists()
+        mac.refresh_from_db()
+        assert mac.assigned_object_id == adopted.pk
+        adopted.refresh_from_db()
+        assert adopted.mac_addresses.filter(pk=mac.pk).exists()
+        # ...and the adopted interface (which had no primary MAC) inherits it.
+        assert adopted.primary_mac_address_id == mac.pk
+
+
+@pytest.mark.django_db
+class TestAdoptBatchesRenamePrediction:
+    """_adopt_existing_template_interfaces resolves all raw names in ONE rename-prediction dispatch."""
+
+    def test_rename_prediction_is_dispatched_once_for_all_raw_interfaces(self):
+        """No per-interface (single-name) predict dispatch happens; raw names are resolved in one batched call."""
+        from dcim.models import (
+            Device,
+            DeviceRole,
+            DeviceType,
+            InterfaceTemplate,
+            Manufacturer,
+            Module,
+            ModuleBay,
+            ModuleType,
+            Site,
+        )
+        from django.dispatch import receiver
+
+        from netbox_librenms_plugin.signals import predict_module_interface_names
+        from netbox_librenms_plugin.views.sync.modules import _adopt_existing_template_interfaces
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Batch-Mfr", slug="batch-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="Batch-DT", slug="batch-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="Batch-Role", slug="batch-role")
+        site, _ = Site.objects.get_or_create(name="Batch-Site", slug="batch-site")
+        device = Device.objects.create(name="batch-dev", device_type=dt, role=role, site=site, status="active")
+
+        mtype = ModuleType.objects.create(manufacturer=mfr, model="Batch-MT")
+        InterfaceTemplate.objects.create(module_type=mtype, name="1/1", type="1000base-t")
+        InterfaceTemplate.objects.create(module_type=mtype, name="1/2", type="1000base-t")
+        bay = ModuleBay.objects.create(device=device, name="Bay1")
+        module = Module.objects.create(device=device, module_bay=bay, module_type=mtype)
+
+        recorded = []
+
+        @receiver(predict_module_interface_names)
+        def rename(sender, device, module, names, **kwargs):
+            recorded.append(list(names))
+            return ["Gi" + n for n in names]
+
+        try:
+            # A standalone interface matching a predicted template name takes adoption past the
+            # early "no matches" return so the rename-prediction loop actually runs.
+            from dcim.models import Interface
+
+            Interface.objects.create(device=device, name="Gi1/1", type="1000base-t")
+
+            result = _adopt_existing_template_interfaces(device, module)
+        finally:
+            predict_module_interface_names.disconnect(rename)
+
+        assert result["status"] == "bound"
+        # The module's two raw interfaces ('1/1', '1/2') must be predicted in a single dispatch.
+        # A per-interface implementation would emit single-name dispatches; assert none exist.
+        single_name_dispatches = [names for names in recorded if len(names) == 1]
+        assert single_name_dispatches == [], f"rename prediction was not batched: {recorded}"
+
+
+class TestRenderModulesPartialServerKeyGuard:
+    """_render_modules_partial_after_action must not 500 on a stale/forged POSTed server_key.
+
+    In a multi-server config, passing the raw key straight into LibreNMSAPI(server_key=...) raises
+    KeyError for an unconfigured key. The HTMX partial must validate membership first and leave the
+    default-server API in place instead of crashing the in-place table swap.
+    """
+
+    def test_forged_server_key_does_not_500_the_partial(self):
+        from django.http import HttpResponse
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+        from netbox_librenms_plugin.views.sync import modules as modules_mod
+
+        device = _make_device()
+        # HX-Request → the in-place swap path (where the rebind happens).
+        request = RequestFactory().post("/", {"server_key": "forged-key"}, HTTP_HX_REQUEST="true")
+
+        servers = {
+            "alpha": {"librenms_url": "https://a.example.com", "api_token": "t"},
+            "beta": {"librenms_url": "https://b.example.com", "api_token": "t"},
+        }
+        with (
+            patch(
+                "netbox_librenms_plugin.librenms_api.get_plugin_config",
+                side_effect=lambda app, key, default=None: servers if key == "servers" else default,
+            ),
+            patch.object(DeviceModuleTableView, "get_context_data", return_value={}),
+            patch("netbox_librenms_plugin.views.sync.modules.render", return_value=HttpResponse("ok")),
+        ):
+            # On the unfixed code LibreNMSAPI(server_key="forged-key") raises KeyError here.
+            resp = modules_mod._render_modules_partial_after_action(request, device, "/sync/", lambda: True)
+
+        assert resp.status_code == 200
+
+
+class TestModulesRedirectPreservesServerKey:
+    """_modules_redirect_response must carry a configured POSTed server_key on the classic redirect."""
+
+    def _request(self, server_key=None):
+        from django.test import RequestFactory
+
+        data = {"server_key": server_key} if server_key is not None else {}
+        return RequestFactory().post("/", data)
+
+    def test_classic_redirect_preserves_configured_server_key(self):
+        """A non-HTMX action on a configured non-default server redirects back to that server's tab."""
+        from netbox_librenms_plugin.views.sync import modules as modules_mod
+
+        request = self._request("prod")
+        with patch(
+            "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+            return_value={"prod": "Prod"},
+        ):
+            resp = modules_mod._modules_redirect_response(request, "/sync/url")
+
+        assert resp.status_code == 302
+        assert "tab=modules" in resp.url
+        assert "server_key=prod" in resp.url
+
+    def test_classic_redirect_drops_unconfigured_server_key(self):
+        """A stale/forged server_key is not forwarded on the redirect."""
+        from netbox_librenms_plugin.views.sync import modules as modules_mod
+
+        request = self._request("ghost")
+        with patch(
+            "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+            return_value={"prod": "Prod"},
+        ):
+            resp = modules_mod._modules_redirect_response(request, "/sync/url")
+
+        assert "server_key" not in resp.url
+
+    def test_htmx_redirect_preserves_configured_server_key(self):
+        """The HTMX HX-Redirect target carries the configured server_key too."""
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.sync import modules as modules_mod
+
+        request = RequestFactory().post("/", {"server_key": "prod"}, HTTP_HX_REQUEST="true")
+        with patch(
+            "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+            return_value={"prod": "Prod"},
+        ):
+            resp = modules_mod._modules_redirect_response(request, "/sync/url")
+
+        assert resp.status_code == 204
+        assert "server_key=prod" in resp["HX-Redirect"]
+
+
+@pytest.mark.django_db
+class TestModulePartialDegradesOnBrokenDefault:
+    """_render_modules_partial_after_action degrades instead of 500ing when the default server is misconfigured."""
+
+    def test_render_after_action_does_not_500(self):
+        """With a broken default and no configured POST key, the committed action renders an empty panel (200)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+        from django.contrib.auth.models import AnonymousUser
+        from django.test import RequestFactory, override_settings
+        from django.urls import reverse
+
+        from netbox_librenms_plugin.views.sync.modules import _render_modules_partial_after_action
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Mfr-mpd", slug="mfr-mpd")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-mpd", slug="dt-mpd")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-mpd", slug="role-mpd")
+        site, _ = Site.objects.get_or_create(name="Site-mpd", slug="site-mpd")
+        device = Device.objects.create(name="host-mpd", device_type=dt, role=role, site=site, status="active")
+
+        request = RequestFactory().post("/modules/action/", data={})
+        request.headers = {"HX-Request": "true"}  # force the HTMX render branch
+        request.user = AnonymousUser()  # the rendered partial's context processors read request.user
+        sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": device.pk})
+
+        with override_settings(PLUGINS_CONFIG={"netbox_librenms_plugin": {"servers": {"default": {}}}}):
+            response = _render_modules_partial_after_action(request, device, sync_url, lambda: True)
+
+        assert response.status_code == 200
+
+
+@pytest.mark.django_db
+class TestInstallModuleBindMessageGating:
+    """InstallModuleView must not report a 'Bound ...' info message for a no-op bind (changed=False)."""
+
+    def _build(self, prebind):
+        from dcim.models import (
+            Device,
+            DeviceRole,
+            DeviceType,
+            Interface,
+            InterfaceTemplate,
+            Manufacturer,
+            ModuleBay,
+            ModuleType,
+            Site,
+        )
+
+        tag = "prebound" if prebind else "fresh"
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-bindmsg-{tag}", slug=f"mfr-bindmsg-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-bindmsg-{tag}", slug=f"dt-bindmsg-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name=f"Role-bindmsg-{tag}", slug=f"role-bindmsg-{tag}")
+        site, _ = Site.objects.get_or_create(name=f"Site-bindmsg-{tag}", slug=f"site-bindmsg-{tag}")
+        device = Device.objects.create(
+            name=f"host-bindmsg-{tag}", device_type=dt, role=role, site=site, status="active"
+        )
+
+        mt = ModuleType.objects.create(manufacturer=mfr, model=f"MT-bindmsg-{tag}")
+        InterfaceTemplate.objects.create(module_type=mt, name="Gi0/1", type="other")
+        bay = ModuleBay.objects.create(device=device, name="bay-bindmsg")
+
+        # A standalone interface matching the module template name; the install adopts it (sets
+        # module FK) before the port-bind runs. When it is ALSO already bound to the posted port_id,
+        # the subsequent _bind_interface_librenms_id is a no-op (changed=False).
+        Interface.objects.filter(device=device).delete()
+        standalone = Interface.objects.create(device=device, name="Gi0/1", type="other")
+        if prebind:
+            standalone.custom_field_data["librenms_id"] = {"default": 42}
+            standalone.save(update_fields=["custom_field_data"])
+        return device, bay, mt
+
+    def _install(self, device, bay, mt):
+        from netbox_librenms_plugin.views.sync.modules import InstallModuleView
+
+        view = object.__new__(InstallModuleView)
+        request = _make_request(
+            "POST",
+            data={
+                "module_bay_id": str(bay.pk),
+                "module_type_id": str(mt.pk),
+                "librenms_port_id": "42",
+                "librenms_ifname": "Gi0/1",
+                "server_key": "default",
+            },
+        )
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch.object(view, "has_write_permission", return_value=True),
+            patch("netbox_librenms_plugin.views.sync.modules.messages") as mock_msg,
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._render_modules_partial_after_action",
+                return_value="RENDERED",
+            ),
+        ):
+            view.post(request, pk=device.pk)
+        return mock_msg
+
+    def test_noop_bind_suppresses_bound_message(self):
+        """A port already on the adopted interface (no-op bind) must NOT emit a 'Bound ...' info toast."""
+        device, bay, mt = self._build(prebind=True)
+        mock_msg = self._install(device, bay, mt)
+
+        info_texts = [c.args[1] for c in mock_msg.info.call_args_list]
+        assert not any("Bound" in t and "port_id 42" in t for t in info_texts), info_texts
+
+    def test_real_bind_reports_bound_message(self):
+        """A port newly bound to the adopted interface (changed=True) still reports the 'Bound ...' toast."""
+        device, bay, mt = self._build(prebind=False)
+        mock_msg = self._install(device, bay, mt)
+
+        info_texts = [c.args[1] for c in mock_msg.info.call_args_list]
+        assert any("Bound" in t and "port_id 42" in t for t in info_texts), info_texts
diff --git a/netbox_librenms_plugin/tests/test_sync_view_mismatch.py b/netbox_librenms_plugin/tests/test_sync_view_mismatch.py
index a1bbab1a65..5ce5409813 100644
--- a/netbox_librenms_plugin/tests/test_sync_view_mismatch.py
+++ b/netbox_librenms_plugin/tests/test_sync_view_mismatch.py
@@ -364,6 +364,38 @@ def test_single_configured_server(self, mock_netbox_device, mock_plugins_config_
         assert entry["is_active"] is True
         assert entry["device_url"] == "https://librenms.example.com/device/device=42/"
 
+    def test_whitespace_padded_string_id_is_included(self, mock_netbox_device, mock_plugins_config_single_server):
+        """Issue #99: a per-server id stored as a whitespace-padded string (" 42 ") resolves fine elsewhere (int() strips whitespace) but str.isdigit() wrongly rejected it here, hiding a valid link from the mappings UI."""
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
+
+        mock_netbox_device.custom_field_data = {"librenms_id": {"production": " 42 "}}
+        with patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings") as mock_settings:
+            mock_settings.PLUGINS_CONFIG = mock_plugins_config_single_server
+            result = BaseLibreNMSSyncView._build_all_server_mappings(mock_netbox_device, "production")
+
+        assert result is not None
+        assert len(result) == 1
+        assert result[0]["server_key"] == "production"
+        assert result[0]["device_id"] == 42
+
+    def test_float_id_is_rejected_not_truncated(self, mock_netbox_device, mock_plugins_config_single_server):
+        """Issue #99: a float id must be rejected, never silently truncated."""
+        from unittest.mock import patch
+
+        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
+
+        mock_netbox_device.custom_field_data = {"librenms_id": {"production": 42, "staging": 1.9}}
+        with patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings") as mock_settings:
+            mock_settings.PLUGINS_CONFIG = mock_plugins_config_single_server
+            result = BaseLibreNMSSyncView._build_all_server_mappings(mock_netbox_device, "production")
+
+        assert result is not None
+        # Only the valid int entry survives; the float is dropped, not coerced to 1.
+        assert [e["server_key"] for e in result] == ["production"]
+        assert all(e["device_id"] != 1 for e in result)
+
     def test_orphaned_server_is_not_configured(self, mock_netbox_device, mock_plugins_config_empty_servers):
         from unittest.mock import patch
 
diff --git a/netbox_librenms_plugin/tests/test_tables_modules.py b/netbox_librenms_plugin/tests/test_tables_modules.py
index 45e0d3c497..ff66492659 100644
--- a/netbox_librenms_plugin/tests/test_tables_modules.py
+++ b/netbox_librenms_plugin/tests/test_tables_modules.py
@@ -313,6 +313,57 @@ def test_render_status_matched_uses_info_badge(self):
         result = str(table.render_status("Matched", {}))
         assert "bg-info" in result
 
+    def test_render_status_wraps_live_badge_with_install_indicator(self):
+        """The live badge is wrapped and a hidden 'Installing…' spinner badge is appended."""
+        table = self._make_table()
+        result = str(table.render_status("Matched", {}))
+        # Live badge wrapper so CSS can hide it while an install POST is in flight.
+        assert "lnms-status-live" in result
+        # Hidden spinner badge revealed by tr.htmx-request (see _module_sync.html).
+        assert "lnms-installing" in result
+        assert "spinner-border" in result
+        assert "Installing" in result
+        # The real status badge is still present inside the wrapper.
+        assert "bg-info" in result
+
+    def test_render_status_install_indicator_present_for_every_status(self):
+        """The install spinner badge rides along on non-installable statuses too (hidden by CSS)."""
+        table = self._make_table()
+        for status in ("Installed", "No Bay", "Serial Mismatch"):
+            result = str(table.render_status(status, {}))
+            assert "lnms-installing" in result, status
+
+    def test_render_status_update_serial_row_spinner_says_updating(self):
+        """An installed-module row offering Update Serial labels the spinner 'Updating…', not 'Installing…'."""
+        table = self._make_table()
+        record = {"installed_module_id": 42, "can_update_serial": True}
+        result = str(table.render_status("Serial Mismatch", record))
+        assert "Updating…" in result
+        assert "Installing…" not in result
+
+    def test_render_status_update_interface_row_spinner_says_updating(self):
+        """An installed-module row offering Update Interface labels the spinner 'Updating…'."""
+        table = self._make_table()
+        record = {"installed_module_id": 42, "can_update_interface_binding": True}
+        result = str(table.render_status("Installed", record))
+        assert "Updating…" in result
+        assert "Installing…" not in result
+
+    def test_render_status_install_row_spinner_still_says_installing(self):
+        """An installable (not-yet-installed) row keeps the 'Installing…' spinner label."""
+        table = self._make_table()
+        result = str(table.render_status("Matched", {"can_install": True}))
+        assert "Installing…" in result
+        assert "Updating…" not in result
+
+    def test_render_status_carrier_row_spinner_says_installing(self):
+        """A No Bay carrier-install row labels the spinner 'Installing…' (it installs a module)."""
+        table = self._make_table()
+        record = {"carrier_install_options": [{"bay_id": 1, "module_type_id": 2}]}
+        result = str(table.render_status("No Bay", record))
+        assert "Installing…" in result
+        assert "Updating…" not in result
+
     def test_render_status_no_bay_uses_warning_badge(self):
         """'No Bay' status renders a bg-warning badge."""
         table = self._make_table()
@@ -446,6 +497,10 @@ def test_render_actions_can_install_renders_install_button(self):
         assert "/install-url/" in result
         assert "SN123" in result
         assert "mdi-download" in result
+        # The install form posts via HTMX so a single install swaps just the module table
+        # in place instead of full-page reloading the whole sync view.
+        assert 'hx-post="/install-url/"' in result
+        assert 'hx-target="#module-sync-content"' in result
 
     def test_render_actions_has_installable_children_renders_branch_button(self):
         """has_installable_children + ent_physical_index renders Install Branch button."""
@@ -525,6 +580,12 @@ def test_render_actions_serial_mismatch_renders_update_serial_button(self):
         assert "update-module-serial" in result or "/url/" in result
         assert "NS225161205" in result
         assert "mdi-sync" in result
+        # Posts via HTMX so the update swaps just the module table in place (with the
+        # closest-row spinner) instead of full-page reloading the whole sync view.
+        assert 'hx-post="/url/"' in result
+        assert 'hx-target="#module-sync-content"' in result
+        assert 'hx-indicator="closest tr"' in result
+        assert 'hx-disabled-elt="find button"' in result
 
     def test_render_actions_no_update_serial_without_flag(self):
         """Update Serial button not rendered when can_update_serial is not set."""
@@ -577,6 +638,12 @@ def test_render_actions_can_update_interface_renders_button(self):
         assert "Update Interface" in result
         assert "mdi-link-variant" in result
         assert 'name="module_id" value="42"' in result
+        # Posts via HTMX so the update swaps just the module table in place (with the
+        # closest-row spinner) instead of full-page reloading the whole sync view.
+        assert 'hx-post="/url/"' in result
+        assert 'hx-target="#module-sync-content"' in result
+        assert 'hx-indicator="closest tr"' in result
+        assert 'hx-disabled-elt="find button"' in result
 
     def test_render_actions_update_interface_requires_permission(self):
         """Update Interface button is hidden without change-interface permission."""
@@ -593,6 +660,30 @@ def test_render_actions_update_interface_requires_permission(self):
 
         assert "Update Interface" not in result
 
+    def test_render_actions_carrier_install_option_renders_htmx_form(self):
+        """A No Bay row with a carrier_install_options entry renders an HTMX install form."""
+        device = MagicMock()
+        device.pk = 83
+        table = self._make_table(device=device)
+        record = {
+            "status": "No Bay",
+            "carrier_install_options": [
+                {"bay_id": 12, "module_type_id": 34, "module_type_name": "CARRIER-A", "bay_name": "Slot 0"},
+            ],
+        }
+        with patch("netbox_librenms_plugin.tables.modules.reverse", return_value="/install-url/"):
+            result = str(table.render_actions(None, record))
+
+        assert "Install CARRIER-A into" in result
+        assert 'name="module_bay_id" value="12"' in result
+        assert 'name="module_type_id" value="34"' in result
+        # Carrier-install posts to install_module, which returns the table partial for HTMX,
+        # so it swaps in place with the closest-row spinner like the other install actions.
+        assert 'hx-post="/install-url/"' in result
+        assert 'hx-target="#module-sync-content"' in result
+        assert 'hx-indicator="closest tr"' in result
+        assert 'hx-disabled-elt="find button"' in result
+
     def test_render_actions_can_replace_renders_replace_button(self):
         """can_replace=True with installed_module_id renders a Replace button."""
         device = MagicMock()
diff --git a/netbox_librenms_plugin/views/base/modules_view.py b/netbox_librenms_plugin/views/base/modules_view.py
index 354236944c..aef676c653 100644
--- a/netbox_librenms_plugin/views/base/modules_view.py
+++ b/netbox_librenms_plugin/views/base/modules_view.py
@@ -8,6 +8,7 @@
 from django.views import View
 
 from netbox_librenms_plugin.utils import (
+    cache_remaining_ttl,
     get_librenms_device_id,
     get_librenms_sync_device,
     get_module_template_interface_names,
@@ -196,6 +197,18 @@ def _count_adoptable_template_interfaces(self, module):
         if device is None:
             return 0
 
+        # Short-circuit before the (per-row) interface-name prediction: if the device has no
+        # module-less interfaces, nothing can be adopted, so the count is 0 regardless. The
+        # existence is cached per device on this render so it costs one query, not one per row —
+        # a fully-adopted device then skips the prediction signal entirely.
+        # Named to avoid shadowing the module-level Django ``cache`` import: this is a per-render
+        # in-memory memo of "device has module-less interfaces", not the Django cache.
+        standalone_exists = self.__dict__.setdefault("_standalone_iface_exists", {})
+        if device.pk not in standalone_exists:
+            standalone_exists[device.pk] = device.interfaces.filter(module__isnull=True).exists()
+        if not standalone_exists[device.pk]:
+            return 0
+
         template_names = get_module_template_interface_names(device, module)
         if not template_names:
             return 0
@@ -351,18 +364,27 @@ def post(self, request, pk):
 
     def get_context_data(self, request, obj):
         """Get context from cache (used by the main sync view on initial page load)."""
+        # Resolve the server key through the DEGRADING helper (mirrors the cables/IP tabs):
+        # the lazy librenms_api property raises KeyError/ValueError on a missing or
+        # misconfigured server config, which would 500 the whole sync-page render for this
+        # tab. With no buildable client there is no valid server scope (and the librenms_id
+        # validation below needs the client too), so degrade to the empty panel — its
+        # refresh POST surfaces the configuration error properly.
+        server_key = self._render_server_key()
+        if server_key is None:
+            return {"table": None, "object": obj, "cache_expiry": None, "server_key": None}
         sync_device = self._get_sync_device(obj)
-        cache_key = self.get_cache_key(sync_device, "inventory", server_key=self.librenms_api.server_key)
+        cache_key = self.get_cache_key(sync_device, "inventory", server_key=server_key)
         cached_payload = cache.get(cache_key)
         if not isinstance(cached_payload, dict) or "inventory" not in cached_payload:
             cache.delete(cache_key)
-            return {"table": None, "object": obj, "cache_expiry": None, "server_key": self.librenms_api.server_key}
+            return {"table": None, "object": obj, "cache_expiry": None, "server_key": server_key}
         # Validate that the cached inventory was built for the same LibreNMS device.
         # If the object has been remapped to a different device, discard stale inventory.
         current_librenms_id = self.librenms_api.get_librenms_id(sync_device)
         if cached_payload.get("librenms_id") != current_librenms_id:
             cache.delete(cache_key)
-            return {"table": None, "object": obj, "cache_expiry": None, "server_key": self.librenms_api.server_key}
+            return {"table": None, "object": obj, "cache_expiry": None, "server_key": server_key}
         return self._build_context(request, obj, cached_payload["inventory"])
 
     def _build_context(self, request, obj, inventory_data):
@@ -446,8 +468,8 @@ def _build_context(self, request, obj, inventory_data):
         table.configure(request)
 
         sync_device = self._get_sync_device(obj)
-        cache_ttl = getattr(cache, "ttl", lambda k: None)(
-            self.get_cache_key(sync_device, "inventory", server_key=self.librenms_api.server_key)
+        cache_ttl = cache_remaining_ttl(
+            cache, self.get_cache_key(sync_device, "inventory", server_key=self.librenms_api.server_key)
         )
         cache_expiry = (
             timezone.now() + timezone.timedelta(seconds=cache_ttl) if cache_ttl is not None and cache_ttl > 0 else None
@@ -709,16 +731,6 @@ def _build_interface_indexes(self, member):
 
         return interfaces_by_port_id, interfaces_by_name
 
-    def _get_interfaces_by_port_id(self, member):
-        """Build an index of device interfaces keyed by LibreNMS port_id."""
-        interface_map, _ = self._build_interface_indexes(member)
-        return interface_map
-
-    def _get_interfaces_by_name(self, member):
-        """Build an index of device interfaces keyed by unique interface names."""
-        _, interface_map = self._build_interface_indexes(member)
-        return interface_map
-
     @staticmethod
     def _build_interface_match_candidates(row):
         """Return ordered candidate interface labels from a row."""
@@ -1053,8 +1065,21 @@ def _merge_transceiver_data(self, inventory_data, ports_data=None):
         if not transceivers:
             return inventory_data, None
 
+        # LibreNMS may return SNMP entity indices as ints on one endpoint and numeric strings on
+        # another (e.g. ENTITY-MIB "300" vs the transceiver API's 300). Coerce both sides to int
+        # so a matching ENTITY row is found instead of caching a duplicate synthetic transceiver.
+        # Local helper to avoid shadowing/duplicating the module-level _try_int the feature stack
+        # adds with the same semantics.
+        def _coerce_idx(value):
+            try:
+                return int(value)
+            except (TypeError, ValueError):
+                return None
+
         # Build lookup of existing inventory items by index and serial
-        inv_by_index = {idx: item for item in inventory_data if (idx := item.get("entPhysicalIndex")) is not None}
+        inv_by_index = {
+            idx: item for item in inventory_data if (idx := _coerce_idx(item.get("entPhysicalIndex"))) is not None
+        }
         inv_serials = {
             s
             for item in inventory_data
@@ -1067,8 +1092,8 @@ def _merge_transceiver_data(self, inventory_data, ports_data=None):
         # Types that are containers, not real transceiver modules
 
         for txr in transceivers:
-            ent_idx = txr.get("entity_physical_index")
-            if not ent_idx:
+            ent_idx = _coerce_idx(txr.get("entity_physical_index"))
+            if ent_idx is None or ent_idx <= 0:
                 continue
 
             port_id = txr.get("port_id")
@@ -1572,9 +1597,23 @@ def _get_module_bays(self, obj):
         """
         from dcim.models import ModuleBay
 
-        bays = ModuleBay.objects.filter(device=obj).select_related(
-            "installed_module__module_type",
-            "module__module_bay",
+        # Prefetch the installed module's device/type/platform: the per-row interface-name
+        # prediction (get_module_template_interface_names → naming-plugin rule lookup) reads
+        # installed_module.device.device_type/platform, which is otherwise an N+1 per
+        # installed-module row (all resolving to the same page device).
+        bays = (
+            ModuleBay.objects.filter(device=obj)
+            .select_related(
+                "installed_module__module_type",
+                "installed_module__device__device_type",
+                "installed_module__device__platform",
+                "module__module_bay",
+            )
+            .prefetch_related(
+                # adoptable-interface count instantiates the installed module's interface templates
+                # (get_module_template_interface_names); prefetch them so it isn't one query per row.
+                "installed_module__module_type__interfacetemplates",
+            )
         )
         device_bays = {}
         module_scoped_bays = {}
diff --git a/netbox_librenms_plugin/views/sync/modules.py b/netbox_librenms_plugin/views/sync/modules.py
index 39b0fa1c1c..c2303fb24a 100644
--- a/netbox_librenms_plugin/views/sync/modules.py
+++ b/netbox_librenms_plugin/views/sync/modules.py
@@ -1,6 +1,9 @@
 """Sync action views for module/inventory installation from LibreNMS."""
 
+import copy
+import logging
 import re
+from urllib.parse import quote_plus
 
 from django.contrib import messages
 from django.core.cache import cache
@@ -18,6 +21,7 @@
     get_module_template_interface_names,
     get_module_types_indexed,
     get_vc_member_positions,
+    predict_module_interface_rename,
     rewrite_interface_name_for_vc_member,
     set_librenms_device_id,
 )
@@ -29,6 +33,8 @@
     NetBoxObjectPermissionMixin,
 )
 
+logger = logging.getLogger(__name__)
+
 
 def _modules_redirect_response(request, sync_url):
     """Return a redirect response that works for both classic and HTMX form posts.
@@ -37,8 +43,20 @@ def _modules_redirect_response(request, sync_url):
     200 response with an ``HX-Redirect`` header so the browser performs a full
     navigation that picks up Django messages and refreshes the modules table.
     For non-HTMX requests we return a normal Django redirect.
+
+    Preserve the POSTed/GET ``server_key`` on the redirect so an action taken on a
+    non-default LibreNMS server lands back on that server's modules tab rather than
+    the globally-selected one. Only a *configured* key is forwarded (mirrors the
+    HTMX rebind membership check); a stale/forged key is dropped.
     """
-    target = f"{sync_url}?tab=modules#librenms-module-table"
+    query = "tab=modules"
+    requested_server_key = (request.POST.get("server_key") or request.GET.get("server_key") or "").strip()
+    if requested_server_key:
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        if requested_server_key in LibreNMSAPI.get_available_servers():
+            query += f"&server_key={quote_plus(requested_server_key)}"
+    target = f"{sync_url}?{query}#librenms-module-table"
     if request.headers.get("HX-Request") == "true":
         response = HttpResponse(status=204)
         response["HX-Redirect"] = target
@@ -46,6 +64,58 @@ def _modules_redirect_response(request, sync_url):
     return redirect(target)
 
 
+def _render_modules_partial_after_action(request, device, sync_url, get_write_permission):
+    """
+    Respond to a module-install action with an in-place table swap for HTMX.
+
+    On an HTMX request, re-render just the module-sync table content — including its
+    flash messages — so the install updates that one panel. The classic redirect
+    reloads the whole sync page, re-rendering every tab's context plus the
+    device-info header for a single-row change. Non-HTMX requests keep the redirect
+    so the action degrades gracefully without JavaScript.
+
+    ``get_write_permission`` is a no-arg callable resolved only on the HTMX render
+    path, so the non-HTMX redirect never depends on the view's request being set.
+    """
+    if request.headers.get("HX-Request") != "true":
+        return _modules_redirect_response(request, sync_url)
+
+    # Re-render the same partial the Refresh button / initial page load use, built
+    # from the (unchanged) cached inventory plus the now-updated NetBox module state.
+    from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+
+    table_view = DeviceModuleTableView()
+    table_view.request = copy.copy(request)
+    # Render the table for the SAME LibreNMS server the action operated on. The inventory cache
+    # is namespaced by server_key; without this the fresh DeviceModuleTableView builds its
+    # LibreNMSAPI for the globally-selected server and would show an empty "refresh modules"
+    # panel whenever that differs from the POSTed key (mirrors the interfaces/cables hardening).
+    requested_server_key = (request.POST.get("server_key") or request.GET.get("server_key") or "").strip()
+    if requested_server_key:
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        # Only honour a CONFIGURED server key: a stale/forged key passed straight into
+        # LibreNMSAPI(server_key=...) raises KeyError in a multi-server config and turns this HTMX
+        # partial into a 500. When it isn't configured, leave the default-server _librenms_api in
+        # place (mirrors the interfaces/cables sync membership check).
+        if requested_server_key in LibreNMSAPI.get_available_servers():
+            table_view._librenms_api = LibreNMSAPI(server_key=requested_server_key)
+    try:
+        context = table_view.get_context_data(request, device)
+    except (KeyError, ValueError):
+        # The install/replace action already COMMITTED. When the POST carried no configured
+        # server_key, the fresh table view falls back to the default server, and building
+        # LibreNMSAPI() for a missing/misconfigured default raises here — which would turn a
+        # successful action into a 500 table-swap. Degrade to an empty panel (same shape as a
+        # cache miss) so the user sees the committed state, not a server error.
+        context = {"table": None, "object": device, "cache_expiry": None, "server_key": None}
+    return render(
+        request,
+        table_view.partial_template_name,
+        {"module_sync": context, "has_write_permission": get_write_permission()},
+    )
+
+
 def _extract_inventory_list(cached_payload):
     """Extract the inventory row list from a cached payload.
 
@@ -234,8 +304,108 @@ def _count_adoptable_interfaces(device, module):
     return Interface.objects.filter(device=device, module__isnull=True, name__in=template_names).count()
 
 
-def _adopt_existing_template_interfaces(device, module):
-    """Adopt existing standalone interfaces into an already-installed module by template name."""
+def _merge_raw_duplicate_interface(raw_iface, adopted_iface, server_key):
+    """
+    Fold a module's raw template interface into its adopted (authoritative) twin.
+
+    ``raw_iface`` is the module's freshly-instantiated template interface whose
+    naming-plugin rename was skipped because ``adopted_iface`` already held the target
+    name. The adopted interface (created earlier by another sync, possibly cabled) keeps
+    all of its own relations; only the LibreNMS port binding that lives on the raw twin is
+    moved across before the raw twin is removed. Mirrors the VC-member normalization
+    conflict handling (adopt the conflicting interface, drop the module's duplicate).
+
+    Returns True when the raw twin was merged and deleted, False when it was left in place
+    for review — because it carries a cable (deleting it would drop a real connection),
+    because it carries a LibreNMS binding that can't be transferred without a server scope,
+    or because it disappeared concurrently.
+    """
+    from dcim.models import Interface
+
+    # Re-read the twin under a row lock and re-verify the delete preconditions from the
+    # locked row (TOCTOU): a cable or IP landing between the caller's read and the delete
+    # below must not be cascaded away. The caller's transaction.atomic() scopes the lock.
+    raw_iface = Interface.objects.select_for_update().filter(pk=raw_iface.pk).first()
+    if raw_iface is None:
+        # Concurrently removed — nothing this call merged; report it left-in-place so the
+        # caller claims no action it didn't perform.
+        return False
+
+    # Never silently destroy a connection: if the raw twin is cabled, leave it for review.
+    if raw_iface.cable_id is not None:
+        return False
+
+    if not server_key and raw_iface.custom_field_data.get("librenms_id"):
+        # Without a server scope the twin's LibreNMS binding cannot be transferred, and
+        # deleting the row would destroy it permanently. Fail closed: leave the twin (and
+        # its binding) in place for review instead.
+        logger.warning(
+            "Adopt: raw twin %r carries a LibreNMS binding but no server_key was resolved; leaving it in place",
+            raw_iface.name,
+        )
+        return False
+
+    if server_key:
+        raw_port_id = _coerce_positive_int(get_librenms_device_id(raw_iface, server_key, auto_save=False))
+        adopted_port_id = _coerce_positive_int(get_librenms_device_id(adopted_iface, server_key, auto_save=False))
+        if raw_port_id and not adopted_port_id:
+            set_librenms_device_id(adopted_iface, raw_port_id, server_key)
+            adopted_iface.save(update_fields=["custom_field_data"])
+        elif raw_port_id and adopted_port_id and raw_port_id != adopted_port_id:
+            # The authoritative adopted interface keeps its own binding, but record that the raw
+            # twin carried a different LibreNMS port so a genuine conflict isn't lost silently.
+            logger.info(
+                "Adopt: raw twin %r had LibreNMS port %s but adopted %r already binds %s; keeping the adopted binding",
+                raw_iface.name,
+                raw_port_id,
+                adopted_iface.name,
+                adopted_port_id,
+            )
+
+    # Preserve the raw twin's MAC addresses before deleting it. Interface deletion cascades to
+    # its MACAddress rows (GenericRelation) and discards its primary-MAC link, so reassign them
+    # to the authoritative adopted interface first — otherwise a prior partial sync's MAC data is
+    # silently lost when the raw twin is folded in.
+    raw_primary_mac = raw_iface.primary_mac_address
+    adopted_has_primary_mac = adopted_iface.primary_mac_address_id is not None
+    for mac in raw_iface.mac_addresses.all():
+        mac.assigned_object = adopted_iface
+        mac.save()
+
+    # Same for assigned IPs: Interface deletion cascades to its IPAddress rows
+    # (GenericRelation), so a management/primary IP living on the raw twin would be
+    # destroyed — and Device.primary_ip4/6/oob_ip (on_delete=SET_NULL) silently nulled.
+    # Reassigning keeps the IP rows alive, so those device FKs stay valid.
+    for ip in raw_iface.ip_addresses.all():
+        ip.assigned_object = adopted_iface
+        ip.save()
+
+    raw_iface.delete()
+
+    # primary_mac_address is UNIQUE per interface, so the adopted interface can only claim the
+    # raw twin's primary MAC after the raw row (still holding that FK) is gone, and only when the
+    # adopted interface had no primary MAC of its own.
+    if raw_primary_mac is not None and not adopted_has_primary_mac:
+        adopted_iface.primary_mac_address = raw_primary_mac
+        adopted_iface.save(update_fields=["primary_mac_address"])
+
+    return True
+
+
+def _adopt_existing_template_interfaces(device, module, server_key=None):
+    """
+    Adopt standalone interfaces matching the module's interface templates into the module.
+
+    Standalone (module-less) interfaces whose name matches one of the module's
+    instantiated, naming-plugin-predicted template names are claimed into ``module``.
+
+    When the module already holds a *raw* interface whose predicted name equals an adopted
+    standalone's name — i.e. a naming plugin (e.g. InterfaceNameRules) skipped the rename
+    because that target name was already taken by the externally-created standalone — the
+    standalone is treated as the authoritative interface: it keeps its own cables/relations,
+    the raw twin's LibreNMS port binding is moved onto it, and the redundant raw twin is
+    removed.
+    """
     from dcim.models import Interface
 
     template_names = get_module_template_interface_names(device, module)
@@ -252,18 +422,51 @@ def _adopt_existing_template_interfaces(device, module):
             "reason": "no matching standalone interfaces found for this module's interface templates",
         }
 
+    # Map each desired (predicted) name to the module's raw interface that would be renamed
+    # to it, so an adopted standalone can be recognised as that raw interface's renamed twin
+    # and the now-redundant raw interface folded in.
+    raw_dup_by_desired: dict = {}
+    raw_module_ifaces = [
+        module_iface
+        for module_iface in Interface.objects.filter(module=module)
+        if module_iface.name not in template_names  # skip already-correctly-named
+    ]
+    if raw_module_ifaces:
+        # Resolve every raw name in ONE dispatch: the signal takes a names list and returns a
+        # 1:1, order-preserving result, so a per-interface loop would re-run every receiver's
+        # rule matching N times (cost scales with port count).
+        predicted_names = predict_module_interface_rename(device, module, [i.name for i in raw_module_ifaces])
+        for module_iface, desired in zip(raw_module_ifaces, predicted_names):
+            if desired != module_iface.name:
+                raw_dup_by_desired.setdefault(desired, module_iface)
+
     adopted_names = []
+    merged_names = []
+    cabled_duplicates = []
     with transaction.atomic():
         for interface in interfaces:
             interface.module = module
             interface.save(update_fields=["module"])
             adopted_names.append(interface.name)
 
-    return {
+            raw_dup = raw_dup_by_desired.get(interface.name)
+            if raw_dup is not None:
+                if _merge_raw_duplicate_interface(raw_dup, interface, server_key):
+                    merged_names.append(raw_dup.name)
+                else:
+                    cabled_duplicates.append(raw_dup.name)
+
+    result = {
         "status": "bound",
         "adopted_count": len(adopted_names),
         "interfaces": adopted_names,
     }
+    if merged_names:
+        result["merged_count"] = len(merged_names)
+        result["merged_interfaces"] = merged_names
+    if cabled_duplicates:
+        result["cabled_duplicates"] = cabled_duplicates
+    return result
 
 
 def _get_vc_member_positions(device):
@@ -438,7 +641,10 @@ def _bind_interface_librenms_id(device, item, module_pk, server_key):
     if update_fields:
         candidate.save(update_fields=sorted(set(update_fields)))
 
-    return {"status": "bound", "interface": candidate.name, "port_id": port_id}
+    # ``changed`` distinguishes a real (re)bind from a no-op where the port already sat on this
+    # interface: callers surface the "bound <iface> to port_id N" confirmation only when something
+    # actually changed, so a no-op doesn't emit a misleading message.
+    return {"status": "bound", "interface": candidate.name, "port_id": port_id, "changed": bool(update_fields)}
 
 
 def _resolve_single_install_binding_item(request, target_device, server_key, get_cache_key):
@@ -486,7 +692,7 @@ def _should_attempt_bind_for_result(result):
     return False
 
 
-class InstallModuleView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, CacheMixin, View):
+class InstallModuleView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View):
     """Install a NetBox Module into a ModuleBay from LibreNMS inventory data."""
 
     def post(self, request, pk):
@@ -504,7 +710,12 @@ def post(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        server_key = (request.POST.get("server_key") or "").strip()
+        # Fall back to the resolved client server (like InstallBranchView / InstallSelectedView /
+        # ReplaceModuleView) when the form posts a blank server_key — e.g. a fallback render where
+        # module_sync.server_key is empty. Without it, `if bind_item and server_key` below is skipped
+        # and the module installs but its matching interface is never bound to its LibreNMS port_id,
+        # with no error surfaced.
+        server_key = (request.POST.get("server_key") or "").strip() or self.librenms_api.server_key
         bind_item = _resolve_single_install_binding_item(request, target_device, server_key, self.get_cache_key)
         serial = request.POST.get("serial", "").strip()
         if serial.lower() in _PLACEHOLDER_VALUES:
@@ -516,7 +727,7 @@ def post(self, request, pk):
             module_type_id = int(request.POST.get("module_type_id"))
         except (TypeError, ValueError):
             messages.error(request, "Missing or invalid module bay/module type ID.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         get_object_or_404(ModuleBay, pk=module_bay_id, device=target_device)  # verify bay belongs to selected device
         module_type = get_object_or_404(ModuleType, pk=module_type_id)
@@ -527,7 +738,9 @@ def post(self, request, pk):
                 locked_bay = ModuleBay.objects.select_for_update().get(pk=module_bay_id)
                 if hasattr(locked_bay, "installed_module") and locked_bay.installed_module:
                     messages.warning(request, f"Module bay '{locked_bay.name}' already has a module installed.")
-                    return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+                    return _render_modules_partial_after_action(
+                        request, target_device, sync_url, self.has_write_permission
+                    )
                 module = Module(
                     device=target_device,
                     module_bay=locked_bay,
@@ -572,7 +785,7 @@ def post(self, request, pk):
                     "Interface identity fallback used posted row metadata because a matching cached "
                     "inventory row was unavailable. Verify the resulting binding.",
                 )
-            if bind_result and bind_result.get("status") == "bound":
+            if bind_result and bind_result.get("status") == "bound" and bind_result.get("changed"):
                 messages.info(
                     request,
                     f"Bound {bind_result['interface']} to LibreNMS port_id {bind_result['port_id']}.",
@@ -586,7 +799,7 @@ def post(self, request, pk):
         except (ValidationError, IntegrityError) as e:
             messages.error(request, f"Failed to install module: {e}")
 
-        return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+        return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
 
 class InstallBranchView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View):
@@ -618,20 +831,20 @@ def post(self, request, pk):
 
         if not parent_index:
             messages.error(request, "Missing parent inventory index.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         try:
             parent_index = int(parent_index)
         except ValueError:
             messages.error(request, "Invalid parent inventory index.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         # Get cached inventory data
         sync_device = _get_sync_device_for_inventory(target_device, server_key)
         cached_data = _get_cached_inventory_for_device(sync_device, server_key, self.get_cache_key)
         if not cached_data:
             messages.error(request, "No cached inventory data. Please refresh modules first.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         # Load ignore rules so the branch respects the same filters shown in the table
         from netbox_librenms_plugin.utils import get_enabled_ignore_rules
@@ -645,7 +858,7 @@ def post(self, request, pk):
 
         if not branch_items:
             messages.warning(request, "No installable items found in this branch.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         # Load module types (with mappings)
         module_types = get_module_types_indexed()
@@ -707,10 +920,10 @@ def post(self, request, pk):
                             skipped.append(f"{result['name']}: {bind_result['reason']}")
         except (ValidationError, IntegrityError) as e:
             messages.error(request, f"Branch install failed: {e}")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         _report_install_results(request, installed, skipped, failed)
-        return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+        return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
     def _collect_branch(self, parent_index, inventory_data, ignore_rules=None, device_serial="", index_map=None):
         """
@@ -1099,27 +1312,27 @@ def post(self, request, pk):
         selected_indices = request.POST.getlist("select")
         if not selected_indices:
             messages.warning(request, "No modules selected.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         sync_device = _get_sync_device_for_inventory(page_device, server_key)
         cached_data = _get_cached_inventory_for_device(sync_device, server_key, self.get_cache_key)
         if not cached_data:
             messages.error(request, "No cached inventory data. Please refresh modules first.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         try:
             # Use dict.fromkeys to preserve order while deduplicating
             selected_list = list(dict.fromkeys(int(i) for i in selected_indices))
         except ValueError:
             messages.error(request, "Invalid selection.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         index_map = {idx: item for item in cached_data if (idx := item.get("entPhysicalIndex")) is not None}
         items = [index_map[idx] for idx in selected_list if idx in index_map]
 
         if not items:
             messages.warning(request, "None of the selected indices matched cached inventory.")
-            return redirect(f"{sync_url}?tab=modules#librenms-module-table")
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         # Load ignore rules once; they're evaluated per-row inside the install
         # loop using the *resolved* target device serial, since VC rows may
@@ -1261,10 +1474,15 @@ def post(self, request, pk):
         except (ValidationError, IntegrityError) as e:
             messages.error(request, f"Failed to update serial: {e}")
 
+        # The 'Update Serial Only' modal form posts hx-swap="none" with no target and relies on the
+        # HX-Redirect to close the modal + reload (like the sibling MoveModuleView) — a 200 partial
+        # would be discarded by HTMX, leaving the modal open on stale mismatch data.
         return _modules_redirect_response(request, sync_url)
 
 
-class UpdateModuleInterfaceView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, CacheMixin, View):
+class UpdateModuleInterfaceView(
+    LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View
+):
     """Associate a matching NetBox interface with an already-installed module."""
 
     def post(self, request, pk):
@@ -1280,7 +1498,12 @@ def post(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        server_key = (request.POST.get("server_key") or "").strip()
+        # Fall back to the resolved client server (mirrors InstallModuleView) when the form
+        # posts a blank server_key — e.g. a stale tab or a fallback render where
+        # module_sync.server_key is empty. Without it the port-bind is skipped AND the
+        # adopt/merge runs without a server scope, so the raw twin's LibreNMS binding
+        # cannot be transferred onto the adopted interface.
+        server_key = (request.POST.get("server_key") or "").strip() or self.librenms_api.server_key
         bind_item = _resolve_single_install_binding_item(request, target_device, server_key, self.get_cache_key)
         sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": pk})
 
@@ -1288,7 +1511,7 @@ def post(self, request, pk):
             module_id = int(request.POST.get("module_id"))
         except (TypeError, ValueError):
             messages.error(request, "Missing or invalid module ID.")
-            return _modules_redirect_response(request, sync_url)
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         module = get_object_or_404(Module, pk=module_id, device=target_device)
 
@@ -1296,8 +1519,34 @@ def post(self, request, pk):
             bind_result = None
             if bind_item and server_key:
                 bind_result = _bind_interface_librenms_id(target_device, bind_item, module.pk, server_key)
-            if bind_result is None:
-                bind_result = _adopt_existing_template_interfaces(target_device, module)
+            # The port-bind above maps at most one LibreNMS port and is a no-op when that
+            # port already sits on the module's interface. Always reconcile standalone
+            # interfaces matching the module's predicted template names — adopting them (and
+            # folding in any raw duplicate a skipped rename left behind) is the action this
+            # button is offered for, so it must run even when the port-bind changed nothing.
+            adopt_result = _adopt_existing_template_interfaces(target_device, module, server_key)
+            if adopt_result.get("status") == "bound":
+                # Adoption becomes the summary result, but don't let it SWALLOW a concurrent
+                # port-bind that ACTUALLY (re)bound a port: when both land in one click, surface the
+                # "bound <iface> to port_id N" detail before the adopt summary replaces bind_result —
+                # otherwise the user can't tell which port_id was bound. ``changed`` guards against
+                # re-announcing a no-op bind (port already on the interface).
+                if bind_result and bind_result.get("changed") and bind_result.get("interface"):
+                    messages.success(
+                        request,
+                        f"Bound interface {bind_result['interface']} to LibreNMS port_id {bind_result['port_id']}.",
+                    )
+                elif bind_result and bind_result.get("status") not in (None, "bound"):
+                    # A conflict/skipped/failed port-bind must not be swallowed by the adopt
+                    # summary about to replace bind_result — the clicked row's port binding
+                    # did NOT happen and the user needs the reason.
+                    messages.warning(
+                        request,
+                        f"Could not update interface association: {bind_result.get('reason', 'unknown reason')}",
+                    )
+                bind_result = adopt_result
+            elif bind_result is None:
+                bind_result = adopt_result
         except Exception:
             bind_result = {
                 "status": "failed",
@@ -1308,24 +1557,38 @@ def post(self, request, pk):
             messages.error(request, "No LibreNMS interface identity is available for this row.")
         elif bind_result.get("status") == "bound":
             adopted_count = bind_result.get("adopted_count")
+            merged_count = bind_result.get("merged_count")
             if adopted_count:
-                messages.success(
-                    request,
+                message = (
                     f"Updated interfaces for {module.module_type.model} in {module.module_bay.name}: "
-                    f"adopted {adopted_count} existing standalone interface(s).",
+                    f"adopted {adopted_count} existing standalone interface(s)"
                 )
-            else:
+                if merged_count:
+                    message += f" and removed {merged_count} duplicate placeholder interface(s)"
+                messages.success(request, message + ".")
+            elif bind_result.get("changed"):
+                # Only announce a rebind that actually changed something: a plain no-op rebind
+                # (interface already correctly named/bound) returns changed=False, and the sibling
+                # InstallModuleView/ReplaceModuleView bind messages gate on it too.
                 messages.success(
                     request,
                     f"Updated interface {bind_result['interface']} for {module.module_type.model} in {module.module_bay.name}.",
                 )
+            cabled_duplicates = bind_result.get("cabled_duplicates")
+            if cabled_duplicates:
+                messages.warning(
+                    request,
+                    "Left duplicate interface(s) in place because they carry a cable or a "
+                    "LibreNMS binding that could not be transferred "
+                    f"(review manually): {', '.join(cabled_duplicates)}.",
+                )
         else:
             messages.warning(
                 request,
                 f"Could not update interface association: {bind_result.get('reason', 'unknown reason')}",
             )
 
-        return _modules_redirect_response(request, sync_url)
+        return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
 
 class ModuleMismatchPreviewView(
@@ -1395,6 +1658,11 @@ def get(self, request, pk):
         )
 
         type_mismatch = matched_type is not None and installed_module.module_type_id != matched_type.pk
+        # type_matched: the LibreNMS model RESOLVED to the installed module's type (directly or via a
+        # ModuleTypeMapping). Distinct from "not type_mismatch", which also covers an UNRECOGNISED model
+        # (matched_type is None). The modal uses this to badge the LibreNMS model when its display string
+        # differs from the NetBox type but is a confirmed match (the common serial-mismatch case).
+        type_matched = matched_type is not None and installed_module.module_type_id == matched_type.pk
         installed_serial = (installed_module.serial or "").strip()
         if installed_serial.lower() in _PLACEHOLDER_VALUES:
             installed_serial = ""
@@ -1429,6 +1697,7 @@ def get(self, request, pk):
                 "librenms_model": librenms_model,
                 "librenms_serial": librenms_serial,
                 "type_mismatch": type_mismatch,
+                "type_matched": type_matched,
                 "serial_mismatch": serial_mismatch,
                 "serial_conflict": serial_conflict,
                 "serial_conflict_ambiguous": serial_conflict_ambiguous,
@@ -1663,7 +1932,7 @@ def post(self, request, pk):
                     request,
                     f"VC member interface normalization applied: {vc_summary}.",
                 )
-            if bind_result and bind_result.get("status") == "bound":
+            if bind_result and bind_result.get("status") == "bound" and bind_result.get("changed"):
                 messages.info(
                     request,
                     f"Bound {bind_result['interface']} to LibreNMS port_id {bind_result['port_id']}.",

From 70a8e707fa53b39971902e4607ebe82750184ea0 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 05/17] fix(cables,vlans): harden cable/vlan verify and cut
 per-row queries

Gate SingleCableVerifyView on dcim.view_device, validate and guard server_key before scoping
the cache and ORM lookups, fail closed on malformed cached link/VLAN snapshots, render an
empty VLAN table on an empty snapshot, and cache the VC member set instead of querying it
per row.
---
 netbox_librenms_plugin/tables/cables.py       |  37 +++-
 .../tests/test_cable_verify.py                | 135 +++++++++++++
 .../tests/test_enrich_remote_port_realdb.py   | 180 ++++++++++++++++++
 .../tests/test_vlan_sync_group_missing.py     | 109 +++++++++++
 .../views/base/cables_view.py                 | 137 ++++++++++---
 .../views/base/vlan_table_view.py             |  33 +++-
 netbox_librenms_plugin/views/sync/vlans.py    |  25 ++-
 7 files changed, 617 insertions(+), 39 deletions(-)
 create mode 100644 netbox_librenms_plugin/tests/test_enrich_remote_port_realdb.py
 create mode 100644 netbox_librenms_plugin/tests/test_vlan_sync_group_missing.py

diff --git a/netbox_librenms_plugin/tables/cables.py b/netbox_librenms_plugin/tables/cables.py
index cad4660b34..5a2d13b0be 100644
--- a/netbox_librenms_plugin/tables/cables.py
+++ b/netbox_librenms_plugin/tables/cables.py
@@ -1,3 +1,5 @@
+import re
+
 import django_tables2 as tables
 from django.utils.html import escape, format_html
 from django.utils.safestring import mark_safe
@@ -6,7 +8,6 @@
 
 from netbox_librenms_plugin.utils import (
     get_table_paginate_count,
-    get_virtual_chassis_member,
 )
 
 
@@ -118,17 +119,43 @@ class VCCableTable(LibreNMSCableTable):
     def __init__(self, *args, device=None, **kwargs):
         """Initialize the VC cable table with device context."""
         super().__init__(*args, device=device, **kwargs)
+        # Cache the VC member set once so render_device_selection doesn't re-query
+        # members.all() (and a members.get per row via get_virtual_chassis_member) for every
+        # row in large cable tables. Mirrors VCModuleTable.
+        self._vc_members = []
+        self._vc_member_by_position = {}
+        if getattr(self.device, "virtual_chassis", None):
+            self._vc_members = list(self.device.virtual_chassis.members.all())
+            self._vc_member_by_position = {m.vc_position: m for m in self._vc_members}
+
+    def _selected_member_id(self, port_name):
+        """
+        Resolve the selected VC member id from the port name.
+
+        Served from the cached member set, mirroring get_virtual_chassis_member's position
+        parse but without a per-row members.get() query.
+
+        Args:
+            port_name: The LibreNMS local port name (e.g. ``Ethernet3``).
+
+        Returns:
+            int: The matched member's id, or the table device's id when no member matches.
+        """
+        match = re.match(r"^[A-Za-z]+(\d+)", port_name or "")
+        if match:
+            member = self._vc_member_by_position.get(int(match.group(1)))
+            if member is not None:
+                return member.id
+        return self.device.id
 
     def render_device_selection(self, value, record):
         """Render a dropdown to select the virtual chassis member for a port."""
-        members = self.device.virtual_chassis.members.all()
-        chassis_member = get_virtual_chassis_member(self.device, record["local_port"])
-        selected_member_id = chassis_member.id if chassis_member else self.device.id
+        selected_member_id = self._selected_member_id(record["local_port"])
         port_id = record["local_port_id"]
 
         options = [
             f'<option value="{member.id}"{" selected" if member.id == selected_member_id else ""}>{escape(member.name)}</option>'
-            for member in members
+            for member in self._vc_members
         ]
 
         return format_html(
diff --git a/netbox_librenms_plugin/tests/test_cable_verify.py b/netbox_librenms_plugin/tests/test_cable_verify.py
index 36aaf3952d..069234f438 100644
--- a/netbox_librenms_plugin/tests/test_cable_verify.py
+++ b/netbox_librenms_plugin/tests/test_cable_verify.py
@@ -10,6 +10,8 @@
 import json
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 def _make_view(server_key="default"):
     """Create a SingleCableVerifyView instance without database access."""
@@ -309,3 +311,136 @@ def fake_check_cable_status(link):
         assert "<img " not in remote_device_html
         # Escaped version should be present (browser renders as text, not tag)
         assert "&lt;img" in remote_device_html
+
+
+class TestServerKeyGuard:
+    """A forged non-string server_key must not crash the membership check (get_available_servers() is a dict)."""
+
+    def _view(self, available):
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+        view = object.__new__(SingleCableVerifyView)
+        view._librenms_api = MagicMock()
+        view._librenms_api.server_key = "default"
+        # A REAL dict so the `in` membership test really hashes the key (the crash point).
+        view._librenms_api.get_available_servers.return_value = available
+        view.require_object_permissions_json = MagicMock(return_value=None)
+        return view
+
+    @pytest.mark.parametrize("forged", [["prod"], {"prod": 1}])
+    def test_unhashable_server_key_falls_back_without_crashing(self, forged):
+        """A JSON array/object server_key must fall back to the active server, not raise TypeError."""
+        # No device_id → post resolves server_key (the guarded line) then returns the empty row.
+        view = self._view({"default": "Default Server"})
+        request = _make_request({"server_key": forged})
+
+        response = view.post(request)  # must not raise unhashable-type TypeError
+
+        assert response.status_code == 200
+
+    def test_valid_string_server_key_is_still_honoured(self):
+        """A configured string key still passes the isinstance guard (regression for the str check)."""
+        view = self._view({"prod": "Prod Server"})
+        request = _make_request({"server_key": "prod", "device_id": ""})
+
+        response = view.post(request)
+
+        assert response.status_code == 200
+
+
+@pytest.mark.django_db
+class TestCablesGetRenderDegradesOnBrokenDefaultServer:
+    """A cached cables GET must degrade cleanly when the default LibreNMS server is misconfigured, not 500 on the lazy LibreNMSAPI() construction."""
+
+    def test_cached_render_does_not_500_when_default_server_build_fails(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceCableTableView
+
+        tag = "cables-broken-srv"
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-{tag}", slug=f"mfr-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-{tag}", slug=f"dt-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name=f"Role-{tag}", slug=f"role-{tag}")
+        site, _ = Site.objects.get_or_create(name=f"Site-{tag}", slug=f"site-{tag}")
+        device = Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
+        view = DeviceCableTableView()
+        request = RequestFactory().get("/")
+        User = get_user_model()
+        request.user = User.objects.filter(is_superuser=True, is_active=True).first() or User.objects.create(
+            username="cables-su", is_superuser=True, is_active=True
+        )
+        view.request = request
+
+        # Seed the links cache under the DEGRADED (None) server_key — what the broken-server render reads.
+        key = view.get_cache_key(device, "links", None)
+        cache.set(
+            key,
+            {"links": [{"local_port": "Gi0/1", "local_port_id": "1", "remote_device": None}]},
+            timeout=300,
+        )
+
+        def broken_cfg(_plugin, cfg_key, *args, **kwargs):
+            # A non-empty 'servers' with no 'default' and no valid dict entry makes LibreNMSAPI()
+            # raise ValueError in its constructor — the exact broken-default-server condition.
+            return {"alpha": "not-a-dict"} if cfg_key == "servers" else None
+
+        try:
+            with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", side_effect=broken_cfg):
+                context = view.get_context_data(request, device)
+            # Degrades: the cached links still render (server_key falls back to None) instead of a 500.
+            assert context is not None
+            assert context["table"] is not None
+            assert context["server_key"] is None
+        finally:
+            cache.delete(key)
+
+
+@pytest.mark.django_db
+class TestSingleCableVerifyMisconfiguredDefault:
+    """SingleCableVerifyView resolves configured servers via the classmethod, not the raising instance property."""
+
+    def test_configured_key_does_not_500_when_default_broken(self):
+        """A configured 'prod' key resolves without constructing the broken default client (issue #108/#109)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+        from django.test import RequestFactory, override_settings
+
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Mfr-scv", slug="mfr-scv")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-scv", slug="dt-scv")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-scv", slug="role-scv")
+        site, _ = Site.objects.get_or_create(name="Site-scv", slug="site-scv")
+        device = Device.objects.create(name="host-scv", device_type=dt, role=role, site=site, status="active")
+
+        view = object.__new__(SingleCableVerifyView)
+        view._librenms_api = None  # live property: accessing it would build LibreNMSAPI() (default)
+        view.require_object_permissions_json = MagicMock(return_value=None)
+
+        # DEFAULT present-but-broken (no url/token) → LibreNMSAPI() raises; get_available_servers()={'prod'}.
+        cfg = {
+            "netbox_librenms_plugin": {
+                "servers": {
+                    "prod": {"librenms_url": "http://prod.example", "api_token": "tok"},
+                    "default": {},
+                }
+            }
+        }
+        request = RequestFactory().post(
+            "/verify/",
+            data=json.dumps({"device_id": device.pk, "local_port_id": "1", "server_key": "prod"}),
+            content_type="application/json",
+        )
+        # RequestFactory skips AuthenticationMiddleware; the object-scoped device lookup reads
+        # request.user, so attach a real superuser (this test is about server-key degradation, not
+        # object scope).
+        from django.contrib.auth import get_user_model
+
+        request.user = get_user_model().objects.create_user(username="scv-user", password="x", is_superuser=True)
+        with override_settings(PLUGINS_CONFIG=cfg):
+            response = view.post(request)
+
+        assert response.status_code == 200
+        assert json.loads(response.content)["status"] == "success"
diff --git a/netbox_librenms_plugin/tests/test_enrich_remote_port_realdb.py b/netbox_librenms_plugin/tests/test_enrich_remote_port_realdb.py
new file mode 100644
index 0000000000..3ea6832d7d
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_enrich_remote_port_realdb.py
@@ -0,0 +1,180 @@
+"""Real-DB coverage for BaseCableTableView.enrich_remote_port librenms_id lookup.
+
+Issue #113 (CodeRabbit): the mock-based enrich_remote_port tests in test_coverage_base_views2.py
+use a reported remote_port equal to the interface name, so they still pass if the librenms_id
+branch is broken and the method falls back to ``name=remote_port`` — the mocked queryset returns
+the same interface for *every* filter call.
+
+These tests exercise the real ORM with the reported port name deliberately DIFFERENT from the
+interface name, so a match can only come from the librenms_id custom-field lookup
+(``_librenms_id_q``). If the id branch regresses, the name fallback finds nothing and the
+assertions fail — a genuine red→green guard.
+"""
+
+from unittest.mock import MagicMock
+
+import pytest
+
+
+def _make_view():
+    from netbox_librenms_plugin.views.base.cables_view import BaseCableTableView
+
+    view = object.__new__(BaseCableTableView)
+    view._librenms_api = MagicMock()
+    view._librenms_api.server_key = "default"
+    return view
+
+
+def _make_device(name, slug_suffix):
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="ACME-113", slug="acme-113")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-113", slug="dt-113")
+    role, _ = DeviceRole.objects.get_or_create(name="Role-113", slug="role-113")
+    site, _ = Site.objects.get_or_create(name="Site-113", slug="site-113")
+    return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
+
+
+@pytest.mark.django_db
+class TestEnrichRemotePortLibrenmsIdRealDB:
+    def test_non_vc_finds_by_librenms_id_when_name_differs(self):
+        """Non-VC: interface name differs from the reported remote_port, so only the librenms_id lookup can match."""
+        from dcim.models import Interface
+
+        device = _make_device("switch-a", "a")
+        iface = Interface.objects.create(
+            device=device,
+            name="ge-0/0/77",
+            type="1000base-t",
+            custom_field_data={"librenms_id": {"default": 20}},
+        )
+
+        view = _make_view()
+        # Reported port name deliberately != iface.name; match must come from remote_port_id.
+        link = {"remote_port": "reported-different-name", "remote_port_id": 20}
+
+        result = view.enrich_remote_port(link, device)
+
+        assert result["netbox_remote_interface_id"] == iface.pk
+        assert result["remote_port_name"] == "ge-0/0/77"
+
+    def test_non_vc_returns_no_interface_when_id_misses_and_name_differs(self):
+        """When the librenms_id misses and the name differs, nothing matches — confirms the positive test above is genuinely driven by the id lookup, not an unconditional return."""
+        from dcim.models import Interface
+
+        device = _make_device("switch-a", "a")
+        Interface.objects.create(
+            device=device,
+            name="ge-0/0/77",
+            type="1000base-t",
+            custom_field_data={"librenms_id": {"default": 20}},
+        )
+
+        view = _make_view()
+        link = {"remote_port": "reported-different-name", "remote_port_id": 999}
+
+        result = view.enrich_remote_port(link, device)
+
+        assert "netbox_remote_interface_id" not in result
+
+    def test_vc_member_finds_by_librenms_id_when_name_differs(self):
+        """VC: the reported port keeps the slot prefix (Gi1/...) so member selection resolves vc_position=1, but the interface name differs — so only the librenms_id lookup can match."""
+        from dcim.models import Interface, VirtualChassis
+
+        member = _make_device("vc-member", "vc")
+        vc = VirtualChassis.objects.create(name="vc-113")
+        member.virtual_chassis = vc
+        member.vc_position = 1
+        member.save()
+
+        iface = Interface.objects.create(
+            device=member,
+            name="xe-1/0/5",
+            type="10gbase-x-sfpp",
+            custom_field_data={"librenms_id": {"default": 21}},
+        )
+
+        view = _make_view()
+        # "Gi1/0/99" → slot 1 (member_pos), but != iface.name "xe-1/0/5".
+        link = {"remote_port": "Gi1/0/99", "remote_port_id": 21}
+
+        result = view.enrich_remote_port(link, member)
+
+        assert result["netbox_remote_interface_id"] == iface.pk
+        assert result["remote_port_name"] == "xe-1/0/5"
+
+
+@pytest.mark.django_db
+class TestVCCableTableMemberQueryCount:
+    """VCCableTable must fetch the VC member set once (in __init__), not per row: render_device_selection previously ran members.all() plus a members.get (via get_virtual_chassis_member) for every cable row."""
+
+    def test_render_device_selection_does_not_query_members_per_row(self):
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from dcim.models import VirtualChassis
+        from netbox_librenms_plugin.tables.cables import VCCableTable
+
+        m1 = _make_device("vc-cable-m1", "c1")
+        vc = VirtualChassis.objects.create(name="vc-cables")
+        m1.virtual_chassis = vc
+        m1.vc_position = 1
+        m1.save()
+        m2 = _make_device("vc-cable-m2", "c2")
+        m2.virtual_chassis = vc
+        m2.vc_position = 2
+        m2.save()
+
+        rows = [
+            {"local_port": f"Gi1/0/{i}", "local_port_id": i, "remote_port": "", "remote_device": "", "cable_status": ""}
+            for i in range(1, 6)  # 5 rows
+        ]
+        # Build the table OUTSIDE the capture so the one-time member fetch isn't counted.
+        table = VCCableTable(rows, device=m1)
+
+        with CaptureQueriesContext(connection) as ctx:
+            for row in rows:
+                table.render_device_selection(row["local_port_id"], row)
+
+        member_queries = [q for q in ctx.captured_queries if "dcim_device" in q["sql"].lower()]
+        # Every row renders from the cached member set → no per-row member queries.
+        assert member_queries == [], f"render_device_selection queried members per row: {len(member_queries)} queries"
+
+
+@pytest.mark.django_db
+class TestModuleTableInstalledModulePrefetch:
+    """LibreNMSModuleTable must batch-load installed modules (with interface templates) in __init__, so render_actions' VC 'Report VC issue' diagnostic adds no per-row Module/interfacetemplate query."""
+
+    def test_render_actions_does_not_query_installed_modules_per_row(self):
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from dcim.models import Module, ModuleBay, ModuleType, VirtualChassis
+        from netbox_librenms_plugin.tables.modules import VCModuleTable
+
+        member = _make_device("vc-mod-m1", "modf4")
+        vc = VirtualChassis.objects.create(name="vc-mod-f4")
+        member.virtual_chassis = vc
+        member.vc_position = 1
+        member.save()
+        mt = ModuleType.objects.create(manufacturer=member.device_type.manufacturer, model="LC-F4-48x10G")
+
+        rows = []
+        for i in range(1, 4):  # 3 installed modules → 3 rows
+            bay = ModuleBay.objects.create(device=member, name=f"Slot{i}")
+            module = Module.objects.create(device=member, module_bay=bay, module_type=mt)
+            rows.append({"installed_module_id": module.pk, "status": "Matched", "name": f"Slot{i}"})
+
+        # Build OUTSIDE the capture so the one-time batch prefetch isn't counted.
+        table = VCModuleTable(rows, device=member, has_write_permission=True, can_add_module=True)
+
+        with CaptureQueriesContext(connection) as ctx:
+            for row in rows:
+                table.render_actions(None, row)
+
+        per_row_queries = [
+            q for q in ctx.captured_queries if '"dcim_module"' in q["sql"] or '"dcim_interfacetemplate"' in q["sql"]
+        ]
+        assert per_row_queries == [], (
+            f"render_actions queried installed modules/templates per row: {len(per_row_queries)} queries"
+        )
diff --git a/netbox_librenms_plugin/tests/test_vlan_sync_group_missing.py b/netbox_librenms_plugin/tests/test_vlan_sync_group_missing.py
new file mode 100644
index 0000000000..79f5b912ca
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_vlan_sync_group_missing.py
@@ -0,0 +1,109 @@
+"""Real-DB e2e: a VLAN whose selected group no longer exists must not report as 'unchanged'.
+
+SyncVLANsView._handle_create_vlans fails closed when a per-row ``vlan_group_{vid}`` points at a
+missing group: it skips that VID (never creating it in the wrong scope) and emits its own error.
+Previously that skip was folded into the shared ``skipped_count`` and surfaced as "N unchanged" in a
+*success* message — implying the VID synced fine. This drives the real view end-to-end (real Device,
+real cache, real message framework, real DB) to pin that the group-missing skip is counted and
+messaged separately and never claims success.
+"""
+
+import pytest
+from django.contrib.auth import get_user_model
+from django.contrib.messages.storage.fallback import FallbackStorage
+from django.core.cache import cache as real_cache
+from django.test import RequestFactory
+
+
+def _make_device(name):
+    from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+    mfr, _ = Manufacturer.objects.get_or_create(name="VLM-Mfr", slug="vlm-mfr")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="VLM-DT", slug="vlm-dt")
+    role, _ = DeviceRole.objects.get_or_create(name="VLM-Role", slug="vlm-role")
+    site, _ = Site.objects.get_or_create(name="VLM-Site", slug="vlm-site")
+    return Device.objects.create(name=name, device_type=dt, role=role, site=site, status="active")
+
+
+def _post_request(device_pk, vid, group_pk):
+    request = RequestFactory().post(
+        "/sync/vlans/",
+        data={
+            "action": "create_vlans",
+            "select": [str(vid)],
+            f"vlan_group_{vid}": str(group_pk),
+            "server_key": "default",
+        },
+    )
+    request.user = get_user_model().objects.create_user(username="vlm-user", password="x", is_superuser=True)
+    request.session = {}
+    setattr(request, "_messages", FallbackStorage(request))
+    return request
+
+
+def _drive_sync(device, vid, group_pk):
+    from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
+
+    view = SyncVLANsView()
+    request = _post_request(device.pk, vid, group_pk)
+    view.request = request  # dispatch() normally wires this; we call post() directly
+    # Seed the cache the exact way the view reads it (server_key "default" is posted, so the lazy
+    # librenms_api property is never built — no LibreNMS boundary is touched).
+    cache_key = view.get_cache_key(device, "vlans", "default")
+    real_cache.set(cache_key, [{"vlan_vlan": vid, "vlan_name": "Management"}], timeout=60)
+    try:
+        view.post(request, object_type="device", object_id=device.pk)
+    finally:
+        real_cache.delete(cache_key)
+    return [(m.level_tag, m.message) for m in request._messages]
+
+
+@pytest.mark.django_db
+class TestVlanSyncGroupMissing:
+    def test_missing_group_not_reported_as_unchanged(self):
+        from ipam.models import VLAN
+
+        device = _make_device("vlm-dev-1")
+        before = VLAN.objects.count()
+
+        # 2**31 - 1: a pk no VLANGroup will ever have in a fresh test DB.
+        messages = _drive_sync(device, vid=10, group_pk=2_147_483_647)
+
+        joined = " || ".join(msg for _, msg in messages)
+        # The per-VID fail-closed error is shown...
+        assert any("no longer exists" in msg for _, msg in messages), joined
+        # ...the skip is attributed to the missing group, NOT to "unchanged"...
+        assert "VLAN group missing" in joined
+        assert "unchanged" not in joined
+        # ...and nothing claims a successful sync.
+        assert not any(level == "success" for level, _ in messages), joined
+        # ...and no VLAN was created in the wrong (global) scope.
+        assert VLAN.objects.count() == before
+
+    def test_valid_global_vlan_still_syncs(self):
+        """Positive control: a row with no group selection still creates a real global VLAN and reports success."""
+        from ipam.models import VLAN
+
+        from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
+
+        device = _make_device("vlm-dev-2")
+        view = SyncVLANsView()
+        request = RequestFactory().post(
+            "/sync/vlans/",
+            data={"action": "create_vlans", "select": ["20"], "server_key": "default"},
+        )
+        request.user = get_user_model().objects.create_user(username="vlm-user2", password="x", is_superuser=True)
+        request.session = {}
+        setattr(request, "_messages", FallbackStorage(request))
+        view.request = request  # dispatch() normally wires this; we call post() directly
+
+        cache_key = view.get_cache_key(device, "vlans", "default")
+        real_cache.set(cache_key, [{"vlan_vlan": 20, "vlan_name": "Users"}], timeout=60)
+        try:
+            view.post(request, object_type="device", object_id=device.pk)
+        finally:
+            real_cache.delete(cache_key)
+
+        messages = [(m.level_tag, m.message) for m in request._messages]
+        assert any(level == "success" and "created" in msg for level, msg in messages), messages
+        assert VLAN.objects.filter(vid=20, group__isnull=True).exists()
diff --git a/netbox_librenms_plugin/views/base/cables_view.py b/netbox_librenms_plugin/views/base/cables_view.py
index 9694001437..d8ae154cc6 100644
--- a/netbox_librenms_plugin/views/base/cables_view.py
+++ b/netbox_librenms_plugin/views/base/cables_view.py
@@ -12,6 +12,7 @@
 from django.views import View
 
 from netbox_librenms_plugin.utils import (
+    cache_remaining_ttl,
     get_interface_name_field,
     get_librenms_sync_device,
     get_virtual_chassis_member,
@@ -20,6 +21,8 @@
     CacheMixin,
     LibreNMSAPIMixin,
     LibreNMSPermissionMixin,
+    NetBoxObjectPermissionMixin,
+    extract_cached_ports,
     parse_request_json,
 )
 
@@ -30,8 +33,22 @@ def _librenms_id_q(server_key: str, value) -> Q:
 
     Matches both integer and string representations to handle any stored format.
     """
-    if isinstance(value, bool):
-        return Q(pk__isnull=True) & Q(pk__isnull=False)  # match nothing
+    # Match nothing for values that can't be a valid librenms_id. Reject bools (an int subclass)
+    # and any non-int/str type up front: int() would truncate a float like 1.9 to 1 and match the
+    # wrong device/interface — looser than find_by_librenms_id's int/str-only contract (issue
+    # #103). Also reject blank strings and non-positive ids.
+    _match_nothing = Q(pk__isnull=True) & Q(pk__isnull=False)
+    if isinstance(value, bool) or not isinstance(value, (int, str)):
+        return _match_nothing
+    if isinstance(value, str) and not value.strip():
+        return _match_nothing
+    try:
+        if int(value) <= 0:
+            return _match_nothing
+    except (TypeError, ValueError):
+        # Non-numeric string: it can't equal a numeric id, but keep the literal match below
+        # rather than failing closed (no behaviour change for that case).
+        pass
 
     q = Q(**{f"custom_field_data__librenms_id__{server_key}": value}) | Q(custom_field_data__librenms_id=value)
     try:
@@ -48,6 +65,34 @@ def _librenms_id_q(server_key: str, value) -> Q:
     return q
 
 
+def _extract_cached_links(cached, cache_key=None):
+    """
+    Return the validated link list from a cached "links" entry, or None when malformed.
+
+    A stale/corrupt but truthy cache value — a non-dict, a non-list ``links``, or any non-dict
+    link row — would crash the cached GET render or the verify path on ``.get()`` / ``.items()``
+    / iteration. Treat those as a cache miss: when ``cache_key`` is given, purge the bad entry so
+    the next read doesn't keep serving garbage.
+
+    Args:
+        cached: The raw value read from the links cache key.
+        cache_key: Optional cache key to delete when the entry is malformed.
+
+    Returns:
+        list | None: The list of (dict) link rows, or None if the entry is malformed.
+    """
+    if not isinstance(cached, dict) or not isinstance(cached.get("links"), list):
+        if cache_key is not None:
+            cache.delete(cache_key)
+        return None
+    links = cached["links"]
+    if any(not isinstance(link, dict) for link in links):
+        if cache_key is not None:
+            cache.delete(cache_key)
+        return None
+    return links
+
+
 class BaseCableTableView(LibreNMSPermissionMixin, LibreNMSAPIMixin, CacheMixin, View):
     """
     Base view for synchronizing cable information from LibreNMS.
@@ -68,8 +113,11 @@ def get_ip_address(self, obj):
 
     def get_ports_data(self, obj):
         """Get ports data without affecting cache"""
-        server_key = self.librenms_api.server_key
-        cached_data = cache.get(self.get_cache_key(obj, "ports", server_key))
+        server_key = self._render_server_key()
+        ports_cache_key = self.get_cache_key(obj, "ports", server_key)
+        # Shape-guard the cached entry (mirrors _extract_cached_links): a truthy but
+        # malformed value would AttributeError-500 get_links_data's .get("ports") reads.
+        cached_data = extract_cached_ports(cache.get(ports_cache_key), ports_cache_key)
         if cached_data:
             return cached_data
         success, data = self.librenms_api.get_ports(self.librenms_id)
@@ -116,7 +164,7 @@ def get_links_data(self, obj):
     def get_device_by_id_or_name(self, remote_device_id, hostname, server_key=None):
         """Try to find device in NetBox first by librenms_id custom field, then by name"""
         if server_key is None:
-            server_key = self.librenms_api.server_key
+            server_key = self._render_server_key()
         # First try matching by LibreNMS ID
         if remote_device_id is not None:
             try:
@@ -162,7 +210,7 @@ def enrich_local_port(self, link, obj, server_key=None):
             interface = None
             local_port_id = link.get("local_port_id")
             if server_key is None:
-                server_key = self.librenms_api.server_key
+                server_key = self._render_server_key()
 
             if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
                 chassis_member = get_virtual_chassis_member(obj, local_port)
@@ -194,7 +242,7 @@ def enrich_remote_port(self, link, device, server_key=None):
             netbox_remote_interface = None
             librenms_remote_port_id = link.get("remote_port_id")
             if server_key is None:
-                server_key = self.librenms_api.server_key
+                server_key = self._render_server_key()
 
             # Handle virtual chassis case
             if hasattr(device, "virtual_chassis") and device.virtual_chassis:
@@ -304,7 +352,7 @@ def enrich_links_data(self, links_data, obj, server_key=None):
     def get_table(self, data, obj):
         """Get the table instance for the view."""
         table = super().get_table(data, obj)
-        server_key = self.librenms_api.server_key
+        server_key = self._render_server_key()
         table.htmx_url = f"{self.request.path}?tab=cables" + (f"&server_key={server_key}" if server_key else "")
         return table
 
@@ -312,7 +360,7 @@ def _prepare_context(self, request, obj, fetch_fresh=False):
         """Helper method to prepare the context data for cable sync views."""
         table = None
         cache_expiry = None
-        server_key = self.librenms_api.server_key
+        server_key = self._render_server_key()
         # For VC devices, cache under the sync device's key so SingleCableVerifyView reads the same entry.
         cache_device = get_librenms_sync_device(obj, server_key=server_key) or obj
 
@@ -323,9 +371,14 @@ def _prepare_context(self, request, obj, fetch_fresh=False):
                 return None
         else:
             # Try to use cached data
-            cached_links_data = cache.get(self.get_cache_key(cache_device, "links", server_key))
+            links_cache_key = self.get_cache_key(cache_device, "links", server_key)
+            cached_links_data = cache.get(links_cache_key)
             if cached_links_data:
-                links_data = cached_links_data.get("links", [])
+                # Fail closed on a malformed/corrupt cache entry (non-dict, non-list "links", or a
+                # non-dict link row) instead of crashing the cached render below on .items().
+                links_data = _extract_cached_links(cached_links_data, links_cache_key)
+                if links_data is None:
+                    return None
             else:
                 return None
 
@@ -356,12 +409,12 @@ def _prepare_context(self, request, obj, fetch_fresh=False):
             )
         else:
             # Write enriched data back, preserving original TTL
-            remaining_ttl = cache.ttl(cache_key)
+            remaining_ttl = cache_remaining_ttl(cache, cache_key)
             if remaining_ttl and remaining_ttl > 0:
                 cache.set(cache_key, {"links": links_data}, timeout=remaining_ttl)
 
         # Calculate cache expiry
-        cache_ttl = cache.ttl(cache_key)
+        cache_ttl = cache_remaining_ttl(cache, cache_key)
         if cache_ttl is not None and cache_ttl > 0:
             cache_expiry = timezone.now() + timezone.timedelta(seconds=cache_ttl)
         # Generate the table
@@ -382,7 +435,7 @@ def get_context_data(self, request, obj):
         context = self._prepare_context(request, obj, fetch_fresh=False)
         if context is None:
             # No data found; return context with empty table
-            context = {"table": None, "object": obj, "cache_expiry": None, "server_key": self.librenms_api.server_key}
+            context = {"table": None, "object": obj, "cache_expiry": None, "server_key": self._render_server_key()}
         return context
 
     def post(self, request, pk):
@@ -400,7 +453,7 @@ def post(self, request, pk):
                         "object": obj,
                         "table": None,
                         "cache_expiry": None,
-                        "server_key": self.librenms_api.server_key,
+                        "server_key": self._render_server_key(),
                     }
                 },
             )
@@ -413,21 +466,46 @@ def post(self, request, pk):
         )
 
 
-class SingleCableVerifyView(BaseCableTableView):
+class SingleCableVerifyView(NetBoxObjectPermissionMixin, BaseCableTableView):
     """
     View to verify a single cable link between two devices.
     """
 
+    # Read-only verify endpoint: require object-view permission (mirrors the interface/module
+    # verify views). Without it any user with mere plugin-view rights could POST an arbitrary
+    # device id and read back that device's rendered cable/topology rows.
+    required_object_permissions = {"POST": [("view", Device)]}
+
     def post(self, request):
         data, err = parse_request_json(request)
         if err:
             return err
+        # Gate BEFORE resolving the device / touching the LibreNMS client: an unauthorized caller
+        # must not be able to probe device IDs or trigger work through this endpoint.
+        if error := self.require_object_permissions_json("POST"):
+            return error
         selected_device_id = data.get("device_id")
         local_port_id = data.get("local_port_id")
-        # Read server_key from POST so we use the exact server the user was viewing
-        server_key = data.get("server_key")
-        if not server_key:
-            server_key = self.librenms_api.server_key
+        # Read server_key from POST so we use the exact server the user was viewing, but only honour
+        # it when it names a configured server: the raw value scopes the links cache and the
+        # _librenms_id_q() JSONField lookups below, so a forged/unconfigured key must not address
+        # another server's namespace (mirrors the interfaces POST path, issues #108/#109). Fall back
+        # to the active server when the POSTed key isn't configured.
+        # get_available_servers() is a dict, so the membership test hashes requested_server_key;
+        # a forged JSON array/object would raise TypeError (unhashable). Require a str first so a
+        # malformed key falls back to the active server instead of crashing the endpoint.
+        # Resolve the configured-server set via the CLASSMETHOD, not self.librenms_api: the lazy
+        # ``librenms_api`` property builds ``LibreNMSAPI()``, whose constructor raises KeyError/
+        # ValueError on a missing/misconfigured default server — so probing membership through the
+        # instance would 500 this verify POST exactly where the sibling IP-verify path degrades.
+        # get_available_servers() needs no instance.
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        requested_server_key = data.get("server_key")
+        if isinstance(requested_server_key, str) and requested_server_key in LibreNMSAPI.get_available_servers():
+            server_key = requested_server_key
+        else:
+            server_key = self._render_server_key()
 
         formatted_row = {
             "local_port": "",
@@ -438,7 +516,9 @@ def post(self, request):
         }
 
         if selected_device_id:
-            selected_device = get_object_or_404(Device, pk=selected_device_id)
+            # Object-scope the lookup: the gate only checked model-level view_device, so an
+            # out-of-scope pk must 404 rather than expose that device's cached cable row.
+            selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
 
             # Use the same sync-device resolution as the GET path so the cache
             # key matches what _prepare_context wrote. When the VC has no
@@ -450,15 +530,16 @@ def post(self, request):
             else:
                 primary_device = selected_device
 
-            cached_links = cache.get(self.get_cache_key(primary_device, "links", server_key))
+            links_cache_key = self.get_cache_key(primary_device, "links", server_key)
+            cached_links = cache.get(links_cache_key)
 
-            if cached_links:
+            # Same fail-closed guard as the cached GET render: a malformed entry (non-dict, non-list
+            # "links", or a non-dict link row) is purged and treated as no cache, so the verify path
+            # returns the empty formatted_row instead of crashing on .get()/.items().
+            valid_links = _extract_cached_links(cached_links, links_cache_key) if cached_links else None
+            if valid_links:
                 link_data = next(
-                    (
-                        link
-                        for link in cached_links.get("links", [])
-                        if str(link.get("local_port_id", "")) == str(local_port_id)
-                    ),
+                    (link for link in valid_links if str(link.get("local_port_id", "")) == str(local_port_id)),
                     None,
                 )
                 if link_data:
diff --git a/netbox_librenms_plugin/views/base/vlan_table_view.py b/netbox_librenms_plugin/views/base/vlan_table_view.py
index 62c6bd7a5c..dbc2d4aea4 100644
--- a/netbox_librenms_plugin/views/base/vlan_table_view.py
+++ b/netbox_librenms_plugin/views/base/vlan_table_view.py
@@ -6,6 +6,7 @@
 
 from netbox_librenms_plugin.constants import LIBRENMS_VLAN_STATE_ACTIVE
 from netbox_librenms_plugin.tables.vlans import LibreNMSVLANTable
+from netbox_librenms_plugin.utils import cache_remaining_ttl, is_list_of_dicts
 from netbox_librenms_plugin.views.mixins import (
     CacheMixin,
     LibreNMSAPIMixin,
@@ -63,6 +64,13 @@ def _fetch_and_cache_vlan_data(self, obj):
         if not success:
             return False, f"Failed to fetch VLANs: {vlans_data}"
 
+        # A success=True response can still carry a malformed-but-truthy payload (string, list
+        # of scalars, etc.); caching it would later 500 in compare_vlans() on vlan.get(...).
+        # Reject anything that isn't a list of dict rows before caching (issue #100). An empty
+        # list is valid (a device with no VLANs).
+        if not is_list_of_dicts(vlans_data):
+            return False, "Unexpected response from LibreNMS (malformed VLAN payload)."
+
         # Cache VLANs
         server_key = self.librenms_api.server_key
         cache.set(
@@ -88,18 +96,35 @@ def get_vlan_context(self, request, obj):
         """
         vlan_table = None
 
-        # Get cached data
-        server_key = getattr(self.librenms_api, "server_key", None)
+        # Get cached data. Use the shared degrading resolver (not a bare getattr on the lazy
+        # librenms_api property): on a missing/misconfigured default the property raises
+        # KeyError/ValueError, which would 500 the VLAN tab on GET — the exact failure mode
+        # _render_server_key() fixes for the sibling interface/module/cable/ip tabs.
+        server_key = self._render_server_key()
         cached_vlans = cache.get(self.get_cache_key(obj, "vlans", server_key))
         last_fetched = cache.get(self.get_last_fetched_key(obj, "vlans", server_key))
 
+        # Fail closed on a stale/corrupt cached entry. compare_vlans() iterates the rows and
+        # calls vlan.get(...), so a malformed snapshot (string, list of scalars) would 500 the
+        # VLAN tab on render. _fetch_and_cache_vlan_data() guards the write side, but a pre-fix
+        # entry can still be in the cache — drop and purge it, then render empty (mirrors the
+        # interfaces read-path guard). An empty list is valid (device with no VLANs).
+        if cached_vlans is not None and not is_list_of_dicts(cached_vlans):
+            cache.delete(self.get_cache_key(obj, "vlans", server_key))
+            cache.delete(self.get_last_fetched_key(obj, "vlans", server_key))
+            cached_vlans = None
+            last_fetched = None
+
         # Get available VLAN groups for this device
         vlan_groups = self.get_vlan_groups_for_device(obj)
 
         # Build lookup maps for VLAN matching
         lookup_maps = self._build_vlan_lookup_maps(vlan_groups)
 
-        if cached_vlans:
+        # `is not None` (not a bare truthiness check): an empty list is a valid successful refresh
+        # (a device with no VLANs) and must still render an empty table — a truthy check would skip
+        # construction and make a VLAN-less device look like it never loaded.
+        if cached_vlans is not None:
             # Compare VLANs with NetBox (against all device-available VLANs)
             compared_vlans = self.compare_vlans(cached_vlans, lookup_maps, device=obj)
 
@@ -107,7 +132,7 @@ def get_vlan_context(self, request, obj):
             vlan_table.configure(request)
 
         # Calculate cache TTL
-        cache_ttl = cache.ttl(self.get_cache_key(obj, "vlans", server_key))
+        cache_ttl = cache_remaining_ttl(cache, self.get_cache_key(obj, "vlans", server_key))
         cache_expiry = timezone.now() + timezone.timedelta(seconds=cache_ttl) if cache_ttl and cache_ttl > 0 else None
 
         return {
diff --git a/netbox_librenms_plugin/views/sync/vlans.py b/netbox_librenms_plugin/views/sync/vlans.py
index f20648c88b..a5c733d4be 100644
--- a/netbox_librenms_plugin/views/sync/vlans.py
+++ b/netbox_librenms_plugin/views/sync/vlans.py
@@ -98,6 +98,7 @@ def _handle_create_vlans(self, request, obj, object_type, object_id):
         created_count = 0
         updated_count = 0
         skipped_count = 0
+        group_missing_count = 0
 
         with transaction.atomic():
             for vid_str in selected_vlans:
@@ -117,7 +118,19 @@ def _handle_create_vlans(self, request, obj, object_type, object_id):
                     try:
                         row_vlan_group = VLANGroup.objects.get(pk=int(group_id_str))
                     except (ValueError, VLANGroup.DoesNotExist):
-                        pass  # Fall back to global VLAN (no group)
+                        # A group was explicitly requested but doesn't exist (stale page or
+                        # tampered id). Fail closed: do NOT fall back to a global VLAN, which
+                        # would persist the VLAN in the wrong scope. Skip this VID and warn.
+                        messages.error(
+                            request,
+                            f"VLAN {vid}: the selected VLAN group no longer exists; skipped to avoid "
+                            "creating it in the wrong scope.",
+                        )
+                        # Count separately from genuine no-ops: this VID did NOT sync (it already
+                        # emitted its own error), so it must not inflate the "N unchanged" summary
+                        # and imply success.
+                        group_missing_count += 1
+                        continue
 
                 librenms_name = vlan_data.get("vlan_name", f"VLAN {vid}")
 
@@ -158,7 +171,10 @@ def _handle_create_vlans(self, request, obj, object_type, object_id):
                     else:
                         skipped_count += 1
 
-        # Build summary message
+        # Build summary message. created/updated/unchanged are all successful sync outcomes (an
+        # "unchanged" VID exists and already matches — nothing to do). Group-missing skips are NOT:
+        # each already emitted its own per-VID error, must never be folded into "N unchanged", and
+        # must not ride under a "VLANs synced" success when they're the only outcome.
         parts = []
         if created_count > 0:
             parts.append(f"{created_count} created")
@@ -168,7 +184,12 @@ def _handle_create_vlans(self, request, obj, object_type, object_id):
             parts.append(f"{skipped_count} unchanged")
 
         if parts:
+            if group_missing_count > 0:
+                parts.append(f"{group_missing_count} skipped (VLAN group missing)")
             messages.success(request, f"VLANs synced: {', '.join(parts)}.")
+        elif group_missing_count > 0:
+            # Nothing actually synced — only group-missing failures. Don't claim success.
+            messages.warning(request, f"No VLANs synced: {group_missing_count} skipped (VLAN group missing).")
         else:
             messages.warning(request, "No VLANs were created or updated.")
 

From 0e570f65e041d8303e1f6036262ea428cec02216 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 20:25:32 +0200
Subject: [PATCH 06/17] fix(api,models): harden LibreNMS server selection and
 unify regex validation

Fall back to the first usable server (skipping incomplete or malformed configs) rather than
the first dict, normalize a legacy-mode server_key to default, cache get_device_info to drop
a per-render LibreNMS call, unify regex-field validation behind validate_regex_field, and
stop tracking .playwright-mcp scratch snapshots.
---
 .gitignore                                    |   3 +
 netbox_librenms_plugin/librenms_api.py        | 102 +++++++--
 netbox_librenms_plugin/models.py              |  22 +-
 .../tests/test_coverage_api.py                |  12 +-
 .../tests/test_librenms_api.py                | 215 ++++++++++++++++++
 5 files changed, 319 insertions(+), 35 deletions(-)

diff --git a/.gitignore b/.gitignore
index 25c298c23b..164a3d160c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -290,3 +290,6 @@ cython_debug/
 ca-bundle.crt
 *.pem
 .github/hooks/
+
+# Playwright MCP scratch snapshots (accessibility/page dumps from local UI verification)
+.playwright-mcp/
diff --git a/netbox_librenms_plugin/librenms_api.py b/netbox_librenms_plugin/librenms_api.py
index 86eba28f32..7b2ded8334 100644
--- a/netbox_librenms_plugin/librenms_api.py
+++ b/netbox_librenms_plugin/librenms_api.py
@@ -9,6 +9,12 @@
 DEFAULT_API_TIMEOUT = 10
 EXTENDED_API_TIMEOUT = 20  # For endpoints that may take longer (e.g., device listing)
 
+# Short-lived cache for get_device_info(). The device-info header is fetched on every sync-tab
+# render (and again on the post-action redirect), but a device's identity/metadata is stable, so
+# a brief cache removes a redundant synchronous LibreNMS round-trip from each render without
+# meaningfully staling the displayed values.
+DEVICE_INFO_CACHE_TIMEOUT = 60
+
 logger = logging.getLogger(__name__)
 
 
@@ -24,6 +30,22 @@ def __init__(self, server_key=None):
         Args:
             server_key: Key for specific server configuration. If None, uses selected server or default.
         """
+        # Track whether the caller explicitly requested a specific server. A key auto-resolved
+        # from LibreNMSSettings.selected_server is NOT explicit, so a stale stored key falls back
+        # to the first available server rather than hard-failing (issue #110).
+        # A blank/whitespace-only string is "no key", not an explicit request: treating "" as
+        # explicit would mark the auto-resolved (and possibly stale) selected_server as explicit
+        # and defeat that fallback, raising KeyError instead.
+        if isinstance(server_key, str):
+            server_key = server_key.strip() or None
+        elif server_key is not None:
+            # A non-string key (e.g. a list/dict from a tampered payload) is not a valid server
+            # key and is unhashable — left as-is it would raise TypeError at the `not in
+            # servers_config` membership check below. Treat it as unset so it fails cleanly via
+            # the same fallback path as a blank string.
+            server_key = None
+        explicit_server_key = server_key is not None
+
         # If no server_key is provided, try to get the selected server from settings
         if not server_key:
             try:
@@ -46,31 +68,58 @@ def __init__(self, server_key=None):
         # If a specific (non-default) server_key was requested but not found, raise
         # immediately to avoid silently using the wrong LibreNMS instance.
         if servers_config and isinstance(servers_config, dict) and server_key not in servers_config:
-            if server_key != "default":
+            # Only fail closed for an *explicitly* requested non-default key (tampered or
+            # stale-page input). An auto-resolved/default key falls back instead (issue #110).
+            if explicit_server_key and server_key != "default":
                 available = list(servers_config.keys())
                 raise KeyError(
                     f"Server '{server_key}' not found in LibreNMS plugin configuration. Available servers: {available}"
                 )
-            first_key = next(iter(servers_config), None)
-            if first_key:
-                logger.info(
-                    "Server '%s' not found in config, falling back to '%s'",
-                    server_key,
-                    first_key,
-                )
-                server_key = first_key
+            # Pick the first *usable* mapping — a dict that actually carries a url + token. A
+            # non-dict or incomplete entry would otherwise be selected and then raise at the config
+            # read below, masking a perfectly usable later server (e.g. {"bad": {}, "prod": {...}}).
+            # If none are usable, fail with a clear error (issue #110).
+            first_key = next(
+                (
+                    key
+                    for key, config in servers_config.items()
+                    if isinstance(config, dict) and config.get("librenms_url") and config.get("api_token")
+                ),
+                None,
+            )
+            if first_key is None:
+                raise ValueError("No valid LibreNMS server configuration entries found.")
+            logger.info(
+                "Server '%s' not found in config, falling back to '%s'",
+                server_key,
+                first_key,
+            )
+            server_key = first_key
 
         self.server_key = server_key
 
         if servers_config and isinstance(servers_config, dict) and server_key in servers_config:
             # Multi-server configuration
             config = servers_config[server_key]
-            self.librenms_url = config["librenms_url"]
-            self.api_token = config["api_token"]
+            # The fallback above only guards the key-not-found case; a present-but-malformed
+            # entry (e.g. {"default": "not-a-dict"}) would otherwise raise an opaque TypeError
+            # at the key reads below. Fail with a clear configuration error instead (issue #110).
+            if not isinstance(config, dict):
+                raise ValueError(f"Invalid LibreNMS server configuration for '{server_key}': expected a mapping.")
+            # Read with .get() rather than direct indexing: a dict-shaped but incomplete entry
+            # (e.g. {"default": {}}) passes the isinstance check, so config["librenms_url"] would
+            # raise an opaque KeyError instead of the ValueError contract callers rely on. The
+            # url/token completeness is enforced by the single guard at the end of __init__.
+            self.librenms_url = config.get("librenms_url")
+            self.api_token = config.get("api_token")
             self.cache_timeout = config.get("cache_timeout", 300)
             self.verify_ssl = config.get("verify_ssl", True)
         else:
-            # Fallback to legacy single-server configuration
+            # Fallback to legacy single-server configuration. Legacy mode has only the implicit
+            # default server, so a stale/tampered request key (e.g. build_librenms_api("ghost"))
+            # must not survive as self.server_key — it would otherwise become the cache/redirect
+            # discriminator under an unconfigured value. Normalize to "default".
+            self.server_key = "default"
             self.librenms_url = get_plugin_config("netbox_librenms_plugin", "librenms_url")
             self.api_token = get_plugin_config("netbox_librenms_plugin", "api_token")
             self.cache_timeout = get_plugin_config("netbox_librenms_plugin", "cache_timeout", 300)
@@ -160,8 +209,14 @@ def get_available_servers(cls):
             # Multi-server configuration
             result = {}
             for key, config in servers_config.items():
-                display_name = config.get("display_name", key)
-                result[key] = display_name
+                # Skip non-usable entries: a non-dict raises on config.get(...) below, and a
+                # dict-shaped but incomplete entry (no librenms_url/api_token, e.g. {"bad": {}})
+                # would pass the redirect/rebind membership check that keys off this map and then
+                # blow up LibreNMSAPI(server_key="bad"). A server that can't be constructed must not
+                # be selectable — exposing it 500s a sync POST instead of degrading to the active one.
+                if not isinstance(config, dict) or not config.get("librenms_url") or not config.get("api_token"):
+                    continue
+                result[key] = config.get("display_name", key)
             return result
         else:
             # Legacy single-server configuration
@@ -346,16 +401,29 @@ def get_device_id_by_hostname(self, hostname):
         except (requests.exceptions.RequestException, ValueError, IndexError, KeyError, TypeError):
             return None
 
-    def get_device_info(self, device_id):
+    def get_device_info(self, device_id, use_cache=True):
         """
         Fetch device information from LibreNMS using its primary IP.
 
+        Successful lookups are cached briefly (``DEVICE_INFO_CACHE_TIMEOUT``) per
+        server/device so the device-info header doesn't re-hit LibreNMS on every
+        sync-tab render. Failures are never cached, so a transient error doesn't
+        persist for the cache window.
+
         Args:
             device_id: LibreNMS device ID
+            use_cache: When False, bypass the short read cache and fetch live data
+                (still refreshing the cache on success). Import decisions pass False so a
+                value just corrected in LibreNMS isn't read back stale within the cache window.
 
         Returns:
             tuple: (success: bool, data: dict)
         """
+        cache_key = f"librenms_device_info_{self.server_key}_{device_id}"
+        if use_cache:
+            cached = cache.get(cache_key)
+            if cached is not None:
+                return cached
 
         try:
             response = requests.get(
@@ -375,7 +443,9 @@ def get_device_info(self, device_id):
             location = device_data.get("location")
             if isinstance(location, dict):
                 device_data["location"] = location.get("location")
-            return True, device_data
+            result = (True, device_data)
+            cache.set(cache_key, result, timeout=DEVICE_INFO_CACHE_TIMEOUT)
+            return result
         except (requests.exceptions.RequestException, ValueError, IndexError, KeyError, TypeError):
             return False, None
 
diff --git a/netbox_librenms_plugin/models.py b/netbox_librenms_plugin/models.py
index 16c8b68952..e8aa8dec77 100644
--- a/netbox_librenms_plugin/models.py
+++ b/netbox_librenms_plugin/models.py
@@ -10,6 +10,8 @@
 from django.urls import reverse
 from netbox.models import NetBoxModel
 
+from netbox_librenms_plugin.utils import validate_regex_field
+
 logger = logging.getLogger(__name__)
 
 
@@ -364,10 +366,7 @@ def clean(self):
             raise ValidationError({"netbox_bay_name": "NetBox bay name must not be empty or whitespace-only."})
         self.netbox_bay_name = netbox_bay_name_stripped
         if self.is_regex:
-            try:
-                pattern = re.compile(self.librenms_name)
-            except re.error as e:
-                raise ValidationError({"librenms_name": f"Invalid regex: {e}"})
+            pattern = validate_regex_field(self.librenms_name, "librenms_name")
             try:
                 _validate_replacement_template(pattern, self.netbox_bay_name)
             except (re.error, IndexError) as e:
@@ -487,10 +486,7 @@ def clean(self):
             errors["replacement"] = "This field is required."
         if errors:
             raise ValidationError(errors)
-        try:
-            compiled = re.compile(self.match_pattern)
-        except re.error as e:
-            raise ValidationError({"match_pattern": f"Invalid regex: {e}"})
+        compiled = validate_regex_field(self.match_pattern, "match_pattern")
         # Validate the replacement template by running a dummy substitution
         try:
             _validate_replacement_template(compiled, self.replacement)
@@ -621,10 +617,7 @@ def clean(self):
         self.__dict__.pop("_compiled_pattern", None)
         pattern_stripped = self.pattern.strip() if self.pattern else ""
         if self.match_type == self.MATCH_REGEX and pattern_stripped:
-            try:
-                re.compile(pattern_stripped)
-            except re.error as e:
-                raise ValidationError({"pattern": f"Invalid regex: {e}"})
+            validate_regex_field(pattern_stripped, "pattern")
         if self.match_type != self.MATCH_SERIAL_DEVICE and not pattern_stripped:
             raise ValidationError({"pattern": "Pattern is required for name-based match types."})
         # Normalize stored pattern to the stripped form so matches_name() and
@@ -863,10 +856,7 @@ def clean(self):
         ):
             if not value:
                 continue
-            try:
-                re.compile(value)
-            except re.error as e:
-                raise ValidationError({field: f"Invalid regex: {e}"})
+            validate_regex_field(value, field)
 
     def get_absolute_url(self):
         return reverse(
diff --git a/netbox_librenms_plugin/tests/test_coverage_api.py b/netbox_librenms_plugin/tests/test_coverage_api.py
index 3e00037fdf..2cd40646b5 100644
--- a/netbox_librenms_plugin/tests/test_coverage_api.py
+++ b/netbox_librenms_plugin/tests/test_coverage_api.py
@@ -862,9 +862,14 @@ class TestGetAvailableServersMultiConfig:
 
     def test_multi_server_config_returns_dict(self):
         api = _make_api()
+        # Entries must carry url + token to be usable/selectable; display_name controls the label.
         servers_config = {
-            "primary": {"display_name": "Primary Server"},
-            "secondary": {"display_name": "Secondary Server"},
+            "primary": {"librenms_url": "https://p.example.com", "api_token": "t1", "display_name": "Primary Server"},
+            "secondary": {
+                "librenms_url": "https://s.example.com",
+                "api_token": "t2",
+                "display_name": "Secondary Server",
+            },
         }
 
         with patch("netbox_librenms_plugin.librenms_api.get_plugin_config") as mock_config:
@@ -875,7 +880,8 @@ def test_multi_server_config_returns_dict(self):
     def test_multi_server_config_uses_key_when_no_display_name(self):
         api = _make_api()
         servers_config = {
-            "main": {},  # No display_name key
+            # Usable (has url + token) but no display_name → the key is the label.
+            "main": {"librenms_url": "https://m.example.com", "api_token": "t"},
         }
 
         with patch("netbox_librenms_plugin.librenms_api.get_plugin_config") as mock_config:
diff --git a/netbox_librenms_plugin/tests/test_librenms_api.py b/netbox_librenms_plugin/tests/test_librenms_api.py
index 176b289f0a..152ef2a6fc 100644
--- a/netbox_librenms_plugin/tests/test_librenms_api.py
+++ b/netbox_librenms_plugin/tests/test_librenms_api.py
@@ -57,6 +57,54 @@ def config_side_effect(plugin, key, default=None):
 
         assert api.librenms_url == "https://legacy.example.com"
 
+    def test_legacy_mode_normalizes_server_key_to_default(self, mock_librenms_config):
+        """In legacy single-server mode a posted/stale server_key must not survive as api.server_key (it would become a bogus cache/redirect discriminator)."""
+        mock_config = mock_librenms_config["mock_config"]
+
+        def config_side_effect(plugin, key, default=None):
+            if key == "servers":
+                return None  # legacy single-server mode
+            legacy = {"librenms_url": "https://legacy.example.com", "api_token": "legacy-token"}
+            return legacy.get(key, default)
+
+        mock_config.side_effect = config_side_effect
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        # A non-default (stale/tampered) key in legacy mode must normalize to "default".
+        api = LibreNMSAPI(server_key="ghost")
+        assert api.server_key == "default"
+
+    def test_init_non_string_server_key_falls_back_cleanly(self, mock_librenms_config):
+        """An unhashable non-string server_key (e.g. a list) is treated as unset, not raised on at the dict membership check."""
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        # Pre-fix: `[] not in servers_config` raised TypeError (unhashable type: 'list').
+        api = LibreNMSAPI(server_key=[])
+
+        assert api.server_key == "default"
+        assert api.librenms_url == "https://librenms.example.com"
+
+    def test_init_fallback_skips_incomplete_server_entry(self, mock_librenms_config):
+        """The auto-default fallback skips a structurally incomplete entry (dict without url/token) and picks the first usable server."""
+        mock_config = mock_librenms_config["mock_config"]
+
+        def config_side_effect(plugin, key, default=None):
+            if key == "servers":
+                # 'bad' is a dict but carries no url/token; 'prod' is usable.
+                return {"bad": {}, "prod": {"librenms_url": "https://prod.example.com", "api_token": "prod-token"}}
+            return default
+
+        mock_config.side_effect = config_side_effect
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        # 'default' isn't configured → auto-default fallback; it must skip 'bad' and pick 'prod'.
+        api = LibreNMSAPI(server_key="default")
+
+        assert api.server_key == "prod"
+        assert api.librenms_url == "https://prod.example.com"
+
     def test_init_missing_config_raises_valueerror(self, mock_librenms_config):
         """Verify ValueError raised when configuration is missing."""
         mock_config = mock_librenms_config["mock_config"]
@@ -90,6 +138,111 @@ def test_init_default_falls_back_to_first_server(self, mock_librenms_config):
         assert api.server_key == "primary"
         assert api.librenms_url == "https://primary.example.com"
 
+    def test_init_stale_auto_selected_server_falls_back(self, mock_librenms_config):
+        """Issue #110: a stale LibreNMSSettings.selected_server (no longer configured) must fall back to the first server rather than hard-fail — it was auto-resolved, not explicitly requested, so the KeyError guard must not fire."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {
+            "primary": {"librenms_url": "https://primary.example.com", "api_token": "t"},
+        }
+        mock_settings = mock_librenms_config["mock_settings"]
+        mock_settings.objects.first.return_value.selected_server = "gone-server"
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        api = LibreNMSAPI()  # server_key=None -> auto-resolved from (stale) settings
+        assert api.server_key == "primary"
+
+    def test_init_blank_server_key_treated_as_non_explicit_falls_back(self, mock_librenms_config):
+        """A blank/whitespace server_key is 'no key': a stale selected_server must still fall back, not hard-fail. Treating '' as explicit would mark the auto-resolved key explicit and defeat the issue #110 fallback (KeyError)."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {
+            "primary": {"librenms_url": "https://primary.example.com", "api_token": "t"},
+        }
+        mock_settings = mock_librenms_config["mock_settings"]
+        mock_settings.objects.first.return_value.selected_server = "gone-server"
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        for blank in ("", "   "):
+            api = LibreNMSAPI(server_key=blank)  # blank → auto-resolved from the (stale) settings
+            assert api.server_key == "primary"
+
+    def test_init_skips_leading_malformed_server_entry(self, mock_librenms_config):
+        """Issue #110: the first-entry fallback must pick the first *valid* mapping, skipping a malformed (non-dict) leading entry that would otherwise raise at the config read."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {
+            "broken": "not-a-dict",
+            "good": {"librenms_url": "https://good.example.com", "api_token": "t"},
+        }
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        api = LibreNMSAPI(server_key="default")
+        assert api.server_key == "good"
+        assert api.librenms_url == "https://good.example.com"
+
+    def test_init_all_malformed_server_entries_raise_valueerror(self, mock_librenms_config):
+        """Issue #110: when no configured entry is a valid mapping, raise a clear ValueError instead of crashing on the malformed entry's config read."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {"broken": "not-a-dict", "also-bad": 123}
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        with pytest.raises(ValueError):
+            LibreNMSAPI(server_key="default")
+
+    def test_init_selected_key_malformed_raises_valueerror_not_typeerror(self, mock_librenms_config):
+        """Issue #110: an explicitly requested key that *exists* but maps to a non-dict must raise a clear ValueError, not an opaque TypeError from indexing the string at the config read."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {"broken": "not-a-dict"}
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        with pytest.raises(ValueError, match="expected a mapping"):
+            LibreNMSAPI(server_key="broken")
+
+    def test_get_available_servers_skips_malformed_entry(self, mock_librenms_config):
+        """get_available_servers() powers the sync-POST server-key membership check."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {
+            "good": {"librenms_url": "https://good.example.com", "api_token": "t", "display_name": "Good"},
+            "broken": "not-a-dict",
+        }
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        servers = LibreNMSAPI.get_available_servers()
+
+        assert servers == {"good": "Good"}
+        assert "broken" not in servers
+
+    def test_init_incomplete_dict_entry_raises_valueerror_not_keyerror(self, mock_librenms_config):
+        """A dict-shaped but incomplete entry ({"bad": {}}) passes the isinstance check, so the config read must fail with ValueError, not an opaque KeyError on config['librenms_url']."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {"bad": {}}
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        with pytest.raises(ValueError):
+            LibreNMSAPI(server_key="bad")
+
+    def test_get_available_servers_skips_incomplete_dict_entry(self, mock_librenms_config):
+        """An incomplete dict entry (no librenms_url/api_token) must not be selectable — it would pass the membership check and then crash LibreNMSAPI construction."""
+        mock_config = mock_librenms_config["mock_config"]
+        mock_config.return_value = {
+            "good": {"librenms_url": "https://good.example.com", "api_token": "t", "display_name": "Good"},
+            "bad": {},  # dict-shaped but unusable
+            "tokenless": {"librenms_url": "https://x.example.com"},  # url but no token
+        }
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        servers = LibreNMSAPI.get_available_servers()
+
+        assert servers == {"good": "Good"}
+        assert "bad" not in servers
+        assert "tokenless" not in servers
+
 
 # =============================================================================
 # Test Class 2: Connection Testing (4 tests)
@@ -832,6 +985,68 @@ def test_get_device_info_not_found(self, mock_get, mock_librenms_config):
         assert success is False
         assert result is None
 
+    @patch("netbox_librenms_plugin.librenms_api.requests.get")
+    def test_get_device_info_caches_success(self, mock_get, mock_librenms_config):
+        """A successful lookup is cached: a second call within the TTL skips the HTTP request."""
+        mock_get.return_value.status_code = 200
+        mock_get.return_value.json.return_value = {
+            "status": "ok",
+            "devices": [{"device_id": 7777, "hostname": "cached-device"}],
+        }
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        api = LibreNMSAPI(server_key="default")
+        first = api.get_device_info(device_id=7777)
+        second = api.get_device_info(device_id=7777)
+
+        assert first == second == (True, {"device_id": 7777, "hostname": "cached-device"})
+        assert mock_get.call_count == 1  # second call served from cache, not re-fetched
+
+    @patch("netbox_librenms_plugin.librenms_api.requests.get")
+    def test_get_device_info_does_not_cache_failure(self, mock_get, mock_librenms_config):
+        """Failures are never cached, so a transient error doesn't persist for the cache window."""
+        mock_get.side_effect = requests.exceptions.Timeout("boom")
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        api = LibreNMSAPI(server_key="default")
+        assert api.get_device_info(device_id=7778) == (False, None)
+        assert api.get_device_info(device_id=7778) == (False, None)
+
+        assert mock_get.call_count == 2  # not cached → re-attempted on the next call
+
+    @patch("netbox_librenms_plugin.librenms_api.requests.get")
+    def test_get_device_info_use_cache_false_bypasses_stale_cache(self, mock_get, mock_librenms_config):
+        """use_cache=False refetches live data instead of returning a stale cached payload, and refreshes the cache."""
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+
+        mock_get.return_value.status_code = 200
+        mock_get.return_value.json.return_value = {
+            "status": "ok",
+            "devices": [{"device_id": 424242, "hostname": "stale"}],
+        }
+
+        api = LibreNMSAPI(server_key="default")
+        # First call populates the 60s cache with the (soon-to-be-stale) value.
+        assert api.get_device_info(device_id=424242) == (True, {"device_id": 424242, "hostname": "stale"})
+
+        # The hostname is corrected in LibreNMS within the cache window.
+        mock_get.return_value.json.return_value = {
+            "status": "ok",
+            "devices": [{"device_id": 424242, "hostname": "fresh"}],
+        }
+
+        # A normal (cached) read still returns the stale value...
+        assert api.get_device_info(device_id=424242) == (True, {"device_id": 424242, "hostname": "stale"})
+        # ...but the import path (use_cache=False) fetches live data...
+        assert api.get_device_info(device_id=424242, use_cache=False) == (
+            True,
+            {"device_id": 424242, "hostname": "fresh"},
+        )
+        # ...and that live fetch refreshes the cache, so subsequent cached reads see the correction.
+        assert api.get_device_info(device_id=424242) == (True, {"device_id": 424242, "hostname": "fresh"})
+
     @patch("netbox_librenms_plugin.librenms_api.requests.get")
     def test_list_devices_with_filters(self, mock_get, mock_librenms_config):
         """Verify listing devices with filter parameter."""

From 09e042a925c430caaa4fb3c3953d2818c243c22e Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 21:04:44 +0200
Subject: [PATCH 07/17] refactor(i2): route object-scoped verify lookups
 through a NetBoxObjectPermissionMixin helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the inline `get_object_or_404(Model.objects.restrict(request.user, "view"), pk=…)`
duplicated across the interface/module/vlan-group/cable/ip verify views with two mixin helpers on
NetBoxObjectPermissionMixin (which already uses self.request.user and houses the object-permission
machinery all 6 views share):
- restricted_queryset(model, action="view")
- restrict_object_or_404(model, action="view", **kwargs)

This matches the repo's convention (shared logic lives on a mixin, e.g. _render_server_key /
resolve_requested_server_key) instead of an inline snippet repeated 8×.

Tests: convert the ip-verify server-key tests to real-DB device resolution; wire real superusers into
the already-real-DB vlan-group verify tests; repoint the orthogonal enrichment / VC-resolution /
post-handler mocks from the module-level get_object_or_404 patch to the restrict_object_or_404 seam.
Full suite green (3344).
---
 .../tests/test_cable_verify.py                |  9 ++-
 .../tests/test_coverage_base_views2.py        | 15 ++--
 .../tests/test_coverage_devices.py            | 43 +++++++++--
 .../tests/test_ip_verify.py                   | 76 ++++++++-----------
 .../tests/test_reviewer_fixes.py              |  8 +-
 .../tests/test_verify_views.py                | 14 ++--
 .../tests/test_view_wiring.py                 |  8 +-
 .../views/base/cables_view.py                 |  2 +-
 .../views/base/ip_addresses_view.py           |  9 +--
 netbox_librenms_plugin/views/mixins.py        | 38 +++++++++-
 .../views/object_sync/devices.py              |  6 +-
 11 files changed, 148 insertions(+), 80 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_cable_verify.py b/netbox_librenms_plugin/tests/test_cable_verify.py
index 069234f438..b5a942a467 100644
--- a/netbox_librenms_plugin/tests/test_cable_verify.py
+++ b/netbox_librenms_plugin/tests/test_cable_verify.py
@@ -91,7 +91,7 @@ def fake_process_remote_device(link, hostname, device_id, server_key=None):
         request = _make_request({"device_id": 1, "local_port_id": 100})
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404", return_value=device),
+            patch.object(view, "restrict_object_or_404", return_value=device),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test_key"),
             patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
@@ -152,7 +152,7 @@ def fake_process_remote(link, hostname, device_id, server_key=None):
         view.process_remote_device = fake_process_remote
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get,
+            patch.object(view, "restrict_object_or_404") as mock_get,
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=None),
             patch("netbox_librenms_plugin.views.base.cables_view.get_token", return_value="tok"),
@@ -224,7 +224,7 @@ def fake_check_cable_status(link):
         request = _make_request({"device_id": 1, "local_port_id": 100})
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404", return_value=device),
+            patch.object(view, "restrict_object_or_404", return_value=device),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test_key"),
             patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
@@ -288,7 +288,7 @@ def fake_check_cable_status(link):
         request = _make_request({"device_id": 1, "local_port_id": 100})
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404", return_value=device),
+            patch.object(view, "restrict_object_or_404", return_value=device),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test_key"),
             patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
@@ -439,6 +439,7 @@ def test_configured_key_does_not_500_when_default_broken(self):
         from django.contrib.auth import get_user_model
 
         request.user = get_user_model().objects.create_user(username="scv-user", password="x", is_superuser=True)
+        view.request = request  # dispatch() normally wires this; the object-scoped lookup reads self.request.user
         with override_settings(PLUGINS_CONFIG=cfg):
             response = view.post(request)
 
diff --git a/netbox_librenms_plugin/tests/test_coverage_base_views2.py b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
index d79510efec..b2d22f0a97 100644
--- a/netbox_librenms_plugin/tests/test_coverage_base_views2.py
+++ b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
@@ -709,7 +709,10 @@ def fake_cache_key(dev, kind, sk):
             return "ck"
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404", return_value=mock_device),
+            patch(
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
+                return_value=mock_device,
+            ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", side_effect=fake_cache_key),
         ):
@@ -758,7 +761,7 @@ def test_vc_member_resolution_calls_get_virtual_chassis_member(self):
 
         with (
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_object_or_404",
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
                 return_value=mock_device,
             ),
             patch(
@@ -872,7 +875,7 @@ def test_interface_not_found_fills_formatted_row(self):
 
         with (
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_object_or_404",
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
                 return_value=mock_device,
             ),
             patch(
@@ -953,7 +956,7 @@ def test_cable_url_present_wraps_cable_status_in_anchor(self):
 
         with (
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_object_or_404",
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
                 return_value=mock_device,
             ),
             patch(
@@ -1986,7 +1989,7 @@ def test_can_create_cable_adds_form_action(self):
 
         with (
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_object_or_404",
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
                 return_value=mock_device,
             ),
             patch(
@@ -2078,7 +2081,7 @@ def _run_post(self, view, process_result):
 
         with (
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_object_or_404",
+                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
                 return_value=mock_device,
             ),
             patch(
diff --git a/netbox_librenms_plugin/tests/test_coverage_devices.py b/netbox_librenms_plugin/tests/test_coverage_devices.py
index 2e285c3f44..f72f91d329 100644
--- a/netbox_librenms_plugin/tests/test_coverage_devices.py
+++ b/netbox_librenms_plugin/tests/test_coverage_devices.py
@@ -16,6 +16,13 @@ def _make_real_device(tag):
     return Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
 
 
+def _make_verify_superuser(tag):
+    """A real superuser so restrict(user, "view") returns the full queryset in DB-backed verify tests."""
+    from django.contrib.auth import get_user_model
+
+    return get_user_model().objects.create_superuser(username=f"verify-su-{tag}", email="", password="x")
+
+
 def _make_device_view():
     """Create a DeviceLibreNMSSyncView instance bypassing __init__."""
     from netbox_librenms_plugin.views.object_sync.devices import DeviceLibreNMSSyncView
@@ -297,7 +304,10 @@ def test_returns_404_when_no_cached_data(self):
         mock_device = MagicMock()
         mock_device.virtual_chassis = None
 
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
+        with patch(
+            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+            return_value=mock_device,
+        ):
             with patch(
                 "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
             ):
@@ -324,7 +334,10 @@ def test_returns_404_when_interface_not_in_cache(self):
 
         cached_data = {"ports": [{"ifName": "eth0", "speed": 1000}]}
 
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
+        with patch(
+            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+            return_value=mock_device,
+        ):
             with patch(
                 "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
             ):
@@ -355,7 +368,10 @@ def test_returns_success_when_interface_found(self):
         mock_table = MagicMock()
         mock_table.format_interface_data.return_value = "<tr>row</tr>"
 
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
+        with patch(
+            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+            return_value=mock_device,
+        ):
             with patch(
                 "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
             ):
@@ -391,7 +407,10 @@ def test_non_vc_device_skips_sync_device_lookup(self):
         mock_table = MagicMock()
         mock_table.format_interface_data.return_value = "<tr>row</tr>"
 
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
+        with patch(
+            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+            return_value=mock_device,
+        ):
             with patch(
                 "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=None
             ) as mock_get_sync_device:
@@ -484,7 +503,10 @@ def test_success_propagates_can_change_interface_to_verify_table(self):
         mock_table.format_module_data.return_value = "<tr>row</tr>"
 
         with (
-            patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=selected_device),
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+                return_value=selected_device,
+            ),
             patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache,
             patch("netbox_librenms_plugin.utils.load_bay_mappings", return_value=([], [])),
             patch("netbox_librenms_plugin.utils.get_enabled_ignore_rules", return_value=[]),
@@ -609,7 +631,10 @@ def test_returns_400_when_invalid_vid(self):
         request.body = json.dumps({"device_id": 1, "vid": "notanumber"}).encode()
 
         mock_device = MagicMock()
-        with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
+        with patch(
+            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+            return_value=mock_device,
+        ):
             response = view.post(request)
 
         assert isinstance(response, JsonResponse)
@@ -634,6 +659,8 @@ def test_returns_success_with_vlan_group(self):
         request.body = json.dumps(
             {"device_id": device.pk, "interface_name": "eth0", "vid": "10", "vlan_group_id": group.pk, "vlan_type": "U"}
         ).encode()
+        request.user = _make_verify_superuser("vg-with")
+        view.request = request
         response = view.post(request)
 
         assert isinstance(response, JsonResponse)
@@ -655,6 +682,8 @@ def test_returns_success_without_vlan_group(self):
         view = self._make_view()
         request = MagicMock()
         request.body = json.dumps({"device_id": device.pk, "vid": "100", "vlan_type": "T"}).encode()
+        request.user = _make_verify_superuser("vg-without")
+        view.request = request
         response = view.post(request)
 
         assert isinstance(response, JsonResponse)
@@ -686,6 +715,8 @@ def test_existing_interface_with_untagged_and_tagged_vlans(self):
         request.body = json.dumps(
             {"device_id": device.pk, "vid": "10", "vlan_group_id": group.pk, "vlan_type": "T", "interface_name": "eth0"}
         ).encode()
+        request.user = _make_verify_superuser("vg-iface")
+        view.request = request
         response = view.post(request)
 
         assert isinstance(response, JsonResponse)
diff --git a/netbox_librenms_plugin/tests/test_ip_verify.py b/netbox_librenms_plugin/tests/test_ip_verify.py
index a469d2d132..e9dd775756 100644
--- a/netbox_librenms_plugin/tests/test_ip_verify.py
+++ b/netbox_librenms_plugin/tests/test_ip_verify.py
@@ -74,26 +74,36 @@ def test_cache_key_default_server(self):
         assert view.get_cache_key(device, "ip_addresses", "default") == expected_key
 
 
+@pytest.mark.django_db
 class TestServerKeyFromPost:
-    """server_key from POST body must be used for cache lookup."""
+    """server_key from POST body must be threaded into the cache lookup key, keyed on the REAL device pk.
 
-    @pytest.fixture(autouse=True)
-    def _patch_ip_models(self):
-        """Patch IPAddress.objects to avoid DB access."""
-        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.IPAddress") as mock_ip:
-            mock_ip.objects.filter.return_value.first.return_value = None
-            yield
+    The device is resolved through the real object-scoped lookup (real Device + a real superuser on
+    the request, so ``restrict`` returns it); only the cache read is instrumented, to capture which
+    key the view queries.
+    """
 
-    def _run_post(self, body, device=None):
-        """Execute view.post() with mocks and return the cache key used."""
-        view = _make_view()
-        if device is None:
-            device = _mock_device()
+    def _real_device(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="IPSK-Mfr", slug="ipsk-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="IPSK-DT", slug="ipsk-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="IPSK-Role", slug="ipsk-role")
+        site, _ = Site.objects.get_or_create(name="IPSK-Site", slug="ipsk-site")
+        return Device.objects.create(name="ipsk-dev", device_type=dt, role=role, site=site, status="active")
+
+    def _run_post(self, body):
+        """Execute view.post() against a real device and return (cache_key_queried, device_pk)."""
+        from django.contrib.auth import get_user_model
+
+        device = self._real_device()
+        body = {**body, "device_id": device.pk, "object_type": "device"}
 
+        view = _make_view()
         request = _make_request(body)
-        # Direct post() bypasses dispatch(); _get_object reads self.request.user to object-scope the
-        # lookup, so supply the request the view would otherwise get from dispatch.
+        request.user = get_user_model().objects.create_superuser(username="ipsk-user", email="", password="x")
         view.request = request
+
         captured_cache_key = {}
 
         def fake_cache_get(key):
@@ -101,13 +111,8 @@ def fake_cache_get(key):
             return {"ip_addresses": []}
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.ip_addresses_view.get_object_or_404",
-                return_value=device,
-            ),
-            # The verify gate validates server_key against configured servers before using it as a
-            # cache namespace; configure "prod" so a posted "prod" threads through, while an absent
-            # or unconfigured key still falls back to "default".
+            # Configure "prod" so a posted "prod" threads through as the cache namespace, while an
+            # absent/unconfigured key falls back to "default".
             patch(
                 "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
                 return_value={"prod": "Prod"},
@@ -117,37 +122,22 @@ def fake_cache_get(key):
             mock_cache.get.side_effect = fake_cache_get
             view.post(request)
 
-        return captured_cache_key.get("key")
+        return captured_cache_key.get("key"), device.pk
 
     def test_server_key_threaded_to_cache_lookup(self):
         """post() must include server_key in the cache key."""
-        device = _mock_device(pk=5)
-        key = self._run_post(
-            {"device_id": 5, "ip_address": "10.0.0.1/24", "server_key": "prod", "object_type": "device"},
-            device=device,
-        )
-
-        assert key == "librenms_ip_addresses_device_5_prod"
+        key, pk = self._run_post({"ip_address": "10.0.0.1/24", "server_key": "prod"})
+        assert key == f"librenms_ip_addresses_device_{pk}_prod"
 
     def test_default_server_key_when_missing(self):
         """When server_key is absent from POST, default to 'default'."""
-        device = _mock_device(pk=5)
-        key = self._run_post(
-            {"device_id": 5, "ip_address": "10.0.0.1/24", "object_type": "device"},
-            device=device,
-        )
-
-        assert key == "librenms_ip_addresses_device_5_default"
+        key, pk = self._run_post({"ip_address": "10.0.0.1/24"})
+        assert key == f"librenms_ip_addresses_device_{pk}_default"
 
     def test_null_server_key_falls_back_to_default(self):
         """When server_key is explicitly null, fall back to 'default'."""
-        device = _mock_device(pk=5)
-        key = self._run_post(
-            {"device_id": 5, "ip_address": "10.0.0.1/24", "server_key": None, "object_type": "device"},
-            device=device,
-        )
-
-        assert key == "librenms_ip_addresses_device_5_default"
+        key, pk = self._run_post({"ip_address": "10.0.0.1/24", "server_key": None})
+        assert key == f"librenms_ip_addresses_device_{pk}_default"
 
 
 class TestVerifyPostRejectsNonObjectBody:
diff --git a/netbox_librenms_plugin/tests/test_reviewer_fixes.py b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
index 06814c843e..7ea3ad784b 100644
--- a/netbox_librenms_plugin/tests/test_reviewer_fixes.py
+++ b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
@@ -290,7 +290,9 @@ def test_server_key_used_for_cache_lookup(self):
                 "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
                 return_value={"production": "Production"},
             ),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
+            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
                 return_value=mock_device,
@@ -331,7 +333,9 @@ def test_fallback_to_api_server_key(self):
         ).encode()
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
+            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
                 side_effect=lambda dev, **kw: dev,
diff --git a/netbox_librenms_plugin/tests/test_verify_views.py b/netbox_librenms_plugin/tests/test_verify_views.py
index 580caf1f79..94be074cd4 100644
--- a/netbox_librenms_plugin/tests/test_verify_views.py
+++ b/netbox_librenms_plugin/tests/test_verify_views.py
@@ -48,7 +48,7 @@ def _make_view(self):
         view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
     def test_vc_no_resolvable_sync_device_returns_empty_row(self, mock_cache, mock_sync, mock_get_obj):
@@ -66,7 +66,7 @@ def test_vc_no_resolvable_sync_device_returns_empty_row(self, mock_cache, mock_s
         assert data["formatted_row"]["cable_status"] == "Missing Ports"
         mock_cache.get.assert_not_called()
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
     def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_get_obj):
@@ -87,7 +87,7 @@ def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_ge
         assert "device" in cache_key
         assert "2" in cache_key
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
     def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
@@ -113,7 +113,7 @@ def test_no_device_id_returns_empty_row(self):
         assert data["status"] == "success"
         assert data["formatted_row"]["cable_status"] == "Missing Ports"
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
     def test_malformed_cached_links_fail_closed(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
@@ -171,7 +171,7 @@ def _make_view(self):
         view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
     def test_vc_no_resolvable_sync_device_returns_404(self, mock_cache, mock_sync, mock_get_obj):
@@ -196,7 +196,7 @@ def test_vc_no_resolvable_sync_device_returns_404(self, mock_cache, mock_sync, m
         assert "sync device" in data["message"].lower()
         mock_cache.get.assert_not_called()
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
     def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_get_obj):
@@ -222,7 +222,7 @@ def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_ge
         cache_key = mock_cache.get.call_args[0][0]
         assert "3" in cache_key
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404")
+    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
     def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
diff --git a/netbox_librenms_plugin/tests/test_view_wiring.py b/netbox_librenms_plugin/tests/test_view_wiring.py
index 3e92814efb..dca011d5fb 100644
--- a/netbox_librenms_plugin/tests/test_view_wiring.py
+++ b/netbox_librenms_plugin/tests/test_view_wiring.py
@@ -456,7 +456,9 @@ def test_server_key_used_for_cache_lookup(self):
                 "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
                 return_value={"production": "Production"},
             ),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
+            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
             ) as mock_sync_device,
@@ -498,7 +500,9 @@ def test_fallback_to_api_server_key(self):
         ).encode()
 
         with (
-            patch("netbox_librenms_plugin.views.base.cables_view.get_object_or_404") as mock_get_obj,
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
+            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
             ) as mock_sync_device,
diff --git a/netbox_librenms_plugin/views/base/cables_view.py b/netbox_librenms_plugin/views/base/cables_view.py
index d8ae154cc6..692eab2d68 100644
--- a/netbox_librenms_plugin/views/base/cables_view.py
+++ b/netbox_librenms_plugin/views/base/cables_view.py
@@ -518,7 +518,7 @@ def post(self, request):
         if selected_device_id:
             # Object-scope the lookup: the gate only checked model-level view_device, so an
             # out-of-scope pk must 404 rather than expose that device's cached cable row.
-            selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
+            selected_device = self.restrict_object_or_404(Device, pk=selected_device_id)
 
             # Use the same sync-device resolution as the GET path so the cache
             # key matches what _prepare_context wrote. When the VC has no
diff --git a/netbox_librenms_plugin/views/base/ip_addresses_view.py b/netbox_librenms_plugin/views/base/ip_addresses_view.py
index 6b30f54f06..f7f5633a31 100644
--- a/netbox_librenms_plugin/views/base/ip_addresses_view.py
+++ b/netbox_librenms_plugin/views/base/ip_addresses_view.py
@@ -423,18 +423,17 @@ def _get_object(self, object_id, object_type=None):
         view perms, so a constrained grant must not resolve an out-of-scope id here — it 404s
         instead of exposing the object's cached IP verify payload.
         """
-        user = self.request.user
         if object_type == "device":
-            return get_object_or_404(Device.objects.restrict(user, "view"), pk=object_id)
+            return self.restrict_object_or_404(Device, pk=object_id)
         elif object_type == "virtualmachine":
-            return get_object_or_404(VirtualMachine.objects.restrict(user, "view"), pk=object_id)
+            return self.restrict_object_or_404(VirtualMachine, pk=object_id)
         else:
             # Try to find object without knowing its type (scoped to the caller's viewable objects).
-            obj = Device.objects.restrict(user, "view").filter(pk=object_id).first()
+            obj = self.restricted_queryset(Device).filter(pk=object_id).first()
             if obj:
                 return obj
 
-            obj = VirtualMachine.objects.restrict(user, "view").filter(pk=object_id).first()
+            obj = self.restricted_queryset(VirtualMachine).filter(pk=object_id).first()
             if obj:
                 return obj
 
diff --git a/netbox_librenms_plugin/views/mixins.py b/netbox_librenms_plugin/views/mixins.py
index 71aa4a37fa..af2c742090 100644
--- a/netbox_librenms_plugin/views/mixins.py
+++ b/netbox_librenms_plugin/views/mixins.py
@@ -4,7 +4,7 @@
 from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.core.cache import cache
 from django.http import HttpResponse, JsonResponse
-from django.shortcuts import redirect
+from django.shortcuts import get_object_or_404, redirect
 from django.utils.http import url_has_allowed_host_and_scheme
 from utilities.permissions import get_permission_for_model
 
@@ -244,6 +244,42 @@ def require_object_permissions_json(self, method):
             return JsonResponse({"error": f"Missing permissions: {missing_str}"}, status=403)
         return None
 
+    def restricted_queryset(self, model, action="view"):
+        """
+        Scope *model*'s queryset to the objects the request user may *action*.
+
+        The permission gates (check_object_permissions / require_*_permissions) only ask
+        ``user.has_perm(perm)`` with no instance, so a constrained grant (e.g. a site-scoped
+        ``view_device``) passes the model-level check. Resolving an id against the plain manager
+        would then expose any object by raw pk, so scope through ``model.objects.restrict`` — the
+        same per-object constraint NetBox enforces everywhere else.
+
+        Args:
+            model: A NetBox model whose manager is a ``RestrictedQuerySet`` (exposes ``restrict``).
+            action: The permission action to scope by (default ``"view"``).
+
+        Returns:
+            A queryset filtered to the objects the request user may perform *action* on.
+        """
+        return model.objects.restrict(self.request.user, action)
+
+    def restrict_object_or_404(self, model, action="view", **kwargs):
+        """
+        Resolve one object through :meth:`restricted_queryset` (fail-closed lookup).
+
+        An out-of-scope id 404s exactly like a nonexistent one, so a constrained grant can't read
+        another object's data by raw pk. Mirrors ``get_object_or_404`` — pass the lookup as kwargs.
+
+        Args:
+            model: A NetBox model whose manager is a ``RestrictedQuerySet``.
+            action: The permission action to scope by (default ``"view"``).
+            **kwargs: Lookup kwargs forwarded to ``get_object_or_404`` (e.g. ``pk=...``).
+
+        Returns:
+            The resolved object the user is permitted to access.
+        """
+        return get_object_or_404(self.restricted_queryset(model, action), **kwargs)
+
     def require_all_permissions(self, method="POST"):
         """
         Check both plugin write and NetBox object permissions.
diff --git a/netbox_librenms_plugin/views/object_sync/devices.py b/netbox_librenms_plugin/views/object_sync/devices.py
index 851afb3e4c..18abd3ff3a 100644
--- a/netbox_librenms_plugin/views/object_sync/devices.py
+++ b/netbox_librenms_plugin/views/object_sync/devices.py
@@ -153,7 +153,7 @@ def post(self, request):
         # Restrict the lookup to the caller's viewable devices: the gate above only checked the
         # model-level view_device perm, so a site-scoped grant would otherwise read another
         # device's cached verify payload by raw pk.
-        selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
+        selected_device = self.restrict_object_or_404(Device, pk=selected_device_id)
 
         # Normalise to the VC sync device so cache keys match what the sync view stored
         if selected_device.virtual_chassis:
@@ -237,7 +237,7 @@ def post(self, request):
         # Restrict the lookup to the caller's viewable devices: the gate above only checked the
         # model-level view_device perm, so a site-scoped grant would otherwise read another
         # device's cached verify payload by raw pk.
-        selected_device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=selected_device_id)
+        selected_device = self.restrict_object_or_404(Device, pk=selected_device_id)
 
         if selected_device.virtual_chassis:
             sync_device = get_librenms_sync_device(selected_device, server_key=server_key)
@@ -395,7 +395,7 @@ def post(self, request):
 
         # Object-scope the lookup (see SingleInterfaceVerifyView): the gate only checked model-level
         # view_device, so an out-of-scope pk must 404 rather than expose the device.
-        device = get_object_or_404(Device.objects.restrict(request.user, "view"), pk=device_id)
+        device = self.restrict_object_or_404(Device, pk=device_id)
         try:
             vid = int(vid_str)
         except (ValueError, TypeError):

From ca84aa71da798072eb6d818f5b6955941a20decc Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 22:38:50 +0200
Subject: [PATCH 08/17] feat(i2): object-scope SaveVlanGroupOverrides + convert
 verify tests to real DB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security fix (new CodeRabbit finding on #313): SaveVlanGroupOverridesView persisted VLAN overrides
after a plain get_object_or_404(Device), gated only by plugin-wide write perm — so any plugin-writer
could write overrides for a device they can't view. Add NetBoxObjectPermissionMixin to the view and
route the lookup through restrict_object_or_404 so an out-of-scope pk 404s (red→green real-DB test).

De-mock: replace every `restrict_object_or_404` test seam-stub with a real Device resolved through the
real object-perm gate + restrict(), across the verify-view suites:
- test_cable_verify: fully real Device/Interface/Cable + real cache (XSS escaping, stale-field recompute)
- test_coverage_devices: real device/cache/table for interface + module + vlan-group + save-overrides
  (module test drives real has_perm from a precise ObjectPermission grant)
- test_verify_views: real VC devices for the cable/interface VC-resolution tests
- test_coverage_base_views2: real devices for the cable post-handler branch tests
- test_reviewer_fixes / test_view_wiring: real VC device for the cable server-key threading tests

Resolve LibreNMSSettings via apps.get_model in the two grant helpers so the autouse mock_librenms_config
fixture (which patches the module attribute in the full suite) can't hand get_for_model() a MagicMock.

Full suite green (3341).
---
 .../tests/test_cable_verify.py                | 587 ++++++------------
 .../tests/test_coverage_base_views2.py        | 135 ++--
 .../tests/test_coverage_devices.py            | 486 ++++++++-------
 .../tests/test_reviewer_fixes.py              | 111 ++--
 .../tests/test_verify_views.py                | 277 ++++++---
 .../tests/test_view_wiring.py                 | 115 ++--
 .../views/object_sync/devices.py              |   9 +-
 7 files changed, 823 insertions(+), 897 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_cable_verify.py b/netbox_librenms_plugin/tests/test_cable_verify.py
index b5a942a467..025db1ac5a 100644
--- a/netbox_librenms_plugin/tests/test_cable_verify.py
+++ b/netbox_librenms_plugin/tests/test_cable_verify.py
@@ -1,447 +1,222 @@
 """
 Regression tests for SingleCableVerifyView.post().
 
+Fully DB-backed: the verify path re-enriches purely from live NetBox state
+(get_device_by_id_or_name, enrich_remote_port and check_cable_status are ORM lookups — the
+LibreNMS client is never touched once the links cache is warm), so these exercise real
+Device/Interface/Cable objects, a real links cache entry and a real object-scoped request end to
+end. The only patched boundary is get_available_servers() — i.e. which LibreNMS servers are
+configured — so the POSTed server_key resolves deterministically.
+
 Covers:
-- Stale derived fields are stripped before re-enrichment (prevents
-  DoesNotExist when remote objects are deleted after caching).
-- LibreNMS-sourced labels are HTML-escaped to prevent XSS.
+- Stale derived fields (ids/URLs from a previous enrichment) in the cached link are stripped and
+  recomputed from current NetBox state.
+- LibreNMS-sourced labels (local_port, remote_device) are HTML-escaped to prevent XSS.
 """
 
 import json
-from unittest.mock import MagicMock, patch
+from unittest.mock import patch
 
 import pytest
+from django.core.cache import cache as real_cache
+from django.test import RequestFactory
 
-
-def _make_view(server_key="default"):
-    """Create a SingleCableVerifyView instance without database access."""
-    from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
-
-    view = object.__new__(SingleCableVerifyView)
-    view._librenms_api = MagicMock()
-    view._librenms_api.server_key = server_key
-    view.request = MagicMock()
-    return view
+SERVER_KEY = "default"
 
 
-def _make_request(body_dict):
-    """Create a mock POST request with JSON body."""
-    request = MagicMock()
-    request.method = "POST"
-    request.body = json.dumps(body_dict).encode()
-    request.META = {"HTTP_X_REQUESTED_WITH": "XMLHttpRequest"}
-    return request
-
-
-class TestStaleFieldStripping:
-    """Cached link data with stale derived fields must be stripped before use."""
-
-    def test_stale_remote_fields_stripped_before_enrichment(self):
-        """Stale netbox_remote_device_id / remote_device_url must not reach check_cable_status()."""
-        view = _make_view()
-
-        # Cached link with stale derived fields (from a previous enrichment)
-        cached_link = {
-            "local_port": "eth0",
-            "local_port_id": 100,
-            "remote_port": "eth1",
-            "remote_device": "switch-remote",
-            "remote_port_id": 200,
-            "remote_device_id": 42,
-            # Stale derived fields — remote device was deleted after caching
-            "netbox_remote_device_id": 999,
-            "remote_device_url": "/dcim/devices/999/",
-            "netbox_remote_interface_id": 888,
-            "remote_port_url": "/dcim/interfaces/888/",
-            "cable_status": "No Cable",
-            "can_create_cable": True,
-        }
-
-        cached_data = {"links": [cached_link]}
-
-        device = MagicMock()
-        device.pk = 1
-        device.id = 1
-        device.virtual_chassis = None
-        interface_mock = MagicMock()
-        interface_mock.pk = 10
-
-        # Track what link_data check_cable_status receives
-        received_link_data = {}
-
-        def fake_check_cable_status(link):
-            received_link_data.update(link)
-            link["cable_status"] = "No Cable"
-            link["can_create_cable"] = True
-            return link
-
-        def fake_process_remote_device(link, hostname, device_id, server_key=None):
-            assert link is not None
-            assert hostname is not None
-            assert device_id is not None
-            assert server_key == "default"
-            # Simulate successful remote enrichment with fresh IDs
-            link["remote_device_url"] = "/dcim/devices/777/"
-            link["netbox_remote_device_id"] = 777
-            link["remote_port_url"] = "/dcim/interfaces/666/"
-            link["netbox_remote_interface_id"] = 666
-            link["remote_port_name"] = "eth1"
-            return link
-
-        request = _make_request({"device_id": 1, "local_port_id": 100})
-
-        with (
-            patch.object(view, "restrict_object_or_404", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-            patch.object(view, "get_cache_key", return_value="test_key"),
-            patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
-            patch.object(view, "process_remote_device", side_effect=fake_process_remote_device),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_virtual_chassis_member", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view._librenms_id_q", return_value=MagicMock()),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_token", return_value="csrf123"),
-            patch("netbox_librenms_plugin.views.base.cables_view.reverse", return_value="/fake/"),
-        ):
-            mock_cache.get.return_value = cached_data
-            # Make the interface filter return our mock
-            device.interfaces.filter.return_value.first.return_value = interface_mock
-
-            view.post(request)
-
-        # check_cable_status should have received fresh IDs from process_remote_device,
-        # NOT the stale 999/888 from cache
-        assert received_link_data.get("netbox_remote_device_id") == 777
-        assert received_link_data.get("netbox_remote_interface_id") == 666
-
-    def test_post_strips_derived_fields_from_cached_link(self):
-        """post() must strip derived fields (URLs, IDs) before re-enrichment.
-
-        Both _prepare_context and post() define a _raw_keys set that controls
-        which cached fields survive into re-enrichment. This test verifies the
-        behavior: derived fields in the cached link must not leak through.
-        """
-        view = _make_view()
-
-        # Cached link with both raw and derived (stale) fields
-        cached_link = {
-            "local_port": "eth0",
-            "local_port_id": 100,
-            "remote_port": "eth1",
-            "remote_device": "switch-a",
-            "remote_port_id": 200,
-            "remote_device_id": 42,
-            # Derived fields that must be stripped:
-            "netbox_local_interface_id": 999,
-            "netbox_remote_interface_id": 888,
-            "netbox_remote_device_id": 777,
-            "local_port_url": "/stale/",
-            "remote_port_url": "/stale/",
-            "remote_device_url": "/stale/",
-            "cable_status": "stale",
-            "can_create_cable": True,
-        }
-
-        # Mock process_remote_device to avoid DB access during re-enrichment;
-        # it should receive the link WITHOUT derived fields.
-        received_link = {}
-
-        def fake_process_remote(link, hostname, device_id, server_key=None):
-            received_link.update(link)
-            return link
-
-        view.process_remote_device = fake_process_remote
-
-        with (
-            patch.object(view, "restrict_object_or_404") as mock_get,
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=None),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_token", return_value="tok"),
-        ):
-            device = MagicMock()
-            device.pk = 1
-            device.virtual_chassis = None
-            device.interfaces.filter.return_value.first.return_value = None
-            mock_get.return_value = device
-            mock_cache.get.return_value = {"links": [cached_link]}
-
-            request = MagicMock()
-            request.body = json.dumps(
-                {
-                    "device_id": 1,
-                    "local_port_id": 100,
-                    "server_key": "default",
-                }
-            )
-            view.post(request)
+def _cable_device(tag, ifaces):
+    """Create a real Device named *tag* with named interfaces.
 
-            # The link passed to process_remote_device must have derived fields stripped
-            assert "netbox_local_interface_id" not in received_link
-            assert "netbox_remote_interface_id" not in received_link
-            assert "netbox_remote_device_id" not in received_link
-            assert "local_port_url" not in received_link
-            assert "cable_status" not in received_link
+    ``ifaces`` is a list of ``(name, librenms_port_id)`` — a non-None port id binds the interface's
+    ``librenms_id`` custom field for that server so the view's ``_librenms_id_q`` lookup resolves it.
+    Returns ``(device, {name: interface})``.
+    """
+    from dcim.models import Device, DeviceRole, DeviceType, Interface, Manufacturer, Site
 
+    mfr, _ = Manufacturer.objects.get_or_create(name=f"CblMfr-{tag}", slug=f"cblmfr-{tag}")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"CblDT-{tag}", slug=f"cbldt-{tag}")
+    role, _ = DeviceRole.objects.get_or_create(name="CblRole", slug="cblrole")
+    site, _ = Site.objects.get_or_create(name="CblSite", slug="cblsite")
+    device = Device.objects.create(name=tag, device_type=dt, role=role, site=site, status="active")
+    made = {}
+    for name, port_id in ifaces:
+        iface = Interface.objects.create(device=device, name=name, type="1000base-t")
+        if port_id is not None:
+            iface.custom_field_data = {"librenms_id": {SERVER_KEY: port_id}}
+            iface.save()
+        made[name] = iface
+    return device, made
 
-class TestXSSEscaping:
-    """LibreNMS-sourced labels must be HTML-escaped in cable verify output."""
 
-    def test_xss_in_local_port_name_escaped(self):
-        """A malicious local_port name must be escaped in the HTML output."""
-        view = _make_view()
-
-        xss_port_name = '<script>alert("xss")</script>'
-        cached_link = {
-            "local_port": xss_port_name,
-            "local_port_id": 100,
-            "remote_port": "eth1",
-            "remote_device": "safe-switch",
-            "remote_port_id": 200,
-            "remote_device_id": 42,
-        }
-
-        cached_data = {"links": [cached_link]}
-
-        device = MagicMock()
-        device.pk = 1
-        device.id = 1
-        device.virtual_chassis = None
-        interface_mock = MagicMock()
-        interface_mock.pk = 10
-
-        def fake_process_remote_device(link, hostname, device_id, server_key=None):
-            link["remote_device_url"] = "/dcim/devices/2/"
-            link["netbox_remote_device_id"] = 2
-            link["remote_port_url"] = "/dcim/interfaces/20/"
-            link["netbox_remote_interface_id"] = 20
-            link["remote_port_name"] = "eth1"
-            return link
-
-        def fake_check_cable_status(link):
-            link["cable_status"] = "No Cable"
-            link["can_create_cable"] = False
-            return link
-
-        request = _make_request({"device_id": 1, "local_port_id": 100})
-
-        with (
-            patch.object(view, "restrict_object_or_404", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-            patch.object(view, "get_cache_key", return_value="test_key"),
-            patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
-            patch.object(view, "process_remote_device", side_effect=fake_process_remote_device),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view._librenms_id_q", return_value=MagicMock()),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_token", return_value="csrf123"),
-            patch("netbox_librenms_plugin.views.base.cables_view.reverse", return_value="/fake/"),
-        ):
-            mock_cache.get.return_value = cached_data
-            device.interfaces.filter.return_value.first.return_value = interface_mock
+def _cable_view_and_request(tag, body):
+    """A real SingleCableVerifyView plus a real superuser request (so the perm gate + restrict resolve)."""
+    from django.contrib.auth import get_user_model
 
-            response = view.post(request)
-
-        content = json.loads(response.content)
-        row = content.get("formatted_row", {})
-        local_port_html = row.get("local_port", "")
-
-        # The raw script tag must NOT appear unescaped
-        assert "<script>" not in local_port_html
-        # The escaped version should be present
-        assert "&lt;script&gt;" in local_port_html
-
-    def test_xss_in_remote_device_name_escaped(self):
-        """A malicious remote_device name must be escaped in the HTML output."""
-        view = _make_view()
+    from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
 
-        xss_device = "<img src=x onerror=alert(1)>"
-        cached_link = {
-            "local_port": "eth0",
-            "local_port_id": 100,
-            "remote_port": "eth1",
-            "remote_device": xss_device,
-            "remote_port_id": 200,
-            "remote_device_id": 42,
-        }
-
-        cached_data = {"links": [cached_link]}
-
-        device = MagicMock()
-        device.pk = 1
-        device.id = 1
-        device.virtual_chassis = None
-        interface_mock = MagicMock()
-        interface_mock.pk = 10
-
-        def fake_process_remote_device(link, hostname, device_id, server_key=None):
-            # Remote device found — but name is the XSS payload
-            link["remote_device_url"] = "/dcim/devices/2/"
-            link["netbox_remote_device_id"] = 2
-            link["remote_port_url"] = "/dcim/interfaces/20/"
-            link["netbox_remote_interface_id"] = 20
-            link["remote_port_name"] = "eth1"
-            return link
-
-        def fake_check_cable_status(link):
-            link["cable_status"] = "No Cable"
-            link["can_create_cable"] = False
-            return link
-
-        request = _make_request({"device_id": 1, "local_port_id": 100})
-
-        with (
-            patch.object(view, "restrict_object_or_404", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-            patch.object(view, "get_cache_key", return_value="test_key"),
-            patch.object(view, "check_cable_status", side_effect=fake_check_cable_status),
-            patch.object(view, "process_remote_device", side_effect=fake_process_remote_device),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device),
-            patch("netbox_librenms_plugin.views.base.cables_view._librenms_id_q", return_value=MagicMock()),
-            patch("netbox_librenms_plugin.views.base.cables_view.get_token", return_value="csrf123"),
-            patch("netbox_librenms_plugin.views.base.cables_view.reverse", return_value="/fake/"),
+    view = SingleCableVerifyView()
+    request = RequestFactory().post("/verify-cable/", data=json.dumps(body), content_type="application/json")
+    request.user = get_user_model().objects.create_superuser(username=f"cbl-{tag}", email="", password="x")
+    view.request = request
+    view.kwargs = {}
+    view.args = ()
+    return view, request
+
+
+def _post_with_links(view, request, device, links):
+    """Warm the real links cache for *device*, run post() (with 'default' configured), clean up, return JSON."""
+    key = view.get_cache_key(device, "links", SERVER_KEY)
+    real_cache.set(key, {"links": links})
+    try:
+        with patch(
+            "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+            return_value={SERVER_KEY: "Default"},
         ):
-            mock_cache.get.return_value = cached_data
-            device.interfaces.filter.return_value.first.return_value = interface_mock
-
             response = view.post(request)
+    finally:
+        real_cache.delete(key)
+    return json.loads(response.content)
 
-        content = json.loads(response.content)
-        row = content.get("formatted_row", {})
-        remote_device_html = row.get("remote_device", "")
-
-        # Raw HTML tag must not appear — angle brackets must be escaped
-        assert "<img " not in remote_device_html
-        # Escaped version should be present (browser renders as text, not tag)
-        assert "&lt;img" in remote_device_html
 
+@pytest.mark.django_db
+class TestStaleFieldStripping:
+    """Cached derived fields (URLs/ids from a previous enrichment) must be recomputed from live state."""
 
-class TestServerKeyGuard:
-    """A forged non-string server_key must not crash the membership check (get_available_servers() is a dict)."""
+    def test_stale_remote_fields_recomputed_from_live_netbox(self):
+        """A stale remote_device_url/id in cache is dropped; the row links the REAL remote device + cable."""
+        from dcim.models import Cable
 
-    def _view(self, available):
-        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+        local, lifaces = _cable_device("stale-local", [("eth0", 100)])
+        remote, rifaces = _cable_device("switch-remote", [("eth1", 200)])
+        cable = Cable(a_terminations=[lifaces["eth0"]], b_terminations=[rifaces["eth1"]])
+        cable.save()
 
-        view = object.__new__(SingleCableVerifyView)
-        view._librenms_api = MagicMock()
-        view._librenms_api.server_key = "default"
-        # A REAL dict so the `in` membership test really hashes the key (the crash point).
-        view._librenms_api.get_available_servers.return_value = available
-        view.require_object_permissions_json = MagicMock(return_value=None)
-        return view
+        view, request = _cable_view_and_request(
+            "stale", {"device_id": local.pk, "local_port_id": 100, "server_key": SERVER_KEY}
+        )
+        content = _post_with_links(
+            view,
+            request,
+            local,
+            [
+                {
+                    "local_port": "eth0",
+                    "local_port_id": 100,
+                    "remote_port": "eth1",
+                    "remote_port_id": 200,
+                    "remote_device": "switch-remote",
+                    "remote_device_id": None,
+                    # Stale derived fields from a previous enrichment (a different remote object then):
+                    "netbox_remote_device_id": 999,
+                    "remote_device_url": "/dcim/devices/999/",
+                    "netbox_remote_interface_id": 888,
+                    "remote_port_url": "/dcim/interfaces/888/",
+                    "cable_status": "No Cable",
+                    "can_create_cable": True,
+                }
+            ],
+        )
 
-    @pytest.mark.parametrize("forged", [["prod"], {"prod": 1}])
-    def test_unhashable_server_key_falls_back_without_crashing(self, forged):
-        """A JSON array/object server_key must fall back to the active server, not raise TypeError."""
-        # No device_id → post resolves server_key (the guarded line) then returns the empty row.
-        view = self._view({"default": "Default Server"})
-        request = _make_request({"server_key": forged})
+        row = content["formatted_row"]
+        # Remote side recomputed to the REAL device, not the stale 999.
+        assert f"/dcim/devices/{remote.pk}/" in row["remote_device"]
+        assert "/dcim/devices/999/" not in row["remote_device"]
+        # The real cable is found, so the stale "No Cable" is replaced.
+        assert "Cable Found" in row["cable_status"]
 
-        response = view.post(request)  # must not raise unhashable-type TypeError
+    def test_stale_local_and_status_fields_recomputed(self):
+        """Stale local interface id / cable_status in cache are stripped; the row uses live values."""
+        local, lifaces = _cable_device("stale2-local", [("eth0", 100)])
 
-        assert response.status_code == 200
+        view, request = _cable_view_and_request(
+            "stale2", {"device_id": local.pk, "local_port_id": 100, "server_key": SERVER_KEY}
+        )
+        content = _post_with_links(
+            view,
+            request,
+            local,
+            [
+                {
+                    "local_port": "eth0",
+                    "local_port_id": 100,
+                    "remote_port": "eth1",
+                    "remote_port_id": 200,
+                    "remote_device": "",  # no remote side → no remote enrichment / cable check
+                    "remote_device_id": None,
+                    # Stale derived fields that must not survive the strip-to-raw-keys step:
+                    "netbox_local_interface_id": 999,
+                    "local_port_url": "/stale/",
+                    "cable_status": "stale-status",
+                    "can_create_cable": True,
+                }
+            ],
+        )
 
-    def test_valid_string_server_key_is_still_honoured(self):
-        """A configured string key still passes the isinstance guard (regression for the str check)."""
-        view = self._view({"prod": "Prod Server"})
-        request = _make_request({"server_key": "prod", "device_id": ""})
+        row = content["formatted_row"]
+        # Local port link recomputed to the REAL interface, not the stale id/url.
+        assert f"/dcim/interfaces/{lifaces['eth0'].pk}/" in row["local_port"]
+        assert "/stale/" not in row["local_port"]
+        # cable_status was stripped (not a raw key) → falls back to the default, never the stale value.
+        assert "stale-status" not in row["cable_status"]
+        assert row["cable_status"] == "Missing Ports"
 
-        response = view.post(request)
 
-        assert response.status_code == 200
+@pytest.mark.django_db
+class TestXSSEscaping:
+    """LibreNMS-sourced labels must be HTML-escaped in cable verify output (real render, real objects)."""
 
+    def test_xss_in_local_port_name_escaped(self):
+        """A malicious local_port name must be escaped in the HTML output."""
+        local, lifaces = _cable_device("xss-local", [("eth0", 100)])
+        xss = '<script>alert("xss")</script>'
 
-@pytest.mark.django_db
-class TestCablesGetRenderDegradesOnBrokenDefaultServer:
-    """A cached cables GET must degrade cleanly when the default LibreNMS server is misconfigured, not 500 on the lazy LibreNMSAPI() construction."""
-
-    def test_cached_render_does_not_500_when_default_server_build_fails(self):
-        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
-        from django.contrib.auth import get_user_model
-        from django.core.cache import cache
-        from django.test import RequestFactory
-
-        from netbox_librenms_plugin.views.object_sync.devices import DeviceCableTableView
-
-        tag = "cables-broken-srv"
-        mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-{tag}", slug=f"mfr-{tag}")
-        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-{tag}", slug=f"dt-{tag}")
-        role, _ = DeviceRole.objects.get_or_create(name=f"Role-{tag}", slug=f"role-{tag}")
-        site, _ = Site.objects.get_or_create(name=f"Site-{tag}", slug=f"site-{tag}")
-        device = Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
-        view = DeviceCableTableView()
-        request = RequestFactory().get("/")
-        User = get_user_model()
-        request.user = User.objects.filter(is_superuser=True, is_active=True).first() or User.objects.create(
-            username="cables-su", is_superuser=True, is_active=True
+        view, request = _cable_view_and_request(
+            "xsslocal", {"device_id": local.pk, "local_port_id": 100, "server_key": SERVER_KEY}
         )
-        view.request = request
-
-        # Seed the links cache under the DEGRADED (None) server_key — what the broken-server render reads.
-        key = view.get_cache_key(device, "links", None)
-        cache.set(
-            key,
-            {"links": [{"local_port": "Gi0/1", "local_port_id": "1", "remote_device": None}]},
-            timeout=300,
+        content = _post_with_links(
+            view,
+            request,
+            local,
+            [
+                {
+                    "local_port": xss,  # interface still resolves by librenms_id below
+                    "local_port_id": 100,
+                    "remote_port": "eth1",
+                    "remote_port_id": 200,
+                    "remote_device": "",
+                    "remote_device_id": None,
+                }
+            ],
         )
 
-        def broken_cfg(_plugin, cfg_key, *args, **kwargs):
-            # A non-empty 'servers' with no 'default' and no valid dict entry makes LibreNMSAPI()
-            # raise ValueError in its constructor — the exact broken-default-server condition.
-            return {"alpha": "not-a-dict"} if cfg_key == "servers" else None
-
-        try:
-            with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", side_effect=broken_cfg):
-                context = view.get_context_data(request, device)
-            # Degrades: the cached links still render (server_key falls back to None) instead of a 500.
-            assert context is not None
-            assert context["table"] is not None
-            assert context["server_key"] is None
-        finally:
-            cache.delete(key)
+        local_port_html = content["formatted_row"]["local_port"]
+        assert "<script>" not in local_port_html
+        assert "&lt;script&gt;" in local_port_html
 
+    def test_xss_in_remote_device_name_escaped(self):
+        """A malicious remote_device name (unresolvable in NetBox) must be escaped in the HTML output."""
+        local, lifaces = _cable_device("xss-remote", [("eth0", 100)])
+        xss_device = "<img src=x onerror=alert(1)>"
 
-@pytest.mark.django_db
-class TestSingleCableVerifyMisconfiguredDefault:
-    """SingleCableVerifyView resolves configured servers via the classmethod, not the raising instance property."""
-
-    def test_configured_key_does_not_500_when_default_broken(self):
-        """A configured 'prod' key resolves without constructing the broken default client (issue #108/#109)."""
-        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
-        from django.test import RequestFactory, override_settings
-
-        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
-
-        mfr, _ = Manufacturer.objects.get_or_create(name="Mfr-scv", slug="mfr-scv")
-        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-scv", slug="dt-scv")
-        role, _ = DeviceRole.objects.get_or_create(name="Role-scv", slug="role-scv")
-        site, _ = Site.objects.get_or_create(name="Site-scv", slug="site-scv")
-        device = Device.objects.create(name="host-scv", device_type=dt, role=role, site=site, status="active")
-
-        view = object.__new__(SingleCableVerifyView)
-        view._librenms_api = None  # live property: accessing it would build LibreNMSAPI() (default)
-        view.require_object_permissions_json = MagicMock(return_value=None)
-
-        # DEFAULT present-but-broken (no url/token) → LibreNMSAPI() raises; get_available_servers()={'prod'}.
-        cfg = {
-            "netbox_librenms_plugin": {
-                "servers": {
-                    "prod": {"librenms_url": "http://prod.example", "api_token": "tok"},
-                    "default": {},
+        view, request = _cable_view_and_request(
+            "xssremote", {"device_id": local.pk, "local_port_id": 100, "server_key": SERVER_KEY}
+        )
+        content = _post_with_links(
+            view,
+            request,
+            local,
+            [
+                {
+                    "local_port": "eth0",
+                    "local_port_id": 100,
+                    "remote_port": "eth1",
+                    "remote_port_id": 200,
+                    "remote_device": xss_device,  # no NetBox device by this name → escaped as text
+                    "remote_device_id": None,
                 }
-            }
-        }
-        request = RequestFactory().post(
-            "/verify/",
-            data=json.dumps({"device_id": device.pk, "local_port_id": "1", "server_key": "prod"}),
-            content_type="application/json",
+            ],
         )
-        # RequestFactory skips AuthenticationMiddleware; the object-scoped device lookup reads
-        # request.user, so attach a real superuser (this test is about server-key degradation, not
-        # object scope).
-        from django.contrib.auth import get_user_model
-
-        request.user = get_user_model().objects.create_user(username="scv-user", password="x", is_superuser=True)
-        view.request = request  # dispatch() normally wires this; the object-scoped lookup reads self.request.user
-        with override_settings(PLUGINS_CONFIG=cfg):
-            response = view.post(request)
 
-        assert response.status_code == 200
-        assert json.loads(response.content)["status"] == "success"
+        remote_device_html = content["formatted_row"]["remote_device"]
+        assert "<img " not in remote_device_html
+        assert "&lt;img" in remote_device_html
diff --git a/netbox_librenms_plugin/tests/test_coverage_base_views2.py b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
index b2d22f0a97..5435e91921 100644
--- a/netbox_librenms_plugin/tests/test_coverage_base_views2.py
+++ b/netbox_librenms_plugin/tests/test_coverage_base_views2.py
@@ -41,6 +41,33 @@ def _mock_request(path="/plugins/librenms/device/1/cables/"):
     return req
 
 
+def _authorized_superuser(tag):
+    """A real superuser so the object-perm gate passes and restrict() resolves the real device."""
+    from django.contrib.auth import get_user_model
+
+    return get_user_model().objects.create_superuser(username=f"cbv2-{tag}", email="", password="x")
+
+
+def _real_cable_device(tag, *, vc=False, bound_port_id=None, iface_name="Gi0/0"):
+    """A real Device for cable-verify post() tests; optionally in a VC and/or with a librenms-id-bound interface."""
+    from dcim.models import Device, DeviceRole, DeviceType, Interface, Manufacturer, Site, VirtualChassis
+
+    mfr, _ = Manufacturer.objects.get_or_create(name=f"Cbv2Mfr-{tag}", slug=f"cbv2mfr-{tag}")
+    dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"Cbv2DT-{tag}", slug=f"cbv2dt-{tag}")
+    role, _ = DeviceRole.objects.get_or_create(name="Cbv2Role", slug="cbv2role")
+    site, _ = Site.objects.get_or_create(name="Cbv2Site", slug="cbv2site")
+    extra = {}
+    if vc:
+        extra["virtual_chassis"] = VirtualChassis.objects.create(name=f"Cbv2VC-{tag}")
+        extra["vc_position"] = 1
+    device = Device.objects.create(name=f"cbv2-{tag}", device_type=dt, role=role, site=site, status="active", **extra)
+    if bound_port_id is not None:
+        iface = Interface.objects.create(device=device, name=iface_name, type="1000base-t")
+        iface.custom_field_data = {"librenms_id": {"default": bound_port_id}}
+        iface.save()
+    return device
+
+
 # =============================================================================
 # TestLibreNMSIdQ  — _librenms_id_q edge cases
 # =============================================================================
@@ -687,20 +714,18 @@ def _make_view(self):
         view.request.user.has_perm.return_value = True
         return view
 
+    @pytest.mark.django_db
     def test_unconfigured_posted_server_key_falls_back_to_session(self):
         """A posted server_key naming no configured server must not scope the links cache / _librenms_id_q ORM lookups — fall back to the active server."""
         import json
 
         view = self._make_view()
+        view.request.user = _authorized_superuser("srvkey")
         view._librenms_api.server_key = "good"
-        view._librenms_api.get_available_servers.return_value = {"good": "Good"}
+        device = _real_cable_device("srvkey")  # non-VC → primary_device = selected_device
 
         mock_request = MagicMock()
-        mock_request.body = json.dumps({"device_id": 1, "local_port_id": 10, "server_key": "ghost"}).encode()
-
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None  # non-VC → primary_device = selected_device
-        mock_device.id = 1
+        mock_request.body = json.dumps({"device_id": device.pk, "local_port_id": 10, "server_key": "ghost"}).encode()
 
         captured = {}
 
@@ -709,9 +734,10 @@ def fake_cache_key(dev, kind, sk):
             return "ck"
 
         with (
+            # "ghost" is not configured → the view must fall back to the active-server key.
             patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"good": "Good"},
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", side_effect=fake_cache_key),
@@ -721,25 +747,24 @@ def fake_cache_key(dev, kind, sk):
 
         assert captured["server_key"] == "good"  # "ghost" is unconfigured → session key used
 
+    @pytest.mark.django_db
     def test_vc_member_resolution_calls_get_virtual_chassis_member(self):
         """VC device → get_virtual_chassis_member called with device and local_port."""
         import json
 
         view = self._make_view()
+        view.request.user = _authorized_superuser("vcmember")
+        device = _real_cable_device("vcmember", vc=True)  # real VC device
 
         mock_request = MagicMock()
         mock_request.body = json.dumps(
             {
-                "device_id": 1,
+                "device_id": device.pk,
                 "local_port_id": 10,
                 "server_key": "default",
             }
         ).encode()
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = MagicMock()  # truthy
-        mock_device.id = 1
-
         mock_member = MagicMock()
         mock_interface = MagicMock()
         mock_interface.pk = 99
@@ -760,13 +785,9 @@ def test_vc_member_resolution_calls_get_virtual_chassis_member(self):
         }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
-            ),
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                return_value=device,
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test-key"),
@@ -801,7 +822,7 @@ def test_vc_member_resolution_calls_get_virtual_chassis_member(self):
             mock_cache.get.return_value = cached_links
             view.post(mock_request)
 
-        mock_vc.assert_called_once_with(mock_device, "Gi0/0")
+        mock_vc.assert_called_once_with(device, "Gi0/0")
         # Verify server_key is forwarded to process_remote_device
         assert mock_process_remote.called
         call_kwargs = mock_process_remote.call_args[1]
@@ -828,27 +849,24 @@ def _make_view(self):
         view.request.user.has_perm.return_value = True
         return view
 
+    @pytest.mark.django_db
     def test_interface_not_found_fills_formatted_row(self):
         """When no local interface found, formatted_row reflects missing interface."""
         import json as json_mod
 
         view = self._make_view()
+        view.request.user = _authorized_superuser("ifnotfound")
+        device = _real_cable_device("ifnotfound")  # non-VC, no interfaces → local lookup returns None
 
         mock_request = MagicMock()
         mock_request.body = json_mod.dumps(
             {
-                "device_id": 1,
+                "device_id": device.pk,
                 "local_port_id": 10,
                 "server_key": "default",
             }
         ).encode()
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None  # non-VC
-        mock_device.id = 1
-        # Both interface lookups return None
-        mock_device.interfaces.filter.return_value.first.return_value = None
-
         cached_links = {
             "links": [
                 {
@@ -874,13 +892,9 @@ def test_interface_not_found_fills_formatted_row(self):
         }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
-            ),
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                return_value=device,
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test-key"),
@@ -902,30 +916,24 @@ def test_interface_not_found_fills_formatted_row(self):
         assert row["local_port"] == "Gi0/0"
         assert "cable_status" in row
 
+    @pytest.mark.django_db
     def test_cable_url_present_wraps_cable_status_in_anchor(self):
         """When cable_url is in link_data, cable_status is wrapped in an <a> tag (line 514)."""
         import json as json_mod
 
         view = self._make_view()
+        view.request.user = _authorized_superuser("cableurl")
+        device = _real_cable_device("cableurl", bound_port_id=10)  # local interface bound to librenms id 10
 
         mock_request = MagicMock()
         mock_request.body = json_mod.dumps(
             {
-                "device_id": 1,
+                "device_id": device.pk,
                 "local_port_id": 10,
                 "server_key": "default",
             }
         ).encode()
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
-        mock_device.id = 1
-
-        mock_interface = MagicMock()
-        mock_interface.pk = 99
-        # librenms_id lookup returns the interface; name lookup not needed
-        mock_device.interfaces.filter.return_value.first.side_effect = [mock_interface, None]
-
         cached_links = {
             "links": [
                 {
@@ -955,13 +963,9 @@ def test_cable_url_present_wraps_cable_status_in_anchor(self):
         }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
-            ),
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                return_value=device,
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test-key"),
@@ -1937,29 +1941,24 @@ def _make_view(self):
         view.request.user.has_perm.return_value = True
         return view
 
+    @pytest.mark.django_db
     def test_can_create_cable_adds_form_action(self):
         """can_create_cable=True → formatted_row['actions'] contains form."""
         import json as json_mod
 
         view = self._make_view()
+        view.request.user = _authorized_superuser("cancreate")
+        device = _real_cable_device("cancreate", bound_port_id=10)  # local interface bound to librenms id 10
 
         mock_request = MagicMock()
         mock_request.body = json_mod.dumps(
             {
-                "device_id": 1,
+                "device_id": device.pk,
                 "local_port_id": 10,
                 "server_key": "default",
             }
         ).encode()
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
-        mock_device.id = 1
-
-        mock_interface = MagicMock()
-        mock_interface.pk = 99
-        mock_device.interfaces.filter.return_value.first.side_effect = [mock_interface, None]
-
         cached_links = {
             "links": [
                 {
@@ -1988,13 +1987,9 @@ def test_can_create_cable_adds_form_action(self):
         }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
-            ),
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                return_value=device,
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test-key"),
@@ -2049,23 +2044,21 @@ def _make_view(self):
         return view
 
     def _run_post(self, view, process_result):
-        """Helper: run the post with a given process_result dict."""
+        """Helper: run the post against a real non-VC device (no interface) with a given process_result dict."""
         import json as json_mod
 
+        view.request.user = _authorized_superuser("notfoundbranch")
+        device = _real_cable_device("notfoundbranch")  # non-VC, no interface → local lookup returns None
+
         mock_request = MagicMock()
         mock_request.body = json_mod.dumps(
             {
-                "device_id": 1,
+                "device_id": device.pk,
                 "local_port_id": 10,
                 "server_key": "default",
             }
         ).encode()
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
-        mock_device.id = 1
-        mock_device.interfaces.filter.return_value.first.return_value = None  # no interface
-
         cached_links = {
             "links": [
                 {
@@ -2080,13 +2073,9 @@ def _run_post(self, view, process_result):
         }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404",
-                return_value=mock_device,
-            ),
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                return_value=device,
             ),
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
             patch.object(view, "get_cache_key", return_value="test-key"),
@@ -2103,6 +2092,7 @@ def _run_post(self, view, process_result):
 
         return json_mod2.loads(response.content)
 
+    @pytest.mark.django_db
     def test_no_remote_device_url_sets_device_not_found(self):
         """remote_device present, no remote_device_url → 'Device Not Found in NetBox' (line 554)."""
         view = self._make_view()
@@ -2120,6 +2110,7 @@ def test_no_remote_device_url_sets_device_not_found(self):
         assert data["status"] == "success"
         assert data["formatted_row"]["cable_status"] == "Device Not Found in NetBox"
 
+    @pytest.mark.django_db
     def test_device_url_but_no_port_url_sets_missing_interface(self):
         """remote_device_url present, no remote_port_url → 'Missing Interface' (line 559)."""
         view = self._make_view()
diff --git a/netbox_librenms_plugin/tests/test_coverage_devices.py b/netbox_librenms_plugin/tests/test_coverage_devices.py
index f72f91d329..ab69029b08 100644
--- a/netbox_librenms_plugin/tests/test_coverage_devices.py
+++ b/netbox_librenms_plugin/tests/test_coverage_devices.py
@@ -23,6 +23,62 @@ def _make_verify_superuser(tag):
     return get_user_model().objects.create_superuser(username=f"verify-su-{tag}", email="", password="x")
 
 
+def _real_verify_request(body, tag):
+    """A real POST request wired with a real superuser (so the object-perm gate + restrict() resolve for real)."""
+    import json as _json
+
+    from django.test import RequestFactory
+
+    request = RequestFactory().post("/verify/", data=_json.dumps(body), content_type="application/json")
+    request.user = _make_verify_superuser(tag)
+    return request
+
+
+def _configured_default():
+    """Patch context declaring 'default' as a configured LibreNMS server so a POSTed server_key resolves."""
+    from unittest.mock import patch
+
+    return patch(
+        "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+        return_value={"default": "Default"},
+    )
+
+
+def _real_port(**overrides):
+    """A LibreNMS-shaped port dict with every field LibreNMSInterfaceTable.format_interface_data reads."""
+    port = {
+        "ifName": "eth0",
+        "ifDescr": "eth0",
+        "ifAlias": "",
+        "ifType": "ethernetCsmacd",
+        "ifSpeed": 1000000000,
+        "ifPhysAddress": "00:11:22:33:44:55",
+        "ifMtu": 1500,
+        "ifAdminStatus": "up",
+        "ifOperStatus": "up",
+    }
+    port.update(overrides)
+    return port
+
+
+def _user_with_perms(tag, perm_specs):
+    """Real user granted exactly ``perm_specs`` = [(action, Model), ...] via NetBox ObjectPermissions.
+
+    Lets a test drive the view's real ``has_perm`` from a precise, real permission set (instead of a
+    mocked ``has_perm`` side-effect), so the perm→table-flag mapping is exercised end to end.
+    """
+    from core.models import ObjectType
+    from django.contrib.auth import get_user_model
+    from users.models import ObjectPermission
+
+    user = get_user_model().objects.create_user(username=f"perms-{tag}", password="x")
+    for i, (action, model) in enumerate(perm_specs):
+        op = ObjectPermission.objects.create(name=f"{tag}-{action}-{i}", actions=[action])
+        op.object_types.set([ObjectType.objects.get_for_model(model)])
+        op.users.set([user])
+    return get_user_model().objects.get(pk=user.pk)  # clear the per-request perm cache
+
+
 def _make_device_view():
     """Create a DeviceLibreNMSSyncView instance bypassing __init__."""
     from netbox_librenms_plugin.views.object_sync.devices import DeviceLibreNMSSyncView
@@ -291,98 +347,90 @@ def test_checks_permission_before_resolving_device(self):
         assert response.status_code == 403
         mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
 
+    @pytest.mark.django_db
     def test_returns_404_when_no_cached_data(self):
-        """Returns 404 when cached ports data not found."""
-        import json
-
+        """Returns 404 when no cached ports exist for the (real) device."""
+        from django.core.cache import cache as real_cache
         from django.http import JsonResponse
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "interface_name": "eth0"}).encode()
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
+        device = _make_real_device("iface-nocache")
+        view = SingleInterfaceVerifyView()
+        request = _real_verify_request(
+            {"device_id": device.pk, "interface_name": "eth0", "server_key": "default"}, "iface-nocache"
+        )
+        view.request = request
 
-        with patch(
-            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-            return_value=mock_device,
-        ):
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
-            ):
-                with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                    mock_cache.get.return_value = None
-                    with patch.object(view, "get_cache_key", return_value="test_key"):
-                        response = view.post(request)
+        real_cache.delete(view.get_cache_key(device, "ports", "default"))
+        with _configured_default():
+            response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 404
 
+    @pytest.mark.django_db
     def test_returns_404_when_interface_not_in_cache(self):
-        """Returns 404 when interface not found in cached ports data."""
-        import json
-
+        """Returns 404 when the requested interface isn't among the real cached ports."""
+        from django.core.cache import cache as real_cache
         from django.http import JsonResponse
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "interface_name": "eth99"}).encode()
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
+        device = _make_real_device("iface-miss")
+        view = SingleInterfaceVerifyView()
+        request = _real_verify_request(
+            {
+                "device_id": device.pk,
+                "interface_name": "eth99",
+                "interface_name_field": "ifName",
+                "server_key": "default",
+            },
+            "iface-miss",
+        )
+        view.request = request
 
-        cached_data = {"ports": [{"ifName": "eth0", "speed": 1000}]}
-
-        with patch(
-            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-            return_value=mock_device,
-        ):
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
-            ):
-                with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                    mock_cache.get.return_value = cached_data
-                    with patch.object(view, "get_cache_key", return_value="test_key"):
-                        response = view.post(request)
+        key = view.get_cache_key(device, "ports", "default")
+        real_cache.set(key, {"ports": [{"ifName": "eth0", "speed": 1000}]})
+        try:
+            with _configured_default():
+                response = view.post(request)
+        finally:
+            real_cache.delete(key)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 404
 
+    @pytest.mark.django_db
     def test_returns_success_when_interface_found(self):
-        """Returns success JSON with formatted_row when interface found in cache."""
+        """Returns success + formatted_row when the interface is in cache (real device, real cache, real table)."""
         import json
 
+        from django.core.cache import cache as real_cache
         from django.http import JsonResponse
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "interface_name": "eth0", "interface_name_field": "ifName"}).encode()
-
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
-
-        port_data = {"ifName": "eth0", "speed": 1000}
-        cached_data = {"ports": [port_data]}
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
-        mock_table = MagicMock()
-        mock_table.format_interface_data.return_value = "<tr>row</tr>"
+        device = _make_real_device("iface-hit")
+        view = SingleInterfaceVerifyView()
+        request = _real_verify_request(
+            {
+                "device_id": device.pk,
+                "interface_name": "eth0",
+                "interface_name_field": "ifName",
+                "server_key": "default",
+            },
+            "iface-hit",
+        )
+        view.request = request
 
-        with patch(
-            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-            return_value=mock_device,
-        ):
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
-            ):
-                with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                    mock_cache.get.return_value = cached_data
-                    with patch.object(view, "get_cache_key", return_value="test_key"):
-                        with patch(
-                            "netbox_librenms_plugin.views.object_sync.devices.LibreNMSInterfaceTable",
-                            return_value=mock_table,
-                        ):
-                            response = view.post(request)
+        key = view.get_cache_key(device, "ports", "default")
+        real_cache.set(key, {"ports": [_real_port()]})
+        try:
+            with _configured_default():
+                response = view.post(request)
+        finally:
+            real_cache.delete(key)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
@@ -390,45 +438,45 @@ def test_returns_success_when_interface_found(self):
         assert data["status"] == "success"
         assert "formatted_row" in data
 
-    def test_non_vc_device_skips_sync_device_lookup(self):
-        """For non-VC devices, get_librenms_sync_device is not called; selected_device used directly."""
-        import json
+    @pytest.mark.django_db
+    def test_non_vc_device_uses_own_cache_key_no_sync_lookup(self):
+        """A non-VC device is used directly: its own cache key hits and get_librenms_sync_device never runs."""
+        from unittest.mock import patch
 
+        from django.core.cache import cache as real_cache
         from django.http import JsonResponse
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "interface_name": "eth0", "interface_name_field": "ifName"}).encode()
+        from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
-        mock_device = MagicMock()
-        mock_device.virtual_chassis = None
-        port_data = {"ifName": "eth0", "speed": 1000}
-        cached_data = {"ports": [port_data]}
-        mock_table = MagicMock()
-        mock_table.format_interface_data.return_value = "<tr>row</tr>"
+        device = _make_real_device("iface-nonvc")  # no virtual_chassis
+        view = SingleInterfaceVerifyView()
+        request = _real_verify_request(
+            {
+                "device_id": device.pk,
+                "interface_name": "eth0",
+                "interface_name_field": "ifName",
+                "server_key": "default",
+            },
+            "iface-nonvc",
+        )
+        view.request = request
 
-        with patch(
-            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-            return_value=mock_device,
-        ):
-            with patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=None
-            ) as mock_get_sync_device:
-                with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                    mock_cache.get.return_value = cached_data
-                    with patch.object(view, "get_cache_key", return_value="test_key") as get_cache_key_mock:
-                        with patch(
-                            "netbox_librenms_plugin.views.object_sync.devices.LibreNMSInterfaceTable",
-                            return_value=mock_table,
-                        ):
-                            response = view.post(request)
+        key = view.get_cache_key(device, "ports", "default")  # keyed on the device itself
+        real_cache.set(key, {"ports": [_real_port()]})
+        try:
+            with (
+                _configured_default(),
+                patch(
+                    "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device",
+                    side_effect=AssertionError("get_librenms_sync_device must not run for a non-VC device"),
+                ),
+            ):
+                response = view.post(request)
+        finally:
+            real_cache.delete(key)
 
         assert isinstance(response, JsonResponse)
-        assert response.status_code == 200
-        # Non-VC device: get_librenms_sync_device should NOT be called
-        mock_get_sync_device.assert_not_called()
-        # The cache key builder was called with mock_device directly
-        assert get_cache_key_mock.call_args[0][0] is mock_device
+        assert response.status_code == 200  # cache hit under the device's OWN key proves it was used directly
 
 
 class TestSingleModuleVerifyView:
@@ -466,47 +514,69 @@ def test_checks_permission_before_resolving_device(self):
         assert response.status_code == 403
         mock_get_obj.assert_not_called()  # device never resolved → no arbitrary-ID probing
 
+    @pytest.mark.django_db
     def test_success_propagates_can_change_interface_to_verify_table(self):
-        """Verify-row table keeps Update Interface available for users with change permission."""
+        """Verify-row table keeps Update Interface available for a user with real change perms.
+
+        Device is resolved through the real restrict() lookup and every table flag is driven by the
+        view's REAL ``has_perm`` against a precise NetBox permission grant — only the module-inventory
+        pipeline / table render (a separate rendering boundary) stays stubbed.
+        """
         import json
 
+        from dcim.models import Interface, Module, ModuleBayTemplate, ModuleType
+        from django.apps import apps
         from django.http import JsonResponse
+        from django.test import RequestFactory
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "ent_physical_index": 10, "server_key": "default"}).encode()
-        request.user.has_perm = MagicMock(
-            side_effect=lambda perm: (
-                perm
-                in {
-                    "dcim.add_module",
-                    "dcim.change_module",
-                    "dcim.change_interface",
-                    "dcim.delete_module",
-                    "dcim.add_modulebaytemplate",
-                    "dcim.add_moduletype",
-                    "netbox_librenms_plugin.add_carrierautoinstallrule",
-                    "netbox_librenms_plugin.add_modulebaymapping",
-                    "netbox_librenms_plugin.add_moduletypemapping",
-                }
-            )
+        from netbox_librenms_plugin.models import (
+            CarrierAutoInstallRule,
+            ModuleBayMapping,
+            ModuleTypeMapping,
+        )
+        from netbox_librenms_plugin.views.object_sync.devices import SingleModuleVerifyView
+
+        # Resolve via the app registry, not the module attribute: the autouse mock_librenms_config
+        # fixture patches netbox_librenms_plugin.models.LibreNMSSettings to a MagicMock in the full
+        # suite, which would otherwise break ObjectType.get_for_model() in _user_with_perms.
+        LibreNMSSettings = apps.get_model("netbox_librenms_plugin", "LibreNMSSettings")
+
+        device = _make_real_device("mod-canchange")  # non-VC real device (with real device_type/manufacturer)
+        user = _user_with_perms(
+            "mod-canchange",
+            [
+                ("view", type(device)),  # dcim.Device — object-perm gate + restrict
+                ("change", LibreNMSSettings),  # plugin write (has_write_permission)
+                ("add", Module),
+                ("change", Module),
+                ("delete", Module),
+                ("change", Interface),
+                ("add", ModuleBayTemplate),
+                ("add", ModuleType),
+                ("add", CarrierAutoInstallRule),
+                ("add", ModuleBayMapping),
+                ("add", ModuleTypeMapping),
+            ],
         )
 
-        selected_device = MagicMock()
-        selected_device.virtual_chassis = None
-        selected_device.device_type = MagicMock()
-        selected_device.device_type.manufacturer = MagicMock()
+        view = SingleModuleVerifyView()
+        request = RequestFactory().post(
+            "/verify-module/",
+            data=json.dumps({"device_id": device.pk, "ent_physical_index": 10, "server_key": "default"}),
+            content_type="application/json",
+        )
+        request.user = user
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+
         inventory_data = [{"entPhysicalIndex": 10, "entPhysicalContainedIn": 0, "entPhysicalName": "Module 1"}]
         row = {"ent_physical_index": 10, "depth": 0, "status": "Installed"}
-
         mock_table = MagicMock()
         mock_table.format_module_data.return_value = "<tr>row</tr>"
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=selected_device,
-            ),
+            _configured_default(),
             patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache,
             patch("netbox_librenms_plugin.utils.load_bay_mappings", return_value=([], [])),
             patch("netbox_librenms_plugin.utils.get_enabled_ignore_rules", return_value=[]),
@@ -542,7 +612,7 @@ def test_success_propagates_can_change_interface_to_verify_table(self):
         assert response.status_code == 200
         mock_table_cls.assert_called_once_with(
             [],
-            device=selected_device,
+            device=device,
             server_key="default",
             has_write_permission=True,
             can_add_module=True,
@@ -620,21 +690,21 @@ def test_returns_400_when_no_vid(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
     def test_returns_400_when_invalid_vid(self):
-        """Returns 400 when vid is not a valid integer."""
-        import json
-
+        """Returns 400 when vid is not a valid integer (real device resolved through restrict())."""
         from django.http import JsonResponse
 
-        view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "vid": "notanumber"}).encode()
+        from netbox_librenms_plugin.views.object_sync.devices import SingleVlanGroupVerifyView
 
-        mock_device = MagicMock()
-        with patch(
-            "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-            return_value=mock_device,
-        ):
+        device = _make_real_device("vg-invalid-vid")
+        view = SingleVlanGroupVerifyView()
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid": "notanumber", "server_key": "default"}, "vg-invalid-vid"
+        )
+        view.request = request
+
+        with _configured_default():
             response = view.post(request)
 
         assert isinstance(response, JsonResponse)
@@ -879,92 +949,82 @@ def test_requires_write_permission(self):
 
         assert result is error_response
 
+    @pytest.mark.django_db
     def test_returns_error_when_no_cached_ports(self):
-        """Returns 400 when ports cache TTL is zero (no cached data)."""
-        import json
-
+        """Returns 400 when ports cache TTL is zero (real device + real write-gate/restrict)."""
         from django.http import JsonResponse
 
+        device = _make_real_device("ovr-nocache")
         view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "vid_group_map": {"10": "5"}}).encode()
-
-        mock_device = MagicMock()
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid_group_map": {"10": "5"}, "server_key": "default"}, "ovr-nocache"
+        )
+        view.request = request
 
-        with patch.object(view, "require_write_permission_json", return_value=None):
-            with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device",
-                    return_value=mock_device,
-                ):
-                    with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                        mock_cache.ttl.return_value = 0
-                        with patch.object(view, "get_cache_key", return_value="ports_key"):
-                            response = view.post(request)
+        with (
+            _configured_default(),
+            patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=device),
+            patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache,
+            patch.object(view, "get_cache_key", return_value="ports_key"),
+        ):
+            mock_cache.ttl.return_value = 0
+            response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
     def test_post_does_not_500_on_cache_backend_without_ttl(self):
-        """A cache backend without .ttl() (e.g. the default LocMemCache) must degrade gracefully, not AttributeError-500."""
-        import json
+        """A cache backend without .ttl() (a REAL LocMemCache) degrades gracefully, not AttributeError-500."""
         from django.core.cache.backends.locmem import LocMemCache
         from django.http import JsonResponse
 
+        device = _make_real_device("ovr-nottl")
         view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "vid_group_map": {"10": "5"}, "server_key": "default"}).encode()
-        mock_device = MagicMock()
-        # A REAL LocMemCache genuinely has no .ttl() — unlike the MagicMock cache other tests use,
-        # which fabricates one and so masks this exact AttributeError.
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid_group_map": {"10": "5"}, "server_key": "default"}, "ovr-nottl"
+        )
+        view.request = request
+        # A REAL LocMemCache genuinely has no .ttl() — unlike a MagicMock cache, which fabricates one
+        # and so masks this exact AttributeError.
         real_locmem = LocMemCache("test-no-ttl", {})
 
         with (
-            patch.object(view, "require_write_permission_json", return_value=None),
-            patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device),
-            patch(
-                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device",
-                return_value=mock_device,
-            ),
+            _configured_default(),
+            patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=device),
             patch("netbox_librenms_plugin.views.object_sync.devices.cache", real_locmem),
             patch.object(view, "get_cache_key", return_value="ports_key"),
         ):
             response = view.post(request)  # must not raise AttributeError
 
-        # No ttl available → treated as "no cached ports" → graceful 400, never a 500.
+        # No ttl available -> treated as "no cached ports" -> graceful 400, never a 500.
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
     def test_saves_overrides_to_cache(self):
-        """Successfully saves VLAN group overrides to cache."""
+        """Successfully saves VLAN group overrides to cache (real device + real write-gate/restrict)."""
         import json
 
         from django.http import JsonResponse
 
+        device = _make_real_device("ovr-save")
         view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "vid_group_map": {"10": "5", "20": "5"},
-                "server_key": "default",
-            }
-        ).encode()
-
-        mock_device = MagicMock()
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid_group_map": {"10": "5", "20": "5"}, "server_key": "default"}, "ovr-save"
+        )
+        view.request = request
 
-        with patch.object(view, "require_write_permission_json", return_value=None):
-            with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device",
-                    return_value=mock_device,
-                ):
-                    with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                        mock_cache.ttl.return_value = 300
-                        mock_cache.get.return_value = {}
-                        with patch.object(view, "get_cache_key", return_value="ports_key"):
-                            with patch.object(view, "get_vlan_overrides_key", return_value="vlan_overrides_key"):
-                                response = view.post(request)
+        with (
+            _configured_default(),
+            patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=device),
+            patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache,
+            patch.object(view, "get_cache_key", return_value="ports_key"),
+            patch.object(view, "get_vlan_overrides_key", return_value="vlan_overrides_key"),
+        ):
+            mock_cache.ttl.return_value = 300
+            mock_cache.get.return_value = {}
+            response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
@@ -972,34 +1032,36 @@ def test_saves_overrides_to_cache(self):
         assert data["status"] == "success"
         mock_cache.set.assert_called_once()
 
+    @pytest.mark.django_db
     def test_save_overrides_uses_device_when_sync_device_none(self):
-        """If VC sync-device resolution fails, fallback uses original device."""
-        import json
-
+        """If VC sync-device resolution fails, fallback uses the (real) selected device."""
         from django.http import JsonResponse
 
+        device = _make_real_device("ovr-syncnone")
         view = self._make_view()
-        request = MagicMock()
-        request.body = json.dumps({"device_id": 1, "vid_group_map": {"10": "5"}, "server_key": "default"}).encode()
-        mock_device = MagicMock()
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid_group_map": {"10": "5"}, "server_key": "default"}, "ovr-syncnone"
+        )
+        view.request = request
 
-        with patch.object(view, "require_write_permission_json", return_value=None):
-            with patch("netbox_librenms_plugin.views.object_sync.devices.get_object_or_404", return_value=mock_device):
-                with patch(
-                    "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=None
-                ) as mock_get_sync_device:
-                    with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
-                        mock_cache.ttl.return_value = 300
-                        mock_cache.get.return_value = {}
-                        with patch.object(view, "get_cache_key", return_value="ports_key"):
-                            with patch.object(view, "get_vlan_overrides_key", return_value="vlan_overrides_key"):
-                                response = view.post(request)
+        with (
+            _configured_default(),
+            patch(
+                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=None
+            ) as mock_get_sync_device,
+            patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache,
+            patch.object(view, "get_cache_key", return_value="ports_key"),
+            patch.object(view, "get_vlan_overrides_key", return_value="vlan_overrides_key"),
+        ):
+            mock_cache.ttl.return_value = 300
+            mock_cache.get.return_value = {}
+            response = view.post(request)
 
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200
-        # Verify fallback: get_librenms_sync_device was called with the selected device
+        # Fallback: get_librenms_sync_device was called with the selected (real) device.
         mock_get_sync_device.assert_called_once()
-        assert mock_get_sync_device.call_args[0][0] is mock_device
+        assert mock_get_sync_device.call_args[0][0].pk == device.pk
 
 
 class TestDeviceCableTableView:
diff --git a/netbox_librenms_plugin/tests/test_reviewer_fixes.py b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
index 7ea3ad784b..c530404e8e 100644
--- a/netbox_librenms_plugin/tests/test_reviewer_fixes.py
+++ b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
@@ -255,101 +255,98 @@ def test_default_pattern(self):
 # SingleCableVerifyView — server_key from POST body
 # ---------------------------------------------------------------------------
 class TestSingleCableVerifyServerKey:
-    """SingleCableVerifyView.post() must read server_key from POST body."""
+    """SingleCableVerifyView.post() must thread server_key from the POST body into VC resolution + cache key."""
 
-    def test_server_key_used_for_cache_lookup(self):
-        """The server_key from POST body is passed to get_cache_key and get_librenms_sync_device."""
+    @staticmethod
+    def _vc_device(tag):
+        """A real Device that belongs to a VirtualChassis (so post() takes the VC sync-resolution branch)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site, VirtualChassis
+
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"SkMfr-{tag}", slug=f"skmfr-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"SkDT-{tag}", slug=f"skdt-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name="SkRole", slug="skrole")
+        site, _ = Site.objects.get_or_create(name="SkSite", slug="sksite")
+        vc = VirtualChassis.objects.create(name=f"SkVC-{tag}")
+        return Device.objects.create(
+            name=f"sk-{tag}", device_type=dt, role=role, site=site, status="active", virtual_chassis=vc, vc_position=1
+        )
+
+    @staticmethod
+    def _view_and_request(device, body, *, api_server_key):
+        """Real view + real superuser request; _librenms_api is stubbed only to supply the active-server key."""
         import json
+        from unittest.mock import MagicMock
+
+        from django.contrib.auth import get_user_model
+        from django.test import RequestFactory
 
         from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
 
-        view = object.__new__(SingleCableVerifyView)
+        view = SingleCableVerifyView()
         view._librenms_api = MagicMock()
-        # dispatch() sets self.request in production; this direct post() call needs an authorized
-        # request for the object-permission gate (reads self.request.user.has_perm).
-        view.request = MagicMock()
-        view.request.user.has_perm.return_value = True
-        view._librenms_api.server_key = "default-server"
-
-        request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "local_port_id": "42",
-                "server_key": "production",
-            }
-        ).encode()
+        view._librenms_api.server_key = api_server_key  # config boundary: the active-server fallback
+        request = RequestFactory().post("/verify-cable/", data=json.dumps(body), content_type="application/json")
+        request.user = get_user_model().objects.create_superuser(username=f"sk-{device.pk}", email="", password="x")
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+        return view, request
 
-        mock_device = MagicMock()
+    @pytest.mark.django_db
+    def test_server_key_used_for_cache_lookup(self):
+        """The POSTed server_key is threaded into get_librenms_sync_device and the (real) cache key."""
+        from unittest.mock import patch
+
+        device = self._vc_device("used")
+        view, request = self._view_and_request(
+            device,
+            {"device_id": device.pk, "local_port_id": "42", "server_key": "production"},
+            api_server_key="default-server",
+        )
 
         with (
             # The posted key is honoured only when it names a configured server; post() checks the
-            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance) so it never builds a
-            # possibly-broken default client just to validate membership.
+            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance).
             patch(
                 "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
                 return_value={"production": "Production"},
             ),
             patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
-            ) as mock_get_obj,
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                return_value=mock_device,
+                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device
             ) as mock_sync_device,
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
         ):
-            mock_get_obj.return_value = mock_device
-            mock_cache.get.return_value = None  # No cached data
-
+            mock_cache.get.return_value = None  # no cached data -> early return once the key is built
             view.post(request)
 
-            # get_librenms_sync_device should be called with the posted server_key
-            mock_sync_device.assert_called_once_with(mock_device, server_key="production")
-            # cache lookup must also use the posted server_key (not the api default)
+            # get_librenms_sync_device gets the posted server_key (device compares by pk via Model.__eq__)
+            mock_sync_device.assert_called_once_with(device, server_key="production")
+            # the real cache key also carries the posted server_key (not the active default)
             cache_key_arg = mock_cache.get.call_args[0][0]
             assert "production" in cache_key_arg
 
+    @pytest.mark.django_db
     def test_fallback_to_api_server_key(self):
-        """When POST body has no server_key, falls back to self.librenms_api.server_key."""
-        import json
-
-        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+        """With no server_key in the POST body, post() falls back to the active-server key."""
+        from unittest.mock import patch
 
-        view = object.__new__(SingleCableVerifyView)
-        view._librenms_api = MagicMock()
-        # dispatch() sets self.request in production; this direct post() call needs an authorized
-        # request for the object-permission gate (reads self.request.user.has_perm).
-        view.request = MagicMock()
-        view.request.user.has_perm.return_value = True
-        view._librenms_api.server_key = "fallback-server"
-
-        request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "local_port_id": "42",
-            }
-        ).encode()
+        device = self._vc_device("fallback")
+        view, request = self._view_and_request(
+            device, {"device_id": device.pk, "local_port_id": "42"}, api_server_key="fallback-server"
+        )
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
-            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
                 side_effect=lambda dev, **kw: dev,
             ) as mock_sync_device,
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
         ):
-            mock_get_obj.return_value = MagicMock()
             mock_cache.get.return_value = None
-
             view.post(request)
 
             mock_sync_device.assert_called_once()
             assert mock_sync_device.call_args[1]["server_key"] == "fallback-server"
-            # cache lookup must also use the fallback server_key
             cache_key_arg = mock_cache.get.call_args[0][0]
             assert "fallback-server" in cache_key_arg
 
diff --git a/netbox_librenms_plugin/tests/test_verify_views.py b/netbox_librenms_plugin/tests/test_verify_views.py
index 94be074cd4..4c37402982 100644
--- a/netbox_librenms_plugin/tests/test_verify_views.py
+++ b/netbox_librenms_plugin/tests/test_verify_views.py
@@ -11,6 +11,9 @@
 import pytest
 from django.test import RequestFactory
 
+from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
+
 
 def _make_request(body: dict) -> MagicMock:
     """Create a mock POST request with JSON body."""
@@ -20,45 +23,64 @@ def _make_request(body: dict) -> MagicMock:
     return request
 
 
-def _make_vc_device(pk=1, name="vc-device"):
-    """Create a mock Device that belongs to a virtual chassis."""
-    device = MagicMock()
-    device.pk = pk
-    device.id = pk
-    device.name = name
-    device._meta.model_name = "device"
-    device.virtual_chassis = MagicMock()
-    device.interfaces.filter.return_value.first.return_value = None
+def _verify_superuser(tag):
+    """A real superuser so the object-perm gate passes and restrict() resolves the real device."""
+    from django.contrib.auth import get_user_model
+
+    return get_user_model().objects.create_superuser(username=f"vv-{tag}", email="", password="x")
+
+
+def _real_vc_device(tag, name=None):
+    """A real Device that belongs to a VirtualChassis (so post() takes the VC sync-resolution branch)."""
+    from dcim.models import VirtualChassis
+
+    device = _make_gate_device(name=name or f"vc-{tag}")
+    vc = VirtualChassis.objects.create(name=f"VV-VC-{tag}")
+    device.virtual_chassis = vc
+    device.vc_position = 1
+    device.save()
     return device
 
 
+def _real_verify_view(view_cls, body, user, *, server_key="default"):
+    """Build a real verify view + real request; _librenms_api is stubbed only to supply the active-server key."""
+    from django.test import RequestFactory
+
+    view = view_cls()
+    view._librenms_api = MagicMock()
+    view._librenms_api.server_key = server_key
+    request = RequestFactory().post("/verify/", data=json.dumps(body), content_type="application/json")
+    request.user = user
+    view.request = request
+    view.kwargs = {}
+    view.args = ()
+    return view, request
+
+
 # ---------------------------------------------------------------------------
 # SingleCableVerifyView
 # ---------------------------------------------------------------------------
 class TestSingleCableVerifyView:
-    """SingleCableVerifyView.post() VC resolution and None guard."""
+    """SingleCableVerifyView.post() VC resolution and None guard (real device, real gate/restrict)."""
 
     def _make_view(self):
         from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
 
         view = object.__new__(SingleCableVerifyView)
         view._librenms_api = MagicMock()
-        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
-        # gate; the gate itself is covered in test_coverage_base_views.py.
         view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
-    def test_vc_no_resolvable_sync_device_returns_empty_row(self, mock_cache, mock_sync, mock_get_obj):
-        """VC where get_librenms_sync_device returns None → empty row, no crash."""
-        device = _make_vc_device(pk=1)
-        mock_get_obj.return_value = device
+    def test_vc_no_resolvable_sync_device_returns_empty_row(self, mock_cache, mock_sync):
+        """VC where get_librenms_sync_device returns None -> empty row, no crash."""
+        device = _real_vc_device("cbl-nosync")
         mock_sync.return_value = None
-
-        view = self._make_view()
-        request = _make_request({"device_id": 1, "local_port_id": "42"})
+        view, request = _real_verify_view(
+            SingleCableVerifyView, {"device_id": device.pk, "local_port_id": "42"}, _verify_superuser("cbl-nosync")
+        )
         response = view.post(request)
 
         data = json.loads(response.content)
@@ -66,38 +88,36 @@ def test_vc_no_resolvable_sync_device_returns_empty_row(self, mock_cache, mock_s
         assert data["formatted_row"]["cable_status"] == "Missing Ports"
         mock_cache.get.assert_not_called()
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
-    def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_get_obj):
-        """VC with resolved sync device: cache is queried with that device's key."""
-        device = _make_vc_device(pk=1)
-        sync_device = _make_vc_device(pk=2, name="sync-device")
-        mock_get_obj.return_value = device
+    def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync):
+        """VC with a resolved sync device: cache is queried with that device's key."""
+        device = _real_vc_device("cbl-sync")
+        sync_device = _real_vc_device("cbl-syncmember", name="cbl-sync-member")
         mock_sync.return_value = sync_device
-        mock_cache.get.return_value = None  # No cached data
-
-        view = self._make_view()
-        request = _make_request({"device_id": 1, "local_port_id": "42"})
+        mock_cache.get.return_value = None
+        view, request = _real_verify_view(
+            SingleCableVerifyView, {"device_id": device.pk, "local_port_id": "42"}, _verify_superuser("cbl-sync")
+        )
         view.post(request)
 
         mock_sync.assert_called_once_with(device, server_key=view._librenms_api.server_key)
         mock_cache.get.assert_called_once()
         cache_key = mock_cache.get.call_args[0][0]
         assert "device" in cache_key
-        assert "2" in cache_key
+        assert str(sync_device.pk) in cache_key
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
-    def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
+    def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync):
         """Non-VC device: get_librenms_sync_device is NOT called."""
-        mock_netbox_device.virtual_chassis = None
-        mock_get_obj.return_value = mock_netbox_device
+        device = _make_gate_device(name="cbl-nonvc")
         mock_cache.get.return_value = None
-
-        view = self._make_view()
-        request = _make_request({"device_id": 5, "local_port_id": "10"})
+        view, request = _real_verify_view(
+            SingleCableVerifyView, {"device_id": device.pk, "local_port_id": "10"}, _verify_superuser("cbl-nonvc")
+        )
         view.post(request)
 
         mock_sync.assert_not_called()
@@ -113,18 +133,17 @@ def test_no_device_id_returns_empty_row(self):
         assert data["status"] == "success"
         assert data["formatted_row"]["cable_status"] == "Missing Ports"
 
-    @patch("netbox_librenms_plugin.views.base.cables_view.SingleCableVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.base.cables_view.cache")
-    def test_malformed_cached_links_fail_closed(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
+    def test_malformed_cached_links_fail_closed(self, mock_cache, mock_sync):
         """A corrupt cached links entry must fail closed (empty row + purge), not 500 the verify path."""
-        mock_netbox_device.virtual_chassis = None
-        mock_get_obj.return_value = mock_netbox_device
-        # A non-dict link row: the old code iterates it and calls str.get(...) → AttributeError.
+        device = _make_gate_device(name="cbl-malformed")
+        # A non-dict link row: the old code iterates it and calls str.get(...) -> AttributeError.
         mock_cache.get.return_value = {"links": ["not-a-dict"]}
-
-        view = self._make_view()
-        request = _make_request({"device_id": 5, "local_port_id": "10"})
+        view, request = _real_verify_view(
+            SingleCableVerifyView, {"device_id": device.pk, "local_port_id": "10"}, _verify_superuser("cbl-malformed")
+        )
         response = view.post(request)
 
         data = json.loads(response.content)
@@ -159,34 +178,27 @@ def test_extract_cached_links_fails_closed_and_purges_malformed_entries():
 # SingleInterfaceVerifyView
 # ---------------------------------------------------------------------------
 class TestSingleInterfaceVerifyView:
-    """SingleInterfaceVerifyView.post() VC resolution and None guard."""
+    """SingleInterfaceVerifyView.post() VC resolution and None guard (real device, real gate/restrict)."""
 
     def _make_view(self):
         from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
         view = object.__new__(SingleInterfaceVerifyView)
         view._librenms_api = MagicMock()
-        # Direct post() calls bypass dispatch() (which sets self.request), so null the object-perm
-        # gate; permission ordering is covered in test_coverage_devices.py.
         view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
-    def test_vc_no_resolvable_sync_device_returns_404(self, mock_cache, mock_sync, mock_get_obj):
-        """VC where get_librenms_sync_device returns None → 404 JSON error, no crash."""
-        device = _make_vc_device(pk=1)
-        mock_get_obj.return_value = device
+    def test_vc_no_resolvable_sync_device_returns_404(self, mock_cache, mock_sync):
+        """VC where get_librenms_sync_device returns None -> 404 JSON error, no crash."""
+        device = _real_vc_device("if-nosync")
         mock_sync.return_value = None
-
-        view = self._make_view()
-        request = _make_request(
-            {
-                "device_id": 1,
-                "interface_name": "eth0",
-                "interface_name_field": "ifName",
-            }
+        view, request = _real_verify_view(
+            SingleInterfaceVerifyView,
+            {"device_id": device.pk, "interface_name": "eth0", "interface_name_field": "ifName"},
+            _verify_superuser("if-nosync"),
         )
         response = view.post(request)
 
@@ -196,48 +208,38 @@ def test_vc_no_resolvable_sync_device_returns_404(self, mock_cache, mock_sync, m
         assert "sync device" in data["message"].lower()
         mock_cache.get.assert_not_called()
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
-    def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync, mock_get_obj):
-        """VC with resolved sync device: cache is queried with that device's key."""
-        device = _make_vc_device(pk=1)
-        sync_device = _make_vc_device(pk=3, name="sync-member")
-        mock_get_obj.return_value = device
+    def test_vc_resolved_sync_device_uses_cache(self, mock_cache, mock_sync):
+        """VC with a resolved sync device: cache is queried with that device's key."""
+        device = _real_vc_device("if-sync")
+        sync_device = _real_vc_device("if-syncmember", name="if-sync-member")
         mock_sync.return_value = sync_device
         mock_cache.get.return_value = None
-
-        view = self._make_view()
-        request = _make_request(
-            {
-                "device_id": 1,
-                "interface_name": "eth0",
-                "interface_name_field": "ifName",
-            }
+        view, request = _real_verify_view(
+            SingleInterfaceVerifyView,
+            {"device_id": device.pk, "interface_name": "eth0", "interface_name_field": "ifName"},
+            _verify_superuser("if-sync"),
         )
         view.post(request)
 
         mock_sync.assert_called_once_with(device, server_key=view._librenms_api.server_key)
         mock_cache.get.assert_called_once()
         cache_key = mock_cache.get.call_args[0][0]
-        assert "3" in cache_key
+        assert str(sync_device.pk) in cache_key
 
-    @patch("netbox_librenms_plugin.views.object_sync.devices.SingleInterfaceVerifyView.restrict_object_or_404")
+    @pytest.mark.django_db
     @patch("netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device")
     @patch("netbox_librenms_plugin.views.object_sync.devices.cache")
-    def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync, mock_get_obj, mock_netbox_device):
+    def test_non_vc_device_skips_sync_device_lookup(self, mock_cache, mock_sync):
         """Non-VC device: get_librenms_sync_device is NOT called."""
-        mock_netbox_device.virtual_chassis = None
-        mock_get_obj.return_value = mock_netbox_device
+        device = _make_gate_device(name="if-nonvc")
         mock_cache.get.return_value = None
-
-        view = self._make_view()
-        request = _make_request(
-            {
-                "device_id": 5,
-                "interface_name": "eth0",
-                "interface_name_field": "ifName",
-            }
+        view, request = _real_verify_view(
+            SingleInterfaceVerifyView,
+            {"device_id": device.pk, "interface_name": "eth0", "interface_name_field": "ifName"},
+            _verify_superuser("if-nonvc"),
         )
         view.post(request)
 
@@ -746,3 +748,100 @@ def test_grant_scopes_lookup_to_covered_device(self):
         scoped = Device.objects.restrict(user, "view")
         assert scoped.filter(pk=in_scope.pk).exists() is True
         assert scoped.filter(pk=out_of_scope.pk).exists() is False
+
+
+@pytest.mark.django_db
+class TestSaveVlanGroupOverridesObjectScope:
+    """SaveVlanGroupOverridesView WRITES overrides, so it must object-scope the device too.
+
+    require_write_permission_json only checks plugin-wide write access, so a plugin-writer with a
+    *constrained* view_device grant could otherwise persist VLAN overrides for a device they can't
+    see. The lookup must go through restrict() so an out-of-scope pk 404s.
+    """
+
+    SERVER_KEY = "default"
+
+    @staticmethod
+    def _plugin_writer_scoped_to(in_scope_device):
+        """A real user with plugin write access AND a pk-constrained view_device grant (no superuser)."""
+        from core.models import ObjectType
+        from dcim.models import Device
+        from django.apps import apps
+        from django.contrib.auth import get_user_model
+        from users.models import ObjectPermission
+
+        # Resolve via the app registry, not `from ...models import LibreNMSSettings`: the autouse
+        # mock_librenms_config fixture patches the module attribute to a MagicMock during the full
+        # suite, so a plain import would hand get_for_model() a mock class.
+        LibreNMSSettings = apps.get_model("netbox_librenms_plugin", "LibreNMSSettings")
+
+        user = get_user_model().objects.create_user(username="scoped-writer", password="x")
+
+        write = ObjectPermission.objects.create(name="plugin-write", actions=["change"])
+        write.object_types.set([ObjectType.objects.get_for_model(LibreNMSSettings)])
+        write.users.set([user])
+
+        view_dev = ObjectPermission.objects.create(
+            name="scoped-view-dev", actions=["view"], constraints={"pk": in_scope_device.pk}
+        )
+        view_dev.object_types.set([ObjectType.objects.get_for_model(Device)])
+        view_dev.users.set([user])
+
+        return get_user_model().objects.get(pk=user.pk)  # clear the per-request perm cache
+
+    def _view_and_request(self, user, device_pk):
+        from netbox_librenms_plugin.views.object_sync.devices import SaveVlanGroupOverridesView
+
+        view = SaveVlanGroupOverridesView()
+        request = RequestFactory().post(
+            "/plugins/librenms_plugin/save-vlan-overrides/",
+            data=json.dumps({"device_id": device_pk, "vid_group_map": {"10": 3}, "server_key": self.SERVER_KEY}),
+            content_type="application/json",
+        )
+        request.user = user
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+        return view, request
+
+    def test_out_of_scope_device_is_blocked(self):
+        """A plugin-writer scoped to another device cannot persist overrides for an out-of-scope device."""
+        from django.core.cache import cache as real_cache
+        from django.http import Http404
+
+        in_scope = _make_gate_device(name="ovr-in")
+        out_of_scope = _make_gate_device(name="ovr-out")
+        user = self._plugin_writer_scoped_to(in_scope)
+        view, request = self._view_and_request(user, out_of_scope.pk)
+
+        overrides_key = view.get_vlan_overrides_key(out_of_scope, self.SERVER_KEY)
+        real_cache.delete(overrides_key)
+        # Even with the ports cache warm (so the write path would otherwise proceed), the device
+        # must 404 at the restricted lookup before anything is persisted.
+        real_cache.set(view.get_cache_key(out_of_scope, "ports", self.SERVER_KEY), {"ports": []}, timeout=300)
+        try:
+            with pytest.raises(Http404):
+                view.post(request)
+            assert real_cache.get(overrides_key) is None  # nothing written for the out-of-scope device
+        finally:
+            real_cache.delete(overrides_key)
+            real_cache.delete(view.get_cache_key(out_of_scope, "ports", self.SERVER_KEY))
+
+    def test_in_scope_device_resolves_past_the_gate(self):
+        """The device the grant DOES cover resolves through restrict() (no over-block — reaches the write path)."""
+        from django.core.cache import cache as real_cache
+        from django.http import Http404, JsonResponse
+
+        in_scope = _make_gate_device(name="ovr-in-2")
+        user = self._plugin_writer_scoped_to(in_scope)
+        view, request = self._view_and_request(user, in_scope.pk)
+        try:
+            # Must NOT 404: an in-scope device is resolvable. (It then hits the ports-cache/TTL check,
+            # returning a JsonResponse either way — the point is the restricted lookup didn't block it.)
+            try:
+                response = view.post(request)
+            except Http404:
+                pytest.fail("in-scope device was wrongly blocked by restrict()")
+            assert isinstance(response, JsonResponse)
+        finally:
+            real_cache.delete(view.get_vlan_overrides_key(in_scope, self.SERVER_KEY))
diff --git a/netbox_librenms_plugin/tests/test_view_wiring.py b/netbox_librenms_plugin/tests/test_view_wiring.py
index dca011d5fb..3409c6bd41 100644
--- a/netbox_librenms_plugin/tests/test_view_wiring.py
+++ b/netbox_librenms_plugin/tests/test_view_wiring.py
@@ -423,100 +423,97 @@ def test_valid_int_passes_through(self, mock_settings):
 
 
 class TestSingleCableVerifyServerKey:
-    """SingleCableVerifyView.post() must read server_key from POST body."""
+    """SingleCableVerifyView.post() must thread server_key from the POST body into VC resolution + cache key."""
+
+    @staticmethod
+    def _vc_device(tag):
+        """A real Device that belongs to a VirtualChassis (so post() takes the VC sync-resolution branch)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site, VirtualChassis
+
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"SkMfr-{tag}", slug=f"skmfr-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"SkDT-{tag}", slug=f"skdt-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name="SkRole", slug="skrole")
+        site, _ = Site.objects.get_or_create(name="SkSite", slug="sksite")
+        vc = VirtualChassis.objects.create(name=f"SkVC-{tag}")
+        return Device.objects.create(
+            name=f"sk-{tag}", device_type=dt, role=role, site=site, status="active", virtual_chassis=vc, vc_position=1
+        )
 
-    def test_server_key_used_for_cache_lookup(self):
-        """The server_key from POST body is passed to get_cache_key and get_librenms_sync_device."""
+    @staticmethod
+    def _view_and_request(device, body, *, api_server_key):
+        """Real view + real superuser request; _librenms_api is stubbed only to supply the active-server key."""
         import json
+        from unittest.mock import MagicMock
+
+        from django.contrib.auth import get_user_model
+        from django.test import RequestFactory
 
         from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
 
-        view = object.__new__(SingleCableVerifyView)
+        view = SingleCableVerifyView()
         view._librenms_api = MagicMock()
-        # dispatch() sets self.request in production; this direct post() call needs an authorized
-        # request for the object-permission gate (reads self.request.user.has_perm).
-        view.request = MagicMock()
-        view.request.user.has_perm.return_value = True
-        view._librenms_api.server_key = "default-server"
-
-        request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "local_port_id": "42",
-                "server_key": "production",
-            }
-        ).encode()
+        view._librenms_api.server_key = api_server_key  # config boundary: the active-server fallback
+        request = RequestFactory().post("/verify-cable/", data=json.dumps(body), content_type="application/json")
+        request.user = get_user_model().objects.create_superuser(username=f"sk-{device.pk}", email="", password="x")
+        view.request = request
+        view.kwargs = {}
+        view.args = ()
+        return view, request
+
+    @pytest.mark.django_db
+    def test_server_key_used_for_cache_lookup(self):
+        """The POSTed server_key is threaded into get_librenms_sync_device and the (real) cache key."""
+        from unittest.mock import patch
+
+        device = self._vc_device("used")
+        view, request = self._view_and_request(
+            device,
+            {"device_id": device.pk, "local_port_id": "42", "server_key": "production"},
+            api_server_key="default-server",
+        )
 
         with (
             # The posted key is honoured only when it names a configured server; post() checks the
-            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance) so it never builds a
-            # possibly-broken default client just to validate membership.
+            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance).
             patch(
                 "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
                 return_value={"production": "Production"},
             ),
             patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
-            ) as mock_get_obj,
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
+                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device
             ) as mock_sync_device,
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
         ):
-            mock_device = MagicMock()
-            mock_sync_device.return_value = mock_device  # return a device so code reaches cache.get
-            mock_get_obj.return_value = mock_device
-            mock_cache.get.return_value = None  # No cached data
-
+            mock_cache.get.return_value = None  # no cached data -> early return once the key is built
             view.post(request)
 
-            # get_librenms_sync_device should be called with the posted server_key
-            mock_sync_device.assert_called_once_with(mock_device, server_key="production")
-            # cache lookup must also use the posted server_key (not the api default)
+            # get_librenms_sync_device gets the posted server_key (device compares by pk via Model.__eq__)
+            mock_sync_device.assert_called_once_with(device, server_key="production")
+            # the real cache key also carries the posted server_key (not the active default)
             cache_key_arg = mock_cache.get.call_args[0][0]
             assert "production" in cache_key_arg
 
+    @pytest.mark.django_db
     def test_fallback_to_api_server_key(self):
-        """When POST body has no server_key, falls back to self.librenms_api.server_key."""
-        import json
-
-        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+        """With no server_key in the POST body, post() falls back to the active-server key."""
+        from unittest.mock import patch
 
-        view = object.__new__(SingleCableVerifyView)
-        view._librenms_api = MagicMock()
-        # dispatch() sets self.request in production; this direct post() call needs an authorized
-        # request for the object-permission gate (reads self.request.user.has_perm).
-        view.request = MagicMock()
-        view.request.user.has_perm.return_value = True
-        view._librenms_api.server_key = "fallback-server"
-
-        request = MagicMock()
-        request.body = json.dumps(
-            {
-                "device_id": 1,
-                "local_port_id": "42",
-            }
-        ).encode()
+        device = self._vc_device("fallback")
+        view, request = self._view_and_request(
+            device, {"device_id": device.pk, "local_port_id": "42"}, api_server_key="fallback-server"
+        )
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404"
-            ) as mock_get_obj,
             patch(
                 "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
+                side_effect=lambda dev, **kw: dev,
             ) as mock_sync_device,
             patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
         ):
-            mock_device = MagicMock()
-            mock_sync_device.return_value = mock_device  # return a device so code reaches cache.get
-            mock_get_obj.return_value = mock_device
             mock_cache.get.return_value = None
-
             view.post(request)
 
             mock_sync_device.assert_called_once()
             assert mock_sync_device.call_args[1]["server_key"] == "fallback-server"
-            # cache lookup must also use the fallback server_key
             cache_key_arg = mock_cache.get.call_args[0][0]
             assert "fallback-server" in cache_key_arg
diff --git a/netbox_librenms_plugin/views/object_sync/devices.py b/netbox_librenms_plugin/views/object_sync/devices.py
index 18abd3ff3a..b6a12fb7ef 100644
--- a/netbox_librenms_plugin/views/object_sync/devices.py
+++ b/netbox_librenms_plugin/views/object_sync/devices.py
@@ -555,7 +555,9 @@ def post(self, request):
         )
 
 
-class SaveVlanGroupOverridesView(LibreNMSPermissionMixin, LibreNMSAPIMixin, CacheMixin, View):
+class SaveVlanGroupOverridesView(
+    LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View
+):
     """
     Persist user VLAN-group-override selections in cache.
 
@@ -584,7 +586,10 @@ def post(self, request):
         # neither address an arbitrary namespace nor TypeError-500 the cf lookups below.
         server_key = self.resolve_requested_server_key(data)
 
-        device = get_object_or_404(Device, pk=device_id)
+        # Object-scope the lookup: require_write_permission_json above only checks plugin-wide write
+        # access, so without this any plugin-writer could persist VLAN overrides for a device they
+        # can't even view (out-of-scope pk). Restrict fail-closes it to a 404 like a nonexistent id.
+        device = self.restrict_object_or_404(Device, pk=device_id)
 
         # Normalise to the VC sync device so cache keys match what the sync view stored
         sync_device = get_librenms_sync_device(device, server_key=server_key)

From 003d130a11dc220ba97818a405784f9977fbfb80 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 23:41:03 +0200
Subject: [PATCH 09/17] fix(modules): correct VC panel swap + isolate
 module-interface bind from adopt failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three CodeRabbit findings on the module-sync views:

- InstallModuleView bay-occupied exit rendered `target_device`'s panel; for a VC-member row action
  (target_device != page_device) that swaps in the member's panel and the page's own bays vanish.
  Swap `page_device` like every other exit path.
- InstallSelectedView's success + ValidationError/IntegrityError paths still returned the full-page
  HX-Redirect while its four early exits (and all of InstallBranchView) return the in-place HTMX
  partial — mixing swap modes flips this row action's behaviour. Return the partial on every exit.
- UpdateModuleInterfaceView wrapped the port-bind AND the adopt step in one broad `except Exception`;
  _bind_interface_librenms_id writes with no atomic, so a bind that committed was masked behind a
  generic "associating" failure when the later adopt raised. Isolate the bind in its own try/except
  (mirroring InstallModuleView) and, on adopt failure, warn without overwriting a committed bind.

Tests (real device/module where the swap path renders; the two exit-path assertions drive the
InstallSelected/UpdateModuleInterface post flows): red→green verified.
---
 .../tests/test_sync_modules.py                | 172 ++++++++++++++++++
 netbox_librenms_plugin/views/sync/modules.py  |  52 ++++--
 2 files changed, 208 insertions(+), 16 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_sync_modules.py b/netbox_librenms_plugin/tests/test_sync_modules.py
index 1f74626602..425678ff8d 100644
--- a/netbox_librenms_plugin/tests/test_sync_modules.py
+++ b/netbox_librenms_plugin/tests/test_sync_modules.py
@@ -1920,6 +1920,122 @@ def _spy(self, request, obj, *args, **kwargs):
         # The action ran against the member, but the swapped panel is the page device's.
         assert [d.pk for d in rendered_for] == [device.pk]
 
+    def test_install_bay_occupied_swaps_page_device_panel_not_vc_member(self):
+        """InstallModuleView's bay-occupied branch swaps the PAGE device's panel, not the targeted VC member's."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.contrib.messages.storage.fallback import FallbackStorage
+        from django.test import RequestFactory
+
+        from dcim.models import Device, Module, ModuleBay, ModuleType, VirtualChassis
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceModuleTableView
+        from netbox_librenms_plugin.views.sync.modules import InstallModuleView
+
+        device, module, _raw, _standalone, _cable = self._build()
+        # Page device is a VC master; the row action targets a member whose bay is already occupied.
+        vc = VirtualChassis.objects.create(name="vc-install-scope")
+        Device.objects.filter(pk=device.pk).update(virtual_chassis=vc, vc_position=1)
+        member = Device.objects.create(
+            name="install-member",
+            device_type=device.device_type,
+            role=device.role,
+            site=device.site,
+            status="active",
+            virtual_chassis=vc,
+            vc_position=2,
+        )
+        mt = ModuleType.objects.create(manufacturer=device.device_type.manufacturer, model="occupied-mt")
+        member_bay = ModuleBay.objects.create(device=member, name="occupied-bay")
+        Module.objects.create(device=member, module_bay=member_bay, module_type=mt)  # occupy the bay
+
+        view = object.__new__(InstallModuleView)
+        view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="production")
+        view.has_write_permission = MagicMock(return_value=True)
+
+        request = RequestFactory().post(
+            "/",
+            data={
+                "module_bay_id": str(member_bay.pk),
+                "module_type_id": str(mt.pk),
+                "selected_device_id": str(member.pk),
+                "server_key": "production",
+            },
+            HTTP_HX_REQUEST="true",
+        )
+        request.user = AnonymousUser()
+        request.session = "session"
+        request._messages = FallbackStorage(request)
+
+        rendered_for = []
+        original_get_context = DeviceModuleTableView.get_context_data
+
+        def _spy(self, request, obj, *args, **kwargs):
+            rendered_for.append(obj)
+            return original_get_context(self, request, obj, *args, **kwargs)
+
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.modules.messages"),
+            patch.object(DeviceModuleTableView, "get_context_data", _spy),
+        ):
+            response = view.post(request, pk=device.pk)
+
+        assert response.status_code == 200
+        # Bay was occupied → the swapped panel must be the PAGE device's, not the member's (target_device).
+        assert [d.pk for d in rendered_for] == [device.pk]
+
+    def test_bind_success_survives_adopt_failure(self):
+        """B2: a committed port-bind is still reported even if the later adoption step raises (not masked)."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.contrib.messages.storage.fallback import FallbackStorage
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.sync.modules import UpdateModuleInterfaceView
+
+        device, module, _raw, _standalone, _cable = self._build()
+
+        view = object.__new__(UpdateModuleInterfaceView)
+        view.required_object_permissions = {}
+        view._librenms_api = MagicMock(server_key="production")
+        view.has_write_permission = MagicMock(return_value=True)
+
+        request = RequestFactory().post(
+            "/",
+            data={"module_id": str(module.pk), "server_key": "production"},
+            HTTP_HX_REQUEST="true",
+        )
+        request.user = AnonymousUser()
+        request.session = "session"
+        request._messages = FallbackStorage(request)
+
+        # The port-bind commits; the subsequent adoption raises (its own transaction rolls back).
+        bound = {"status": "bound", "changed": True, "interface": "eth-bind", "port_id": 42}
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._resolve_single_install_binding_item",
+                return_value={"ent_physical_index": 1},
+            ),
+            patch("netbox_librenms_plugin.views.sync.modules._bind_interface_librenms_id", return_value=bound),
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._adopt_existing_template_interfaces",
+                side_effect=RuntimeError("adopt boom"),
+            ),
+            # Sentinel the swap so it doesn't consume the flash messages we assert on.
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._render_modules_partial_after_action",
+                return_value="PARTIAL",
+            ),
+        ):
+            view.post(request, pk=device.pk)
+
+        joined = " | ".join(m.message for m in request._messages)
+        # The bind that DID commit is still reported...
+        assert "eth-bind" in joined
+        # ...and is NOT hidden behind the old generic "associating" failure that swallowed it.
+        assert "unexpected error while associating" not in joined
+
 
 class TestPredictModuleInterfaceRenameLengthGuard:
     """predict_module_interface_rename enforces the 1:1, order-preserving receiver contract."""
@@ -3163,6 +3279,62 @@ def test_install_selected_view_no_cache_delete(self):
         mock_messages.success.assert_called_once()
         mock_cache.delete.assert_not_called()
 
+    def test_install_selected_success_path_uses_htmx_partial_swap(self):
+        """B1: InstallSelectedView's success path swaps the HTMX partial, not a full-page HX-Redirect (matches InstallBranchView + its own early exits)."""
+        from netbox_librenms_plugin.views.sync.modules import InstallBranchView, InstallSelectedView
+
+        view = object.__new__(InstallSelectedView)
+        view.required_object_permissions = {}
+        view.has_write_permission = MagicMock(return_value=True)
+        device = _make_device()
+
+        request = _make_request("POST", data={"server_key": "default"})
+        post_mock = MagicMock()
+        post_mock.get = MagicMock(side_effect=lambda k, d=None: {"server_key": "default"}.get(k, d))
+        post_mock.getlist = MagicMock(return_value=["100"])
+        request.POST = post_mock
+
+        cached_inventory = [
+            {
+                "entPhysicalIndex": 100,
+                "entPhysicalClass": "module",
+                "entPhysicalModelName": "MOD-A",
+                "entPhysicalContainedIn": 0,
+                "entPhysicalName": "Slot 0",
+            },
+        ]
+        install_result = {"status": "installed", "name": "Slot 0"}
+
+        with (
+            patch.object(view, "require_all_permissions", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.modules.get_object_or_404", return_value=device),
+            patch("netbox_librenms_plugin.views.sync.modules.reverse", return_value="/sync/"),
+            patch("netbox_librenms_plugin.views.sync.modules.cache") as mock_cache,
+            patch.object(view, "get_cache_key", return_value="test-key"),
+            patch.object(InstallBranchView, "_install_single", return_value=install_result),
+            patch("netbox_librenms_plugin.views.sync.modules.get_module_types_indexed", return_value={}),
+            patch("netbox_librenms_plugin.utils.get_enabled_ignore_rules", return_value=[]),
+            patch("netbox_librenms_plugin.utils.load_bay_mappings", return_value=([], [])),
+            patch("netbox_librenms_plugin.utils.preload_normalization_rules", return_value={}),
+            patch("netbox_librenms_plugin.views.sync.modules.transaction") as mock_tx,
+            patch("netbox_librenms_plugin.views.sync.modules.messages"),
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._render_modules_partial_after_action",
+                return_value="PARTIAL",
+            ) as mock_partial,
+            patch(
+                "netbox_librenms_plugin.views.sync.modules._modules_redirect_response",
+                return_value="REDIRECT",
+            ) as mock_redirect,
+        ):
+            mock_cache.get.return_value = {"inventory": cached_inventory, "librenms_id": "test"}
+            mock_tx.atomic = lambda *a, **kw: MagicMock(__enter__=MagicMock(), __exit__=MagicMock(return_value=False))
+            result = view.post(request, pk=24)
+
+        assert result == "PARTIAL"  # not the full-page HX-Redirect
+        mock_partial.assert_called_once()
+        mock_redirect.assert_not_called()
+
     def test_install_branch_rejects_stale_cached_inventory_context(self):
         """Branch install should fail closed when cached inventory librenms_id mismatches target device context."""
         from netbox_librenms_plugin.views.sync.modules import InstallBranchView
diff --git a/netbox_librenms_plugin/views/sync/modules.py b/netbox_librenms_plugin/views/sync/modules.py
index c2303fb24a..dd61a6f5ff 100644
--- a/netbox_librenms_plugin/views/sync/modules.py
+++ b/netbox_librenms_plugin/views/sync/modules.py
@@ -738,8 +738,11 @@ def post(self, request, pk):
                 locked_bay = ModuleBay.objects.select_for_update().get(pk=module_bay_id)
                 if hasattr(locked_bay, "installed_module") and locked_bay.installed_module:
                     messages.warning(request, f"Module bay '{locked_bay.name}' already has a module installed.")
+                    # Swap the PAGE device's panel (like every other exit path), not target_device:
+                    # for a VC-member row action (target_device != page_device) rendering the member's
+                    # panel here makes the page's own bays vanish.
                     return _render_modules_partial_after_action(
-                        request, target_device, sync_url, self.has_write_permission
+                        request, page_device, sync_url, self.has_write_permission
                     )
                 module = Module(
                     device=target_device,
@@ -1417,13 +1420,15 @@ def post(self, request, pk):
                             skipped.append(f"{result['name']}: {bind_result['reason']}")
         except (ValidationError, IntegrityError) as e:
             messages.error(request, f"Install failed: {e}")
-            return _modules_redirect_response(request, sync_url)
+            # HTMX partial swap on every exit, matching InstallBranchView + this view's own early
+            # exits — a full-page HX-Redirect here would flip this row action's swap behaviour.
+            return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
         if invalid_selection_seen:
             _warn_invalid_selected_device(request)
 
         _report_install_results(request, installed, skipped, failed)
-        return _modules_redirect_response(request, sync_url)
+        return _render_modules_partial_after_action(request, page_device, sync_url, self.has_write_permission)
 
 
 class UpdateModuleSerialView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, View):
@@ -1515,16 +1520,36 @@ def post(self, request, pk):
 
         module = get_object_or_404(Module, pk=module_id, device=target_device)
 
-        try:
-            bind_result = None
-            if bind_item and server_key:
+        # Isolate the port-bind in its own guard (mirrors InstallModuleView): _bind_interface_librenms_id
+        # writes with no atomic wrapper, so a bind that commits must NOT be masked by a later adoption
+        # failure — the two steps get separate try/excepts.
+        bind_result = None
+        if bind_item and server_key:
+            try:
                 bind_result = _bind_interface_librenms_id(target_device, bind_item, module.pk, server_key)
-            # The port-bind above maps at most one LibreNMS port and is a no-op when that
-            # port already sits on the module's interface. Always reconcile standalone
-            # interfaces matching the module's predicted template names — adopting them (and
-            # folding in any raw duplicate a skipped rename left behind) is the action this
-            # button is offered for, so it must run even when the port-bind changed nothing.
+            except Exception:
+                bind_result = {
+                    "status": "failed",
+                    "reason": "unexpected error while binding interface to installed module",
+                }
+
+        # The port-bind above maps at most one LibreNMS port and is a no-op when that port already
+        # sits on the module's interface. Always reconcile standalone interfaces matching the module's
+        # predicted template names — adopting them (and folding in any raw duplicate a skipped rename
+        # left behind) is the action this button is offered for, so it must run even when the
+        # port-bind changed nothing.
+        try:
             adopt_result = _adopt_existing_template_interfaces(target_device, module, server_key)
+        except Exception:
+            # Adoption raised (its own transaction rolls back). Surface it, but do NOT overwrite a
+            # bind that already committed — a generic failure here would hide the port that WAS bound.
+            messages.warning(request, "Interface adoption failed unexpectedly after the port-binding step.")
+            if not (bind_result and bind_result.get("status") == "bound"):
+                bind_result = {
+                    "status": "failed",
+                    "reason": "unexpected error while adopting interfaces for installed module",
+                }
+        else:
             if adopt_result.get("status") == "bound":
                 # Adoption becomes the summary result, but don't let it SWALLOW a concurrent
                 # port-bind that ACTUALLY (re)bound a port: when both land in one click, surface the
@@ -1547,11 +1572,6 @@ def post(self, request, pk):
                 bind_result = adopt_result
             elif bind_result is None:
                 bind_result = adopt_result
-        except Exception:
-            bind_result = {
-                "status": "failed",
-                "reason": "unexpected error while associating interface to installed module",
-            }
 
         if bind_result is None:
             messages.error(request, "No LibreNMS interface identity is available for this row.")

From 7147160cabc99f0d6e71ab5ff45bbaa322b3ec68 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 23:41:04 +0200
Subject: [PATCH 10/17] refactor(sync): centralize the live-device-info
 write-path fetch on LibreNMSAPIMixin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `get_device_info(id, use_cache=False)` idiom — persist LIVE LibreNMS values on a write path, not
the possibly-stale sync-tab render snapshot — was copy-pasted with its rationale across six write
views. Add LibreNMSAPIMixin.get_live_device_info(librenms_id), which every one of those views already
inherits (they use self.librenms_api), and route all six through it:
name/serial/type/platform update, legacy-id convert, and the OOB Primary-IP resolution.

The two sites that keep a site-specific note (convert serial gate, Primary-IP decision) now reference
the helper instead of a now-hidden use_cache flag. Helper test uses a recording fake to prove the
cache is bypassed; existing view coverage exercises behaviour unchanged.
---
 .../tests/test_mixins_helpers.py              | 24 +++++++++++++++++++
 netbox_librenms_plugin/views/mixins.py        | 17 +++++++++++++
 .../views/sync/device_fields.py               | 22 ++++++-----------
 .../views/sync/ip_addresses.py                |  6 ++---
 4 files changed, 51 insertions(+), 18 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_mixins_helpers.py b/netbox_librenms_plugin/tests/test_mixins_helpers.py
index 1893f7941e..14ba92fa2e 100644
--- a/netbox_librenms_plugin/tests/test_mixins_helpers.py
+++ b/netbox_librenms_plugin/tests/test_mixins_helpers.py
@@ -87,3 +87,27 @@ def test_non_string_key_falls_back_without_crashing(self):
     def test_missing_key_falls_back(self):
         view = self._view()
         assert view.resolve_requested_server_key({}) == view._render_server_key()
+
+
+class TestGetLiveDeviceInfo:
+    """get_live_device_info centralizes the write-path rule: always fetch uncached (use_cache=False)."""
+
+    def test_delegates_to_get_device_info_with_cache_bypassed(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        calls = []
+
+        class _RecordingAPI:
+            # Default use_cache=True so a helper that forgot to pass the flag would record True.
+            def get_device_info(self, librenms_id, use_cache=True):
+                calls.append((librenms_id, use_cache))
+                return (True, {"sysName": "sw1", "device_id": librenms_id})
+
+        view = DeviceInterfaceTableView()
+        view._librenms_api = _RecordingAPI()
+
+        result = view.get_live_device_info(42)
+
+        # The whole point of the helper: every write path bypasses the possibly-stale render cache.
+        assert calls == [(42, False)]
+        assert result == (True, {"sysName": "sw1", "device_id": 42})
diff --git a/netbox_librenms_plugin/views/mixins.py b/netbox_librenms_plugin/views/mixins.py
index af2c742090..6fd4f81b0f 100644
--- a/netbox_librenms_plugin/views/mixins.py
+++ b/netbox_librenms_plugin/views/mixins.py
@@ -388,6 +388,23 @@ def resolve_requested_server_key(self, data):
             return requested_server_key
         return self._render_server_key()
 
+    def get_live_device_info(self, librenms_id):
+        """
+        Fetch LIVE LibreNMS device info for a write path (``use_cache=False``).
+
+        Device-mutating actions (name/serial/type/platform update, legacy-id convert, OOB IP
+        resolution) must persist current LibreNMS values, not the possibly-stale sync-tab render
+        snapshot cached for up to ``DEVICE_INFO_CACHE_TIMEOUT``. Centralizing this here keeps every
+        write path opting out of the cache the same way instead of repeating the rationale inline.
+
+        Args:
+            librenms_id: The device's LibreNMS id.
+
+        Returns:
+            tuple[bool, dict | None]: ``(success, device_info)`` from ``get_device_info``.
+        """
+        return self.librenms_api.get_device_info(librenms_id, use_cache=False)
+
     def get_server_info(self):
         """
         Get information about the currently active LibreNMS server.
diff --git a/netbox_librenms_plugin/views/sync/device_fields.py b/netbox_librenms_plugin/views/sync/device_fields.py
index d0222a9dd7..09f8331335 100644
--- a/netbox_librenms_plugin/views/sync/device_fields.py
+++ b/netbox_librenms_plugin/views/sync/device_fields.py
@@ -57,9 +57,7 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
-        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
+        success, device_info = self.get_live_device_info(self.librenms_id)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -133,9 +131,7 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
-        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
+        success, device_info = self.get_live_device_info(self.librenms_id)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -189,9 +185,7 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
-        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
+        success, device_info = self.get_live_device_info(self.librenms_id)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -259,9 +253,7 @@ def post(self, request, pk):
             messages.error(request, "Device not found in LibreNMS")
             return redirect("plugins:netbox_librenms_plugin:device_librenms_sync", pk=pk)
 
-        # use_cache=False: this is a write path — persist LIVE LibreNMS values, not the stale
-        # snapshot the sync-tab render may have cached for up to DEVICE_INFO_CACHE_TIMEOUT.
-        success, device_info = self.librenms_api.get_device_info(self.librenms_id, use_cache=False)
+        success, device_info = self.get_live_device_info(self.librenms_id)
 
         if not success or not device_info:
             messages.error(request, "Failed to retrieve device info from LibreNMS")
@@ -716,9 +708,9 @@ def post(self, request, pk):
             return self._sync_url(object_type, pk)
         librenms_id = int(cf_value)
 
-        # Verify serial match before converting — live fetch (use_cache=False): the serial gate
-        # decides whether to rewrite the id, so it must not read a stale sync-tab cache snapshot.
-        success, device_info = self.librenms_api.get_device_info(librenms_id, use_cache=False)
+        # Verify serial match before converting — get_live_device_info reads live (uncached): the
+        # serial gate decides whether to rewrite the id, so it must not read a stale sync-tab snapshot.
+        success, device_info = self.get_live_device_info(librenms_id)
         if not success or not device_info:
             messages.error(request, "Could not retrieve device info from LibreNMS to verify serial.")
             return self._sync_url(object_type, pk)
diff --git a/netbox_librenms_plugin/views/sync/ip_addresses.py b/netbox_librenms_plugin/views/sync/ip_addresses.py
index 3e252acfca..061bff08b8 100644
--- a/netbox_librenms_plugin/views/sync/ip_addresses.py
+++ b/netbox_librenms_plugin/views/sync/ip_addresses.py
@@ -115,9 +115,9 @@ def get_management_ip(self, obj):
             librenms_id = self.librenms_api.get_librenms_id(obj)
             if not librenms_id:
                 return None
-            # use_cache=False: this feeds the Primary-IP write decision, so it must read the live
-            # management IP, not a stale snapshot the sync-tab render may have cached.
-            success, info = self.librenms_api.get_device_info(librenms_id, use_cache=False)
+            # get_live_device_info reads live (uncached): this feeds the Primary-IP write decision,
+            # so it must read the current management IP, not a stale sync-tab snapshot.
+            success, info = self.get_live_device_info(librenms_id)
             if not success or not isinstance(info, dict):
                 return None
             ip = info.get("ip")

From 1ea0fa6dfe8c7210852f560db9c2fa5a0a56e3a1 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 23:41:05 +0200
Subject: [PATCH 11/17] fix(bulk-import): drop javascript: href for a button;
 cover missing-VLAN XSS escaping

- bulk_import_confirm.html's partial-cache "Refresh" control was an `<a href="javascript:...">`
  pseudo-protocol link (CSP-hostile, flagged accessibility/security). Replace with a real
  `<button type="button" onclick="window.location.reload()">`; assert no `javascript:` in the render.
- Add the missing render_vlans coverage case with a non-empty `missing_vlans` carrying an XSS vid, so
  the escaping guarantee is exercised on that branch too (the existing case only covered summary/tooltip).
---
 .../htmx/bulk_import_confirm.html                |  2 +-
 .../tests/test_coverage_actions.py               |  3 +++
 .../tests/test_coverage_tables.py                | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
index fdefd45935..a6a473a858 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/htmx/bulk_import_confirm.html
@@ -20,7 +20,7 @@ <h5 class="modal-title">
       <i class="mdi mdi-clock-alert"></i>
       {{ cache_expired_count }} of {{ selected_count }} selected device{{ selected_count|pluralize }} had expired cache data
       and {{ cache_expired_count|pluralize:"was,were" }} dropped or may be missing role/rack selections.
-      <a href="javascript:window.location.reload();" class="alert-link">Refresh</a> or re-run your filter to reload device data.
+      <button type="button" class="btn btn-link alert-link p-0 align-baseline" onclick="window.location.reload();">Refresh</button> or re-run your filter to reload device data.
     </div>
   {% endif %}
 
diff --git a/netbox_librenms_plugin/tests/test_coverage_actions.py b/netbox_librenms_plugin/tests/test_coverage_actions.py
index fe4f21d372..0302bf5ec1 100644
--- a/netbox_librenms_plugin/tests/test_coverage_actions.py
+++ b/netbox_librenms_plugin/tests/test_coverage_actions.py
@@ -4667,6 +4667,9 @@ def _fetch(device_id, *a, **k):
         assert "router01" in html
         assert "1 of 2 selected device" in html
         assert "expired cache data" in html
+        # The Refresh control is a real button, not a CSP-blocked javascript: pseudo-protocol href.
+        assert "javascript:" not in html
+        assert "<button" in html and "window.location.reload()" in html
 
 
 class TestBuildIdServerInfoPaddedId:
diff --git a/netbox_librenms_plugin/tests/test_coverage_tables.py b/netbox_librenms_plugin/tests/test_coverage_tables.py
index 677169de9a..6116f4fcd2 100644
--- a/netbox_librenms_plugin/tests/test_coverage_tables.py
+++ b/netbox_librenms_plugin/tests/test_coverage_tables.py
@@ -2713,3 +2713,19 @@ def test_render_vlans_escapes_malicious_vid(self):
         rendered = str(table.render_vlans(value=None, record=record))
         assert "<img" not in rendered
         assert "&lt;img" in rendered
+
+    def test_render_vlans_escapes_malicious_vid_when_missing(self):
+        """Same #105 sink but with the VLAN flagged missing, so the mark_safe(warning) missing-branch is exercised."""
+        table = _make_interface_table()
+        record = {
+            "untagged_vlan": self.XSS,
+            "tagged_vlans": [],
+            "missing_vlans": [self.XSS],  # vid in missing_vlans → missing branch (summary icon + tooltip)
+            "exists_in_netbox": False,
+            "netbox_interface": None,
+            "vlan_group_map": {},
+            "ifName": "eth0",
+        }
+        rendered = str(table.render_vlans(value=None, record=record))
+        assert "<img" not in rendered
+        assert "&lt;img" in rendered

From a4b9d55c4fd116a6cc724f14bcb1c7dfa6ce65cf Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Thu, 2 Jul 2026 23:41:06 +0200
Subject: [PATCH 12/17] test: restore cable-verify server-key classes + DRY the
 serial-match queryset mock

- Restore three cable-verify classes an earlier full-file rewrite dropped (TestServerKeyGuard,
  broken-default-server render/verify degrade). TestServerKeyGuard's honoured-key test previously
  posted device_id="" (which skips the code path that consumes server_key) and stubbed the wrong
  seam (self._librenms_api.get_available_servers), so it passed regardless of the fix. Rewrite it to
  use a real device and patch the LibreNMSAPI.get_available_servers classmethod the guard actually
  consults, asserting the resolved server_key == the posted configured key.
- Extract the slice-aware `__getitem__` queryset mock (repeated verbatim in 12 device_filter closures,
  supporting validate_device_for_import's [:2] unique-serial guard) into one _matchable_filter_result
  helper so the slice contract can't drift out of sync.
---
 .../tests/test_cable_verify.py                | 162 +++++++++++++++++-
 .../tests/test_import_utils.py                | 100 +++--------
 2 files changed, 189 insertions(+), 73 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_cable_verify.py b/netbox_librenms_plugin/tests/test_cable_verify.py
index 025db1ac5a..0c02515dce 100644
--- a/netbox_librenms_plugin/tests/test_cable_verify.py
+++ b/netbox_librenms_plugin/tests/test_cable_verify.py
@@ -15,7 +15,7 @@
 """
 
 import json
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
 import pytest
 from django.core.cache import cache as real_cache
@@ -220,3 +220,163 @@ def test_xss_in_remote_device_name_escaped(self):
         remote_device_html = content["formatted_row"]["remote_device"]
         assert "<img " not in remote_device_html
         assert "&lt;img" in remote_device_html
+
+
+def _cable_view_with_api(tag, body, *, api_server_key="default"):
+    """A real SingleCableVerifyView + real superuser request, with _librenms_api stubbed only to supply
+    the active-server fallback key (its constructor would otherwise need real LibreNMS config)."""
+    from django.contrib.auth import get_user_model
+
+    from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+    view = SingleCableVerifyView()
+    view._librenms_api = MagicMock()
+    view._librenms_api.server_key = api_server_key
+    request = RequestFactory().post("/verify-cable/", data=json.dumps(body), content_type="application/json")
+    request.user = get_user_model().objects.create_superuser(username=f"guard-{tag}", email="", password="x")
+    view.request = request
+    view.kwargs = {}
+    view.args = ()
+    return view, request
+
+
+@pytest.mark.django_db
+class TestServerKeyGuard:
+    """A forged non-string server_key must not crash the membership check; a configured string is honoured."""
+
+    @pytest.mark.parametrize("forged", [["prod"], {"prod": 1}])
+    def test_unhashable_server_key_falls_back_without_crashing(self, forged):
+        """A JSON array/object server_key must fall back (the isinstance guard) — no unhashable TypeError."""
+        # No device_id → post() resolves server_key (the guarded line) then returns the empty row.
+        view, request = _cable_view_with_api("forged", {"server_key": forged})
+        response = view.post(request)  # must not raise an unhashable-type TypeError
+        assert response.status_code == 200
+
+    def test_valid_string_server_key_is_honoured_in_cache_namespace(self):
+        """A configured string key scopes the REAL links cache namespace, via the real classmethod check (#108/#109).
+
+        Unlike the old device_id="" version, this actually exercises the resolved server_key: it drives
+        the real LibreNMSAPI.get_available_servers() classmethod (patched to configure 'prod') and asserts
+        the resolved key threads into get_cache_key — so it fails if the membership check ever regresses.
+        """
+        device, _ = _cable_device("guard-valid", [("eth0", 100)])
+        view, request = _cable_view_with_api(
+            "valid", {"device_id": device.pk, "local_port_id": 100, "server_key": "prod"}
+        )
+
+        captured = {}
+        real_get_cache_key = view.get_cache_key
+
+        def spy(dev, kind, sk):
+            captured["server_key"] = sk
+            return real_get_cache_key(dev, kind, sk)
+
+        with (
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"prod": "Prod"},
+            ),
+            patch.object(view, "get_cache_key", side_effect=spy),
+        ):
+            view.post(request)
+
+        assert captured["server_key"] == "prod"  # the posted, CONFIGURED key was honoured, not the active default
+
+
+@pytest.mark.django_db
+class TestCablesGetRenderDegradesOnBrokenDefaultServer:
+    """A cached cables GET must degrade cleanly when the default LibreNMS server is misconfigured, not 500 on the lazy LibreNMSAPI() construction."""
+
+    def test_cached_render_does_not_500_when_default_server_build_fails(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+        from django.contrib.auth import get_user_model
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceCableTableView
+
+        tag = "cables-broken-srv"
+        mfr, _ = Manufacturer.objects.get_or_create(name=f"Mfr-{tag}", slug=f"mfr-{tag}")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"DT-{tag}", slug=f"dt-{tag}")
+        role, _ = DeviceRole.objects.get_or_create(name=f"Role-{tag}", slug=f"role-{tag}")
+        site, _ = Site.objects.get_or_create(name=f"Site-{tag}", slug=f"site-{tag}")
+        device = Device.objects.create(name=f"host-{tag}", device_type=dt, role=role, site=site, status="active")
+        view = DeviceCableTableView()
+        request = RequestFactory().get("/")
+        User = get_user_model()
+        request.user = User.objects.filter(is_superuser=True, is_active=True).first() or User.objects.create(
+            username="cables-su", is_superuser=True, is_active=True
+        )
+        view.request = request
+
+        # Seed the links cache under the DEGRADED (None) server_key — what the broken-server render reads.
+        key = view.get_cache_key(device, "links", None)
+        cache.set(
+            key,
+            {"links": [{"local_port": "Gi0/1", "local_port_id": "1", "remote_device": None}]},
+            timeout=300,
+        )
+
+        def broken_cfg(_plugin, cfg_key, *args, **kwargs):
+            # A non-empty 'servers' with no 'default' and no valid dict entry makes LibreNMSAPI()
+            # raise ValueError in its constructor — the exact broken-default-server condition.
+            return {"alpha": "not-a-dict"} if cfg_key == "servers" else None
+
+        try:
+            with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", side_effect=broken_cfg):
+                context = view.get_context_data(request, device)
+            # Degrades: the cached links still render (server_key falls back to None) instead of a 500.
+            assert context is not None
+            assert context["table"] is not None
+            assert context["server_key"] is None
+        finally:
+            cache.delete(key)
+
+
+@pytest.mark.django_db
+class TestSingleCableVerifyMisconfiguredDefault:
+    """SingleCableVerifyView resolves configured servers via the classmethod, not the raising instance property."""
+
+    def test_configured_key_does_not_500_when_default_broken(self):
+        """A configured 'prod' key resolves without constructing the broken default client (issue #108/#109)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+        from django.test import RequestFactory, override_settings
+
+        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="Mfr-scv", slug="mfr-scv")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="DT-scv", slug="dt-scv")
+        role, _ = DeviceRole.objects.get_or_create(name="Role-scv", slug="role-scv")
+        site, _ = Site.objects.get_or_create(name="Site-scv", slug="site-scv")
+        device = Device.objects.create(name="host-scv", device_type=dt, role=role, site=site, status="active")
+
+        view = object.__new__(SingleCableVerifyView)
+        view._librenms_api = None  # live property: accessing it would build LibreNMSAPI() (default)
+        view.require_object_permissions_json = MagicMock(return_value=None)
+
+        # DEFAULT present-but-broken (no url/token) → LibreNMSAPI() raises; get_available_servers()={'prod'}.
+        cfg = {
+            "netbox_librenms_plugin": {
+                "servers": {
+                    "prod": {"librenms_url": "http://prod.example", "api_token": "tok"},
+                    "default": {},
+                }
+            }
+        }
+        request = RequestFactory().post(
+            "/verify/",
+            data=json.dumps({"device_id": device.pk, "local_port_id": "1", "server_key": "prod"}),
+            content_type="application/json",
+        )
+        # RequestFactory skips AuthenticationMiddleware; the object-scoped device lookup reads
+        # request.user, so attach a real superuser (this test is about server-key degradation, not
+        # object scope).
+        from django.contrib.auth import get_user_model
+
+        request.user = get_user_model().objects.create_user(username="scv-user", password="x", is_superuser=True)
+        view.request = request  # dispatch() normally wires this; the object-scoped lookup reads self.request.user
+        with override_settings(PLUGINS_CONFIG=cfg):
+            response = view.post(request)
+
+        assert response.status_code == 200
+        assert json.loads(response.content)["status"] == "success"
diff --git a/netbox_librenms_plugin/tests/test_import_utils.py b/netbox_librenms_plugin/tests/test_import_utils.py
index d0031d3023..e755655422 100644
--- a/netbox_librenms_plugin/tests/test_import_utils.py
+++ b/netbox_librenms_plugin/tests/test_import_utils.py
@@ -9,6 +9,22 @@
 
 import pytest
 
+
+def _matchable_filter_result():
+    """Return a mock queryset whose ``[:2]`` slice derives from ``.first.return_value``.
+
+    validate_device_for_import's unique-serial guard slices the queryset (``[:2]``, issue #101), so a
+    mocked ``.filter()`` result must honour that slice: a single match -> ``[match]``, no match -> ``[]``.
+    Callers set ``.first.return_value`` after constructing it (the slice reads it lazily). Centralized so
+    the slice contract lives in one place if the guard's slice size ever changes again.
+    """
+    result = MagicMock()
+    result.__getitem__.side_effect = lambda _s: (
+        [result.first.return_value] if result.first.return_value is not None else []
+    )
+    return result
+
+
 # =============================================================================
 # TestCacheKeyGeneration - 4 tests
 # =============================================================================
@@ -1730,12 +1746,7 @@ def test_serial_match_blocks_import(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1762,12 +1773,7 @@ def test_serial_match_same_hostname_offers_link(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1794,12 +1800,7 @@ def test_serial_match_diff_hostname_offers_hostname_differs(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -1826,12 +1827,7 @@ def test_hostname_match_diff_serial_offers_update(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "name__iexact" in kwargs:
                 result.first.return_value = existing
             elif "serial" in kwargs:
@@ -1911,12 +1907,7 @@ def test_hostname_match_serial_conflict_warns(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "name__iexact" in kwargs:
                 result.first.return_value = hostname_device
             elif "serial" in kwargs:
@@ -1947,12 +1938,7 @@ def test_librenms_id_match_shows_serial_confirmed(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -1996,12 +1982,7 @@ def test_librenms_id_match_detects_serial_drift(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -2047,12 +2028,7 @@ def test_librenms_id_match_still_validates_site(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )
@@ -2099,12 +2075,7 @@ def test_existing_device_role_populated(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2157,12 +2128,7 @@ def test_device_type_mismatch_flagged(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2213,12 +2179,7 @@ def test_no_device_type_mismatch_when_types_match(self):
         self.mock_vm.objects.filter.return_value.first.return_value = None
 
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             if "serial" in kwargs:
                 result.first.return_value = existing
             else:
@@ -2310,12 +2271,7 @@ def _make_existing(self, name, serial="SN001", virtual_chassis=None, vc_position
 
     def _setup_librenms_id_filter(self, existing):
         def device_filter(*args, **kwargs):
-            result = MagicMock()
-            # Support the unique-serial guard's [:2] slice: derive the slice from the
-            # .first() stub so a single match -> [match], no match -> [] (issue #101).
-            result.__getitem__.side_effect = lambda _s: (
-                [result.first.return_value] if result.first.return_value is not None else []
-            )
+            result = _matchable_filter_result()
             q_has_librenms = any("librenms_id" in str(arg) for arg in args) or any(
                 k.startswith("custom_field_data__librenms_id") for k in kwargs
             )

From 4f954546dcd2e3300ca09e3c46b350614fe6ec5a Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Fri, 3 Jul 2026 07:02:47 +0200
Subject: [PATCH 13/17] fix(ip-verify): reject malformed vrf_id with 400, not a
 masked 500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SingleIPAddressVerifyView.post() read vrf_id straight from the JSON body and passed it into
IPAddress.objects.filter(vrf__id=…) inside _find_existing_ip. A non-numeric (or boolean) vrf_id
raises ValueError there, which the method's broad `except Exception` turns into an opaque 500. Any
caller past the object-view gate could trigger it with {"vrf_id": "abc"}.

Coerce/validate vrf_id to int up front and fail closed with a 400 (None — no VRF — still passes
through). Same "fail closed on malformed payloads" hardening already applied to the JSON body and the
server_key. Real-DB e2e test creates an IP at the posted address (so the vrf__id filter is actually
reached) and asserts 400 for non-numeric/list/bool vrf_id and 200 for a numeric string.
---
 .../tests/test_ip_verify.py                   | 53 +++++++++++++++++++
 .../views/base/ip_addresses_view.py           | 11 ++++
 2 files changed, 64 insertions(+)

diff --git a/netbox_librenms_plugin/tests/test_ip_verify.py b/netbox_librenms_plugin/tests/test_ip_verify.py
index e9dd775756..93d43ab598 100644
--- a/netbox_librenms_plugin/tests/test_ip_verify.py
+++ b/netbox_librenms_plugin/tests/test_ip_verify.py
@@ -154,6 +154,59 @@ def test_non_dict_json_returns_400(self):
         assert json.loads(response.content)["message"] == "JSON payload must be an object"
 
 
+@pytest.mark.django_db
+class TestVerifyPostRejectsMalformedVrfId:
+    """A non-numeric vrf_id must 400 before the VRF filter, not 500 via the broad handler.
+
+    The `vrf__id` filter in `_find_existing_ip` is only reached when an IPAddress at the posted address
+    already exists, so the real IP is created first — otherwise the guard is never exercised and the
+    pre-fix code wouldn't 500 either. Only the cache read is stubbed; `_find_existing_ip` runs for real.
+    """
+
+    def _real_device(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="VRFSK-Mfr", slug="vrfsk-mfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="VRFSK-DT", slug="vrfsk-dt")
+        role, _ = DeviceRole.objects.get_or_create(name="VRFSK-Role", slug="vrfsk-role")
+        site, _ = Site.objects.get_or_create(name="VRFSK-Site", slug="vrfsk-site")
+        return Device.objects.create(name="vrfsk-dev", device_type=dt, role=role, site=site, status="active")
+
+    def _post(self, vrf_id):
+        from django.contrib.auth import get_user_model
+        from ipam.models import IPAddress
+
+        device = self._real_device()
+        IPAddress.objects.get_or_create(address="10.0.0.1/24")  # make the vrf__id filter reachable
+
+        view = _make_view()
+        request = _make_request(
+            {"ip_address": "10.0.0.1/24", "vrf_id": vrf_id, "device_id": device.pk, "object_type": "device"}
+        )
+        request.user = get_user_model().objects.create_superuser(username=f"vrfsk-{device.pk}", email="", password="x")
+        view.request = request
+
+        with patch("netbox_librenms_plugin.views.base.ip_addresses_view.cache") as mock_cache:
+            mock_cache.get.return_value = {"ip_addresses": []}  # no cache hit → real _find_existing_ip runs
+            return view.post(request)
+
+    def test_non_numeric_vrf_id_returns_400(self):
+        response = self._post("abc")
+        assert response.status_code == 400
+        assert json.loads(response.content)["message"] == "Invalid VRF ID"
+
+    def test_list_vrf_id_returns_400(self):
+        assert self._post([1, 2]).status_code == 400
+
+    def test_boolean_vrf_id_returns_400(self):
+        # bool is an int subclass; a JSON `true` must not silently coerce to vrf__id=1.
+        assert self._post(True).status_code == 400
+
+    def test_numeric_string_vrf_id_is_accepted(self):
+        # A digit string coerces to int and flows through the real filter without 400/500.
+        assert self._post("999999").status_code == 200
+
+
 class TestFindInCacheFailsClosed:
     """SingleIPAddressVerifyView._find_in_cache treats a truthy non-dict entry as a miss, not a crash."""
 
diff --git a/netbox_librenms_plugin/views/base/ip_addresses_view.py b/netbox_librenms_plugin/views/base/ip_addresses_view.py
index f7f5633a31..3e6ce279ad 100644
--- a/netbox_librenms_plugin/views/base/ip_addresses_view.py
+++ b/netbox_librenms_plugin/views/base/ip_addresses_view.py
@@ -541,6 +541,17 @@ def post(self, request):
 
             ip_address = data.get("ip_address")
             vrf_id = data.get("vrf_id")
+            # Coerce/validate vrf_id before it reaches IPAddress.objects.filter(vrf__id=…) in
+            # _find_existing_ip: a non-numeric (or bool) JSON value would raise ValueError there and the
+            # broad handler below would mask it as an opaque 500. Fail closed with a 400 instead. None
+            # (no VRF) is legitimate and passes through unchanged.
+            if isinstance(vrf_id, bool):
+                return JsonResponse({"status": "error", "message": "Invalid VRF ID"}, status=400)
+            if vrf_id is not None:
+                try:
+                    vrf_id = int(vrf_id)
+                except (TypeError, ValueError):
+                    return JsonResponse({"status": "error", "message": "Invalid VRF ID"}, status=400)
             # Validate the requested server key before using it as a cache namespace: an
             # unconfigured/forged key would otherwise let a caller probe arbitrary server-key cache
             # namespaces via get_cache_key(). Mirror the sync/cable membership check; anything

From 52d8745d0da994954f7cc48d0cc64bcfd26f2e2a Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Fri, 3 Jul 2026 07:02:48 +0200
Subject: [PATCH 14/17] fix(modules): validate posted server_key against
 configured servers before binding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The module install/replace/bind POST flows resolved server_key as
`(request.POST.get("server_key") or "").strip() or self.librenms_api.server_key` — handling only a
BLANK key. A forged non-blank key that names no configured server was honoured and used to scope
cache reads and to write the LibreNMS custom-field binding
(custom_field_data["librenms_id"][server_key]) under an unconfigured namespace. Every other
server-key entry point on this branch already validates against LibreNMSAPI.get_available_servers()
(the IP-verify view, the sync/cable views via resolve_requested_server_key) — the module views were
the lone gap.

Add LibreNMSAPIMixin.resolve_posted_server_key(data): honour only a configured string key, else fall
back to the ACTIVE client server (so the port-bind still runs — unlike resolve_requested_server_key,
which degrades to None for cached GET renders). Route all six module server_key resolutions
(InstallModule/InstallBranch/InstallSelected/UpdateModuleInterface/ReplaceModule POST +
ModuleMismatchPreview GET) through it. Helper test covers configured/forged/blank/missing (red→green);
the affected view tests now configure their posted "production"/"prod" server (mirrors a real
multi-server deployment).
---
 .../tests/test_mixins_helpers.py              | 41 ++++++++++++++++++-
 .../tests/test_module_replace.py              |  6 +++
 .../tests/test_sync_modules.py                | 32 +++++++++++++++
 netbox_librenms_plugin/views/mixins.py        | 24 +++++++++++
 netbox_librenms_plugin/views/sync/modules.py  | 32 +++++++--------
 5 files changed, 118 insertions(+), 17 deletions(-)

diff --git a/netbox_librenms_plugin/tests/test_mixins_helpers.py b/netbox_librenms_plugin/tests/test_mixins_helpers.py
index 14ba92fa2e..f4321701f6 100644
--- a/netbox_librenms_plugin/tests/test_mixins_helpers.py
+++ b/netbox_librenms_plugin/tests/test_mixins_helpers.py
@@ -7,7 +7,7 @@
 These exercise the real functions against the real Django cache / real plugin config — no mocks.
 """
 
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
 import pytest
 from django.core.cache import cache as real_cache
@@ -89,6 +89,45 @@ def test_missing_key_falls_back(self):
         assert view.resolve_requested_server_key({}) == view._render_server_key()
 
 
+class TestResolvePostedServerKey:
+    """resolve_posted_server_key honours only a configured key, else falls back to the ACTIVE server.
+
+    Unlike resolve_requested_server_key (which degrades to _render_server_key()/None for GET renders),
+    the module install/bind ACTION paths fall back to the active client server so the port-bind still
+    runs — but a forged non-blank key must still be rejected so a binding is never written under an
+    unconfigured namespace.
+    """
+
+    def _view(self, active="active-server"):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        view = DeviceInterfaceTableView()
+        view._librenms_api = MagicMock(server_key=active)  # the active-server boundary
+        return view
+
+    def test_configured_key_is_honoured(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"prod": "Prod", "default": "Default"}):
+            assert view.resolve_posted_server_key({"server_key": "prod"}) == "prod"
+
+    def test_forged_nonblank_key_falls_back_to_active(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"default": "Default"}):
+            # 'evil' names no configured server → must NOT be honoured (would scope a bind under a
+            # bogus namespace); fall back to the active server instead.
+            assert view.resolve_posted_server_key({"server_key": "evil"}) == "active-server"
+
+    def test_blank_key_falls_back_to_active(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"default": "Default"}):
+            assert view.resolve_posted_server_key({"server_key": "   "}) == "active-server"
+
+    def test_missing_key_falls_back_to_active(self):
+        view = self._view()
+        with patch.object(LibreNMSAPI, "get_available_servers", return_value={"default": "Default"}):
+            assert view.resolve_posted_server_key({}) == "active-server"
+
+
 class TestGetLiveDeviceInfo:
     """get_live_device_info centralizes the write-path rule: always fetch uncached (use_cache=False)."""
 
diff --git a/netbox_librenms_plugin/tests/test_module_replace.py b/netbox_librenms_plugin/tests/test_module_replace.py
index 353e95415a..63439b3439 100644
--- a/netbox_librenms_plugin/tests/test_module_replace.py
+++ b/netbox_librenms_plugin/tests/test_module_replace.py
@@ -400,6 +400,12 @@ def test_replace_deletes_old_and_creates_new(self):
         with (
             patch("netbox_librenms_plugin.views.sync.modules.get_object_or_404", side_effect=[device, installed]),
             patch.object(view, "require_all_permissions", return_value=None),
+            # "prod" must be a configured server for resolve_posted_server_key to honour the posted key
+            # (else it degrades to the active "default"); mirrors a real multi-server deployment.
+            patch(
+                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
+                return_value={"prod": "Prod", "default": "Default"},
+            ),
             patch.object(view, "get_cache_key", return_value="ck") as mock_get_cache_key,
             patch(
                 "netbox_librenms_plugin.views.sync.modules._get_sync_device_for_inventory",
diff --git a/netbox_librenms_plugin/tests/test_sync_modules.py b/netbox_librenms_plugin/tests/test_sync_modules.py
index 425678ff8d..71ae680711 100644
--- a/netbox_librenms_plugin/tests/test_sync_modules.py
+++ b/netbox_librenms_plugin/tests/test_sync_modules.py
@@ -1479,6 +1479,22 @@ class TestAdoptMergesRawDuplicateInterface:
     LibreNMS port binding off the raw twin, and delete the now-redundant raw twin.
     """
 
+    @pytest.fixture(autouse=True)
+    def _configure_production_server(self):
+        # These tests post server_key="production"; resolve_posted_server_key now validates the posted
+        # key against the configured servers before honouring it, so "production" must be configured or
+        # it degrades to the active server. Configuring it mirrors a real multi-server deployment.
+        # Patch get_plugin_config (the seam BOTH LibreNMSAPI.__init__ and get_available_servers read),
+        # not just the get_available_servers classmethod: the panel-render path in some of these tests
+        # constructs a real LibreNMSAPI("production"), which __init__ validates against get_plugin_config
+        # — so "production" must be a fully configured server (url+token), else the render KeyErrors.
+        servers = {
+            "default": {"librenms_url": "https://librenms.example.com", "api_token": "test-token"},
+            "production": {"librenms_url": "https://prod.example.com", "api_token": "prod-token"},
+        }
+        with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", return_value=servers):
+            yield
+
     def _build(self):
         from dcim.models import (
             Cable,
@@ -2080,6 +2096,22 @@ def _rename(sender, device, module, names, **kwargs):  # noqa: ARG001
 class TestSingleInstallInterfaceBinding:
     """Single-row install should resolve inventory identity and bind interfaces."""
 
+    @pytest.fixture(autouse=True)
+    def _configure_production_server(self):
+        # These tests post server_key="production"; resolve_posted_server_key now validates it against
+        # the configured servers before honouring it, so "production" must be configured or it degrades
+        # to the active server. Configuring it mirrors a real multi-server deployment.
+        # Patch get_plugin_config (the seam BOTH LibreNMSAPI.__init__ and get_available_servers read),
+        # not just the get_available_servers classmethod: the panel-render path in some of these tests
+        # constructs a real LibreNMSAPI("production"), which __init__ validates against get_plugin_config
+        # — so "production" must be a fully configured server (url+token), else the render KeyErrors.
+        servers = {
+            "default": {"librenms_url": "https://librenms.example.com", "api_token": "test-token"},
+            "production": {"librenms_url": "https://prod.example.com", "api_token": "prod-token"},
+        }
+        with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", return_value=servers):
+            yield
+
     def test_resolve_single_install_binding_item_uses_cache_row_by_ent_index(self):
         from netbox_librenms_plugin.views.sync.modules import _resolve_single_install_binding_item
 
diff --git a/netbox_librenms_plugin/views/mixins.py b/netbox_librenms_plugin/views/mixins.py
index 6fd4f81b0f..f3609b2ab7 100644
--- a/netbox_librenms_plugin/views/mixins.py
+++ b/netbox_librenms_plugin/views/mixins.py
@@ -388,6 +388,30 @@ def resolve_requested_server_key(self, data):
             return requested_server_key
         return self._render_server_key()
 
+    def resolve_posted_server_key(self, data):
+        """
+        Resolve a requested server key for an ACTION path, degrading to the ACTIVE server.
+
+        The module install/replace/bind flows scope cache reads AND write LibreNMS custom-field
+        bindings (``custom_field_data["librenms_id"][server_key]``) under this key. A blank fallback
+        alone is not enough: a forged *non-blank* key that names no configured server would otherwise be
+        honoured and address an unconfigured namespace. Only a configured string key is honoured; blank,
+        non-string, or unrecognised falls back to ``self.librenms_api.server_key`` — the active client
+        server — so the port-bind still runs (unlike :meth:`resolve_requested_server_key`, which degrades
+        to ``None`` for cached GET *renders*).
+
+        Args:
+            data: A dict-like request payload (``request.POST`` or ``request.GET``) carrying an optional
+                ``server_key``.
+
+        Returns:
+            str: The validated posted key, or the active-server key.
+        """
+        requested_server_key = (data.get("server_key") or "").strip()
+        if requested_server_key and requested_server_key in LibreNMSAPI.get_available_servers():
+            return requested_server_key
+        return self.librenms_api.server_key
+
     def get_live_device_info(self, librenms_id):
         """
         Fetch LIVE LibreNMS device info for a write path (``use_cache=False``).
diff --git a/netbox_librenms_plugin/views/sync/modules.py b/netbox_librenms_plugin/views/sync/modules.py
index dd61a6f5ff..943b86998c 100644
--- a/netbox_librenms_plugin/views/sync/modules.py
+++ b/netbox_librenms_plugin/views/sync/modules.py
@@ -710,12 +710,12 @@ def post(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        # Fall back to the resolved client server (like InstallBranchView / InstallSelectedView /
-        # ReplaceModuleView) when the form posts a blank server_key — e.g. a fallback render where
-        # module_sync.server_key is empty. Without it, `if bind_item and server_key` below is skipped
-        # and the module installs but its matching interface is never bound to its LibreNMS port_id,
-        # with no error surfaced.
-        server_key = (request.POST.get("server_key") or "").strip() or self.librenms_api.server_key
+        # Validate the posted server_key against configured servers, else fall back to the active
+        # client server (resolve_posted_server_key). A blank key (e.g. a fallback render where
+        # module_sync.server_key is empty) OR a forged/unconfigured one must degrade rather than scope
+        # the bind under a bogus namespace — without a usable key `if bind_item and server_key` below is
+        # skipped and the module installs but its interface is never bound to its LibreNMS port_id.
+        server_key = self.resolve_posted_server_key(request.POST)
         bind_item = _resolve_single_install_binding_item(request, target_device, server_key, self.get_cache_key)
         serial = request.POST.get("serial", "").strip()
         if serial.lower() in _PLACEHOLDER_VALUES:
@@ -829,7 +829,7 @@ def post(self, request, pk):
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
         parent_index = request.POST.get("parent_index")
-        server_key = request.POST.get("server_key") or self.librenms_api.server_key
+        server_key = self.resolve_posted_server_key(request.POST)
         sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": pk})
 
         if not parent_index:
@@ -1309,7 +1309,7 @@ def post(self, request, pk):
             return error
 
         page_device = get_object_or_404(Device, pk=pk)
-        server_key = request.POST.get("server_key") or self.librenms_api.server_key
+        server_key = self.resolve_posted_server_key(request.POST)
         sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": pk})
 
         selected_indices = request.POST.getlist("select")
@@ -1503,12 +1503,12 @@ def post(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        # Fall back to the resolved client server (mirrors InstallModuleView) when the form
-        # posts a blank server_key — e.g. a stale tab or a fallback render where
-        # module_sync.server_key is empty. Without it the port-bind is skipped AND the
-        # adopt/merge runs without a server scope, so the raw twin's LibreNMS binding
-        # cannot be transferred onto the adopted interface.
-        server_key = (request.POST.get("server_key") or "").strip() or self.librenms_api.server_key
+        # Validate the posted server_key against configured servers, else fall back to the active
+        # client server (mirrors InstallModuleView via resolve_posted_server_key). A blank key (stale
+        # tab / fallback render) OR a forged/unconfigured one degrades to the active server rather than
+        # scoping under a bogus namespace. Without a usable key the port-bind is skipped AND the
+        # adopt/merge runs without a server scope, so the raw twin's LibreNMS binding can't transfer.
+        server_key = self.resolve_posted_server_key(request.POST)
         bind_item = _resolve_single_install_binding_item(request, target_device, server_key, self.get_cache_key)
         sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": pk})
 
@@ -1636,7 +1636,7 @@ def get(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        server_key = request.GET.get("server_key") or self.librenms_api.server_key
+        server_key = self.resolve_posted_server_key(request.GET)
 
         try:
             module_id = int(request.GET.get("module_id"))
@@ -1808,7 +1808,7 @@ def post(self, request, pk):
         )
         if invalid_selected_device:
             _warn_invalid_selected_device(request)
-        server_key = request.POST.get("server_key") or self.librenms_api.server_key
+        server_key = self.resolve_posted_server_key(request.POST)
         sync_url = reverse("plugins:netbox_librenms_plugin:device_librenms_sync", kwargs={"pk": pk})
 
         try:

From dabaa2b8a4a29568268d89e06f93f34c2d407c9c Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Fri, 3 Jul 2026 07:02:49 +0200
Subject: [PATCH 15/17] test: relocate reviewer-fix regressions to their home
 suites, drop duplicates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A prior partial move (b15fe5365) scattered copies of these tests into module-specific files but left
test_reviewer_fixes.py in place with the originals — so several classes existed in two files at once
(CodeRabbit flagged TestSingleCableVerifyServerKey as a verbatim duplicate). Finish the job so each of
the 8 classes lives in exactly one home:

- normalize-mapping + create-platform-full-clean → test_coverage_device_fields
- generate/load VC member name → test_virtual_chassis
- all-server-mappings validation → test_coverage_sync_view (beside TestBuildAllServerMappings)
- render-device-selection escape → test_coverage_tables
- Drop the two verbatim duplicates (SingleCableVerifyServerKey, ImportSingleDeviceLazyValidation) —
  canonical copies already live in test_view_wiring / test_import_utils; also remove the misplaced
  copies the prior move had dumped into test_view_wiring.
- Delete test_reviewer_fixes.py.

De-mock where the real object drives the behaviour: the render-escape test builds a real virtual
chassis + a real member Device with an XSS name; the VC-member-name loader reads a real LibreNMSSettings
row (resolved via apps.get_model and restored over the session-wide LibreNMSSettings mock for the
loader's deferred import). None/boolean/DB-error cases keep a mock — a NOT-NULL CharField cannot hold
those values. Full suite green (3337).
---
 .../tests/test_coverage_device_fields.py      | 102 ++++
 .../tests/test_coverage_sync_view.py          |  54 +++
 .../tests/test_coverage_tables.py             |  39 ++
 .../tests/test_reviewer_fixes.py              | 447 ------------------
 .../tests/test_view_wiring.py                 |  86 ----
 .../tests/test_virtual_chassis.py             |  66 ++-
 6 files changed, 241 insertions(+), 553 deletions(-)
 delete mode 100644 netbox_librenms_plugin/tests/test_reviewer_fixes.py

diff --git a/netbox_librenms_plugin/tests/test_coverage_device_fields.py b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
index 67ec016b58..7ed7602445 100644
--- a/netbox_librenms_plugin/tests/test_coverage_device_fields.py
+++ b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
@@ -2371,3 +2371,105 @@ def test_remove_server_mapping_has_required_object_permissions(self):
         from netbox_librenms_plugin.views.sync.device_fields import RemoveServerMappingView
 
         assert "POST" in RemoveServerMappingView.required_object_permissions
+
+
+# ---------------------------------------------------------------------------
+# _normalize_librenms_mapping
+# ---------------------------------------------------------------------------
+class TestNormalizeLibreNMSMapping:
+    """_normalize_librenms_mapping must reject booleans and non-digit strings."""
+
+    def _call(self, value):
+        # Instantiate the view class minimally to access the method
+        from netbox_librenms_plugin.views.sync.device_fields import RemoveServerMappingView
+
+        view = object.__new__(RemoveServerMappingView)
+        return view._normalize_librenms_mapping(value)
+
+    def test_int_becomes_default_dict(self):
+        assert self._call(42) == {"default": 42}
+
+    def test_bool_true_returns_empty(self):
+        assert self._call(True) == {}
+
+    def test_bool_false_returns_empty(self):
+        assert self._call(False) == {}
+
+    def test_digit_string_coerced(self):
+        assert self._call("42") == {"default": 42}
+
+    def test_non_digit_string_returns_empty(self):
+        assert self._call("not-a-number") == {}
+
+    def test_plus_prefix_rejected(self):
+        """'+1' is not strictly digit-only."""
+        assert self._call("+1") == {}
+
+    def test_space_padded_rejected(self):
+        """' 42 ' is not strictly digit-only."""
+        assert self._call(" 42 ") == {}
+
+    def test_dict_passed_through(self):
+        d = {"production": 7}
+        assert self._call(d) is d
+
+    def test_none_returns_empty(self):
+        assert self._call(None) == {}
+
+    def test_list_returns_empty(self):
+        assert self._call([1, 2]) == {}
+
+
+# ---------------------------------------------------------------------------
+# CreateAndAssignPlatformView — full_clean before save
+# ---------------------------------------------------------------------------
+class TestCreatePlatformFullClean:
+    """CreateAndAssignPlatformView must surface a real Platform.full_clean() ValidationError, not 500."""
+
+    @staticmethod
+    def _make_device(name):
+        """Create a minimal real Device (this branch predates the conftest real-DB builders)."""
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
+
+        site, _ = Site.objects.get_or_create(name="PFTestSite", slug="pf-test-site")
+        mfr, _ = Manufacturer.objects.get_or_create(name="PFTestMfr", slug="pf-test-mfr")
+        dtype, _ = DeviceType.objects.get_or_create(model="PFTestDT", slug="pf-test-dt", defaults={"manufacturer": mfr})
+        role, _ = DeviceRole.objects.get_or_create(name="PFTestRole", slug="pf-test-role", defaults={"color": "00ff00"})
+        return Device.objects.create(name=name, device_type=dtype, role=role, site=site, status="active")
+
+    @pytest.mark.django_db
+    def test_real_slug_collision_is_caught_and_reported(self):
+        """A real slug collision (different name, same slugify) is rejected by Platform.full_clean() and reported, not 500'd."""
+        from dcim.models import Platform
+
+        from netbox_librenms_plugin.views.sync.device_fields import CreateAndAssignPlatformView
+
+        device = self._make_device("platform-collision-dev")
+        # An existing platform already owns the slug "test-platform".
+        Platform.objects.create(name="Existing Platform", slug="test-platform")
+
+        view = object.__new__(CreateAndAssignPlatformView)
+        view.require_all_permissions = MagicMock(return_value=None)  # the permission boundary
+        request = MagicMock()
+        request.method = "POST"
+        # A DIFFERENT name that slugifies to the SAME slug: passes the name-exists short-circuit
+        # but trips the real Platform.full_clean() unique-slug validation.
+        request.POST = {"platform_name": "Test Platform"}
+        view.request = request
+
+        with (
+            patch("netbox_librenms_plugin.views.sync.device_fields.messages") as mock_messages,
+            patch("netbox_librenms_plugin.views.sync.device_fields.redirect", return_value="redirected"),
+        ):
+            result = view.post(request, pk=device.pk)
+
+        # The real full_clean() rejected the duplicate slug — no second platform was created...
+        assert Platform.objects.filter(slug="test-platform").count() == 1
+        assert not Platform.objects.filter(name="Test Platform").exists()
+        # ...and the device's platform was left unset (the create rolled back before assignment).
+        device.refresh_from_db()
+        assert device.platform_id is None
+        # The user is shown the caught error, not a 500.
+        assert result == "redirected"
+        mock_messages.error.assert_called_once()
+        assert "could not be created" in mock_messages.error.call_args[0][1]
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_view.py b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
index 18ef8ee58c..c2d016a33a 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_view.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
@@ -510,6 +510,60 @@ def test_malformed_server_config_treated_as_unconfigured(self):
         assert result[0]["is_configured"] is False
 
 
+class TestAllServerMappingsDidValidation:
+    """all_server_mappings must skip invalid device IDs in the cf_value dict."""
+
+    def _call(self, obj, active_server_key="default"):
+        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
+
+        return BaseLibreNMSSyncView._build_all_server_mappings(obj, active_server_key)
+
+    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
+    def test_skips_boolean_did(self, mock_settings):
+        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
+        obj = MagicMock()
+        obj.custom_field_data = {"librenms_id": {"default": True, "prod": 42}}
+        result = self._call(obj)
+        # Only prod=42 should survive
+        assert len(result) == 1
+        assert result[0]["device_id"] == 42
+
+    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
+    def test_skips_none_did(self, mock_settings):
+        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
+        obj = MagicMock()
+        obj.custom_field_data = {"librenms_id": {"default": None}}
+        result = self._call(obj)
+        assert result is None  # empty list → returns None
+
+    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
+    def test_coerces_digit_string_did(self, mock_settings):
+        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
+        obj = MagicMock()
+        obj.custom_field_data = {"librenms_id": {"prod": "99"}}
+        result = self._call(obj)
+        assert len(result) == 1
+        assert result[0]["device_id"] == 99
+
+    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
+    def test_skips_non_digit_string_did(self, mock_settings):
+        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
+        obj = MagicMock()
+        obj.custom_field_data = {"librenms_id": {"default": "bogus"}}
+        result = self._call(obj)
+        assert result is None
+
+    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
+    def test_valid_int_passes_through(self, mock_settings):
+        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
+        obj = MagicMock()
+        obj.custom_field_data = {"librenms_id": {"default": 5, "secondary": 10}}
+        result = self._call(obj)
+        assert len(result) == 2
+        ids = {e["device_id"] for e in result}
+        assert ids == {5, 10}
+
+
 class TestGetLibreNMSDeviceInfo:
     """Tests for get_librenms_device_info (lines 228+)."""
 
diff --git a/netbox_librenms_plugin/tests/test_coverage_tables.py b/netbox_librenms_plugin/tests/test_coverage_tables.py
index 6116f4fcd2..145c700ba3 100644
--- a/netbox_librenms_plugin/tests/test_coverage_tables.py
+++ b/netbox_librenms_plugin/tests/test_coverage_tables.py
@@ -14,6 +14,8 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -2729,3 +2731,40 @@ def test_render_vlans_escapes_malicious_vid_when_missing(self):
         rendered = str(table.render_vlans(value=None, record=record))
         assert "<img" not in rendered
         assert "&lt;img" in rendered
+
+
+# ---------------------------------------------------------------------------
+# render_device_selection — XSS escape
+# ---------------------------------------------------------------------------
+@pytest.mark.django_db
+class TestRenderDeviceSelectionEscape:
+    """VCCableTable.render_device_selection must HTML-escape a virtual-chassis member's name."""
+
+    def test_member_name_is_escaped(self):
+        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site, VirtualChassis
+
+        from netbox_librenms_plugin.tables.cables import VCCableTable
+
+        mfr, _ = Manufacturer.objects.get_or_create(name="XssMfr", slug="xssmfr")
+        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model="XssDT", slug="xssdt")
+        role, _ = DeviceRole.objects.get_or_create(name="XssRole", slug="xssrole")
+        site, _ = Site.objects.get_or_create(name="XssSite", slug="xsssite")
+        vc = VirtualChassis.objects.create(name="XssVC")
+        member = Device.objects.create(
+            name='<script>alert("xss")</script>',
+            device_type=dt,
+            role=role,
+            site=site,
+            status="active",
+            virtual_chassis=vc,
+            vc_position=1,
+        )
+
+        # The device IS a VC member, so device.virtual_chassis.members.all() includes it and its
+        # (malicious) name flows into the dropdown options cached in __init__.
+        table = VCCableTable([], device=member)
+        html = str(table.render_device_selection(None, {"local_port": "eth0", "local_port_id": "42"}))
+
+        # The raw <script> tag must NOT appear — it should be escaped.
+        assert "<script>" not in html
+        assert "&lt;script&gt;" in html
diff --git a/netbox_librenms_plugin/tests/test_reviewer_fixes.py b/netbox_librenms_plugin/tests/test_reviewer_fixes.py
deleted file mode 100644
index c530404e8e..0000000000
--- a/netbox_librenms_plugin/tests/test_reviewer_fixes.py
+++ /dev/null
@@ -1,447 +0,0 @@
-"""
-Regression tests for reviewer-requested fixes.
-
-Covers: _load_vc_member_name_pattern validation, _generate_vc_member_name pattern
-handling, _normalize_librenms_mapping guards, all_server_mappings did validation,
-render_device_selection XSS escape, SingleCableVerifyView server_key from POST,
-import_single_device lazy validation api passthrough, CreateAndAssignPlatformView
-full_clean before save.
-"""
-
-from unittest.mock import MagicMock, patch
-
-import pytest
-
-
-# ---------------------------------------------------------------------------
-# _load_vc_member_name_pattern
-# ---------------------------------------------------------------------------
-class TestLoadVcMemberNamePattern:
-    """_load_vc_member_name_pattern must return valid string or default."""
-
-    DEFAULT = "-M{position}"
-
-    def _call(self):
-        from netbox_librenms_plugin.import_utils.virtual_chassis import _load_vc_member_name_pattern
-
-        return _load_vc_member_name_pattern()
-
-    def _patch_settings(self, settings_obj):
-        """Patch the deferred import of LibreNMSSettings inside the function."""
-        return patch(
-            "netbox_librenms_plugin.models.LibreNMSSettings.objects",
-            **{"order_by.return_value.first.return_value": settings_obj},
-        )
-
-    def test_returns_valid_pattern(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = "-SW{position}"
-        with self._patch_settings(settings):
-            assert self._call() == "-SW{position}"
-
-    def test_returns_default_for_none_pattern(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = None
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
-
-    def test_returns_default_for_empty_string(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = ""
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
-
-    def test_returns_default_for_whitespace_only(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = "   "
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
-
-    def test_returns_default_for_boolean(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = True
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
-
-    def test_returns_default_when_no_settings(self):
-        with self._patch_settings(None):
-            assert self._call() == self.DEFAULT
-
-    def test_returns_default_on_exception(self):
-        with patch(
-            "netbox_librenms_plugin.models.LibreNMSSettings.objects",
-        ) as mock_objs:
-            mock_objs.order_by.side_effect = RuntimeError("db error")
-            assert self._call() == self.DEFAULT
-
-
-# ---------------------------------------------------------------------------
-# _normalize_librenms_mapping
-# ---------------------------------------------------------------------------
-class TestNormalizeLibreNMSMapping:
-    """_normalize_librenms_mapping must reject booleans and non-digit strings."""
-
-    def _call(self, value):
-        # Instantiate the view class minimally to access the method
-        from netbox_librenms_plugin.views.sync.device_fields import RemoveServerMappingView
-
-        view = object.__new__(RemoveServerMappingView)
-        return view._normalize_librenms_mapping(value)
-
-    def test_int_becomes_default_dict(self):
-        assert self._call(42) == {"default": 42}
-
-    def test_bool_true_returns_empty(self):
-        assert self._call(True) == {}
-
-    def test_bool_false_returns_empty(self):
-        assert self._call(False) == {}
-
-    def test_digit_string_coerced(self):
-        assert self._call("42") == {"default": 42}
-
-    def test_non_digit_string_returns_empty(self):
-        assert self._call("not-a-number") == {}
-
-    def test_plus_prefix_rejected(self):
-        """'+1' is not strictly digit-only."""
-        assert self._call("+1") == {}
-
-    def test_space_padded_rejected(self):
-        """' 42 ' is not strictly digit-only."""
-        assert self._call(" 42 ") == {}
-
-    def test_dict_passed_through(self):
-        d = {"production": 7}
-        assert self._call(d) is d
-
-    def test_none_returns_empty(self):
-        assert self._call(None) == {}
-
-    def test_list_returns_empty(self):
-        assert self._call([1, 2]) == {}
-
-
-# ---------------------------------------------------------------------------
-# all_server_mappings — did validation
-# ---------------------------------------------------------------------------
-class TestAllServerMappingsDidValidation:
-    """all_server_mappings must skip invalid device IDs in the cf_value dict."""
-
-    def _call(self, obj, active_server_key="default"):
-        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
-
-        return BaseLibreNMSSyncView._build_all_server_mappings(obj, active_server_key)
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_boolean_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": True, "prod": 42}}
-        result = self._call(obj)
-        # Only prod=42 should survive
-        assert len(result) == 1
-        assert result[0]["device_id"] == 42
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_none_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": None}}
-        result = self._call(obj)
-        assert result is None  # empty list → returns None
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_coerces_digit_string_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"prod": "99"}}
-        result = self._call(obj)
-        assert len(result) == 1
-        assert result[0]["device_id"] == 99
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_non_digit_string_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": "bogus"}}
-        result = self._call(obj)
-        assert result is None
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_valid_int_passes_through(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": 5, "secondary": 10}}
-        result = self._call(obj)
-        assert len(result) == 2
-        ids = {e["device_id"] for e in result}
-        assert ids == {5, 10}
-
-
-# ---------------------------------------------------------------------------
-# render_device_selection — XSS escape
-# ---------------------------------------------------------------------------
-class TestRenderDeviceSelectionEscape:
-    """render_device_selection must HTML-escape member.name."""
-
-    def test_member_name_is_escaped(self):
-        from netbox_librenms_plugin.tables.cables import VCCableTable
-
-        device = MagicMock()
-        device.id = 1
-        vc = MagicMock()
-        member = MagicMock()
-        member.id = 1
-        member.name = '<script>alert("xss")</script>'
-        vc.members.all.return_value = [member]
-        device.virtual_chassis = vc
-
-        # The dropdown options render from the member set cached in __init__.
-        table = VCCableTable([], device=device)
-        record = {"local_port": "eth0", "local_port_id": "42"}
-        html = str(table.render_device_selection(None, record))
-
-        # The raw <script> tag must NOT appear — it should be escaped
-        assert "<script>" not in html
-        assert "&lt;script&gt;" in html
-
-
-# ---------------------------------------------------------------------------
-# _generate_vc_member_name — pattern handling
-# ---------------------------------------------------------------------------
-class TestGenerateVcMemberName:
-    """_generate_vc_member_name must respect caller-supplied pattern and catch format errors."""
-
-    def _call(self, master_name, position, serial=None, pattern=None):
-        from netbox_librenms_plugin.import_utils.virtual_chassis import _generate_vc_member_name
-
-        return _generate_vc_member_name(master_name, position, serial=serial, pattern=pattern)
-
-    def test_explicit_pattern_used(self):
-        """When pattern is passed, it should be used directly (no DB query)."""
-        result = self._call("switch01", 2, pattern="-SW{position}")
-        assert result == "switch01-SW2"
-
-    def test_serial_in_pattern(self):
-        result = self._call("switch01", 2, serial="ABC123", pattern=" [{serial}]")
-        assert result == "switch01 [ABC123]"
-
-    def test_none_pattern_loads_from_settings(self):
-        """When pattern is None, _load_vc_member_name_pattern is called."""
-        with patch(
-            "netbox_librenms_plugin.import_utils.virtual_chassis._load_vc_member_name_pattern",
-            return_value="-STACK{position}",
-        ):
-            result = self._call("core01", 3, pattern=None)
-        assert result == "core01-STACK3"
-
-    def test_malformed_pattern_falls_back_to_default(self):
-        """Invalid format spec falls back to -M{position}."""
-        result = self._call("switch01", 2, pattern="{position!z}")
-        assert result == "switch01-M2"
-
-    def test_missing_key_falls_back_to_default(self):
-        """Unknown placeholder falls back to -M{position}."""
-        result = self._call("switch01", 2, pattern="-{unknown_key}")
-        assert result == "switch01-M2"
-
-    def test_default_pattern(self):
-        result = self._call("switch01", 2, pattern="-M{position}")
-        assert result == "switch01-M2"
-
-
-# ---------------------------------------------------------------------------
-# SingleCableVerifyView — server_key from POST body
-# ---------------------------------------------------------------------------
-class TestSingleCableVerifyServerKey:
-    """SingleCableVerifyView.post() must thread server_key from the POST body into VC resolution + cache key."""
-
-    @staticmethod
-    def _vc_device(tag):
-        """A real Device that belongs to a VirtualChassis (so post() takes the VC sync-resolution branch)."""
-        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site, VirtualChassis
-
-        mfr, _ = Manufacturer.objects.get_or_create(name=f"SkMfr-{tag}", slug=f"skmfr-{tag}")
-        dt, _ = DeviceType.objects.get_or_create(manufacturer=mfr, model=f"SkDT-{tag}", slug=f"skdt-{tag}")
-        role, _ = DeviceRole.objects.get_or_create(name="SkRole", slug="skrole")
-        site, _ = Site.objects.get_or_create(name="SkSite", slug="sksite")
-        vc = VirtualChassis.objects.create(name=f"SkVC-{tag}")
-        return Device.objects.create(
-            name=f"sk-{tag}", device_type=dt, role=role, site=site, status="active", virtual_chassis=vc, vc_position=1
-        )
-
-    @staticmethod
-    def _view_and_request(device, body, *, api_server_key):
-        """Real view + real superuser request; _librenms_api is stubbed only to supply the active-server key."""
-        import json
-        from unittest.mock import MagicMock
-
-        from django.contrib.auth import get_user_model
-        from django.test import RequestFactory
-
-        from netbox_librenms_plugin.views.base.cables_view import SingleCableVerifyView
-
-        view = SingleCableVerifyView()
-        view._librenms_api = MagicMock()
-        view._librenms_api.server_key = api_server_key  # config boundary: the active-server fallback
-        request = RequestFactory().post("/verify-cable/", data=json.dumps(body), content_type="application/json")
-        request.user = get_user_model().objects.create_superuser(username=f"sk-{device.pk}", email="", password="x")
-        view.request = request
-        view.kwargs = {}
-        view.args = ()
-        return view, request
-
-    @pytest.mark.django_db
-    def test_server_key_used_for_cache_lookup(self):
-        """The POSTed server_key is threaded into get_librenms_sync_device and the (real) cache key."""
-        from unittest.mock import patch
-
-        device = self._vc_device("used")
-        view, request = self._view_and_request(
-            device,
-            {"device_id": device.pk, "local_port_id": "42", "server_key": "production"},
-            api_server_key="default-server",
-        )
-
-        with (
-            # The posted key is honoured only when it names a configured server; post() checks the
-            # LibreNMSAPI.get_available_servers() CLASSMETHOD (not the instance).
-            patch(
-                "netbox_librenms_plugin.librenms_api.LibreNMSAPI.get_available_servers",
-                return_value={"production": "Production"},
-            ),
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device", return_value=device
-            ) as mock_sync_device,
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-        ):
-            mock_cache.get.return_value = None  # no cached data -> early return once the key is built
-            view.post(request)
-
-            # get_librenms_sync_device gets the posted server_key (device compares by pk via Model.__eq__)
-            mock_sync_device.assert_called_once_with(device, server_key="production")
-            # the real cache key also carries the posted server_key (not the active default)
-            cache_key_arg = mock_cache.get.call_args[0][0]
-            assert "production" in cache_key_arg
-
-    @pytest.mark.django_db
-    def test_fallback_to_api_server_key(self):
-        """With no server_key in the POST body, post() falls back to the active-server key."""
-        from unittest.mock import patch
-
-        device = self._vc_device("fallback")
-        view, request = self._view_and_request(
-            device, {"device_id": device.pk, "local_port_id": "42"}, api_server_key="fallback-server"
-        )
-
-        with (
-            patch(
-                "netbox_librenms_plugin.views.base.cables_view.get_librenms_sync_device",
-                side_effect=lambda dev, **kw: dev,
-            ) as mock_sync_device,
-            patch("netbox_librenms_plugin.views.base.cables_view.cache") as mock_cache,
-        ):
-            mock_cache.get.return_value = None
-            view.post(request)
-
-            mock_sync_device.assert_called_once()
-            assert mock_sync_device.call_args[1]["server_key"] == "fallback-server"
-            cache_key_arg = mock_cache.get.call_args[0][0]
-            assert "fallback-server" in cache_key_arg
-
-
-# ---------------------------------------------------------------------------
-# import_single_device — lazy validation passes api
-# ---------------------------------------------------------------------------
-class TestImportSingleDeviceLazyValidation:
-    """import_single_device must pass api=api to validate_device_for_import when validation is None."""
-
-    def test_api_passed_to_validate(self):
-        from netbox_librenms_plugin.import_utils.device_operations import import_single_device
-
-        mock_api = MagicMock()
-        mock_api.server_key = "prod"
-
-        mock_validation = {
-            "existing_device": MagicMock(name="existing"),
-            "can_import": False,
-        }
-
-        with (
-            patch(
-                "netbox_librenms_plugin.import_utils.device_operations.LibreNMSAPI",
-                return_value=mock_api,
-            ),
-            patch(
-                "netbox_librenms_plugin.import_utils.device_operations.validate_device_for_import",
-                return_value=mock_validation,
-            ) as mock_validate,
-        ):
-            # Call with validation=None so lazy path triggers
-            import_single_device(
-                42,
-                server_key="prod",
-                sync_options={"use_sysname": True, "strip_domain": False},
-                validation=None,
-                libre_device={"device_id": 42, "hostname": "test"},
-            )
-
-            mock_validate.assert_called_once()
-            # api must be passed as keyword arg
-            assert mock_validate.call_args[1].get("api") is mock_api
-
-
-# ---------------------------------------------------------------------------
-# CreateAndAssignPlatformView — full_clean before save
-# ---------------------------------------------------------------------------
-class TestCreatePlatformFullClean:
-    """CreateAndAssignPlatformView must surface a real Platform.full_clean() ValidationError, not 500."""
-
-    @staticmethod
-    def _make_device(name):
-        """Create a minimal real Device (this branch predates the conftest real-DB builders)."""
-        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
-
-        site, _ = Site.objects.get_or_create(name="PFTestSite", slug="pf-test-site")
-        mfr, _ = Manufacturer.objects.get_or_create(name="PFTestMfr", slug="pf-test-mfr")
-        dtype, _ = DeviceType.objects.get_or_create(model="PFTestDT", slug="pf-test-dt", defaults={"manufacturer": mfr})
-        role, _ = DeviceRole.objects.get_or_create(name="PFTestRole", slug="pf-test-role", defaults={"color": "00ff00"})
-        return Device.objects.create(name=name, device_type=dtype, role=role, site=site, status="active")
-
-    @pytest.mark.django_db
-    def test_real_slug_collision_is_caught_and_reported(self):
-        """A real slug collision (different name, same slugify) is rejected by Platform.full_clean() and reported, not 500'd."""
-        from dcim.models import Platform
-
-        from netbox_librenms_plugin.views.sync.device_fields import CreateAndAssignPlatformView
-
-        device = self._make_device("platform-collision-dev")
-        # An existing platform already owns the slug "test-platform".
-        Platform.objects.create(name="Existing Platform", slug="test-platform")
-
-        view = object.__new__(CreateAndAssignPlatformView)
-        view.require_all_permissions = MagicMock(return_value=None)  # the permission boundary
-        request = MagicMock()
-        request.method = "POST"
-        # A DIFFERENT name that slugifies to the SAME slug: passes the name-exists short-circuit
-        # but trips the real Platform.full_clean() unique-slug validation.
-        request.POST = {"platform_name": "Test Platform"}
-        view.request = request
-
-        with (
-            patch("netbox_librenms_plugin.views.sync.device_fields.messages") as mock_messages,
-            patch("netbox_librenms_plugin.views.sync.device_fields.redirect", return_value="redirected"),
-        ):
-            result = view.post(request, pk=device.pk)
-
-        # The real full_clean() rejected the duplicate slug — no second platform was created...
-        assert Platform.objects.filter(slug="test-platform").count() == 1
-        assert not Platform.objects.filter(name="Test Platform").exists()
-        # ...and the device's platform was left unset (the create rolled back before assignment).
-        device.refresh_from_db()
-        assert device.platform_id is None
-        # The user is shown the caught error, not a 500.
-        assert result == "redirected"
-        mock_messages.error.assert_called_once()
-        assert "could not be created" in mock_messages.error.call_args[0][1]
diff --git a/netbox_librenms_plugin/tests/test_view_wiring.py b/netbox_librenms_plugin/tests/test_view_wiring.py
index 3409c6bd41..76e17be8f1 100644
--- a/netbox_librenms_plugin/tests/test_view_wiring.py
+++ b/netbox_librenms_plugin/tests/test_view_wiring.py
@@ -7,7 +7,6 @@
 
 import os
 from pathlib import Path
-from unittest.mock import MagicMock, patch
 
 import pytest
 
@@ -337,91 +336,6 @@ def test_template_compiles(self, template_path):
         self._engine.from_string(source)
 
 
-class TestRenderDeviceSelectionEscape:
-    """VCCableTable.render_device_selection must HTML-escape member.name."""
-
-    def test_member_name_is_escaped(self):
-        from unittest.mock import MagicMock
-
-        from netbox_librenms_plugin.tables.cables import VCCableTable
-
-        device = MagicMock()
-        device.id = 1
-        vc = MagicMock()
-        member = MagicMock()
-        member.id = 1
-        member.name = '<script>alert("xss")</script>'
-        vc.members.all.return_value = [member]
-        device.virtual_chassis = vc
-
-        # The dropdown options render from the member set cached in __init__.
-        table = VCCableTable([], device=device)
-        record = {"local_port": "eth0", "local_port_id": "42"}
-        html = str(table.render_device_selection(None, record))
-
-        assert "<script>" not in html
-        assert "&lt;script&gt;" in html
-
-
-class TestAllServerMappingsDidValidation:
-    """all_server_mappings must skip invalid device IDs in the cf_value dict."""
-
-    def _call(self, obj, active_server_key="default"):
-        from netbox_librenms_plugin.views.base.librenms_sync_view import BaseLibreNMSSyncView
-
-        return BaseLibreNMSSyncView._build_all_server_mappings(obj, active_server_key)
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_boolean_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": True, "prod": 42}}
-        result = self._call(obj)
-        # Only prod=42 should survive
-        assert len(result) == 1
-        assert result[0]["device_id"] == 42
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_none_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": None}}
-        result = self._call(obj)
-        assert result is None  # empty list → returns None
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_coerces_digit_string_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"prod": "99"}}
-        result = self._call(obj)
-        assert len(result) == 1
-        assert result[0]["device_id"] == 99
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_skips_non_digit_string_did(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": "bogus"}}
-        result = self._call(obj)
-        assert result is None
-
-    @patch("netbox_librenms_plugin.views.base.librenms_sync_view.django_settings")
-    def test_valid_int_passes_through(self, mock_settings):
-        mock_settings.PLUGINS_CONFIG = {"netbox_librenms_plugin": {"servers": {}}}
-        obj = MagicMock()
-        obj.custom_field_data = {"librenms_id": {"default": 5, "secondary": 10}}
-        result = self._call(obj)
-        assert len(result) == 2
-        ids = {e["device_id"] for e in result}
-        assert ids == {5, 10}
-
-
-# ---------------------------------------------------------------------------
-# render_device_selection — XSS escape
-# ---------------------------------------------------------------------------
-
-
 class TestSingleCableVerifyServerKey:
     """SingleCableVerifyView.post() must thread server_key from the POST body into VC resolution + cache key."""
 
diff --git a/netbox_librenms_plugin/tests/test_virtual_chassis.py b/netbox_librenms_plugin/tests/test_virtual_chassis.py
index 7507bca2be..3f81152bac 100644
--- a/netbox_librenms_plugin/tests/test_virtual_chassis.py
+++ b/netbox_librenms_plugin/tests/test_virtual_chassis.py
@@ -2,59 +2,85 @@
 
 from unittest.mock import MagicMock, patch
 
+import pytest
 
+
+@pytest.mark.django_db
 class TestLoadVcMemberNamePattern:
     """_load_vc_member_name_pattern must return valid string or default."""
 
     DEFAULT = "-M{position}"
 
+    @staticmethod
+    def _real_settings_model():
+        # apps.get_model returns the REAL registered model even when the session-wide
+        # mock_librenms_config autouse has patched netbox_librenms_plugin.models.LibreNMSSettings to a
+        # MagicMock — so real rows can be persisted and read back.
+        from django.apps import apps
+
+        return apps.get_model("netbox_librenms_plugin", "LibreNMSSettings")
+
     def _call(self):
         from netbox_librenms_plugin.import_utils.virtual_chassis import _load_vc_member_name_pattern
 
         return _load_vc_member_name_pattern()
 
+    def _call_real(self):
+        # The loader does a deferred `from ...models import LibreNMSSettings`, which reads the autouse
+        # mock in the full suite. Restore the real model for the duration of the call so it queries the
+        # row _store_pattern persisted (the whole point of the real-DB de-mock).
+        with patch("netbox_librenms_plugin.models.LibreNMSSettings", self._real_settings_model()):
+            return self._call()
+
+    def _store_pattern(self, pattern):
+        """Persist a single real LibreNMSSettings row carrying the given pattern."""
+        Real = self._real_settings_model()
+        Real.objects.all().delete()
+        Real.objects.create(vc_member_name_pattern=pattern)
+
     def _patch_settings(self, settings_obj):
-        """Patch the deferred import of LibreNMSSettings inside the function."""
+        """Patch the deferred LibreNMSSettings lookup for values the real CharField cannot hold."""
         return patch(
             "netbox_librenms_plugin.models.LibreNMSSettings.objects",
             **{"order_by.return_value.first.return_value": settings_obj},
         )
 
     def test_returns_valid_pattern(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = "-SW{position}"
-        with self._patch_settings(settings):
-            assert self._call() == "-SW{position}"
-
-    def test_returns_default_for_none_pattern(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = None
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
+        """A configured non-empty pattern is read back verbatim from the real settings row."""
+        self._store_pattern("-SW{position}")
+        assert self._call_real() == "-SW{position}"
 
     def test_returns_default_for_empty_string(self):
-        settings = MagicMock()
-        settings.vc_member_name_pattern = ""
-        with self._patch_settings(settings):
-            assert self._call() == self.DEFAULT
+        """An empty-string pattern in the real settings row falls back to the default."""
+        self._store_pattern("")
+        assert self._call_real() == self.DEFAULT
 
     def test_returns_default_for_whitespace_only(self):
+        """A whitespace-only pattern in the real settings row falls back to the default."""
+        self._store_pattern("   ")
+        assert self._call_real() == self.DEFAULT
+
+    def test_returns_default_when_no_settings(self):
+        """With no settings row persisted, the loader falls back to the default."""
+        self._real_settings_model().objects.all().delete()
+        assert self._call_real() == self.DEFAULT
+
+    def test_returns_default_for_none_pattern(self):
+        """A NULL pattern (unreachable via the NOT NULL CharField) falls back to the default."""
         settings = MagicMock()
-        settings.vc_member_name_pattern = "   "
+        settings.vc_member_name_pattern = None
         with self._patch_settings(settings):
             assert self._call() == self.DEFAULT
 
     def test_returns_default_for_boolean(self):
+        """A boolean pattern (the CharField would stringify it) falls back to the default."""
         settings = MagicMock()
         settings.vc_member_name_pattern = True
         with self._patch_settings(settings):
             assert self._call() == self.DEFAULT
 
-    def test_returns_default_when_no_settings(self):
-        with self._patch_settings(None):
-            assert self._call() == self.DEFAULT
-
     def test_returns_default_on_exception(self):
+        """A DB error while loading settings falls back to the default."""
         with patch(
             "netbox_librenms_plugin.models.LibreNMSSettings.objects",
         ) as mock_objs:

From 039f4db3b51b3973a676cee90a404259a3a3cd01 Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Mon, 13 Jul 2026 15:31:59 +0200
Subject: [PATCH 16/17] perf(migration): preload device_type rules once in 0011
 renormalize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

renormalize_device_type_mappings called apply_normalization_rules(scope=
"device_type") once per DeviceTypeMapping row without preloaded_rules, so it
re-queried NormalizationRule on every row — an avoidable N+1 that scales with the
number of existing mappings during upgrade.

Preload the device_type rule chain once via preload_normalization_rules() and
thread the dict into every per-row apply_normalization_rules() call, so the whole
data migration issues a constant number of rule queries. Behaviour is unchanged;
each row is still re-keyed exactly as before.

Test: test_rule_queries_are_constant_regardless_of_row_count runs the migration
over multiple mappings inside CaptureQueriesContext and asserts the
NormalizationRule query count does not scale with row count (was 1/row).
---
 .../0011_renormalize_device_type_mappings.py  | 15 ++++++--
 netbox_librenms_plugin/tests/test_utils.py    | 35 +++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
index b13f13f1bd..3c062f52df 100644
--- a/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
+++ b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
@@ -23,10 +23,17 @@ def renormalize_device_type_mappings(apps, schema_editor):
     # import/normalization: if anything is unavailable, leave rows untouched rather than corrupt
     # them (a fresh install has no rows to migrate anyway).
     try:
-        from netbox_librenms_plugin.utils import apply_normalization_rules
+        from netbox_librenms_plugin.utils import apply_normalization_rules, preload_normalization_rules
     except Exception:  # pragma: no cover - defensive
         return
 
+    # Preload the device_type rule chain ONCE. Without this, each per-row
+    # apply_normalization_rules() re-queries NormalizationRule (an avoidable N+1 that scales with
+    # the number of existing mappings); passing the preloaded dict makes the whole migration issue
+    # a constant number of rule queries. The mappings are un-scoped (manufacturer=None), matching
+    # the per-row calls below which pass no manufacturer.
+    preloaded_rules = preload_normalization_rules(scope="device_type")
+
     for mapping in DeviceTypeMapping.objects.all().iterator():
         raw = mapping.librenms_hardware or ""
         rekeyed = None
@@ -40,7 +47,11 @@ def renormalize_device_type_mappings(apps, schema_editor):
         # savepoint, so a rollback doesn't invalidate it.)
         try:
             with transaction.atomic():
-                normalized = (apply_normalization_rules(value=raw, scope="device_type") or "").strip().lower()
+                normalized = (
+                    (apply_normalization_rules(value=raw, scope="device_type", preloaded_rules=preloaded_rules) or "")
+                    .strip()
+                    .lower()
+                )
 
                 # Stored values are already lowercased (the model lowercases on save); skip when
                 # the normalization is a no-op so we don't issue pointless writes or fire signals.
diff --git a/netbox_librenms_plugin/tests/test_utils.py b/netbox_librenms_plugin/tests/test_utils.py
index fe1ef2baf9..f32db6465f 100644
--- a/netbox_librenms_plugin/tests/test_utils.py
+++ b/netbox_librenms_plugin/tests/test_utils.py
@@ -1239,6 +1239,41 @@ def flaky_save(inst, *args, **kwargs):
         assert DeviceTypeMapping.objects.filter(librenms_hardware="x-boom").exists()
         assert DeviceTypeMapping.objects.filter(librenms_hardware="good").exists()
 
+    def test_rule_queries_are_constant_regardless_of_row_count(self):
+        """The migration preloads the device_type rule chain once, so it issues a constant number of NormalizationRule queries instead of one per mapping row (N+1)."""
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT-Perf")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^raw-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        # Several rows that all get re-keyed → each would trigger its own rule fetch without the
+        # single preload. Distinct normalized targets so none collide on the unique constraint.
+        for suffix in ("a", "b", "c", "d"):
+            DeviceTypeMapping.objects.create(librenms_hardware=f"raw-{suffix}", netbox_device_type=dt)
+
+        with CaptureQueriesContext(connection) as ctx:
+            self._run_migration()
+
+        rule_queries = [q for q in ctx.captured_queries if "normalizationrule" in q["sql"].lower()]
+        # preload_normalization_rules(scope="device_type") issues exactly one NormalizationRule
+        # SELECT (unscoped, manufacturer__isnull=True); the per-row calls then read the preloaded
+        # dict with zero further queries. Before the fix this was one query PER ROW (== 4 here),
+        # scaling with install size. Assert it does not scale with the 4 rows.
+        assert len(rule_queries) <= 2, (
+            f"expected a constant number of NormalizationRule queries from the single preload, got "
+            f"{len(rule_queries)} for 4 mapping rows — the migration is re-querying rules per row (N+1)"
+        )
+        # Sanity: behaviour is unchanged — every row was still re-keyed.
+        for suffix in ("a", "b", "c", "d"):
+            assert DeviceTypeMapping.objects.filter(librenms_hardware=suffix).exists()
+
     def test_db_error_on_one_row_does_not_poison_the_rest(self, monkeypatch):
         """A real DB error on one row's save must be confined to that row's savepoint so the rest still migrate.
 

From ade244ceed97442876f3bd68f3490f333b30cb4e Mon Sep 17 00:00:00 2001
From: Marcin Zieba <marcinpsk@gmail.com>
Date: Tue, 14 Jul 2026 08:56:27 +0200
Subject: [PATCH 17/17] fix(migration): guard 0011 rule preload in its own
 savepoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 0011 renormalize migration preloads the device_type NormalizationRule
chain once (the N+1 fix) before the per-row loop. That preload issues a DB
query outside any savepoint, so a failure there aborted the whole migration
before the per-row guards ran — and, being a DB error, poisoned the outer
atomic transaction so catching it alone could not leave a clean state.

Wrap the single preload in its own transaction.atomic() savepoint and bail
out on failure, logging and leaving every row untouched, matching the
per-row savepoint pattern and the migration's "leave rows untouched"
contract. The single-preload N+1 fix is preserved. Real-DB red->green test
drives a genuine preload DB error (SELECT 1/0).
---
 .../0011_renormalize_device_type_mappings.py  | 18 +++++++-
 netbox_librenms_plugin/tests/test_utils.py    | 45 +++++++++++++++++++
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
index 3c062f52df..71b4bcb602 100644
--- a/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
+++ b/netbox_librenms_plugin/migrations/0011_renormalize_device_type_mappings.py
@@ -32,7 +32,23 @@ def renormalize_device_type_mappings(apps, schema_editor):
     # the number of existing mappings); passing the preloaded dict makes the whole migration issue
     # a constant number of rule queries. The mappings are un-scoped (manufacturer=None), matching
     # the per-row calls below which pass no manufacturer.
-    preloaded_rules = preload_normalization_rules(scope="device_type")
+    #
+    # Guard the preload the same way the per-row work is guarded: it issues a DB query, so a failure
+    # here (connection/query error mid-upgrade) would otherwise abort the whole migration BEFORE any
+    # per-row savepoint runs. And because it is a DB error, catching it alone is not enough — on
+    # PostgreSQL it poisons the migration's outer atomic transaction, so subsequent work (or the
+    # migration's own commit) would still fail. Wrap it in its own savepoint and bail out leaving
+    # every row untouched, mirroring the import guard above and the "leave rows untouched rather
+    # than corrupt them" contract.
+    try:
+        with transaction.atomic():
+            preloaded_rules = preload_normalization_rules(scope="device_type")
+    except Exception:
+        logger.exception(
+            "renormalize_device_type_mappings: failed to preload device_type normalization rules; "
+            "leaving all rows untouched."
+        )
+        return
 
     for mapping in DeviceTypeMapping.objects.all().iterator():
         raw = mapping.librenms_hardware or ""
diff --git a/netbox_librenms_plugin/tests/test_utils.py b/netbox_librenms_plugin/tests/test_utils.py
index f32db6465f..038e664768 100644
--- a/netbox_librenms_plugin/tests/test_utils.py
+++ b/netbox_librenms_plugin/tests/test_utils.py
@@ -1361,6 +1361,51 @@ def poisoned_apply(value, scope, *args, **kwargs):
         assert DeviceTypeMapping.objects.filter(librenms_hardware="z-boom").exists()
         assert DeviceTypeMapping.objects.filter(librenms_hardware="good").exists()
 
+    def test_preload_failure_leaves_all_rows_untouched(self, monkeypatch):
+        """A DB error while preloading the rule chain must leave EVERY row untouched, not abort the upgrade.
+
+        The single preload (the N+1 fix) runs once before the per-row loop and issues its own DB
+        query. A failure there (connection/query error mid-upgrade) would otherwise propagate before
+        any per-row savepoint runs — and, being a DB error, would poison the migration's outer atomic
+        transaction, so even catching the Python exception could not leave a clean state. Its own
+        savepoint must contain the failure and the migration must bail out leaving all rows at their
+        original keys. This drives a genuine DB error (SELECT 1/0) through the preload, not a Python
+        raise, so it actually exercises the savepoint.
+        """
+        from django.db import connection
+
+        from netbox_librenms_plugin import utils as plugin_utils
+        from netbox_librenms_plugin.models import DeviceTypeMapping, NormalizationRule
+
+        dt = self._device_type(model="Renorm-DT8")
+        NormalizationRule.objects.create(
+            scope=NormalizationRule.SCOPE_DEVICE_TYPE,
+            match_pattern=r"^w-(.+)$",
+            replacement=r"\1",
+            priority=10,
+        )
+        DeviceTypeMapping.objects.create(librenms_hardware="w-alpha", netbox_device_type=dt)
+        DeviceTypeMapping.objects.create(librenms_hardware="w-beta", netbox_device_type=dt)
+
+        def poisoned_preload(*args, **kwargs):
+            # A genuine DB failure in the preload query, the way a real connection/query error
+            # during upgrade would behave — recoverable only by rolling back its savepoint.
+            with connection.cursor() as cur:
+                cur.execute("SELECT 1 / 0")
+
+        # The migration imports the symbol inside the function body, so patching the module
+        # attribute is exactly what its runtime import resolves.
+        monkeypatch.setattr(plugin_utils, "preload_normalization_rules", poisoned_preload)
+
+        # Must NOT propagate the preload error out of the migration...
+        self._run_migration()
+
+        # ...and every row must be left at its original (un-normalized) key — nothing re-keyed.
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="w-alpha").exists()
+        assert DeviceTypeMapping.objects.filter(librenms_hardware="w-beta").exists()
+        assert not DeviceTypeMapping.objects.filter(librenms_hardware="alpha").exists()
+        assert not DeviceTypeMapping.objects.filter(librenms_hardware="beta").exists()
+
 
 class TestCacheRemainingTtl:
     """cache_remaining_ttl reads .ttl on django-redis and degrades to None on backends without it."""