Add per-connection user-approval prompts for VNC

management/server/types/account.go

@@ -14,7 +14,7 @@ import (
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/ssh/auth"
+	auth "github.com/netbirdio/netbird/shared/sessionauth"
 	nbdns "github.com/netbirdio/netbird/dns"
 	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"

management/server/types/networkmap_components.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/netbirdio/netbird/client/ssh/auth"
+	auth "github.com/netbirdio/netbird/shared/sessionauth"
 	nbdns "github.com/netbirdio/netbird/dns"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"

management/server/types/policy_authorized_users.go

@@ -6,7 +6,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/ssh/auth"
+	auth "github.com/netbirdio/netbird/shared/sessionauth"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
@@ -28,6 +28,9 @@ type VNCSessionPubKey struct {
 	PubKey string
 	// UserID is the unhashed user identity the pubkey authenticates as.
 	UserID string
+	// DisplayName is a human-readable label for UserID, used by the host
+	// peer's approval prompt. Empty when not provided.
+	DisplayName string
 }
 
 // ruleAuthCallbacks lets Account and NetworkMapComponents share the per-rule
@@ -83,8 +86,9 @@ func (cb ruleAuthCallbacks) handleVNCRule(rule *PolicyRule, peerInSources, peerI
 	cb.collectVNCUsers(rule, state.vncAuthorizedUsers)
 	if peerInDestinations && rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
 		state.vncSessionPubKeys = append(state.vncSessionPubKeys, VNCSessionPubKey{
-			PubKey: rule.SessionPubKey,
-			UserID: rule.AuthorizedUser,
+			PubKey:      rule.SessionPubKey,
+			UserID:      rule.AuthorizedUser,
+			DisplayName: rule.SessionDisplayName,
 		})
 	}
 }

management/server/types/policyrule.go

@@ -94,6 +94,13 @@ type PolicyRule struct {
 	// AuthorizedUser when the rule was created via temporary-access for a
 	// VNC scope; empty otherwise.
 	SessionPubKey string
+
+	// SessionDisplayName is a human-readable label for the user the
+	// SessionPubKey was issued to (typically display name, falling back
+	// to email or user id). The daemon surfaces it on the host's
+	// per-connection approval prompt so the user being asked can
+	// recognise who is requesting access.
+	SessionDisplayName string
 }
 
 // Copy returns a copy of a policy rule
@@ -116,6 +123,7 @@ func (pm *PolicyRule) Copy() *PolicyRule {
 		AuthorizedGroups:    make(map[string][]string, len(pm.AuthorizedGroups)),
 		AuthorizedUser:      pm.AuthorizedUser,
 		SessionPubKey:       pm.SessionPubKey,
+		SessionDisplayName:  pm.SessionDisplayName,
 	}
 	copy(rule.Destinations, pm.Destinations)
 	copy(rule.Sources, pm.Sources)
@@ -144,7 +152,8 @@ func (pm *PolicyRule) Equal(other *PolicyRule) bool {
 		pm.SourceResource != other.SourceResource ||
 		pm.DestinationResource != other.DestinationResource ||
 		pm.AuthorizedUser != other.AuthorizedUser ||
-		pm.SessionPubKey != other.SessionPubKey {
+		pm.SessionPubKey != other.SessionPubKey ||
+		pm.SessionDisplayName != other.SessionDisplayName {
 		return false
 	}