Merge remote-tracking branch 'origin/main' into feat-post_quantum_ml_kem

# Conflicts:
#	.github/workflows/wasm-build-validation.yml

client/server/server.go

@@ -595,9 +595,6 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 	if msg.ManagementUrl != "" {
 		config.ManagementURL = msg.ManagementUrl
 	}
-	if msg.AdminURL != "" {
-		config.AdminURL = msg.AdminURL
-	}
 	if msg.InterfaceName != nil {
 		config.InterfaceName = msg.InterfaceName
 	}
@@ -2413,7 +2410,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 	// overlay (Loader lives outside profilemanager).
 	cfg.ApplyMDMPolicy(s.mdmLoader.Load())
 	managementURL := cfg.ManagementURL
-	adminURL := cfg.AdminURL
 
 	var preSharedKey = cfg.PreSharedKey
 	if preSharedKey != "" {
@@ -2469,7 +2465,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 	return &proto.GetConfigResponse{
 		ManagementUrl:                 managementURL.String(),
 		PreSharedKey:                  preSharedKey,
-		AdminURL:                      adminURL.String(),
 		InterfaceName:                 cfg.WgIface,
 		WireguardPort:                 int64(cfg.WgPort),
 		Mtu:                           int64(cfg.MTU),

client/server/setconfig_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"os"
 	"os/user"
 	"path/filepath"
 	"reflect"
@@ -129,7 +130,10 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, "https://new-api.netbird.io:443", cfg.ManagementURL.String())
-	require.Equal(t, "https://new-admin.netbird.io:443", cfg.AdminURL.String())
+	// Older clients still send the deprecated admin URL; it must be ignored.
+	raw, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+	require.NotContains(t, string(raw), "new-admin.netbird.io", "deprecated AdminURL must not be persisted")
 	require.Equal(t, rosenpassEnabled, cfg.RosenpassEnabled)
 	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
 	require.NotNil(t, cfg.ServerSSHAllowed)
@@ -182,11 +186,11 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"CleanNATExternalIPs":   true, // control flag for clearing
 		"CleanDNSLabels":        true, // control flag for clearing
 		"LazyConnectionEnabled": true, // deprecated: proto field retained for compat, no longer applied
+		"AdminURL":              true, // deprecated: proto field retained for compat, no longer applied
 	}
 
 	expectedFields := map[string]bool{
 		"ManagementUrl":                 true,
-		"AdminURL":                      true,
 		"RosenpassEnabled":              true,
 		"RosenpassPermissive":           true,
 		"ServerSSHAllowed":              true,
@@ -249,7 +253,6 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 	// This map must be updated when adding new config-related CLI flags.
 	flagToField := map[string]string{
 		"management-url":                    "ManagementUrl",
-		"admin-url":                         "AdminURL",
 		"enable-rosenpass":                  "RosenpassEnabled",
 		"rosenpass-permissive":              "RosenpassPermissive",
 		"allow-server-ssh":                  "ServerSSHAllowed",
@@ -286,6 +289,7 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 	fieldsWithoutCLIFlags := map[string]bool{
 		"DisableNotifications":  true, // Only settable via UI
 		"LazyConnectionEnabled": true, // deprecated: no longer settable (managed by server + NB_LAZY_CONN)
+		"AdminURL":              true, // deprecated: the admin-url flag is no longer functional
 	}
 
 	// Get all SetConfigRequest fields to verify our map is complete.