Let an MDM policy set the groups the daemon sockets are restricted to

client/cmd/service_allow_group_test.go

@@ -7,6 +7,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/mdm"
 )
 
 func TestResolveAllowGroups_NoValuesLeavesSocketOpen(t *testing.T) {
@@ -36,6 +38,68 @@ func TestResolveAllowGroups_UnresolvableIsAnError(t *testing.T) {
 	assert.Contains(t, err.Error(), "no-such-group-08b1f0c4")
 }
 
+func TestResolveAllowGroups_SplitsCommaSeparatedEntries(t *testing.T) {
+	// One managed-configuration string listing several principals, as a
+	// Windows REG_SZ delivers them.
+	resolved, err := resolveAllowGroups([]string{testAllowGroupPrincipal + ", " + testAllowGroupPrincipal})
+	require.NoError(t, err)
+	assert.Equal(t, []string{testAllowGroupPrincipal}, resolved)
+}
+
+func TestDaemonSocketPrincipals(t *testing.T) {
+	original := allowGroups
+	t.Cleanup(func() { allowGroups = original })
+
+	t.Run("no configuration leaves the sockets open", func(t *testing.T) {
+		allowGroups = nil
+
+		resolved, _, err := daemonSocketPrincipals(mdm.NewPolicy(nil))
+		require.NoError(t, err)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("the install-time flag applies when nothing is managed", func(t *testing.T) {
+		allowGroups = []string{testAllowGroupPrincipal}
+
+		resolved, source, err := daemonSocketPrincipals(mdm.NewPolicy(nil))
+		require.NoError(t, err)
+		assert.Equal(t, []string{testAllowGroupPrincipal}, resolved)
+		assert.Contains(t, source, "--allow-group")
+	})
+
+	t.Run("an MDM policy overrides the install-time flag", func(t *testing.T) {
+		allowGroups = nil
+		policy := mdm.NewPolicy(map[string]any{mdm.KeyAllowGroups: testAllowGroupPrincipal})
+
+		resolved, source, err := daemonSocketPrincipals(policy)
+		require.NoError(t, err)
+		assert.Equal(t, []string{testAllowGroupPrincipal}, resolved)
+		assert.Contains(t, source, mdm.KeyAllowGroups)
+	})
+
+	t.Run("an empty MDM value lifts an install-time restriction", func(t *testing.T) {
+		allowGroups = []string{testAllowGroupPrincipal}
+		policy := mdm.NewPolicy(map[string]any{mdm.KeyAllowGroups: ""})
+
+		resolved, source, err := daemonSocketPrincipals(policy)
+		require.NoError(t, err)
+		assert.Empty(t, resolved)
+		assert.Contains(t, source, mdm.KeyAllowGroups)
+	})
+
+	// A managed value that cannot be resolved must not fall back to the
+	// install-time flag or to an open socket: the host was meant to be locked
+	// down, so the daemon refuses to serve instead.
+	t.Run("an unresolvable MDM value is an error", func(t *testing.T) {
+		allowGroups = []string{testAllowGroupPrincipal}
+		policy := mdm.NewPolicy(map[string]any{mdm.KeyAllowGroups: "no-such-group-08b1f0c4"})
+
+		_, _, err := daemonSocketPrincipals(policy)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), mdm.KeyAllowGroups)
+	})
+}
+
 func TestCutKind(t *testing.T) {
 	tests := []struct {
 		value string