Merge ~ack/maas:lock-unlock-machine-ui into maas:master

[Alberto Donato]

LP: #1453878 - add lock/unlock actions in the UI

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/748/console
COMMIT: 4de6a9a9df5cabced15826cfc8b3aa22fa9de318

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/749/console
COMMIT: c92eae16a19f384621ec02a05eabaf0c5e99fd19

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/750/console
COMMIT: fbf1bf948bcda4e833b54f279c6777f8e3256b34

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/751/console
COMMIT: 557739c6ee76f11ff56fba230a893832bf53bb21

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 6d70369582f2dc90e2e4722b68c2c1388f819933

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/799/console
COMMIT: aae7b4c0a64671ff468ce07c23f890f24468f8cd

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 71c00214bc5cc8bbce29fe38cae9fb4aada0766d

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 52d5ce6cbf464368ee0fc6992d985d81072cba1d

review: Approve

[Andres Rodriguez (andreserl)]

lgtm!

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/841/consoleText

[MAAS Lander (maas-lander)]

LANDING
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/843/consoleText

[MAAS Lander (maas-lander)]

LANDING
-b lock-unlock-machine-ui lp:~ack/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/865/consoleText

diff --git a/src/maasserver/node_action.py b/src/maasserver/node_action.py
index 74c8df7..5b7435c 100644
--- a/src/maasserver/node_action.py
+++ b/src/maasserver/node_action.py
@@ -108,6 +108,9 @@ class NodeAction(metaclass=ABCMeta):
     # is being applied to a node_type which is node
     node_permission = None
 
+    # Whether the action is allowed when the node is locked
+    allowed_when_locked = False
+
     def __init__(self, node, user, request=None):
         """Initialize a node action.
 
@@ -129,8 +132,11 @@ class NodeAction(metaclass=ABCMeta):
         elif (self.node_permission == NODE_PERMISSION.ADMIN and
                 not self.user.is_superuser):
             return False
+        elif self.node.locked and not self.allowed_when_locked:
+            return False
         elif self.node.node_type == NODE_TYPE.MACHINE:
             return self.node.status in self.actionable_statuses
+
         return True
 
     def inhibit(self):
@@ -498,6 +504,41 @@ class MarkFixed(NodeAction):
             return not script_failures.exists()
 
 
+class Lock(NodeAction):
+    """Lock a node."""
+
+    name = "lock"
+    display = "Lock"
+    display_sentence = "Lock"
+    actionable_statuses = (NODE_STATUS.DEPLOYED,)
+    permission = NODE_PERMISSION.LOCK
+    for_type = {NODE_TYPE.MACHINE}
+
+    def execute(self):
+        self.node.lock(self.user, "via web interface")
+
+
+class Unlock(NodeAction):
+    """Unlock a node."""
+
+    name = "unlock"
+    display = "Unlock"
+    display_sentence = "Unlock"
+    actionable_statuses = ALL_STATUSES
+    permission = NODE_PERMISSION.LOCK
+    for_type = {NODE_TYPE.MACHINE}
+    allowed_when_locked = True
+
+    def is_actionable(self):
+        if not super().is_actionable():
+            return False
+        # don't show action if not locked
+        return self.node.locked
+
+    def execute(self):
+        self.node.unlock(self.user, "via web interface")
+
+
 class OverrideFailedTesting(NodeAction):
     """Override failed tests and reset node into a usable state."""
     name = "override-failed-testing"
@@ -601,6 +642,8 @@ ACTION_CLASSES = (
     MarkBroken,
     MarkFixed,
     OverrideFailedTesting,
+    Lock,
+    Unlock,
     SetZone,
     ImportImages,
     Delete,
diff --git a/src/maasserver/static/js/angular/controllers/node_details.js b/src/maasserver/static/js/angular/controllers/node_details.js
index 1633a61..565dced 100644
--- a/src/maasserver/static/js/angular/controllers/node_details.js
+++ b/src/maasserver/static/js/angular/controllers/node_details.js
@@ -739,11 +739,21 @@ angular.module('MAAS').controller('NodeDetailsController', [
             return $scope.power_types.length > 0;
         };
 
+        // Return true if the node is locked
+        $scope.isLocked = function() {
+            if ($scope.node === null) {
+                return false;
+            }
+
+            return $scope.node.locked;
+        };
+
         // Return true when the edit buttons can be clicked.
         $scope.canEdit = function() {
             return (
                 $scope.isRackControllerConnected() &&
-                $scope.isSuperUser());
+                    $scope.isSuperUser() &&
+                    ! $scope.isLocked());
         };
 
         // Called to edit the domain name.
diff --git a/src/maasserver/static/js/angular/controllers/tests/test_node_details.js b/src/maasserver/static/js/angular/controllers/tests/test_node_details.js
index 28f4b9b..cc583d4 100644
--- a/src/maasserver/static/js/angular/controllers/tests/test_node_details.js
+++ b/src/maasserver/static/js/angular/controllers/tests/test_node_details.js
@@ -1439,6 +1439,18 @@ describe("NodeDetailsController", function() {
                     "isRackControllerConnected").and.returnValue(true);
                 expect($scope.canEdit()).toBe(true);
             });
+
+        it("returns false if machine is locked",
+           function() {
+               var controller = makeController();
+               $scope.isController = false;
+               spyOn(
+                   $scope,
+                   "isRackControllerConnected").and.returnValue(true);
+               $scope.node = makeNode();
+               $scope.node.locked = true;
+               expect($scope.canEdit()).toBe(false);
+           });
     });
 
     describe("editHeaderDomain", function() {
diff --git a/src/maasserver/static/partials/node-details.html b/src/maasserver/static/partials/node-details.html
index bcbf37e..3741be9 100755
--- a/src/maasserver/static/partials/node-details.html
+++ b/src/maasserver/static/partials/node-details.html
@@ -100,6 +100,8 @@
                                  <span data-ng-if="action.option.name === 'mark-broken'">Mark {$ type_name $}</span>
                                  <span data-ng-if="action.option.name === 'mark-fixed'">Mark {$ type_name $}</span>
                                  <span data-ng-if="action.option.name === 'override-failed-testing'">Override failed testing</span>
+                                 <span data-ng-if="action.option.name === 'lock'">Lock {$ type_name $}</span>
+                                 <span data-ng-if="action.option.name === 'unlock'">Unlock {$ type_name $}</span>
                                  <span data-ng-if="action.option.name === 'delete'">Delete {$ type_name $}</span>
                                  <span data-ng-if="action.option.name === 'import-images'">Import images</span>
                              </button>
diff --git a/src/maasserver/static/partials/nodes-list.html b/src/maasserver/static/partials/nodes-list.html
index 05cce9b..a817cf3 100644
--- a/src/maasserver/static/partials/nodes-list.html
+++ b/src/maasserver/static/partials/nodes-list.html
@@ -159,6 +159,12 @@
                         <span data-ng-if="tabs[tab].actionOption.name === 'override-failed-testing'">Override failed testing on {$ tabs[tab].selectedItems.length $}
                             <span data-ng-pluralize count="tabs[tab].selectedItems.length" when="{'one': 'machine', 'other': 'machines'}"></span>
                         </span>
+                        <span data-ng-if="tabs[tab].actionOption.name === 'lock'">Lock {$ tabs[tab].selectedItems.length $}
+                            <span data-ng-pluralize count="tabs[tab].selectedItems.length" when="{'one': 'machine', 'other': 'machines'}"></span>
+                        </span>
+                        <span data-ng-if="tabs[tab].actionOption.name === 'unlock'">Unlock {$ tabs[tab].selectedItems.length $}
+                            <span data-ng-pluralize count="tabs[tab].selectedItems.length" when="{'one': 'machine', 'other': 'machines'}"></span>
+                        </span>
                         <span data-ng-if="tabs[tab].actionOption.name === 'delete'">Delete {$ tabs[tab].selectedItems.length $}
                             <span data-ng-pluralize count="tabs[tab].selectedItems.length" when="{'one': 'machine', 'other': 'machines'}"></span>
                         </span>
diff --git a/src/maasserver/tests/test_node_action.py b/src/maasserver/tests/test_node_action.py
index a9368e0..9e0a3de 100644
--- a/src/maasserver/tests/test_node_action.py
+++ b/src/maasserver/tests/test_node_action.py
@@ -39,6 +39,7 @@ from maasserver.node_action import (
     Deploy,
     ExitRescueMode,
     ImportImages,
+    Lock,
     MarkBroken,
     MarkFixed,
     NodeAction,
@@ -50,6 +51,7 @@ from maasserver.node_action import (
     RPC_EXCEPTIONS,
     SetZone,
     Test,
+    Unlock,
 )
 import maasserver.node_action as node_action_module
 from maasserver.node_status import (
@@ -270,6 +272,22 @@ class TestNodeAction(MAASServerTestCase):
         node = factory.make_Node()
         self.assertFalse(MyAction(node, factory.make_User()).is_actionable())
 
+    def test_is_actionable_false_if_locked(self):
+
+        class MyAction(FakeNodeAction):
+            pass
+
+        node = factory.make_Node(status=NODE_STATUS.DEPLOYED, locked=True)
+        self.assertFalse(MyAction(node, factory.make_User()).is_actionable())
+
+    def test_is_actionable_true_if_allow_ed_when_locked(self):
+
+        class MyAction(FakeNodeAction):
+            allowed_when_locked = True
+
+        node = factory.make_Node(status=NODE_STATUS.DEPLOYED, locked=True)
+        self.assertTrue(MyAction(node, factory.make_User()).is_actionable())
+
     def test_delete_action_last_for_node(self):
         node = factory.make_Node()
         actions = compile_node_actions(
@@ -821,6 +839,59 @@ class TestPowerOffAction(MAASServerTestCase):
             "Nodes already powered off can be powered off.")
 
 
+class TestLockAction(MAASServerTestCase):
+
+    def test_changes_locked_status(self):
+        user = factory.make_User()
+        node = factory.make_Node(status=NODE_STATUS.DEPLOYED, owner=user)
+        action = Lock(node, user)
+        self.assertTrue(action.is_permitted())
+        action.execute()
+        self.assertTrue(reload_object(node).locked)
+
+    def test_not_actionable_if_not_deployed(self):
+        user = factory.make_User()
+        node = factory.make_Node(status=NODE_STATUS.READY, owner=user)
+        action = Lock(node, user)
+        self.assertFalse(action.is_actionable())
+
+    def test_not_actionable_if_locked(self):
+        user = factory.make_User()
+        node = factory.make_Node(
+            status=NODE_STATUS.DEPLOYED, owner=user, locked=True)
+        action = Lock(node, user)
+        self.assertFalse(action.is_actionable())
+
+    def test_not_actionable_if_not_machine(self):
+        user = factory.make_User()
+        controller = factory.make_RackController()
+        action = Lock(controller, user)
+        self.assertFalse(action.is_actionable())
+
+
+class TestUnlockAction(MAASServerTestCase):
+
+    def test_changes_locked_status(self):
+        user = factory.make_User()
+        node = factory.make_Node(locked=True, owner=user)
+        action = Unlock(node, user)
+        self.assertTrue(action.is_permitted())
+        action.execute()
+        self.assertFalse(reload_object(node).locked)
+
+    def test_not_actionable_if_not_locked(self):
+        user = factory.make_User()
+        node = factory.make_Node(owner=user)
+        action = Unlock(node, user)
+        self.assertFalse(action.is_actionable())
+
+    def test_not_actionable_if_not_machine(self):
+        user = factory.make_User()
+        controller = factory.make_RackController()
+        action = Unlock(controller, user)
+        self.assertFalse(action.is_actionable())
+
+
 ACTIONABLE_STATUSES = [
     NODE_STATUS.DEPLOYING,
     NODE_STATUS.FAILED_DEPLOYMENT,
diff --git a/src/maasserver/websockets/handlers/machine.py b/src/maasserver/websockets/handlers/machine.py
index b3126d3..67fe666 100644
--- a/src/maasserver/websockets/handlers/machine.py
+++ b/src/maasserver/websockets/handlers/machine.py
@@ -350,10 +350,8 @@ class MachineHandler(NodeHandler):
 
     def update(self, params):
         """Update the object from params."""
-        # Only admin users can perform update.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
+        # check that the operation is allowed
+        self._get_node_or_permission_error(params)
         data = super(NodeHandler, self).update(params)
         node_obj = Node.objects.get(system_id=data['system_id'])
 
@@ -375,6 +373,8 @@ class MachineHandler(NodeHandler):
             `m.api.machines`.
         """
         machine = self.get_object(params)
+        if machine.locked:
+            raise HandlerPermissionError()
         self._preflight_special_filesystem_modifications("mount", machine)
         form = MountNonStorageFilesystemForm(machine, data=params)
         if form.is_valid():
@@ -391,6 +391,8 @@ class MachineHandler(NodeHandler):
             `m.api.machines`.
         """
         machine = self.get_object(params)
+        if machine.locked:
+            raise HandlerPermissionError()
         self._preflight_special_filesystem_modifications("unmount", machine)
         form = UnmountNonStorageFilesystemForm(machine, data=params)
         if form.is_valid():
@@ -414,6 +416,8 @@ class MachineHandler(NodeHandler):
 
     def update_filesystem(self, params):
         node = self.get_object(params)
+        if node.locked:
+            raise HandlerPermissionError()
         block_id = params.get('block_id')
         partition_id = params.get('partition_id')
         fstype = params.get('fstype')
@@ -523,11 +527,7 @@ class MachineHandler(NodeHandler):
 
     def update_disk(self, params):
         """Update disk information."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         device = BlockDevice.objects.get(
             id=params['block_id'], node=node).actual_instance
         if device.type == 'physical':
@@ -551,22 +551,14 @@ class MachineHandler(NodeHandler):
                     params.get('mount_options', ''))
 
     def delete_disk(self, params):
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         block_id = params.get('block_id')
         if block_id is not None:
             block_device = BlockDevice.objects.get(id=block_id, node=node)
             block_device.delete()
 
     def delete_partition(self, params):
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         partition_id = params.get('partition_id')
         if partition_id is not None:
             partition = Partition.objects.get(
@@ -574,11 +566,7 @@ class MachineHandler(NodeHandler):
             partition.delete()
 
     def delete_volume_group(self, params):
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         volume_group_id = params.get('volume_group_id')
         if volume_group_id is not None:
             volume_group = VolumeGroup.objects.get(id=volume_group_id)
@@ -587,11 +575,7 @@ class MachineHandler(NodeHandler):
             volume_group.delete()
 
     def delete_cache_set(self, params):
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         cache_set_id = params.get('cache_set_id')
         if cache_set_id is not None:
             cache_set = CacheSet.objects.get(id=cache_set_id)
@@ -600,10 +584,7 @@ class MachineHandler(NodeHandler):
             cache_set.delete()
 
     def delete_filesystem(self, params):
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         blockdevice_id = params.get('blockdevice_id')
         partition_id = params.get('partition_id')
         filesystem_id = params.get('filesystem_id')
@@ -618,11 +599,7 @@ class MachineHandler(NodeHandler):
 
     def create_partition(self, params):
         """Create a partition."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         disk_obj = BlockDevice.objects.get(id=params['block_id'], node=node)
         form = AddPartitionForm(
             disk_obj, {
@@ -640,11 +617,7 @@ class MachineHandler(NodeHandler):
 
     def create_cache_set(self, params):
         """Create a cache set."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         block_id = params.get('block_id')
         partition_id = params.get('partition_id')
 
@@ -665,11 +638,7 @@ class MachineHandler(NodeHandler):
 
     def create_bcache(self, params):
         """Create a bcache."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         block_id = params.get('block_id')
         partition_id = params.get('partition_id')
 
@@ -701,11 +670,7 @@ class MachineHandler(NodeHandler):
 
     def create_raid(self, params):
         """Create a RAID."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         form = CreateRaidForm(node=node, data=params)
         if not form.is_valid():
             raise HandlerError(form.errors)
@@ -720,11 +685,7 @@ class MachineHandler(NodeHandler):
 
     def create_volume_group(self, params):
         """Create a volume group."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         form = CreateVolumeGroupForm(node=node, data=params)
         if not form.is_valid():
             raise HandlerError(form.errors)
@@ -733,11 +694,7 @@ class MachineHandler(NodeHandler):
 
     def create_logical_volume(self, params):
         """Create a logical volume."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         volume_group = VolumeGroup.objects.get(id=params['volume_group_id'])
         if volume_group.get_node() != node:
             raise VolumeGroup.DoesNotExist()
@@ -759,11 +716,7 @@ class MachineHandler(NodeHandler):
 
     def set_boot_disk(self, params):
         """Set the disk as the boot disk."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         device = BlockDevice.objects.get(
             id=params['block_id'], node=node).actual_instance
         if device.type != 'physical':
@@ -803,11 +756,7 @@ class MachineHandler(NodeHandler):
 
     def create_physical(self, params):
         """Create physical interface."""
-        # Only admin users can perform create.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         form = PhysicalInterfaceForm(node=node, data=params)
         if form.is_valid():
             interface = form.save()
@@ -818,11 +767,7 @@ class MachineHandler(NodeHandler):
 
     def create_vlan(self, params):
         """Create VLAN interface."""
-        # Only admin users can perform create.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         params['parents'] = [params.pop('parent')]
         form = VLANInterfaceForm(node=node, data=params)
         if form.is_valid():
@@ -834,11 +779,7 @@ class MachineHandler(NodeHandler):
 
     def create_bond(self, params):
         """Create bond interface."""
-        # Only admin users can perform create.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         form = BondInterfaceForm(node=node, data=params)
         if form.is_valid():
             interface = form.save()
@@ -849,11 +790,7 @@ class MachineHandler(NodeHandler):
 
     def create_bridge(self, params):
         """Create bridge interface."""
-        # Only admin users can perform create.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         if node.status == NODE_STATUS.ALLOCATED:
             form = AcquiredBridgeInterfaceForm(node=node, data=params)
         else:
@@ -867,11 +804,7 @@ class MachineHandler(NodeHandler):
 
     def update_interface(self, params):
         """Update the interface."""
-        # Only admin users can perform update.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         interface = Interface.objects.get(node=node, id=params["interface_id"])
         if node.status == NODE_STATUS.DEPLOYED:
             interface_form = DeployedInterfaceForm
@@ -889,21 +822,13 @@ class MachineHandler(NodeHandler):
 
     def delete_interface(self, params):
         """Delete the interface."""
-        # Only admin users can perform delete.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         interface = Interface.objects.get(node=node, id=params["interface_id"])
         interface.delete()
 
     def link_subnet(self, params):
         """Create or update the link."""
-        # Only admin users can perform update.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         interface = Interface.objects.get(node=node, id=params["interface_id"])
         subnet = None
         if "subnet" in params:
@@ -923,11 +848,7 @@ class MachineHandler(NodeHandler):
 
     def unlink_subnet(self, params):
         """Delete the link."""
-        # Only admin users can perform unlink.
-        if not reload_object(self.user).is_superuser:
-            raise HandlerPermissionError()
-
-        node = self.get_object(params)
+        node = self._get_node_or_permission_error(params)
         interface = Interface.objects.get(node=node, id=params["interface_id"])
         interface.unlink_subnet_by_id(params["link_id"])
 
@@ -958,3 +879,9 @@ class MachineHandler(NodeHandler):
         d.addErrback(eb_error)
         d.addCallback(partial(deferToDatabase, update_state))
         return d
+
+    def _get_node_or_permission_error(self, params):
+        node = self.get_object(params)
+        if not reload_object(self.user).is_superuser or node.locked:
+            raise HandlerPermissionError()
+        return node
diff --git a/src/maasserver/websockets/handlers/tests/test_general.py b/src/maasserver/websockets/handlers/tests/test_general.py
index 8e4139b..f530de8 100644
--- a/src/maasserver/websockets/handlers/tests/test_general.py
+++ b/src/maasserver/websockets/handlers/tests/test_general.py
@@ -164,7 +164,8 @@ class TestGeneralHandler(MAASServerTestCase):
         self.assertItemsEqual(
             ['release', 'mark-broken', 'on', 'deploy', 'mark-fixed',
              'commission', 'abort', 'acquire', 'off', 'rescue-mode',
-             'exit-rescue-mode', 'test', 'override-failed-testing'],
+             'exit-rescue-mode', 'lock', 'test', 'override-failed-testing',
+             'unlock'],
             [action['name'] for action in handler.machine_actions({})])
 
     def test_device_actions_for_admin(self):
diff --git a/src/maasserver/websockets/handlers/tests/test_machine.py b/src/maasserver/websockets/handlers/tests/test_machine.py
index ea45b78..ceef773 100644
--- a/src/maasserver/websockets/handlers/tests/test_machine.py
+++ b/src/maasserver/websockets/handlers/tests/test_machine.py
@@ -1799,10 +1799,19 @@ class TestMachineHandler(MAASServerTestCase):
 
     def test_update_raise_permissions_error_for_non_admin(self):
         user = factory.make_User()
+        node = factory.make_Node()
+        handler = MachineHandler(user, {})
+        self.assertRaises(
+            HandlerPermissionError,
+            handler.update, {'system_id': node.system_id})
+
+    def test_update_raise_permissions_error_for_locked_node(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
         handler = MachineHandler(user, {})
         self.assertRaises(
             HandlerPermissionError,
-            handler.update, {})
+            handler.update, {'system_id': node.system_id})
 
     def test_update_raises_validation_error_for_invalid_architecture(self):
         user = factory.make_admin()
@@ -1980,6 +1989,18 @@ class TestMachineHandler(MAASServerTestCase):
         self.assertEqual(new_name, block_device.name)
         self.assertItemsEqual(new_tags, block_device.tags)
 
+    def test_update_disk_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        block_device = factory.make_PhysicalBlockDevice(node=node)
+        new_name = factory.make_name("new")
+        params = {
+            'system_id': node.system_id,
+            'block_id': block_device.id,
+            'name': new_name}
+        self.assertRaises(HandlerPermissionError, handler.update_disk, params)
+
     def test_delete_disk(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -1995,6 +2016,16 @@ class TestMachineHandler(MAASServerTestCase):
             })
         self.assertIsNone(reload_object(block_device))
 
+    def test_delete_disk_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        block_device = factory.make_PhysicalBlockDevice(node=node)
+        params = {
+            'system_id': node.system_id,
+            'block_id': block_device.id}
+        self.assertRaises(HandlerPermissionError, handler.delete_disk, params)
+
     def test_delete_partition(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2010,6 +2041,17 @@ class TestMachineHandler(MAASServerTestCase):
             })
         self.assertIsNone(reload_object(partition))
 
+    def test_delete_partition_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        partition = factory.make_Partition(node=node)
+        params = {
+            'system_id': node.system_id,
+            'partition_id': partition.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.delete_partition, params)
+
     def test_delete_volume_group(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2026,6 +2068,18 @@ class TestMachineHandler(MAASServerTestCase):
             })
         self.assertIsNone(reload_object(volume_group))
 
+    def test_delete_volume_group_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        volume_group = factory.make_FilesystemGroup(
+            node=node, group_type=FILESYSTEM_GROUP_TYPE.LVM_VG)
+        params = {
+            'system_id': node.system_id,
+            'volume_group_id': volume_group.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.delete_volume_group, params)
+
     def test_delete_cache_set(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2041,6 +2095,17 @@ class TestMachineHandler(MAASServerTestCase):
             })
         self.assertIsNone(reload_object(cache_set))
 
+    def test_delete_cache_set_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        cache_set = factory.make_CacheSet(node=node)
+        params = {
+            'system_id': node.system_id,
+            'cache_set_id': cache_set.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.delete_cache_set, params)
+
     def test_delete_filesystem_deletes_blockdevice_filesystem(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2079,6 +2144,20 @@ class TestMachineHandler(MAASServerTestCase):
         self.assertIsNone(reload_object(filesystem))
         self.assertIsNotNone(reload_object(partition))
 
+    def test_delete_filesystem_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        partition = factory.make_Partition(node=node)
+        filesystem = factory.make_Filesystem(
+            partition=partition, fstype=FILESYSTEM_TYPE.EXT4)
+        params = {
+            'system_id': node.system_id,
+            'partition_id': partition.id,
+            'filesystem_id': filesystem.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.delete_filesystem, params)
+
     def test_create_partition(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2142,6 +2221,29 @@ class TestMachineHandler(MAASServerTestCase):
             fstype=fstype, mount_point=mount_point,
             mount_options=mount_options))
 
+    def test_create_partition_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        block_device = factory.make_BlockDevice(node=node)
+        partition_table = factory.make_PartitionTable(
+            block_device=block_device, node=node)
+        partition_table = factory.make_PartitionTable(
+            block_device=block_device, node=node)
+        size = partition_table.block_device.size // 2
+        fstype = factory.pick_filesystem_type()
+        mount_point = factory.make_absolute_path()
+        mount_options = factory.make_name("options")
+        params = {
+            'system_id': node.system_id,
+            'block_id': partition_table.block_device_id,
+            'partition_size': size,
+            'fstype': fstype,
+            'mount_point': mount_point,
+            'mount_options': mount_options}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_partition, params)
+
     def test_create_cache_set_for_partition(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2171,6 +2273,17 @@ class TestMachineHandler(MAASServerTestCase):
         self.assertEqual(
             block_device.id, cache_set.get_filesystem().block_device.id)
 
+    def test_create_cache_set_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        partition = factory.make_Partition(node=node)
+        params = {
+            'system_id': node.system_id,
+            'partition_id': partition.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_cache_set, params)
+
     def test_create_bcache_for_partition(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2303,6 +2416,29 @@ class TestMachineHandler(MAASServerTestCase):
             fstype=fstype, mount_point=mount_point,
             mount_options=mount_options))
 
+    def test_create_bcache_set_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        block_device = factory.make_PhysicalBlockDevice(node=node)
+        name = factory.make_name("bcache")
+        cache_set = factory.make_CacheSet(node=node)
+        cache_mode = factory.pick_enum(CACHE_MODE_TYPE)
+        fstype = factory.pick_filesystem_type()
+        mount_point = factory.make_absolute_path()
+        mount_options = factory.make_name("options")
+        params = {
+            'system_id': node.system_id,
+            'block_id': block_device.id,
+            'name': name,
+            'cache_set': cache_set.id,
+            'cache_mode': cache_mode,
+            'fstype': fstype,
+            'mount_point': mount_point,
+            'mount_options': mount_options}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_bcache, params)
+
     def test_create_raid(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2363,6 +2499,20 @@ class TestMachineHandler(MAASServerTestCase):
             fstype=fstype, mount_point=mount_point,
             mount_options=mount_options))
 
+    def test_create_raid_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        disk0 = factory.make_PhysicalBlockDevice(node=node)
+        disk1 = factory.make_PhysicalBlockDevice(node=node)
+        params = {
+            'system_id': node.system_id,
+            'name': factory.make_name('md'),
+            'level': 'raid-1',
+            'block_devices': [disk0.id, disk1.id]}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_raid, params)
+
     def test_create_volume_group(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2439,6 +2589,21 @@ class TestMachineHandler(MAASServerTestCase):
             fstype=fstype, mount_point=mount_point,
             mount_options=mount_options))
 
+    def test_create_logical_volume_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        volume_group = factory.make_FilesystemGroup(
+            group_type=FILESYSTEM_GROUP_TYPE.LVM_VG, node=node)
+        size = volume_group.get_lvm_free_space()
+        params = {
+            'system_id': node.system_id,
+            'name': factory.make_name("lv"),
+            'volume_group_id': volume_group.id,
+            'size': size}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_logical_volume, params)
+
     def test_set_boot_disk(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2464,6 +2629,17 @@ class TestMachineHandler(MAASServerTestCase):
         self.assertEqual(
             str(error), "Only a physical disk can be set as the boot disk.")
 
+    def test_set_boot_disk_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        boot_disk = factory.make_PhysicalBlockDevice(node=node)
+        params = {
+            'system_id': node.system_id,
+            'block_id': boot_disk.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.set_boot_disk, params)
+
     def test_update_raise_HandlerError_if_tag_has_definition(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})
@@ -2625,6 +2801,19 @@ class TestMachineHandler(MAASServerTestCase):
                 node=node, type=INTERFACE_TYPE.VLAN, parents=interface))
         self.assertIsNotNone(vlan_interface)
 
+    def test_create_physical_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        vlan = factory.make_VLAN()
+        params = {
+            "system_id": node.system_id,
+            "name": factory.make_name("eth"),
+            "mac_address": factory.make_mac_address(),
+            "vlan": vlan.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_physical, params)
+
     def test_create_vlan_creates_link_auto(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2692,6 +2881,23 @@ class TestMachineHandler(MAASServerTestCase):
             alloc_type=IPADDRESS_TYPE.STICKY, ip=None, subnet=new_subnet)
         self.assertIsNotNone(link_up_ip)
 
+    def test_create_vlan_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        vlan = factory.make_VLAN()
+        interface = factory.make_Interface(
+            INTERFACE_TYPE.PHYSICAL, node=node, vlan=vlan)
+        new_subnet = factory.make_Subnet(vlan=vlan)
+        params = {
+            "system_id": node.system_id,
+            "parent": interface.id,
+            "vlan": vlan.id,
+            "mode": INTERFACE_LINK_TYPE.AUTO,
+            "subnet": new_subnet.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_vlan, params)
+
     def test_create_bond_creates_bond(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2729,6 +2935,24 @@ class TestMachineHandler(MAASServerTestCase):
                 "parents": [nic1.id, nic2.id],
                 })
 
+    def test_create_bond_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        nic1 = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        nic2 = factory.make_Interface(
+            INTERFACE_TYPE.PHYSICAL, node=node, vlan=nic1.vlan)
+        bond_mode = factory.pick_enum(BOND_MODE)
+        params = {
+            "system_id": node.system_id,
+            "name": factory.make_name("bond"),
+            "parents": [nic1.id, nic2.id],
+            "mac_address": "%s" % nic1.mac_address,
+            "vlan": nic1.vlan.id,
+            "bond_mode": bond_mode}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_bond, params)
+
     def test_create_bridge_creates_bridge(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2765,6 +2989,22 @@ class TestMachineHandler(MAASServerTestCase):
                 "parents": [nic1.id],
                 })
 
+    def test_create_bridge_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        nic1 = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        params = {
+            "system_id": node.system_id,
+            "name": factory.make_name("br"),
+            "parents": [nic1.id],
+            "mac_address": "%s" % nic1.mac_address,
+            "vlan": nic1.vlan.id,
+            "bridge_stp": factory.pick_bool(),
+            "bridge_fd": random.randint(0, 15)}
+        self.assertRaises(
+            HandlerPermissionError, handler.create_bridge, params)
+
     def test_update_interface(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2814,6 +3054,20 @@ class TestMachineHandler(MAASServerTestCase):
                 "vlan": random.randint(1000, 5000),
                 })
 
+    def test_update_interface_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        interface = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        handler._script_results = {}
+        handler._refresh_script_result_cache(node.get_latest_script_results)
+        params = {
+            "system_id": node.system_id,
+            "interface_id": interface.id,
+            "name": factory.make_name("name")}
+        self.assertRaises(
+            HandlerPermissionError, handler.update_interface, params)
+
     def test_delete_interface(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2825,6 +3079,17 @@ class TestMachineHandler(MAASServerTestCase):
             })
         self.assertIsNone(reload_object(interface))
 
+    def test_delete_interface_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        interface = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        params = {
+            "system_id": node.system_id,
+            "interface_id": interface.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.delete_interface, params)
+
     def test_link_subnet_calls_update_link_by_id_if_link_id(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2894,6 +3159,22 @@ class TestMachineHandler(MAASServerTestCase):
             MockCalledOnceWith(
                 ANY, mode, subnet, ip_address=ip_address))
 
+    def test_link_subnet_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        interface = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        subnet = factory.make_Subnet()
+        params = {
+            "system_id": node.system_id,
+            "interface_id": interface.id,
+            "link_id": factory.make_StaticIPAddress(interface=interface).id,
+            "subnet": subnet.id,
+            "mode": factory.pick_enum(INTERFACE_LINK_TYPE),
+            "ip_address": factory.make_ip_address()}
+        self.assertRaises(
+            HandlerPermissionError, handler.link_subnet, params)
+
     def test_unlink_subnet(self):
         user = factory.make_admin()
         node = factory.make_Node()
@@ -2901,13 +3182,27 @@ class TestMachineHandler(MAASServerTestCase):
         interface = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
         link_ip = factory.make_StaticIPAddress(
             alloc_type=IPADDRESS_TYPE.AUTO, ip="", interface=interface)
-        handler.delete_interface({
+        handler.unlink_subnet({
             "system_id": node.system_id,
             "interface_id": interface.id,
             "link_id": link_ip.id,
             })
         self.assertIsNone(reload_object(link_ip))
 
+    def test_unlink_subnet_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        node = factory.make_Node(locked=True)
+        handler = MachineHandler(user, {})
+        interface = factory.make_Interface(INTERFACE_TYPE.PHYSICAL, node=node)
+        link_ip = factory.make_StaticIPAddress(
+            alloc_type=IPADDRESS_TYPE.AUTO, ip="", interface=interface)
+        params = {
+            "system_id": node.system_id,
+            "interface_id": interface.id,
+            "link_id": link_ip.id}
+        self.assertRaises(
+            HandlerPermissionError, handler.unlink_subnet, params)
+
     def test_get_grouped_storages_parses_blockdevices(self):
         user = factory.make_User()
         node = factory.make_Node(owner=user)
@@ -3045,6 +3340,17 @@ class TestMachineHandlerMountSpecial(MAASServerTestCase):
                 'mount_point': Equals(["Enter a valid value."]),
             }))
 
+    def test_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        machine = factory.make_Node(locked=True, owner=user)
+        params = {
+            'system_id': machine.system_id, 'fstype': FILESYSTEM_TYPE.RAMFS,
+            'mount_point': factory.make_absolute_path(),
+        }
+        self.assertRaises(
+            HandlerPermissionError, handler.mount_special, params)
+
 
 class TestMachineHandlerMountSpecialScenarios(MAASServerTestCase):
     """Scenario tests for MachineHandler.mount_special."""
@@ -3247,9 +3553,37 @@ class TestMachineHandlerUnmountSpecialScenarios(MAASServerTestCase):
                 raises_node_state_violation,
                 "using status %d on %s" % (status, self.fstype))
 
+    def test_locked_raises_permission_error(self):
+        admin = factory.make_admin()
+        node = factory.make_Node(locked=True, owner=admin)
+        filesystem = factory.make_Filesystem(
+            node=node, fstype=self.fstype,
+            mount_point=factory.make_absolute_path())
+        handler = MachineHandler(admin, {})
+        params = {
+            'system_id': node.system_id,
+            'mount_point': filesystem.mount_point}
+        self.assertRaises(
+            HandlerPermissionError, handler.unmount_special, params)
+
 
 class TestMachineHandlerUpdateFilesystem(MAASServerTestCase):
 
+    def test_locked_raises_permission_error(self):
+        user = factory.make_admin()
+        handler = MachineHandler(user, {})
+        node = factory.make_Node(locked=True)
+        block_device = factory.make_PhysicalBlockDevice(node=node)
+        fs = factory.make_Filesystem(block_device=block_device)
+        params = {
+            'system_id': node.system_id,
+            'block_id': block_device.id,
+            'fstype': fs.fstype,
+            'mount_point': None,
+            'mount_options': None}
+        self.assertRaises(
+            HandlerPermissionError, handler.update_filesystem, params)
+
     def test_unmount_blockdevice_filesystem(self):
         user = factory.make_admin()
         handler = MachineHandler(user, {})