Add VNC allow and approval settings to MDM policy

client/ui/services/settings.go

@@ -19,6 +19,8 @@ type MDMFields struct {
 	DisableClientRoutes      bool   `json:"disableClientRoutes"`
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
+	AllowServerVNC           *bool  `json:"allowServerVNC"`
+	DisableVNCApproval       bool   `json:"disableVNCApproval"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
@@ -261,4 +263,8 @@ func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
 		allowed := cfgResp.GetServerSSHAllowed()
 		mdm.AllowServerSSH = &allowed
 	}
+	if _, ok := set["allowServerVNC"]; ok {
+		allowed := cfgResp.GetServerVNCAllowed()
+		mdm.AllowServerVNC = &allowed
+	}
 }

client/ui/services/settings_mdm_test.go

@@ -0,0 +1,44 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+func TestApplyMDMRestrictions_VNCFields(t *testing.T) {
+	t.Run("unmanaged leaves fields at zero", func(t *testing.T) {
+		var mdm MDMFields
+		applyMDMRestrictions(&mdm, &proto.GetConfigResponse{})
+		assert.Nil(t, mdm.AllowServerVNC)
+		assert.False(t, mdm.DisableVNCApproval)
+	})
+
+	t.Run("managed surfaces enforced values", func(t *testing.T) {
+		var mdm MDMFields
+		applyMDMRestrictions(&mdm, &proto.GetConfigResponse{
+			MDMManagedFields:   []string{"allowServerVNC", "disableVNCApproval"},
+			ServerVNCAllowed:   true,
+			DisableVNCApproval: true,
+		})
+		require.NotNil(t, mdm.AllowServerVNC)
+		assert.True(t, *mdm.AllowServerVNC, "AllowServerVNC should carry the enforced value")
+		assert.True(t, mdm.DisableVNCApproval, "DisableVNCApproval should be flagged managed")
+	})
+
+	t.Run("managed VNC disallowed surfaces false", func(t *testing.T) {
+		var mdm MDMFields
+		applyMDMRestrictions(&mdm, &proto.GetConfigResponse{
+			MDMManagedFields: []string{"allowServerVNC"},
+			ServerVNCAllowed: false,
+		})
+		require.NotNil(t, mdm.AllowServerVNC)
+		assert.False(t, *mdm.AllowServerVNC)
+		assert.False(t, mdm.DisableVNCApproval, "unmanaged approval stays zero")
+	})
+}