From 8d6b7b61754db8e13ff7c6a99063e9d1d2e47eb4 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Sat, 29 Aug 2026 13:49:47 +0200 Subject: [PATCH] Leave the VNC approver nil when there is no broker to ask --- client/internal/engine_vnc.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/client/internal/engine_vnc.go b/client/internal/engine_vnc.go index 9ee3e09b2..12d803360 100644 --- a/client/internal/engine_vnc.go +++ b/client/internal/engine_vnc.go @@ -133,6 +133,16 @@ func (e *Engine) startVNCServer() error { log.Info("VNC: running as system service, enabling service mode (per-session agent proxy)") } requireApproval := e.config.DisableVNCApproval == nil || !*e.config.DisableVNCApproval + + // Left nil when there is no broker to ask, so the server's own + // no-approver refusal runs and the client is told which of the two it hit. + // Wrapping a nil broker still denies, because Broker.Request reports one as + // an error, but it denies as "approval denied" and hides the real reason. + var approver vncserver.Approver + if e.approvalBroker != nil { + approver = &vncApprover{broker: e.approvalBroker, statusRecorder: e.statusRecorder} + } + srv := vncserver.New(vncserver.Config{ Capturer: capturer, Injector: injector, @@ -141,7 +151,7 @@ func (e *Engine) startVNCServer() error { SessionRecorder: sessionRecorder, NetstackNet: e.wgInterface.GetNet(), RequireApproval: requireApproval, - Approver: &vncApprover{broker: e.approvalBroker, statusRecorder: e.statusRecorder}, + Approver: approver, // Session start/stop is invisible to the peer status recorder, so push a // snapshot ourselves; otherwise the UI's session list goes stale until an // unrelated peer change happens to fire one.