Revert "Merge main"

This reverts commit 89f95b15482030ed9d3aee8d3caab68c65f43055.

shared/context/keys.go

@@ -3,7 +3,6 @@ package context
 const (
 	RequestIDKey = "requestID"
 	AccountIDKey = "accountID"
-	RoleKey      = "role"
 	UserIDKey    = "userID"
 	PeerIDKey    = "peerID"
 )

shared/management/client/client.go

@@ -16,10 +16,6 @@ type Client interface {
 	Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error
 	Register(setupKey string, jwtToken string, sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	Login(sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
-	// ExtendAuthSession refreshes the peer's SSO session deadline using a fresh JWT.
-	// Returns the new absolute deadline; zero time when the server reports the peer
-	// is not eligible for session extension.
-	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
 	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
 	GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error)

shared/management/client/client_test.go

@@ -17,8 +17,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
+	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -89,7 +89,7 @@ func startManagement(t *testing.T) (*grpc.Server, net.Listener) {
 			gomock.Any(),
 			gomock.Any(),
 		).
-		Return(true, context.Background(), nil).
+		Return(true, nil).
 		AnyTimes()
 
 	peersManger := peers.NewManager(store, permissionsManagerMock)

shared/management/client/grpc.go

@@ -607,61 +607,6 @@ func (c *GrpcClient) Login(sysInfo *system.Info, pubSSHKey []byte, dnsLabels dom
 	return c.login(&proto.LoginRequest{Meta: infoToMetaData(sysInfo), PeerKeys: keys, DnsLabels: dnsLabels.ToPunycodeList()})
 }
 
-// ExtendAuthSession refreshes the peer's SSO session deadline on the management
-// server using a freshly issued JWT. The tunnel is untouched: no network map
-// sync, no peer reconnect. Returns the new absolute UTC deadline (zero time
-// when the server reports the field empty).
-func (c *GrpcClient) ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error) {
-	if !c.ready() {
-		return nil, errors.New(errMsgNoMgmtConnection)
-	}
-
-	serverKey, err := c.getServerPublicKey()
-	if err != nil {
-		return nil, err
-	}
-
-	reqBody, err := encryption.EncryptMessage(*serverKey, c.key, &proto.ExtendAuthSessionRequest{
-		JwtToken: jwtToken,
-		Meta:     infoToMetaData(sysInfo),
-	})
-	if err != nil {
-		log.Errorf("failed to encrypt extend auth session message: %s", err)
-		return nil, err
-	}
-
-	var resp *proto.EncryptedMessage
-	operation := func() error {
-		mgmCtx, cancel := context.WithTimeout(context.Background(), ConnectTimeout)
-		defer cancel()
-
-		var err error
-		resp, err = c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
-			WgPubKey: c.key.PublicKey().String(),
-			Body:     reqBody,
-		})
-		if err != nil {
-			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.Canceled {
-				return err
-			}
-			return backoff.Permanent(err)
-		}
-		return nil
-	}
-
-	if err := backoff.Retry(operation, nbgrpc.Backoff(c.ctx)); err != nil {
-		log.Errorf("failed to extend auth session on Management Service: %v", err)
-		return nil, err
-	}
-
-	out := &proto.ExtendAuthSessionResponse{}
-	if err := encryption.DecryptMessage(*serverKey, c.key, resp.Body, out); err != nil {
-		log.Errorf("failed to decrypt extend auth session response: %s", err)
-		return nil, err
-	}
-	return out, nil
-}
-
 // GetDeviceAuthorizationFlow returns a device authorization flow information.
 // It also takes care of encrypting and decrypting messages.
 func (c *GrpcClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error) {

shared/management/client/mock.go

@@ -14,7 +14,6 @@ type MockClient struct {
 	SyncFunc                       func(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
 	RegisterFunc                   func(setupKey string, jwtToken string, info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	LoginFunc                      func(info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
-	ExtendAuthSessionFunc          func(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlowFunc func() (*proto.DeviceAuthorizationFlow, error)
 	GetPKCEAuthorizationFlowFunc   func() (*proto.PKCEAuthorizationFlow, error)
 	GetServerURLFunc               func() string
@@ -66,13 +65,6 @@ func (m *MockClient) Login(info *system.Info, sshKey []byte, dnsLabels domain.Li
 	return m.LoginFunc(info, sshKey, dnsLabels)
 }
 
-func (m *MockClient) ExtendAuthSession(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error) {
-	if m.ExtendAuthSessionFunc == nil {
-		return nil, nil
-	}
-	return m.ExtendAuthSessionFunc(info, jwtToken)
-}
-
 func (m *MockClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error) {
 	if m.GetDeviceAuthorizationFlowFunc == nil {
 		return nil, nil

shared/management/client/rest/reverse_proxy_clusters.go

@@ -2,7 +2,6 @@ package rest
 
 import (
 	"context"
-	"errors"
 	"net/url"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -34,12 +33,6 @@ func (a *ReverseProxyClustersAPI) List(ctx context.Context) ([]api.ProxyCluster,
 // NetBird cannot be deleted via this endpoint; the server returns 404 / 400
 // for cluster addresses the account does not own.
 func (a *ReverseProxyClustersAPI) Delete(ctx context.Context, clusterAddress string) error {
-	// Guard against the empty input: url.PathEscape("") returns "" which
-	// would collapse the request URL onto the collection endpoint and
-	// silently delete nothing (or 405 depending on routing).
-	if clusterAddress == "" {
-		return errors.New("clusterAddress is required")
-	}
 	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/reverse-proxies/clusters/"+url.PathEscape(clusterAddress), nil, nil)
 	if err != nil {
 		return err

shared/management/client/rest/reverse_proxy_clusters_test.go

@@ -88,17 +88,3 @@ func TestReverseProxyClusters_Delete_Err(t *testing.T) {
 		assert.Error(t, err)
 	})
 }
-
-// TestReverseProxyClusters_Delete_EmptyAddress guards against an empty
-// clusterAddress reaching the wire — that would collapse the URL onto
-// the collection endpoint instead of a specific cluster. The client
-// must short-circuit with a typed error before any request is issued.
-func TestReverseProxyClusters_Delete_EmptyAddress(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/reverse-proxies/clusters/", func(http.ResponseWriter, *http.Request) {
-			t.Fatal("empty clusterAddress must be rejected client-side; no request should reach the server")
-		})
-		err := c.ReverseProxyClusters.Delete(context.Background(), "")
-		assert.Error(t, err, "empty clusterAddress must surface as an error")
-	})
-}

shared/management/client/rest/reverse_proxy_tokens.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"net/url"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -62,12 +61,6 @@ func (a *ReverseProxyTokensAPI) Create(ctx context.Context, request api.ProxyTok
 // credentials existed; the plain secret can no longer authenticate any
 // new proxy registration.
 func (a *ReverseProxyTokensAPI) Delete(ctx context.Context, tokenID string) error {
-	// Guard against the empty input: url.PathEscape("") returns "" which
-	// would collapse the request URL onto the collection endpoint and
-	// silently delete nothing (or 405 depending on routing).
-	if tokenID == "" {
-		return errors.New("tokenID is required")
-	}
 	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/reverse-proxies/proxy-tokens/"+url.PathEscape(tokenID), nil, nil)
 	if err != nil {
 		return err

shared/management/client/rest/reverse_proxy_tokens_test.go

@@ -129,16 +129,3 @@ func TestReverseProxyTokens_Delete_Err(t *testing.T) {
 		assert.Error(t, err)
 	})
 }
-
-// TestReverseProxyTokens_Delete_EmptyID guards against an empty tokenID
-// reaching the wire — url.PathEscape("") would collapse the URL onto
-// the collection endpoint.
-func TestReverseProxyTokens_Delete_EmptyID(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/reverse-proxies/proxy-tokens/", func(http.ResponseWriter, *http.Request) {
-			t.Fatal("empty tokenID must be rejected client-side; no request should reach the server")
-		})
-		err := c.ReverseProxyTokens.Delete(context.Background(), "")
-		assert.Error(t, err, "empty tokenID must surface as an error")
-	})
-}

shared/management/http/api/openapi.yml

@@ -3086,24 +3086,6 @@ components:
         - enabled
         - auth
         - meta
-      allOf:
-        # When private=true, access_groups must be present and non-empty,
-        # and the service mode must be "http". The bearer-auth mutex is
-        # enforced at the service-validation layer
-        # (validatePrivateRequirements) because it sits in a nested
-        # ServiceAuthConfig and isn't cleanly expressible here.
-        - if:
-            required: [private]
-            properties:
-              private:
-                const: true
-          then:
-            required: [access_groups]
-            properties:
-              access_groups:
-                minItems: 1
-              mode:
-                const: http
     ServiceMeta:
       type: object
       properties:
@@ -3191,23 +3173,6 @@ components:
         - name
         - domain
         - enabled
-      allOf:
-        # Mirror of the Service conditional: when private=true the
-        # request must carry a non-empty access_groups list and the
-        # mode must be "http". The bearer-auth mutex is enforced at the
-        # service-validation layer (validatePrivateRequirements).
-        - if:
-            required: [private]
-            properties:
-              private:
-                const: true
-          then:
-            required: [access_groups]
-            properties:
-              access_groups:
-                minItems: 1
-              mode:
-                const: http
     ServiceTargetOptions:
       type: object
       properties:

shared/management/proto/management.proto

@@ -52,14 +52,6 @@ service ManagementService {
   // Executes a job on a target peer (e.g., debug bundle)
   rpc Job(stream EncryptedMessage) returns (stream EncryptedMessage) {}
 
-  // ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
-  // Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
-  // but does not redo the network-map sync. Only valid for SSO-registered peers where
-  // login expiration is enabled. The tunnel remains up.
-  // EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
-  // EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
-  rpc ExtendAuthSession(EncryptedMessage) returns (EncryptedMessage) {}
-
   // CreateExpose creates a temporary reverse proxy service for a peer
   rpc CreateExpose(EncryptedMessage) returns (EncryptedMessage) {}
 
@@ -141,15 +133,6 @@ message SyncResponse {
 
   // Posture checks to be evaluated by client
   repeated Checks Checks = 6;
-
-  // 3-state session deadline. Carried on every Sync snapshot so admin-side
-  // changes propagate live without a client reconnect.
-  //   field unset (nil)        → snapshot carries no info; client keeps the
-  //                              deadline it already had
-  //   set, seconds=0 nanos=0   → explicit "expiry disabled" or peer is not
-  //                              SSO-registered; client clears its anchor
-  //   set, valid timestamp     → new absolute UTC deadline
-  google.protobuf.Timestamp sessionExpiresAt = 7;
 }
 
 message  SyncMetaRequest {
@@ -261,31 +244,6 @@ message LoginResponse {
   PeerConfig peerConfig = 2;
   // Posture checks to be evaluated by client
   repeated Checks Checks = 3;
-
-  // 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
-  //   field unset (nil)        → no info; client keeps any deadline it had
-  //   set, seconds=0 nanos=0   → explicit "expiry disabled" / non-SSO peer
-  //   set, valid timestamp     → new absolute UTC deadline
-  google.protobuf.Timestamp sessionExpiresAt = 4;
-}
-
-// ExtendAuthSessionRequest carries a fresh JWT to refresh the peer's session deadline.
-// The encrypted body of an EncryptedMessage with this payload is sent to the
-// ExtendAuthSession RPC.
-message ExtendAuthSessionRequest {
-  // SSO token (must be a fresh, valid JWT for the peer's owning user)
-  string jwtToken = 1;
-  // Meta data of the peer (used for IdP user info refresh consistent with Login)
-  PeerSystemMeta meta = 2;
-}
-
-// ExtendAuthSessionResponse contains the refreshed session deadline.
-message ExtendAuthSessionResponse {
-  // 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
-  // In practice ExtendAuthSession only succeeds for SSO peers with expiry
-  // enabled, so this carries a valid timestamp on the success path. The
-  // 3-state encoding is documented here for symmetry with Login/Sync.
-  google.protobuf.Timestamp sessionExpiresAt = 1;
 }
 
 message ServerKeyResponse {

shared/management/proto/management_grpc.pb.go

@@ -52,13 +52,6 @@ type ManagementServiceClient interface {
 	Logout(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ctx context.Context, opts ...grpc.CallOption) (ManagementService_JobClient, error)
-	// ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
-	// Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
-	// but does not redo the network-map sync. Only valid for SSO-registered peers where
-	// login expiration is enabled. The tunnel remains up.
-	// EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
-	// EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
-	ExtendAuthSession(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
 	// CreateExpose creates a temporary reverse proxy service for a peer
 	CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
 	// RenewExpose extends the TTL of an active expose session
@@ -201,15 +194,6 @@ func (x *managementServiceJobClient) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
-func (c *managementServiceClient) ExtendAuthSession(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
-	out := new(EncryptedMessage)
-	err := c.cc.Invoke(ctx, "/management.ManagementService/ExtendAuthSession", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *managementServiceClient) CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
 	out := new(EncryptedMessage)
 	err := c.cc.Invoke(ctx, "/management.ManagementService/CreateExpose", in, out, opts...)
@@ -275,13 +259,6 @@ type ManagementServiceServer interface {
 	Logout(context.Context, *EncryptedMessage) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ManagementService_JobServer) error
-	// ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
-	// Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
-	// but does not redo the network-map sync. Only valid for SSO-registered peers where
-	// login expiration is enabled. The tunnel remains up.
-	// EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
-	// EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
-	ExtendAuthSession(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
 	// CreateExpose creates a temporary reverse proxy service for a peer
 	CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
 	// RenewExpose extends the TTL of an active expose session
@@ -322,9 +299,6 @@ func (UnimplementedManagementServiceServer) Logout(context.Context, *EncryptedMe
 func (UnimplementedManagementServiceServer) Job(ManagementService_JobServer) error {
 	return status.Errorf(codes.Unimplemented, "method Job not implemented")
 }
-func (UnimplementedManagementServiceServer) ExtendAuthSession(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ExtendAuthSession not implemented")
-}
 func (UnimplementedManagementServiceServer) CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateExpose not implemented")
 }
@@ -520,24 +494,6 @@ func (x *managementServiceJobServer) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
-func _ManagementService_ExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(EncryptedMessage)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ManagementServiceServer).ExtendAuthSession(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/management.ManagementService/ExtendAuthSession",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ManagementServiceServer).ExtendAuthSession(ctx, req.(*EncryptedMessage))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _ManagementService_CreateExpose_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(EncryptedMessage)
 	if err := dec(in); err != nil {
@@ -627,10 +583,6 @@ var ManagementService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Logout",
 			Handler:    _ManagementService_Logout_Handler,
 		},
-		{
-			MethodName: "ExtendAuthSession",
-			Handler:    _ManagementService_ExtendAuthSession_Handler,
-		},
 		{
 			MethodName: "CreateExpose",
 			Handler:    _ManagementService_CreateExpose_Handler,

shared/management/proto/proxy_service.proto

@@ -237,7 +237,7 @@ message SendStatusUpdateRequest {
   bool certificate_issued = 4;
   optional string error_message = 5;
   // Per-account inbound listener state for the account that owns
-  // service_id. Populated only when --private is enabled and the
+  // service_id. Populated only when --private-inbound is enabled and the
   // embedded client for the account is up. Field numbers >=50 reserved
   // for observability extensions.
   optional ProxyInboundListener inbound_listener = 50;