Replace RequireFlowInitiator with AuthzLevel and clear flow on switch profile

client/server/server.go

@@ -165,9 +165,9 @@ type oauthAuthFlow struct {
 	info      auth.AuthFlowInfo
 
 	// cacheGeneration is the SSH JWT cache's generation as of the start of the
-	// request that created this flow. The flow outlives a profile switch, so
-	// reading the generation any later — when the IdP has answered, or when the
-	// token finally arrives — would read the new session's one and let the old
+	// request that created this flow. A logout or a profile switch clears the
+	// flow, but the IdP may already have been polled by then, so reading the
+	// generation any later would read the new session's one and let the old
 	// session's token into the new session's cache.
 	cacheGeneration uint64
 
@@ -1277,6 +1277,7 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
 
 	s.jwtCache.clear()
+	s.clearPendingAuthFlows()
 
 	if msg != nil && msg.ProfileName != nil {
 		s.publishProfileListChanged(*msg.ProfileName)
@@ -1335,9 +1336,25 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 	return &proto.DownResponse{}, nil
 }
 
-func (s *Server) cleanupConnection() error {
+// clearPendingAuthFlows drops both pending authentication flows and wakes their
+// waiters. A flow is only ever authorized against the profile that was active
+// when it started, so leaving one behind across a switch or a logout would hand
+// its result to whoever owns the profile that comes next.
+//
+// The caller holds s.mutex.
+func (s *Server) clearPendingAuthFlows() {
+	if s.oauthAuthFlow.waitCancel != nil {
+		s.oauthAuthFlow.waitCancel()
+	}
 	s.oauthAuthFlow = oauthAuthFlow{}
 
+	s.extendAuthSessionFlow.CancelWait()
+	s.extendAuthSessionFlow.Clear()
+}
+
+func (s *Server) cleanupConnection() error {
+	s.clearPendingAuthFlows()
+
 	if s.actCancel == nil {
 		return ErrServiceNotUp
 	}

client/server/server_connect_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -18,10 +19,12 @@ func newTestServer() *Server {
 	return &Server{
 		rootCtx:        context.Background(),
 		statusRecorder: peer.NewRecorder(""),
-		// New always populates the SSH JWT cache and the logout and
-		// profile-switch paths call into it unconditionally, so a Server
-		// assembled field by field has to populate it too.
-		jwtCache: newJWTCache(),
+		// New always populates the SSH JWT cache and the pending extend-session
+		// flow, and the logout and profile-switch paths call into both
+		// unconditionally, so a Server assembled field by field has to populate
+		// them too.
+		jwtCache:              newJWTCache(),
+		extendAuthSessionFlow: auth.NewPendingFlow(),
 	}
 }