Merge remote-tracking branch 'origin/main' into embedded-vnc

# Conflicts:
#	client/cmd/up.go
#	client/internal/engine.go
#	client/internal/profilemanager/config.go
#	client/proto/daemon.pb.go
#	client/server/mdm.go
#	client/server/server.go
#	client/status/status.go
#	client/ui/main.go
#	client/ui/services/windowmanager.go
#	management/internals/shared/grpc/conversion.go
#	management/server/store/sql_store.go
#	management/server/store/sql_store_test.go
#	shared/management/networkmap/envelope.go
#	shared/management/proto/management.pb.go

shared/management/proto/management.proto

@@ -277,6 +277,7 @@ message PeerSystemMeta {
 
   repeated PeerCapability capabilities = 18;
   int32 syncMessageVersion = 19;
+  repeated CertificateProof certificateProofs = 20;
 }
 
 message LoginResponse {
@@ -473,7 +474,8 @@ message NetworkMap {
   // RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
   bool routesFirewallRulesIsEmpty = 11;
 
-  repeated ForwardingRule forwardingRules = 12;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  repeated ForwardingRule forwardingRules = 12 [deprecated = true];
 
   // SSHAuth represents SSH authorization configuration
   SSHAuth sshAuth = 13;
@@ -595,8 +597,18 @@ message DeviceAuthorizationFlow {
   }
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
-message PKCEAuthorizationFlowRequest {}
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
+message PKCEAuthorizationFlowRequest {
+  // SessionExtend indicates the flow will renew the SSO session of a peer that
+  // is already registered, rather than log in or register one. An extend is
+  // bound to the account that peer belongs to, so the server must not answer it
+  // with a configuration that lets the IdP reply from whatever session is
+  // already active: with several accounts signed in at the IdP that need not be
+  // the peer's own, and the resulting token is rejected as a peer/user mismatch
+  // with no way for the user to correct it.
+  bool SessionExtend = 1;
+}
 
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow
@@ -751,6 +763,24 @@ message NetworkAddress {
 
 message Checks {
   repeated string Files = 1;
+  // certificateChallenge asks the peer to prove possession of a certificate chaining to caCertificates.
+  CertificateChallenge certificateChallenge = 2;
+}
+
+message CertificateChallenge {
+  // nonce is issued by management, bound to the peer and a time window; the peer signs it.
+  bytes nonce = 1;
+  // caCertificates are PEM encoded trust anchors the presented certificate must chain to.
+  repeated string caCertificates = 2;
+}
+
+// CertificateProof demonstrates possession of the private key of chain[0] by signing the challenge nonce.
+message CertificateProof {
+  bytes nonce = 1;
+  // chain is DER encoded, leaf first.
+  repeated bytes chain = 2;
+  string sigAlg = 3;
+  bytes signature = 4;
 }
 
 
@@ -799,17 +829,13 @@ message RouteFirewallRule {
   string RouteID = 10;
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
 message ForwardingRule {
-  // Protocol of the forwarding rule
+  option deprecated = true;
+
   RuleProtocol protocol = 1;
-
-  // portInfo is the ingress destination port information, where the traffic arrives in the gateway node
   PortInfo destinationPort = 2;
-
-  // IP address of the translated address (remote peer) to send traffic to
   bytes translatedAddress = 3;
-
-  // Translated port information, where the traffic should be forwarded to
   PortInfo translatedPort = 4;
 }
 
@@ -855,7 +881,7 @@ message StopExposeResponse {}
 // Component-based NetworkMap wire format (PeerCapabilityComponentNetworkMap).
 //
 // Peers that advertise this capability receive NetworkMap building blocks
-// (peers + groups + policies + routes + dns + ssh + forwarding) and run the
+// (peers + groups + policies + routes + dns + ssh) and run the
 // expansion (Calculate) locally instead of receiving a fully-expanded
 // NetworkMap from the server.
 // =====================================================================
@@ -873,8 +899,8 @@ message NetworkMapEnvelope {
 // client decodes it into a types.NetworkMapComponents and runs Calculate()
 // locally to produce the same NetworkMap the legacy server path would have
 // produced. Every field carries RAW component data — no server-side
-// expansion (firewall rules, DNS config, SSH auth, route firewall rules,
-// forwarding rules) is shipped; the client computes those itself.
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
 message NetworkMapComponentsFull {
   uint64 serial = 1;
 
@@ -958,12 +984,8 @@ message NetworkMapComponentsFull {
   // versions; clients fold it into their Calculate() DNS output.
   int64 dns_forwarder_port = 23;
 
-  // Pre-expanded NetworkMap fragments injected post-Calculate by external
-  // controllers (BYOP / port-forwarding proxies). The receiving client
-  // merges these into its locally-computed NetworkMap the same way the
-  // legacy server does via NetworkMap.Merge — so downstream consumers see
-  // a unified merged result regardless of source.
-  ProxyPatch proxy_patch = 24;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  ProxyPatch proxy_patch = 24 [deprecated = true];
 
   // SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
   // "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
@@ -976,12 +998,10 @@ message NetworkMapComponentsFull {
   reserved 26 to 50;
 }
 
-// ProxyPatch carries NetworkMap fragments that don't fit the component-graph
-// model — they're pre-expanded by external controllers (BYOP /
-// port-forwarding proxies) and injected post-Calculate. Fields use the
-// legacy wire types because the proxy delivers them pre-formed; there is
-// no raw component shape to convert from. Empty when no proxy is active.
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
 message ProxyPatch {
+  option deprecated = true;
+
   repeated RemotePeerConfig peers = 1;
   repeated RemotePeerConfig offline_peers = 2;
   repeated FirewallRule firewall_rules = 3;

shared/management/proto/proxy_service.proto

@@ -105,6 +105,12 @@ enum PathRewriteMode {
   PATH_REWRITE_PRESERVE = 1;
 }
 
+enum TargetAccessAction {
+  TARGET_ACCESS_ACTION_INHERIT = 0;
+  TARGET_ACCESS_ACTION_BYPASS = 1;
+  TARGET_ACCESS_ACTION_BLOCK = 2;
+}
+
 message PathTargetOptions {
   bool skip_tls_verify = 1;
   google.protobuf.Duration request_timeout = 2;
@@ -178,6 +184,7 @@ message PathMapping {
   string path = 1;
   string target = 2;
   PathTargetOptions options = 3;
+  TargetAccessAction access_action = 4;
 }
 
 message HeaderAuth {
@@ -363,7 +370,9 @@ message GetOIDCURLResponse {
 
 message ValidateSessionRequest {
   string domain = 1;
-  string session_token = 2;
+  string session_token = 2 [deprecated = true];
+  // session_code is a short-lived, single-use code exchanged for a session token.
+  string session_code = 3;
 }
 
 message ValidateSessionResponse {
@@ -380,6 +389,8 @@ message ValidateSessionResponse {
   // Stamped onto upstream requests as X-NetBird-Groups so downstream
   // services can read names rather than opaque ids.
   repeated string peer_group_names = 6;
+  // session_token contains the durable token issued when session_code is redeemed.
+  string session_token = 7;
 }
 
 // ValidateTunnelPeerRequest carries the inbound peer's tunnel IP and the
@@ -506,4 +517,3 @@ message RecordLLMUsageRequest {
 
 message RecordLLMUsageResponse {
 }
-