[management] Push network maps when background validation changes (#8299)

An integrated validator can approve or revoke peers outside a login or
sync, for example during a periodic EDR sync. Only revocations of SSO
peers reached anyone; a newly approved peer kept its empty map, and its
peers did not see it, until an unrelated update or a reconnect.

Add SetPeerValidationChangeListener to the IntegratedValidator interface.
The account manager registers a handler that resolves the affected peers
and calls OnPeersUpdated, the same path a login-time approval takes. The
OSS validator and the mock implement it as a no-op.

management/server/integrations/integrated_validator/integrated_validator_mock.go

@@ -130,6 +130,18 @@ func (mr *MockIntegratedValidatorMockRecorder) SetPeerInvalidationListener(fn an
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPeerInvalidationListener", reflect.TypeOf((*MockIntegratedValidator)(nil).SetPeerInvalidationListener), fn)
 }
 
+// SetPeerValidationChangeListener mocks base method.
+func (m *MockIntegratedValidator) SetPeerValidationChangeListener(fn func(string, []string)) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetPeerValidationChangeListener", fn)
+}
+
+// SetPeerValidationChangeListener indicates an expected call of SetPeerValidationChangeListener.
+func (mr *MockIntegratedValidatorMockRecorder) SetPeerValidationChangeListener(fn any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPeerValidationChangeListener", reflect.TypeOf((*MockIntegratedValidator)(nil).SetPeerValidationChangeListener), fn)
+}
+
 // Stop mocks base method.
 func (m *MockIntegratedValidator) Stop(ctx context.Context) {
 	m.ctrl.T.Helper()

management/server/integrations/integrated_validator/interface.go

@@ -21,6 +21,9 @@ type IntegratedValidator interface {
 	GetInvalidPeers(ctx context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error)
 	PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error
 	SetPeerInvalidationListener(fn func(accountID string, peerIDs []string))
+	// SetPeerValidationChangeListener registers fn to be called with the peers whose
+	// validation state changed outside a login or sync, so their network maps can be pushed.
+	SetPeerValidationChangeListener(fn func(accountID string, peerIDs []string))
 	Stop(ctx context.Context)
 	ValidateFlowResponse(ctx context.Context, peerKey string, flowResponse *proto.PKCEAuthorizationFlow) *proto.PKCEAuthorizationFlow
 }

management/server/integrations/integrated_validator/validator/validator.go

@@ -55,6 +55,9 @@ func (v *IntegratedValidatorImpl) PeerDeleted(_ context.Context, _, _ string, _
 func (v *IntegratedValidatorImpl) SetPeerInvalidationListener(_ func(accountID string, peerIDs []string)) {
 }
 
+func (v *IntegratedValidatorImpl) SetPeerValidationChangeListener(_ func(accountID string, peerIDs []string)) {
+}
+
 func (v *IntegratedValidatorImpl) Stop(_ context.Context) {
 }