Merge remote-tracking branch 'origin/main' into fix_debug_upload_url_from_mgmt

# Conflicts:
#	client/proto/daemon.pb.go
#	management/internals/controllers/network_map/controller/controller.go
#	management/internals/controllers/network_map/nmaptest/runner.go
#	management/internals/shared/grpc/server.go
#	management/server/account.go
#	shared/management/proto/management.pb.go
#	upload-server/server/server.go

client/ios/NetBirdSDK/client.go

@@ -129,6 +129,10 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 
 // SetConfigFromJSON stores the JSON config that later loads resolve instead of the config file (tvOS).
 func (c *Client) SetConfigFromJSON(jsonStr string) error {
+	// Parsed only to reject an unreadable document early; the JSON itself is
+	// what is stored, and every load re-parses it. A document carrying no peer
+	// identity is readable and accepted: that is a logged-out profile, and the
+	// login that follows provisions the keys.
 	if _, err := profilemanager.ConfigFromJSON(jsonStr); err != nil {
 		log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
 		return err
@@ -484,7 +488,7 @@ func (c *Client) LoginForMobile() string {
 	}
 	c.applyMDMOverlay(cfg)
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "", false)
 	if err != nil {
 		return err.Error()
 	}

client/ios/NetBirdSDK/login.go

@@ -330,7 +330,7 @@ func profileLoginHint(cfgPath string) string {
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, profileLoginHint(a.cfgPath))
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false, profileLoginHint(a.cfgPath))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
@@ -379,6 +379,35 @@ func (a *Auth) SetConfigFromJSON(jsonStr string) error {
 }
 
 func (a *Auth) setBaseConfig(base *profilemanager.Config) error {
+	// A logged-out profile carries no keys: the mobile logout clears them in
+	// place so the next login registers a new peer instead of resurrecting the
+	// old one. This is that login, and auth.NewAuth parses the WireGuard key
+	// before the SSO flow even starts, so an absent identity fails the login on
+	// key size rather than asking the user to sign in.
+	//
+	// Minted on the base config, which is the one GetConfigJSON hands back for
+	// the caller to store — the overlaid copy below is runtime-only.
+	generated, err := base.EnsureIdentity()
+	if err != nil {
+		return fmt.Errorf("ensure profile identity: %w", err)
+	}
+	if generated {
+		if a.cfgPath != "" {
+			// Non-atomic, like NewAuth's own write: the tvOS App Group sandbox
+			// blocks the temp-file-and-rename an atomic write needs.
+			if err := profilemanager.DirectWriteOutConfig(a.cfgPath, base); err != nil {
+				return fmt.Errorf("write out profile config: %w", err)
+			}
+		} else {
+			// No file to write to — this is the tvOS path, where the profile
+			// lives in the caller's own store. It persists the new identity by
+			// calling GetConfigJSON once the login completes; until then the
+			// keys exist only here, and a login that never completes leaves
+			// nothing behind.
+			log.Infof("provisioned a peer identity for a config with no file on disk")
+		}
+	}
+
 	overlaid, err := copyConfig(base)
 	if err != nil {
 		return err

client/ios/NetBirdSDK/preferences.go

@@ -49,7 +49,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -67,7 +67,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -89,7 +89,7 @@ func (p *Preferences) HasPreSharedKey() (bool, error) {
 		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -115,7 +115,7 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -136,7 +136,7 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +149,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -168,7 +168,7 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}