fix admin user persm

devices/views.py

@@ -4,7 +4,7 @@ from rest_framework import generics, status
 from rest_framework.response import Response
 from django_filters.rest_framework import DjangoFilterBackend
 from billing.models import Payment
-from .models import Device
+from .models import Device, normalize_mac
 from django.db.models import Prefetch
 from .serializers import (
     CreateDeviceSerializer,
@@ -79,9 +79,13 @@ class DeviceListCreateAPIView(
         raw_mac = request.data.get("mac", None)
         mac = raw_mac.strip() if raw_mac else None
         MAC_REGEX = re.compile(r"^([0-9A-Fa-f]{2}([.:-]?)){5}[0-9A-Fa-f]{2}$")
-        NORMALIZE_MAC_REGEX = re.compile(r"[^0-9A-Fa-f]")
         if not isinstance(mac, str) or not MAC_REGEX.match(mac):
             return Response({"message": "Invalid mac address."}, status=400)
+
+        # Canonicalize BEFORE checking uniqueness and before saving, so that
+        # the same physical MAC in different formats/cases is treated as one.
+        mac = normalize_mac(mac)
+
         if Device.objects.filter(mac=mac).exists():
             return Response(
                 {"message": "Device with this mac address already exists."}, status=400
@@ -90,8 +94,9 @@ class DeviceListCreateAPIView(
         if not mac_details.ok:
             return Response({"message": "MAC address vendor not found."}, status=400)
 
-        mac = re.sub(NORMALIZE_MAC_REGEX, "-", mac).upper()
-
+        # The serializer canonicalizes the MAC again on save (see
+        # CreateDeviceSerializer.validate_mac), so the stored value matches
+        # what we checked above regardless of the raw request format.
         return super().create(request, *args, **kwargs)
 
     def perform_create(self, serializer):