Report the MDM VNC keys to the UI and bound the copyrect tile-hash map

client/mdm/restrictions.go

@@ -64,9 +64,13 @@ func BuildRestrictions(policy *Policy) Restrictions {
 	r.MDM.SplitTunnelMode = policy.HasKey(KeySplitTunnelMode)
 	r.MDM.SplitTunnelApps = policy.HasKey(KeySplitTunnelApps)
 	r.MDM.RemoteJobsAllowed = policy.HasKey(KeyRemoteJobsAllowed)
+	r.MDM.DisableVNCApproval = policy.HasKey(KeyDisableVNCApproval)
 	if v, ok := policy.GetBool(KeyAllowServerSSH); ok {
 		r.MDM.AllowServerSSH = &v
 	}
+	if v, ok := policy.GetBool(KeyAllowServerVNC); ok {
+		r.MDM.AllowServerVNC = &v
+	}
 	if v, ok := policy.GetBool(KeyDisableAdvancedView); ok {
 		r.MDM.DisableAdvancedView = &v
 	}

client/mdm/restrictions_test.go

@@ -0,0 +1,37 @@
+package mdm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Every key the UI can be told about has to be mapped here. A field left out
+// reports the key as unmanaged, so the desktop and mobile UIs offer a control
+// the policy actually enforces, and the user's change is silently overridden.
+func TestBuildRestrictions_MapsRemoteAccessKeys(t *testing.T) {
+	policy := NewPolicy(map[string]any{
+		KeyAllowServerSSH:     true,
+		KeyAllowServerVNC:     true,
+		KeyDisableVNCApproval: true,
+		KeyRemoteJobsAllowed:  true,
+	})
+
+	r := BuildRestrictions(policy)
+
+	require.NotNil(t, r.MDM.AllowServerSSH, "allowServerSSH must be reported as managed")
+	assert.True(t, *r.MDM.AllowServerSSH)
+	require.NotNil(t, r.MDM.AllowServerVNC, "allowServerVNC must be reported as managed")
+	assert.True(t, *r.MDM.AllowServerVNC)
+	assert.True(t, r.MDM.DisableVNCApproval, "disableVNCApproval must be reported as managed")
+	assert.True(t, r.MDM.RemoteJobsAllowed)
+}
+
+// An unmanaged key stays nil/false so the UI leaves the control editable.
+func TestBuildRestrictions_UnmanagedVNCKeys(t *testing.T) {
+	r := BuildRestrictions(NewPolicy(map[string]any{KeyAllowServerSSH: false}))
+
+	assert.Nil(t, r.MDM.AllowServerVNC, "an unset allowServerVNC must not read as managed")
+	assert.False(t, r.MDM.DisableVNCApproval)
+}