[client] Drop the non-functional admin URL (#8267)

* [client] Drop the non-functional admin URL

#4218 deprecated --admin-url, but #3980 merged right after it and restored the flag and its wiring. The value has been stored and echoed back ever since, without anything reading it.

Stop sending it from the CLI, ignore it in the daemon and drop it from the profile config, the UI settings service and the debug bundle. The proto fields stay for older clients, and the mobile getters and setters keep their signatures as deprecated stubs.

* [client] Drop adminUrl from the Wails API reference

client/internal/debug/debug.go

@@ -174,7 +174,6 @@ The IP addresses in the interfaces file are anonymized using the same process as
 Configuration
 The config.txt file contains anonymized configuration information of the NetBird client. Sensitive information such as private keys and SSH keys are excluded. The following fields are anonymized:
 - ManagementURL
-- AdminURL
 - NATExternalIPs
 - CustomDNSAddress
 
@@ -602,9 +601,6 @@ func (g *BundleGenerator) addConfig() error {
 		if g.internalConfig.ManagementURL != nil {
 			configContent.WriteString(fmt.Sprintf("ManagementURL: %s\n", g.anonymizer.AnonymizeURI(g.internalConfig.ManagementURL.String())))
 		}
-		if g.internalConfig.AdminURL != nil {
-			configContent.WriteString(fmt.Sprintf("AdminURL: %s\n", g.anonymizer.AnonymizeURI(g.internalConfig.AdminURL.String())))
-		}
 		configContent.WriteString(fmt.Sprintf("NATExternalIPs: %v\n", anonymizeNATExternalIPs(g.internalConfig.NATExternalIPs, g.anonymizer)))
 		if g.internalConfig.CustomDNSAddress != "" {
 			configContent.WriteString(fmt.Sprintf("CustomDNSAddress: %s\n", g.anonymizer.AnonymizeString(g.internalConfig.CustomDNSAddress)))
@@ -613,9 +609,6 @@ func (g *BundleGenerator) addConfig() error {
 		if g.internalConfig.ManagementURL != nil {
 			configContent.WriteString(fmt.Sprintf("ManagementURL: %s\n", g.internalConfig.ManagementURL.String()))
 		}
-		if g.internalConfig.AdminURL != nil {
-			configContent.WriteString(fmt.Sprintf("AdminURL: %s\n", g.internalConfig.AdminURL.String()))
-		}
 		configContent.WriteString(fmt.Sprintf("NATExternalIPs: %v\n", g.internalConfig.NATExternalIPs))
 		if g.internalConfig.CustomDNSAddress != "" {
 			configContent.WriteString(fmt.Sprintf("CustomDNSAddress: %s\n", g.internalConfig.CustomDNSAddress))

client/internal/debug/debug_test.go

@@ -856,14 +856,12 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 	}
 
 	mURL, _ := url.Parse("https://api.example.com:443")
-	aURL, _ := url.Parse("https://admin.example.com:443")
 	bTrue := true
 	iVal := 42
 	cfg := &profilemanager.Config{
 		PrivateKey:                    "priv",
 		PreSharedKey:                  "psk",
 		ManagementURL:                 mURL,
-		AdminURL:                      aURL,
 		WgIface:                       "wt0",
 		WgPort:                        51820,
 		NetworkMonitor:                &bTrue,
@@ -947,7 +945,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 }
 
 // renderAddConfigSpecific renders the fields handled by the anonymize/non-anonymize
-// branches in addConfig (ManagementURL, AdminURL, NATExternalIPs, CustomDNSAddress).
+// branches in addConfig (ManagementURL, NATExternalIPs, CustomDNSAddress).
 // addCommonConfigFields covers the rest. Keeping this in the test mirrors the
 // production shape without needing to write an actual zip.
 func renderAddConfigSpecific(g *BundleGenerator) string {
@@ -956,9 +954,6 @@ func renderAddConfigSpecific(g *BundleGenerator) string {
 		if g.internalConfig.ManagementURL != nil {
 			sb.WriteString("ManagementURL: " + g.anonymizer.AnonymizeURI(g.internalConfig.ManagementURL.String()) + "\n")
 		}
-		if g.internalConfig.AdminURL != nil {
-			sb.WriteString("AdminURL: " + g.anonymizer.AnonymizeURI(g.internalConfig.AdminURL.String()) + "\n")
-		}
 		sb.WriteString("NATExternalIPs: x\n")
 		if g.internalConfig.CustomDNSAddress != "" {
 			sb.WriteString("CustomDNSAddress: " + g.anonymizer.AnonymizeString(g.internalConfig.CustomDNSAddress) + "\n")
@@ -967,9 +962,6 @@ func renderAddConfigSpecific(g *BundleGenerator) string {
 		if g.internalConfig.ManagementURL != nil {
 			sb.WriteString("ManagementURL: " + g.internalConfig.ManagementURL.String() + "\n")
 		}
-		if g.internalConfig.AdminURL != nil {
-			sb.WriteString("AdminURL: " + g.internalConfig.AdminURL.String() + "\n")
-		}
 		sb.WriteString("NATExternalIPs: x\n")
 		if g.internalConfig.CustomDNSAddress != "" {
 			sb.WriteString("CustomDNSAddress: " + g.internalConfig.CustomDNSAddress + "\n")

client/internal/profilemanager/config.go

@@ -36,7 +36,8 @@ const (
 	DefaultManagementURL = "https://api.netbird.io:443"
 	// oldDefaultManagementURL points to the NetBird's old cloud management endpoint
 	oldDefaultManagementURL = "https://api.wiretrustee.com:443"
-	// DefaultAdminURL points to NetBird's cloud management console
+	// DefaultAdminURL points to NetBird's cloud management console. It is only
+	// reported by the deprecated mobile admin URL getters.
 	DefaultAdminURL = "https://app.netbird.io:443"
 )
 
@@ -60,7 +61,6 @@ var DefaultInterfaceBlacklist = []string{
 // ConfigInput carries configuration changes to the client
 type ConfigInput struct {
 	ManagementURL                 string
-	AdminURL                      string
 	ConfigPath                    string
 	StateFilePath                 string
 	PreSharedKey                  *string
@@ -114,7 +114,6 @@ type Config struct {
 	PrivateKey                    string
 	PreSharedKey                  string
 	ManagementURL                 *url.URL
-	AdminURL                      *url.URL
 	WgIface                       string
 	WgPort                        int
 	NetworkMonitor                *bool
@@ -508,29 +507,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 	}
 
-	if config.AdminURL == nil {
-		log.Infof("using default Admin URL %s", DefaultAdminURL)
-		config.AdminURL, err = parseURL("Admin URL", DefaultAdminURL)
-		if err != nil {
-			return false, err
-		}
-	}
-	// The admin panel is opened, not dialed, so unlike the Management URL its
-	// path is part of what identifies it: a panel served under /netbird is not
-	// the one served at the root.
-	if input.AdminURL != "" {
-		newURL, err := parseURL("Admin Panel URL", input.AdminURL)
-		if err != nil {
-			return updated, err
-		}
-		if !SameServiceURLIncludingPath(newURL, config.AdminURL) {
-			log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
-				newURL.String(), config.AdminURL.String())
-			config.AdminURL = newURL
-			updated = true
-		}
-	}
-
 	if input.WireguardPort != nil && *input.WireguardPort != config.WgPort {
 		log.Infof("updating Wireguard port %d (old value %d)",
 			*input.WireguardPort, config.WgPort)
@@ -1027,8 +1003,7 @@ func ParseServiceURL(serviceName, serviceURL string) (*url.URL, error) {
 // matches only another nil one.
 //
 // The path plays no part: a management URL is dialed, and only its host and
-// port are. util.SameServiceURL is this comparison plus the path, which is
-// what SameServiceURLIncludingPath needs and delegates to.
+// port are. util.SameServiceURL is this comparison plus the path.
 func SameServiceURL(a, b *url.URL) bool {
 	if a == nil || b == nil {
 		return a == b
@@ -1039,25 +1014,6 @@ func SameServiceURL(a, b *url.URL) bool {
 		util.ServiceURLPort(a) == util.ServiceURLPort(b)
 }
 
-// SameServiceURLIncludingPath is SameServiceURL plus everything a URL carries
-// past its endpoint: path, query, fragment and userinfo.
-//
-// Use it for a URL that gets opened rather than dialed. The admin panel can
-// live under a path, so two URLs with the same endpoint and different paths are
-// two different panels — where for a URL the client dials over gRPC only the
-// endpoint is ever used. Equivalent spellings still compare equal: a missing
-// path and "/" are the same root, and so is a trailing slash on any path.
-func SameServiceURLIncludingPath(a, b *url.URL) bool {
-	if a == nil || b == nil {
-		return a == b
-	}
-
-	return util.SameServiceURL(a, b) &&
-		a.RawQuery == b.RawQuery &&
-		a.Fragment == b.Fragment &&
-		a.User.String() == b.User.String()
-}
-
 func parseURL(serviceName, serviceURL string) (*url.URL, error) {
 	parsedMgmtURL, err := url.ParseRequestURI(serviceURL)
 	if err != nil {

client/internal/profilemanager/config_test.go

@@ -36,17 +36,14 @@ func TestGetConfig(t *testing.T) {
 	}
 
 	assert.Equal(t, config.ManagementURL.String(), DefaultManagementURL)
-	assert.Equal(t, config.AdminURL.String(), DefaultAdminURL)
 
 	managementURL := "https://test.management.url:33071"
-	adminURL := "https://app.admin.url:443"
 	path := filepath.Join(t.TempDir(), "config.json")
 	preSharedKey := "preSharedKey"
 
 	// case 2: new config has to be generated
 	config, err = UpdateOrCreateConfig(ConfigInput{
 		ManagementURL: managementURL,
-		AdminURL:      adminURL,
 		ConfigPath:    path,
 		PreSharedKey:  &preSharedKey,
 	})
@@ -64,7 +61,6 @@ func TestGetConfig(t *testing.T) {
 	// case 3: existing config -> fetch it
 	config, err = UpdateOrCreateConfig(ConfigInput{
 		ManagementURL: managementURL,
-		AdminURL:      adminURL,
 		ConfigPath:    path,
 		PreSharedKey:  &preSharedKey,
 	})
@@ -79,7 +75,6 @@ func TestGetConfig(t *testing.T) {
 	newManagementURL := "https://test.newManagement.url:33071"
 	config, err = UpdateOrCreateConfig(ConfigInput{
 		ManagementURL: newManagementURL,
-		AdminURL:      adminURL,
 		ConfigPath:    path,
 		PreSharedKey:  &preSharedKey,
 	})
@@ -164,7 +159,6 @@ func TestNewProfileDefaults(t *testing.T) {
 	require.NoError(t, err, "should create new config")
 
 	assert.Equal(t, DefaultManagementURL, config.ManagementURL.String(), "ManagementURL should have default")
-	assert.Equal(t, DefaultAdminURL, config.AdminURL.String(), "AdminURL should have default")
 	assert.NotEmpty(t, config.PrivateKey, "PrivateKey should be generated")
 	assert.NotEmpty(t, config.SSHKey, "SSHKey should be generated")
 	assert.Equal(t, iface.WgInterfaceDefault, config.WgIface, "WgIface should have default")

client/internal/profilemanager/config_would_change_test.go

@@ -334,40 +334,34 @@ func TestCreateInMemoryConfigCarriesAnIdentity(t *testing.T) {
 	require.NotEmpty(t, cfg.SSHKey)
 }
 
-// The admin panel is opened, not dialed, so its path identifies it. Comparing
-// it as a bare endpoint left a custom panel URL unable to change.
-func TestAdminURLPathIsPartOfTheIdentity(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "panel.json")
-	_, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: path,
-		AdminURL:   "https://app.example.com/netbird",
-	})
+// Profiles written before the admin URL was dropped still carry an AdminURL key.
+// It must not break loading, and the next write must drop it.
+func TestLegacyAdminURLIsIgnored(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "legacy.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
 	require.NoError(t, err)
 
-	cfg, err := GetExistingConfig(path)
+	raw, err := os.ReadFile(path)
 	require.NoError(t, err)
-	require.Equal(t, "https://app.example.com:443/netbird", cfg.AdminURL.String())
-
-	// Equivalent spellings of the same panel are still not a change.
-	for _, same := range []string{
-		"https://app.example.com/netbird",
-		"https://app.example.com:443/netbird",
-		"https://app.example.com/netbird/",
-		"https://APP.example.com/netbird",
-	} {
-		changed, err := cfg.WouldChange(ConfigInput{AdminURL: same})
-		require.NoError(t, err)
-		require.False(t, changed, "%q is the stored panel written differently", same)
-	}
-
-	// A different path is a different panel, and it must be persisted.
-	changed, err := cfg.WouldChange(ConfigInput{AdminURL: "https://app.example.com/other"})
+	var stored map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(raw, &stored))
+	stored["AdminURL"] = json.RawMessage(`{"Scheme":"https","Host":"panel.example.com:443","Path":"/netbird"}`)
+	rewritten, err := json.Marshal(stored)
 	require.NoError(t, err)
-	require.True(t, changed, "a different panel path is a change")
+	require.NoError(t, os.WriteFile(path, rewritten, 0600))
 
-	updated, err := UpdateConfig(ConfigInput{ConfigPath: path, AdminURL: "https://app.example.com/other"})
+	_, err = GetExistingConfig(path)
+	require.NoError(t, err, "a legacy AdminURL key must not prevent loading the profile")
+
+	port := 51999
+	_, err = UpdateConfig(ConfigInput{ConfigPath: path, WireguardPort: &port})
 	require.NoError(t, err)
-	require.Equal(t, "https://app.example.com:443/other", updated.AdminURL.String(), "the new panel path was not persisted")
+
+	raw, err = os.ReadFile(path)
+	require.NoError(t, err)
+	stored = nil
+	require.NoError(t, json.Unmarshal(raw, &stored))
+	require.NotContains(t, stored, "AdminURL", "the legacy AdminURL key should be dropped on write")
 }
 
 // unsetOnDisk rewrites the stored config so the named fields carry a JSON null,