Replace VNC JWT auth with a Noise_IK handshake bound to ACL-pushed pubkeys

shared/management/http/api/openapi.yml

@@ -1007,6 +1007,10 @@ components:
           items:
             type: string
             example: "tcp/80"
+        session_pub_key:
+          description: Ephemeral Ed25519 public key the requester will sign session-binding challenges with. Required for VNC rules; ignored for SSH and L4.
+          type: string
+          example: "n0r3pL4c3h0ld3rK3y=="
       required:
         - name
         - wg_pub_key
@@ -1028,10 +1032,15 @@ components:
           items:
             type: string
             example: "tcp/80"
+        target_pub_key:
+          description: Identity public key of the destination peer the temporary access was requested for. Used by the requester to verify the destination daemon's identity before transmitting credentials.
+          type: string
+          example: "n0r3pL4c3h0ld3rK3y=="
       required:
         - name
         - id
         - rules
+        - target_pub_key
     AccessiblePeer:
       allOf:
         - $ref: '#/components/schemas/PeerMinimum'

shared/management/http/api/types.gen.go

@@ -3391,6 +3391,9 @@ type PeerTemporaryAccessRequest struct {
 	// Rules List of temporary access rules
 	Rules []string `json:"rules"`
 
+	// SessionPubKey Ephemeral Ed25519 public key the requester will sign session-binding challenges with. Required for VNC rules; ignored for SSH and L4.
+	SessionPubKey *string `json:"session_pub_key,omitempty"`
+
 	// WgPubKey Peer's WireGuard public key
 	WgPubKey string `json:"wg_pub_key"`
 }
@@ -3405,6 +3408,9 @@ type PeerTemporaryAccessResponse struct {
 
 	// Rules List of temporary access rules
 	Rules []string `json:"rules"`
+
+	// TargetPubKey Identity public key of the destination peer the temporary access was requested for. Used by the requester to verify the destination daemon's identity before transmitting credentials.
+	TargetPubKey string `json:"target_pub_key"`
 }
 
 // PersonalAccessToken defines model for PersonalAccessToken.

shared/management/proto/management.proto

@@ -428,9 +428,6 @@ message MachineUserIndexes {
 
 // VNCAuth represents VNC authorization configuration for a peer.
 message VNCAuth {
-  // UserIDClaim is the JWT claim to be used to get the users ID
-  string UserIDClaim = 1;
-
   // AuthorizedUsers is a list of hashed user IDs authorized to access this peer via VNC
   repeated bytes AuthorizedUsers = 2;
 
@@ -438,6 +435,24 @@ message VNCAuth {
   // Used in session mode to determine which OS user to create the virtual session as.
   // The wildcard "*" allows any OS user.
   map<string, MachineUserIndexes> machine_users = 3;
+
+  // SessionPubKeys are short-lived X25519 static keypairs the dashboard
+  // (or other temporary-access clients) registers per session. The
+  // daemon runs a Noise_IK handshake against the matching pubkey to
+  // authenticate the connection and resolve the pubkey back to a user.
+  repeated SessionPubKey session_pub_keys = 4;
+}
+
+// SessionPubKey binds an ephemeral X25519 static public key to a hashed
+// user identity so the daemon can authorize VNC connections that
+// complete a Noise_IK handshake with the matching private key.
+message SessionPubKey {
+  // PubKey is the 32-byte X25519 static public key.
+  bytes pub_key = 1;
+
+  // UserIDHash is the BLAKE2b-128 hash of the user ID this session
+  // belongs to, matching the entries in VNCAuth.AuthorizedUsers.
+  bytes user_id_hash = 2;
 }
 
 // RemotePeerConfig represents a configuration of a remote peer.