Add admin interface for managing node tags

Implement CRUD operations for NodeTags in the admin interface:

- Add NodeTagMove schema for moving tags between nodes
- Add PUT /nodes/{public_key}/tags/{key}/move API endpoint
- Add web routes at /a/node-tags for tag management
- Create admin templates with node selector and tag management UI
- Support editing, adding, moving, and deleting tags via API calls
- Add comprehensive tests for new functionality

The interface allows selecting a node from a dropdown, viewing its
tags, and performing all CRUD operations including moving a tag
to a different node without having to delete and recreate it.

src/meshcore_hub/api/routes/node_tags.py

@@ -6,7 +6,12 @@ from sqlalchemy import select
 from meshcore_hub.api.auth import RequireAdmin, RequireRead
 from meshcore_hub.api.dependencies import DbSession
 from meshcore_hub.common.models import Node, NodeTag
-from meshcore_hub.common.schemas.nodes import NodeTagCreate, NodeTagRead, NodeTagUpdate
+from meshcore_hub.common.schemas.nodes import (
+    NodeTagCreate,
+    NodeTagMove,
+    NodeTagRead,
+    NodeTagUpdate,
+)
 
 router = APIRouter()
 
@@ -130,6 +135,58 @@ async def update_node_tag(
     return NodeTagRead.model_validate(node_tag)
 
 
+@router.put("/nodes/{public_key}/tags/{key}/move", response_model=NodeTagRead)
+async def move_node_tag(
+    _: RequireAdmin,
+    session: DbSession,
+    public_key: str,
+    key: str,
+    data: NodeTagMove,
+) -> NodeTagRead:
+    """Move a node tag to a different node."""
+    # Find source node
+    source_query = select(Node).where(Node.public_key == public_key)
+    source_node = session.execute(source_query).scalar_one_or_none()
+
+    if not source_node:
+        raise HTTPException(status_code=404, detail="Source node not found")
+
+    # Find tag
+    tag_query = select(NodeTag).where(
+        (NodeTag.node_id == source_node.id) & (NodeTag.key == key)
+    )
+    node_tag = session.execute(tag_query).scalar_one_or_none()
+
+    if not node_tag:
+        raise HTTPException(status_code=404, detail="Tag not found")
+
+    # Find destination node
+    dest_query = select(Node).where(Node.public_key == data.new_public_key)
+    dest_node = session.execute(dest_query).scalar_one_or_none()
+
+    if not dest_node:
+        raise HTTPException(status_code=404, detail="Destination node not found")
+
+    # Check if tag already exists on destination node
+    conflict_query = select(NodeTag).where(
+        (NodeTag.node_id == dest_node.id) & (NodeTag.key == key)
+    )
+    conflict = session.execute(conflict_query).scalar_one_or_none()
+
+    if conflict:
+        raise HTTPException(
+            status_code=409,
+            detail=f"Tag '{key}' already exists on destination node",
+        )
+
+    # Move tag to destination node
+    node_tag.node_id = dest_node.id
+    session.commit()
+    session.refresh(node_tag)
+
+    return NodeTagRead.model_validate(node_tag)
+
+
 @router.delete("/nodes/{public_key}/tags/{key}", status_code=204)
 async def delete_node_tag(
     _: RequireAdmin,

src/meshcore_hub/common/schemas/nodes.py

@@ -38,6 +38,17 @@ class NodeTagUpdate(BaseModel):
     )
 
 
+class NodeTagMove(BaseModel):
+    """Schema for moving a node tag to a different node."""
+
+    new_public_key: str = Field(
+        ...,
+        min_length=64,
+        max_length=64,
+        description="Public key of the destination node",
+    )
+
+
 class NodeTagRead(BaseModel):
     """Schema for reading a node tag."""
 

src/meshcore_hub/web/routes/admin.py

@@ -1,9 +1,10 @@
-"""Admin page route."""
+"""Admin page routes."""
 
 import logging
+from typing import Optional
 
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import HTMLResponse
+from fastapi import APIRouter, Form, HTTPException, Query, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
 
 from meshcore_hub.web.app import get_network_context, get_templates
 
@@ -11,21 +12,236 @@ logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/a", tags=["admin"])
 
 
+def _check_admin_enabled(request: Request) -> None:
+    """Check if admin interface is enabled, raise 404 if not."""
+    if not getattr(request.app.state, "admin_enabled", False):
+        raise HTTPException(status_code=404, detail="Not Found")
+
+
+def _get_auth_context(request: Request) -> dict:
+    """Extract OAuth2Proxy authentication headers."""
+    return {
+        "auth_user": request.headers.get("X-Forwarded-User"),
+        "auth_groups": request.headers.get("X-Forwarded-Groups"),
+        "auth_email": request.headers.get("X-Forwarded-Email"),
+        "auth_username": request.headers.get("X-Forwarded-Preferred-Username"),
+    }
+
+
 @router.get("/", response_class=HTMLResponse)
 async def admin_home(request: Request) -> HTMLResponse:
     """Render the admin page with OAuth2Proxy user info."""
-    # Check if admin interface is enabled
-    if not getattr(request.app.state, "admin_enabled", False):
-        raise HTTPException(status_code=404, detail="Not Found")
+    _check_admin_enabled(request)
 
     templates = get_templates(request)
     context = get_network_context(request)
     context["request"] = request
+    context.update(_get_auth_context(request))
 
-    # Extract OAuth2Proxy headers
-    context["auth_user"] = request.headers.get("X-Forwarded-User")
-    context["auth_groups"] = request.headers.get("X-Forwarded-Groups")
-    context["auth_email"] = request.headers.get("X-Forwarded-Email")
-    context["auth_username"] = request.headers.get("X-Forwarded-Preferred-Username")
+    return templates.TemplateResponse("admin/index.html", context)
 
-    return templates.TemplateResponse("admin.html", context)
+
+@router.get("/node-tags", response_class=HTMLResponse)
+async def admin_node_tags(
+    request: Request,
+    public_key: Optional[str] = Query(None),
+    message: Optional[str] = Query(None),
+    error: Optional[str] = Query(None),
+) -> HTMLResponse:
+    """Admin page for managing node tags."""
+    _check_admin_enabled(request)
+
+    templates = get_templates(request)
+    context = get_network_context(request)
+    context["request"] = request
+    context.update(_get_auth_context(request))
+
+    # Flash messages from redirects
+    context["message"] = message
+    context["error"] = error
+
+    # Fetch all nodes for dropdown
+    nodes = []
+    try:
+        response = await request.app.state.http_client.get(
+            "/api/v1/nodes",
+            params={"limit": 100},
+        )
+        if response.status_code == 200:
+            data = response.json()
+            nodes = data.get("items", [])
+    except Exception as e:
+        logger.exception("Failed to fetch nodes: %s", e)
+        context["error"] = "Failed to fetch nodes"
+
+    context["nodes"] = nodes
+    context["selected_public_key"] = public_key
+
+    # Fetch tags for selected node
+    tags = []
+    selected_node = None
+    if public_key:
+        # Find the selected node in the list
+        for node in nodes:
+            if node.get("public_key") == public_key:
+                selected_node = node
+                break
+
+        try:
+            response = await request.app.state.http_client.get(
+                f"/api/v1/nodes/{public_key}/tags",
+            )
+            if response.status_code == 200:
+                tags = response.json()
+            elif response.status_code == 404:
+                context["error"] = "Node not found"
+        except Exception as e:
+            logger.exception("Failed to fetch tags: %s", e)
+            context["error"] = "Failed to fetch tags"
+
+    context["tags"] = tags
+    context["selected_node"] = selected_node
+
+    return templates.TemplateResponse("admin/node_tags.html", context)
+
+
+@router.post("/node-tags", response_class=RedirectResponse)
+async def admin_create_node_tag(
+    request: Request,
+    public_key: str = Form(...),
+    key: str = Form(...),
+    value: str = Form(""),
+    value_type: str = Form("string"),
+) -> RedirectResponse:
+    """Create a new node tag."""
+    _check_admin_enabled(request)
+
+    redirect_url = f"/a/node-tags?public_key={public_key}"
+
+    try:
+        response = await request.app.state.http_client.post(
+            f"/api/v1/nodes/{public_key}/tags",
+            json={
+                "key": key,
+                "value": value or None,
+                "value_type": value_type,
+            },
+        )
+        if response.status_code == 201:
+            redirect_url += f"&message=Tag '{key}' created successfully"
+        elif response.status_code == 409:
+            redirect_url += f"&error=Tag '{key}' already exists"
+        elif response.status_code == 404:
+            redirect_url += "&error=Node not found"
+        else:
+            detail = response.json().get("detail", "Unknown error")
+            redirect_url += f"&error={detail}"
+    except Exception as e:
+        logger.exception("Failed to create tag: %s", e)
+        redirect_url += "&error=Failed to create tag"
+
+    return RedirectResponse(url=redirect_url, status_code=303)
+
+
+@router.post("/node-tags/update", response_class=RedirectResponse)
+async def admin_update_node_tag(
+    request: Request,
+    public_key: str = Form(...),
+    key: str = Form(...),
+    value: str = Form(""),
+    value_type: str = Form("string"),
+) -> RedirectResponse:
+    """Update an existing node tag."""
+    _check_admin_enabled(request)
+
+    redirect_url = f"/a/node-tags?public_key={public_key}"
+
+    try:
+        response = await request.app.state.http_client.put(
+            f"/api/v1/nodes/{public_key}/tags/{key}",
+            json={
+                "value": value or None,
+                "value_type": value_type,
+            },
+        )
+        if response.status_code == 200:
+            redirect_url += f"&message=Tag '{key}' updated successfully"
+        elif response.status_code == 404:
+            redirect_url += f"&error=Tag '{key}' not found"
+        else:
+            detail = response.json().get("detail", "Unknown error")
+            redirect_url += f"&error={detail}"
+    except Exception as e:
+        logger.exception("Failed to update tag: %s", e)
+        redirect_url += "&error=Failed to update tag"
+
+    return RedirectResponse(url=redirect_url, status_code=303)
+
+
+@router.post("/node-tags/move", response_class=RedirectResponse)
+async def admin_move_node_tag(
+    request: Request,
+    public_key: str = Form(...),
+    key: str = Form(...),
+    new_public_key: str = Form(...),
+) -> RedirectResponse:
+    """Move a node tag to a different node."""
+    _check_admin_enabled(request)
+
+    # Redirect to the destination node after move
+    redirect_url = f"/a/node-tags?public_key={new_public_key}"
+
+    try:
+        response = await request.app.state.http_client.put(
+            f"/api/v1/nodes/{public_key}/tags/{key}/move",
+            json={"new_public_key": new_public_key},
+        )
+        if response.status_code == 200:
+            redirect_url += f"&message=Tag '{key}' moved successfully"
+        elif response.status_code == 404:
+            # Stay on source node if not found
+            redirect_url = f"/a/node-tags?public_key={public_key}"
+            detail = response.json().get("detail", "Not found")
+            redirect_url += f"&error={detail}"
+        elif response.status_code == 409:
+            redirect_url = f"/a/node-tags?public_key={public_key}"
+            redirect_url += f"&error=Tag '{key}' already exists on destination node"
+        else:
+            redirect_url = f"/a/node-tags?public_key={public_key}"
+            detail = response.json().get("detail", "Unknown error")
+            redirect_url += f"&error={detail}"
+    except Exception as e:
+        logger.exception("Failed to move tag: %s", e)
+        redirect_url = f"/a/node-tags?public_key={public_key}"
+        redirect_url += "&error=Failed to move tag"
+
+    return RedirectResponse(url=redirect_url, status_code=303)
+
+
+@router.post("/node-tags/delete", response_class=RedirectResponse)
+async def admin_delete_node_tag(
+    request: Request,
+    public_key: str = Form(...),
+    key: str = Form(...),
+) -> RedirectResponse:
+    """Delete a node tag."""
+    _check_admin_enabled(request)
+
+    redirect_url = f"/a/node-tags?public_key={public_key}"
+
+    try:
+        response = await request.app.state.http_client.delete(
+            f"/api/v1/nodes/{public_key}/tags/{key}",
+        )
+        if response.status_code == 204:
+            redirect_url += f"&message=Tag '{key}' deleted successfully"
+        elif response.status_code == 404:
+            redirect_url += f"&error=Tag '{key}' not found"
+        else:
+            detail = response.json().get("detail", "Unknown error")
+            redirect_url += f"&error={detail}"
+    except Exception as e:
+        logger.exception("Failed to delete tag: %s", e)
+        redirect_url += "&error=Failed to delete tag"
+
+    return RedirectResponse(url=redirect_url, status_code=303)

src/meshcore_hub/web/templates/admin/index.html

@@ -4,10 +4,34 @@
 
 {% block content %}
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Admin</h1>
+    <div>
+        <h1 class="text-3xl font-bold">Admin</h1>
+        <div class="text-sm breadcrumbs">
+            <ul>
+                <li><a href="/">Home</a></li>
+                <li>Admin</li>
+            </ul>
+        </div>
+    </div>
     <a href="/oauth2/sign_out" class="btn btn-outline btn-sm">Sign Out</a>
 </div>
 
+<!-- Navigation Cards -->
+<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4 mb-8">
+    <a href="/a/node-tags" class="card bg-base-100 shadow-xl hover:shadow-2xl transition-shadow">
+        <div class="card-body">
+            <h2 class="card-title">
+                <svg xmlns="http://www.w3.org/2000/svg" class="h-6 w-6" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A2 2 0 013 12V7a4 4 0 014-4z" />
+                </svg>
+                Node Tags
+            </h2>
+            <p>Manage custom tags and metadata for network nodes.</p>
+        </div>
+    </a>
+</div>
+
+<!-- Auth Info -->
 <div class="card bg-base-100 shadow-xl">
     <div class="card-body">
         <h2 class="card-title">Authenticated User</h2>

src/meshcore_hub/web/templates/admin/node_tags.html

@@ -0,0 +1,340 @@
+{% extends "base.html" %}
+
+{% block title %}{{ network_name }} - Node Tags Admin{% endblock %}
+
+{% block content %}
+<div class="flex items-center justify-between mb-6">
+    <div>
+        <h1 class="text-3xl font-bold">Node Tags</h1>
+        <div class="text-sm breadcrumbs">
+            <ul>
+                <li><a href="/">Home</a></li>
+                <li><a href="/a/">Admin</a></li>
+                <li>Node Tags</li>
+            </ul>
+        </div>
+    </div>
+    <a href="/oauth2/sign_out" class="btn btn-outline btn-sm">Sign Out</a>
+</div>
+
+<!-- Flash Messages -->
+{% if message %}
+<div class="alert alert-success mb-4">
+    <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+    </svg>
+    <span>{{ message }}</span>
+</div>
+{% endif %}
+
+{% if error %}
+<div class="alert alert-error mb-4">
+    <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z" />
+    </svg>
+    <span>{{ error }}</span>
+</div>
+{% endif %}
+
+<!-- Node Selector -->
+<div class="card bg-base-100 shadow-xl mb-6">
+    <div class="card-body">
+        <h2 class="card-title">Select Node</h2>
+        <form method="get" action="/a/node-tags" class="flex gap-4 items-end">
+            <div class="form-control flex-1">
+                <label class="label">
+                    <span class="label-text">Node</span>
+                </label>
+                <select name="public_key" class="select select-bordered w-full" onchange="this.form.submit()">
+                    <option value="">-- Select a node --</option>
+                    {% for node in nodes %}
+                    <option value="{{ node.public_key }}" {% if node.public_key == selected_public_key %}selected{% endif %}>
+                        {{ node.name or 'Unnamed' }} ({{ node.public_key[:8] }}...{{ node.public_key[-4:] }})
+                    </option>
+                    {% endfor %}
+                </select>
+            </div>
+            <button type="submit" class="btn btn-primary">Load Tags</button>
+        </form>
+    </div>
+</div>
+
+{% if selected_public_key and selected_node %}
+<!-- Selected Node Info -->
+<div class="card bg-base-100 shadow-xl mb-6">
+    <div class="card-body">
+        <div class="flex justify-between items-start">
+            <div>
+                <h2 class="card-title">{{ selected_node.name or 'Unnamed Node' }}</h2>
+                <p class="text-sm opacity-70 font-mono">{{ selected_public_key }}</p>
+                {% if selected_node.adv_type %}
+                <span class="badge badge-outline mt-2">{{ selected_node.adv_type }}</span>
+                {% endif %}
+            </div>
+            <a href="/nodes/{{ selected_public_key }}" class="btn btn-ghost btn-sm">View Node</a>
+        </div>
+    </div>
+</div>
+
+<!-- Tags Table -->
+<div class="card bg-base-100 shadow-xl mb-6">
+    <div class="card-body">
+        <h2 class="card-title">Tags ({{ tags|length }})</h2>
+
+        {% if tags %}
+        <div class="overflow-x-auto">
+            <table class="table table-zebra">
+                <thead>
+                    <tr>
+                        <th>Key</th>
+                        <th>Value</th>
+                        <th>Type</th>
+                        <th>Updated</th>
+                        <th class="w-48">Actions</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for tag in tags %}
+                    <tr>
+                        <td class="font-mono font-semibold">{{ tag.key }}</td>
+                        <td class="max-w-xs truncate" title="{{ tag.value or '' }}">{{ tag.value or '-' }}</td>
+                        <td>
+                            <span class="badge badge-ghost badge-sm">{{ tag.value_type }}</span>
+                        </td>
+                        <td class="text-sm opacity-70">{{ tag.updated_at[:10] if tag.updated_at else '-' }}</td>
+                        <td>
+                            <div class="flex gap-1">
+                                <button class="btn btn-ghost btn-xs" onclick="openEditModal('{{ tag.key }}', '{{ tag.value|e if tag.value else '' }}', '{{ tag.value_type }}')">
+                                    Edit
+                                </button>
+                                <button class="btn btn-ghost btn-xs" onclick="openMoveModal('{{ tag.key }}')">
+                                    Move
+                                </button>
+                                <button class="btn btn-ghost btn-xs text-error" onclick="openDeleteModal('{{ tag.key }}')">
+                                    Delete
+                                </button>
+                            </div>
+                        </td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+        {% else %}
+        <div class="text-center py-8 text-base-content/60">
+            <p>No tags found for this node.</p>
+            <p class="text-sm mt-2">Add a new tag below.</p>
+        </div>
+        {% endif %}
+    </div>
+</div>
+
+<!-- Add New Tag Form -->
+<div class="card bg-base-100 shadow-xl">
+    <div class="card-body">
+        <h2 class="card-title">Add New Tag</h2>
+        <form method="post" action="/a/node-tags" class="grid grid-cols-1 md:grid-cols-4 gap-4">
+            <input type="hidden" name="public_key" value="{{ selected_public_key }}">
+
+            <div class="form-control">
+                <label class="label">
+                    <span class="label-text">Key</span>
+                </label>
+                <input type="text" name="key" class="input input-bordered" placeholder="tag_name" required maxlength="100">
+            </div>
+
+            <div class="form-control">
+                <label class="label">
+                    <span class="label-text">Value</span>
+                </label>
+                <input type="text" name="value" class="input input-bordered" placeholder="tag value">
+            </div>
+
+            <div class="form-control">
+                <label class="label">
+                    <span class="label-text">Type</span>
+                </label>
+                <select name="value_type" class="select select-bordered">
+                    <option value="string">string</option>
+                    <option value="number">number</option>
+                    <option value="boolean">boolean</option>
+                    <option value="coordinate">coordinate</option>
+                </select>
+            </div>
+
+            <div class="form-control">
+                <label class="label">
+                    <span class="label-text">&nbsp;</span>
+                </label>
+                <button type="submit" class="btn btn-primary">Add Tag</button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<!-- Edit Modal -->
+<dialog id="editModal" class="modal">
+    <div class="modal-box">
+        <h3 class="font-bold text-lg">Edit Tag</h3>
+        <form method="post" action="/a/node-tags/update" class="py-4">
+            <input type="hidden" name="public_key" value="{{ selected_public_key }}">
+            <input type="hidden" name="key" id="editKey">
+
+            <div class="form-control mb-4">
+                <label class="label">
+                    <span class="label-text">Key</span>
+                </label>
+                <input type="text" id="editKeyDisplay" class="input input-bordered" disabled>
+            </div>
+
+            <div class="form-control mb-4">
+                <label class="label">
+                    <span class="label-text">Value</span>
+                </label>
+                <input type="text" name="value" id="editValue" class="input input-bordered">
+            </div>
+
+            <div class="form-control mb-4">
+                <label class="label">
+                    <span class="label-text">Type</span>
+                </label>
+                <select name="value_type" id="editValueType" class="select select-bordered w-full">
+                    <option value="string">string</option>
+                    <option value="number">number</option>
+                    <option value="boolean">boolean</option>
+                    <option value="coordinate">coordinate</option>
+                </select>
+            </div>
+
+            <div class="modal-action">
+                <button type="button" class="btn" onclick="editModal.close()">Cancel</button>
+                <button type="submit" class="btn btn-primary">Save Changes</button>
+            </div>
+        </form>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+        <button>close</button>
+    </form>
+</dialog>
+
+<!-- Move Modal -->
+<dialog id="moveModal" class="modal">
+    <div class="modal-box">
+        <h3 class="font-bold text-lg">Move Tag to Another Node</h3>
+        <form method="post" action="/a/node-tags/move" class="py-4">
+            <input type="hidden" name="public_key" value="{{ selected_public_key }}">
+            <input type="hidden" name="key" id="moveKey">
+
+            <div class="form-control mb-4">
+                <label class="label">
+                    <span class="label-text">Tag Key</span>
+                </label>
+                <input type="text" id="moveKeyDisplay" class="input input-bordered" disabled>
+            </div>
+
+            <div class="form-control mb-4">
+                <label class="label">
+                    <span class="label-text">Destination Node</span>
+                </label>
+                <select name="new_public_key" id="moveDestination" class="select select-bordered w-full" required>
+                    <option value="">-- Select destination node --</option>
+                    {% for node in nodes %}
+                    {% if node.public_key != selected_public_key %}
+                    <option value="{{ node.public_key }}">
+                        {{ node.name or 'Unnamed' }} ({{ node.public_key[:8] }}...{{ node.public_key[-4:] }})
+                    </option>
+                    {% endif %}
+                    {% endfor %}
+                </select>
+            </div>
+
+            <div class="alert alert-warning mb-4">
+                <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                </svg>
+                <span>This will move the tag from the current node to the destination node.</span>
+            </div>
+
+            <div class="modal-action">
+                <button type="button" class="btn" onclick="moveModal.close()">Cancel</button>
+                <button type="submit" class="btn btn-warning">Move Tag</button>
+            </div>
+        </form>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+        <button>close</button>
+    </form>
+</dialog>
+
+<!-- Delete Modal -->
+<dialog id="deleteModal" class="modal">
+    <div class="modal-box">
+        <h3 class="font-bold text-lg">Delete Tag</h3>
+        <form method="post" action="/a/node-tags/delete" class="py-4">
+            <input type="hidden" name="public_key" value="{{ selected_public_key }}">
+            <input type="hidden" name="key" id="deleteKey">
+
+            <p class="py-4">Are you sure you want to delete the tag "<span id="deleteKeyDisplay" class="font-mono font-semibold"></span>"?</p>
+
+            <div class="alert alert-error mb-4">
+                <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                </svg>
+                <span>This action cannot be undone.</span>
+            </div>
+
+            <div class="modal-action">
+                <button type="button" class="btn" onclick="deleteModal.close()">Cancel</button>
+                <button type="submit" class="btn btn-error">Delete</button>
+            </div>
+        </form>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+        <button>close</button>
+    </form>
+</dialog>
+
+{% elif selected_public_key and not selected_node %}
+<div class="alert alert-warning">
+    <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+    </svg>
+    <span>Node not found: {{ selected_public_key }}</span>
+</div>
+{% else %}
+<div class="card bg-base-100 shadow-xl">
+    <div class="card-body text-center py-12">
+        <svg xmlns="http://www.w3.org/2000/svg" class="h-16 w-16 mx-auto mb-4 opacity-30" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A2 2 0 013 12V7a4 4 0 014-4z" />
+        </svg>
+        <h2 class="text-xl font-semibold mb-2">Select a Node</h2>
+        <p class="opacity-70">Choose a node from the dropdown above to view and manage its tags.</p>
+    </div>
+</div>
+{% endif %}
+{% endblock %}
+
+{% block extra_scripts %}
+<script>
+function openEditModal(key, value, valueType) {
+    document.getElementById('editKey').value = key;
+    document.getElementById('editKeyDisplay').value = key;
+    document.getElementById('editValue').value = value;
+    document.getElementById('editValueType').value = valueType;
+    editModal.showModal();
+}
+
+function openMoveModal(key) {
+    document.getElementById('moveKey').value = key;
+    document.getElementById('moveKeyDisplay').value = key;
+    document.getElementById('moveDestination').selectedIndex = 0;
+    moveModal.showModal();
+}
+
+function openDeleteModal(key) {
+    document.getElementById('deleteKey').value = key;
+    document.getElementById('deleteKeyDisplay').textContent = key;
+    deleteModal.showModal();
+}
+</script>
+{% endblock %}

tests/test_api/test_nodes.py

@@ -158,3 +158,133 @@ class TestNodeTags:
             headers={"Authorization": "Bearer test-admin-key"},
         )
         assert response.status_code == 201  # Created
+
+
+class TestMoveNodeTag:
+    """Tests for PUT /nodes/{public_key}/tags/{key}/move endpoint."""
+
+    # 64-character public key for testing
+    DEST_PUBLIC_KEY = "xyz789xyz789xyz789xyz789xyz789xyabc123abc123abc123abc123abc123ab"
+
+    def test_move_node_tag_success(
+        self, client_no_auth, api_db_session, sample_node, sample_node_tag
+    ):
+        """Test successfully moving a tag to another node."""
+        from meshcore_hub.common.models import Node
+        from datetime import datetime, timezone
+
+        # Create a second node with 64-char public key
+        second_node = Node(
+            public_key=self.DEST_PUBLIC_KEY,
+            name="Second Node",
+            adv_type="CHAT",
+            first_seen=datetime.now(timezone.utc),
+        )
+        api_db_session.add(second_node)
+        api_db_session.commit()
+
+        response = client_no_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}/move",
+            json={"new_public_key": second_node.public_key},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["key"] == sample_node_tag.key
+        assert data["value"] == sample_node_tag.value
+
+        # Verify tag is no longer on original node
+        response = client_no_auth.get(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}"
+        )
+        assert response.status_code == 404
+
+        # Verify tag is now on new node
+        response = client_no_auth.get(
+            f"/api/v1/nodes/{second_node.public_key}/tags/{sample_node_tag.key}"
+        )
+        assert response.status_code == 200
+
+    def test_move_node_tag_source_not_found(self, client_no_auth):
+        """Test moving a tag from a non-existent node."""
+        response = client_no_auth.put(
+            "/api/v1/nodes/nonexistent123/tags/somekey/move",
+            json={"new_public_key": self.DEST_PUBLIC_KEY},
+        )
+        assert response.status_code == 404
+        assert "Source node not found" in response.json()["detail"]
+
+    def test_move_node_tag_tag_not_found(self, client_no_auth, sample_node):
+        """Test moving a non-existent tag."""
+        response = client_no_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/nonexistent/move",
+            json={"new_public_key": self.DEST_PUBLIC_KEY},
+        )
+        assert response.status_code == 404
+        assert "Tag not found" in response.json()["detail"]
+
+    def test_move_node_tag_dest_not_found(
+        self, client_no_auth, sample_node, sample_node_tag
+    ):
+        """Test moving a tag to a non-existent destination node."""
+        # 64-character nonexistent public key
+        nonexistent_key = (
+            "1111111111111111111111111111111122222222222222222222222222222222"
+        )
+        response = client_no_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}/move",
+            json={"new_public_key": nonexistent_key},
+        )
+        assert response.status_code == 404
+        assert "Destination node not found" in response.json()["detail"]
+
+    def test_move_node_tag_conflict(
+        self, client_no_auth, api_db_session, sample_node, sample_node_tag
+    ):
+        """Test moving a tag when destination already has that key."""
+        from meshcore_hub.common.models import Node, NodeTag
+        from datetime import datetime, timezone
+
+        # Create second node with same tag key
+        second_node = Node(
+            public_key=self.DEST_PUBLIC_KEY,
+            name="Second Node",
+            adv_type="CHAT",
+            first_seen=datetime.now(timezone.utc),
+        )
+        api_db_session.add(second_node)
+        api_db_session.commit()
+
+        # Add the same tag key to second node
+        existing_tag = NodeTag(
+            node_id=second_node.id,
+            key=sample_node_tag.key,  # Same key
+            value="different value",
+        )
+        api_db_session.add(existing_tag)
+        api_db_session.commit()
+
+        response = client_no_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}/move",
+            json={"new_public_key": second_node.public_key},
+        )
+        assert response.status_code == 409
+        assert "already exists on destination" in response.json()["detail"]
+
+    def test_move_node_tag_requires_admin(
+        self, client_with_auth, sample_node, sample_node_tag
+    ):
+        """Test that move operation requires admin auth."""
+        # Without auth
+        response = client_with_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}/move",
+            json={"new_public_key": self.DEST_PUBLIC_KEY},
+        )
+        assert response.status_code == 401
+
+        # With read key (not admin)
+        response = client_with_auth.put(
+            f"/api/v1/nodes/{sample_node.public_key}/tags/{sample_node_tag.key}/move",
+            json={"new_public_key": self.DEST_PUBLIC_KEY},
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 403

tests/test_web/conftest.py

@@ -255,6 +255,18 @@ class MockHttpClient:
         key = f"POST:{path}"
         return self._create_response(key)
 
+    async def put(
+        self, path: str, json: dict | None = None, params: dict | None = None
+    ) -> Response:
+        """Mock PUT request."""
+        key = f"PUT:{path}"
+        return self._create_response(key)
+
+    async def delete(self, path: str, params: dict | None = None) -> Response:
+        """Mock DELETE request."""
+        key = f"DELETE:{path}"
+        return self._create_response(key)
+
     async def aclose(self) -> None:
         """Mock close method."""
         pass

tests/test_web/test_admin.py

@@ -0,0 +1,338 @@
+"""Tests for admin web routes."""
+
+from typing import Any
+
+import pytest
+from fastapi.testclient import TestClient
+
+from meshcore_hub.web.app import create_app
+
+from .conftest import MockHttpClient
+
+
+@pytest.fixture
+def mock_http_client_admin() -> MockHttpClient:
+    """Create a mock HTTP client for admin tests."""
+    client = MockHttpClient()
+
+    # Mock the nodes API response for admin dropdown
+    client.set_response(
+        "GET",
+        "/api/v1/nodes",
+        200,
+        {
+            "items": [
+                {
+                    "public_key": "abc123def456abc123def456abc123de",
+                    "name": "Node One",
+                    "adv_type": "REPEATER",
+                    "first_seen": "2024-01-01T00:00:00Z",
+                    "last_seen": "2024-01-01T12:00:00Z",
+                    "created_at": "2024-01-01T00:00:00Z",
+                    "updated_at": "2024-01-01T00:00:00Z",
+                    "tags": [],
+                },
+                {
+                    "public_key": "xyz789xyz789xyz789xyz789xyz789xy",
+                    "name": "Node Two",
+                    "adv_type": "CHAT",
+                    "first_seen": "2024-01-01T00:00:00Z",
+                    "last_seen": "2024-01-01T11:00:00Z",
+                    "created_at": "2024-01-01T00:00:00Z",
+                    "updated_at": "2024-01-01T00:00:00Z",
+                    "tags": [],
+                },
+            ],
+            "total": 2,
+            "limit": 100,
+            "offset": 0,
+        },
+    )
+
+    # Mock node tags response
+    client.set_response(
+        "GET",
+        "/api/v1/nodes/abc123def456abc123def456abc123de/tags",
+        200,
+        [
+            {
+                "key": "environment",
+                "value": "production",
+                "value_type": "string",
+                "created_at": "2024-01-01T00:00:00Z",
+                "updated_at": "2024-01-01T00:00:00Z",
+            },
+            {
+                "key": "location",
+                "value": "building-a",
+                "value_type": "string",
+                "created_at": "2024-01-01T00:00:00Z",
+                "updated_at": "2024-01-01T00:00:00Z",
+            },
+        ],
+    )
+
+    # Mock create tag response
+    client.set_response(
+        "POST",
+        "/api/v1/nodes/abc123def456abc123def456abc123de/tags",
+        201,
+        {
+            "key": "new_tag",
+            "value": "new_value",
+            "value_type": "string",
+            "created_at": "2024-01-01T00:00:00Z",
+            "updated_at": "2024-01-01T00:00:00Z",
+        },
+    )
+
+    # Mock update tag response
+    client.set_response(
+        "PUT",
+        "/api/v1/nodes/abc123def456abc123def456abc123de/tags/environment",
+        200,
+        {
+            "key": "environment",
+            "value": "staging",
+            "value_type": "string",
+            "created_at": "2024-01-01T00:00:00Z",
+            "updated_at": "2024-01-01T12:00:00Z",
+        },
+    )
+
+    # Mock move tag response
+    client.set_response(
+        "PUT",
+        "/api/v1/nodes/abc123def456abc123def456abc123de/tags/environment/move",
+        200,
+        {
+            "key": "environment",
+            "value": "production",
+            "value_type": "string",
+            "created_at": "2024-01-01T00:00:00Z",
+            "updated_at": "2024-01-01T12:00:00Z",
+        },
+    )
+
+    # Mock delete tag response
+    client.set_response(
+        "DELETE",
+        "/api/v1/nodes/abc123def456abc123def456abc123de/tags/environment",
+        204,
+        None,
+    )
+
+    return client
+
+
+@pytest.fixture
+def admin_app(mock_http_client_admin: MockHttpClient) -> Any:
+    """Create a web app with admin enabled."""
+    app = create_app(
+        api_url="http://localhost:8000",
+        api_key="test-api-key",
+        network_name="Test Network",
+        network_city="Test City",
+        network_country="Test Country",
+        network_radio_config="Test Radio Config",
+        network_contact_email="test@example.com",
+        admin_enabled=True,
+    )
+
+    app.state.http_client = mock_http_client_admin
+
+    return app
+
+
+@pytest.fixture
+def admin_app_disabled(mock_http_client_admin: MockHttpClient) -> Any:
+    """Create a web app with admin disabled."""
+    app = create_app(
+        api_url="http://localhost:8000",
+        api_key="test-api-key",
+        network_name="Test Network",
+        network_city="Test City",
+        network_country="Test Country",
+        network_radio_config="Test Radio Config",
+        network_contact_email="test@example.com",
+        admin_enabled=False,
+    )
+
+    app.state.http_client = mock_http_client_admin
+
+    return app
+
+
+@pytest.fixture
+def admin_client(admin_app: Any, mock_http_client_admin: MockHttpClient) -> TestClient:
+    """Create a test client with admin enabled."""
+    admin_app.state.http_client = mock_http_client_admin
+    return TestClient(admin_app, raise_server_exceptions=True)
+
+
+@pytest.fixture
+def admin_client_disabled(
+    admin_app_disabled: Any, mock_http_client_admin: MockHttpClient
+) -> TestClient:
+    """Create a test client with admin disabled."""
+    admin_app_disabled.state.http_client = mock_http_client_admin
+    return TestClient(admin_app_disabled, raise_server_exceptions=True)
+
+
+class TestAdminHome:
+    """Tests for admin home page."""
+
+    def test_admin_home_enabled(self, admin_client):
+        """Test admin home page when enabled."""
+        response = admin_client.get("/a/")
+        assert response.status_code == 200
+        assert "Admin" in response.text
+        assert "Node Tags" in response.text
+
+    def test_admin_home_disabled(self, admin_client_disabled):
+        """Test admin home page when disabled."""
+        response = admin_client_disabled.get("/a/")
+        assert response.status_code == 404
+
+
+class TestAdminNodeTags:
+    """Tests for admin node tags page."""
+
+    def test_node_tags_page_no_selection(self, admin_client):
+        """Test node tags page without selecting a node."""
+        response = admin_client.get("/a/node-tags")
+        assert response.status_code == 200
+        assert "Node Tags" in response.text
+        assert "Select a Node" in response.text
+        # Should show node dropdown
+        assert "Node One" in response.text
+        assert "Node Two" in response.text
+
+    def test_node_tags_page_with_selection(self, admin_client):
+        """Test node tags page with a node selected."""
+        response = admin_client.get(
+            "/a/node-tags?public_key=abc123def456abc123def456abc123de"
+        )
+        assert response.status_code == 200
+        assert "Node Tags" in response.text
+        # Should show the selected node's tags
+        assert "environment" in response.text
+        assert "production" in response.text
+        assert "location" in response.text
+        assert "building-a" in response.text
+
+    def test_node_tags_page_disabled(self, admin_client_disabled):
+        """Test node tags page when admin is disabled."""
+        response = admin_client_disabled.get("/a/node-tags")
+        assert response.status_code == 404
+
+    def test_node_tags_page_with_message(self, admin_client):
+        """Test node tags page displays success message."""
+        response = admin_client.get(
+            "/a/node-tags?public_key=abc123def456abc123def456abc123de"
+            "&message=Tag%20created%20successfully"
+        )
+        assert response.status_code == 200
+        assert "Tag created successfully" in response.text
+
+    def test_node_tags_page_with_error(self, admin_client):
+        """Test node tags page displays error message."""
+        response = admin_client.get(
+            "/a/node-tags?public_key=abc123def456abc123def456abc123de"
+            "&error=Tag%20already%20exists"
+        )
+        assert response.status_code == 200
+        assert "Tag already exists" in response.text
+
+
+class TestAdminCreateTag:
+    """Tests for creating node tags."""
+
+    def test_create_tag_success(self, admin_client):
+        """Test creating a new tag."""
+        response = admin_client.post(
+            "/a/node-tags",
+            data={
+                "public_key": "abc123def456abc123def456abc123de",
+                "key": "new_tag",
+                "value": "new_value",
+                "value_type": "string",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 303
+        assert "message=" in response.headers["location"]
+        assert "created" in response.headers["location"]
+
+    def test_create_tag_disabled(self, admin_client_disabled):
+        """Test creating tag when admin is disabled."""
+        response = admin_client_disabled.post(
+            "/a/node-tags",
+            data={
+                "public_key": "abc123def456abc123def456abc123de",
+                "key": "new_tag",
+                "value": "new_value",
+                "value_type": "string",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 404
+
+
+class TestAdminUpdateTag:
+    """Tests for updating node tags."""
+
+    def test_update_tag_success(self, admin_client):
+        """Test updating a tag."""
+        response = admin_client.post(
+            "/a/node-tags/update",
+            data={
+                "public_key": "abc123def456abc123def456abc123de",
+                "key": "environment",
+                "value": "staging",
+                "value_type": "string",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 303
+        assert "message=" in response.headers["location"]
+        assert "updated" in response.headers["location"]
+
+
+class TestAdminMoveTag:
+    """Tests for moving node tags."""
+
+    def test_move_tag_success(self, admin_client):
+        """Test moving a tag to another node."""
+        response = admin_client.post(
+            "/a/node-tags/move",
+            data={
+                "public_key": "abc123def456abc123def456abc123de",
+                "key": "environment",
+                "new_public_key": "xyz789xyz789xyz789xyz789xyz789xy",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 303
+        # Should redirect to destination node
+        assert "xyz789xyz789xyz789xyz789xyz789xy" in response.headers["location"]
+        assert "message=" in response.headers["location"]
+        assert "moved" in response.headers["location"]
+
+
+class TestAdminDeleteTag:
+    """Tests for deleting node tags."""
+
+    def test_delete_tag_success(self, admin_client):
+        """Test deleting a tag."""
+        response = admin_client.post(
+            "/a/node-tags/delete",
+            data={
+                "public_key": "abc123def456abc123def456abc123de",
+                "key": "environment",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 303
+        assert "message=" in response.headers["location"]
+        assert "deleted" in response.headers["location"]