[client] Extract SSH JWT cache into shared jwtcache package

Move the daemon's memguard-backed JWT token cache from client/server
into client/ssh/jwtcache so it can be reused outside the daemon
process. The TTL derivation from Config.SSHJWTCacheTTL (nil=default,
0=disabled) moves into jwtcache.ResolveTTL.

Wire the cache into the iOS SDK's SSH client: iOS has no daemon to
delegate caching to, so without it every reconnect forced the user
through the browser OAuth device-code flow. The cache lives on the
long-lived Client (the app creates a new SSHClient per session) and
uses the same config-driven TTL semantics as the daemon.

client/server/jwt_cache.go

@@ -1,79 +0,0 @@
-package server
-
-import (
-	"sync"
-	"time"
-
-	"github.com/awnumar/memguard"
-	log "github.com/sirupsen/logrus"
-)
-
-type jwtCache struct {
-	mu           sync.RWMutex
-	enclave      *memguard.Enclave
-	expiresAt    time.Time
-	timer        *time.Timer
-	maxTokenSize int
-}
-
-func newJWTCache() *jwtCache {
-	return &jwtCache{
-		maxTokenSize: 8192,
-	}
-}
-
-func (c *jwtCache) store(token string, maxAge time.Duration) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	c.cleanup()
-
-	if c.timer != nil {
-		c.timer.Stop()
-	}
-
-	tokenBytes := []byte(token)
-	c.enclave = memguard.NewEnclave(tokenBytes)
-
-	c.expiresAt = time.Now().Add(maxAge)
-
-	var timer *time.Timer
-	timer = time.AfterFunc(maxAge, func() {
-		c.mu.Lock()
-		defer c.mu.Unlock()
-		if c.timer != timer {
-			return
-		}
-		c.cleanup()
-		c.timer = nil
-		log.Debugf("JWT token cache expired after %v, securely wiped from memory", maxAge)
-	})
-	c.timer = timer
-}
-
-func (c *jwtCache) get() (string, bool) {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-
-	if c.enclave == nil || time.Now().After(c.expiresAt) {
-		return "", false
-	}
-
-	buffer, err := c.enclave.Open()
-	if err != nil {
-		log.Debugf("Failed to open JWT token enclave: %v", err)
-		return "", false
-	}
-	defer buffer.Destroy()
-
-	token := string(buffer.Bytes())
-	return token, true
-}
-
-// cleanup destroys the secure enclave, must be called with lock held
-func (c *jwtCache) cleanup() {
-	if c.enclave != nil {
-		c.enclave = nil
-	}
-	c.expiresAt = time.Time{}
-}

client/server/server.go

@@ -26,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
 	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/ssh/jwtcache"
 	"github.com/netbirdio/netbird/client/system"
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -50,9 +51,6 @@ const (
 	defaultMaxRetryTime     = 14 * 24 * time.Hour
 	defaultRetryMultiplier  = 1.7
 
-	// JWT token cache TTL for the client daemon (disabled by default)
-	defaultJWTCacheTTL = 0
-
 	errRestoreResidualState   = "failed to restore residual state: %v"
 	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
@@ -134,7 +132,7 @@ type Server struct {
 
 	updateManager *updater.Manager
 
-	jwtCache *jwtCache
+	jwtCache *jwtcache.Cache
 }
 
 type oauthAuthFlow struct {
@@ -156,7 +154,7 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		updateSettingsDisabled: updateSettingsDisabled,
 		captureEnabled:         captureEnabled,
 		networksDisabled:       networksDisabled,
-		jwtCache:               newJWTCache(),
+		jwtCache:               jwtcache.New(),
 		extendAuthSessionFlow:  auth.NewPendingFlow(),
 		probeThrottle:          newProbeThrottle(probeThreshold),
 	}
@@ -1624,19 +1622,11 @@ func (s *Server) getJWTCacheTTL() time.Duration {
 	config := s.config
 	s.mutex.Unlock()
 
-	if config == nil || config.SSHJWTCacheTTL == nil {
-		return defaultJWTCacheTTL
+	if config == nil {
+		return jwtcache.DefaultTTL
 	}
 
-	seconds := *config.SSHJWTCacheTTL
-	if seconds == 0 {
-		log.Debug("SSH JWT cache disabled (configured to 0)")
-		return 0
-	}
-
-	ttl := time.Duration(seconds) * time.Second
-	log.Debugf("SSH JWT cache TTL set to %v from config", ttl)
-	return ttl
+	return jwtcache.ResolveTTL(config.SSHJWTCacheTTL)
 }
 
 // RequestJWTAuth initiates JWT authentication flow for SSH
@@ -1658,7 +1648,7 @@ func (s *Server) RequestJWTAuth(
 
 	jwtCacheTTL := s.getJWTCacheTTL()
 	if jwtCacheTTL > 0 {
-		if cachedToken, found := s.jwtCache.get(); found {
+		if cachedToken, found := s.jwtCache.Get(); found {
 			log.Debugf("JWT token found in cache, returning cached token for SSH authentication")
 
 			return &proto.RequestJWTAuthResponse{
@@ -1731,7 +1721,7 @@ func (s *Server) WaitJWTToken(
 
 	jwtCacheTTL := s.getJWTCacheTTL()
 	if jwtCacheTTL > 0 {
-		s.jwtCache.store(token, jwtCacheTTL)
+		s.jwtCache.Store(token, jwtCacheTTL)
 		log.Debugf("JWT token cached for SSH authentication, TTL: %v", jwtCacheTTL)
 	} else {
 		log.Debug("JWT caching disabled, not storing token")