From 5f900fe38fb4141ebfc03d5a91166d99bae8e6f8 Mon Sep 17 00:00:00 2001
From: "Theodor S. Midtlien" <theodor@midtlien.com>
Date: Thu, 10 Sep 2026 17:07:35 +0200
Subject: [PATCH] Fix status and list profiles

---
 client/cmd/status.go                  |  9 +++++++++
 client/internal/ipcauth/authz_gate.go | 14 +++++++++-----
 client/internal/ipcauth/methods.go    |  2 +-
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/client/cmd/status.go b/client/cmd/status.go
index f2e5bcc66..b61e47514 100644
--- a/client/cmd/status.go
+++ b/client/cmd/status.go
@@ -15,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 	nbstatus "github.com/netbirdio/netbird/client/status"
 	"github.com/netbirdio/netbird/util"
+	"github.com/netbirdio/netbird/version"
 )
 
 var (
@@ -98,6 +99,14 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		return nil
 	}
 
+	if resp.GetFullStatus() == nil {
+		cmd.Printf("Daemon status: %s\n"+
+			"Daemon version: %s\nCLI version: %s\n\n"+
+			"Detailed status is unavailable: the connection belongs to another user.\n",
+			status, resp.GetDaemonVersion(), version.NetbirdVersion())
+		return nil
+	}
+
 	if ipv4Flag {
 		cmd.Print(parseInterfaceIP(resp.GetFullStatus().GetLocalPeerState().GetIP()))
 		return nil
diff --git a/client/internal/ipcauth/authz_gate.go b/client/internal/ipcauth/authz_gate.go
index baa70196f..a8d629fff 100644
--- a/client/internal/ipcauth/authz_gate.go
+++ b/client/internal/ipcauth/authz_gate.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"sync"
 
+	"github.com/netbirdio/netbird/client/proto"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -47,14 +48,17 @@ func (g *AuthzGate) state() DaemonState {
 // RequireHolderForFullStatus escalates a StatusRequest that asks for peer detail
 // or for probes to be run.
 func RequireHolderForFullStatus(r Request) error {
-	statusReq, ok := r.Msg.(interface {
-		GetGetFullPeerStatus() bool
-		GetShouldRunProbes() bool
-	})
+	statusReq, ok := r.Msg.(*proto.StatusRequest)
 	if !ok {
 		return nil
 	}
-	if !statusReq.GetGetFullPeerStatus() && !statusReq.GetShouldRunProbes() {
+	if r.Level < AuthzLevelSessionHolder {
+		if statusReq.GetFullPeerStatus {
+			statusReq.GetFullPeerStatus = false
+		}
+		if statusReq.ShouldRunProbes {
+			statusReq.ShouldRunProbes = false
+		}
 		return nil
 	}
 	return RequireLevel(AuthzLevelSessionHolder)(r)
diff --git a/client/internal/ipcauth/methods.go b/client/internal/ipcauth/methods.go
index fc875fa5e..d1817b3c6 100644
--- a/client/internal/ipcauth/methods.go
+++ b/client/internal/ipcauth/methods.go
@@ -48,6 +48,7 @@ var methodPolicies = map[string]MethodPolicy{
 	// Any identified caller.
 	servicePath + "Status":           {Level: AuthzLevelIdentified, Rules: []Rule{RequireHolderForFullStatus}},
 	servicePath + "AddProfile":       {Level: AuthzLevelIdentified, Audit: true},
+	servicePath + "ListProfiles":     {Level: AuthzLevelIdentified},
 	servicePath + "GetActiveProfile": {Level: AuthzLevelIdentified},
 	servicePath + "GetFeatures":      {Level: AuthzLevelIdentified},
 	servicePath + "WailsUIReady":     {Level: AuthzLevelIdentified},
@@ -67,7 +68,6 @@ var methodPolicies = map[string]MethodPolicy{
 	servicePath + "SwitchProfile": {Level: AuthzLevelSessionHolder, TargetsProfile: true, Audit: true},
 
 	// Owner of some profile
-	servicePath + "ListProfiles":       {Level: AuthzLevelProfileOwner},
 	servicePath + "GetLogLevel":        {Level: AuthzLevelProfileOwner},
 	servicePath + "ListStates":         {Level: AuthzLevelProfileOwner},
 	servicePath + "GetInstallerResult": {Level: AuthzLevelProfileOwner},