From 8ee434595caf902e3cf602496577970cba8af434 Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Wed, 12 Aug 2026 09:13:44 +0000 Subject: [PATCH] [client] Render remote-jobs config in the debug bundle TestAddConfig_AllFieldsCovered fails on any new Config field that is neither rendered nor excluded. Render RemoteJobsAllowed alongside the other collection toggles, and exclude DebugBundleUploadURL with a justification: it is an MDM-provided URL that can carry credentials or query tokens, so it stays out of the shared bundle. --- client/internal/debug/debug.go | 3 +++ client/internal/debug/debug_test.go | 14 ++++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/client/internal/debug/debug.go b/client/internal/debug/debug.go index dbe22139a..88785dddc 100644 --- a/client/internal/debug/debug.go +++ b/client/internal/debug/debug.go @@ -703,6 +703,9 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder) if g.internalConfig.ServerSSHAllowed != nil { configContent.WriteString(fmt.Sprintf("ServerSSHAllowed: %v\n", *g.internalConfig.ServerSSHAllowed)) } + if g.internalConfig.RemoteJobsAllowed != nil { + configContent.WriteString(fmt.Sprintf("RemoteJobsAllowed: %v\n", *g.internalConfig.RemoteJobsAllowed)) + } if g.internalConfig.EnableSSHRoot != nil { configContent.WriteString(fmt.Sprintf("EnableSSHRoot: %v\n", *g.internalConfig.EnableSSHRoot)) } diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go index 7fe93a5c1..5123ed68d 100644 --- a/client/internal/debug/debug_test.go +++ b/client/internal/debug/debug_test.go @@ -839,12 +839,13 @@ COMMIT` // the excluded set with a justification. func TestAddConfig_AllFieldsCovered(t *testing.T) { excluded := map[string]string{ - "PrivateKey": "sensitive: WireGuard private key", - "PreSharedKey": "sensitive: WireGuard pre-shared key", - "SSHKey": "sensitive: SSH private key", - "ClientCertKeyPair": "non-config: parsed cert pair, not serialized", - "Name": "non-config: profile name is not needed for debug purposes", - "policy": "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields", + "PrivateKey": "sensitive: WireGuard private key", + "PreSharedKey": "sensitive: WireGuard pre-shared key", + "SSHKey": "sensitive: SSH private key", + "ClientCertKeyPair": "non-config: parsed cert pair, not serialized", + "Name": "non-config: profile name is not needed for debug purposes", + "policy": "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields", + "DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle", } mURL, _ := url.Parse("https://api.example.com:443") @@ -864,6 +865,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) { RosenpassEnabled: true, RosenpassPermissive: true, ServerSSHAllowed: &bTrue, + RemoteJobsAllowed: &bTrue, EnableSSHRoot: &bTrue, EnableSSHSFTP: &bTrue, EnableSSHLocalPortForwarding: &bTrue,