Merge branch 'main' into fix/pkce-flow-session-extend

Both sides extended the OAuth flow entry points: main threads a login hint
through GetOAuthFlow/NewOAuthFlow, this branch threads a sessionExtend flag.
The merged signatures carry both.

client/android/login.go keeps main's structure — the hint reaches the flow
through GetOAuthFlow rather than a loginHintSetter assertion, profile email
helpers live in client/mobile, and runOAuthFlow is the shared driver — with
this branch's sessionExtend plumbing and wrong-account retry layered on top.
The branch's runInteractiveFlow is dropped in favour of runOAuthFlow.

client/android/ssh_client.go is new from main and merged without conflict,
but calls NewOAuthFlow; SSH login is a fresh login, so it passes false.

management.pb.go regenerated with the pinned protoc-gen-go v1.26 from
generate.sh. The .proto merged cleanly: main's LazyState and proxy_embedded
are disjoint from this branch's SessionExtend field.

client/ios/NetBirdSDK/client.go

@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/netevents"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -36,11 +37,6 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
-// ConnectionListener export internal Listener for mobile
-type ConnectionListener interface {
-	peer.Listener
-}
-
 // RouteListener export internal RouteListener for mobile
 type NetworkChangeListener interface {
 	listener.NetworkChangeListener
@@ -87,6 +83,10 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
+	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run injects its state and sweeper into each new
+	// ConnectClient.
+	netMgr *netevents.Manager
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -97,6 +97,7 @@ type Client struct {
 
 // NewClient instantiate a new Client
 func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osVersion string, osName string, networkChangeListener NetworkChangeListener, dnsManager DnsManager) *Client {
+	recorder := peer.NewRecorder("")
 	return &Client{
 		cfgFile:               cfgFile,
 		stateFile:             stateFile,
@@ -105,10 +106,11 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		deviceName:            deviceName,
 		osName:                osName,
 		osVersion:             osVersion,
-		recorder:              peer.NewRecorder(""),
+		recorder:              recorder,
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
+		netMgr:                netevents.NewManager(recorder),
 	}
 }
 
@@ -184,7 +186,8 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	c.onHostDnsFn = func([]string) {}
 	cfg.WgIface = interfaceName
 
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetEvents(c.netMgr))
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -193,6 +196,25 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	return connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile, c.cacheDir, c.logFilePath)
 }
 
+// SetNetworkAvailable feeds OS-reported network availability into the client
+// (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
+// suspend their attempts and the connection listener reports NoNetwork
+// instead of Connecting; when availability returns, the loops resume
+// immediately with a fresh backoff. Losing the last network also sweeps the
+// registered connections, so the client does not keep reporting Connected
+// over stale sockets with no network at all.
+func (c *Client) SetNetworkAvailable(available bool) {
+	c.netMgr.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange marks the management, signal and relay connections
+// stale after the OS switched networks and schedules a sweep that cuts
+// whatever has not redialed on the new network by then. The engine and the
+// TUN device stay untouched.
+func (c *Client) NotifyNetworkChange() {
+	c.netMgr.NotifyNetworkChange()
+}
+
 // Stop the internal client and free the resources
 func (c *Client) Stop() {
 	c.ctxCancelLock.Lock()
@@ -331,7 +353,11 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	c.recorder.SetConnectionListener(listener)
+	if listener == nil {
+		c.recorder.RemoveConnectionListener()
+		return
+	}
+	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
 }
 
 // RemoveConnectionListener remove connection listener

client/ios/NetBirdSDK/connection_listener.go

@@ -0,0 +1,43 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// Client state values, re-exported as basic constants so gomobile emits them
+// into the generated bindings. They mirror peer.ClientState*: append-only,
+// never reorder.
+const (
+	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
+	ClientStateConnected     = int(peer.ClientStateConnected)
+	ClientStateConnecting    = int(peer.ClientStateConnecting)
+	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
+	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
+)
+
+// ConnectionListener export internal Listener for mobile.
+//
+// It intentionally lacks OnStateChanged for now: adding a method to a gomobile
+// interface breaks every Swift implementation, so the iOS app keeps building
+// against the legacy per-state callbacks. A follow-up will extend it together
+// with the app.
+type ConnectionListener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}
+
+// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
+// peer.Listener.
+type connectionListenerAdapter struct {
+	ConnectionListener
+}
+
+// OnStateChanged is dropped on iOS until the app adopts the state callback;
+// the legacy per-state callbacks continue to fire.
+func (a connectionListenerAdapter) OnStateChanged(peer.ClientState) {}

client/ios/NetBirdSDK/login.go

@@ -323,7 +323,7 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false)
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false, "")
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}

client/ios/NetBirdSDK/profile_manager.go

@@ -0,0 +1,138 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/mobile"
+)
+
+const (
+	// iOS uses a single user context per app.
+	iosUsername = "ios"
+)
+
+// Profile represents a profile for gomobile.
+type Profile struct {
+	ID       string
+	Name     string
+	Email    string
+	IsActive bool
+}
+
+// ProfileArray wraps profiles for gomobile compatibility (gomobile cannot
+// bind Go slices directly).
+type ProfileArray struct {
+	items []*Profile
+}
+
+// Length returns the number of profiles.
+func (p *ProfileArray) Length() int {
+	return len(p.items)
+}
+
+// Get returns the profile at index i, or nil if out of range.
+func (p *ProfileArray) Get(i int) *Profile {
+	if i < 0 || i >= len(p.items) {
+		return nil
+	}
+	return p.items[i]
+}
+
+// ProfileManager adapts the shared mobile profile manager (client/mobile) to
+// gomobile-friendly types. See that package for the on-disk layout and
+// semantics.
+type ProfileManager struct {
+	impl *mobile.ProfileManager
+}
+
+// NewProfileManager creates a new profile manager for iOS. configDir is the
+// App Group shared container path that both the app and the network extension
+// can reach.
+func NewProfileManager(configDir string) *ProfileManager {
+	return &ProfileManager{impl: mobile.NewProfileManager(configDir, iosUsername)}
+}
+
+// ListProfiles returns all available profiles, including the default profile,
+// with their active status set.
+func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
+	profiles, err := pm.impl.ListProfiles()
+	if err != nil {
+		return nil, err
+	}
+
+	items := make([]*Profile, 0, len(profiles))
+	for i := range profiles {
+		items = append(items, fromMobileProfile(&profiles[i]))
+	}
+	return &ProfileArray{items: items}, nil
+}
+
+// GetActiveProfile returns the currently active profile.
+func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
+	p, err := pm.impl.GetActiveProfile()
+	if err != nil {
+		return nil, err
+	}
+	return fromMobileProfile(p), nil
+}
+
+// SwitchProfile records the given profile ID as the active profile. The caller
+// must stop the VPN tunnel before switching.
+func (pm *ProfileManager) SwitchProfile(id string) error {
+	return pm.impl.SwitchProfile(id)
+}
+
+// AddProfile creates a new profile with the given display name and a
+// generated ID. It returns the created profile so the caller learns the ID.
+func (pm *ProfileManager) AddProfile(displayName string) (*Profile, error) {
+	p, err := pm.impl.AddProfile(displayName)
+	if err != nil {
+		return nil, err
+	}
+	return fromMobileProfile(p), nil
+}
+
+// RenameProfile changes the display name of the profile identified by id. The
+// on-disk filename (the ID) is left unchanged.
+func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	return pm.impl.RenameProfile(id, newName)
+}
+
+// LogoutProfile clears authentication data for a profile, forcing a re-login.
+// The management URL and other settings are preserved.
+func (pm *ProfileManager) LogoutProfile(id string) error {
+	return pm.impl.LogoutProfile(id)
+}
+
+// RemoveProfile deletes a profile. The default profile and the active profile
+// cannot be removed.
+func (pm *ProfileManager) RemoveProfile(id string) error {
+	return pm.impl.RemoveProfile(id)
+}
+
+// GetConfigPath returns the config file path for the given profile ID. Swift
+// should call this instead of constructing paths itself.
+func (pm *ProfileManager) GetConfigPath(id string) (string, error) {
+	return pm.impl.GetConfigPath(id)
+}
+
+// GetStateFilePath returns the state file path for the given profile ID.
+func (pm *ProfileManager) GetStateFilePath(id string) (string, error) {
+	return pm.impl.GetStateFilePath(id)
+}
+
+// GetActiveConfigPath returns the config file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveConfigPath() (string, error) {
+	return pm.impl.GetActiveConfigPath()
+}
+
+// GetActiveStateFilePath returns the state file path for the currently active
+// profile.
+func (pm *ProfileManager) GetActiveStateFilePath() (string, error) {
+	return pm.impl.GetActiveStateFilePath()
+}
+
+func fromMobileProfile(p *mobile.Profile) *Profile {
+	return &Profile{ID: p.ID, Name: p.Name, Email: p.Email, IsActive: p.IsActive}
+}