From 90be56788ab7fbcfc15caf084ce896260eec9248 Mon Sep 17 00:00:00 2001
From: Eduard Gert <kontakt@eduardgert.de>
Date: Mon, 15 Jun 2026 13:20:16 +0200
Subject: [PATCH] fix mdm allowserverssh

---
 .../modules/settings/SettingsNavigation.tsx   | 27 +++++++++----------
 .../src/modules/settings/SettingsPage.tsx     |  2 +-
 client/ui/services/settings.go                |  7 +++++
 3 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
index a48c4099d..1907c2114 100644
--- a/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
@@ -19,6 +19,7 @@ export const SettingsNavigation = () => {
     const { t } = useTranslation();
     const { updateAvailable } = useClientVersion();
     const { mdm, features } = useRestrictions();
+    const showSsh = mdm.allowServerSSH || !features.disableUpdateSettings;
 
     const aboutAdornment = updateAvailable ? (
         <Tooltip content={t("settings.tabs.updateAvailable")} side={"right"}>
@@ -55,21 +56,19 @@ export const SettingsNavigation = () => {
                         title={t("settings.tabs.profiles")}
                     />
                 )}
+                {showSsh && (
+                    <VerticalTabs.Trigger
+                        value={"ssh"}
+                        icon={SquareTerminalIcon}
+                        title={t("settings.tabs.ssh")}
+                    />
+                )}
                 {!features.disableUpdateSettings && (
-                    <>
-                        {!mdm.allowServerSSH && (
-                            <VerticalTabs.Trigger
-                                value={"ssh"}
-                                icon={SquareTerminalIcon}
-                                title={t("settings.tabs.ssh")}
-                            />
-                        )}
-                        <VerticalTabs.Trigger
-                            value={"advanced"}
-                            icon={BoltIcon}
-                            title={t("settings.tabs.advanced")}
-                        />
-                    </>
+                    <VerticalTabs.Trigger
+                        value={"advanced"}
+                        icon={BoltIcon}
+                        title={t("settings.tabs.advanced")}
+                    />
                 )}
                 <VerticalTabs.Trigger
                     value={"troubleshooting"}
diff --git a/client/ui/frontend/src/modules/settings/SettingsPage.tsx b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
index b41d37475..ce3924647 100644
--- a/client/ui/frontend/src/modules/settings/SettingsPage.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
@@ -54,7 +54,7 @@ export const SettingsPage = () => {
             [Tab.Network]: editable,
             [Tab.Security]: editable,
             [Tab.Profiles]: !features.disableProfiles,
-            [Tab.SSH]: editable && !mdm.allowServerSSH,
+            [Tab.SSH]: mdm.allowServerSSH || editable,
             [Tab.Advanced]: editable,
             [Tab.Troubleshooting]: true,
             [Tab.About]: true,
diff --git a/client/ui/services/settings.go b/client/ui/services/settings.go
index 253051f50..eb01b1e8a 100644
--- a/client/ui/services/settings.go
+++ b/client/ui/services/settings.go
@@ -235,6 +235,10 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 			if v.Field(i).Kind() != reflect.Bool {
 				continue
 			}
+			// AllowServerSSH carries the resolved value (like ManagementURL), not the is-managed flag.
+			if t.Field(i).Name == "AllowServerSSH" {
+				continue
+			}
 			if _, ok := set[t.Field(i).Tag.Get("json")]; ok {
 				v.Field(i).SetBool(true)
 			}
@@ -242,6 +246,9 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 		if _, ok := set["managementURL"]; ok {
 			r.MDM.ManagementURL = cfgResp.GetManagementUrl()
 		}
+		if _, ok := set["allowServerSSH"]; ok {
+			r.MDM.AllowServerSSH = cfgResp.GetServerSSHAllowed()
+		}
 	}
 	r.MDM.DisableAdvancedView = featResp.GetDisableAdvancedView()
 	return r, nil