Assert the login status after the SSO flow starts

.github/dependabot.yml

@@ -3,8 +3,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      interval: "daily"
+    open-pull-requests-limit: 15
     groups:
       actions:
         patterns:
@@ -22,12 +22,9 @@ updates:
     directories:
       - "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     open-pull-requests-limit: 15
     groups:
-      golang-x-packages:
-        patterns:
-          - "golang.org/x/*"
       aws-sdk:
         patterns:
           - "github.com/aws/aws-sdk-go-v2/*"

SECURITY.md

@@ -1,70 +1,12 @@
 # Security Policy
 
-NetBird's goal is to provide a secure network. The client runs as a privileged service on every machine it is installed on,
-so we take reports about it seriously and we publish what we fix.
+NetBird's goal is to provide a secure network. If you find a vulnerability or bug, please report it by opening an issue [here](https://github.com/netbirdio/netbird/issues/new?assignees=&labels=&template=bug-issue-report.md&title=) or by contacting us by email.
+
+There has yet to be an official bug bounty program for the NetBird project.
+
+## Supported Versions
+- We currently support only the latest version
 
 ## Reporting a Vulnerability
 
-**Please do not open a public issue for a security vulnerability.** Public issues are visible to everyone, including before
-a fix is available.
-
-Report security issues one of these two ways:
-
-- **GitHub private vulnerability reporting** — [open a private report](https://github.com/netbirdio/netbird/security/advisories/new)
-  on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
-- **Email** — `security@netbird.io`.
-
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
-filing a repository report.
-
-### What to include
-
-A report is easier to act on when it contains:
-
-- The affected component (client, management, signal, relay, dashboard) and the version or commit you tested
-- The platform and configuration, where relevant — operating system, self-hosted or NetBird Cloud, container or host install
-- What an attacker needs before they can exploit it: network position, an account, local access, a specific privilege level
-- Steps to reproduce, and a proof of concept if you have one
-- The impact you believe it has
-
-Partial reports are still welcome. If you are unsure whether something is a security issue, send it to `security@netbird.io`
-and let us make that call.
-
-## What to expect from us
-
-- **We acknowledge your report** and tell you whether we can reproduce it.
-- **We work with you on severity and scope.** If we assess it differently than you do, we will explain why rather than
-  silently downgrade it.
-- **We fix and release**, then publish a [GitHub Security Advisory](https://github.com/netbirdio/netbird/security/advisories)
-  naming the affected version range and the patched version.
-- **We credit reporters who want to be credited.** Tell us the name or handle you would like used, or that you would rather
-  stay anonymous.
-- **We keep you in the loop** until the advisory is published.
-
-We ask that you give us a reasonable opportunity to ship a fix before disclosing the issue publicly, and that you avoid
-accessing, modifying, or exfiltrating data belonging to other people while testing. Testing against your own installation
-or your own account is always fine.
-
-## Supported Versions
-
-We support the latest release. Security fixes ship in the next version rather than as backports to older releases, so
-upgrading to the current release is how you get them.
-
-Release notifications are available by watching [releases](https://github.com/netbirdio/netbird/releases).
-
-## Published advisories
-
-Every vulnerability we fix is published as a GitHub Security Advisory on the
-[advisories page](https://github.com/netbirdio/netbird/security/advisories), including the affected version range, the
-patched version, and the reporter's credit. Advisories for the Go module are also distributed through the Go vulnerability
-database, so `govulncheck` will report them against your dependencies.
-
-## Bug bounty
-
-There is no official bug bounty program for the NetBird project. We credit reporters in advisories, and we are grateful for
-the work, but we cannot currently offer payment for reports.
-
-## Non-security bugs
-
-For bugs that are not security issues, please use the
-[issue tracker](https://github.com/netbirdio/netbird/discussions/new/choose).
+Please report security issues to `security@netbird.io`

client/server/login_outcome_test.go

@@ -0,0 +1,89 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A login that never reached Management is not a decision about the peer's
+// credentials, so it must come back as a retryable error rather than an SSO
+// prompt: the user cannot finish a browser login while Management is down, and
+// the CLI's own backoff resolves the outage on its own once the daemon reports
+// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
+// because Management happened to be restarting when the daemon dialed it.
+func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	unreachable := errors.New("create connection: dial context: context deadline exceeded")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return internal.StatusLoginFailed, unreachable
+	}
+
+	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
+	require.Nil(t, resp, "a failed login must not answer with a login response")
+	require.Equal(t, 1, attempts)
+	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
+
+	status, err := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"a peer that could not reach Management is not waiting on a login")
+}
+
+// The counterpart: Management refusing the peer's credentials is a decision, and
+// the SSO flow still has to start for it. The profile carries an unusable
+// private key so the flow setup fails immediately instead of dialing, which is
+// enough to show the branch was entered — the refusal itself is never what comes
+// back out.
+func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	breakProfilePrivateKey(t, cfgPath)
+
+	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		return internal.StatusNeedsLogin, refused
+	}
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+	require.NotErrorIs(t, err, refused,
+		"the refusal was handed back to the caller instead of starting the SSO flow")
+
+	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, stateErr)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"the SSO flow setup was never reached with the broken key")
+}
+
+// breakProfilePrivateKey replaces the profile's private key with an unparseable
+// one, which makes any attempt to build a Management client fail on the spot.
+func breakProfilePrivateKey(t *testing.T, cfgPath string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	var cfg map[string]any
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	cfg["PrivateKey"] = "not-a-key"
+
+	patched, err := json.Marshal(cfg)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
+}

client/server/server.go

@@ -132,6 +132,11 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
+
+	// loginAttemptFn stands in for the Management login round trip. Tests set
+	// it to drive the login outcomes that need a server on the other end;
+	// production leaves it nil, and every login goes through loginAttempt.
+	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
 }
 
 type oauthAuthFlow struct {
@@ -367,7 +372,19 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// loginAttempt attempts to login using the provided information. it returns a status in case something fails
+// attemptLogin runs a login round trip against Management, or the stand-in a
+// test installed in place of it.
+func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
+	if s.loginAttemptFn != nil {
+		return s.loginAttemptFn(ctx, setupKey, jwtToken)
+	}
+	return s.loginAttempt(ctx, setupKey, jwtToken)
+}
+
+// loginAttempt attempts to login using the provided information. It returns
+// StatusNeedsLogin when Management refused the peer's credentials and
+// StatusLoginFailed for every other failure, so callers can tell an
+// authentication decision apart from a login that never got made.
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -616,11 +633,23 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
+	loginStatus, err := s.attemptLogin(ctx, "", "")
+	if err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
 
+	// Only an authentication refusal means the peer has to (re-)authenticate.
+	// Any other failure leaves the login undecided: Management unreachable, a
+	// restart mid-request, an internal error. Those are returned for the caller
+	// to retry, because turning them into an SSO prompt asks the user to solve
+	// something that is not theirs to solve, and a browser login cannot succeed
+	// while Management is unreachable anyway.
+	if loginStatus != internal.StatusNeedsLogin {
+		state.Set(loginStatus)
+		return nil, err
+	}
+
 	if msg.SetupKey == "" {
 		hint := ""
 		if msg.Hint != nil {
@@ -677,7 +706,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -832,7 +861,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}

client/ui/netbird-ui.rb.tmpl

@@ -29,13 +29,8 @@ cask "{{ $projectName }}" do
   end
 
   uninstall_preflight do
-    system_command "/bin/sh",
-                   args: ["-c", <<~CMD],
-                     launchctl bootout system/netbird 2>/dev/null || \
-                       launchctl unload /Library/LaunchDaemons/netbird.plist 2>/dev/null || true
-                     rm -f /Library/LaunchDaemons/netbird.plist
-                   CMD
-                   sudo: true
+    system_command "#{appdir}/Netbird UI.app/uninstaller.sh",
+                   sudo: false
   end
 
   name "Netbird UI"

go.mod

@@ -83,7 +83,7 @@ require (
 	github.com/moby/moby/api v1.54.1
 	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
-	github.com/oapi-codegen/runtime v1.6.0
+	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/ory/dockertest/v4 v4.0.0
 	github.com/oschwald/maxminddb-golang v1.12.0

go.sum

@@ -496,10 +496,8 @@ github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
-github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
-github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU=
-github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.1.2 h1:P2+CubHq8fO4Q6fV1tqDBZHCwpVpvPg7oKiYzQgXIyI=
+github.com/oapi-codegen/runtime v1.1.2/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/okta/okta-sdk-golang/v2 v2.18.0 h1:cfDasMb7CShbZvOrF6n+DnLevWwiHgedWMGJ8M8xKDc=