Add ssh authenatication with jwt (#4550)

client/ssh/client/client.go

@@ -21,6 +21,8 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/netbirdio/netbird/client/proto"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/detection"
 )
 
 const (
@@ -40,12 +42,10 @@ type Client struct {
 	windowsStdinMode  uint32 // nolint:unused
 }
 
-// Close terminates the SSH connection
 func (c *Client) Close() error {
 	return c.client.Close()
 }
 
-// OpenTerminal opens an interactive terminal session
 func (c *Client) OpenTerminal(ctx context.Context) error {
 	session, err := c.client.NewSession()
 	if err != nil {
@@ -259,43 +259,29 @@ func (c *Client) createSession(ctx context.Context) (*ssh.Session, func(), error
 	return session, cleanup, nil
 }
 
-// Dial connects to the given ssh server with proper host key verification
-func Dial(ctx context.Context, addr, user string) (*Client, error) {
-	hostKeyCallback, err := createHostKeyCallback(addr)
-	if err != nil {
-		return nil, fmt.Errorf("create host key callback: %w", err)
+// getDefaultDaemonAddr returns the daemon address from environment or default for the OS
+func getDefaultDaemonAddr() string {
+	if addr := os.Getenv("NB_DAEMON_ADDR"); addr != "" {
+		return addr
 	}
-
-	config := &ssh.ClientConfig{
-		User:            user,
-		Timeout:         30 * time.Second,
-		HostKeyCallback: hostKeyCallback,
+	if runtime.GOOS == "windows" {
+		return DefaultDaemonAddrWindows
 	}
-
-	return dial(ctx, "tcp", addr, config)
-}
-
-// DialInsecure connects to the given ssh server without host key verification (for testing only)
-func DialInsecure(ctx context.Context, addr, user string) (*Client, error) {
-	config := &ssh.ClientConfig{
-		User:            user,
-		Timeout:         30 * time.Second,
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 - Only used for tests
-	}
-
-	return dial(ctx, "tcp", addr, config)
+	return DefaultDaemonAddr
 }
 
 // DialOptions contains options for SSH connections
 type DialOptions struct {
-	KnownHostsFile string
-	IdentityFile   string
-	DaemonAddr     string
+	KnownHostsFile     string
+	IdentityFile       string
+	DaemonAddr         string
+	SkipCachedToken    bool
+	InsecureSkipVerify bool
 }
 
-// DialWithOptions connects to the given ssh server with specified options
-func DialWithOptions(ctx context.Context, addr, user string, opts DialOptions) (*Client, error) {
-	hostKeyCallback, err := createHostKeyCallbackWithOptions(addr, opts)
+// Dial connects to the given ssh server with specified options
+func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, error) {
+	hostKeyCallback, err := createHostKeyCallback(opts)
 	if err != nil {
 		return nil, fmt.Errorf("create host key callback: %w", err)
 	}
@@ -306,7 +292,6 @@ func DialWithOptions(ctx context.Context, addr, user string, opts DialOptions) (
 		HostKeyCallback: hostKeyCallback,
 	}
 
-	// Add SSH key authentication if identity file is specified
 	if opts.IdentityFile != "" {
 		authMethod, err := createSSHKeyAuth(opts.IdentityFile)
 		if err != nil {
@@ -315,11 +300,16 @@ func DialWithOptions(ctx context.Context, addr, user string, opts DialOptions) (
 		config.Auth = append(config.Auth, authMethod)
 	}
 
-	return dial(ctx, "tcp", addr, config)
+	daemonAddr := opts.DaemonAddr
+	if daemonAddr == "" {
+		daemonAddr = getDefaultDaemonAddr()
+	}
+
+	return dialWithJWT(ctx, "tcp", addr, config, daemonAddr, opts.SkipCachedToken)
 }
 
-// dial establishes an SSH connection
-func dial(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
+// dialSSH establishes an SSH connection without JWT authentication
+func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
 	dialer := &net.Dialer{}
 	conn, err := dialer.DialContext(ctx, network, addr)
 	if err != nil {
@@ -340,143 +330,84 @@ func dial(ctx context.Context, network, addr string, config *ssh.ClientConfig) (
 	}, nil
 }
 
-// createHostKeyCallback creates a host key verification callback that checks daemon first, then known_hosts files
-func createHostKeyCallback(addr string) (ssh.HostKeyCallback, error) {
-	daemonAddr := os.Getenv("NB_DAEMON_ADDR")
-	if daemonAddr == "" {
-		if runtime.GOOS == "windows" {
-			daemonAddr = DefaultDaemonAddrWindows
-		} else {
-			daemonAddr = DefaultDaemonAddr
-		}
+// dialWithJWT establishes an SSH connection with optional JWT authentication based on server detection
+func dialWithJWT(ctx context.Context, network, addr string, config *ssh.ClientConfig, daemonAddr string, skipCache bool) (*Client, error) {
+	host, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, fmt.Errorf("parse address %s: %w", addr, err)
 	}
-	return createHostKeyCallbackWithDaemonAddr(addr, daemonAddr)
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return nil, fmt.Errorf("parse port %s: %w", portStr, err)
+	}
+
+	dialer := &net.Dialer{Timeout: detection.Timeout}
+	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
+	if err != nil {
+		return nil, fmt.Errorf("SSH server detection failed: %w", err)
+	}
+
+	if !serverType.RequiresJWT() {
+		return dialSSH(ctx, network, addr, config)
+	}
+
+	jwtCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	jwtToken, err := requestJWTToken(jwtCtx, daemonAddr, skipCache)
+	if err != nil {
+		return nil, fmt.Errorf("request JWT token: %w", err)
+	}
+
+	configWithJWT := nbssh.AddJWTAuth(config, jwtToken)
+	return dialSSH(ctx, network, addr, configWithJWT)
 }
 
-// createHostKeyCallbackWithDaemonAddr creates a host key verification callback with specified daemon address
-func createHostKeyCallbackWithDaemonAddr(addr, daemonAddr string) (ssh.HostKeyCallback, error) {
-	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
-		// First try to get host key from NetBird daemon
-		if err := verifyHostKeyViaDaemon(hostname, remote, key, daemonAddr); err == nil {
-			return nil
-		}
+// requestJWTToken requests a JWT token from the NetBird daemon
+func requestJWTToken(ctx context.Context, daemonAddr string, skipCache bool) (string, error) {
+	conn, err := connectToDaemon(daemonAddr)
+	if err != nil {
+		return "", fmt.Errorf("connect to daemon: %w", err)
+	}
+	defer conn.Close()
 
-		// Fallback to known_hosts files
-		knownHostsFiles := getKnownHostsFiles()
-
-		var hostKeyCallbacks []ssh.HostKeyCallback
-
-		for _, file := range knownHostsFiles {
-			if callback, err := knownhosts.New(file); err == nil {
-				hostKeyCallbacks = append(hostKeyCallbacks, callback)
-			}
-		}
-
-		// Try each known_hosts callback
-		for _, callback := range hostKeyCallbacks {
-			if err := callback(hostname, remote, key); err == nil {
-				return nil
-			}
-		}
-
-		return fmt.Errorf("host key verification failed: key not found in NetBird daemon or any known_hosts file")
-	}, nil
+	client := proto.NewDaemonServiceClient(conn)
+	return nbssh.RequestJWTToken(ctx, client, os.Stdout, os.Stderr, !skipCache)
 }
 
 // verifyHostKeyViaDaemon verifies SSH host key by querying the NetBird daemon
 func verifyHostKeyViaDaemon(hostname string, remote net.Addr, key ssh.PublicKey, daemonAddr string) error {
-	client, err := connectToDaemon(daemonAddr)
+	conn, err := connectToDaemon(daemonAddr)
 	if err != nil {
 		return err
 	}
 	defer func() {
-		if err := client.Close(); err != nil {
+		if err := conn.Close(); err != nil {
 			log.Debugf("daemon connection close error: %v", err)
 		}
 	}()
 
-	addresses := buildAddressList(hostname, remote)
-	log.Debugf("verifying SSH host key for hostname=%s, remote=%s, addresses=%v", hostname, remote.String(), addresses)
-
-	return verifyKeyWithDaemon(client, addresses, key)
+	client := proto.NewDaemonServiceClient(conn)
+	verifier := nbssh.NewDaemonHostKeyVerifier(client)
+	callback := nbssh.CreateHostKeyCallback(verifier)
+	return callback(hostname, remote, key)
 }
 
 func connectToDaemon(daemonAddr string) (*grpc.ClientConn, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
+	addr := strings.TrimPrefix(daemonAddr, "tcp://")
 
-	conn, err := grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(daemonAddr, "tcp://"),
+	conn, err := grpc.NewClient(
+		addr,
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
 	)
 	if err != nil {
-		log.Debugf("failed to connect to NetBird daemon at %s: %v", daemonAddr, err)
+		log.Debugf("failed to create gRPC client for NetBird daemon at %s: %v", daemonAddr, err)
 		return nil, fmt.Errorf("failed to connect to NetBird daemon: %w", err)
 	}
+
 	return conn, nil
 }
 
-func buildAddressList(hostname string, remote net.Addr) []string {
-	addresses := []string{hostname}
-	if host, _, err := net.SplitHostPort(remote.String()); err == nil {
-		if host != hostname {
-			addresses = append(addresses, host)
-		}
-	}
-	return addresses
-}
-
-func verifyKeyWithDaemon(conn *grpc.ClientConn, addresses []string, key ssh.PublicKey) error {
-	client := proto.NewDaemonServiceClient(conn)
-
-	for _, addr := range addresses {
-		if err := checkAddressKey(client, addr, key); err == nil {
-			return nil
-		}
-	}
-	return fmt.Errorf("SSH host key not found or does not match in NetBird daemon")
-}
-
-func checkAddressKey(client proto.DaemonServiceClient, addr string, key ssh.PublicKey) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	response, err := client.GetPeerSSHHostKey(ctx, &proto.GetPeerSSHHostKeyRequest{
-		PeerAddress: addr,
-	})
-	log.Debugf("daemon query for address %s: found=%v, error=%v", addr, response != nil && response.GetFound(), err)
-
-	if err != nil {
-		log.Debugf("daemon query error for %s: %v", addr, err)
-		return err
-	}
-
-	if !response.GetFound() {
-		log.Debugf("SSH host key not found in daemon for address: %s", addr)
-		return fmt.Errorf("key not found")
-	}
-
-	return compareKeys(response.GetSshHostKey(), key, addr)
-}
-
-func compareKeys(storedKeyData []byte, presentedKey ssh.PublicKey, addr string) error {
-	storedKey, _, _, _, err := ssh.ParseAuthorizedKey(storedKeyData)
-	if err != nil {
-		log.Debugf("failed to parse stored SSH host key for %s: %v", addr, err)
-		return err
-	}
-
-	if presentedKey.Type() == storedKey.Type() && string(presentedKey.Marshal()) == string(storedKey.Marshal()) {
-		log.Debugf("SSH host key verified via NetBird daemon for %s", addr)
-		return nil
-	}
-
-	log.Debugf("SSH host key mismatch for %s: stored type=%s, presented type=%s", addr, storedKey.Type(), presentedKey.Type())
-	return fmt.Errorf("key mismatch")
-}
-
 // getKnownHostsFiles returns paths to known_hosts files in order of preference
 func getKnownHostsFiles() []string {
 	var files []string
@@ -503,8 +434,12 @@ func getKnownHostsFiles() []string {
 	return files
 }
 
-// createHostKeyCallbackWithOptions creates a host key verification callback with custom options
-func createHostKeyCallbackWithOptions(addr string, opts DialOptions) (ssh.HostKeyCallback, error) {
+// createHostKeyCallback creates a host key verification callback
+func createHostKeyCallback(opts DialOptions) (ssh.HostKeyCallback, error) {
+	if opts.InsecureSkipVerify {
+		return ssh.InsecureIgnoreHostKey(), nil // #nosec G106 - User explicitly requested insecure mode
+	}
+
 	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
 		if err := tryDaemonVerification(hostname, remote, key, opts.DaemonAddr); err == nil {
 			return nil

client/ssh/client/client_test.go

@@ -7,29 +7,36 @@ import (
 	"io"
 	"net"
 	"os"
-	"os/exec"
 	"os/user"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	cryptossh "golang.org/x/crypto/ssh"
 
 	"github.com/netbirdio/netbird/client/ssh"
 	sshserver "github.com/netbirdio/netbird/client/ssh/server"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
 )
 
 // TestMain handles package-level setup and cleanup
 func TestMain(m *testing.M) {
+	// Guard against infinite recursion when test binary is called as "netbird ssh exec"
+	// This happens when running tests as non-privileged user with fallback
+	if len(os.Args) > 2 && os.Args[1] == "ssh" && os.Args[2] == "exec" {
+		// Just exit with error to break the recursion
+		fmt.Fprintf(os.Stderr, "Test binary called as 'ssh exec' - preventing infinite recursion\n")
+		os.Exit(1)
+	}
+
 	// Run tests
 	code := m.Run()
 
 	// Cleanup any created test users
-	cleanupTestUsers()
+	testutil.CleanupTestUsers()
 
 	os.Exit(code)
 }
@@ -39,19 +46,14 @@ func TestSSHClient_DialWithKey(t *testing.T) {
 	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
 	require.NoError(t, err)
 
-	// Generate client key pair
-	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
-	require.NoError(t, err)
-	clientPubKey, err := ssh.GeneratePublicKey(clientPrivKey)
-	require.NoError(t, err)
-
 	// Create and start server
-	server := sshserver.New(hostKey)
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
 	server.SetAllowRootLogin(true) // Allow root/admin login for tests
 
-	err = server.AddAuthorizedKey("test-peer", string(clientPubKey))
-	require.NoError(t, err)
-
 	serverAddr := sshserver.StartTestServer(t, server)
 	defer func() {
 		err := server.Stop()
@@ -62,8 +64,10 @@ func TestSSHClient_DialWithKey(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	currentUser := getCurrentUsername()
-	client, err := DialInsecure(ctx, serverAddr, currentUser)
+	currentUser := testutil.GetTestUsername(t)
+	client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+		InsecureSkipVerify: true,
+	})
 	require.NoError(t, err)
 	defer func() {
 		err := client.Close()
@@ -75,7 +79,7 @@ func TestSSHClient_DialWithKey(t *testing.T) {
 }
 
 func TestSSHClient_CommandExecution(t *testing.T) {
-	if runtime.GOOS == "windows" && isCI() {
+	if runtime.GOOS == "windows" && testutil.IsCI() {
 		t.Skip("Skipping Windows command execution tests in CI due to S4U authentication issues")
 	}
 
@@ -129,20 +133,16 @@ func TestSSHClient_ConnectionHandling(t *testing.T) {
 	}()
 
 	// Generate client key for multiple connections
-	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
-	require.NoError(t, err)
-	clientPubKey, err := ssh.GeneratePublicKey(clientPrivKey)
-	require.NoError(t, err)
-	err = server.AddAuthorizedKey("multi-peer", string(clientPubKey))
-	require.NoError(t, err)
 
 	const numClients = 3
 	clients := make([]*Client, numClients)
 
 	for i := 0; i < numClients; i++ {
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		currentUser := getCurrentUsername()
-		client, err := DialInsecure(ctx, serverAddr, fmt.Sprintf("%s-%d", currentUser, i))
+		currentUser := testutil.GetTestUsername(t)
+		client, err := Dial(ctx, serverAddr, fmt.Sprintf("%s-%d", currentUser, i), DialOptions{
+			InsecureSkipVerify: true,
+		})
 		cancel()
 		require.NoError(t, err, "Client %d should connect successfully", i)
 		clients[i] = client
@@ -161,19 +161,14 @@ func TestSSHClient_ContextCancellation(t *testing.T) {
 		require.NoError(t, err)
 	}()
 
-	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
-	require.NoError(t, err)
-	clientPubKey, err := ssh.GeneratePublicKey(clientPrivKey)
-	require.NoError(t, err)
-	err = server.AddAuthorizedKey("cancel-peer", string(clientPubKey))
-	require.NoError(t, err)
-
 	t.Run("connection with short timeout", func(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
 		defer cancel()
 
-		currentUser := getCurrentUsername()
-		_, err = DialInsecure(ctx, serverAddr, currentUser)
+		currentUser := testutil.GetTestUsername(t)
+		_, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
 		if err != nil {
 			// Check for actual timeout-related errors rather than string matching
 			assert.True(t,
@@ -187,8 +182,10 @@ func TestSSHClient_ContextCancellation(t *testing.T) {
 	t.Run("command execution cancellation", func(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
-		currentUser := getCurrentUsername()
-		client, err := DialInsecure(ctx, serverAddr, currentUser)
+		currentUser := testutil.GetTestUsername(t)
+		client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
 		require.NoError(t, err)
 		defer func() {
 			if err := client.Close(); err != nil {
@@ -214,7 +211,11 @@ func TestSSHClient_NoAuthMode(t *testing.T) {
 	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
 	require.NoError(t, err)
 
-	server := sshserver.New(hostKey)
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
 	server.SetAllowRootLogin(true) // Allow root/admin login for tests
 
 	serverAddr := sshserver.StartTestServer(t, server)
@@ -226,10 +227,12 @@ func TestSSHClient_NoAuthMode(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	currentUser := getCurrentUsername()
+	currentUser := testutil.GetTestUsername(t)
 
 	t.Run("any key succeeds in no-auth mode", func(t *testing.T) {
-		client, err := DialInsecure(ctx, serverAddr, currentUser)
+		client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
 		assert.NoError(t, err)
 		if client != nil {
 			require.NoError(t, client.Close(), "Client should close without error")
@@ -282,24 +285,22 @@ func setupTestSSHServerAndClient(t *testing.T) (*sshserver.Server, string, *Clie
 	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
 	require.NoError(t, err)
 
-	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
-	require.NoError(t, err)
-	clientPubKey, err := ssh.GeneratePublicKey(clientPrivKey)
-	require.NoError(t, err)
-
-	server := sshserver.New(hostKey)
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
 	server.SetAllowRootLogin(true) // Allow root/admin login for tests
 
-	err = server.AddAuthorizedKey("test-peer", string(clientPubKey))
-	require.NoError(t, err)
-
 	serverAddr := sshserver.StartTestServer(t, server)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	currentUser := getCurrentUsername()
-	client, err := DialInsecure(ctx, serverAddr, currentUser)
+	currentUser := testutil.GetTestUsername(t)
+	client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+		InsecureSkipVerify: true,
+	})
 	require.NoError(t, err)
 
 	return server, serverAddr, client
@@ -361,18 +362,14 @@ func TestSSHClient_PortForwardingDataTransfer(t *testing.T) {
 	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
 	require.NoError(t, err)
 
-	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
-	require.NoError(t, err)
-	clientPubKey, err := ssh.GeneratePublicKey(clientPrivKey)
-	require.NoError(t, err)
-
-	server := sshserver.New(hostKey)
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
 	server.SetAllowLocalPortForwarding(true)
 	server.SetAllowRootLogin(true) // Allow root/admin login for tests
 
-	err = server.AddAuthorizedKey("test-peer", string(clientPubKey))
-	require.NoError(t, err)
-
 	serverAddr := sshserver.StartTestServer(t, server)
 	defer func() {
 		err := server.Stop()
@@ -387,11 +384,13 @@ func TestSSHClient_PortForwardingDataTransfer(t *testing.T) {
 	require.NoError(t, err)
 
 	// Skip if running as system account that can't do port forwarding
-	if isSystemAccount(realUser) {
+	if testutil.IsSystemAccount(realUser) {
 		t.Skipf("Skipping port forwarding test - running as system account: %s", realUser)
 	}
 
-	client, err := DialInsecure(ctx, serverAddr, realUser)
+	client, err := Dial(ctx, serverAddr, realUser, DialOptions{
+		InsecureSkipVerify: true, // Skip host key verification for test
+	})
 	require.NoError(t, err)
 	defer func() {
 		if err := client.Close(); err != nil {
@@ -478,180 +477,6 @@ func TestSSHClient_PortForwardingDataTransfer(t *testing.T) {
 	assert.Equal(t, expectedResponse, string(response))
 }
 
-// getCurrentUsername returns the current username for SSH connections
-func getCurrentUsername() string {
-	if runtime.GOOS == "windows" {
-		if currentUser, err := user.Current(); err == nil {
-			// Check if this is a system account that can't authenticate
-			if isSystemAccount(currentUser.Username) {
-				// In CI environments, create a test user; otherwise try Administrator
-				if isCI() {
-					if testUser := getOrCreateTestUser(); testUser != "" {
-						return testUser
-					}
-				} else {
-					// Try Administrator first for local development
-					if _, err := user.Lookup("Administrator"); err == nil {
-						return "Administrator"
-					}
-					if testUser := getOrCreateTestUser(); testUser != "" {
-						return testUser
-					}
-				}
-			}
-			// On Windows, return the full domain\username for proper authentication
-			return currentUser.Username
-		}
-	}
-
-	if username := os.Getenv("USER"); username != "" {
-		return username
-	}
-
-	if currentUser, err := user.Current(); err == nil {
-		return currentUser.Username
-	}
-
-	return "test-user"
-}
-
-// isCI checks if we're running in GitHub Actions CI
-func isCI() bool {
-	// Check standard CI environment variables
-	if os.Getenv("GITHUB_ACTIONS") == "true" || os.Getenv("CI") == "true" {
-		return true
-	}
-
-	// Check for GitHub Actions runner hostname pattern (when running as SYSTEM)
-	hostname, err := os.Hostname()
-	if err == nil && strings.HasPrefix(hostname, "runner") {
-		return true
-	}
-
-	return false
-}
-
-// getOrCreateTestUser creates a test user on Windows if needed
-func getOrCreateTestUser() string {
-	testUsername := "netbird-test-user"
-
-	// Check if user already exists
-	if _, err := user.Lookup(testUsername); err == nil {
-		return testUsername
-	}
-
-	// Try to create the user using PowerShell
-	if createWindowsTestUser(testUsername) {
-		// Register cleanup for the test user
-		registerTestUserCleanup(testUsername)
-		return testUsername
-	}
-
-	return ""
-}
-
-var createdTestUsers = make(map[string]bool)
-var testUsersToCleanup []string
-
-// registerTestUserCleanup registers a test user for cleanup
-func registerTestUserCleanup(username string) {
-	if !createdTestUsers[username] {
-		createdTestUsers[username] = true
-		testUsersToCleanup = append(testUsersToCleanup, username)
-	}
-}
-
-// cleanupTestUsers removes all created test users
-func cleanupTestUsers() {
-	for _, username := range testUsersToCleanup {
-		removeWindowsTestUser(username)
-	}
-	testUsersToCleanup = nil
-	createdTestUsers = make(map[string]bool)
-}
-
-// removeWindowsTestUser removes a local user on Windows using PowerShell
-func removeWindowsTestUser(username string) {
-	if runtime.GOOS != "windows" {
-		return
-	}
-
-	// PowerShell command to remove a local user
-	psCmd := fmt.Sprintf(`
-		try {
-			Remove-LocalUser -Name "%s" -ErrorAction Stop
-			Write-Output "User removed successfully"
-		} catch {
-			if ($_.Exception.Message -like "*cannot be found*") {
-				Write-Output "User not found (already removed)"
-			} else {
-				Write-Error $_.Exception.Message
-			}
-		}
-	`, username)
-
-	cmd := exec.Command("powershell", "-Command", psCmd)
-	output, err := cmd.CombinedOutput()
-
-	if err != nil {
-		log.Printf("Failed to remove test user %s: %v, output: %s", username, err, string(output))
-	} else {
-		log.Printf("Test user %s cleanup result: %s", username, string(output))
-	}
-}
-
-// createWindowsTestUser creates a local user on Windows using PowerShell
-func createWindowsTestUser(username string) bool {
-	if runtime.GOOS != "windows" {
-		return false
-	}
-
-	// PowerShell command to create a local user
-	psCmd := fmt.Sprintf(`
-		try {
-			$password = ConvertTo-SecureString "TestPassword123!" -AsPlainText -Force
-			New-LocalUser -Name "%s" -Password $password -Description "NetBird test user" -UserMayNotChangePassword -PasswordNeverExpires
-			Add-LocalGroupMember -Group "Users" -Member "%s"
-			Write-Output "User created successfully"
-		} catch {
-			if ($_.Exception.Message -like "*already exists*") {
-				Write-Output "User already exists"
-			} else {
-				Write-Error $_.Exception.Message
-				exit 1
-			}
-		}
-	`, username, username)
-
-	cmd := exec.Command("powershell", "-Command", psCmd)
-	output, err := cmd.CombinedOutput()
-
-	if err != nil {
-		log.Printf("Failed to create test user: %v, output: %s", err, string(output))
-		return false
-	}
-
-	log.Printf("Test user creation result: %s", string(output))
-	return true
-}
-
-// isSystemAccount checks if the user is a system account that can't authenticate
-func isSystemAccount(username string) bool {
-	systemAccounts := []string{
-		"system",
-		"NT AUTHORITY\\SYSTEM",
-		"NT AUTHORITY\\LOCAL SERVICE",
-		"NT AUTHORITY\\NETWORK SERVICE",
-	}
-
-	for _, sysAccount := range systemAccounts {
-		if strings.EqualFold(username, sysAccount) {
-			return true
-		}
-	}
-	return false
-}
-
 // getRealCurrentUser returns the actual current user (not test user) for features like port forwarding
 func getRealCurrentUser() (string, error) {
 	if runtime.GOOS == "windows" {