Merge remote-tracking branch 'origin/ui-refactor' into ui-refactor

# Conflicts:
#	client/ui/frontend/src/screens/Update.tsx

client/cmd/login.go

@@ -22,11 +22,19 @@ import (
 	"github.com/netbirdio/netbird/util"
 )
 
+// extendSessionFlag drives the `netbird login --extend` flow: refresh the
+// SSO session expiry on the management server without tearing down the
+// tunnel. Mutually exclusive with setup-key login (a setup-key cannot
+// refresh an SSO-tracked peer — see auth.errSetupKeyOnSSOExpiredPeer).
+var extendSessionFlag bool
+
 func init() {
 	loginCmd.PersistentFlags().BoolVar(&noBrowser, noBrowserFlag, false, noBrowserDesc)
 	loginCmd.PersistentFlags().BoolVar(&showQR, showQRFlag, false, showQRDesc)
 	loginCmd.PersistentFlags().StringVar(&profileName, profileNameFlag, "", profileNameDesc)
 	loginCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "(DEPRECATED) Netbird config file location")
+	loginCmd.PersistentFlags().BoolVar(&extendSessionFlag, "extend", false,
+		"refresh the SSO session expiry without tearing down the tunnel (requires an active connection)")
 }
 
 var loginCmd = &cobra.Command{
@@ -61,6 +69,16 @@ var loginCmd = &cobra.Command{
 			return err
 		}
 
+		if extendSessionFlag {
+			if providedSetupKey != "" {
+				return fmt.Errorf("--extend cannot be combined with a setup key; setup keys can only enrol new peers")
+			}
+			if err := doExtendSession(ctx, cmd); err != nil {
+				return fmt.Errorf("extend session failed: %v", err)
+			}
+			return nil
+		}
+
 		// workaround to run without service
 		if util.FindFirstLogPath(logFiles) == "" {
 			if err := doForegroundLogin(ctx, cmd, providedSetupKey, activeProf); err != nil {
@@ -150,6 +168,65 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	return nil
 }
 
+// doExtendSession drives the daemon's RequestExtendAuthSession /
+// WaitExtendAuthSession pair. The user is sent through a regular SSO flow
+// (browser + verification URL) and the resulting JWT is forwarded to the
+// management server's ExtendAuthSession RPC. The tunnel stays up
+// throughout — no Down/Up, no network-map resync.
+func doExtendSession(ctx context.Context, cmd *cobra.Command) error {
+	conn, err := DialClientGRPCServer(ctx, daemonAddr)
+	if err != nil {
+		//nolint
+		return fmt.Errorf("failed to connect to daemon error: %v\n"+
+			"If the daemon is not running please run: "+
+			"\nnetbird service install \nnetbird service start\n", err)
+	}
+	defer conn.Close()
+
+	client := proto.NewDaemonServiceClient(conn)
+
+	req := &proto.RequestExtendAuthSessionRequest{}
+	// Pre-fill the IdP login hint from the active profile so the user
+	// doesn't have to retype their email. Best-effort: we still proceed
+	// without a hint if the lookup fails.
+	pm := profilemanager.NewProfileManager()
+	if active, perr := pm.GetActiveProfile(); perr == nil {
+		if profState, sperr := pm.GetProfileState(active.Name); sperr == nil && profState.Email != "" {
+			req.Hint = &profState.Email
+		}
+	}
+
+	startResp, err := client.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return fmt.Errorf("start extend session: %v", err)
+	}
+
+	uri := startResp.GetVerificationURIComplete()
+	if uri == "" {
+		uri = startResp.GetVerificationURI()
+	}
+	openURL(cmd, uri, startResp.GetUserCode(), noBrowser, showQR)
+
+	waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: startResp.GetDeviceCode(),
+		UserCode:   startResp.GetUserCode(),
+	})
+	if err != nil {
+		return fmt.Errorf("wait for extend session: %v", err)
+	}
+
+	if ts := waitResp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		deadline := ts.AsTime().Local()
+		cmd.Printf("Session extended. New expiry: %s\n", deadline.Format("2006-01-02 15:04:05 MST"))
+	} else {
+		// Management reported the peer is not eligible (e.g. login
+		// expiration disabled on the account). Surface that fact
+		// instead of pretending the call succeeded.
+		cmd.Println("Session extension call completed, but the management server did not return a new deadline (peer may not be SSO-tracked or login expiration is disabled).")
+	}
+	return nil
+}
+
 func getActiveProfile(ctx context.Context, pm *profilemanager.ProfileManager, profileName string, username string) (*profilemanager.Profile, error) {
 	// switch profile if provided
 

client/cmd/status.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/status"
@@ -117,6 +118,11 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		profName = activeProf.Name
 	}
 
+	var sessionExpiresAt time.Time
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() {
+		sessionExpiresAt = ts.AsTime().UTC()
+	}
+
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
 		Anonymize:            anonymizeFlag,
 		DaemonVersion:        resp.GetDaemonVersion(),
@@ -127,6 +133,7 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		IPsFilter:            ipsFilterMap,
 		ConnectionTypeFilter: connectionTypeFilter,
 		ProfileName:          profName,
+		SessionExpiresAt:     sessionExpiresAt,
 	})
 	var statusOutputString string
 	switch {

client/internal/auth/auth.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
 
@@ -21,6 +22,25 @@ import (
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// peerLoginExpiredMsg is the exact phrase the management server returns
+// when a previously SSO-enrolled peer's login has expired. Sourced from
+// shared/management/status/error.go (NewPeerLoginExpiredError). Matched
+// by substring so a future server-side rewording that keeps the phrase
+// still triggers the friendly fallback in Login().
+const peerLoginExpiredMsg = "peer login has expired"
+
+// errSetupKeyOnSSOExpiredPeer replaces the raw management error when the
+// user runs `netbird login -k <setup-key>` against a peer that was
+// originally enrolled via SSO. Wrapped in a PermissionDenied gRPC status
+// so callers' existing isPermissionDenied / isAuthError checks still
+// classify it correctly (early-exit from retry backoff, StatusNeedsLogin
+// in the server state machine).
+var errSetupKeyOnSSOExpiredPeer = status.Error(
+	codes.PermissionDenied,
+	"this peer was originally enrolled via SSO and its session has expired. "+
+		"Setup keys can only enrol new peers — run `netbird up` (interactive SSO) to re-login.",
+)
+
 // Auth manages authentication operations with the management server
 // It maintains a long-lived connection and automatically handles reconnection with backoff
 type Auth struct {
@@ -184,6 +204,15 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 			log.Debugf("peer registration required")
 			_, err = a.registerPeer(client, ctx, setupKey, jwtToken, pubSSHKey)
 			if err != nil {
+				// The peer pub-key is already on file with the management
+				// server (originally enrolled via SSO) and the session has
+				// expired. The setup-key path can only enrol new peers, so
+				// retrying with -k will keep failing. Replace the raw mgm
+				// message with an actionable hint that tells the user to
+				// re-authenticate via SSO instead.
+				if setupKey != "" && jwtToken == "" && isPeerLoginExpired(err) {
+					err = errSetupKeyOnSSOExpiredPeer
+				}
 				isAuthError = isPermissionDenied(err)
 				return err
 			}
@@ -474,3 +503,16 @@ func isLoginNeeded(err error) bool {
 func isRegistrationNeeded(err error) bool {
 	return isPermissionDenied(err)
 }
+
+// isPeerLoginExpired reports whether err is the management server's
+// "peer login has expired" PermissionDenied response. Used by Login to
+// detect the case where the caller passed a setup-key but the peer is
+// actually an SSO-enrolled record whose session needs refreshing — the
+// setup-key path cannot help there.
+func isPeerLoginExpired(err error) bool {
+	if !isPermissionDenied(err) {
+		return false
+	}
+	s, _ := status.FromError(err)
+	return strings.Contains(s.Message(), peerLoginExpiredMsg)
+}

client/internal/auth/auth_test.go

@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestIsPeerLoginExpired(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil",
+			err:  nil,
+			want: false,
+		},
+		{
+			name: "plain error (not a gRPC status)",
+			err:  errors.New("network read: connection reset"),
+			want: false,
+		},
+		{
+			name: "PermissionDenied with different message",
+			err:  status.Error(codes.PermissionDenied, "user is blocked"),
+			want: false,
+		},
+		{
+			name: "Unauthenticated with the expected phrase",
+			// Wrong status code — must still return false.
+			err:  status.Error(codes.Unauthenticated, "peer login has expired, please log in once more"),
+			want: false,
+		},
+		{
+			name: "exact server message",
+			err:  status.Error(codes.PermissionDenied, "peer login has expired, please log in once more"),
+			want: true,
+		},
+		{
+			name: "phrase as substring",
+			// Future-proofing: if mgm reworords but keeps the phrase,
+			// the friendly fallback must still kick in.
+			err:  status.Error(codes.PermissionDenied, "session refused: peer login has expired (account=foo)"),
+			want: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isPeerLoginExpired(tc.err); got != tc.want {
+				t.Fatalf("isPeerLoginExpired(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestErrSetupKeyOnSSOExpiredPeer(t *testing.T) {
+	// Sentinel must surface as PermissionDenied so the upstream
+	// isPermissionDenied / isAuthError checks classify it correctly
+	// (short-circuit retry backoff, set StatusNeedsLogin).
+	if !isPermissionDenied(errSetupKeyOnSSOExpiredPeer) {
+		t.Fatalf("errSetupKeyOnSSOExpiredPeer must be a PermissionDenied gRPC error")
+	}
+
+	// Message must actually mention SSO and `netbird up` so it is
+	// actionable for the end user. Loose substring checks keep the
+	// test resilient to copy edits.
+	s, _ := status.FromError(errSetupKeyOnSSOExpiredPeer)
+	msg := strings.ToLower(s.Message())
+	for _, want := range []string{"sso", "netbird up"} {
+		if !strings.Contains(msg, want) {
+			t.Errorf("sentinel message should contain %q, got %q", want, s.Message())
+		}
+	}
+}

client/internal/auth/pending_flow.go

@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"context"
+	"sync"
+	"time"
+)
+
+// PendingFlow stores an in-progress OAuth flow between the RPC that
+// initiates it (returns the verification URI to the UI) and the RPC
+// that waits for the user to complete it. The flow handle, the
+// device-code info, and the absolute expiry are kept together so the
+// waiting RPC can validate the device code and reuse the same flow.
+//
+// PendingFlow is safe for concurrent use; callers must not access the
+// stored fields directly.
+type PendingFlow struct {
+	mu         sync.Mutex
+	flow       OAuthFlow
+	info       AuthFlowInfo
+	expiresAt  time.Time
+	waitCancel context.CancelFunc
+}
+
+// NewPendingFlow returns an empty PendingFlow ready to be populated by Set.
+func NewPendingFlow() *PendingFlow {
+	return &PendingFlow{}
+}
+
+// Set stores the flow and its authorization info, computing the absolute
+// expiry from info.ExpiresIn (seconds, as returned by the IdP).
+func (p *PendingFlow) Set(flow OAuthFlow, info AuthFlowInfo) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = flow
+	p.info = info
+	p.expiresAt = time.Now().Add(time.Duration(info.ExpiresIn) * time.Second)
+}
+
+// Get returns the stored flow, info, and whether a flow is currently
+// pending. Returns (nil, zero, false) after Clear or before Set.
+func (p *PendingFlow) Get() (OAuthFlow, AuthFlowInfo, bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.flow == nil {
+		return nil, AuthFlowInfo{}, false
+	}
+	return p.flow, p.info, true
+}
+
+// ExpiresAt returns the absolute expiry of the pending flow. Returns
+// the zero time when no flow is pending.
+func (p *PendingFlow) ExpiresAt() time.Time {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.expiresAt
+}
+
+// SetWaitCancel records the cancel function for the goroutine currently
+// blocked in WaitToken so a new RequestAuth can preempt it.
+func (p *PendingFlow) SetWaitCancel(cancel context.CancelFunc) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.waitCancel = cancel
+}
+
+// CancelWait invokes and clears the stored wait-cancel, if any. Safe to
+// call when no wait is in progress.
+func (p *PendingFlow) CancelWait() {
+	p.mu.Lock()
+	cancel := p.waitCancel
+	p.waitCancel = nil
+	p.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+}
+
+// Clear resets the pending flow to empty. Any stored wait-cancel is
+// dropped without being invoked — call CancelWait first if the waiting
+// goroutine must be stopped.
+func (p *PendingFlow) Clear() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = nil
+	p.info = AuthFlowInfo{}
+	p.expiresAt = time.Time{}
+	p.waitCancel = nil
+}

client/internal/auth/sessionwatch/event.go

@@ -0,0 +1,74 @@
+package sessionwatch
+
+import (
+	"strconv"
+	"time"
+)
+
+// internal event kinds are no longer exposed: the watcher drives the Sink
+// directly (NotifyStateChange on deadline change/clear, PublishEvent at
+// each warning lead). Tests use a mock Sink to observe what the watcher
+// emits.
+
+// Metadata keys attached by the daemon to session-warning SystemEvents.
+// The UI tray reads these to build a locale-aware notification without
+// relying on the daemon's locale-less UserMessage string, and to
+// disambiguate the T-WarningLead notification from the T-FinalWarningLead
+// fallback that auto-opens the SessionAboutToExpire dialog.
+const (
+	// MetaSessionWarning is set to "true" on both warning events (T-10 and
+	// T-2) so the UI can detect a session-warning SystemEvent without
+	// matching on the message text. Use MetaSessionFinal to distinguish
+	// the two.
+	MetaSessionWarning = "session_warning"
+	// MetaSessionFinal is set to "true" on the T-FinalWarningLead event
+	// only. Consumers that need to auto-open the SessionAboutToExpire
+	// dialog gate on this; T-WarningLead events leave the field unset.
+	MetaSessionFinal = "session_final_warning"
+	// MetaSessionExpiresAt carries the absolute UTC deadline encoded with
+	// FormatExpiresAt; consumers must decode with ParseExpiresAt so a
+	// future format change stays a single edit.
+	MetaSessionExpiresAt = "session_expires_at"
+	// MetaSessionLeadMinutes carries the lead in whole minutes (WarningLead
+	// for the T-10 event, FinalWarningLead for the T-2 event) so the UI
+	// can show "expires in ~N minutes" without hardcoding either constant.
+	MetaSessionLeadMinutes = "lead_minutes"
+)
+
+// expiresAtLayout is the wire format used for MetaSessionExpiresAt.
+// Producer and consumers both go through FormatExpiresAt/ParseExpiresAt
+// so this layout stays a single source of truth.
+const expiresAtLayout = time.RFC3339
+
+// FormatExpiresAt encodes a deadline for MetaSessionExpiresAt. Always
+// emits UTC so a consumer in another timezone reads the same wall-clock
+// deadline.
+func FormatExpiresAt(t time.Time) string {
+	return t.UTC().Format(expiresAtLayout)
+}
+
+// ParseExpiresAt decodes the MetaSessionExpiresAt value back to a UTC
+// time. Returns an error when the field is empty or malformed; the
+// caller decides whether to fall back (zero value) or propagate.
+func ParseExpiresAt(s string) (time.Time, error) {
+	t, err := time.Parse(expiresAtLayout, s)
+	if err != nil {
+		return time.Time{}, err
+	}
+	return t.UTC(), nil
+}
+
+// FormatLeadMinutes encodes a lead duration for MetaSessionLeadMinutes
+// as the integer count of whole minutes. Sub-minute residuals are
+// truncated — the field is informational ("expires in ~N minutes") and
+// fractional minutes don't change what the UI displays.
+func FormatLeadMinutes(d time.Duration) string {
+	return strconv.Itoa(int(d / time.Minute))
+}
+
+// ParseLeadMinutes decodes a MetaSessionLeadMinutes value. Returns 0
+// and the parse error for malformed input; consumers that prefer a
+// silent fallback can simply ignore the error.
+func ParseLeadMinutes(s string) (int, error) {
+	return strconv.Atoi(s)
+}

client/internal/auth/sessionwatch/watcher.go

@@ -0,0 +1,362 @@
+// Package sessionwatch tracks the SSO session expiry deadline that the
+// management server publishes via LoginResponse / SyncResponse and fires
+// two warning events at fixed lead times before expiry: an interactive
+// T-WarningLead notification and a dismiss-gated T-FinalWarningLead
+// fallback dialog.
+//
+// The watcher is idempotent: Update may be called as often as the network
+// map snapshots arrive. Repeating the same deadline is a no-op; a new
+// deadline reschedules the timers and arms a fresh warning cycle.
+//
+// Warning firing is edge-detected. Each unique deadline value fires each
+// warning callback at most once.
+package sessionwatch
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+const (
+	// Skew tolerates a small clock difference between the management
+	// server and this peer before treating a deadline as "in the past".
+	// Slightly above typical NTP drift; tight enough that the UI doesn't
+	// paint a stale expiry as if it were valid.
+	Skew = 30 * time.Second
+
+	// maxDeadlineHorizon caps how far in the future an accepted deadline
+	// can sit. A timestamp beyond this is almost certainly a protocol
+	// glitch, and silently arming a 100-year timer would hide the bug.
+	maxDeadlineHorizon = 10 * 365 * 24 * time.Hour
+
+	// WarningLead is how far before expiry the first (interactive)
+	// warning fires. Drives the T-10 OS notification with
+	// Extend/Dismiss actions.
+	WarningLead = 10 * time.Minute
+
+	// FinalWarningLead is how far before expiry the fallback final
+	// warning fires. Drives the auto-opened SessionAboutToExpire dialog,
+	// but only when the user has not dismissed the T-WarningLead warning
+	// for the same deadline. Must be strictly less than WarningLead.
+	FinalWarningLead = 2 * time.Minute
+)
+
+var (
+	// ErrDeadlineBeforeEpoch is returned by Update when the supplied
+	// deadline pre-dates 1970-01-01.
+	ErrDeadlineBeforeEpoch = errors.New("session deadline before unix epoch")
+
+	// ErrDeadlineTooFarFuture is returned by Update when the supplied
+	// deadline is more than maxDeadlineHorizon in the future.
+	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")
+
+	// ErrDeadlineInPast is returned by Update when the supplied deadline
+	// is more than Skew in the past.
+	ErrDeadlineInPast = errors.New("session deadline in the past")
+)
+
+// StatusRecorder is the side-effect surface the watcher drives on every
+// state transition. Production wires this to peer.Status (NotifyStateChange
+// for deadline change/clear, PublishEvent for the two warnings); tests pass
+// a fake recorder so the same surface is observable without an engine.
+//
+// PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
+// composes the metadata internally so the wire format (MetaSession*) is
+// owned by sessionwatch, not the caller.
+type StatusRecorder interface {
+	NotifyStateChange()
+	PublishEvent(
+		severity cProto.SystemEvent_Severity,
+		category cProto.SystemEvent_Category,
+		message string,
+		userMessage string,
+		metadata map[string]string,
+	)
+}
+
+// Watcher observes the latest session deadline and fires two warnings
+// before it expires: the interactive T-WarningLead notification, and the
+// fallback T-FinalWarningLead dialog (suppressed when the user dismissed
+// the first one for the same deadline). Safe for concurrent use.
+type Watcher struct {
+	lead      time.Duration
+	finalLead time.Duration
+
+	mu           sync.Mutex
+	current      time.Time
+	timer        *time.Timer
+	finalTimer   *time.Timer
+	firedAt      time.Time // deadline value the T-WarningLead callback last fired against
+	finalFiredAt time.Time // deadline value the T-FinalWarningLead callback last fired against
+	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates fireFinal
+	closed       bool
+	recorder     StatusRecorder
+}
+
+// New returns a watcher with the package defaults WarningLead and
+// FinalWarningLead. Pass nil for recorder to silence side effects (handy
+// in unit tests that exercise sanity checks without observing the publish
+// path).
+func New(recorder StatusRecorder) *Watcher {
+	return NewWithLeads(WarningLead, FinalWarningLead, recorder)
+}
+
+// NewWithLeads returns a watcher with custom lead times. Useful for tests.
+// final must be strictly less than lead; otherwise both timers fire in the
+// wrong order or simultaneously and the UI flow breaks. A zero final lead
+// disables the final-warning timer entirely (see armTimerLocked) so a
+// millisecond-scale deadline doesn't flush both timers in one tick.
+func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
+	return &Watcher{
+		lead:      lead,
+		finalLead: final,
+		recorder:  recorder,
+	}
+}
+
+// Update sets the latest deadline. Pass the zero time to clear (e.g. when
+// a Sync push from the server omits the field because login expiration
+// was disabled).
+//
+// Same-value updates are no-ops. A different non-zero value cancels any
+// pending timer, resets the "already fired" guard, and arms a new one.
+//
+// Returns one of the sentinel Err* values when the deadline fails the
+// sanity checks (pre-epoch, far future, or in the past beyond Skew).
+// In every error case the watcher first clears its state so it stays
+// consistent with what the caller will push into its other sinks (e.g.
+// applySessionDeadline forces a zero deadline into the status recorder
+// after a non-nil error).
+func (w *Watcher) Update(deadline time.Time) error {
+	w.mu.Lock()
+	if w.closed {
+		w.mu.Unlock()
+		return nil
+	}
+
+	if deadline.IsZero() {
+		w.clearLocked()
+		return nil
+	}
+
+	now := time.Now()
+	switch {
+	case deadline.Before(time.Unix(0, 0)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineBeforeEpoch, deadline)
+	case deadline.After(now.Add(maxDeadlineHorizon)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
+	case deadline.Before(now.Add(-Skew)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
+	}
+
+	if deadline.Equal(w.current) {
+		w.mu.Unlock()
+		return nil
+	}
+
+	w.stopTimerLocked()
+	w.current = deadline
+	// Reset every per-deadline guard so a refreshed deadline arms a fresh
+	// warning cycle: both edge triggers and the user Dismiss decision
+	// (the user agreed to the old deadline expiring; a new deadline
+	// restarts the contract).
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+
+	w.armTimerLocked(deadline)
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.NotifyStateChange()
+	}
+	log.Infof("auth session deadline set to: %s (in %s)", deadline.Format(time.RFC3339), time.Until(deadline).Round(time.Second))
+	return nil
+}
+
+// Deadline returns the most recently observed deadline. Zero when no
+// deadline is currently tracked.
+func (w *Watcher) Deadline() time.Time {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.current
+}
+
+// Dismiss records the user's "Dismiss" action against the current deadline
+// and suppresses the upcoming final-warning callback for that deadline.
+// Idempotent: repeated calls are no-ops. A subsequent Update with a fresh
+// deadline resets the dismissal so the final-warning cycle re-arms.
+//
+// No-op when the watcher holds no deadline or has been closed.
+func (w *Watcher) Dismiss() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed || w.current.IsZero() {
+		return
+	}
+	if w.dismissedAt.Equal(w.current) {
+		return
+	}
+	w.dismissedAt = w.current
+	// Cancel the armed final-warning timer eagerly. fireFinal would also
+	// gate on dismissedAt, but stopping the timer avoids a wakeup with
+	// nothing to do and makes the intent visible.
+	if w.finalTimer != nil {
+		w.finalTimer.Stop()
+		w.finalTimer = nil
+	}
+	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
+}
+
+// Close stops any pending timer. Update calls after Close are ignored.
+func (w *Watcher) Close() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed {
+		return
+	}
+	w.closed = true
+	w.stopTimerLocked()
+}
+
+// clearLocked drops the tracked deadline and notifies the recorder so
+// downstream consumers (SubscribeStatus stream, UI) drop their anchor.
+// The caller must hold w.mu; this helper releases it before invoking
+// the recorder.
+func (w *Watcher) clearLocked() {
+	if w.current.IsZero() {
+		w.mu.Unlock()
+		return
+	}
+	w.stopTimerLocked()
+	w.current = time.Time{}
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.NotifyStateChange()
+	}
+	log.Infof("auth session deadline cleared")
+}
+
+func (w *Watcher) stopTimerLocked() {
+	if w.timer != nil {
+		w.timer.Stop()
+		w.timer = nil
+	}
+	if w.finalTimer != nil {
+		w.finalTimer.Stop()
+		w.finalTimer = nil
+	}
+}
+
+func (w *Watcher) armTimerLocked(deadline time.Time) {
+	w.timer = armOneShotLocked(deadline.Add(-w.lead), func() { w.fire(deadline) })
+	// finalLead <= 0 disables the final-warning timer entirely. Used by
+	// tests that predate the final-warning fallback so a millisecond-scale
+	// deadline does not flush both timers at once.
+	if w.finalLead > 0 {
+		w.finalTimer = armOneShotLocked(deadline.Add(-w.finalLead), func() { w.fireFinal(deadline) })
+	}
+}
+
+func (w *Watcher) fire(armedFor time.Time) {
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(armedFor) {
+		// Deadline moved while we were waiting (e.g. a successful extend).
+		// The reschedule path armed a fresh timer; this one is stale.
+		w.mu.Unlock()
+		return
+	}
+	if !w.firedAt.IsZero() && w.firedAt.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	w.firedAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session expiry soon warning fired")
+	publishWarning(recorder, armedFor, false)
+}
+
+// fireFinal mirrors fire for the T-FinalWarningLead timer with an extra
+// dismiss-gate: if the user dismissed the T-WarningLead notification for
+// this deadline, the final warning is suppressed entirely.
+func (w *Watcher) fireFinal(armedFor time.Time) {
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	if !w.finalFiredAt.IsZero() && w.finalFiredAt.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	if w.dismissedAt.Equal(armedFor) {
+		w.mu.Unlock()
+		log.Infof("auth session final-warning skipped (dismissed by user)")
+		return
+	}
+	w.finalFiredAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session final-warning fired")
+	publishWarning(recorder, armedFor, true)
+}
+
+// armOneShotLocked schedules cb at fireAt. When fireAt is already in the
+// past it dispatches on the next scheduler tick so a state-change recorder
+// notification (invoked after w.mu is released) lands first. Caller must
+// hold w.mu.
+func armOneShotLocked(fireAt time.Time, cb func()) *time.Timer {
+	delay := time.Until(fireAt)
+	if delay <= 0 {
+		return time.AfterFunc(0, cb)
+	}
+	return time.AfterFunc(delay, cb)
+}
+
+// publishWarning composes the SystemEvent for a watcher-fired warning and
+// pushes it through the recorder. Severity is CRITICAL on both — bypassing
+// the user's Notifications toggle is deliberate: missing the warning
+// window forces the post-mortem SessionExpired flow (tunnel torn down,
+// lock icon, manual re-login), which is the UX we are trying to avoid.
+func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
+	lead := WarningLead
+	message := "session expiry warning"
+	meta := map[string]string{
+		MetaSessionWarning:   "true",
+		MetaSessionExpiresAt: FormatExpiresAt(deadline),
+	}
+	if final {
+		lead = FinalWarningLead
+		message = "session expiry final warning"
+		meta[MetaSessionFinal] = "true"
+	}
+	meta[MetaSessionLeadMinutes] = FormatLeadMinutes(lead)
+
+	recorder.PublishEvent(
+		cProto.SystemEvent_CRITICAL,
+		cProto.SystemEvent_AUTHENTICATION,
+		message,
+		"",
+		meta,
+	)
+}

client/internal/auth/sessionwatch/watcher_test.go

@@ -0,0 +1,463 @@
+package sessionwatch
+
+import (
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+// fakeRecorder satisfies StatusRecorder and records every call so tests
+// can observe what the watcher emits. NotifyStateChange and PublishEvent
+// land in the same ordered events slice (with the Kind distinguishing
+// them) so tests that care about ordering still work.
+type fakeRecorder struct {
+	mu     sync.Mutex
+	events []event
+}
+
+type eventKind int
+
+const (
+	stateChange eventKind = iota
+	publish
+)
+
+type event struct {
+	kind eventKind
+	// Set only for publish events.
+	severity cProto.SystemEvent_Severity
+	category cProto.SystemEvent_Category
+	message  string
+	meta     map[string]string
+}
+
+func (r *fakeRecorder) NotifyStateChange() {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.events = append(r.events, event{kind: stateChange})
+}
+
+func (r *fakeRecorder) PublishEvent(
+	severity cProto.SystemEvent_Severity,
+	category cProto.SystemEvent_Category,
+	message string,
+	_ string,
+	metadata map[string]string,
+) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.events = append(r.events, event{
+		kind:     publish,
+		severity: severity,
+		category: category,
+		message:  message,
+		meta:     metadata,
+	})
+}
+
+func (r *fakeRecorder) snapshot() []event {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]event, len(r.events))
+	copy(out, r.events)
+	return out
+}
+
+func (e event) isFinalWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionFinal] == "true"
+}
+
+func (e event) isWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionWarning] == "true" && e.meta[MetaSessionFinal] != "true"
+}
+
+func countWhere(events []event, pred func(event) bool) int {
+	n := 0
+	for _, e := range events {
+		if pred(e) {
+			n++
+		}
+	}
+	return n
+}
+
+func waitForEvents(t *testing.T, r *fakeRecorder, want int) []event {
+	t.Helper()
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if got := r.snapshot(); len(got) >= want {
+			return got
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	got := r.snapshot()
+	t.Fatalf("timed out waiting for %d events, got %d: %+v", want, len(got), got)
+	return nil
+}
+
+// newWatcher builds a watcher with the final timer disabled (finalLead=0),
+// matching the lead-only behaviour the pre-final-warning tests assume.
+func newWatcher(lead time.Duration, r *fakeRecorder) *Watcher {
+	return NewWithLeads(lead, 0, r)
+}
+
+func TestUpdateZeroBeforeAnythingIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Time{})
+
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events on initial zero, got %+v", got)
+	}
+}
+
+func TestUpdateNonZeroFiresStateChange(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if events[0].kind != stateChange {
+		t.Fatalf("expected stateChange, got %+v", events[0])
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("deadline mismatch: %v vs %v", w.Deadline(), d)
+	}
+}
+
+func TestSameDeadlineIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+	_ = w.Update(d)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly 1 event for repeated same deadline, got %d: %+v", len(events), events)
+	}
+}
+
+func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	// Deadline 80ms out — warning should fire after ~30ms.
+	d := time.Now().Add(80 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if events[0].kind != stateChange {
+		t.Fatalf("event[0] should be stateChange, got %+v", events[0])
+	}
+	if !events[1].isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", events[1])
+	}
+}
+
+func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r) // lead > delta => fire immediately
+	defer w.Close()
+
+	d := time.Now().Add(10 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected immediate warning publish, got %+v", events[1])
+	}
+}
+
+func TestNewDeadlineCancelsPriorTimer(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	first := time.Now().Add(80 * time.Millisecond) // would fire warning ~30ms in
+	_ = w.Update(first)
+
+	// Replace with a far-future deadline before the warning fires.
+	time.Sleep(5 * time.Millisecond)
+	second := time.Now().Add(time.Hour)
+	_ = w.Update(second)
+
+	// Wait past when first's warning would have fired.
+	time.Sleep(80 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isWarning); n != 0 {
+		t.Fatalf("warning fired for cancelled deadline: %+v", r.snapshot())
+	}
+}
+
+func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 30 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	first := time.Now().Add(50 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Wait for stateChange + warning of the first cycle.
+	waitForEvents(t, r, 2)
+
+	// Simulate a successful extend: brand new deadline.
+	second := time.Now().Add(60 * time.Millisecond)
+	_ = w.Update(second)
+
+	// 4 events total: stateChange, warning (first), stateChange, warning (second).
+	events := waitForEvents(t, r, 4)
+	if events[2].kind != stateChange {
+		t.Fatalf("event[2] should be stateChange for the new deadline, got %+v", events[2])
+	}
+	if !events[3].isWarning() {
+		t.Fatalf("event[3] should be a warning publish for the new deadline, got %+v", events[3])
+	}
+}
+
+func TestUpdateZeroAfterNonZeroClearsState(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+	defer w.Close()
+
+	d := time.Now().Add(2 * time.Hour)
+	_ = w.Update(d)
+	waitForEvents(t, r, 1)
+
+	_ = w.Update(time.Time{})
+
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("Deadline should be zero after clear")
+	}
+}
+
+func TestUpdateRejectsBeforeEpoch(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Unix(-100, 0))
+	if !errors.Is(err, ErrDeadlineBeforeEpoch) {
+		t.Fatalf("want ErrDeadlineBeforeEpoch, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected pre-epoch update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateRejectsTooFarFuture(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(50 * 365 * 24 * time.Hour))
+	if !errors.Is(err, ErrDeadlineTooFarFuture) {
+		t.Fatalf("want ErrDeadlineTooFarFuture, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected far-future update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateInPastClearsDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+	// Drain the stateChange from the seed.
+	waitForEvents(t, r, 1)
+
+	err := w.Update(time.Now().Add(-1 * time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("want ErrDeadlineInPast, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("in-past update must clear the deadline, got %v", w.Deadline())
+	}
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+}
+
+func TestUpdateWithinSkewAccepted(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	// 5 seconds in the past is within the 30s Skew tolerance — accept it.
+	d := time.Now().Add(-5 * time.Second)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("within-skew Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be applied, got %v want %v", w.Deadline(), d)
+	}
+}
+
+func TestCloseSilencesUpdates(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	w.Close()
+
+	_ = w.Update(time.Now().Add(time.Hour))
+
+	time.Sleep(20 * time.Millisecond)
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events after Close, got %+v", got)
+	}
+}
+
+func TestFinalWarningFiresAfterRegularWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	// Warning fires at deadline-80ms, final at deadline-30ms.
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Expect stateChange + warning + final-warning.
+	events := waitForEvents(t, r, 3)
+
+	if countWhere(events, func(e event) bool { return e.kind == stateChange }) != 1 {
+		t.Fatalf("expected exactly 1 stateChange, got %+v", events)
+	}
+	if countWhere(events, event.isWarning) != 1 {
+		t.Fatalf("expected exactly 1 warning publish, got %+v", events)
+	}
+	if countWhere(events, event.isFinalWarning) != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %+v", events)
+	}
+
+	// Warning must precede final (same deadline, longer lead fires first).
+	var wIdx, fIdx int
+	for i, e := range events {
+		switch {
+		case e.isWarning():
+			wIdx = i
+		case e.isFinalWarning():
+			fIdx = i
+		}
+	}
+	if wIdx > fIdx {
+		t.Fatalf("warning must publish before final-warning, got order %+v", events)
+	}
+}
+
+func TestDismissSuppressesFinalWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Wait for the warning publish so we know we're inside the warning
+	// window, then dismiss before the final timer would fire.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isWarning) >= 1 {
+			break
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isWarning) < 1 {
+		t.Fatalf("warning did not publish in time, events=%+v", r.snapshot())
+	}
+
+	w.Dismiss()
+
+	// Now wait past when the final would have fired.
+	time.Sleep(120 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isFinalWarning); n != 0 {
+		t.Fatalf("final-warning published after Dismiss(), events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissResetByNewDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	first := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Dismiss against the first deadline.
+	w.Dismiss()
+
+	// Replace with a fresh deadline before the first's timers complete.
+	time.Sleep(10 * time.Millisecond)
+	second := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(second)
+
+	// The second cycle must publish a final-warning (the dismiss state
+	// did not carry over).
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isFinalWarning) < 1 {
+		t.Fatalf("final-warning did not publish on fresh deadline after Dismiss reset, events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissBeforeUpdateIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	// No deadline tracked yet; Dismiss must be a no-op (no panic, no state).
+	w.Dismiss()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Final warning should still publish — Dismiss only acts on the current
+	// deadline, and there was none at the time of the call.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
+}

client/internal/connect.go

@@ -393,6 +393,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 
+		// Seed the session-expiry deadline from the LoginResponse. Subsequent
+		// changes flow in through SyncResponse and are applied in handleSync.
+		engine.ApplySessionDeadline(loginResp.GetSessionExpiresAt())
+
 		log.Infof("Netbird engine started, the IP is: %s", peerConfig.GetAddress())
 		state.Set(StatusConnected)
 

client/internal/engine.go

@@ -35,6 +35,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
@@ -250,6 +251,8 @@ type Engine struct {
 	jobExecutorWG sync.WaitGroup
 
 	exposeManager *expose.Manager
+
+	sessionWatcher *sessionwatch.Watcher
 }
 
 // Peer is an instance of the Connection Peer
@@ -293,6 +296,17 @@ func NewEngine(
 		clientMetrics:      services.ClientMetrics,
 		updateManager:      services.UpdateManager,
 	}
+	// sessionWatcher keeps the SubscribeStatus consumers in sync with the
+	// session expiry deadline. Deadline-change ticks come for free via
+	// Status.SetSessionExpiresAt; the watcher exists to push a wake-up at
+	// T-WarningLead and T-FinalWarningLead so the UI repaints the remaining
+	// time / warning state even when nothing else changed, and to publish
+	// two SystemEvents (the warning composition lives in sessionwatch so
+	// the wire format stays owned by one package):
+	//   - T-WarningLead   → interactive "Extend now / Dismiss" notification
+	//   - T-FinalWarningLead → auto-opened SessionAboutToExpire dialog,
+	//     suppressed when the user dismissed the earlier warning
+	engine.sessionWatcher = sessionwatch.New(engine.statusRecorder)
 
 	log.Infof("I am: %s", config.WgPrivateKey.PublicKey().String())
 	return engine
@@ -333,6 +347,10 @@ func (e *Engine) Stop() error {
 		e.srWatcher.Close()
 	}
 
+	if e.sessionWatcher != nil {
+		e.sessionWatcher.Close()
+	}
+
 	if e.updateManager != nil {
 		e.updateManager.SetDownloadOnly()
 	}
@@ -865,6 +883,8 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return e.ctx.Err()
 	}
 
+	e.ApplySessionDeadline(update.GetSessionExpiresAt())
+
 	if update.NetworkMap != nil && update.NetworkMap.PeerConfig != nil {
 		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate)
 	}

client/internal/engine_authsession.go

@@ -0,0 +1,97 @@
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/system"
+)
+
+// ApplySessionDeadline propagates the absolute SSO session deadline carried on
+// LoginResponse / SyncResponse to both the watcher (for the edge-triggered
+// warning) and the status recorder (for the SubscribeStatus / Status RPC
+// snapshot the UI consumes).
+//
+// The wire field is 3-state:
+//   - nil                        → snapshot carries no info; keep the
+//     previously-anchored deadline (no-op)
+//   - explicit zero (s=0, n=0)   → peer is not SSO-registered or expiry is
+//     disabled; clear both sinks
+//   - valid timestamp            → new deadline; arm watcher, expose on
+//     status recorder
+//
+// Deadline sanity-checks live in sessionwatch.Watcher.Update. Any rejected
+// value is treated as a clear on both sinks: the alternative — leaving the
+// previously-known deadline in place — risks the UI confidently displaying
+// a stale "expires in X" while the server has actually invalidated it.
+func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
+	if ts == nil {
+		return
+	}
+	var deadline time.Time
+	// Explicit zero (seconds=0 AND nanos=0) is the sentinel for "disabled".
+	// Everything else flows through Watcher.Update, whose sanity-checks
+	// reject out-of-range / pre-epoch / far-future / too-stale values; the
+	// catch-block below converts any rejection into a clear.
+	if ts.GetSeconds() != 0 || ts.GetNanos() != 0 {
+		deadline = ts.AsTime().UTC()
+	}
+	if e.sessionWatcher != nil {
+		if err := e.sessionWatcher.Update(deadline); err != nil {
+			log.Errorf("auth session deadline rejected: %v, clearing", err)
+			deadline = time.Time{}
+		}
+	}
+	if e.statusRecorder != nil {
+		e.statusRecorder.SetSessionExpiresAt(deadline)
+	}
+}
+
+// DismissSessionWarning records the user's "Dismiss" click on the
+// T-WarningLead interactive notification and suppresses the upcoming
+// T-FinalWarningLead fallback for the current deadline. No-op when the
+// watcher is not running or holds no deadline.
+func (e *Engine) DismissSessionWarning() {
+	if e.sessionWatcher == nil {
+		return
+	}
+	e.sessionWatcher.Dismiss()
+}
+
+// ExtendAuthSession asks the management server to refresh the SSO session
+// expiry deadline using the supplied JWT, then mirrors the new deadline into
+// the daemon's state. The tunnel is untouched; no resync, no reconnect.
+//
+// Returns the new absolute UTC deadline (or zero time when the server
+// reports the peer is not eligible for extension).
+func (e *Engine) ExtendAuthSession(ctx context.Context, jwtToken string) (time.Time, error) {
+	if jwtToken == "" {
+		return time.Time{}, errors.New("jwt token is required")
+	}
+	if e.mgmClient == nil {
+		return time.Time{}, errors.New("management client is not initialised")
+	}
+
+	info, err := system.GetInfoWithChecks(ctx, e.checks)
+	if err != nil {
+		log.Warnf("failed to collect system info for session extend: %v", err)
+		info = system.GetInfo(ctx)
+	}
+
+	resp, err := e.mgmClient.ExtendAuthSession(info, jwtToken)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("extend auth session on management: %w", err)
+	}
+
+	e.ApplySessionDeadline(resp.GetSessionExpiresAt())
+
+	if resp.GetSessionExpiresAt().IsValid() {
+		return resp.GetSessionExpiresAt().AsTime().UTC(), nil
+	}
+	return time.Time{}, nil
+}

client/internal/engine_session_deadline_test.go

@@ -0,0 +1,78 @@
+package internal
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// TestApplySessionDeadline_ThreeState pins down the 3-state semantics of the
+// wire field carried on LoginResponse / SyncResponse:
+//
+//   - nil pointer            → no info; previously-anchored deadline survives
+//   - explicit zero value    → "expiry disabled" sentinel; both sinks cleared
+//   - valid future timestamp → new deadline propagated to both sinks
+func TestApplySessionDeadline_ThreeState(t *testing.T) {
+	newEngine := func() *Engine {
+		recorder := peer.NewRecorder("")
+		return &Engine{
+			statusRecorder: recorder,
+			sessionWatcher: sessionwatch.New(recorder),
+		}
+	}
+
+	t.Run("valid timestamp sets deadline on both sinks", func(t *testing.T) {
+		e := newEngine()
+		deadline := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(deadline))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(deadline),
+			"status recorder should hold the new deadline")
+	})
+
+	t.Run("nil is a no-op and preserves previous deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		e.ApplySessionDeadline(nil)
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded),
+			"nil snapshot must not disturb the existing deadline")
+	})
+
+	t.Run("explicit zero clears a previously-anchored deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Explicit zero Timestamp{} (seconds=0, nanos=0) is the
+		// "expiry disabled / not SSO" sentinel.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"explicit zero sentinel must clear the deadline")
+	})
+
+	t.Run("invalid timestamp clears the deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Out-of-range nanos → IsValid()==false; same-meaning as the
+		// disabled sentinel for downstream sinks.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{Seconds: 1, Nanos: -1})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"invalid timestamp must clear the deadline")
+	})
+}

client/internal/peer/status.go

@@ -202,6 +202,12 @@ type Status struct {
 	notifier              *notifier
 	rosenpassEnabled      bool
 	rosenpassPermissive   bool
+	// sessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Populated from management LoginResponse /
+	// SyncResponse and exposed via the daemon's Status / SubscribeStatus RPC
+	// so the UI can show remaining time without itself talking to mgm.
+	sessionExpiresAt      time.Time
 	nsGroupStates         []NSGroupState
 	resolvedDomainsStates map[domain.Domain]ResolvedDomainInfo
 	lazyConnectionEnabled bool
@@ -739,6 +745,31 @@ func (d *Status) UpdateLocalPeerState(localPeerState LocalPeerState) {
 	d.notifyStateChange()
 }
 
+// SetSessionExpiresAt records the absolute UTC instant at which the peer's
+// SSO session is set to expire. Pass the zero value to clear (e.g. when the
+// management server stops publishing a deadline because login expiration was
+// disabled or the peer is not SSO-tracked). Same-value updates are no-ops;
+// real changes fan out via notifyStateChange so SubscribeStatus consumers
+// pick up the new deadline on their next read.
+func (d *Status) SetSessionExpiresAt(deadline time.Time) {
+	d.mux.Lock()
+	if d.sessionExpiresAt.Equal(deadline) {
+		d.mux.Unlock()
+		return
+	}
+	d.sessionExpiresAt = deadline
+	d.mux.Unlock()
+	d.notifyStateChange()
+}
+
+// GetSessionExpiresAt returns the most recently recorded SSO session deadline,
+// or the zero value when no deadline is tracked.
+func (d *Status) GetSessionExpiresAt() time.Time {
+	d.mux.Lock()
+	defer d.mux.Unlock()
+	return d.sessionExpiresAt
+}
+
 // AddLocalPeerStateRoute adds a route to the local peer state
 func (d *Status) AddLocalPeerStateRoute(route string, resourceId route.ResID) {
 	d.mux.Lock()

client/proto/daemon.proto

@@ -115,6 +115,25 @@ service DaemonService {
   // WaitJWTToken waits for JWT authentication completion
   rpc WaitJWTToken(WaitJWTTokenRequest) returns (WaitJWTTokenResponse) {}
 
+  // RequestExtendAuthSession initiates an SSO session-extension flow.
+  // The daemon prepares a PKCE/device-code request against the IdP and
+  // returns the verification URI; the UI is expected to open it. The flow
+  // state is kept in the daemon until WaitExtendAuthSession completes it.
+  rpc RequestExtendAuthSession(RequestExtendAuthSessionRequest) returns (RequestExtendAuthSessionResponse) {}
+
+  // WaitExtendAuthSession blocks until the user finishes the SSO step
+  // started by RequestExtendAuthSession, then forwards the resulting JWT
+  // to the management server's ExtendAuthSession RPC. Returns the new
+  // session expiry deadline. The tunnel stays up the entire time.
+  rpc WaitExtendAuthSession(WaitExtendAuthSessionRequest) returns (WaitExtendAuthSessionResponse) {}
+
+  // DismissSessionWarning records that the user clicked "Dismiss" on the
+  // T-WarningLead interactive notification, suppressing the auto-opened
+  // SessionAboutToExpire dialog that would otherwise fire at
+  // T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+  // a missed call only means the fallback dialog will still appear.
+  rpc DismissSessionWarning(DismissSessionWarningRequest) returns (DismissSessionWarningResponse) {}
+
 // StartCPUProfile starts CPU profiling in the daemon
   rpc StartCPUProfile(StartCPUProfileRequest) returns (StartCPUProfileResponse) {}
 
@@ -256,6 +275,10 @@ message StatusResponse{
   FullStatus fullStatus = 2;
   // NetBird daemon version
   string daemonVersion = 3;
+  // Absolute UTC instant at which the peer's SSO session expires.
+  // Unset when the peer is not SSO-registered or login expiration is disabled.
+  // The UI derives "warning active" from this value and its own clock.
+  google.protobuf.Timestamp sessionExpiresAt = 4;
 }
 
 message DownRequest {}
@@ -810,6 +833,55 @@ message WaitJWTTokenResponse {
   int64 expiresIn = 3;
 }
 
+// RequestExtendAuthSessionRequest kicks off the session-extension SSO flow.
+message RequestExtendAuthSessionRequest {
+  // Optional OIDC login_hint (typically the user's email) to pre-fill the
+  // IdP login form.
+  optional string hint = 1;
+}
+
+// RequestExtendAuthSessionResponse carries the verification URI the UI
+// should open in a browser. The daemon retains the flow state and resolves
+// it via WaitExtendAuthSession.
+message RequestExtendAuthSessionResponse {
+  // verification URI for the user to open in the browser
+  string verificationURI = 1;
+  // complete verification URI (with embedded user code)
+  string verificationURIComplete = 2;
+  // user code to enter on verification URI (for device-code flows)
+  string userCode = 3;
+  // device code for matching the WaitExtendAuthSession call to this flow
+  string deviceCode = 4;
+  // expiration time in seconds for the device code / PKCE flow
+  int64 expiresIn = 5;
+}
+
+// WaitExtendAuthSessionRequest is sent by the UI after it opens the
+// verification URI. The daemon blocks on this call until the user
+// completes (or aborts) the SSO step.
+message WaitExtendAuthSessionRequest {
+  // device code returned by RequestExtendAuthSession
+  string deviceCode = 1;
+  // user code for verification
+  string userCode = 2;
+}
+
+// WaitExtendAuthSessionResponse carries the refreshed deadline returned
+// by the management server. Unset when the management server reports the
+// peer is not eligible for session extension.
+message WaitExtendAuthSessionResponse {
+  google.protobuf.Timestamp sessionExpiresAt = 1;
+}
+
+// DismissSessionWarningRequest is sent by the UI when the user clicks
+// "Dismiss" on the T-WarningLead notification.
+message DismissSessionWarningRequest {}
+
+// DismissSessionWarningResponse acknowledges the dismissal. Carries no
+// payload — the daemon's only obligation is to silence the upcoming
+// T-FinalWarningLead fallback for the current deadline.
+message DismissSessionWarningResponse {}
+
 // StartCPUProfileRequest for starting CPU profiling
 message StartCPUProfileRequest {}
 

client/proto/daemon_grpc.pb.go

@@ -86,6 +86,22 @@ type DaemonServiceClient interface {
 	RequestJWTAuth(ctx context.Context, in *RequestJWTAuthRequest, opts ...grpc.CallOption) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(ctx context.Context, in *WaitJWTTokenRequest, opts ...grpc.CallOption) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -496,6 +512,33 @@ func (c *daemonServiceClient) WaitJWTToken(ctx context.Context, in *WaitJWTToken
 	return out, nil
 }
 
+func (c *daemonServiceClient) RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error) {
+	out := new(RequestExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, "/daemon.DaemonService/RequestExtendAuthSession", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error) {
+	out := new(WaitExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, "/daemon.DaemonService/WaitExtendAuthSession", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error) {
+	out := new(DismissSessionWarningResponse)
+	err := c.cc.Invoke(ctx, "/daemon.DaemonService/DismissSessionWarning", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error) {
 	out := new(StartCPUProfileResponse)
 	err := c.cc.Invoke(ctx, "/daemon.DaemonService/StartCPUProfile", in, out, opts...)
@@ -627,6 +670,22 @@ type DaemonServiceServer interface {
 	RequestJWTAuth(context.Context, *RequestJWTAuthRequest) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -749,6 +808,15 @@ func (UnimplementedDaemonServiceServer) RequestJWTAuth(context.Context, *Request
 func (UnimplementedDaemonServiceServer) WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method WaitJWTToken not implemented")
 }
+func (UnimplementedDaemonServiceServer) RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RequestExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method WaitExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DismissSessionWarning not implemented")
+}
 func (UnimplementedDaemonServiceServer) StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method StartCPUProfile not implemented")
 }
@@ -1431,6 +1499,60 @@ func _DaemonService_WaitJWTToken_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_RequestExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/daemon.DaemonService/RequestExtendAuthSession",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, req.(*RequestExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_WaitExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WaitExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/daemon.DaemonService/WaitExtendAuthSession",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, req.(*WaitExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_DismissSessionWarning_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DismissSessionWarningRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/daemon.DaemonService/DismissSessionWarning",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, req.(*DismissSessionWarningRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_StartCPUProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(StartCPUProfileRequest)
 	if err := dec(in); err != nil {
@@ -1645,6 +1767,18 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "WaitJWTToken",
 			Handler:    _DaemonService_WaitJWTToken_Handler,
 		},
+		{
+			MethodName: "RequestExtendAuthSession",
+			Handler:    _DaemonService_RequestExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "WaitExtendAuthSession",
+			Handler:    _DaemonService_WaitExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "DismissSessionWarning",
+			Handler:    _DaemonService_DismissSessionWarning_Handler,
+		},
 		{
 			MethodName: "StartCPUProfile",
 			Handler:    _DaemonService_StartCPUProfile_Handler,

client/server/server.go

@@ -19,6 +19,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	gstatus "google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
@@ -67,6 +68,12 @@ type Server struct {
 	logFile string
 
 	oauthAuthFlow oauthAuthFlow
+	// extendAuthSessionFlow holds the pending PKCE flow created by
+	// RequestExtendAuthSession until WaitExtendAuthSession resolves it.
+	// Kept separate from oauthAuthFlow (which is reserved for the SSH
+	// JWT path) so a concurrent SSH auth doesn't clobber the session
+	// extend flow or vice versa.
+	extendAuthSessionFlow *auth.PendingFlow
 
 	mutex  sync.Mutex
 	config *profilemanager.Config
@@ -123,6 +130,7 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		captureEnabled:         captureEnabled,
 		networksDisabled:       networksDisabled,
 		jwtCache:               newJWTCache(),
+		extendAuthSessionFlow:  auth.NewPendingFlow(),
 	}
 	agent := &serverAgent{s}
 	s.sleepHandler = sleephandler.New(agent)
@@ -1221,6 +1229,10 @@ func (s *Server) buildStatusResponse(msg *proto.StatusRequest) (*proto.StatusRes
 
 	statusResponse := proto.StatusResponse{Status: string(status), DaemonVersion: version.NetbirdVersion()}
 
+	if deadline := s.statusRecorder.GetSessionExpiresAt(); !deadline.IsZero() {
+		statusResponse.SessionExpiresAt = timestamppb.New(deadline)
+	}
+
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
@@ -1450,6 +1462,131 @@ func (s *Server) WaitJWTToken(
 	}, nil
 }
 
+// RequestExtendAuthSession initiates the SSO session-extension flow and
+// returns the verification URI the UI should open. The flow state is held
+// in s.extendAuthSessionFlow until WaitExtendAuthSession resolves it.
+func (s *Server) RequestExtendAuthSession(
+	ctx context.Context,
+	msg *proto.RequestExtendAuthSessionRequest,
+) (*proto.RequestExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	s.mutex.Lock()
+	config := s.config
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if config == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not configured")
+	}
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+
+	hint := ""
+	if msg.Hint != nil {
+		hint = *msg.Hint
+	}
+	if hint == "" {
+		hint = profilemanager.GetLoginHint()
+	}
+
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
+	}
+
+	authInfo, err := oAuthFlow.RequestAuthInfo(ctx)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to request auth info: %v", err)
+	}
+
+	s.extendAuthSessionFlow.Set(oAuthFlow, authInfo)
+
+	return &proto.RequestExtendAuthSessionResponse{
+		VerificationURI:         authInfo.VerificationURI,
+		VerificationURIComplete: authInfo.VerificationURIComplete,
+		UserCode:                authInfo.UserCode,
+		DeviceCode:              authInfo.DeviceCode,
+		ExpiresIn:               int64(authInfo.ExpiresIn),
+	}, nil
+}
+
+// WaitExtendAuthSession blocks until the user completes the SSO step
+// initiated by RequestExtendAuthSession, then forwards the resulting JWT
+// to the management server's ExtendAuthSession RPC. The returned deadline
+// is also applied locally via the engine so SubscribeStatus consumers see
+// the refreshed state.
+func (s *Server) WaitExtendAuthSession(
+	ctx context.Context,
+	req *proto.WaitExtendAuthSessionRequest,
+) (*proto.WaitExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	oAuthFlow, authInfo, ok := s.extendAuthSessionFlow.Get()
+
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if !ok || authInfo.DeviceCode != req.DeviceCode {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "invalid device code or no active extend-session flow")
+	}
+
+	tokenInfo, err := oAuthFlow.WaitToken(ctx, authInfo)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to obtain JWT token: %v", err)
+	}
+
+	// Clear pending flow before talking to mgm so a retry can re-initiate.
+	s.extendAuthSessionFlow.Clear()
+
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine is not initialised")
+	}
+
+	deadline, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse())
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "management ExtendAuthSession failed: %v", err)
+	}
+
+	resp := &proto.WaitExtendAuthSessionResponse{}
+	if !deadline.IsZero() {
+		resp.SessionExpiresAt = timestamppb.New(deadline)
+	}
+	return resp, nil
+}
+
+// DismissSessionWarning forwards the user's "Dismiss" click on the
+// T-WarningLead notification down to the engine's sessionWatcher so the
+// T-FinalWarningLead fallback is suppressed for the current deadline.
+// Best-effort: when the client/engine is not yet running the call is a
+// successful no-op (the watcher has no deadline to dismiss anyway).
+func (s *Server) DismissSessionWarning(
+	_ context.Context,
+	_ *proto.DismissSessionWarningRequest,
+) (*proto.DismissSessionWarningResponse, error) {
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+	if connectClient == nil {
+		return &proto.DismissSessionWarningResponse{}, nil
+	}
+	if engine := connectClient.Engine(); engine != nil {
+		engine.DismissSessionWarning()
+	}
+	return &proto.DismissSessionWarningResponse{}, nil
+}
+
 // ExposeService exposes a local port via the NetBird reverse proxy.
 func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.DaemonService_ExposeServiceServer) error {
 	s.mutex.Lock()

client/status/status.go

@@ -55,6 +55,10 @@ type ConvertOptions struct {
 	IPsFilter            map[string]struct{}
 	ConnectionTypeFilter string
 	ProfileName          string
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Sourced from StatusResponse.SessionExpiresAt.
+	SessionExpiresAt time.Time
 }
 
 type PeerStateDetailOutput struct {
@@ -153,6 +157,11 @@ type OutputOverview struct {
 	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
 	ProfileName             string                     `json:"profileName" yaml:"profileName"`
 	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. nil when the peer is not SSO-tracked or login
+	// expiration is disabled. Pointer (rather than zero-value time.Time) so
+	// JSON / YAML omit the field entirely with `,omitempty`.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty" yaml:"sessionExpiresAt,omitempty"`
 }
 
 // ConvertToStatusOutputOverview converts protobuf status to the output overview.
@@ -198,6 +207,10 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 		ProfileName:             opts.ProfileName,
 		SSHServerState:          sshServerOverview,
 	}
+	if !opts.SessionExpiresAt.IsZero() {
+		t := opts.SessionExpiresAt
+		overview.SessionExpiresAt = &t
+	}
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
@@ -535,6 +548,15 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 
 	peersCountString := fmt.Sprintf("%d/%d Connected", o.Peers.Connected, o.Peers.Total)
 
+	var sessionExpiryString string
+	if o.SessionExpiresAt != nil && !o.SessionExpiresAt.IsZero() {
+		sessionExpiryString = fmt.Sprintf(
+			"Session expires: %s (in %s)\n",
+			o.SessionExpiresAt.Format(time.RFC3339),
+			FormatRemainingDuration(time.Until(*o.SessionExpiresAt)),
+		)
+	}
+
 	var forwardingRulesString string
 	if o.NumberOfForwardingRules > 0 {
 		forwardingRulesString = fmt.Sprintf("Forwarding rules: %d\n", o.NumberOfForwardingRules)
@@ -565,6 +587,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"SSH Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
+			"%s"+
 			"Peers count: %s\n",
 		fmt.Sprintf("%s/%s%s", goos, goarch, goarm),
 		o.DaemonVersion,
@@ -583,6 +606,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		sshServerStatus,
 		networks,
 		forwardingRulesString,
+		sessionExpiryString,
 		peersCountString,
 	)
 	return summary
@@ -996,3 +1020,57 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 		overview.SSHServerState.Sessions[i].Command = a.AnonymizeString(session.Command)
 	}
 }
+
+// FormatRemainingDuration renders a time.Duration for the "Session expires"
+// line. Examples: "2h 15m", "47m 12s", "8s", "expired 3m ago".
+//
+// Granularity drops to seconds only under a minute, otherwise minutes are
+// the smallest unit shown — sub-minute precision is noise for a deadline
+// that's hours or days out.
+func FormatRemainingDuration(d time.Duration) string {
+	if d <= 0 {
+		return "expired " + HumaniseDuration(-d) + " ago"
+	}
+	return HumaniseDuration(d)
+}
+
+// HumaniseDuration renders a positive duration in compact form (e.g.
+// "2h 15m", "47m", "8s"). Exposed alongside FormatRemainingDuration so
+// callers that don't need the "expired … ago" wording can format
+// positive durations directly.
+func HumaniseDuration(d time.Duration) string {
+	if d < time.Minute {
+		s := int(d.Round(time.Second).Seconds())
+		if s < 1 {
+			s = 1
+		}
+		return fmt.Sprintf("%ds", s)
+	}
+
+	const (
+		day    = 24 * time.Hour
+		hour   = time.Hour
+		minute = time.Minute
+	)
+
+	days := int64(d / day)
+	d -= time.Duration(days) * day
+	hours := int64(d / hour)
+	d -= time.Duration(hours) * hour
+	minutes := int64(d / minute)
+
+	switch {
+	case days > 0:
+		if hours == 0 {
+			return fmt.Sprintf("%dd", days)
+		}
+		return fmt.Sprintf("%dd %dh", days, hours)
+	case hours > 0:
+		if minutes == 0 {
+			return fmt.Sprintf("%dh", hours)
+		}
+		return fmt.Sprintf("%dh %dm", hours, minutes)
+	default:
+		return fmt.Sprintf("%dm", minutes)
+	}
+}

client/status/status_test.go

@@ -641,3 +641,50 @@ func TestTimeAgo(t *testing.T) {
 		})
 	}
 }
+
+func TestHumaniseDuration(t *testing.T) {
+	cases := []struct {
+		in   time.Duration
+		want string
+	}{
+		{0, "1s"},
+		{500 * time.Millisecond, "1s"},
+		{8 * time.Second, "8s"},
+		{59 * time.Second, "59s"},
+		{time.Minute, "1m"},
+		{47*time.Minute + 12*time.Second, "47m"},
+		{time.Hour, "1h"},
+		{2*time.Hour + 15*time.Minute, "2h 15m"},
+		{2 * time.Hour, "2h"},
+		{24 * time.Hour, "1d"},
+		{2*24*time.Hour + 3*time.Hour, "2d 3h"},
+	}
+	for _, tc := range cases {
+		got := HumaniseDuration(tc.in)
+		assert.Equal(t, tc.want, got, "input %s", tc.in)
+	}
+}
+
+func TestFormatRemainingDuration_Expired(t *testing.T) {
+	assert.Equal(t, "expired 3m ago", FormatRemainingDuration(-3*time.Minute))
+	assert.Equal(t, "expired 1s ago", FormatRemainingDuration(-500*time.Millisecond))
+}
+
+func TestSessionExpiresLineRendered(t *testing.T) {
+	in := overview // copy of the package-level fixture
+	deadline := time.Now().Add(2*time.Hour + 30*time.Minute).UTC()
+	in.SessionExpiresAt = &deadline
+
+	out := in.GeneralSummary(false, false, false, false)
+	assert.Contains(t, out, "Session expires: ")
+	assert.Contains(t, out, deadline.Format(time.RFC3339))
+	// 2h 30m drifts to "2h 29m" within 60s — match the family prefix.
+	assert.Contains(t, out, "(in 2h ")
+}
+
+func TestSessionExpiresLineOmittedWhenNil(t *testing.T) {
+	in := overview
+	in.SessionExpiresAt = nil
+	out := in.GeneralSummary(false, false, false, false)
+	assert.NotContains(t, out, "Session expires")
+}

client/ui/authsession/service.go

@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// ExtendStartParams optionally pre-fills the IdP login form.
+type ExtendStartParams struct {
+	// Hint is the OIDC login_hint, typically the user's email.
+	Hint string `json:"hint"`
+}
+
+// ExtendStartResult tells the UI what to open and how to match the
+// follow-up Wait call to the daemon's pending flow.
+type ExtendStartResult struct {
+	VerificationURI         string `json:"verificationUri"`
+	VerificationURIComplete string `json:"verificationUriComplete"`
+	UserCode                string `json:"userCode"`
+	DeviceCode              string `json:"deviceCode"`
+	ExpiresIn               int64  `json:"expiresIn"`
+}
+
+// ExtendWaitParams identifies the pending flow by the device/user code
+// the UI received from RequestExtend.
+type ExtendWaitParams struct {
+	DeviceCode string `json:"deviceCode"`
+	UserCode   string `json:"userCode"`
+}
+
+// ExtendResult carries the refreshed deadline. ExpiresAt is nil when the
+// management server reported the peer is not eligible for session
+// extension.
+type ExtendResult struct {
+	ExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
+}
+
+// DaemonConn yields a lazy daemon gRPC client. Mirrors services.DaemonConn
+// in the Wails services package; duplicated here so the Session can be
+// owned by authsession without an import cycle.
+type DaemonConn interface {
+	Client() (proto.DaemonServiceClient, error)
+}
+
+// Session bundles the session-auth daemon RPCs the UI drives — the
+// interactive extend flow (RequestExtend + WaitExtend) and the Dismiss
+// hand-off. The tray uses it directly; the Wails-bound wrapper in
+// client/ui/services exposes only the subset the React frontend needs.
+type Session struct {
+	conn DaemonConn
+}
+
+// NewSession returns a Session backed by the shared daemon connection.
+func NewSession(conn DaemonConn) *Session {
+	return &Session{conn: conn}
+}
+
+// RequestExtend starts the SSO session-extension flow on the daemon and
+// returns the verification URI for the UI to open.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	req := &proto.RequestExtendAuthSessionRequest{}
+	if p.Hint != "" {
+		h := p.Hint
+		req.Hint = &h
+	}
+
+	resp, err := cli.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	return ExtendStartResult{
+		VerificationURI:         resp.GetVerificationURI(),
+		VerificationURIComplete: resp.GetVerificationURIComplete(),
+		UserCode:                resp.GetUserCode(),
+		DeviceCode:              resp.GetDeviceCode(),
+		ExpiresIn:               resp.GetExpiresIn(),
+	}, nil
+}
+
+// WaitExtend blocks until the user completes the SSO flow started by
+// RequestExtend, then returns the new session deadline (or nil when the
+// management server reports the peer ineligible).
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendResult{}, err
+	}
+
+	resp, err := cli.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: p.DeviceCode,
+		UserCode:   p.UserCode,
+	})
+	if err != nil {
+		return ExtendResult{}, err
+	}
+
+	out := ExtendResult{}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		out.ExpiresAt = &t
+	}
+	return out, nil
+}
+
+// DismissWarning records the user's "Dismiss" click on the T-WarningLead
+// notification so the daemon suppresses the T-FinalWarningLead fallback
+// dialog for the current deadline. Best-effort: the daemon never reports
+// a "deadline not found" error — a stale or no-op call is silently swallowed.
+func (s *Session) DismissWarning(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.DismissSessionWarning(ctx, &proto.DismissSessionWarningRequest{})
+	return err
+}

client/ui/authsession/warning.go

@@ -0,0 +1,83 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package authsession holds the UI-side domain logic for the SSO
+// session-extend feature. Wails service facades in
+// client/ui/services/session*.go are thin adapters around the types and
+// functions defined here; the parsing, request shapes, and constants
+// live in this package so future-us can reason about (and test) the
+// feature without dragging the Wails service surface around with it.
+package authsession
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+)
+
+// Metadata keys the daemon attaches to session-warning SystemEvents.
+// Re-exported from sessionwatch (single source of truth on the daemon
+// side) so UI-side consumers don't have to import the daemon-internal
+// package directly.
+const (
+	MetaWarning     = sessionwatch.MetaSessionWarning
+	MetaFinal       = sessionwatch.MetaSessionFinal
+	MetaExpiresAt   = sessionwatch.MetaSessionExpiresAt
+	MetaLeadMinutes = sessionwatch.MetaSessionLeadMinutes
+)
+
+// Warning is the typed payload emitted on the session-warning Wails
+// events. The React side subscribes to "netbird:session:warning" and
+// "netbird:session:final-warning" and receives this shape.
+//
+// ExpiresAt is best-effort: when the metadata is missing or malformed
+// (e.g. an older daemon emits the event without the timestamp) it stays
+// zero — the UI can fall back to the Status snapshot.
+type Warning struct {
+	// ExpiresAt is the absolute UTC deadline the warning was fired
+	// against. The UI displays remaining time relative to its own clock.
+	ExpiresAt time.Time `json:"sessionExpiresAt"`
+	// LeadMinutes is the warning's configured lead time in minutes
+	// (WarningLead for the T-10 event, FinalWarningLead for the T-2
+	// event). Exposed so the UI can show "expires in ~N minutes" without
+	// hardcoding either constant on its side.
+	LeadMinutes int `json:"leadMinutes"`
+	// Final is true on the T-FinalWarningLead fallback event and false
+	// on the regular T-WarningLead notification. Exposed so a frontend
+	// listener bound to the dedicated final-warning Wails event still
+	// receives a payload it can self-describe (and so a tray that
+	// happens to see both event streams can branch in one place).
+	Final bool `json:"final"`
+}
+
+// WarningFromMetadata parses the daemon's SystemEvent metadata into a
+// Warning payload. Returns (nil, false) when the event is not a
+// session-warning at all (the common case). When the metadata flag is
+// set but a field fails to parse, the field stays at its zero value and
+// the event is still surfaced — the UI gets to decide how to handle it.
+func WarningFromMetadata(meta map[string]string) (*Warning, bool) {
+	if meta == nil || meta[MetaWarning] != "true" {
+		return nil, false
+	}
+
+	out := &Warning{
+		Final: meta[MetaFinal] == "true",
+	}
+	if raw := meta[MetaExpiresAt]; raw != "" {
+		if t, err := sessionwatch.ParseExpiresAt(raw); err == nil {
+			out.ExpiresAt = t
+		}
+	}
+	if raw := meta[MetaLeadMinutes]; raw != "" {
+		if n, err := sessionwatch.ParseLeadMinutes(raw); err == nil {
+			out.LeadMinutes = n
+		}
+	}
+	return out, true
+}
+
+// ParseExpiresAt decodes a MetaExpiresAt metadata value to a UTC time.
+// Thin re-export of sessionwatch.ParseExpiresAt so UI-side call sites
+// (tray, frontend bindings) don't import the daemon-internal package.
+func ParseExpiresAt(s string) (time.Time, error) {
+	return sessionwatch.ParseExpiresAt(s)
+}

client/ui/authsession/warning_test.go

@@ -0,0 +1,82 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"testing"
+	"time"
+)
+
+func TestWarningFromMetadata_NotASessionWarning(t *testing.T) {
+	cases := []struct {
+		name string
+		meta map[string]string
+	}{
+		{"nil metadata", nil},
+		{"empty map", map[string]string{}},
+		{"unrelated event", map[string]string{"new_version_available": "0.65.0"}},
+		{"flag not 'true'", map[string]string{"session_warning": "1"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if w, ok := WarningFromMetadata(tc.meta); ok {
+				t.Fatalf("expected (nil, false), got (%+v, %v)", w, ok)
+			}
+		})
+	}
+}
+
+func TestWarningFromMetadata_FullPayload(t *testing.T) {
+	ts := "2026-05-18T13:30:00Z"
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": ts,
+		"lead_minutes":       "10",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("expected the warning to be recognised, got ok=false")
+	}
+	want, _ := time.Parse(time.RFC3339, ts)
+	if !got.ExpiresAt.Equal(want.UTC()) {
+		t.Errorf("ExpiresAt = %v, want %v", got.ExpiresAt, want.UTC())
+	}
+	if got.LeadMinutes != 10 {
+		t.Errorf("LeadMinutes = %d, want 10", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_BadFieldsStillEmits(t *testing.T) {
+	// Older or buggy daemon: the flag is set but the timestamp/lead are
+	// missing or malformed. The UI should still get a warning so it can
+	// at least surface "session expires soon"; field zero-values are fine.
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": "not-a-timestamp",
+		"lead_minutes":       "abc",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised even with malformed fields")
+	}
+	if !got.ExpiresAt.IsZero() {
+		t.Errorf("malformed timestamp should leave field zero, got %v", got.ExpiresAt)
+	}
+	if got.LeadMinutes != 0 {
+		t.Errorf("malformed lead_minutes should leave field 0, got %d", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_MissingFieldsStillEmits(t *testing.T) {
+	// Only the flag is present (e.g. future-trimmed event). Still emit.
+	meta := map[string]string{"session_warning": "true"}
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised when only flag is present")
+	}
+	if got.ExpiresAt.IsZero() != true || got.LeadMinutes != 0 {
+		t.Errorf("missing fields should be zero-valued, got %+v", got)
+	}
+}

client/ui/frontend/src/components/ProfileDropdown.tsx

@@ -11,6 +11,7 @@ import { NewProfileModal } from "@/components/NewProfileModal";
 import { Tooltip } from "@/components/Tooltip";
 import { useProfile } from "@/modules/profile/ProfileContext";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 type ProfileDropdownProps = {
     onManageProfiles?: () => void;
@@ -40,7 +41,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
         } catch (e) {
             await Dialogs.Error({
                 Title: title,
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);
@@ -70,7 +71,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
         } catch (e) {
             await Dialogs.Error({
                 Title: t("profile.error.createTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         }
     };

client/ui/frontend/src/i18n/locales/de/common.json

@@ -3,6 +3,7 @@
     "tray.status.disconnected": "Getrennt",
     "tray.status.daemonUnavailable": "Nicht aktiv",
     "tray.status.error": "Fehler",
+    "tray.session.expiresIn": "Sitzung: {remaining}",
 
     "tray.menu.open": "NetBird öffnen",
     "tray.menu.connect": "Verbinden",
@@ -31,6 +32,14 @@
     "notify.error.switchProfile": "Wechsel zu {profile} fehlgeschlagen",
     "notify.sessionExpired.title": "NetBird-Sitzung abgelaufen",
     "notify.sessionExpired.body": "Ihre NetBird-Sitzung ist abgelaufen. Bitte melden Sie sich erneut an.",
+    "notify.sessionWarning.title": "Sitzung läuft bald ab",
+    "notify.sessionWarning.body": "Ihre NetBird-Sitzung läuft in {remaining} ab. Klicken Sie auf Jetzt verlängern, um zu erneuern.",
+    "notify.sessionWarning.bodyGeneric": "Ihre NetBird-Sitzung läuft bald ab. Klicken Sie auf Jetzt verlängern, um zu erneuern.",
+    "notify.sessionWarning.extend": "Jetzt verlängern",
+    "notify.sessionWarning.dismiss": "Verwerfen",
+    "notify.sessionWarning.failed": "NetBird-Sitzung konnte nicht verlängert werden",
+    "notify.sessionWarning.successTitle": "NetBird-Sitzung verlängert",
+    "notify.sessionWarning.successBody": "Ihre Sitzung wurde erneuert.",
 
     "common.cancel": "Abbrechen",
     "common.save": "Speichern",
@@ -272,6 +281,7 @@
     "sessionAboutToExpire.stay": "Verbunden bleiben",
     "sessionAboutToExpire.logout": "Abmelden",
     "sessionAboutToExpire.expired": "Sitzung abgelaufen",
+    "sessionAboutToExpire.extendFailedTitle": "Sitzungsverlängerung fehlgeschlagen",
 
     "peers.search.placeholder": "Nach Peer-Name, DNS oder IP-Adresse suchen",
     "peers.filter.all": "Alle",
@@ -284,5 +294,14 @@
 
     "daemon.unavailable.title": "NetBird-Dienst läuft nicht",
     "daemon.unavailable.description": "Die App stellt automatisch die Verbindung wieder her, sobald der Dienst läuft.",
-    "daemon.unavailable.docsLink": "Dokumentation"
+    "daemon.unavailable.docsLink": "Dokumentation",
+
+    "error.jwt_clock_skew": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut.",
+    "error.jwt_expired": "Ihr Anmeldetoken ist abgelaufen. Bitte melden Sie sich erneut an.",
+    "error.jwt_signature_invalid": "Anmeldung fehlgeschlagen: Die Token-Signatur ist ungültig. Bitte wenden Sie sich an Ihren Administrator.",
+    "error.session_expired": "Ihre Sitzung ist abgelaufen. Bitte melden Sie sich erneut an.",
+    "error.invalid_setup_key": "Der Setup-Schlüssel fehlt oder ist ungültig.",
+    "error.permission_denied": "Die Anmeldung wurde vom Server abgelehnt.",
+    "error.daemon_unreachable": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft.",
+    "error.unknown": "Vorgang fehlgeschlagen. Technische Details siehe unten."
 }

client/ui/frontend/src/i18n/locales/en/common.json

@@ -3,6 +3,7 @@
     "tray.status.disconnected": "Disconnected",
     "tray.status.daemonUnavailable": "Not running",
     "tray.status.error": "Error",
+    "tray.session.expiresIn": "Session: {remaining}",
 
     "tray.menu.open": "Open NetBird",
     "tray.menu.connect": "Connect",
@@ -31,6 +32,14 @@
     "notify.error.switchProfile": "Failed to switch to {profile}",
     "notify.sessionExpired.title": "NetBird session expired",
     "notify.sessionExpired.body": "Your NetBird session has expired. Please log in again.",
+    "notify.sessionWarning.title": "Session expires soon",
+    "notify.sessionWarning.body": "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+    "notify.sessionWarning.bodyGeneric": "Your NetBird session is about to expire. Click Extend now to renew.",
+    "notify.sessionWarning.extend": "Extend now",
+    "notify.sessionWarning.dismiss": "Dismiss",
+    "notify.sessionWarning.failed": "Failed to extend NetBird session",
+    "notify.sessionWarning.successTitle": "NetBird session extended",
+    "notify.sessionWarning.successBody": "Your session has been refreshed.",
 
     "common.cancel": "Cancel",
     "common.save": "Save",
@@ -293,6 +302,7 @@
     "sessionAboutToExpire.stay": "Stay connected",
     "sessionAboutToExpire.logout": "Logout",
     "sessionAboutToExpire.expired": "Session expired",
+    "sessionAboutToExpire.extendFailedTitle": "Extend Session Failed",
 
     "peers.search.placeholder": "Search by peer name, DNS or IP address",
     "peers.filter.all": "All",
@@ -305,5 +315,14 @@
 
     "daemon.unavailable.title": "NetBird Service Is Not Running",
     "daemon.unavailable.description": "The app will reconnect automatically once the service is running.",
-    "daemon.unavailable.docsLink": "Documentation"
+    "daemon.unavailable.docsLink": "Documentation",
+
+    "error.jwt_clock_skew": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",
+    "error.jwt_expired": "Your sign-in token has expired. Please sign in again.",
+    "error.jwt_signature_invalid": "Sign-in failed: the token signature is invalid. Please contact your administrator.",
+    "error.session_expired": "Your session has expired. Please sign in again.",
+    "error.invalid_setup_key": "The setup key is missing or invalid.",
+    "error.permission_denied": "Sign-in was rejected by the server.",
+    "error.daemon_unreachable": "The NetBird daemon is not responding. Please check that the service is running.",
+    "error.unknown": "Operation failed. See details for the technical message."
 }

client/ui/frontend/src/i18n/locales/hu/common.json

@@ -3,6 +3,7 @@
     "tray.status.disconnected": "Lekapcsolva",
     "tray.status.daemonUnavailable": "Nem fut",
     "tray.status.error": "Hiba",
+    "tray.session.expiresIn": "Munkamenet: {remaining}",
 
     "tray.menu.open": "NetBird megnyitása",
     "tray.menu.connect": "Csatlakozás",
@@ -31,6 +32,14 @@
     "notify.error.switchProfile": "Átváltás sikertelen erre: {profile}",
     "notify.sessionExpired.title": "NetBird munkamenet lejárt",
     "notify.sessionExpired.body": "A NetBird munkamenet lejárt. Kérjük, jelentkezzen be újra.",
+    "notify.sessionWarning.title": "Munkamenet hamarosan lejár",
+    "notify.sessionWarning.body": "A NetBird munkamenet {remaining} múlva lejár. Kattints a Meghosszabbítás gombra a megújításhoz.",
+    "notify.sessionWarning.bodyGeneric": "A NetBird munkamenet hamarosan lejár. Kattints a Meghosszabbítás gombra a megújításhoz.",
+    "notify.sessionWarning.extend": "Meghosszabbítás",
+    "notify.sessionWarning.dismiss": "Elvetés",
+    "notify.sessionWarning.failed": "A NetBird munkamenet meghosszabbítása sikertelen",
+    "notify.sessionWarning.successTitle": "NetBird munkamenet meghosszabbítva",
+    "notify.sessionWarning.successBody": "A munkamenet frissítve.",
 
     "common.cancel": "Mégse",
     "common.save": "Mentés",
@@ -272,6 +281,7 @@
     "sessionAboutToExpire.stay": "Maradjon csatlakoztatva",
     "sessionAboutToExpire.logout": "Kijelentkezés",
     "sessionAboutToExpire.expired": "Munkamenet lejárt",
+    "sessionAboutToExpire.extendFailedTitle": "A munkamenet meghosszabbítása sikertelen",
 
     "peers.search.placeholder": "Keresés társ neve, DNS vagy IP-cím alapján",
     "peers.filter.all": "Összes",
@@ -284,5 +294,14 @@
 
     "daemon.unavailable.title": "A NetBird szolgáltatás nem fut",
     "daemon.unavailable.description": "Az alkalmazás automatikusan újracsatlakozik, amint a szolgáltatás újra elérhető.",
-    "daemon.unavailable.docsLink": "Dokumentáció"
+    "daemon.unavailable.docsLink": "Dokumentáció",
+
+    "error.jwt_clock_skew": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra.",
+    "error.jwt_expired": "A bejelentkezési token lejárt. Kérjük, jelentkezzen be újra.",
+    "error.jwt_signature_invalid": "A bejelentkezés sikertelen: a token aláírása érvénytelen. Kérjük, lépjen kapcsolatba a rendszergazdával.",
+    "error.session_expired": "A munkamenet lejárt. Kérjük, jelentkezzen be újra.",
+    "error.invalid_setup_key": "A telepítési kulcs hiányzik vagy érvénytelen.",
+    "error.permission_denied": "A szerver elutasította a bejelentkezést.",
+    "error.daemon_unreachable": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás.",
+    "error.unknown": "A művelet meghiúsult. A technikai részleteket a Details mezőben találja."
 }

client/ui/frontend/src/layouts/ConnectionStatusSwitch.tsx

@@ -7,6 +7,7 @@ import { ToggleSwitch } from "@/components/ToggleSwitch.tsx";
 import { useStatus } from "@/modules/daemon-status/StatusContext.tsx";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 import { cn } from "@/lib/cn.ts";
+import { formatErrorMessage } from "@/lib/errors.ts";
 import netbirdFullLogo from "@/assets/logos/netbird-full.svg";
 
 enum ConnectionState {
@@ -38,8 +39,7 @@ const NEEDS_LOGIN_STATES = new Set([
     "LoginFailed",
 ]);
 
-const errorMessage = (e: unknown) =>
-    e instanceof Error ? e.message : String(e);
+const errorMessage = formatErrorMessage;
 
 // startLogin drives the daemon's SSO login end-to-end. The BrowserLogin
 // popup window is the only login UI; errors surface as a native
@@ -230,6 +230,14 @@ export const ConnectionStatusSwitch = () => {
         // See connect() above — clear via the effect, not eagerly.
     };
 
+    // Tracks whether the daemon has entered Connecting during the
+    // current "connect" action. Lets us distinguish "still waiting for
+    // the daemon to start" (Idle → Idle) from "the connect flow was
+    // cancelled externally" (Connecting → Idle, e.g. tray Disconnect
+    // while the UI was Connecting). Reset whenever action returns to
+    // null.
+    const sawConnectingRef = useRef(false);
+
     // Release the action latch when the daemon settles on a terminal
     // state for the user's intent — and, in the connect → NeedsLogin
     // case, hand off to driveLogin so the user doesn't have to click
@@ -237,6 +245,13 @@ export const ConnectionStatusSwitch = () => {
     // .finally, not here: Login's internal Down makes the daemon flap
     // through Idle, which would otherwise look like a terminal state.
     useEffect(() => {
+        if (action === null) {
+            sawConnectingRef.current = false;
+            return;
+        }
+        if (daemonState === "Connecting") {
+            sawConnectingRef.current = true;
+        }
         if (action === "connect") {
             if (needsLogin) {
                 driveLogin();
@@ -244,6 +259,14 @@ export const ConnectionStatusSwitch = () => {
             }
             if (daemonState === "Connected" || unreachable) {
                 setAction(null);
+                return;
+            }
+            // Cancelled externally (e.g. tray Disconnect during our
+            // Connecting): the daemon went back to Idle after we'd
+            // observed Connecting. Clear the latch so the UI stops
+            // showing Connecting forever.
+            if (sawConnectingRef.current && daemonState === "Idle") {
+                setAction(null);
             }
             return;
         }

client/ui/frontend/src/lib/errors.ts

@@ -0,0 +1,52 @@
+// Shared error formatter for native dialog bodies.
+//
+// The Go service layer (client/ui/services/connection.go classifyDaemonError)
+// wraps daemon errors in a ClientError struct exposed to the TS side as
+// {code, short, long}. Short is already localised (Go reads the current
+// preferences.Store language and resolves "error.<code>" via i18n.Bundle).
+// Long always carries the unwrapped raw daemon message so the operator can
+// see the JWT / mgm stack when the short text is too generic.
+//
+// Wails wraps Go-returned errors as Error({message, cause, kind}) where
+// .message holds the JSON-stringified payload and the structured object
+// lives on .cause — Object.keys(err) is empty in that case. We therefore
+// probe .cause first, then fall back to parsing .message as JSON, then
+// to plain .message text for callers that still hand us a raw Error.
+const extractClientError = (e: unknown): { short?: string; long?: string } | null => {
+    if (!e || typeof e !== "object") return null;
+    const withCause = e as { cause?: unknown; message?: unknown };
+    if (withCause.cause && typeof withCause.cause === "object") {
+        return withCause.cause as { short?: string; long?: string };
+    }
+    if (typeof withCause.message === "string") {
+        const m = withCause.message.trim();
+        if (m.startsWith("{") && m.endsWith("}")) {
+            try {
+                const parsed = JSON.parse(m);
+                if (parsed && typeof parsed === "object") {
+                    if ("cause" in parsed && parsed.cause && typeof parsed.cause === "object") {
+                        return parsed.cause as { short?: string; long?: string };
+                    }
+                    return parsed as { short?: string; long?: string };
+                }
+            } catch {
+                // not JSON — fall through to plain-message handling
+            }
+        }
+    }
+    return null;
+};
+
+export const formatErrorMessage = (e: unknown): string => {
+    const ce = extractClientError(e);
+    if (ce) {
+        const short = typeof ce.short === "string" ? ce.short : "";
+        const long = typeof ce.long === "string" ? ce.long : "";
+        if (short && long && long !== short) {
+            return `${short}\n\nDetails: ${long}`;
+        }
+        if (short) return short;
+    }
+    if (e instanceof Error) return e.message;
+    return String(e);
+};

client/ui/frontend/src/modules/authentication/SessionAboutToExpireDialog.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useSearchParams } from "react-router-dom";
-import { Events } from "@wailsio/runtime";
+import { Dialogs } from "@wailsio/runtime";
 import { ClockIcon } from "lucide-react";
 import { Button } from "@/components/Button";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
@@ -9,10 +9,15 @@ import { DialogActions } from "@/components/DialogActions";
 import { DialogDescription } from "@/components/DialogDescription";
 import { DialogHeading } from "@/components/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
-import { Connection, Profiles as ProfilesSvc, WindowManager } from "@bindings/services";
+import {
+    Connection,
+    Profiles as ProfilesSvc,
+    Session,
+    WindowManager,
+} from "@bindings/services";
 import { useAutoSizeWindow } from "@/lib/useAutoSizeWindow";
+import { formatErrorMessage } from "@/lib/errors.ts";
 
-const EVENT_TRIGGER_LOGIN = "trigger-login";
 const DEFAULT_SECONDS = 360;
 const WINDOW_WIDTH = 360;
 
@@ -35,6 +40,7 @@ export default function SessionAboutToExpireDialog() {
     }, [params]);
 
     const [remaining, setRemaining] = useState(initialSeconds);
+    const [busy, setBusy] = useState(false);
     const expired = remaining <= 0;
 
     useEffect(() => {
@@ -49,10 +55,38 @@ export default function SessionAboutToExpireDialog() {
         return () => window.clearInterval(id);
     }, [remaining]);
 
-    const stay = useCallback(() => {
-        void Events.Emit(EVENT_TRIGGER_LOGIN);
-        WindowManager.CloseSessionAboutToExpire().catch(console.error);
-    }, []);
+    // Mirrors tray.go::runExtendSession: starts the daemon SSO extend flow,
+    // opens the browser for the user to sign in, blocks on the daemon until
+    // the new deadline arrives. Tunnel stays up; success simply closes the
+    // dialog, failure surfaces a native error dialog and leaves this one
+    // open so the user can retry or logout.
+    const stay = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            const start = await Session.RequestExtend({ hint: "" });
+            const uri = start.verificationUriComplete || start.verificationUri;
+            if (uri) {
+                try {
+                    await Connection.OpenURL(uri);
+                } catch (e) {
+                    console.debug("OpenURL failed during extend", e);
+                }
+            }
+            await Session.WaitExtend({
+                deviceCode: start.deviceCode,
+                userCode: start.userCode,
+            });
+            WindowManager.CloseSessionAboutToExpire().catch(console.error);
+        } catch (e) {
+            await Dialogs.Error({
+                Title: t("sessionAboutToExpire.extendFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    }, [busy, t]);
 
     const logout = useCallback(async () => {
         try {
@@ -99,7 +133,7 @@ export default function SessionAboutToExpireDialog() {
                     size={"md"}
                     className={"w-full"}
                     onClick={stay}
-                    disabled={expired}
+                    disabled={expired || busy}
                 >
                     {t("sessionAboutToExpire.stay")}
                 </Button>
@@ -108,6 +142,7 @@ export default function SessionAboutToExpireDialog() {
                     size={"md"}
                     className={"w-full"}
                     onClick={logout}
+                    disabled={busy}
                 >
                     {t("sessionAboutToExpire.logout")}
                 </Button>

client/ui/frontend/src/modules/debug-bundle/useDebugBundle.ts

@@ -6,6 +6,7 @@ import {
 } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
 import i18next from "@/lib/i18n";
+import { formatErrorMessage } from "@/lib/errors.ts";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 
 const NETBIRD_UPLOAD_URL = "https://upload.debug.netbird.io/upload-url";
@@ -158,7 +159,7 @@ export const useDebugBundle = () => {
             setStage({ kind: "idle" });
             await Dialogs.Error({
                 Title: i18next.t("settings.error.debugBundleTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             if (abortRef.current === ctrl) abortRef.current = null;

client/ui/frontend/src/modules/settings/LanguagePicker.tsx

@@ -11,6 +11,7 @@ import { HelpText } from "@/components/HelpText";
 import { Label } from "@/components/Label";
 import { loadLanguages } from "@/lib/i18n";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 // Flags live alongside the rest of the SVG flag library under
 // assets/flags/1x1 and are filename-matched to the language code
@@ -91,7 +92,7 @@ export function LanguagePicker() {
         } catch (e) {
             await Dialogs.Error({
                 Title: t("settings.error.saveTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);

client/ui/frontend/src/modules/settings/SettingsContext.tsx

@@ -13,9 +13,7 @@ import type { Config } from "@bindings/services/models.js";
 import i18next from "@/lib/i18n";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 import { SkeletonSettings } from "@/modules/skeletons/SkeletonSettings.tsx";
-
-const errorMessage = (e: unknown) =>
-    e instanceof Error ? e.message : String(e);
+import { formatErrorMessage as errorMessage } from "@/lib/errors.ts";
 
 const SAVE_DEBOUNCE_MS = 400;
 

client/ui/frontend/src/modules/settings/SettingsProfiles.tsx

@@ -13,6 +13,7 @@ import i18next from "@/lib/i18n";
 import { useProfile } from "@/modules/profile/ProfileContext";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 const DEFAULT_PROFILE = "default";
 
@@ -45,7 +46,7 @@ export function SettingsProfiles() {
         } catch (e) {
             await Dialogs.Error({
                 Title: title,
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);
@@ -90,7 +91,7 @@ export function SettingsProfiles() {
         } catch (e) {
             await Dialogs.Error({
                 Title: i18next.t("profile.error.createTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         }
     };

client/ui/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/wailsapp/wails/v3/pkg/events"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
+	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
 	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
@@ -60,6 +61,7 @@ func init() {
 	application.RegisterEvent[services.Status](services.EventStatus)
 	application.RegisterEvent[services.SystemEvent](services.EventSystem)
 	application.RegisterEvent[services.ProfileRef](services.EventProfileChanged)
+	application.RegisterEvent[authsession.Warning](services.EventSessionWarning)
 	application.RegisterEvent[updater.State](updater.EventStateChanged)
 	application.RegisterEvent[preferences.UIPreferences](preferences.EventPreferencesChanged)
 }
@@ -121,7 +123,6 @@ func main() {
 		},
 	})
 
-	connection := services.NewConnection(conn)
 	settings := services.NewSettings(conn)
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State. Peers feeds the daemon
@@ -131,7 +132,6 @@ func main() {
 	update := services.NewUpdate(conn, updaterHolder)
 	peers := services.NewPeers(conn, app.Event, updaterHolder)
 	notifier := notifications.New()
-	profileSwitcher := services.NewProfileSwitcher(profiles, connection, peers)
 
 	// localesFS reroots the embedded tree at the locales directory itself
 	// so the bundle sees _index.json and <lang>/common.json at the top
@@ -154,7 +154,18 @@ func main() {
 	}
 	localizer := NewLocalizer(bundle, prefStore)
 
+	// Connection lives after bundle + prefStore so it can localise daemon
+	// errors (services.NewConnection takes both as dependencies).
+	connection := services.NewConnection(conn, bundle, prefStore)
+	profileSwitcher := services.NewProfileSwitcher(profiles, connection, peers)
+
 	app.RegisterService(application.NewService(connection))
+	// authsession.Session owns the full extend + dismiss surface; the tray
+	// drives the "Extend now" action from the T-10 OS notification through
+	// this directly. The Wails-bound services.Session wraps only the subset
+	// the React frontend calls, so the generated TS surface stays minimal.
+	authSession := authsession.NewSession(conn)
+	app.RegisterService(application.NewService(services.NewSession(authSession)))
 	app.RegisterService(application.NewService(settings))
 	app.RegisterService(application.NewService(services.NewNetworks(conn)))
 	app.RegisterService(application.NewService(services.NewForwarding(conn)))
@@ -215,6 +226,7 @@ func main() {
 		Update:          update,
 		ProfileSwitcher: profileSwitcher,
 		WindowManager:   windowManager,
+		Session:         authSession,
 		Localizer:       localizer,
 	})
 	listenForShowSignal(context.Background(), tray)

client/ui/services/connection.go

@@ -4,15 +4,143 @@ package services
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
+	"strings"
+
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
 )
 
+// ErrorTranslator is the subset of i18n.Bundle Connection needs to localise
+// daemon errors. Defined as an interface so tests can stub it; the runtime
+// implementation is *i18n.Bundle.
+type ErrorTranslator interface {
+	Translate(lang i18n.LanguageCode, key string, args ...string) string
+}
+
+// LanguagePreference is the subset of preferences.Store Connection needs
+// to discover the current UI language at error-classification time. The
+// runtime implementation is *preferences.Store.
+type LanguagePreference interface {
+	Get() preferences.UIPreferences
+}
+
+// ClientError is a structured error returned to the frontend.
+//
+// The daemon hands us gRPC errors whose Message is a stack of wrapped strings
+// from the management server and the underlying JWT library, for example:
+//
+//	"invalid jwt token, err: token could not be parsed: token has invalid
+//	 claims: token used before issued"
+//
+// Showing that raw message in a native dialog is unreadable, so we map the
+// substrings we recognise to a {code, short, long} triple. The frontend
+// translates Code through i18n (preferred); Short is an English fallback so
+// the dialog still reads cleanly if a code is missing from the locale; Long
+// always carries the unwrapped daemon message for the operator.
+type ClientError struct {
+	Code  string `json:"code"`
+	Short string `json:"short"`
+	Long  string `json:"long"`
+}
+
+// Error returns the user-facing short message so plain Go callers and the
+// Wails default error path still get a readable string.
+func (e *ClientError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return e.Short
+}
+
+// MarshalJSON encodes the full {code, short, long} triple so the Wails
+// binding emits a structured object instead of the default "error: ..."
+// string. The TS layer accesses these fields via try/catch.
+func (e *ClientError) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+	type alias ClientError
+	return json.Marshal((*alias)(e))
+}
+
+// classifyDaemonError turns a raw gRPC error from the daemon into a
+// ClientError with a stable code and a short localised summary. The Long
+// field always carries the unwrapped daemon message so the operator can
+// inspect the root cause when the short text is too generic. Short is
+// looked up via i18n under "error.<code>": i18n.Bundle.Translate already
+// handles current-language → English → key passthrough, so any missing
+// locale entry surfaces as a visible "error.<code>" string in the dialog —
+// a deliberate fail-loud signal that the bundle needs updating.
+func (s *Connection) classifyDaemonError(err error) *ClientError {
+	if err == nil {
+		return nil
+	}
+
+	msg := err.Error()
+	if st, ok := gstatus.FromError(err); ok {
+		msg = st.Message()
+	}
+	lower := strings.ToLower(msg)
+
+	code := "unknown"
+	switch {
+	case strings.Contains(lower, "token used before issued"),
+		strings.Contains(lower, "token is not valid yet"):
+		code = "jwt_clock_skew"
+	case strings.Contains(lower, "token is expired"),
+		strings.Contains(lower, "token has expired"):
+		code = "jwt_expired"
+	case strings.Contains(lower, "token signature is invalid"):
+		code = "jwt_signature_invalid"
+	case strings.Contains(lower, "peer login has expired"):
+		code = "session_expired"
+	case strings.Contains(lower, "invalid setup-key"),
+		strings.Contains(lower, "invalid setup key"):
+		code = "invalid_setup_key"
+	case strings.Contains(lower, "permission denied"):
+		code = "permission_denied"
+	case strings.Contains(lower, "no connection could be made"),
+		strings.Contains(lower, "connection refused"),
+		strings.Contains(lower, "context deadline exceeded"):
+		code = "daemon_unreachable"
+	}
+
+	return &ClientError{
+		Code:  code,
+		Short: s.translateShort(code),
+		Long:  msg,
+	}
+}
+
+// translateShort resolves the localised short message for code. The i18n
+// Bundle's own Translate already falls back current-language → English →
+// key passthrough, so callers either see the localised string or the bare
+// "error.<code>" key (which makes the missing translation obvious). If
+// the translator is nil — e.g. a Connection constructed in a unit test —
+// we return the key for the same reason.
+func (s *Connection) translateShort(code string) string {
+	key := "error." + code
+	if s.translator == nil {
+		return key
+	}
+	lang := i18n.DefaultLanguage
+	if s.prefs != nil {
+		if pref := s.prefs.Get().Language; pref != "" {
+			lang = pref
+		}
+	}
+	return s.translator.Translate(lang, key)
+}
+
 // LoginParams carries the fields the UI sets when starting a login.
 type LoginParams struct {
 	ProfileName   string `json:"profileName"`
@@ -52,11 +180,17 @@ type LogoutParams struct {
 
 // Connection groups the daemon RPCs that drive login / connect / disconnect.
 type Connection struct {
-	conn DaemonConn
+	conn       DaemonConn
+	translator ErrorTranslator
+	prefs      LanguagePreference
 }
 
-func NewConnection(conn DaemonConn) *Connection {
-	return &Connection{conn: conn}
+// NewConnection wires Connection with its translation dependencies. Either
+// translator or prefs may be nil; in that case classifyDaemonError falls
+// back to the English Short text baked into the error map. main.go always
+// supplies both at startup.
+func NewConnection(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference) *Connection {
+	return &Connection{conn: conn, translator: translator, prefs: prefs}
 }
 
 func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, error) {
@@ -117,7 +251,7 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 
 	resp, err := cli.Login(ctx, req)
 	if err != nil {
-		return LoginResult{}, err
+		return LoginResult{}, s.classifyDaemonError(err)
 	}
 	return LoginResult{
 		NeedsSSOLogin:           resp.GetNeedsSSOLogin(),
@@ -137,7 +271,7 @@ func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		Hostname: p.Hostname,
 	})
 	if err != nil {
-		return "", err
+		return "", s.classifyDaemonError(err)
 	}
 	return resp.GetEmail(), nil
 }
@@ -155,8 +289,10 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	if p.Username != "" {
 		req.Username = ptrStr(p.Username)
 	}
-	_, err = cli.Up(ctx, req)
-	return err
+	if _, err = cli.Up(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
 }
 
 func (s *Connection) Down(ctx context.Context) error {
@@ -164,8 +300,10 @@ func (s *Connection) Down(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	_, err = cli.Down(ctx, &proto.DownRequest{})
-	return err
+	if _, err = cli.Down(ctx, &proto.DownRequest{}); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
 }
 
 // OpenURL launches the user's preferred browser to display url. Mirrors the
@@ -201,6 +339,8 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	if p.Username != "" {
 		req.Username = ptrStr(p.Username)
 	}
-	_, err = cli.Logout(ctx, req)
-	return err
+	if _, err = cli.Logout(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
 }

client/ui/services/peers.go

@@ -15,6 +15,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/updater"
 )
 
@@ -34,6 +35,14 @@ const (
 	// others without polling. The daemon itself does not emit a profile
 	// event, so this is the only signal that closes the gap.
 	EventProfileChanged = "netbird:profile:changed"
+	// EventSessionWarning is emitted on every session-warning watcher
+	// fire (T-WarningLead and T-FinalWarningLead) as a strongly-typed
+	// sibling of EventSystem so React / tray subscribers don't have to
+	// filter the firehose of EventSystem. Consumers branch on the
+	// SessionWarning.Final flag to tell the interactive T-10 event apart
+	// from the fallback T-2 event; the dialog auto-open lives in the
+	// tray (Go side) so the frontend stays passive on this flow.
+	EventSessionWarning = "netbird:session:warning"
 
 	// StatusDaemonUnavailable is the synthetic Status the UI emits when the
 	// daemon's gRPC socket is unreachable (daemon not running, socket
@@ -43,11 +52,11 @@ const (
 
 	// Daemon connection status strings — mirror internal.Status* in
 	// client/internal/state.go.
-	StatusConnected     = "Connected"
-	StatusConnecting    = "Connecting"
-	StatusIdle          = "Idle"
-	StatusNeedsLogin    = "NeedsLogin"
-	StatusLoginFailed   = "LoginFailed"
+	StatusConnected      = "Connected"
+	StatusConnecting     = "Connecting"
+	StatusIdle           = "Idle"
+	StatusNeedsLogin     = "NeedsLogin"
+	StatusLoginFailed    = "LoginFailed"
 	StatusSessionExpired = "SessionExpired"
 )
 
@@ -110,13 +119,19 @@ type LocalPeer struct {
 
 // Status is the snapshot the frontend renders on the dashboard.
 type Status struct {
-	Status        string       `json:"status"`
-	DaemonVersion string       `json:"daemonVersion"`
-	Management    PeerLink     `json:"management"`
-	Signal        PeerLink     `json:"signal"`
-	Local         LocalPeer    `json:"local"`
-	Peers         []PeerStatus `json:"peers"`
+	Status        string        `json:"status"`
+	DaemonVersion string        `json:"daemonVersion"`
+	Management    PeerLink      `json:"management"`
+	Signal        PeerLink      `json:"signal"`
+	Local         LocalPeer     `json:"local"`
+	Peers         []PeerStatus  `json:"peers"`
 	Events        []SystemEvent `json:"events"`
+	// SessionExpiresAt is the absolute UTC instant at which the peer's
+	// SSO session expires. nil when the peer is not SSO-tracked or login
+	// expiration is disabled (either server-side off, or peer not
+	// SSO-registered). The UI derives "warning active" from this value
+	// plus its own clock.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
 }
 
 // Peers serves the dashboard data: one polled Status RPC and a long-running
@@ -277,23 +292,6 @@ func (s *Peers) Get(ctx context.Context) (Status, error) {
 	return statusFromProto(resp), nil
 }
 
-// isDaemonUnreachable reports whether a gRPC stream error indicates the
-// daemon socket itself is not answering (process down, socket missing,
-// permission denied) versus the daemon responding with an application-level
-// error code. Only the former should flip the tray to "Not running" — a
-// daemon that returns FailedPrecondition (e.g. while it's retrying the
-// management connection) is alive and shouldn't be reported as down.
-func isDaemonUnreachable(err error) bool {
-	if err == nil {
-		return false
-	}
-	st, ok := status.FromError(err)
-	if !ok {
-		return true
-	}
-	return st.Code() == codes.Unavailable
-}
-
 // statusStreamLoop subscribes to the daemon's SubscribeStatus stream and
 // re-emits each FullStatus snapshot on the Wails event bus. The first
 // message is the current snapshot; subsequent messages fire on
@@ -406,6 +404,9 @@ func (s *Peers) toastStreamLoop(ctx context.Context) {
 			se := systemEventFromProto(ev)
 			log.Infof("backend event: system severity=%s category=%s msg=%q", se.Severity, se.Category, se.UserMessage)
 			s.emitter.Emit(EventSystem, se)
+			if warn, ok := authsession.WarningFromMetadata(se.Metadata); ok {
+				s.emitter.Emit(EventSessionWarning, warn)
+			}
 			if s.updater != nil {
 				s.updater.OnSystemEvent(ev)
 			}
@@ -468,6 +469,10 @@ func statusFromProto(resp *proto.StatusResponse) Status {
 	for _, e := range full.GetEvents() {
 		st.Events = append(st.Events, systemEventFromProto(e))
 	}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		st.SessionExpiresAt = &t
+	}
 	return st
 }
 
@@ -488,3 +493,20 @@ func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
 	}
 	return out
 }
+
+// isDaemonUnreachable reports whether a gRPC stream error indicates the
+// daemon socket itself is not answering (process down, socket missing,
+// permission denied) versus the daemon responding with an application-level
+// error code. Only the former should flip the tray to "Not running" — a
+// daemon that returns FailedPrecondition (e.g. while it's retrying the
+// management connection) is alive and shouldn't be reported as down.
+func isDaemonUnreachable(err error) bool {
+	if err == nil {
+		return false
+	}
+	st, ok := status.FromError(err)
+	if !ok {
+		return true
+	}
+	return st.Code() == codes.Unavailable
+}

client/ui/services/session.go

@@ -0,0 +1,48 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+)
+
+// Re-exports so frontend bindings stay on services.ExtendStart* /
+// services.ExtendWait* / services.ExtendResult without each call site
+// importing authsession.
+type (
+	ExtendStartParams = authsession.ExtendStartParams
+	ExtendStartResult = authsession.ExtendStartResult
+	ExtendWaitParams  = authsession.ExtendWaitParams
+	ExtendResult      = authsession.ExtendResult
+)
+
+// Session is the Wails-bound wrapper around authsession.Session. It only
+// re-exposes the subset the React frontend actually calls
+// (SessionAboutToExpireDialog.tsx: RequestExtend + WaitExtend). The tray
+// uses authsession.Session directly, so methods that only the tray needs
+// (DismissWarning) are deliberately absent here — keeping the generated
+// TS surface minimal.
+type Session struct {
+	inner *authsession.Session
+}
+
+// NewSession returns the Wails-bound wrapper. The caller owns the inner
+// authsession.Session and may use it directly (e.g. the tray).
+func NewSession(inner *authsession.Session) *Session {
+	return &Session{inner: inner}
+}
+
+// RequestExtend starts the SSO session-extension flow on the daemon and
+// returns the verification URI for the UI to open.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	return s.inner.RequestExtend(ctx, p)
+}
+
+// WaitExtend blocks until the user completes the SSO flow started by
+// RequestExtend, then returns the new session deadline (or nil when the
+// management server reports the peer ineligible).
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	return s.inner.WaitExtend(ctx, p)
+}

client/ui/tray.go

@@ -9,12 +9,15 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
+	nbstatus "github.com/netbirdio/netbird/client/status"
+	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
@@ -34,13 +37,29 @@ const (
 	notifyIDEvent          = "netbird-event-"
 	notifyIDTrayError      = "netbird-tray-error"
 	notifyIDSessionExpired = "netbird-session-expired"
+	notifyIDSessionWarning = "netbird-session-warning"
+
+	// notifyCategorySessionWarning groups the "Extend now" / "Dismiss"
+	// actions on the T-10min OS notification. Registered once at tray
+	// construction with the Wails notifications service; subsequent
+	// SendNotificationWithActions calls reference it by ID.
+	notifyCategorySessionWarning = "netbird-session-warning"
+	notifyActionExtendNow        = "extend-now"
+	notifyActionDismiss          = "dismiss"
 
 	statusError = "Error"
 
 	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
 	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
+
+	// finalWarningCountdownSeconds is the countdown shown in the auto-opened
+	// SessionAboutToExpire dialog. Mirrors sessionwatch.FinalWarningLead
+	// (2 minutes); the values stay in sync by hand because the lead is fixed
+	// for the initial rollout.
+	finalWarningCountdownSeconds = 120
 )
 
+
 // Tray builds and updates the systray menu. It mirrors the layout of the Fyne
 // systray 1:1 and routes clicks back to the gRPC services. Dynamic state
 // (status icon, exit-node submenu) is driven by the netbird:status event.
@@ -57,6 +76,12 @@ type TrayServices struct {
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager
+	// Session drives the SSO session-extend flow invoked from the
+	// "Extend now" action on the T-10min OS notification, plus the
+	// Dismiss hand-off that suppresses the T-2 fallback dialog. Bound to
+	// the authsession package directly because the Wails wrapper in
+	// services only re-exposes the React-facing subset.
+	Session *authsession.Session
 	// Localizer is the tray's bridge to translations. Constructed in main
 	// from i18n.Bundle + preferences.Store; the Wails-bound facades
 	// (services.I18n, services.Preferences) are registered separately for
@@ -75,8 +100,14 @@ type Tray struct {
 	// language switch.
 	loc *Localizer
 
-	menu               *application.Menu
-	statusItem         *application.MenuItem
+	menu       *application.Menu
+	statusItem *application.MenuItem
+	// sessionExpiresItem displays the SSO session deadline as a humanised
+	// remaining-time label ("Session: 47m"). Hidden when no deadline is
+	// tracked (non-SSO peer or login-expiration disabled on the account).
+	// Refreshed by applyStatus on every Status push and by a 1-minute
+	// ticker between pushes so the countdown moves naturally.
+	sessionExpiresItem *application.MenuItem
 	upItem             *application.MenuItem
 	downItem           *application.MenuItem
 	exitNodeItem       *application.MenuItem
@@ -99,6 +130,16 @@ type Tray struct {
 	activeProfile        string
 	activeUsername       string
 	switchCancel         context.CancelFunc
+	// sessionExpiresAt is the most recent deadline observed on a Status
+	// snapshot. Used to skip a no-op label rewrite when the daemon repeats
+	// the same value across rapid pushes. Guarded by mu.
+	sessionExpiresAt time.Time
+	// pendingConnectLogin is set when handleConnect kicks off an Up on an
+	// idle daemon. The daemon will flip to NeedsLogin if the peer is
+	// SSO-tracked and has no cached token; applyStatus consumes this flag
+	// on that transition to automatically open the browser-login flow,
+	// saving the user a second Connect click. Guarded by mu.
+	pendingConnectLogin bool
 
 	// profileLoadMu serializes loadProfiles so the daemon-status-driven
 	// refresh in applyStatus cannot race with the ApplicationStarted seed
@@ -151,6 +192,14 @@ func NewTray(app *application.App, window *application.WebviewWindow, svc TraySe
 	// nil-deref).
 	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
 		go t.loadProfiles()
+		// Notification-category registration must run after the Wails
+		// notifications service Startup has populated wn.appName /
+		// registry path on Windows; before app.Run() the category lookup
+		// in SendNotificationWithActions silently falls back to a
+		// gomb-nélküli notification (the Windows impl logs "Category not
+		// found"). The macOS/Linux impls don't strictly require this
+		// ordering, but running here is harmless for them.
+		t.registerSessionWarningCategory()
 	})
 
 	// Localizer fires this callback after it has already swapped its own
@@ -185,6 +234,7 @@ func (t *Tray) reapplyMenuState() {
 	lastStatus := t.lastStatus
 	daemonVersion := t.lastDaemonVersion
 	exitNodes := append([]string(nil), t.exitNodes...)
+	sessionDeadline := t.sessionExpiresAt
 	t.mu.Unlock()
 
 	daemonUnavailable := strings.EqualFold(lastStatus, services.StatusDaemonUnavailable)
@@ -195,6 +245,15 @@ func (t *Tray) reapplyMenuState() {
 		t.statusItem.SetEnabled(false)
 		t.applyStatusIndicator(lastStatus)
 	}
+	if t.sessionExpiresItem != nil {
+		if sessionDeadline.IsZero() {
+			t.sessionExpiresItem.SetHidden(true)
+		} else {
+			remaining := nbstatus.FormatRemainingDuration(time.Until(sessionDeadline))
+			t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+			t.sessionExpiresItem.SetHidden(false)
+		}
+	}
 	if t.upItem != nil {
 		t.upItem.SetHidden(connected || connecting || daemonUnavailable)
 		t.upItem.SetEnabled(!connected && !connecting && !daemonUnavailable)
@@ -264,6 +323,14 @@ func (t *Tray) buildMenu() *application.Menu {
 		SetEnabled(false).
 		SetBitmap(iconMenuDotIdle)
 
+	// sessionExpiresItem sits directly below the status row so the
+	// remaining-time label reads as a sub-line of "Connected" etc. Hidden
+	// until applyStatus sees a non-zero SessionExpiresAt on the daemon
+	// Status snapshot — peers without SSO tracking or with login expiry
+	// disabled never reveal this row.
+	t.sessionExpiresItem = menu.Add("").SetEnabled(false)
+	t.sessionExpiresItem.SetHidden(true)
+
 	menu.AddSeparator()
 	// The tray icon's left-click handler is intentionally unbound (see
 	// NewTray for the rationale), so expose the window through an explicit
@@ -362,12 +429,25 @@ func (t *Tray) handleConnect() {
 		return
 	}
 	t.upItem.SetEnabled(false)
+	// Arm the SSO auto-handoff: Up() is async and the daemon may flip to
+	// NeedsLogin once it detects an SSO peer with no cached token. The
+	// flag is consumed by applyStatus on that transition, which then
+	// triggers the browser-login flow without the user having to click
+	// Connect a second time. Cleared on any terminal state (Connected /
+	// Idle / LoginFailed / DaemonUnavailable / SessionExpired) so a stale
+	// flag can't hijack a future status push.
+	t.mu.Lock()
+	t.pendingConnectLogin = true
+	t.mu.Unlock()
 	go func() {
 		ctx, cancel := context.WithCancel(context.Background())
 		defer cancel()
 		if err := t.svc.Connection.Up(ctx, services.UpParams{}); err != nil {
 			log.Errorf("connect: %v", err)
 			t.notifyError(t.loc.T("notify.error.connect"))
+			t.mu.Lock()
+			t.pendingConnectLogin = false
+			t.mu.Unlock()
 			t.upItem.SetEnabled(true)
 		}
 	}()
@@ -414,7 +494,14 @@ func (t *Tray) onStatusEvent(ev *application.CustomEvent) {
 // its own richer notification when EventUpdateState fires.
 func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	se, ok := ev.Data.(services.SystemEvent)
-	if !ok || se.UserMessage == "" {
+	if !ok {
+		return
+	}
+	// Session-warning events carry no UserMessage — the tray builds the
+	// localised notification body locally from metadata. Every other
+	// event needs a non-empty UserMessage to show anything meaningful.
+	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
+	if !isSessionWarning && se.UserMessage == "" {
 		return
 	}
 	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
@@ -438,6 +525,29 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		return
 	}
 
+	// Session-warning events come in two flavours; detect via the stable
+	// metadata flags rather than category/severity so a future reword on
+	// the daemon side still routes here.
+	//   - T-WarningLead (MetaSessionWarning + no MetaSessionFinal) →
+	//     interactive "Extend now / Dismiss" OS notification. Title and
+	//     body are built locally from i18n + metadata so the text follows
+	//     the active UI language regardless of what the daemon (which has
+	//     no locale context) writes into UserMessage.
+	//   - T-FinalWarningLead (MetaSessionFinal=true) → auto-open the
+	//     SessionAboutToExpire dialog. No OS notification here; the
+	//     dialog is the last-chance reminder, doubling up would be noise.
+	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+		if se.Metadata[authsession.MetaFinal] == "true" {
+			t.openSessionAboutToExpire()
+			return
+		}
+		t.notifySessionWarning(
+			t.loc.T("notify.sessionWarning.title"),
+			t.buildSessionWarningBody(se.Metadata),
+		)
+		return
+	}
+
 	body := se.UserMessage
 	if id := se.Metadata["id"]; id != "" {
 		body += fmt.Sprintf(" ID: %s", id)
@@ -467,6 +577,28 @@ func (t *Tray) applyStatus(st services.Status) {
 	// flag in onSessionExpire.
 	sessionExpiredEnter := strings.EqualFold(st.Status, services.StatusSessionExpired) &&
 		!strings.EqualFold(t.lastStatus, services.StatusSessionExpired)
+
+	// Consume the SSO auto-handoff flag armed by handleConnect. Trigger
+	// the browser-login flow on a Connect → NeedsLogin transition so the
+	// user doesn't need to click Connect a second time. Clear it on any
+	// other terminal state — including Connecting bursts that resolve to
+	// Connected / Idle / LoginFailed / DaemonUnavailable — so a stale
+	// flag can't fire weeks later when the daemon happens to flip.
+	triggerLogin := false
+	if t.pendingConnectLogin {
+		switch {
+		case strings.EqualFold(st.Status, services.StatusNeedsLogin):
+			triggerLogin = true
+			t.pendingConnectLogin = false
+		case strings.EqualFold(st.Status, services.StatusConnected),
+			strings.EqualFold(st.Status, services.StatusIdle),
+			strings.EqualFold(st.Status, services.StatusLoginFailed),
+			strings.EqualFold(st.Status, services.StatusSessionExpired),
+			strings.EqualFold(st.Status, services.StatusDaemonUnavailable):
+			t.pendingConnectLogin = false
+		}
+	}
+
 	daemonVersionChanged := st.DaemonVersion != "" && st.DaemonVersion != t.lastDaemonVersion
 	t.connected = connected
 	t.lastStatus = st.Status
@@ -479,6 +611,11 @@ func (t *Tray) applyStatus(st services.Status) {
 	t.exitNodes = exitNodes
 	t.mu.Unlock()
 
+	if triggerLogin {
+		t.ShowWindow()
+		t.app.Event.Emit(services.EventTriggerLogin)
+	}
+
 	if iconChanged {
 		t.applyIcon()
 		daemonUnavailable := strings.EqualFold(st.Status, services.StatusDaemonUnavailable)
@@ -547,6 +684,8 @@ func (t *Tray) applyStatus(st services.Status) {
 	if sessionExpiredEnter {
 		t.handleSessionExpired()
 	}
+
+	t.applySessionExpiry(st.SessionExpiresAt, connected)
 }
 
 // handleSessionExpired surfaces the SSO re-authentication path when the
@@ -849,6 +988,40 @@ func (t *Tray) switchProfile(name string) {
 	}()
 }
 
+// applySessionExpiry refreshes the "Session: 47m" tray row from the latest
+// Status snapshot's SessionExpiresAt. Only shown when the tunnel is up:
+// in any other state (Idle after a Down, Connecting, NeedsLogin,
+// SessionExpired, LoginFailed, DaemonUnavailable, or mid profile-switch)
+// the deadline is meaningless and the row is hidden. The internal
+// sessionExpiresAt cache is cleared in the same path so reapplyMenuState
+// after a language switch doesn't resurrect a stale label.
+//
+// No per-minute ticker: between Status pushes the label may drift by a
+// few minutes, which is fine for a tray-menu status row that the user
+// opens on demand. The T-10min OS notification (driven by the daemon's
+// sessionwatch) does the time-critical signalling.
+func (t *Tray) applySessionExpiry(deadline *time.Time, connected bool) {
+	var d time.Time
+	if connected && deadline != nil {
+		d = *deadline
+	}
+
+	t.mu.Lock()
+	t.sessionExpiresAt = d
+	t.mu.Unlock()
+
+	if t.sessionExpiresItem == nil {
+		return
+	}
+	if d.IsZero() {
+		t.sessionExpiresItem.SetHidden(true)
+		return
+	}
+	remaining := nbstatus.FormatRemainingDuration(time.Until(d))
+	t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+	t.sessionExpiresItem.SetHidden(false)
+}
+
 // notify wraps the Wails notification service with the tray's standard
 // id-prefix scheme and swallows errors (notifications are best-effort).
 func (t *Tray) notify(title, body, id string) {
@@ -864,6 +1037,166 @@ func (t *Tray) notify(title, body, id string) {
 	}
 }
 
+// registerSessionWarningCategory wires the OS notification category for the
+// T-10min SSO expiry warning. The category carries two actions ("Extend now"
+// and "Dismiss") and the global response handler so a click resolves back
+// into runExtendSession. Idempotent — called once from NewTray; errors are
+// logged and swallowed because the worst case is a plain text notification
+// without buttons.
+func (t *Tray) registerSessionWarningCategory() {
+	if t.svc.Notifier == nil {
+		return
+	}
+	if err := t.svc.Notifier.RegisterNotificationCategory(notifications.NotificationCategory{
+		ID: notifyCategorySessionWarning,
+		Actions: []notifications.NotificationAction{
+			{ID: notifyActionExtendNow, Title: t.loc.T("notify.sessionWarning.extend")},
+			{ID: notifyActionDismiss, Title: t.loc.T("notify.sessionWarning.dismiss")},
+		},
+	}); err != nil {
+		log.Debugf("register session-warning notification category: %v", err)
+	}
+	t.svc.Notifier.OnNotificationResponse(func(result notifications.NotificationResult) {
+		if result.Error != nil {
+			log.Debugf("notification response error: %v", result.Error)
+			return
+		}
+		if result.Response.CategoryID != notifyCategorySessionWarning {
+			return
+		}
+		switch result.Response.ActionIdentifier {
+		case notifyActionExtendNow, notifications.DefaultActionIdentifier:
+			// DefaultActionIdentifier covers the body-click on platforms
+			// that don't expose buttons separately (e.g. some minimal
+			// Linux notification daemons fall back to a single click
+			// area). Treat it as Extend so the user always has a path.
+			go t.runExtendSession()
+		case notifyActionDismiss:
+			// Explicit user opt-out. Tell the daemon so the
+			// T-FinalWarningLead fallback dialog stays closed for this
+			// deadline; the regular watcher remains armed for the next
+			// deadline value (e.g. after a successful extend elsewhere).
+			go t.dismissSessionWarning()
+		}
+	})
+}
+
+// buildSessionWarningBody composes the localised body for the T-10min
+// notification from the daemon's metadata. The daemon does not have a
+// locale, so it ships a stable RFC3339 deadline ("session_expires_at")
+// and integer lead time ("lead_minutes") in metadata; the tray turns
+// them into a user-language sentence via the active i18n bundle.
+//
+// Falls back to a constant string when the metadata is missing or the
+// timestamp fails to parse — the user still sees the warning, just
+// without the remaining-time count.
+func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
+	if meta == nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	raw := meta[authsession.MetaExpiresAt]
+	if raw == "" {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	deadline, err := authsession.ParseExpiresAt(raw)
+	if err != nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
+	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
+}
+
+// notifySessionWarning sends the interactive T-10min OS notification. Falls
+// back to the plain `notify` helper if the Wails service doesn't expose the
+// with-actions variant (older platform impls, or a bare Notifier in tests).
+func (t *Tray) notifySessionWarning(title, body string) {
+	if t.svc.Notifier == nil {
+		return
+	}
+	err := t.svc.Notifier.SendNotificationWithActions(notifications.NotificationOptions{
+		ID:         notifyIDSessionWarning,
+		Title:      title,
+		Body:       body,
+		CategoryID: notifyCategorySessionWarning,
+	})
+	if err != nil {
+		log.Debugf("notify session-warning with actions: %v", err)
+		// Fall back to a plain notification so the user at least gets
+		// the warning text, even without buttons.
+		t.notify(title, body, notifyIDSessionWarning)
+	}
+}
+
+// runExtendSession drives the daemon's RequestExtendAuthSession +
+// WaitExtendAuthSession pair when the user clicks "Extend now" on the
+// session-warning notification. Mirrors `doExtendSession` in
+// client/cmd/login.go but talks to the in-process Wails Session service
+// instead of opening a daemon gRPC channel from a CLI process. The
+// browser is opened via Connection.OpenURL (which honours $BROWSER on
+// Unix). Errors surface as plain notifyError calls — there is no foreground
+// UI flow here because the warning may fire while the main window is
+// closed.
+func (t *Tray) runExtendSession() {
+	if t.svc.Session == nil || t.svc.Connection == nil {
+		log.Debugf("session-warning: extend requested but services not wired")
+		return
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	start, err := t.svc.Session.RequestExtend(ctx, services.ExtendStartParams{})
+	if err != nil {
+		log.Warnf("session-warning: RequestExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+
+	uri := start.VerificationURIComplete
+	if uri == "" {
+		uri = start.VerificationURI
+	}
+	if uri != "" {
+		if err := t.svc.Connection.OpenURL(uri); err != nil {
+			log.Debugf("session-warning: opening verification URL: %v", err)
+		}
+	}
+
+	if _, err := t.svc.Session.WaitExtend(ctx, services.ExtendWaitParams{
+		DeviceCode: start.DeviceCode,
+		UserCode:   start.UserCode,
+	}); err != nil {
+		log.Warnf("session-warning: WaitExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+	t.notify(t.loc.T("notify.sessionWarning.successTitle"), t.loc.T("notify.sessionWarning.successBody"), notifyIDSessionWarning)
+}
+
+// dismissSessionWarning tells the daemon to silence the T-FinalWarningLead
+// fallback dialog for the current deadline. Best-effort: a failure only
+// means the dialog will still appear, so we log and move on.
+func (t *Tray) dismissSessionWarning() {
+	if t.svc.Session == nil {
+		return
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := t.svc.Session.DismissWarning(ctx); err != nil {
+		log.Debugf("session-warning: DismissWarning failed: %v", err)
+	}
+}
+
+// openSessionAboutToExpire fires the auto-opened fallback dialog at
+// T-FinalWarningLead when the user did not dismiss the earlier T-10
+// notification. Idempotent on the WindowManager side (a second call
+// while the window is already open is a no-op).
+func (t *Tray) openSessionAboutToExpire() {
+	if t.svc.WindowManager == nil {
+		return
+	}
+	t.svc.WindowManager.OpenSessionAboutToExpire(finalWarningCountdownSeconds)
+}
+
 // notifyError fires a generic "Error" notification for tray-driven action
 // failures. Each tray click site already logs the underlying error; this
 // adds the user-visible toast.

client/ui/xembed_host_linux.go

@@ -3,7 +3,7 @@
 package main
 
 /*
-#cgo pkg-config: x11 gtk+-3.0 cairo cairo-xlib
+#cgo pkg-config: x11 gtk4 gtk4-x11 cairo cairo-xlib
 #cgo LDFLAGS: -lX11
 #include "xembed_tray_linux.h"
 #include <X11/Xlib.h>

client/ui/xembed_tray_linux.c

@@ -5,6 +5,7 @@
 #include <cairo/cairo-xlib.h>
 #include <cairo/cairo.h>
 #include <gtk/gtk.h>
+#include <gdk/x11/gdkx.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -241,7 +242,7 @@ int xembed_poll_event(Display *dpy, Window icon_win,
     return 0;
 }
 
-/* --- GTK3 popup window menu support --- */
+/* --- GTK4 popup window menu support --- */
 
 /* Implemented in Go via //export */
 extern void goMenuItemClicked(int id);
@@ -274,18 +275,19 @@ static void free_popup_data(popup_data *pd) {
     free(pd);
 }
 
+
 /* Close every popup window — top-level plus any open submenus.
    Called when the user clicks an actionable item or focus leaves the
-   top-level window. */
+   menu tree. */
 static void close_all_popups(void) {
     for (GList *l = submenu_popups; l; l = l->next) {
-        gtk_widget_destroy(GTK_WIDGET(l->data));
+        gtk_window_destroy(GTK_WINDOW(l->data));
     }
     g_list_free(submenu_popups);
     submenu_popups = NULL;
 
     if (popup_win) {
-        gtk_widget_hide(popup_win);
+        gtk_widget_set_visible(popup_win, FALSE);
     }
 }
 
@@ -296,24 +298,26 @@ static void on_button_clicked(GtkButton *btn, gpointer user_data) {
     goMenuItemClicked(id);
 }
 
-static void on_check_toggled(GtkToggleButton *btn, gpointer user_data) {
+static void on_check_toggled(GtkCheckButton *btn, gpointer user_data) {
     (void)btn;
     int id = GPOINTER_TO_INT(user_data);
     close_all_popups();
     goMenuItemClicked(id);
 }
 
-/* When any popup loses focus we want to close the entire popup tree —
-   unless focus moved to another window we own (e.g. opening a submenu).
-   focus-out fires before the corresponding focus-in on the new window,
-   so we defer the check to an idle callback: by then any sibling popup
-   has had a chance to grab focus. If none of our windows still has
-   toplevel focus, the user clicked outside the menu tree → tear down. */
+/* The popup is a regular WM-managed window (not override-redirect),
+   so the WM hands keyboard focus to it on map. When focus moves
+   elsewhere — the user clicked somewhere else, switched apps, etc. —
+   the focus controller's "leave" signal fires and we tear down the
+   menu tree. Submenus open from inside the top-level popup, so we
+   defer the actual close to an idle callback: that gives the new
+   submenu a chance to take focus first, and we only close if none of
+   our windows still has it. */
 static gboolean any_popup_has_focus(void) {
-    if (popup_win && gtk_window_has_toplevel_focus(GTK_WINDOW(popup_win)))
+    if (popup_win && gtk_window_is_active(GTK_WINDOW(popup_win)))
         return TRUE;
     for (GList *l = submenu_popups; l; l = l->next) {
-        if (gtk_window_has_toplevel_focus(GTK_WINDOW(l->data)))
+        if (gtk_window_is_active(GTK_WINDOW(l->data)))
             return TRUE;
     }
     return FALSE;
@@ -321,17 +325,90 @@ static gboolean any_popup_has_focus(void) {
 
 static gboolean focus_out_recheck(gpointer user_data) {
     (void)user_data;
-    if (!any_popup_has_focus()) {
+    if (!any_popup_has_focus())
         close_all_popups();
-    }
     return G_SOURCE_REMOVE;
 }
 
-static gboolean on_popup_focus_out(GtkWidget *widget, GdkEvent *event,
-                                    gpointer user_data) {
-    (void)widget; (void)event; (void)user_data;
+static void on_popup_focus_leave(GtkEventControllerFocus *ctrl,
+                                  gpointer user_data) {
+    (void)ctrl; (void)user_data;
     g_idle_add(focus_out_recheck, NULL);
-    return FALSE;
+}
+
+/* Attach a focus controller that fires close_all_popups on focus loss. */
+static void attach_outside_click_close(GtkWidget *win) {
+    GtkEventController *focus = gtk_event_controller_focus_new();
+    g_signal_connect(focus, "leave",
+                     G_CALLBACK(on_popup_focus_leave), NULL);
+    gtk_widget_add_controller(win, focus);
+}
+
+/* Move a GtkWindow at the X11 level. GTK4 removed gtk_window_move(); the
+   GdkSurface is mapped to a real X11 Window we can reposition with
+   XMoveWindow. Must be called after the window has been realized (i.e.
+   after gtk_widget_set_visible TRUE).
+
+   The popup is **not** override-redirect — the WM keeps managing it so
+   focus tracking still works (focus-out fires when the user clicks
+   elsewhere). We tag the window with a stack of EWMH hints that make
+   sane WMs (fluxbox, openbox, i3, kwin, mutter) render it like a
+   floating menu: above the tray panel, skipped from taskbar/pager,
+   no decorations. */
+static void x11_move_window(GtkWidget *win, int x, int y) {
+    GdkSurface *surface = gtk_native_get_surface(GTK_NATIVE(win));
+    if (!surface || !GDK_IS_X11_SURFACE(surface))
+        return;
+    Window xid = gdk_x11_surface_get_xid(surface);
+    GdkDisplay *display = gdk_surface_get_display(surface);
+    Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+
+    /* _NET_WM_WINDOW_TYPE_POPUP_MENU: makes fluxbox / openbox / etc
+       render the window above panels and skip decorations. Must be
+       set before the window is mapped to be honoured by some WMs;
+       on already-mapped windows it works for most modern WMs but a
+       few need an unmap/map cycle to re-read the property. */
+    Atom wm_type        = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE", False);
+    Atom wm_type_popup  = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE_POPUP_MENU", False);
+    XChangeProperty(xdpy, xid, wm_type, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)&wm_type_popup, 1);
+
+    /* _NET_WM_STATE_ABOVE + SKIP_TASKBAR + SKIP_PAGER. Bundled into
+       one property write. */
+    Atom wm_state       = XInternAtom(xdpy, "_NET_WM_STATE", False);
+    Atom state_above    = XInternAtom(xdpy, "_NET_WM_STATE_ABOVE", False);
+    Atom state_skip_tb  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_TASKBAR", False);
+    Atom state_skip_pg  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_PAGER", False);
+    Atom states[3] = { state_above, state_skip_tb, state_skip_pg };
+    XChangeProperty(xdpy, xid, wm_state, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)states, 3);
+
+    XMoveWindow(xdpy, xid, x, y);
+    XRaiseWindow(xdpy, xid);
+
+    /* POPUP_MENU windows aren't given keyboard focus by most WMs (the
+       spec says they're "menus", which traditionally use a grab rather
+       than focus). Without focus GtkEventControllerFocus's leave signal
+       never fires, so we'd have no way to notice the user clicking
+       elsewhere. Ask the WM to activate us via _NET_ACTIVE_WINDOW
+       (source=2 means "pager / pseudo-user request" which most WMs
+       honour without timestamp checks). This is safer than calling
+       XSetInputFocus directly — that races the X server with the
+       not-yet-fully-mapped window and trips BadMatch. */
+    Atom net_active = XInternAtom(xdpy, "_NET_ACTIVE_WINDOW", False);
+    XClientMessageEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.type         = ClientMessage;
+    ev.window       = xid;
+    ev.message_type = net_active;
+    ev.format       = 32;
+    ev.data.l[0]    = 2;            /* source: pager */
+    ev.data.l[1]    = CurrentTime;
+    XSendEvent(xdpy, DefaultRootWindow(xdpy), False,
+               SubstructureRedirectMask | SubstructureNotifyMask,
+               (XEvent *)&ev);
+
+    XFlush(xdpy);
 }
 
 /* Forward declaration — submenu buttons need to schedule a child popup. */
@@ -346,55 +423,81 @@ typedef struct {
 static void on_submenu_button_clicked(GtkButton *btn, gpointer user_data) {
     submenu_open_data *sd = (submenu_open_data *)user_data;
 
-    GtkWidget *win = gtk_window_new(GTK_WINDOW_TOPLEVEL);
-    gtk_window_set_type_hint(GTK_WINDOW(win), GDK_WINDOW_TYPE_HINT_POPUP_MENU);
+    GtkWidget *win = gtk_window_new();
     gtk_window_set_decorated(GTK_WINDOW(win), FALSE);
     gtk_window_set_resizable(GTK_WINDOW(win), FALSE);
-    gtk_window_set_skip_taskbar_hint(GTK_WINDOW(win), TRUE);
-    gtk_window_set_skip_pager_hint(GTK_WINDOW(win), TRUE);
-    gtk_window_set_keep_above(GTK_WINDOW(win), TRUE);
 
-    g_signal_connect(win, "focus-out-event",
-                     G_CALLBACK(on_popup_focus_out), NULL);
+    attach_outside_click_close(win);
 
     GtkWidget *vbox = build_menu_box(sd->items, sd->count);
-    gtk_container_add(GTK_CONTAINER(win), vbox);
+    gtk_window_set_child(GTK_WINDOW(win), vbox);
 
-    /* GtkButton has no native GdkWindow of its own — gtk_widget_get_window
-       returns the parent popup's window. To get the button's screen-space
-       position we read the popup origin (ox, oy) and add the button's
-       allocation within the popup. */
-    gint ox, oy;
-    gdk_window_get_origin(gtk_widget_get_window(GTK_WIDGET(btn)), &ox, &oy);
-    GtkAllocation alloc;
-    gtk_widget_get_allocation(GTK_WIDGET(btn), &alloc);
-    int ax = ox + alloc.x;
-    int ay = oy + alloc.y;
+    /* Need the anchor button's position in root coordinates. GTK4
+       removed gtk_widget_translate_coordinates(); compute via the
+       button's bounds within its native widget plus the native
+       surface's screen origin via X11. */
+    graphene_rect_t bounds;
+    if (!gtk_widget_compute_bounds(GTK_WIDGET(btn),
+                                   GTK_WIDGET(gtk_widget_get_native(GTK_WIDGET(btn))),
+                                   &bounds)) {
+        bounds.origin.x = 0;
+        bounds.origin.y = 0;
+        bounds.size.width = 0;
+        bounds.size.height = 0;
+    }
+    GdkSurface *anchor_surface =
+        gtk_native_get_surface(gtk_widget_get_native(GTK_WIDGET(btn)));
+    int ox = 0, oy = 0;
+    if (anchor_surface && GDK_IS_X11_SURFACE(anchor_surface)) {
+        Window axid = gdk_x11_surface_get_xid(anchor_surface);
+        GdkDisplay *display = gdk_surface_get_display(anchor_surface);
+        Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+        Window child;
+        XTranslateCoordinates(xdpy, axid, DefaultRootWindow(xdpy),
+                              0, 0, &ox, &oy, &child);
+    }
+    int ax = ox + (int)bounds.origin.x;
+    int ay = oy + (int)bounds.origin.y;
 
-    gtk_widget_show_all(win);
-    gint sw, sh;
-    gtk_window_get_size(GTK_WINDOW(win), &sw, &sh);
+    gtk_widget_set_visible(win, TRUE);
+
+    int sw, sh;
+    gtk_window_get_default_size(GTK_WINDOW(win), &sw, &sh);
+    if (sw <= 0 || sh <= 0) {
+        /* default_size returns -1,-1 if never explicitly set; fall back
+           to the measured preferred size. */
+        GtkRequisition req;
+        gtk_widget_get_preferred_size(win, NULL, &req);
+        sw = req.width;
+        sh = req.height;
+    }
 
     /* The parent popup grows upward from the tray, so submenu items
        sit closer to the bottom of the screen than to the top. Align
        the submenu's BOTTOM to the anchor button's bottom: the popup
-       grows upward, level with the row that opened it. Don't clamp
-       to the monitor top — that would re-position the submenu next
-       to an unrelated sibling row above the anchor. */
-    int final_x = ax + alloc.width;
-    int final_y = ay + alloc.height - sh;
+       grows upward, level with the row that opened it. */
+    int final_x = ax + (int)bounds.size.width;
+    int final_y = ay + (int)bounds.size.height - sh;
 
     /* Horizontal flip against the monitor under the anchor button. */
     GdkDisplay *display = gtk_widget_get_display(win);
-    GdkMonitor *monitor = gdk_display_get_monitor_at_point(display, ax, ay);
-    if (monitor) {
+    GListModel *monitors = gdk_display_get_monitors(display);
+    guint n = g_list_model_get_n_items(monitors);
+    for (guint i = 0; i < n; i++) {
+        GdkMonitor *m = (GdkMonitor *)g_list_model_get_item(monitors, i);
         GdkRectangle geom;
-        gdk_monitor_get_geometry(monitor, &geom);
-        if (final_x + sw > geom.x + geom.width)
-            final_x = ax - sw;                        /* flip to the left */
+        gdk_monitor_get_geometry(m, &geom);
+        if (ax >= geom.x && ax < geom.x + geom.width &&
+            ay >= geom.y && ay < geom.y + geom.height) {
+            if (final_x + sw > geom.x + geom.width)
+                final_x = ax - sw;          /* flip to the left */
+            g_object_unref(m);
+            break;
+        }
+        g_object_unref(m);
     }
 
-    gtk_window_move(GTK_WINDOW(win), final_x, final_y);
+    x11_move_window(win, final_x, final_y);
     gtk_window_present(GTK_WINDOW(win));
 
     submenu_popups = g_list_prepend(submenu_popups, win);
@@ -402,8 +505,7 @@ static void on_submenu_button_clicked(GtkButton *btn, gpointer user_data) {
 
 /* Build a vbox of GtkWidgets for the supplied items. Used for both the
    top-level popup and each submenu popup. The submenu_open_data attached
-   to submenu buttons is freed when the submenu_popups list is cleared
-   (we use the button's "destroy" signal). */
+   to submenu buttons is freed when the button is destroyed. */
 static void on_button_destroy_free_data(GtkWidget *widget, gpointer user_data) {
     (void)widget;
     free(user_data);
@@ -417,19 +519,21 @@ static GtkWidget *build_menu_box(xembed_menu_item *items, int count) {
 
         if (mi->is_separator) {
             GtkWidget *sep = gtk_separator_new(GTK_ORIENTATION_HORIZONTAL);
-            gtk_box_pack_start(GTK_BOX(vbox), sep, FALSE, FALSE, 2);
+            gtk_widget_set_margin_top(sep, 2);
+            gtk_widget_set_margin_bottom(sep, 2);
+            gtk_box_append(GTK_BOX(vbox), sep);
             continue;
         }
 
         if (mi->is_check) {
             GtkWidget *chk = gtk_check_button_new_with_label(
                 mi->label ? mi->label : "");
-            gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(chk), mi->checked);
+            gtk_check_button_set_active(GTK_CHECK_BUTTON(chk), mi->checked);
             gtk_widget_set_sensitive(chk, mi->enabled);
             g_signal_connect(chk, "toggled",
                              G_CALLBACK(on_check_toggled),
                              GINT_TO_POINTER(mi->id));
-            gtk_box_pack_start(GTK_BOX(vbox), chk, FALSE, FALSE, 0);
+            gtk_box_append(GTK_BOX(vbox), chk);
             continue;
         }
 
@@ -447,9 +551,10 @@ static GtkWidget *build_menu_box(xembed_menu_item *items, int count) {
 
         GtkWidget *btn = gtk_button_new_with_label(label_text);
         gtk_widget_set_sensitive(btn, mi->enabled);
-        gtk_button_set_relief(GTK_BUTTON(btn), GTK_RELIEF_NONE);
-        GtkWidget *lbl = gtk_bin_get_child(GTK_BIN(btn));
-        if (lbl) gtk_label_set_xalign(GTK_LABEL(lbl), 0.0);
+        gtk_button_set_has_frame(GTK_BUTTON(btn), FALSE);
+        GtkWidget *lbl = gtk_button_get_child(GTK_BUTTON(btn));
+        if (GTK_IS_LABEL(lbl))
+            gtk_label_set_xalign(GTK_LABEL(lbl), 0.0);
 
         free(display_label);
 
@@ -468,7 +573,7 @@ static GtkWidget *build_menu_box(xembed_menu_item *items, int count) {
                              G_CALLBACK(on_button_clicked),
                              GINT_TO_POINTER(mi->id));
         }
-        gtk_box_pack_start(GTK_BOX(vbox), btn, FALSE, FALSE, 0);
+        gtk_box_append(GTK_BOX(vbox), btn);
     }
 
     return vbox;
@@ -480,38 +585,35 @@ static gboolean popup_menu_idle(gpointer user_data) {
     /* Destroy old top-level (and orphan submenus) before rebuilding. */
     close_all_popups();
     if (popup_win) {
-        gtk_widget_destroy(popup_win);
+        gtk_window_destroy(GTK_WINDOW(popup_win));
         popup_win = NULL;
     }
 
-    popup_win = gtk_window_new(GTK_WINDOW_TOPLEVEL);
-    gtk_window_set_type_hint(GTK_WINDOW(popup_win),
-                             GDK_WINDOW_TYPE_HINT_POPUP_MENU);
+    popup_win = gtk_window_new();
     gtk_window_set_decorated(GTK_WINDOW(popup_win), FALSE);
     gtk_window_set_resizable(GTK_WINDOW(popup_win), FALSE);
-    gtk_window_set_skip_taskbar_hint(GTK_WINDOW(popup_win), TRUE);
-    gtk_window_set_skip_pager_hint(GTK_WINDOW(popup_win), TRUE);
-    gtk_window_set_keep_above(GTK_WINDOW(popup_win), TRUE);
 
-    /* Close on focus loss. */
-    g_signal_connect(popup_win, "focus-out-event",
-                     G_CALLBACK(on_popup_focus_out), NULL);
+    attach_outside_click_close(popup_win);
 
     GtkWidget *vbox = build_menu_box(pd->items, pd->count);
-    gtk_container_add(GTK_CONTAINER(popup_win), vbox);
+    gtk_window_set_child(GTK_WINDOW(popup_win), vbox);
 
-    gtk_widget_show_all(popup_win);
+    gtk_widget_set_visible(popup_win, TRUE);
+
+    /* Position the window above the click point (menu grows upward
+       from tray). Use measured preferred size — default_size is -1
+       until set. */
+    GtkRequisition req;
+    gtk_widget_get_preferred_size(popup_win, NULL, &req);
+    int win_w = req.width;
+    int win_h = req.height;
 
-    /* Position the window above the click point (menu grows upward from tray). */
-    gint win_w, win_h;
-    gtk_window_get_size(GTK_WINDOW(popup_win), &win_w, &win_h);
     int final_x = pd->x - win_w / 2;
     int final_y = pd->y - win_h;
     if (final_x < 0) final_x = 0;
     if (final_y < 0) final_y = pd->y;  /* fallback: below click */
-    gtk_window_move(GTK_WINDOW(popup_win), final_x, final_y);
+    x11_move_window(popup_win, final_x, final_y);
 
-    /* Grab focus so focus-out-event works. */
     gtk_window_present(GTK_WINDOW(popup_win));
 
     /* The vbox+children retain pointers into pd->items (via submenu

go.mod

@@ -103,7 +103,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-alpha.94
+	github.com/wailsapp/wails/v3 v3.0.0-alpha.95
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -191,7 +191,7 @@ require (
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.0 // indirect
+	github.com/go-git/go-git/v5 v5.19.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.13 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect

go.sum

@@ -194,8 +194,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc=
-github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
@@ -703,8 +703,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-alpha.94 h1:c/0ZZTj3BFbZQD1s5KHwsshlhunH6YC++gt+cGYV6qA=
-github.com/wailsapp/wails/v3 v3.0.0-alpha.94/go.mod h1:4cKvtUppwqYC9tVtvgHWzEmXfUnuLEV3q8d0Jh6xkQQ=
+github.com/wailsapp/wails/v3 v3.0.0-alpha.95 h1:Rve8djRSldn6381q2l8gw8XEnzPX/4So6VsRM6bc7Vs=
+github.com/wailsapp/wails/v3 v3.0.0-alpha.95/go.mod h1:3euiK0wb6vnXvxiHysRYYbukCa060bLSsfrvN7sZg4k=
 github.com/wailsapp/wails/webview2 v1.0.24 h1:uULnjCSaRfMlU84mS3kjLgPsRosEOIusVK1nFOHZHzs=
 github.com/wailsapp/wails/webview2 v1.0.24/go.mod h1:sdf+s0nAdxlzVWf9SCxC15XaxnQPJeY+uU1Ucn3jHQM=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=

management/internals/shared/grpc/conversion.go

@@ -6,9 +6,11 @@ import (
 	"net/netip"
 	"net/url"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 	goproto "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	integrationsConfig "github.com/netbirdio/management-integrations/integrations/config"
 
@@ -185,9 +187,38 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 		response.NetworkMap.SshAuth = &proto.SSHAuth{AuthorizedUsers: hashedUsers, MachineUsers: machineUsers, UserIDClaim: userIDClaim}
 	}
 
+	// settings == nil → field stays nil → "no info in this snapshot", client
+	// preserves the deadline it already had. settings non-nil → emit either a
+	// valid deadline or the explicit-zero "disabled" sentinel via
+	// encodeSessionExpiresAt.
+	if settings != nil {
+		response.SessionExpiresAt = encodeSessionExpiresAt(
+			peer.SessionExpiresAt(settings.PeerLoginExpirationEnabled, settings.PeerLoginExpiration),
+		)
+	}
+
 	return response
 }
 
+// encodeSessionExpiresAt encodes a server-side deadline into the 3-state wire
+// representation used on LoginResponse, SyncResponse and
+// ExtendAuthSessionResponse. See the proto comments on those messages.
+//
+//   - deadline.IsZero() → returns &Timestamp{} (seconds=0, nanos=0): the
+//     "expiry disabled or peer is not SSO-tracked" sentinel; the client clears
+//     its anchor.
+//   - deadline non-zero → returns timestamppb.New(deadline): the new absolute
+//     UTC deadline.
+//
+// Returning nil ("no info, preserve client's anchor") is the caller's job —
+// only meaningful on Sync builds where settings were not resolved.
+func encodeSessionExpiresAt(deadline time.Time) *timestamppb.Timestamp {
+	if deadline.IsZero() {
+		return &timestamppb.Timestamp{}
+	}
+	return timestamppb.New(deadline)
+}
+
 func buildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]map[string]struct{}) ([][]byte, map[string]*proto.MachineUserIndexes) {
 	userIDToIndex := make(map[string]uint32)
 	var hashedUsers [][]byte

management/internals/shared/grpc/conversion_test.go

@@ -5,6 +5,7 @@ import (
 	"net/netip"
 	"reflect"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 
@@ -200,3 +201,29 @@ func TestBuildJWTConfig_Audiences(t *testing.T) {
 		})
 	}
 }
+
+// TestEncodeSessionExpiresAt pins the wire encoding the client's
+// applySessionDeadline depends on:
+//
+//   - zero deadline  → &Timestamp{} (seconds=0, nanos=0): the explicit
+//     "expiry disabled or peer is not SSO-tracked" sentinel.
+//   - non-zero       → timestamppb.New(deadline): the absolute UTC deadline.
+//
+// The third state (nil pointer = "no info in this snapshot") is the caller's
+// responsibility on the Sync path when settings could not be resolved; the
+// helper itself never returns nil.
+func TestEncodeSessionExpiresAt(t *testing.T) {
+	t.Run("zero deadline encodes as explicit-zero sentinel", func(t *testing.T) {
+		got := encodeSessionExpiresAt(time.Time{})
+		assert.NotNil(t, got, "must not return nil; nil means 'no info', not 'disabled'")
+		assert.Equal(t, int64(0), got.GetSeconds())
+		assert.Equal(t, int32(0), got.GetNanos())
+	})
+
+	t.Run("non-zero deadline round-trips", func(t *testing.T) {
+		deadline := time.Date(2030, 1, 2, 3, 4, 5, 0, time.UTC)
+		got := encodeSessionExpiresAt(deadline)
+		assert.NotNil(t, got)
+		assert.True(t, got.AsTime().Equal(deadline))
+	})
+}

management/internals/shared/grpc/server.go

@@ -821,6 +821,80 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 	}, nil
 }
 
+// ExtendAuthSession refreshes the peer's SSO session expiry deadline using a
+// fresh JWT. The same JWT validation pipeline as Login is used. The tunnel
+// stays up; no network map sync is performed. The new deadline is returned
+// in ExtendAuthSessionResponse.SessionExpiresAt.
+func (s *Server) ExtendAuthSession(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
+	extendReq := &proto.ExtendAuthSessionRequest{}
+	peerKey, err := s.parseRequest(ctx, req, extendReq)
+	if err != nil {
+		return nil, err
+	}
+
+	//nolint
+	ctx = context.WithValue(ctx, nbContext.PeerIDKey, peerKey.String())
+	if accountID, accErr := s.accountManager.GetAccountIDForPeerKey(ctx, peerKey.String()); accErr == nil {
+		//nolint
+		ctx = context.WithValue(ctx, nbContext.AccountIDKey, accountID)
+	}
+
+	jwt := extendReq.GetJwtToken()
+	if jwt == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "jwt token is required")
+	}
+
+	var userID string
+	const attempts = 3
+	for i := 0; i < attempts; i++ {
+		userID, err = s.validateToken(ctx, peerKey.String(), jwt)
+		if err == nil {
+			break
+		}
+		if i == attempts-1 {
+			break
+		}
+		log.WithContext(ctx).Warnf("failed validating JWT token while extending session for peer %s: %v. Retrying (idP cache).", peerKey.String(), err)
+		select {
+		case <-time.After(200 * time.Millisecond):
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	if userID == "" {
+		return nil, status.Errorf(codes.Unauthenticated, "jwt token did not yield a user id")
+	}
+
+	deadline, err := s.accountManager.ExtendPeerSession(ctx, peerKey.String(), userID)
+	if err != nil {
+		log.WithContext(ctx).Warnf("failed extending session for peer %s: %v", peerKey.String(), err)
+		return nil, mapError(ctx, err)
+	}
+
+	// Success path normally returns a non-zero deadline. A defensive zero
+	// would still encode as the explicit "disabled" sentinel rather than nil,
+	// so the client clears any stale anchor instead of preserving it.
+	resp := &proto.ExtendAuthSessionResponse{
+		SessionExpiresAt: encodeSessionExpiresAt(deadline),
+	}
+
+	wgKey, err := s.secretsManager.GetWGKey()
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed processing request")
+	}
+	encrypted, err := encryption.EncryptMessage(peerKey, wgKey, resp)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed encrypting response")
+	}
+	return &proto.EncryptedMessage{
+		WgPubKey: wgKey.PublicKey().String(),
+		Body:     encrypted,
+	}, nil
+}
+
 func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, netMap *types.NetworkMap, postureChecks []*posture.Checks) (*proto.LoginResponse, error) {
 	var relayToken *Token
 	var err error
@@ -844,6 +918,12 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
 
+	// settings is always non-nil here, so we never emit nil — encoder returns
+	// either a valid deadline or the explicit-zero "disabled" sentinel.
+	loginResp.SessionExpiresAt = encodeSessionExpiresAt(
+		peer.SessionExpiresAt(settings.PeerLoginExpirationEnabled, settings.PeerLoginExpiration),
+	)
+
 	return loginResp, nil
 }
 

management/server/account.go

@@ -355,7 +355,17 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			oldSettings.LazyConnectionEnabled != newSettings.LazyConnectionEnabled ||
 			oldSettings.DNSDomain != newSettings.DNSDomain ||
 			oldSettings.AutoUpdateVersion != newSettings.AutoUpdateVersion ||
-			oldSettings.AutoUpdateAlways != newSettings.AutoUpdateAlways {
+			oldSettings.AutoUpdateAlways != newSettings.AutoUpdateAlways ||
+			oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled ||
+			oldSettings.PeerLoginExpiration != newSettings.PeerLoginExpiration {
+			// Session deadline is derived from LastLogin + PeerLoginExpiration
+			// on every Login/Sync response. Without a fan-out push, connected
+			// peers keep the deadline they received at login time and only see
+			// the new value after the next unrelated NetworkMap change. Add
+			// these two fields to the trigger list so admin-side expiry tweaks
+			// (e.g. shortening from 24h to 1h) reach every connected peer
+			// within seconds, which is what the proactive-warning feature
+			// relies on (see client/internal/auth/sessionwatch).
 			updateAccountPeers = true
 		}
 

management/server/account/manager.go

@@ -109,6 +109,7 @@ type Manager interface {
 	UpdateAccountSettings(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error)
 	UpdateAccountOnboarding(ctx context.Context, accountID, userID string, newOnboarding *types.AccountOnboarding) (*types.AccountOnboarding, error)
 	LoginPeer(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, error)                       // used by peer gRPC API
+	ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error)                                                   // used by peer gRPC API for ExtendAuthSession
 	SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) // used by peer gRPC API
 	GetExternalCacheManager() ExternalCacheManager
 	GetPostureChecks(ctx context.Context, accountID, postureChecksID, userID string) (*posture.Checks, error)

management/server/account/manager_mock.go

@@ -1304,6 +1304,21 @@ func (mr *MockManagerMockRecorder) LoginPeer(ctx, login interface{}) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LoginPeer", reflect.TypeOf((*MockManager)(nil).LoginPeer), ctx, login)
 }
 
+// ExtendPeerSession mocks base method.
+func (m *MockManager) ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ExtendPeerSession", ctx, peerPubKey, userID)
+	ret0, _ := ret[0].(time.Time)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ExtendPeerSession indicates an expected call of ExtendPeerSession.
+func (mr *MockManagerMockRecorder) ExtendPeerSession(ctx, peerPubKey, userID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExtendPeerSession", reflect.TypeOf((*MockManager)(nil).ExtendPeerSession), ctx, peerPubKey, userID)
+}
+
 // MarkPeerConnected mocks base method.
 func (m *MockManager) MarkPeerConnected(ctx context.Context, peerKey string, realIP net.IP, accountID string, sessionStartedAt int64) error {
 	m.ctrl.T.Helper()

management/server/activity/codes.go

@@ -240,6 +240,10 @@ const (
 	AccountLocalMfaEnabled Activity = 123
 	// AccountLocalMfaDisabled indicates that a user disabled TOTP MFA for local users
 	AccountLocalMfaDisabled Activity = 124
+	// UserExtendedPeerSession indicates that a user refreshed their peer's
+	// SSO session deadline via ExtendAuthSession without re-establishing the
+	// tunnel. Distinct from UserLoggedInPeer (full interactive login).
+	UserExtendedPeerSession Activity = 125
 
 	AccountDeleted Activity = 99999
 )
@@ -394,6 +398,8 @@ var activityMap = map[Activity]Code{
 	AccountLocalMfaEnabled:  {"Account local MFA enabled", "account.setting.local.mfa.enable"},
 	AccountLocalMfaDisabled: {"Account local MFA disabled", "account.setting.local.mfa.disable"},
 
+	UserExtendedPeerSession: {"User extended peer session", "user.peer.session.extend"},
+
 	DomainAdded:     {"Domain added", "domain.add"},
 	DomainDeleted:   {"Domain deleted", "domain.delete"},
 	DomainValidated: {"Domain validated", "domain.validate"},

management/server/mock_server/account_mock.go

@@ -98,6 +98,7 @@ type MockAccountManager struct {
 	GetPeerFunc                           func(ctx context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error)
 	UpdateAccountSettingsFunc             func(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error)
 	LoginPeerFunc                         func(ctx context.Context, login types.PeerLogin) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, error)
+	ExtendPeerSessionFunc                 func(ctx context.Context, peerPubKey, userID string) (time.Time, error)
 	SyncPeerFunc                          func(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error)
 	InviteUserFunc                        func(ctx context.Context, accountID string, initiatorUserID string, targetUserEmail string) error
 	ApproveUserFunc                       func(ctx context.Context, accountID, initiatorUserID, targetUserID string) (*types.UserInfo, error)
@@ -860,6 +861,14 @@ func (am *MockAccountManager) LoginPeer(ctx context.Context, login types.PeerLog
 	return nil, nil, nil, status.Errorf(codes.Unimplemented, "method LoginPeer is not implemented")
 }
 
+// ExtendPeerSession mocks ExtendPeerSession of the AccountManager interface
+func (am *MockAccountManager) ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error) {
+	if am.ExtendPeerSessionFunc != nil {
+		return am.ExtendPeerSessionFunc(ctx, peerPubKey, userID)
+	}
+	return time.Time{}, status.Errorf(codes.Unimplemented, "method ExtendPeerSession is not implemented")
+}
+
 // SyncPeer mocks SyncPeer of the AccountManager interface
 func (am *MockAccountManager) SyncPeer(ctx context.Context, sync types.PeerSync, accountID string) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, int64, error) {
 	if am.SyncPeerFunc != nil {

management/server/peer.go

@@ -1128,6 +1128,79 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.Peer
 	return p, nmap, pc, err
 }
 
+// ExtendPeerSession refreshes the peer's SSO session deadline by updating
+// LastLogin after a successful JWT validation. The tunnel is untouched: no
+// network map sync, no peer reconnect.
+//
+// Preconditions enforced here:
+//   - userID must be present (caller validated the JWT and extracted the user ID).
+//   - The peer must exist and be SSO-registered (AddedWithSSOLogin) with
+//     LoginExpirationEnabled.
+//   - Account-level PeerLoginExpirationEnabled must be true.
+//   - The JWT user must match peer.UserID (mirrors LoginPeer at peer.go ~1028).
+//
+// Returns the new absolute UTC deadline.
+func (am *DefaultAccountManager) ExtendPeerSession(ctx context.Context, peerPubKey, userID string) (time.Time, error) {
+	if userID == "" {
+		return time.Time{}, status.Errorf(status.PermissionDenied, "session extend requires a JWT")
+	}
+
+	accountID, err := am.Store.GetAccountIDByPeerPubKey(ctx, peerPubKey)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if !settings.PeerLoginExpirationEnabled {
+		return time.Time{}, status.Errorf(status.PreconditionFailed, "peer login expiration is disabled for the account")
+	}
+
+	var refreshed *nbpeer.Peer
+	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		peer, err := transaction.GetPeerByPeerPubKey(ctx, store.LockingStrengthUpdate, peerPubKey)
+		if err != nil {
+			return err
+		}
+
+		if !peer.AddedWithSSOLogin() || !peer.LoginExpirationEnabled {
+			return status.Errorf(status.PreconditionFailed, "peer is not eligible for session extension")
+		}
+
+		if peer.UserID != userID {
+			log.WithContext(ctx).Warnf("user mismatch when extending session for peer %s: peer user %s, jwt user %s", peer.ID, peer.UserID, userID)
+			return status.NewPeerLoginMismatchError()
+		}
+
+		peer = peer.UpdateLastLogin()
+		if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
+			return err
+		}
+
+		if err := transaction.SaveUserLastLogin(ctx, accountID, userID, peer.GetLastLogin()); err != nil {
+			log.WithContext(ctx).Debugf("failed to update user last login during session extend: %v", err)
+		}
+
+		am.StoreEvent(ctx, userID, peer.ID, accountID, activity.UserExtendedPeerSession, peer.EventMeta(am.networkMapController.GetDNSDomain(settings)))
+		refreshed = peer
+		return nil
+	})
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	// Reschedule the per-account expiration job. schedulePeerLoginExpiration
+	// is a no-op when a job is already running, but the running job will pick
+	// up the new LastLogin on its next tick. Calling it here is harmless and
+	// guarantees a job is in flight even if a prior one ended right before
+	// the extend.
+	am.schedulePeerLoginExpiration(ctx, accountID)
+
+	return refreshed.SessionExpiresAt(settings.PeerLoginExpirationEnabled, settings.PeerLoginExpiration), nil
+}
+
 // getPeerPostureChecks returns the posture checks for the peer.
 func getPeerPostureChecks(ctx context.Context, transaction store.Store, accountID, peerID string) ([]*posture.Checks, error) {
 	policies, err := transaction.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)

management/server/peer/peer.go

@@ -367,6 +367,22 @@ func (p *Peer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
 	return timeLeft <= 0, timeLeft
 }
 
+// SessionExpiresAt returns the absolute UTC instant at which the peer's SSO
+// session expires, derived from LastLogin and the account-level
+// PeerLoginExpiration setting. Returns the zero value when login expiration
+// does not apply (peer not SSO-registered, peer-level toggle off, or account
+// expiry disabled). Callers should treat the zero value as "no deadline".
+func (p *Peer) SessionExpiresAt(accountExpirationEnabled bool, expiresIn time.Duration) time.Time {
+	if !accountExpirationEnabled || !p.AddedWithSSOLogin() || !p.LoginExpirationEnabled {
+		return time.Time{}
+	}
+	last := p.GetLastLogin()
+	if last.IsZero() {
+		return time.Time{}
+	}
+	return last.Add(expiresIn).UTC()
+}
+
 // FQDN returns peers FQDN combined of the peer's DNS label and the system's DNS domain
 func (p *Peer) FQDN(dnsDomain string) string {
 	if dnsDomain == "" {

shared/management/client/client.go

@@ -16,6 +16,10 @@ type Client interface {
 	Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error
 	Register(setupKey string, jwtToken string, sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	Login(sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
+	// ExtendAuthSession refreshes the peer's SSO session deadline using a fresh JWT.
+	// Returns the new absolute deadline; zero time when the server reports the peer
+	// is not eligible for session extension.
+	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
 	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
 	GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error)

shared/management/client/grpc.go

@@ -607,6 +607,61 @@ func (c *GrpcClient) Login(sysInfo *system.Info, pubSSHKey []byte, dnsLabels dom
 	return c.login(&proto.LoginRequest{Meta: infoToMetaData(sysInfo), PeerKeys: keys, DnsLabels: dnsLabels.ToPunycodeList()})
 }
 
+// ExtendAuthSession refreshes the peer's SSO session deadline on the management
+// server using a freshly issued JWT. The tunnel is untouched: no network map
+// sync, no peer reconnect. Returns the new absolute UTC deadline (zero time
+// when the server reports the field empty).
+func (c *GrpcClient) ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error) {
+	if !c.ready() {
+		return nil, errors.New(errMsgNoMgmtConnection)
+	}
+
+	serverKey, err := c.getServerPublicKey()
+	if err != nil {
+		return nil, err
+	}
+
+	reqBody, err := encryption.EncryptMessage(*serverKey, c.key, &proto.ExtendAuthSessionRequest{
+		JwtToken: jwtToken,
+		Meta:     infoToMetaData(sysInfo),
+	})
+	if err != nil {
+		log.Errorf("failed to encrypt extend auth session message: %s", err)
+		return nil, err
+	}
+
+	var resp *proto.EncryptedMessage
+	operation := func() error {
+		mgmCtx, cancel := context.WithTimeout(context.Background(), ConnectTimeout)
+		defer cancel()
+
+		var err error
+		resp, err = c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
+			WgPubKey: c.key.PublicKey().String(),
+			Body:     reqBody,
+		})
+		if err != nil {
+			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.Canceled {
+				return err
+			}
+			return backoff.Permanent(err)
+		}
+		return nil
+	}
+
+	if err := backoff.Retry(operation, nbgrpc.Backoff(c.ctx)); err != nil {
+		log.Errorf("failed to extend auth session on Management Service: %v", err)
+		return nil, err
+	}
+
+	out := &proto.ExtendAuthSessionResponse{}
+	if err := encryption.DecryptMessage(*serverKey, c.key, resp.Body, out); err != nil {
+		log.Errorf("failed to decrypt extend auth session response: %s", err)
+		return nil, err
+	}
+	return out, nil
+}
+
 // GetDeviceAuthorizationFlow returns a device authorization flow information.
 // It also takes care of encrypting and decrypting messages.
 func (c *GrpcClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error) {

shared/management/client/mock.go

@@ -14,6 +14,7 @@ type MockClient struct {
 	SyncFunc                       func(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
 	RegisterFunc                   func(setupKey string, jwtToken string, info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	LoginFunc                      func(info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
+	ExtendAuthSessionFunc          func(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlowFunc func() (*proto.DeviceAuthorizationFlow, error)
 	GetPKCEAuthorizationFlowFunc   func() (*proto.PKCEAuthorizationFlow, error)
 	GetServerURLFunc               func() string
@@ -65,6 +66,13 @@ func (m *MockClient) Login(info *system.Info, sshKey []byte, dnsLabels domain.Li
 	return m.LoginFunc(info, sshKey, dnsLabels)
 }
 
+func (m *MockClient) ExtendAuthSession(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error) {
+	if m.ExtendAuthSessionFunc == nil {
+		return nil, nil
+	}
+	return m.ExtendAuthSessionFunc(info, jwtToken)
+}
+
 func (m *MockClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error) {
 	if m.GetDeviceAuthorizationFlowFunc == nil {
 		return nil, nil

shared/management/proto/management.proto

@@ -52,6 +52,14 @@ service ManagementService {
   // Executes a job on a target peer (e.g., debug bundle)
   rpc Job(stream EncryptedMessage) returns (stream EncryptedMessage) {}
 
+  // ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
+  // Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
+  // but does not redo the network-map sync. Only valid for SSO-registered peers where
+  // login expiration is enabled. The tunnel remains up.
+  // EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
+  // EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
+  rpc ExtendAuthSession(EncryptedMessage) returns (EncryptedMessage) {}
+
   // CreateExpose creates a temporary reverse proxy service for a peer
   rpc CreateExpose(EncryptedMessage) returns (EncryptedMessage) {}
 
@@ -133,6 +141,15 @@ message SyncResponse {
 
   // Posture checks to be evaluated by client
   repeated Checks Checks = 6;
+
+  // 3-state session deadline. Carried on every Sync snapshot so admin-side
+  // changes propagate live without a client reconnect.
+  //   field unset (nil)        → snapshot carries no info; client keeps the
+  //                              deadline it already had
+  //   set, seconds=0 nanos=0   → explicit "expiry disabled" or peer is not
+  //                              SSO-registered; client clears its anchor
+  //   set, valid timestamp     → new absolute UTC deadline
+  google.protobuf.Timestamp sessionExpiresAt = 7;
 }
 
 message  SyncMetaRequest {
@@ -244,6 +261,31 @@ message LoginResponse {
   PeerConfig peerConfig = 2;
   // Posture checks to be evaluated by client
   repeated Checks Checks = 3;
+
+  // 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
+  //   field unset (nil)        → no info; client keeps any deadline it had
+  //   set, seconds=0 nanos=0   → explicit "expiry disabled" / non-SSO peer
+  //   set, valid timestamp     → new absolute UTC deadline
+  google.protobuf.Timestamp sessionExpiresAt = 4;
+}
+
+// ExtendAuthSessionRequest carries a fresh JWT to refresh the peer's session deadline.
+// The encrypted body of an EncryptedMessage with this payload is sent to the
+// ExtendAuthSession RPC.
+message ExtendAuthSessionRequest {
+  // SSO token (must be a fresh, valid JWT for the peer's owning user)
+  string jwtToken = 1;
+  // Meta data of the peer (used for IdP user info refresh consistent with Login)
+  PeerSystemMeta meta = 2;
+}
+
+// ExtendAuthSessionResponse contains the refreshed session deadline.
+message ExtendAuthSessionResponse {
+  // 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
+  // In practice ExtendAuthSession only succeeds for SSO peers with expiry
+  // enabled, so this carries a valid timestamp on the success path. The
+  // 3-state encoding is documented here for symmetry with Login/Sync.
+  google.protobuf.Timestamp sessionExpiresAt = 1;
 }
 
 message ServerKeyResponse {

shared/management/proto/management_grpc.pb.go

@@ -52,6 +52,13 @@ type ManagementServiceClient interface {
 	Logout(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ctx context.Context, opts ...grpc.CallOption) (ManagementService_JobClient, error)
+	// ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
+	// Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
+	// but does not redo the network-map sync. Only valid for SSO-registered peers where
+	// login expiration is enabled. The tunnel remains up.
+	// EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
+	// EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
+	ExtendAuthSession(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
 	// CreateExpose creates a temporary reverse proxy service for a peer
 	CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
 	// RenewExpose extends the TTL of an active expose session
@@ -194,6 +201,15 @@ func (x *managementServiceJobClient) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
+func (c *managementServiceClient) ExtendAuthSession(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
+	out := new(EncryptedMessage)
+	err := c.cc.Invoke(ctx, "/management.ManagementService/ExtendAuthSession", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *managementServiceClient) CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
 	out := new(EncryptedMessage)
 	err := c.cc.Invoke(ctx, "/management.ManagementService/CreateExpose", in, out, opts...)
@@ -259,6 +275,13 @@ type ManagementServiceServer interface {
 	Logout(context.Context, *EncryptedMessage) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ManagementService_JobServer) error
+	// ExtendAuthSession refreshes the peer's session expiry deadline using a fresh JWT.
+	// Same JWT validation pipeline as Login (including jwt.UserID == peer.UserID check),
+	// but does not redo the network-map sync. Only valid for SSO-registered peers where
+	// login expiration is enabled. The tunnel remains up.
+	// EncryptedMessage of the request has a body of ExtendAuthSessionRequest.
+	// EncryptedMessage of the response has a body of ExtendAuthSessionResponse.
+	ExtendAuthSession(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
 	// CreateExpose creates a temporary reverse proxy service for a peer
 	CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
 	// RenewExpose extends the TTL of an active expose session
@@ -299,6 +322,9 @@ func (UnimplementedManagementServiceServer) Logout(context.Context, *EncryptedMe
 func (UnimplementedManagementServiceServer) Job(ManagementService_JobServer) error {
 	return status.Errorf(codes.Unimplemented, "method Job not implemented")
 }
+func (UnimplementedManagementServiceServer) ExtendAuthSession(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ExtendAuthSession not implemented")
+}
 func (UnimplementedManagementServiceServer) CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateExpose not implemented")
 }
@@ -494,6 +520,24 @@ func (x *managementServiceJobServer) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
+func _ManagementService_ExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EncryptedMessage)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).ExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ManagementService/ExtendAuthSession",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).ExtendAuthSession(ctx, req.(*EncryptedMessage))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _ManagementService_CreateExpose_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(EncryptedMessage)
 	if err := dec(in); err != nil {
@@ -583,6 +627,10 @@ var ManagementService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Logout",
 			Handler:    _ManagementService_Logout_Handler,
 		},
+		{
+			MethodName: "ExtendAuthSession",
+			Handler:    _ManagementService_ExtendAuthSession_Handler,
+		},
 		{
 			MethodName: "CreateExpose",
 			Handler:    _ManagementService_CreateExpose_Handler,