Disable ownership on mobile

client/internal/profilemanager/migration.go

@@ -1,3 +1,5 @@
+//go:build !ios && !android
+
 package profilemanager
 
 import (

client/internal/profilemanager/migration_mobile.go

@@ -0,0 +1,23 @@
+//go:build ios || android
+
+package profilemanager
+
+import (
+	"os/user"
+	"strconv"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// MigrateLegacyProfiles is a no-op on mobile
+func (s *ServiceManager) MigrateLegacyProfiles() error {
+	return nil
+}
+
+// PrincipalForUser turns a resolved account into an owner principal.
+func PrincipalForUser(u *user.User) (string, bool) {
+	if uid, err := strconv.ParseUint(u.Uid, 10, 32); err == nil {
+		return ipcauth.UIDPrincipal(uint32(uid)), true
+	}
+	return "", false
+}

client/internal/profilemanager/migration_test.go

@@ -1,3 +1,5 @@
+//go:build !ios && !android
+
 package profilemanager
 
 import (

client/internal/profilemanager/profilemanager.go

@@ -44,6 +44,9 @@ func (p *Profile) AccessibleBy(id ipcauth.Identity) bool {
 	if !id.Known() {
 		return false
 	}
+	if ipcauth.ProfileOwnershipDisabled() {
+		return true
+	}
 	if ipcauth.IsPrivilegedCaller(id) {
 		return true
 	}

client/internal/profilemanager/profilemanager_test.go

@@ -7,8 +7,19 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 )
 
+func TestAccessibleByReachesUnownedProfileWhenOwnershipDisabled(t *testing.T) {
+	t.Setenv(ipcauth.EnvDisableProfileOwnership, "true")
+
+	unowned := Profile{}
+	caller := ipcauth.KnownForTest(ipcauth.Identity{UID: 4242})
+
+	assert.True(t, unowned.AccessibleBy(caller), "an unowned profile is reachable with ownership off")
+}
+
 func withTempConfigDir(t *testing.T, testFunc func(configDir string)) {
 	t.Helper()
 	tempDir := t.TempDir()