Skip the PR title and docs acknowledgement checks for Crowdin service PRs

.github/workflows/docs-ack.yml

@@ -12,6 +12,8 @@ jobs:
   docs-ack:
     name: Require docs PR URL or explicit "not needed"
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated without the PR template.
+    if: github.event.pull_request.user.login != 'netbirddev'
 
     steps:
       - name: Read PR body

.github/workflows/pr-title-check.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   check-title:
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated with a fixed title.
+    if: github.event.pull_request.user.login != 'netbirddev'
     steps:
       - name: Validate PR title prefix
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.goreleaser_ui_gtk3.yaml

@@ -43,17 +43,19 @@ archives:
       - netbird-ui-gtk3
 
 nfpms:
-  # Mutually-exclusive alternative to the GTK4 netbird-ui package -- both
-  # ship the same /usr/bin/netbird-ui from the shared stable/yum repos, so
-  # this one carries its own name and conflicts with the GTK4 package.
+  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
+  # alternatives served from separate repo paths (see uploads below); a given
+  # distro points at exactly one of them. The file names must still differ:
+  # the Debian pool is shared storage keyed by file name, so a default-named
+  # gtk3 .deb would overwrite the stable one.
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_deb_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -65,10 +67,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    conflicts:
-      - netbird-ui
-    replaces:
-      - netbird-ui
     dependencies:
       - netbird (>= 0.75.0)
       - libgtk-3-0
@@ -81,8 +79,8 @@ nfpms:
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -94,10 +92,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    # No `replaces` here: nfpm maps it to rpm Obsoletes, which would make
-    # dnf swap installed GTK4 netbird-ui packages for this one on upgrade.
-    conflicts:
-      - netbird-ui
     dependencies:
       - netbird >= 0.75.0
       - (gtk3 or libgtk-3-0)
@@ -117,20 +111,32 @@ changelog:
   disable: true
 
 uploads:
-  - name: debian
+  # The gtk3 packages reuse the netbird-ui package name, so they live in
+  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
+  # legacy distros point their repo config at.
+  #
+  # GoReleaser derives the credential env var from the upload name, so these
+  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
+  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
+  # a missing secret is a silent skip rather than a failure -- the packages
+  # reached the GitHub release but never the package repositories. Point
+  # `password` at the exported vars so both uploads authenticate.
+  - name: debian-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_deb_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
     method: PUT
 
-  - name: yum
+  - name: yum-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_rpm_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
+    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT

client/android/ssh_client.go

@@ -1,829 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	gossh "golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/client/ssh/detection"
-)
-
-const (
-	sshDialTimeout      = 30 * time.Second
-	sshDetectionTimeout = 5 * time.Second
-)
-
-// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
-// a string because gomobile flattens errors to their message, so a sentinel
-// value would not survive the binding.
-const PasswordRequiredMarker = "netbird-ssh-password-required"
-
-// HostKeyUnknownMarker tells Java to show the fingerprint and, on confirmation,
-// retry with TrustHostKey set. The presented fingerprint is appended after the
-// marker so the prompt can display it and the retry can guard against a key
-// that changed between the two connects. Only regular (non-NetBird) servers
-// reach this: NetBird peers verify against the registry.
-const HostKeyUnknownMarker = "netbird-ssh-hostkey-unknown"
-
-var (
-	errPasswordRequired = errors.New(PasswordRequiredMarker)
-	errClientClosed     = errors.New("ssh client closed")
-)
-
-// errHostKeyUnknown carries the presented fingerprint so Connect can build the
-// marker message the Java side parses.
-type errHostKeyUnknown struct {
-	fingerprint string
-}
-
-func (e *errHostKeyUnknown) Error() string {
-	return HostKeyUnknownMarker + ":" + e.fingerprint
-}
-
-// engineHostKeyVerifier adapts *internal.Engine to nbssh.HostKeyVerifier.
-type engineHostKeyVerifier struct {
-	engine *internal.Engine
-}
-
-func (v *engineHostKeyVerifier) VerifySSHHostKey(peerAddress string, presented []byte) error {
-	storedKey, found := v.engine.GetPeerSSHKey(peerAddress)
-	if !found {
-		return nbssh.ErrPeerNotFound
-	}
-	return nbssh.VerifyHostKey(storedKey, presented, peerAddress)
-}
-
-// SSHTerminalListener receives SSH session events. It is implemented in Java.
-//
-// All callbacks are invoked from goroutines and may run concurrently with each
-// other; the implementation must be safe to call from any thread.
-type SSHTerminalListener interface {
-	OnConnected()
-	OnData(data []byte)
-	OnClose(reason string)
-	OnError(message string)
-}
-
-// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
-//
-// It dials through the running NetBird tunnel and runs a standard SSH session
-// on top with PTY enabled. Host-key verification uses the NetBird-provided
-// peer SSH host keys, identical to the desktop client.
-type SSHClient struct {
-	nb        *Client
-	mu        sync.Mutex
-	listener  SSHTerminalListener
-	urlOpener URLOpener
-
-	sshClient *gossh.Client
-	session   *gossh.Session
-	stdin     io.WriteCloser
-	closed    bool
-
-	// gen identifies the current connection attempt. Connect and Close bump it,
-	// so an in-flight dial or a reader left over from a previous connection
-	// finds itself stale and stays silent instead of publishing OnConnected or
-	// OnClose for a connection the caller already abandoned.
-	gen        uint64
-	dialCancel context.CancelFunc
-
-	// knownHostsPath is the TOFU store for regular SSH servers. Java supplies a
-	// per-profile path, since an overlay IP is a different host under a
-	// different profile. Empty until set: without it a regular server cannot be
-	// verified and Connect refuses one.
-	knownHostsPath string
-	// trustHostKey carries the fingerprint the user confirmed on a previous
-	// attempt, so the retry accepts exactly that key and persists it.
-	trustHostKey string
-}
-
-// NewSSHClient creates a new SSH client bound to the running NetBird Client.
-func NewSSHClient(c *Client) *SSHClient {
-	return &SSHClient{nb: c}
-}
-
-// SetListener registers the Java listener. Must be called before Connect to
-// receive any events.
-func (s *SSHClient) SetListener(l SSHTerminalListener) {
-	s.mu.Lock()
-	s.listener = l
-	s.mu.Unlock()
-}
-
-// SetURLOpener registers the Java URL opener used to display the device-code
-// authorization page in a Custom Tabs window when the target peer requires
-// JWT authentication. Must be set before Connect to be effective.
-func (s *SSHClient) SetURLOpener(opener URLOpener) {
-	s.mu.Lock()
-	s.urlOpener = opener
-	s.mu.Unlock()
-}
-
-// SetKnownHostsPath points the TOFU host-key store at a per-profile file. Must
-// be set before connecting to a regular SSH server; without it such a server
-// cannot be verified and Connect refuses one.
-func (s *SSHClient) SetKnownHostsPath(path string) {
-	s.mu.Lock()
-	s.knownHostsPath = path
-	s.mu.Unlock()
-}
-
-// TrustHostKey records the fingerprint the user confirmed for a regular server,
-// so the next Connect accepts that exact key and adds it to the known-hosts
-// store. Passing a fingerprint that no longer matches makes the connect fail
-// rather than trust a key that changed since the prompt.
-func (s *SSHClient) TrustHostKey(fingerprint string) {
-	s.mu.Lock()
-	s.trustHostKey = fingerprint
-	s.mu.Unlock()
-}
-
-// Connect dials the SSH server through the NetBird tunnel and performs the
-// SSH handshake. It auto-detects the server type via SSH banner inspection
-// and selects the appropriate authentication path:
-//
-//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
-//     flow, opens the verification URL through the registered URLOpener, and
-//     uses the resulting token as the SSH password. Host-key verification
-//     uses the NetBird peer registry.
-//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
-//     private key. Host-key verification uses the NetBird peer registry.
-//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
-//     first (so a user-installed NetBird public key works), then falls back
-//     to the supplied password if non-empty. Host-key verification is
-//     trust-on-first-use against the per-profile known-hosts store.
-//
-// The password parameter is only consulted for regular SSH servers.
-func (s *SSHClient) Connect(host string, port int, user, password string) error {
-	if port < 1 || port > 65535 {
-		return fmt.Errorf("invalid port: %d", port)
-	}
-
-	cfg, _, cc := s.nb.stateSnapshot()
-	if cc == nil {
-		return errors.New("netbird client not running")
-	}
-	if cfg == nil {
-		return errors.New("netbird config not loaded")
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return errors.New("netbird engine not available")
-	}
-
-	s.mu.Lock()
-	s.gen++
-	gen := s.gen
-	s.mu.Unlock()
-
-	serverType := detectServerType(host, port)
-	log.Debugf("SSH server type: %s", serverType)
-
-	authMethods, hostKeyCallback, err := s.buildAuth(cfg, engine, serverType, password)
-	if err != nil {
-		return err
-	}
-
-	clientConfig := &gossh.ClientConfig{
-		User:            user,
-		Auth:            authMethods,
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         sshDialTimeout,
-	}
-	err = s.dialAndHandshake(gen, host, port, clientConfig)
-
-	// An unknown host key is a prompt, not a failure: return the marker intact
-	// (rootCause would unwrap it) so Java can show the fingerprint and retry.
-	var unknownHost *errHostKeyUnknown
-	if errors.As(err, &unknownHost) {
-		return errors.New(unknownHost.Error())
-	}
-
-	// A regular server may still accept a password, so let the caller ask for
-	// one instead of failing. NetBird servers never use a password, so a
-	// failure there is genuine.
-	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
-		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) &&
-		passwordCouldHelp(err, password != "") {
-		return errPasswordRequired
-	}
-	if err != nil {
-		return rootCause(err)
-	}
-	return nil
-}
-
-// StartSession requests a PTY and starts an interactive shell. Output from
-// the session is forwarded to the listener via OnData.
-func (s *SSHClient) StartSession(cols, rows int) error {
-	err := s.startSession(cols, rows)
-	if err != nil {
-		log.Infof("SSH: start session failed: %v", err)
-		return rootCause(err)
-	}
-	return nil
-}
-
-// Write sends data to the SSH session stdin.
-func (s *SSHClient) Write(data []byte) error {
-	s.mu.Lock()
-	stdin := s.stdin
-	s.mu.Unlock()
-	if stdin == nil {
-		return errors.New("ssh session not started")
-	}
-	if _, err := stdin.Write(data); err != nil {
-		return fmt.Errorf("write stdin: %w", err)
-	}
-	return nil
-}
-
-// Resize updates the PTY window size.
-func (s *SSHClient) Resize(cols, rows int) error {
-	s.mu.Lock()
-	session := s.session
-	s.mu.Unlock()
-	if session == nil {
-		return errors.New("ssh session not started")
-	}
-	return session.WindowChange(rows, cols)
-}
-
-// Reset makes a closed client usable for another Connect: Close leaves the
-// one-shot guard set, and clearing it lets the same client back a reconnect.
-func (s *SSHClient) Reset() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.closed = false
-}
-
-// Close terminates the SSH session and underlying connection. Safe to call
-// multiple times.
-func (s *SSHClient) Close() error {
-	s.mu.Lock()
-	s.gen++
-	if s.dialCancel != nil {
-		s.dialCancel()
-		s.dialCancel = nil
-	}
-	sshClient := s.sshClient
-	session := s.session
-	stdin := s.stdin
-	s.sshClient = nil
-	s.session = nil
-	s.stdin = nil
-	notify := !s.closed
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-
-	if stdin != nil {
-		if err := stdin.Close(); err != nil {
-			log.Debugf("ssh: stdin close: %v", err)
-		}
-	}
-	if session != nil {
-		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
-			log.Debugf("ssh: session close: %v", err)
-		}
-	}
-	var firstErr error
-	if sshClient != nil {
-		if err := sshClient.Close(); err != nil {
-			firstErr = err
-		}
-	}
-	if notify && listener != nil {
-		listener.OnClose("closed by client")
-	}
-	return firstErr
-}
-
-func (s *SSHClient) startSession(cols, rows int) error {
-	log.Debugf("SSH: starting session %dx%d", cols, rows)
-	s.mu.Lock()
-	sshClient := s.sshClient
-	gen := s.gen
-	s.mu.Unlock()
-
-	if sshClient == nil {
-		return errors.New("ssh client not connected")
-	}
-
-	session, err := sshClient.NewSession()
-	if err != nil {
-		return fmt.Errorf("new session: %w", err)
-	}
-
-	modes := gossh.TerminalModes{
-		gossh.ECHO:          1,
-		gossh.TTY_OP_ISPEED: 14400,
-		gossh.TTY_OP_OSPEED: 14400,
-		gossh.VINTR:         3,
-		gossh.VQUIT:         28,
-		gossh.VERASE:        127,
-	}
-	if err := session.RequestPty("xterm-256color", rows, cols, modes); err != nil {
-		closeQuiet(session, "session after pty error")
-		return fmt.Errorf("request pty: %w", err)
-	}
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		closeQuiet(session, "session after stdin error")
-		return fmt.Errorf("stdin pipe: %w", err)
-	}
-	stdout, err := session.StdoutPipe()
-	if err != nil {
-		closeQuiet(session, "session after stdout error")
-		return fmt.Errorf("stdout pipe: %w", err)
-	}
-	stderr, err := session.StderrPipe()
-	if err != nil {
-		closeQuiet(session, "session after stderr error")
-		return fmt.Errorf("stderr pipe: %w", err)
-	}
-
-	if err := session.Shell(); err != nil {
-		closeQuiet(session, "session after shell error")
-		return fmt.Errorf("start shell: %w", err)
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(session, "stale session")
-		return errClientClosed
-	}
-	s.session = session
-	s.stdin = stdin
-	s.mu.Unlock()
-
-	readerDone := make(chan string, 2)
-	go func() { readerDone <- s.readLoop(stdout, "stdout") }()
-	go func() { readerDone <- s.readLoop(stderr, "stderr") }()
-	go func() {
-		reason := <-readerDone
-		if second := <-readerDone; reason == "" {
-			reason = second
-		}
-		s.notifyClose(gen, reason)
-	}()
-	log.Debug("SSH: session started, shell running")
-	return nil
-}
-
-func (s *SSHClient) buildAuth(cfg *profilemanager.Config, engine *internal.Engine,
-	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
-
-	switch serverType {
-	case detection.ServerTypeNetBirdJWT:
-		token, err := s.requestJWTToken(cfg)
-		if err != nil {
-			return nil, nil, fmt.Errorf("jwt: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.Password(token)}
-		return auths, nbssh.CreateHostKeyCallback(&engineHostKeyVerifier{engine: engine}), nil
-
-	case detection.ServerTypeNetBirdNoJWT:
-		if cfg.SSHKey == "" {
-			return nil, nil, errors.New("no NetBird SSH key available")
-		}
-		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
-		if err != nil {
-			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
-		return auths, nbssh.CreateHostKeyCallback(&engineHostKeyVerifier{engine: engine}), nil
-
-	case detection.ServerTypeRegular:
-		var auths []gossh.AuthMethod
-		if cfg.SSHKey != "" {
-			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
-				auths = append(auths, gossh.PublicKeys(signer))
-			} else {
-				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
-			}
-		}
-		if password != "" {
-			pw := password
-			auths = append(auths, gossh.Password(pw))
-			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
-				answers := make([]string, len(questions))
-				for i := range questions {
-					answers[i] = pw
-				}
-				return answers, nil
-			}))
-		}
-		if len(auths) == 0 {
-			// Nothing to offer at all: ask for a password rather than failing,
-			// so the caller can retry once the user supplies one.
-			return nil, nil, errPasswordRequired
-		}
-		callback, err := s.tofuHostKeyCallback()
-		if err != nil {
-			return nil, nil, err
-		}
-		return auths, callback, nil
-
-	default:
-		return nil, nil, fmt.Errorf("unsupported SSH server type: %v", serverType)
-	}
-}
-
-// tofuHostKeyCallback verifies a regular server's host key against the
-// per-profile known-hosts file. An unknown host returns errHostKeyUnknown so
-// Java can show the fingerprint and, once confirmed, retry with the key
-// trusted; a changed key is rejected outright, as OpenSSH does. When the user
-// has confirmed a fingerprint, the callback accepts exactly that key and
-// appends it to the store.
-func (s *SSHClient) tofuHostKeyCallback() (gossh.HostKeyCallback, error) {
-	s.mu.Lock()
-	path := s.knownHostsPath
-	trusted := s.trustHostKey
-	s.mu.Unlock()
-
-	if path == "" {
-		return nil, errors.New("no known-hosts store configured for regular SSH")
-	}
-
-	if err := ensureFileExists(path); err != nil {
-		return nil, fmt.Errorf("prepare known-hosts store: %w", err)
-	}
-
-	known, err := knownhosts.New(path)
-	if err != nil {
-		return nil, fmt.Errorf("load known-hosts store: %w", err)
-	}
-
-	return func(hostname string, remote net.Addr, key gossh.PublicKey) error {
-		err := known(hostname, remote, key)
-		if err == nil {
-			return nil
-		}
-
-		var keyErr *knownhosts.KeyError
-		if !errors.As(err, &keyErr) {
-			return err
-		}
-		// Want holds the keys already stored for this host: non-empty means the
-		// presented key replaced a known one, which TOFU must never accept
-		// silently.
-		if len(keyErr.Want) > 0 {
-			return fmt.Errorf("SSH host key changed for %s (possible attack)", hostname)
-		}
-
-		fingerprint := gossh.FingerprintSHA256(key)
-		if trusted == "" {
-			return &errHostKeyUnknown{fingerprint: fingerprint}
-		}
-		if trusted != fingerprint {
-			return fmt.Errorf("SSH host key changed since it was confirmed for %s", hostname)
-		}
-		if err := appendKnownHost(path, hostname, remote, key); err != nil {
-			return fmt.Errorf("persist trusted host key: %w", err)
-		}
-		// The confirmation is spent: now that the key is stored, a later
-		// reconnect must verify against the file, not re-accept this fingerprint.
-		s.mu.Lock()
-		s.trustHostKey = ""
-		s.mu.Unlock()
-		return nil
-	}, nil
-}
-
-func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config) (string, error) {
-	s.mu.Lock()
-	urlOpener := s.urlOpener
-	s.mu.Unlock()
-	if urlOpener == nil {
-		return "", errors.New("URL opener not configured for JWT auth")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profilemanager.GetLoginHint())
-	if err != nil {
-		return "", fmt.Errorf("create oauth flow: %w", err)
-	}
-
-	flowInfo, err := flow.RequestAuthInfo(ctx)
-	if err != nil {
-		return "", fmt.Errorf("request auth info: %w", err)
-	}
-
-	// Called synchronously: Open is what marks the surface as opened on the
-	// client side, and OnLoginSuccess below is a no-op until it has. Starting
-	// both in their own goroutines let them race, so a fast token left the
-	// browser in front of the terminal.
-	urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
-
-	// WaitToken blocks for as long as the browser round-trip takes, so say so
-	// rather than leaving the terminal blank.
-	s.notifyStatus("Waiting for browser authentication...")
-
-	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
-	if err != nil {
-		return "", fmt.Errorf("wait for token: %w", err)
-	}
-
-	token := tokenInfo.GetTokenToUse()
-	if token == "" {
-		return "", errors.New("empty token returned by IdP")
-	}
-
-	// Tells the client the browser round-trip is over so it can dismiss the
-	// surface it opened, the same way the login and session-extend flows do.
-	// Without it the Custom Tab stays in front of the terminal even though the
-	// token has already been collected.
-	urlOpener.OnLoginSuccess()
-
-	return token, nil
-}
-
-func (s *SSHClient) dialAndHandshake(gen uint64, host string, port int, clientConfig *gossh.ClientConfig) error {
-	addr := net.JoinHostPort(host, strconv.Itoa(port))
-	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
-	defer cancel()
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		return errClientClosed
-	}
-	s.dialCancel = cancel
-	s.mu.Unlock()
-
-	var dialer net.Dialer
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return fmt.Errorf("dial %s: %w", addr, err)
-	}
-
-	// DialContext bounds only the TCP establishment; without a deadline on the
-	// socket a peer that accepts and then goes silent blocks the handshake
-	// forever.
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			closeQuiet(conn, "conn after deadline error")
-			return fmt.Errorf("set handshake deadline: %w", err)
-		}
-	}
-
-	sshConn, chans, reqs, err := gossh.NewClientConn(conn, addr, clientConfig)
-	if err != nil {
-		if cerr := conn.Close(); cerr != nil {
-			log.Debugf("ssh: close after handshake error: %v", cerr)
-		}
-		return fmt.Errorf("ssh handshake: %w", err)
-	}
-
-	if err := conn.SetDeadline(time.Time{}); err != nil {
-		closeQuiet(sshConn, "ssh conn after deadline clear error")
-		return fmt.Errorf("clear handshake deadline: %w", err)
-	}
-
-	client := gossh.NewClient(sshConn, chans, reqs)
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(client, "stale ssh client")
-		return errClientClosed
-	}
-	s.sshClient = client
-	listener := s.listener
-	s.mu.Unlock()
-
-	if listener != nil {
-		listener.OnConnected()
-	}
-	return nil
-}
-
-func (s *SSHClient) readLoop(r io.Reader, name string) string {
-	buf := make([]byte, 4096)
-	for {
-		n, err := r.Read(buf)
-		if n > 0 {
-			s.mu.Lock()
-			listener := s.listener
-			s.mu.Unlock()
-			if listener != nil {
-				chunk := make([]byte, n)
-				copy(chunk, buf[:n])
-				listener.OnData(chunk)
-			}
-		}
-		if err != nil {
-			// EOF is a normal shell exit, so report it without a reason.
-			if errors.Is(err, io.EOF) {
-				return ""
-			}
-			log.Debugf("ssh %s read: %v", name, err)
-			return rootCause(err).Error()
-		}
-	}
-}
-
-// notifyStatus writes a progress line to the terminal through the normal
-// output path, so long steps are visible while nothing else is arriving.
-func (s *SSHClient) notifyStatus(text string) {
-	s.mu.Lock()
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
-	}
-}
-
-func (s *SSHClient) notifyClose(gen uint64, reason string) {
-	s.mu.Lock()
-	if gen != s.gen || s.closed {
-		s.mu.Unlock()
-		return
-	}
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnClose(reason)
-	}
-}
-
-// RemoveKnownHost deletes every known_hosts entry for host:port from the store,
-// so a host trusted for a session that is being deleted does not linger. Java
-// calls this only once no session targets that host, so a shared host stays
-// trusted. Missing file or entry is not an error: the goal state is "absent".
-func RemoveKnownHost(path, host string, port int) error {
-	target := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-
-	var kept []string
-	changed := false
-	scanner := bufio.NewScanner(bytes.NewReader(data))
-	for scanner.Scan() {
-		line := scanner.Text()
-		if knownHostsLineMatches(line, target) {
-			changed = true
-			continue
-		}
-		kept = append(kept, line)
-	}
-	if err := scanner.Err(); err != nil {
-		return err
-	}
-	if !changed {
-		return nil
-	}
-
-	out := strings.Join(kept, "\n")
-	if len(kept) > 0 {
-		out += "\n"
-	}
-	return os.WriteFile(path, []byte(out), 0o600)
-}
-
-func closeQuiet(c io.Closer, label string) {
-	if c == nil {
-		return
-	}
-	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}
-
-func detectServerType(host string, port int) detection.ServerType {
-	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
-	defer cancel()
-
-	dialer := &net.Dialer{}
-	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
-	if err != nil {
-		log.Debugf("ssh: server detection failed: %v (assuming regular SSH)", err)
-		return detection.ServerTypeRegular
-	}
-	return serverType
-}
-
-// rootCause returns the innermost error of a %w chain, so the terminal shows
-// "i/o timeout" rather than every layer that added context on the way up.
-func rootCause(err error) error {
-	for {
-		// A joined error has no single root, so keep it as-is.
-		if _, ok := err.(interface{ Unwrap() []error }); ok {
-			return err
-		}
-		next := errors.Unwrap(err)
-		if next == nil {
-			return err
-		}
-		err = next
-	}
-}
-
-// ensureFileExists creates an empty known-hosts file when none exists yet, so
-// knownhosts.New has something to parse on the first connection to any host.
-func ensureFileExists(path string) error {
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o600)
-	if err != nil {
-		return err
-	}
-	return f.Close()
-}
-
-// appendKnownHost adds the confirmed key to the store in the standard
-// known_hosts format, so it verifies silently on later connections and can be
-// inspected or edited like any OpenSSH known_hosts file.
-func appendKnownHost(path, hostname string, remote net.Addr, key gossh.PublicKey) error {
-	addresses := []string{knownhosts.Normalize(hostname)}
-	if remote != nil {
-		if normalized := knownhosts.Normalize(remote.String()); normalized != addresses[0] {
-			addresses = append(addresses, normalized)
-		}
-	}
-	line := knownhosts.Line(addresses, key)
-
-	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o600)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if cerr := f.Close(); cerr != nil {
-			log.Debugf("ssh: close known-hosts after append: %v", cerr)
-		}
-	}()
-	_, err = f.WriteString(line + "\n")
-	return err
-}
-
-// knownHostsLineMatches reports whether a known_hosts line's address list
-// contains the normalized target. Comment and blank lines never match.
-func knownHostsLineMatches(line, target string) bool {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return false
-	}
-	fields := strings.Fields(trimmed)
-	if len(fields) == 0 {
-		return false
-	}
-	for _, addr := range strings.Split(fields[0], ",") {
-		if addr == target {
-			return true
-		}
-	}
-	return false
-}
-
-// isAuthFailure distinguishes credential rejection from dial, timeout and
-// host-key errors, which retrying with a password would not fix.
-func isAuthFailure(err error) bool {
-	if errors.Is(err, errPasswordRequired) {
-		return true
-	}
-	var partial *gossh.PartialSuccessError
-	if errors.As(err, &partial) {
-		return true
-	}
-	return strings.Contains(err.Error(), "unable to authenticate")
-}
-
-// passwordCouldHelp reports whether prompting for a password again can change
-// the outcome. gossh lists a method under "attempted methods" only when the
-// server offered it, so a supplied password that was never attempted means the
-// server does not accept passwords and the real error should surface instead.
-func passwordCouldHelp(err error, passwordOffered bool) bool {
-	if !passwordOffered {
-		return true
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "password") || strings.Contains(msg, "keyboard-interactive")
-}

client/ssh/server/command_execution_windows.go

@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{

client/ssh/server/port_forwarding.go

@@ -133,12 +133,7 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
-	// is asked directly rather than through isPrivilegedOrUnknown: that helper
-	// reports an account it cannot evaluate as privileged, which is safe for a
-	// refusal and unsafe for a grant such as this one. Windows has returned
-	// above, so Uid here is a Unix uid and never a SID.
-	if result.User != nil && result.User.Uid == "0" {
+	if result.User != nil && isPrivilegedUsername(result.User.Username) {
 		return nil
 	}
 

client/ssh/server/privileges_other.go

@@ -1,16 +0,0 @@
-//go:build !windows
-
-package server
-
-// isProcessElevated is only meaningful on Windows; other platforms use the
-// effective UID check in isCurrentProcessPrivileged.
-func isProcessElevated() bool {
-	return false
-}
-
-// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
-// privileged on other platforms so a caller refusing privileged accounts fails
-// closed.
-func isWindowsAccountPrivilegedOrUnknown(string) bool {
-	return true
-}

client/ssh/server/privileges_windows.go

@@ -1,228 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"fmt"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-var (
-	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
-	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
-)
-
-const (
-	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
-	// the user belongs to through a global group.
-	lgIncludeIndirect  = 0x1
-	maxPreferredLength = 0xFFFFFFFF
-)
-
-// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
-type localGroupUsersInfo0 struct {
-	name *uint16
-}
-
-// isProcessElevated reports whether the current process token is elevated
-// (TokenElevation): true for elevated administrators, the built-in
-// Administrator, administrators with UAC disabled, and SYSTEM; false for
-// standard users and administrators running with a UAC-filtered token.
-func isProcessElevated() bool {
-	return windows.GetCurrentProcessToken().IsElevated()
-}
-
-// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
-// on this machine: a well-known service account, a built-in Administrator
-// (RID 500), or a member of the local Administrators group, directly or through
-// nested groups.
-//
-// An account whose privilege cannot be determined counts as privileged, which
-// is why the name says "or unknown". That is fail-closed for a caller that
-// refuses privileged accounts, and fail-open for a caller that grants something
-// to them, so only the former may use this.
-func isWindowsAccountPrivilegedOrUnknown(username string) bool {
-	sid, _, _, err := windows.LookupSID("", username)
-	if err != nil {
-		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
-		return true
-	}
-
-	if isPrivilegedUserSID(sid) {
-		return true
-	}
-
-	member, err := isLocalAdminsMember(username)
-	if err != nil {
-		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
-		return true
-	}
-	return member
-}
-
-// isPrivilegedUserSID reports whether the SID itself identifies a privileged
-// principal, without consulting group membership.
-func isPrivilegedUserSID(sid *windows.SID) bool {
-	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinLocalServiceSid,
-		windows.WinNetworkServiceSid,
-		windows.WinBuiltinAdministratorsSid,
-	}
-	for _, sidType := range wellKnown {
-		if sid.IsWellKnown(sidType) {
-			return true
-		}
-	}
-	return isBuiltinAdministratorSID(sid)
-}
-
-// isBuiltinAdministratorSID reports whether the SID is a machine or domain
-// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
-// that account; it can be renamed but cannot be removed from the
-// Administrators group.
-func isBuiltinAdministratorSID(sid *windows.SID) bool {
-	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-		return false
-	}
-	count := sid.SubAuthorityCount()
-	if count < 2 || sid.SubAuthority(0) != 21 {
-		return false
-	}
-	return sid.SubAuthority(uint32(count-1)) == 500
-}
-
-// isLocalAdminsMember reports whether the account is a member of the local
-// Administrators group.
-//
-// Local accounts are checked against the local SAM, which is authoritative for
-// them and, unlike a token, cannot under-report: UAC filters the tokens of
-// local administrators, and a filtered token carries Administrators as
-// deny-only, which a membership check on the token would read as "not a
-// member". Domain accounts are exempt from that filtering, so for them an S4U
-// token is preferred because its group list is LSA's transitive expansion and
-// therefore covers nested and universal groups plus the machine's own local
-// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
-// logon, so it serves as the fallback when no token can be obtained.
-func isLocalAdminsMember(username string) (bool, error) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	if err != nil {
-		return false, fmt.Errorf("create Administrators SID: %w", err)
-	}
-
-	account, domain := parseUsername(username)
-	if NewPrivilegeDropper().isLocalUser(domain) {
-		return localGroupsContainSID(account, adminSid)
-	}
-
-	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
-	if s4uErr == nil {
-		return member, nil
-	}
-	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
-
-	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
-	if err != nil {
-		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
-	}
-	return member, nil
-}
-
-// s4uTokenIsMember obtains an S4U token for the account and checks whether the
-// given SID is enabled in it.
-func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
-	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
-	if err != nil {
-		return false, err
-	}
-	defer func() {
-		if err := windows.CloseHandle(token); err != nil {
-			log.Debugf("close S4U token: %v", err)
-		}
-	}()
-	return windows.Token(token).IsMember(sid)
-}
-
-// localGroupsContainSID reports whether the wanted group is among the local
-// groups the account belongs to, directly or through a global group.
-//
-// The wanted SID is resolved to its group name once and compared against the
-// enumerated names. Well-known SIDs resolve from a static table, so that lookup
-// needs no domain controller, and it keeps the comparison correct for a renamed
-// or localized group because both sides then carry the new name. Resolving each
-// enumerated name back to a SID instead would add a lookup per group that can
-// block until it times out while a domain controller is unreachable, and cannot
-// change the outcome: the names enumerated here are local groups of this
-// machine, whose names are unique, so a name match identifies the group.
-//
-// A failure to resolve the wanted SID is returned rather than reported as
-// "not a member", so a privilege check built on this fails closed.
-func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
-	wantName, _, _, err := want.LookupAccount("")
-	if err != nil {
-		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
-	}
-
-	groups, err := netUserGetLocalGroups(username)
-	if err != nil {
-		return false, err
-	}
-
-	for _, group := range groups {
-		if strings.EqualFold(group, wantName) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// netUserGetLocalGroups returns the names of the local groups the account is a
-// member of, including indirect membership through global groups.
-func netUserGetLocalGroups(username string) ([]string, error) {
-	name16, err := windows.UTF16PtrFromString(username)
-	if err != nil {
-		return nil, fmt.Errorf("convert username: %w", err)
-	}
-
-	var buf *byte
-	var entriesRead, totalEntries uint32
-	status, _, _ := procNetUserGetLocalGroups.Call(
-		0, // local server
-		uintptr(unsafe.Pointer(name16)),
-		0, // level 0: LOCALGROUP_USERS_INFO_0
-		lgIncludeIndirect,
-		uintptr(unsafe.Pointer(&buf)),
-		maxPreferredLength,
-		uintptr(unsafe.Pointer(&entriesRead)),
-		uintptr(unsafe.Pointer(&totalEntries)),
-	)
-	if status != 0 {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
-	}
-	if buf == nil {
-		return nil, nil
-	}
-	defer func() {
-		if err := windows.NetApiBufferFree(buf); err != nil {
-			log.Debugf("free NetApi buffer: %v", err)
-		}
-	}()
-
-	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
-	// short read is not expected. Report it rather than silently returning a
-	// subset of the account's groups.
-	if entriesRead != totalEntries {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
-	}
-
-	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
-	groups := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		groups = append(groups, windows.UTF16PtrToString(entry.name))
-	}
-	return groups, nil
-}

client/ssh/server/privileges_windows_test.go

@@ -1,293 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"os/user"
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// filterNormalAccount limits NetUserEnum to normal user accounts.
-const filterNormalAccount = 0x2
-
-// TOKEN_ELEVATION_TYPE values.
-const (
-	tokenElevationTypeDefault = 1
-	tokenElevationTypeFull    = 2
-	tokenElevationTypeLimited = 3
-)
-
-// tokenElevationType reads TokenElevationType from a token.
-func tokenElevationType(token windows.Token) (uint32, error) {
-	var elevationType, returnedLen uint32
-	err := windows.GetTokenInformation(token, windows.TokenElevationType,
-		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
-	if err != nil {
-		return 0, err
-	}
-	return elevationType, nil
-}
-
-// userInfo0 mirrors USER_INFO_0.
-type userInfo0 struct {
-	name *uint16
-}
-
-func mustParseSID(t *testing.T, s string) *windows.SID {
-	t.Helper()
-	sid, err := windows.StringToSid(s)
-	require.NoError(t, err, "parse SID %s", s)
-	return sid
-}
-
-// localAccountNames returns the names of the local user accounts.
-func localAccountNames(t *testing.T) []string {
-	t.Helper()
-
-	var buf *byte
-	var entriesRead, totalEntries, resume uint32
-	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
-		&entriesRead, &totalEntries, &resume)
-	require.NoError(t, err, "enumerate local users")
-	t.Cleanup(func() {
-		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
-	})
-
-	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
-	names := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		names = append(names, windows.UTF16PtrToString(entry.name))
-	}
-	return names
-}
-
-// localAccountNameByRID returns the name of the local account carrying the
-// given RID. Accounts such as Administrator and Guest can be renamed and are
-// localized, so tests must not name them literally.
-func localAccountNameByRID(t *testing.T, rid uint32) string {
-	t.Helper()
-
-	for _, name := range localAccountNames(t) {
-		sid, _, _, err := windows.LookupSID("", name)
-		if err != nil {
-			continue
-		}
-		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-			continue
-		}
-		count := sid.SubAuthorityCount()
-		if count < 2 || sid.SubAuthority(0) != 21 {
-			continue
-		}
-		if sid.SubAuthority(uint32(count-1)) == rid {
-			return name
-		}
-	}
-
-	t.Fatalf("no local account with RID %d", rid)
-	return ""
-}
-
-// wellKnownAccountName resolves a well-known SID to the qualified account name
-// the local system uses for it, which is localized.
-func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
-	t.Helper()
-
-	sid, err := windows.CreateWellKnownSid(sidType)
-	require.NoError(t, err, "create well-known SID")
-	name, domain, _, err := sid.LookupAccount("")
-	require.NoError(t, err, "resolve %s to an account name", sid)
-	if domain == "" {
-		return name
-	}
-	return domain + `\` + name
-}
-
-func TestIsBuiltinAdministratorSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
-		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
-		{"system", "S-1-5-18", false},
-		{"administrators_group", "S-1-5-32-544", false},
-		{"non_nt_authority", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsPrivilegedUserSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"local_system", "S-1-5-18", true},
-		{"local_service", "S-1-5-19", true},
-		{"network_service", "S-1-5-20", true},
-		{"administrators_group", "S-1-5-32-544", true},
-		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"users_group", "S-1-5-32-545", false},
-		{"everyone", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
-	tests := []struct {
-		name     string
-		username string
-		want     bool
-	}{
-		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
-		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
-		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
-		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
-		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
-		// exist on every Windows installation, though they may be disabled.
-		{"builtin_administrator", localAccountNameByRID(t, 500), true},
-		{"guest", localAccountNameByRID(t, 501), false},
-		// Unresolvable accounts fail closed.
-		{"nonexistent_user", "netbird-no-such-user", true},
-		{"empty_username", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
-		})
-	}
-}
-
-func TestIsProcessElevated(t *testing.T) {
-	elevated := isProcessElevated()
-
-	// TokenElevationType is a second, independent view of the same token:
-	// Full means elevated and Limited means a filtered administrator, while
-	// Default covers both a standard user and an administrator with no linked
-	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
-	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
-	require.NoError(t, err, "read token elevation type")
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
-	// counts only enabled SIDs, so a filtered administrator reports false here.
-	member, err := windows.Token(0).IsMember(adminSid)
-	require.NoError(t, err, "check own Administrators membership")
-
-	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
-
-	switch elevationType {
-	case tokenElevationTypeFull:
-		assert.True(t, elevated, "a token of elevation type Full must report elevated")
-	case tokenElevationTypeLimited:
-		assert.False(t, elevated, "a filtered administrator token must not report elevated")
-	}
-
-	// Administrators enabled in the token means the token wields administrative
-	// rights, which is what elevation reports.
-	if member {
-		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
-	}
-}
-
-// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
-// for domain accounts. S4U logons need the TCB privilege, so the test runs
-// only as SYSTEM (which is how CI executes the suite). For local accounts the
-// token's Administrators membership must agree with the SAM enumeration.
-func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
-	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
-	require.NoError(t, err, "create SYSTEM SID")
-	current, err := user.Current()
-	require.NoError(t, err, "get current user")
-	if current.Uid != system.String() {
-		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
-	}
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	checked := 0
-	for _, name := range localAccountNames(t) {
-		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
-		if err != nil {
-			// Disabled or logon-restricted accounts cannot get an S4U logon.
-			t.Logf("skipping %s: %v", name, err)
-			continue
-		}
-		viaSAM, err := localGroupsContainSID(name, adminSid)
-		require.NoError(t, err, "enumerate local groups for %s", name)
-
-		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
-		checked++
-	}
-	// Ineligible accounts are skipped, so without this the test could report
-	// success while comparing nothing at all.
-	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
-	t.Logf("checked %d local accounts via S4U", checked)
-}
-
-// TestLocalGroupsContainSID_Administrator checks the positive case against the
-// built-in Administrator, a member of Administrators on every installation.
-func TestLocalGroupsContainSID_Administrator(t *testing.T) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	administrator := localAccountNameByRID(t, 500)
-	member, err := localGroupsContainSID(administrator, adminSid)
-	require.NoError(t, err, "enumerate local groups for %s", administrator)
-	assert.True(t, member, "%s is a member of the Administrators group", administrator)
-}
-
-// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
-// that resolves to no group: the error must surface rather than being reported
-// as "not a member", so the privilege check treats the account as privileged.
-func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
-	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
-
-	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
-	require.Error(t, err, "must report an error when the wanted group cannot be identified")
-}
-
-func TestLocalGroupsContainSID_Guest(t *testing.T) {
-	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
-	require.NoError(t, err, "create Guests SID")
-	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	guest := localAccountNameByRID(t, 501)
-
-	inGuests, err := localGroupsContainSID(guest, guestsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
-
-	inAdmins, err := localGroupsContainSID(guest, adminsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
-}

client/ssh/server/server_config_test.go

@@ -239,7 +239,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
-		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -249,7 +248,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -259,7 +257,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -269,7 +266,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -277,7 +273,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -285,35 +280,13 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
-			uid:         "0",
 			expectError: false,
 		},
-		{
-			// Only uid 0 is privileged, whatever the account is called.
-			name:          "uid 0 under another name may bind a privileged port",
-			forwardType:   "remote",
-			port:          22,
-			username:      "toor",
-			uid:           "0",
-			expectError:   false,
-			skipOnWindows: true,
-		},
-		{
-			name:          "account named root without uid 0 may not",
-			forwardType:   "remote",
-			port:          22,
-			username:      "root",
-			uid:           "1000",
-			expectError:   true,
-			errorMsg:      "cannot bind to privileged port",
-			skipOnWindows: true,
-		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -326,7 +299,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username, Uid: tt.uid},
+				User:    &user.User{Username: tt.username},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -447,13 +420,6 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
-	// Windows classification depends on account SIDs and group membership, and
-	// the accounts involved carry localized, renameable names. It is covered by
-	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
-	if runtime.GOOS == "windows" {
-		t.Skip("covered by TestIsWindowsAccountPrivileged")
-	}
-
 	tests := []struct {
 		username    string
 		expected    bool
@@ -474,16 +440,44 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-		{
-			username:    "Administrator",
-			expected:    false,
-			description: "Administrator should not be privileged on non-Windows systems",
-		},
+	}
+
+	// Add Windows-specific tests
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    true,
+				description: "Administrator should be considered privileged on Windows",
+			},
+			{
+				username:    "administrator",
+				expected:    true,
+				description: "administrator should be considered privileged on Windows (case insensitive)",
+			},
+		}...)
+	} else {
+		// On non-Windows systems, Administrator should not be privileged
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    false,
+				description: "Administrator should not be privileged on non-Windows systems",
+			},
+		}...)
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedOrUnknown(tt.username)
+			result := isPrivilegedUsername(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}

client/ssh/server/sftp_windows.go

@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := parseUsername(targetUser.Username)
+	username, domain := s.parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {

client/ssh/server/user_utils.go

@@ -16,6 +16,11 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )
 
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
 	getCurrentUser         = currentUserWithGetent
@@ -24,9 +29,6 @@ var (
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 
 	getEuid = os.Geteuid
-
-	getProcessElevated                   = isProcessElevated
-	getWindowsAccountPrivilegedOrUnknown = isWindowsAccountPrivilegedOrUnknown
 )
 
 const (
@@ -63,13 +65,6 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }
 
-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -80,7 +75,7 @@ func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult
 
 	// Handle empty username case - but still check root access controls
 	if req.RequestedUsername == "" {
-		if isPrivilegedOrUnknown(context.currentUser.Username) && !context.allowRoot {
+		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
 			return PrivilegeCheckResult{
 				Allowed: false,
 				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
@@ -140,7 +135,7 @@ func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheck
 
 	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
 
-	if isPrivilegedOrUnknown(resolvedUser.Username) && !ctx.allowRoot {
+	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
 		return PrivilegeCheckResult{
 			Allowed:               false,
 			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
@@ -180,42 +175,6 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }
 
-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result, err := s.userPrivilegeCheck(username)
-	if err != nil {
-		return nil, err
-	}
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -224,6 +183,13 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }
 
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -287,30 +253,159 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }
 
-// isPrivilegedOrUnknown reports whether the given username represents a
-// privileged user, or on Windows an account whose privilege could not be
-// determined.
-// On Unix: root.
-// On Windows: well-known service accounts, built-in Administrator accounts,
-// and members of the local Administrators group; handles domain-qualified
-// usernames like "DOMAIN\user" or "user@domain.com". An account that cannot be
-// resolved or evaluated is reported as privileged.
-//
-// Use this to refuse privileged accounts, never to grant them anything: the
-// undetermined case is safe for a refusal and unsafe for a grant.
-func isPrivilegedOrUnknown(username string) bool {
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return nil, result.Error
+	}
+
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
+// On Unix: root
+// On Windows: Administrator, SYSTEM (case-insensitive)
+// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
+func isPrivilegedUsername(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-	return getWindowsAccountPrivilegedOrUnknown(username)
+
+	bareUsername := username
+	// Handle Windows domain format: DOMAIN\username
+	if idx := strings.LastIndex(username, `\`); idx != -1 {
+		bareUsername = username[idx+1:]
+	}
+	// Handle email-style format: username@domain.com
+	if idx := strings.Index(bareUsername, "@"); idx != -1 {
+		bareUsername = bareUsername[:idx]
+	}
+
+	return isWindowsPrivilegedUser(bareUsername)
+}
+
+// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
+func isWindowsPrivilegedUser(bareUsername string) bool {
+	// common privileged usernames (case insensitive)
+	privilegedNames := []string{
+		"administrator",
+		"admin",
+		"root",
+		"system",
+		"localsystem",
+		"networkservice",
+		"localservice",
+	}
+
+	usernameLower := strings.ToLower(bareUsername)
+	for _, privilegedName := range privilegedNames {
+		if usernameLower == privilegedName {
+			return true
+		}
+	}
+
+	// computer accounts (ending with $) are not privileged by themselves
+	// They only gain privileges through group membership or specific SIDs
+
+	if targetUser, err := lookupUser(bareUsername); err == nil {
+		return isWindowsPrivilegedSID(targetUser.Uid)
+	}
+
+	return false
+}
+
+// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
+func isWindowsPrivilegedSID(sid string) bool {
+	privilegedSIDs := []string{
+		"S-1-5-18",     // Local System (SYSTEM)
+		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
+		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
+		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
+		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
+	}
+
+	for _, privilegedSID := range privilegedSIDs {
+		if sid == privilegedSID {
+			return true
+		}
+	}
+
+	// Check for domain administrator accounts (RID 500 in any domain)
+	// Format: S-1-5-21-domain-domain-domain-500
+	// This is reliable as RID 500 is reserved for the domain Administrator account
+	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
+		return true
+	}
+
+	// Check for other well-known privileged RIDs in domain contexts
+	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
+	if strings.HasPrefix(sid, "S-1-5-21-") {
+		if strings.HasSuffix(sid, "-512") || // Domain Admins group
+			strings.HasSuffix(sid, "-516") || // Domain Controllers group
+			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
+			return true
+		}
+	}
+
+	return false
 }
 
 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means the process token is elevated (administrators, SYSTEM).
+// On Windows, this means running as Administrator or SYSTEM.
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return getProcessElevated()
+		return isWindowsElevated()
 	}
 	return getEuid() == 0
 }
+
+// isWindowsElevated checks if the current process is running with elevated privileges on Windows
+func isWindowsElevated() bool {
+	currentUser, err := getCurrentUser()
+	if err != nil {
+		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
+		return false
+	}
+
+	if isWindowsPrivilegedSID(currentUser.Uid) {
+		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
+		return true
+	}
+
+	if isPrivilegedUsername(currentUser.Username) {
+		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
+		return true
+	}
+
+	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
+	return false
+}

client/ssh/server/user_utils_test.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -28,8 +27,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-	originalGetProcessElevated := getProcessElevated
-	originalGetWindowsAccountPrivilegedOrUnknown := getWindowsAccountPrivilegedOrUnknown
+
+	// Reset caches to ensure clean test state
 
 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -54,31 +53,16 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}
 
-	// Simulate the Windows token elevation check based on the fixture user:
-	// the built-in Administrator (RID 500) and SYSTEM run elevated.
-	getProcessElevated = func() bool {
+	// Mock privilege detection based on the test user
+	getIsProcessPrivileged = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
-	}
-
-	// Simulate the Windows account classifier for the fixture accounts.
-	// "root" does not exist on Windows; the real classifier fails closed on
-	// unresolvable accounts, so it counts as privileged here too.
-	getWindowsAccountPrivilegedOrUnknown = func(username string) bool {
-		bare := username
-		if idx := strings.LastIndex(bare, `\`); idx != -1 {
-			bare = bare[idx+1:]
-		}
-		if idx := strings.Index(bare, "@"); idx != -1 {
-			bare = bare[:idx]
-		}
-		switch strings.ToLower(bare) {
-		case "administrator", "system", "root":
+		// Check both username and SID for Windows systems
+		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
 			return true
 		}
-		return false
+		return isPrivilegedUsername(currentUser.Username)
 	}
 
 	// Return cleanup function
@@ -87,8 +71,10 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-		getProcessElevated = originalGetProcessElevated
-		getWindowsAccountPrivilegedOrUnknown = originalGetWindowsAccountPrivilegedOrUnknown
+
+		getIsProcessPrivileged = isCurrentProcessPrivileged
+
+		// Reset caches after test
 	}
 }
 
@@ -435,9 +421,6 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }
 
 func TestPrivilegedUsernameDetection(t *testing.T) {
-	// Windows classification is syscall-backed (SID resolution, group
-	// membership) and is covered by privileges_windows_test.go; here only the
-	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -449,9 +432,25 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
 
-		// Windows dispatch to the (mocked) account classifier
+		// Windows tests
 		{"windows_administrator", "Administrator", "windows", true},
+		{"windows_system", "SYSTEM", "windows", true},
+		{"windows_admin", "admin", "windows", true},
+		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
+		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
+		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
+		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
+		{"windows_localsystem", "localsystem", "windows", true},
+		{"windows_networkservice", "networkservice", "windows", true},
+		{"windows_localservice", "localservice", "windows", true},
+
+		// Computer accounts (these depend on current user context in real implementation)
+		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
+		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
+
+		// Cross-platform
+		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}
 
 	for _, tt := range tests {
@@ -460,8 +459,50 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
 			defer cleanup()
 
-			result := isPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
+			result := isPrivilegedUsername(tt.username)
+			assert.Equal(t, tt.privileged, result)
+		})
+	}
+}
+
+func TestWindowsPrivilegedSIDDetection(t *testing.T) {
+	tests := []struct {
+		name        string
+		sid         string
+		privileged  bool
+		description string
+	}{
+		// Well-known system accounts
+		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
+		{"local_service", "S-1-5-19", true, "Local Service"},
+		{"network_service", "S-1-5-20", true, "Network Service"},
+		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
+		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
+
+		// Domain accounts
+		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
+		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
+		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
+		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
+
+		// Regular users
+		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
+		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
+		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
+
+		// Groups that are not privileged
+		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
+		{"power_users", "S-1-5-32-547", false, "Power Users group"},
+
+		// Invalid SIDs
+		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
+		{"empty_sid", "", false, "Empty SID"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsPrivilegedSID(tt.sid)
+			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
 		})
 	}
 }

client/ssh/server/userswitching_windows.go

@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
 
-	username, _ := parseUsername(localUser.Username)
+	username, _ := s.parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 
 	shell := getUserShell(localUser.Uid)
 
@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }
 
 // parseUsername extracts username and domain from a Windows username
-func parseUsername(fullUsername string) (username, domain string) {
+func (s *Server) parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]

e2e/harness/Dockerfile.client

@@ -20,9 +20,5 @@ ENV NETBIRD_BIN="/usr/local/bin/netbird" \
     NB_ENABLE_CAPTURE="false" \
     NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
 ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
-# --chmod because the build context is not always a git checkout. A suite in
-# another module builds from this module's extracted copy in the module cache,
-# where every file is 0444 — the cache drops the executable bit git records — and
-# a bare COPY then produces an entrypoint the runtime cannot exec.
-COPY --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+COPY client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
 COPY --from=builder /out/netbird /usr/local/bin/netbird

e2e/harness/client.go

@@ -32,36 +32,12 @@ type Client struct {
 	container testcontainers.Container
 }
 
-// clientOptions is what the ClientOption values assemble.
-type clientOptions struct {
-	name string
-}
-
-// ClientOption adjusts how StartClient runs the agent.
-type ClientOption func(*clientOptions)
-
-// WithClientName names the agent, which sets both its network alias and its
-// container hostname. The hostname matters beyond addressing: the agent reports
-// it to management at registration, so it is the name the peer appears under in
-// the API.
-//
-// Required to run more than one agent against the same server — the default name
-// is shared, and two containers cannot hold the same alias on one network.
-func WithClientName(name string) ClientOption {
-	return func(o *clientOptions) { o.name = name }
-}
-
 // StartClient builds the client image and runs it on the combined server's
 // network, joining via the given setup key. The image entrypoint brings the
 // daemon up automatically; callers wait for connectivity with WaitConnected /
 // WaitProxyPeer.
-func StartClient(ctx context.Context, c *Combined, setupKey string, opts ...ClientOption) (*Client, error) {
-	o := clientOptions{name: clientAlias}
-	for _, opt := range opts {
-		opt(&o)
-	}
-
-	root, err := repoRoot(ctx)
+func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, error) {
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}
@@ -71,13 +47,9 @@ func StartClient(ctx context.Context, c *Combined, setupKey string, opts ...Clie
 	}
 
 	req := testcontainers.ContainerRequest{
-		Image: clientImage,
-		// The agent reports the container's hostname to management, so this is
-		// the name the peer is addressable by in the API as well as on the
-		// network. The entrypoint takes no hostname flag of its own.
-		Hostname:       o.name,
+		Image:          clientImage,
 		Networks:       []string{c.network.Name},
-		NetworkAliases: map[string][]string{c.network.Name: {o.name}},
+		NetworkAliases: map[string][]string{c.network.Name: {clientAlias}},
 		Env: map[string]string{
 			"NB_MANAGEMENT_URL": combinedExposedURL,
 			"NB_SETUP_KEY":      setupKey,

e2e/harness/combined.go

@@ -61,68 +61,11 @@ type Combined struct {
 	workDir string
 }
 
-// combinedOptions is what the CombinedOption values assemble.
-type combinedOptions struct {
-	geolocation bool
-	env         map[string]string
-}
-
-// CombinedOption adjusts how StartCombined boots the server. The defaults suit a
-// suite that only drives the API; the options exist for the ones that need more
-// of the product than that.
-type CombinedOption func(*combinedOptions)
-
-// WithGeolocation leaves the GeoLite database download enabled. It is off by
-// default because the download adds startup latency that most suites get nothing
-// for. A suite asserting on location-based posture checks needs it: management
-// evaluates those rules against the database, and without it the rule fails
-// instead of passing without having been checked.
-func WithGeolocation() CombinedOption {
-	return func(o *combinedOptions) { o.geolocation = true }
-}
-
-// WithServerEnv adds environment variables to the combined container, overriding
-// the defaults on a key collision. For settings this harness does not model
-// directly, so a suite needing one does not have to fork the harness to get it.
-func WithServerEnv(env map[string]string) CombinedOption {
-	return func(o *combinedOptions) {
-		if o.env == nil {
-			o.env = map[string]string{}
-		}
-		for k, v := range env {
-			o.env[k] = v
-		}
-	}
-}
-
-// combinedEnv is the combined container's environment: setup-PAT enabled so the
-// caller can mint an admin token through /api/setup, geolocation off unless the
-// suite asked for it, and whatever the suite added on top.
-func combinedEnv(o combinedOptions) map[string]string {
-	env := map[string]string{
-		"NB_SETUP_PAT_ENABLED": "true",
-	}
-	if !o.geolocation {
-		// Skip the GeoLite DB download — it blocks startup and agent-network
-		// ingest doesn't use geolocation.
-		env["NB_DISABLE_GEOLOCATION"] = "true"
-	}
-	for k, v := range o.env {
-		env[k] = v
-	}
-	return env
-}
-
 // StartCombined builds the combined server from its multistage Dockerfile and
 // boots it with setup-PAT enabled on a fresh shared network, returning once the
 // API is serving. The caller still owns minting the admin PAT via Bootstrap.
-func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, error) {
-	var o combinedOptions
-	for _, opt := range opts {
-		opt(&o)
-	}
-
-	root, err := repoRoot(ctx)
+func StartCombined(ctx context.Context) (*Combined, error) {
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}
@@ -145,7 +88,7 @@ func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, erro
 		return nil, fmt.Errorf("create work dir: %w", err)
 	}
 
-	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
+	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, containerIssuer)
 	if err := os.WriteFile(filepath.Join(workDir, "config.yaml"), []byte(cfg), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("write combined config: %w", err)
@@ -169,8 +112,13 @@ func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, erro
 		ExposedPorts:   []string{combinedHTTPPort},
 		Networks:       []string{net.Name},
 		NetworkAliases: map[string][]string{net.Name: {combinedAlias}},
-		Env:            combinedEnv(o),
-		Cmd:            []string{"--config", "/nb/config.yaml"},
+		Env: map[string]string{
+			"NB_SETUP_PAT_ENABLED": "true",
+			// Skip the GeoLite DB download — it blocks startup and agent-network
+			// ingest doesn't use geolocation.
+			"NB_DISABLE_GEOLOCATION": "true",
+		},
+		Cmd: []string{"--config", "/nb/config.yaml"},
 		HostConfigModifier: func(hc *container.HostConfig) {
 			hc.Binds = append(hc.Binds, workDir+":/nb")
 		},

e2e/harness/config.go

@@ -15,11 +15,6 @@ package harness
 // server is required to load it — a broken path or malformed file fails startup
 // rather than silently falling back to the compiled-in rates, and TestMain then
 // fails with the container logs.
-//
-// disableGeoliteUpdate is a parameter rather than a fixed true because a suite
-// that exercises geolocation needs the database: management can only evaluate a
-// location rule with GeoLite loaded, and a rule it cannot evaluate fails rather
-// than passing vacuously. See WithGeolocation.
 const combinedConfigYAML = `server:
   listenAddress: ":8080"
   exposedAddress: "%s"
@@ -30,7 +25,7 @@ const combinedConfigYAML = `server:
   authSecret: "e2e-relay-secret"
   dataDir: "/nb/data"
   disableAnonymousMetrics: true
-  disableGeoliteUpdate: %t
+  disableGeoliteUpdate: true
   auth:
     issuer: "%s"
   store:

e2e/harness/options_test.go

@@ -1,161 +0,0 @@
-//go:build e2e
-
-package harness
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The options exist so a suite can ask for a deployment this harness would not
-// otherwise give it. What they configure is a container environment and a config
-// file, both assembled before anything is started, so they are checkable without
-// Docker — which is the point: a wiring mistake here would otherwise only show up
-// as a puzzling failure minutes into a container run.
-
-func TestCombinedEnvGeolocation(t *testing.T) {
-	var off combinedOptions
-	assert.Equal(t, "true", combinedEnv(off)["NB_DISABLE_GEOLOCATION"],
-		"geolocation should be off by default")
-
-	var on combinedOptions
-	WithGeolocation()(&on)
-	assert.NotContains(t, combinedEnv(on), "NB_DISABLE_GEOLOCATION",
-		"WithGeolocation must leave NB_DISABLE_GEOLOCATION unset, so the server downloads the database")
-	assert.Equal(t, "true", combinedEnv(on)["NB_SETUP_PAT_ENABLED"],
-		"the setup PAT must stay enabled whatever else is configured; Bootstrap depends on it")
-}
-
-// The config file carries the same decision as the environment variable, and the
-// server needs both to agree: disableGeoliteUpdate suppresses the download even
-// when geolocation itself is enabled.
-func TestCombinedConfigGeolocation(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		opts []CombinedOption
-		want string
-	}{
-		{name: "default", want: "disableGeoliteUpdate: true"},
-		{name: "with geolocation", opts: []CombinedOption{WithGeolocation()}, want: "disableGeoliteUpdate: false"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			var o combinedOptions
-			for _, opt := range tc.opts {
-				opt(&o)
-			}
-			cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
-			assert.Contains(t, cfg, tc.want, "geolocation not rendered as expected")
-			// The issuer is the last verb; a mis-ordered argument list would put
-			// the boolean here instead and the server would fail to start.
-			assert.Contains(t, cfg, `issuer: "`+containerIssuer+`"`, "issuer not rendered")
-		})
-	}
-}
-
-func TestWithServerEnvOverrides(t *testing.T) {
-	var o combinedOptions
-	WithServerEnv(map[string]string{"NB_LOG_LEVEL": "debug"})(&o)
-	WithServerEnv(map[string]string{"NB_SETUP_PAT_ENABLED": "false"})(&o)
-
-	env := combinedEnv(o)
-	assert.Equal(t, "debug", env["NB_LOG_LEVEL"], "added variable missing")
-	assert.Equal(t, "false", env["NB_SETUP_PAT_ENABLED"], "a suite must be able to override a default")
-}
-
-// Two agents on one network cannot share an alias, so the name has to reach both
-// the alias and the hostname. The hostname is the one management records, so it is
-// also what the peer is addressable by through the API.
-func TestWithClientName(t *testing.T) {
-	o := clientOptions{name: clientAlias}
-	require.Equal(t, "client", o.name, "unexpected default client name")
-
-	WithClientName("peer2")(&o)
-	assert.Equal(t, "peer2", o.name, "WithClientName did not take")
-}
-
-// repoRoot has to recognise this module rather than merely finding a go.mod, or a
-// suite in another module gets its own root and a build context without the
-// component Dockerfiles in it.
-func TestIsModule(t *testing.T) {
-	dir := t.TempDir()
-
-	other := filepath.Join(dir, "go.mod")
-	require.NoError(t, os.WriteFile(other, []byte("module example.com/other\n\ngo 1.25\n"), 0o600))
-	assert.False(t, isModule(other, modulePath), "another module's go.mod must not be taken for this repo")
-
-	ours := filepath.Join(dir, "ours.mod")
-	require.NoError(t, os.WriteFile(ours, []byte("// a comment\n\nmodule "+modulePath+"\n\ngo 1.25\n"), 0o600))
-	assert.True(t, isModule(ours, modulePath), "this repo's go.mod was not recognised")
-
-	assert.False(t, isModule(filepath.Join(dir, "absent.mod"), modulePath),
-		"a missing go.mod must not report a match")
-}
-
-// Running from inside the repo, repoRoot finds it by walking up — the module
-// lookup is only the fallback, and this asserts the walk still wins so an in-repo
-// run never depends on the module cache.
-func TestRepoRootFindsThisRepo(t *testing.T) {
-	root, err := repoRoot(context.Background())
-	require.NoError(t, err)
-	assert.True(t, isModule(filepath.Join(root, "go.mod"), modulePath),
-		"repoRoot returned %s, which is not this module", root)
-
-	for _, f := range []string{combinedDockerfile, clientDockerfile} {
-		_, err := os.Stat(filepath.Join(root, f))
-		assert.NoError(t, err, "%s is not present under the reported root %s", f, root)
-	}
-}
-
-// A caller that vendors its dependencies puts the go command in automatic vendor
-// mode, where `go list -m -f {{.Dir}}` succeeds and reports an EMPTY directory:
-// vendor/ holds packages, not module source. Without -mod=readonly the lookup
-// would come back empty and the harness would report a missing module for a
-// dependency that is present.
-func TestModuleDirResolvesUnderVendorMode(t *testing.T) {
-	if _, err := exec.LookPath("go"); err != nil {
-		t.Skip("no go tool on PATH")
-	}
-	ctx := context.Background()
-
-	base := t.TempDir()
-	dep := filepath.Join(base, "dep")
-	main := filepath.Join(base, "main")
-	require.NoError(t, os.MkdirAll(dep, 0o750))
-	require.NoError(t, os.MkdirAll(main, 0o750))
-
-	// A local replacement rather than a real dependency, so this needs no network.
-	require.NoError(t, os.WriteFile(filepath.Join(dep, "go.mod"),
-		[]byte("module example.com/dep\n\ngo 1.25\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(dep, "dep.go"),
-		[]byte("package dep\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(main, "go.mod"),
-		[]byte("module example.com/main\n\ngo 1.25\n\nrequire example.com/dep v0.0.0\n\nreplace example.com/dep v0.0.0 => ../dep\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(main, "main.go"),
-		[]byte("package main\n\nimport _ \"example.com/dep\"\n\nfunc main() {}\n"), 0o600))
-
-	t.Chdir(main)
-	vendor := exec.CommandContext(ctx, "go", "mod", "vendor")
-	out, err := vendor.CombinedOutput()
-	require.NoError(t, err, "go mod vendor: %s", out)
-
-	dir, err := moduleDir(ctx, "example.com/dep")
-	require.NoError(t, err, "the module must still resolve with a vendor directory present")
-	assert.Equal(t, dep, dir, "resolved the wrong directory")
-}
-
-// A cancelled context has to stop the lookup rather than leaving the caller
-// waiting on a subprocess it has already given up on.
-func TestModuleDirHonoursContext(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	_, err := moduleDir(ctx, modulePath)
-	assert.ErrorIs(t, err, context.Canceled, "a cancelled context must stop the lookup")
-}

e2e/harness/paths.go

@@ -3,82 +3,27 @@
 package harness
 
 import (
-	"context"
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"strings"
 )
 
-// modulePath is this module, used both to recognise the repo when walking up
-// from the working directory and to locate it when the suite lives elsewhere.
-const modulePath = "github.com/netbirdio/netbird"
-
-// repoRoot returns the directory the component Dockerfiles are built from.
-//
-// Walking up from the working directory finds it for any test inside this repo,
-// no matter which package it runs from. A suite in another module gets a
-// different answer that way — its own module root, where combined/Dockerfile
-// does not exist — so the ancestor has to be this module and not merely some
-// module. When it is not, the build context is the extracted module directory of
-// whichever version that suite depends on, which is the right one: the server it
-// tests against is then built from the same revision as the client library it
-// was compiled with.
-func repoRoot(ctx context.Context) (string, error) {
+// repoRoot walks up from the working directory to the module root (the
+// directory holding go.mod), so the Docker build context is correct no matter
+// which package the test runs from.
+func repoRoot() (string, error) {
 	dir, err := os.Getwd()
 	if err != nil {
 		return "", err
 	}
 	for {
-		if isModule(filepath.Join(dir, "go.mod"), modulePath) {
+		if _, statErr := os.Stat(filepath.Join(dir, "go.mod")); statErr == nil {
 			return dir, nil
 		}
 		parent := filepath.Dir(dir)
 		if parent == dir {
-			break
+			return "", fmt.Errorf("go.mod not found above %s", dir)
 		}
 		dir = parent
 	}
-	return moduleDir(ctx, modulePath)
-}
-
-// isModule reports whether the go.mod at path declares the given module.
-func isModule(path, want string) bool {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return false
-	}
-	for _, line := range strings.Split(string(b), "\n") {
-		if rest, ok := strings.CutPrefix(strings.TrimSpace(line), "module "); ok {
-			return strings.TrimSpace(rest) == want
-		}
-	}
-	return false
-}
-
-// moduleDir asks the go tool where a module's source is, which for a dependent
-// module is its extracted copy in the module cache. The cache is read-only, and
-// a Docker build context is only ever read.
-//
-// -mod=readonly is required rather than cosmetic. A caller that vendors its
-// dependencies puts the go command in automatic vendor mode, where this lookup
-// succeeds with an EMPTY directory — vendor/ holds packages, not module source,
-// so there is nothing to report. Asking in readonly mode resolves against the
-// module graph instead, which answers for both a cached module and a local
-// replacement, and neither writes to go.mod.
-func moduleDir(ctx context.Context, module string) (string, error) {
-	cmd := exec.CommandContext(ctx, "go", "list", "-mod=readonly", "-m", "-f", "{{.Dir}}", module)
-	out, err := cmd.Output()
-	if err != nil {
-		return "", fmt.Errorf("locate %s: %w", module, err)
-	}
-	dir := strings.TrimSpace(string(out))
-	if dir == "" {
-		return "", fmt.Errorf("locate %s: the go tool reported no directory; run `go mod download %s`", module, module)
-	}
-	if _, err := os.Stat(dir); err != nil {
-		return "", fmt.Errorf("locate %s: %w", module, err)
-	}
-	return dir, nil
 }

e2e/harness/proxy.go

@@ -43,7 +43,7 @@ type Proxy struct {
 // or override any NB_PROXY_* var (e.g. NB_PROXY_TUNNEL_CACHE_TTL for tests that
 // need a short authorization-cache window).
 func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverrides ...map[string]string) (*Proxy, error) {
-	root, err := repoRoot(ctx)
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}