Merge remote-tracking branch 'origin/main' into embedded-vnc

# Conflicts:
#	client/cmd/up.go
#	client/internal/engine.go
#	client/internal/profilemanager/config.go
#	client/proto/daemon.pb.go
#	client/server/mdm.go
#	client/server/server.go
#	client/status/status.go
#	client/ui/main.go
#	client/ui/services/windowmanager.go
#	management/internals/shared/grpc/conversion.go
#	management/server/store/sql_store.go
#	management/server/store/sql_store_test.go
#	shared/management/networkmap/envelope.go
#	shared/management/proto/management.pb.go

shared/management/networkmap/envelope.go

@@ -15,7 +15,7 @@ import (
 //   - NetworkMap is the *proto.NetworkMap shape the engine reads today via
 //     update.GetNetworkMap() — built from the envelope's components by
 //     running Calculate() locally + converting back through the shared
-//     proto helpers + merging the optional ProxyPatch.
+//     proto helpers.
 //   - Components is the *types.NetworkMapComponents the engine retains so
 //     future incremental delta updates have a base to apply changes
 //     against. The client keeps it under its sync lock.
@@ -26,8 +26,8 @@ type EnvelopeResult struct {
 
 // EnvelopeToNetworkMap is the full client-side pipeline: decode the
 // component envelope back to a typed NetworkMapComponents, run Calculate()
-// locally to produce the typed NetworkMap, convert it to the wire form the
-// engine consumes, and fold in any ProxyPatch the server attached.
+// locally to produce the typed NetworkMap and convert it to the wire form the
+// engine consumes.
 //
 // localPeerKey is the receiving peer's WG pub key (used to derive
 // includeIPv6 / useSourcePrefixes from the receiving peer's own record in
@@ -128,74 +128,12 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 		}
 	}
 
-	if typedNM.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(typedNM.ForwardingRules))
-		for _, rule := range typedNM.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		protoNM.ForwardingRules = forwardingRules
-	}
-
-	// Merge the proxy patch the server attached. Mirrors the legacy
-	// NetworkMap.Merge step that the server runs after Calculate().
-	if full != nil && full.ProxyPatch != nil {
-		mergeProxyPatch(protoNM, full.ProxyPatch)
-	}
-
 	return &EnvelopeResult{
 		NetworkMap: protoNM,
 		Components: components,
 	}, nil
 }
 
-// mergeProxyPatch folds a ProxyPatch's pre-expanded fragments into the
-// proto.NetworkMap that Calculate() produced. Mirrors types.NetworkMap.Merge
-// — same six collections, deduplicated where the legacy merge dedupes.
-func mergeProxyPatch(nm *proto.NetworkMap, patch *proto.ProxyPatch) {
-	nm.RemotePeers = appendUniquePeers(nm.RemotePeers, patch.Peers)
-	nm.OfflinePeers = appendUniquePeers(nm.OfflinePeers, patch.OfflinePeers)
-	nm.FirewallRules = append(nm.FirewallRules, patch.FirewallRules...)
-	nm.Routes = append(nm.Routes, patch.Routes...)
-	nm.RoutesFirewallRules = append(nm.RoutesFirewallRules, patch.RouteFirewallRules...)
-	nm.ForwardingRules = append(nm.ForwardingRules, patch.ForwardingRules...)
-	if len(nm.RemotePeers) > 0 {
-		nm.RemotePeersIsEmpty = false
-	}
-	if len(nm.FirewallRules) > 0 {
-		nm.FirewallRulesIsEmpty = false
-	}
-	if len(nm.RoutesFirewallRules) > 0 {
-		nm.RoutesFirewallRulesIsEmpty = false
-	}
-}
-
-// appendUniquePeers dedupes by WgPubKey — mirrors legacy
-// mergeUniquePeersByID's intent (legacy keyed off Peer.ID; in proto form the
-// closest stable identifier is WgPubKey).
-func appendUniquePeers(dst, extra []*proto.RemotePeerConfig) []*proto.RemotePeerConfig {
-	if len(extra) == 0 {
-		return dst
-	}
-	seen := make(map[string]struct{}, len(dst))
-	for _, p := range dst {
-		if p == nil {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-	}
-	for _, p := range extra {
-		if p == nil {
-			continue
-		}
-		if _, ok := seen[p.WgPubKey]; ok {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-		dst = append(dst, p)
-	}
-	return dst
-}
-
 func trimKey(s string) string {
 	if len(s) > 12 {
 		return s[:12]

shared/management/networkmap/nmdata/peer.go

@@ -56,6 +56,7 @@ type PeerSystemMeta struct {
 	KernelVersion      string
 	NetworkAddresses   []NetworkAddress
 	Files              []File
+	Certificates       []string
 	Capabilities       []int32
 	Flags              Flags
 	SyncMessageVersion int

shared/management/networkmap/nmdata/posture.go

@@ -18,6 +18,7 @@ type ChecksDefinition struct {
 	GeoLocationCheck      *GeoLocationCheck
 	PeerNetworkRangeCheck *PeerNetworkRangeCheck
 	ProcessCheck          *ProcessCheck
+	CertificateCheck      *CertificateCheck
 }
 
 // Check is the slim twin of posture.Check. It is sealed: only the check types
@@ -79,5 +80,8 @@ func (pc *PostureChecks) GetChecks() []Check {
 	if pc.Checks.ProcessCheck != nil {
 		checks = append(checks, pc.Checks.ProcessCheck)
 	}
+	if pc.Checks.CertificateCheck != nil {
+		checks = append(checks, pc.Checks.CertificateCheck)
+	}
 	return checks
 }

shared/management/networkmap/nmdata/posture_certificate.go

@@ -0,0 +1,16 @@
+package nmdata
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// CertificateCheck is the slim twin of posture.CertificateCheck.
+type CertificateCheck struct {
+	CACertificates []string
+}
+
+func (c *CertificateCheck) check(peer *Peer) (bool, error) {
+	return certposture.AnyChainMatchesCAs(peer.Meta.Certificates, c.CACertificates, time.Now()), nil
+}

shared/management/networkmap/nmdata/posture_certificate_test.go

@@ -0,0 +1,28 @@
+package nmdata
+
+import (
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestCertificateCheck_Check(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chain := certposture.EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	c := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{ca.PEM}}})
+	without := &Peer{}
+	with := &Peer{Meta: PeerSystemMeta{Certificates: []string{chain}}}
+
+	assert.False(t, c[0].Passes(without))
+	assert.True(t, c[0].Passes(with))
+	assert.True(t, PostureVerdictChanged(c, without, with))
+
+	otherOnly := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{otherCA.PEM}}})
+	assert.False(t, otherOnly[0].Passes(with))
+}