Merge remote-tracking branch 'origin/main' into merge-modify-peer-reactivate

client/embed/embed.go

@@ -91,13 +91,6 @@ type Options struct {
 	// when the embedded client must never act as a stepping stone into
 	// the host's local network (e.g. the proxy's overlay peer).
 	BlockLANAccess bool
-	// LazyConnectionEnabled is a tri-state local override for lazy connections,
-	// mirroring the NB_LAZY_CONN env var. Nil defers to the management feature
-	// flag; a set value overrides it in both directions. A short-lived client
-	// that reaches only a few known peers can set this to false, so its peers
-	// connect eagerly and the first request does not wait for the connection to
-	// be established.
-	LazyConnectionEnabled *bool
 	// WireguardPort is the port for the tunnel interface. Use 0 for a random port.
 	WireguardPort *int
 	// MTU is the MTU for the tunnel interface.
@@ -227,15 +220,6 @@ func New(opts Options) (*Client, error) {
 		config.PrivateKey = opts.PrivateKey
 	}
 
-	if opts.LazyConnectionEnabled != nil {
-		// Runtime-only override, read back through lazyconn.ParseState; a set value
-		// wins over the management feature flag in both directions.
-		config.LazyConnection = "off"
-		if *opts.LazyConnectionEnabled {
-			config.LazyConnection = "on"
-		}
-	}
-
 	if opts.Performance.PreallocatedBuffersPerPool != nil {
 		wgdevice.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
 	}

client/internal/engine.go

@@ -863,19 +863,40 @@ func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 		}
 	}
 
-	// second, close all modified connections and remove them from the state map
+	// second, look up the activation state of all modified peers before removing
+	// any of them, so an unavailable state leaves the current connections intact
+	active := make(map[string]bool, len(modified))
 	for _, p := range modified {
-		err := e.removePeer(p.GetWgPubKey())
+		peerPubKey := p.GetWgPubKey()
+		state, err := e.statusRecorder.GetPeer(peerPubKey)
 		if err != nil {
+			return fmt.Errorf("get status of modified peer %s: %w", peerPubKey, err)
+		}
+		active[peerPubKey] = state.ConnStatus != peer.StatusIdle
+	}
+	// then close all modified connections and remove them from the state map
+	for _, p := range modified {
+		if err := e.removePeer(p.GetWgPubKey()); err != nil {
 			return err
 		}
 	}
-	// third, add the peer connections again
+	// third, add the peer connections again, restoring each peer's activation
+	// state: under lazy connections a re-added peer starts idle, but the remote
+	// side of an established connection keeps its state and sends no further
+	// offers, so a previously active peer left idle cannot reconnect until the
+	// remote's connection expires.
 	for _, p := range modified {
-		err := e.addNewPeer(p)
-		if err != nil {
+		if err := e.addNewPeer(p); err != nil {
 			return err
 		}
+		if !active[p.GetWgPubKey()] {
+			continue
+		}
+		conn, ok := e.peerStore.PeerConn(p.GetWgPubKey())
+		if !ok {
+			continue
+		}
+		e.connMgr.ActivatePeer(e.ctx, conn)
 	}
 	return nil
 }

client/internal/engine_test.go

@@ -26,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
@@ -466,6 +467,163 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	}
 }
 
+// TestEngine_ModifiedPeerKeepsActivationState verifies that a peer re-added by
+// modifyPeers keeps its previous activation state under lazy connections. A
+// modified peer is removed and re-added, and a re-add defaults to idle; the
+// remote side of an established connection keeps its state and sends no further
+// offers, so a previously active peer parked idle leaves the pair unable to
+// reconnect until the remote's connection expires.
+func TestEngine_ModifiedPeerKeepsActivationState(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	t.Cleanup(cancel)
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:    "utun103",
+		WgAddr:         wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey:   key,
+		WgPort:         33101,
+		MTU:            iface.DefaultMTU,
+		LazyConnection: lazyconn.StateOn,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      &mgmt.MockClient{},
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	wgIface := &MockWGIface{
+		NameFunc: func() string { return "utun103" },
+		IsUserspaceBindFunc: func() bool {
+			return false
+		},
+		RemovePeerFunc: func(peerKey string) error {
+			return nil
+		},
+		AddressFunc: func() wgaddr.Address {
+			return wgaddr.Address{
+				IP:      netip.MustParseAddr("10.20.0.1"),
+				Network: netip.MustParsePrefix("10.20.0.0/24"),
+			}
+		},
+		UpdatePeerFunc: func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+			return nil
+		},
+	}
+	engine.wgInterface = wgIface
+	engine.routeManager = routemanager.NewManager(routemanager.ManagerConfig{
+		Context:          ctx,
+		PublicKey:        key.PublicKey().String(),
+		DNSRouteInterval: time.Minute,
+		WGInterface:      engine.wgInterface,
+		StatusRecorder:   engine.statusRecorder,
+		RelayManager:     relayMgr,
+	})
+	require.NoError(t, engine.routeManager.Init())
+	engine.dnsServer = &dns.MockServer{
+		UpdateDNSServerFunc: func(serial uint64, update nbdns.Config) error { return nil },
+	}
+	udpConn, err := net.ListenUDP("udp4", nil)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if err := udpConn.Close(); err != nil {
+			t.Errorf("close UDP listener: %v", err)
+		}
+	})
+	engine.udpMux = udpmux.NewUniversalUDPMuxDefault(udpmux.UniversalUDPMuxParams{UDPConn: udpConn, MTU: 1280})
+	engine.ctx = ctx
+	engine.srWatcher = guard.NewSRWatcher(nil, nil, nil, icemaker.Config{})
+	engine.connMgr = NewConnMgr(engine.config, engine.statusRecorder, engine.peerStore, wgIface)
+	engine.connMgr.Start(ctx)
+	t.Cleanup(engine.connMgr.Close)
+
+	// No agent version: not lazy-capable, so the connection opens permanently.
+	activePeer := &mgmtProto.RemotePeerConfig{
+		WgPubKey:   "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		AllowedIps: []string{"100.64.0.10/24"},
+	}
+	// Lazy-capable, never activated: managed as idle.
+	idlePeer := &mgmtProto.RemotePeerConfig{
+		WgPubKey:     "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		AllowedIps:   []string{"100.64.0.11/24"},
+		AgentVersion: "development",
+	}
+
+	err = engine.updateNetworkMap(&mgmtProto.NetworkMap{
+		Serial:      1,
+		RemotePeers: []*mgmtProto.RemotePeerConfig{activePeer, idlePeer},
+	})
+	require.NoError(t, err)
+
+	state, err := engine.statusRecorder.GetPeer(activePeer.WgPubKey)
+	require.NoError(t, err)
+	require.Equal(t, peer.StatusConnecting, state.ConnStatus, "peer without lazy support should open a permanent connection")
+
+	state, err = engine.statusRecorder.GetPeer(idlePeer.WgPubKey)
+	require.NoError(t, err)
+	require.Equal(t, peer.StatusIdle, state.ConnStatus, "lazy-capable peer should be managed as idle")
+
+	// The active peer's agent version changes, as when a peer registered over the
+	// API logs in and fills in its meta; the idle peer's allowed IPs change. Both
+	// count as modified and are removed and re-added.
+	err = engine.updateNetworkMap(&mgmtProto.NetworkMap{
+		Serial: 2,
+		RemotePeers: []*mgmtProto.RemotePeerConfig{
+			{
+				WgPubKey:     activePeer.WgPubKey,
+				AllowedIps:   activePeer.AllowedIps,
+				AgentVersion: "development",
+			},
+			{
+				WgPubKey:     idlePeer.WgPubKey,
+				AllowedIps:   []string{"100.64.0.21/24"},
+				AgentVersion: "development",
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	state, err = engine.statusRecorder.GetPeer(activePeer.WgPubKey)
+	require.NoError(t, err)
+	assert.NotEqual(t, peer.StatusIdle, state.ConnStatus, "previously active peer should stay active after a modify")
+
+	state, err = engine.statusRecorder.GetPeer(idlePeer.WgPubKey)
+	require.NoError(t, err)
+	assert.Equal(t, peer.StatusIdle, state.ConnStatus, "previously idle peer should stay idle after a modify")
+
+	// A missing status entry fails the modify before any connection is removed.
+	require.NoError(t, engine.statusRecorder.RemovePeer(activePeer.WgPubKey))
+	err = engine.updateNetworkMap(&mgmtProto.NetworkMap{
+		Serial: 3,
+		RemotePeers: []*mgmtProto.RemotePeerConfig{
+			{
+				WgPubKey:     activePeer.WgPubKey,
+				AllowedIps:   []string{"100.64.0.30/24"},
+				AgentVersion: "development",
+			},
+			{
+				WgPubKey:     idlePeer.WgPubKey,
+				AllowedIps:   []string{"100.64.0.31/24"},
+				AgentVersion: "development",
+			},
+		},
+	})
+	require.ErrorContains(t, err, "get status of modified peer", "a modify with an unavailable peer state should fail")
+
+	activeConn, ok := engine.peerStore.PeerConn(activePeer.WgPubKey)
+	require.True(t, ok, "peer with unavailable state should keep its connection")
+	assert.True(t, compareNetIPLists(activeConn.WgConfig().AllowedIps, activePeer.AllowedIps),
+		"peer with unavailable state should keep its allowed IPs")
+
+	idleConn, ok := engine.peerStore.PeerConn(idlePeer.WgPubKey)
+	require.True(t, ok, "the other modified peer should keep its connection")
+	assert.True(t, compareNetIPLists(idleConn.WgConfig().AllowedIps, []string{"100.64.0.21/24"}),
+		"the other modified peer should keep its allowed IPs")
+}
+
 func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 	testCases := []struct {
 		name                 string

client/system/info_js.go

@@ -15,7 +15,7 @@ func UpdateStaticInfoAsync() {
 }
 
 // GetInfo retrieves system information for WASM environment
-func GetInfo(ctx context.Context) *Info {
+func GetInfo(_ context.Context) *Info {
 	info := &Info{
 		GoOS:           runtime.GOOS,
 		Kernel:         runtime.GOARCH,
@@ -30,13 +30,6 @@ func GetInfo(ctx context.Context) *Info {
 	collectBrowserInfo(info)
 	collectLocationInfo(info)
 	collectSystemInfo(info)
-
-	// A caller-provided device name wins, as on the other platforms. A peer
-	// registered over an API keeps reporting the name it was registered with,
-	// so its meta does not change on the first sync.
-	if name := extractDeviceName(ctx, info.Hostname); name != "" {
-		info.Hostname = name
-	}
 	return info
 }
 

client/system/info_js_test.go

@@ -1,27 +0,0 @@
-//go:build js
-
-package system
-
-import (
-	"context"
-	"testing"
-)
-
-// TestGetInfoHonorsDeviceName covers a caller-provided device name reaching the
-// reported hostname, so a peer registered over an API keeps reporting the name
-// it was registered with instead of renaming itself on its first sync.
-func TestGetInfoHonorsDeviceName(t *testing.T) {
-	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "session-name")
-	if got := GetInfo(ctx).Hostname; got != "session-name" {
-		t.Errorf("hostname should carry the caller's device name, got %q", got)
-	}
-}
-
-// TestGetInfoWithoutDeviceNameKeepsFallback covers the embed layer's habit of
-// always setting the context value: an empty name must not blank the hostname.
-func TestGetInfoWithoutDeviceNameKeepsFallback(t *testing.T) {
-	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "")
-	if got := GetInfo(ctx).Hostname; got == "" {
-		t.Error("an empty device name must not blank the hostname")
-	}
-}

client/system/process_test.go

@@ -1,5 +1,3 @@
-//go:build windows || (linux && !android) || (darwin && !ios) || freebsd
-
 package system
 
 import (

client/ui/i18n/locales/de/common.json

@@ -764,19 +764,7 @@
         "message": "Sensible Informationen anonymisieren"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Verbirgt IP-Adressen, Domains und andere sensible Werte."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Der Standardmodus lässt interne IPv4-Adressen und Peer-Namen für den Support lesbar. Der strikte Modus anonymisiert zusätzlich private (RFC 1918), CGNAT- und Link-Local-IP-Adressen, Peer-Namen und öffentliche WireGuard-Schlüssel. Wiederkehrende Werte erhalten denselben Platzhalter, sodass Peers unterscheidbar bleiben. Verwenden Sie den strikten Modus, wenn Sie das Debug-Paket außerhalb Ihrer Organisation weitergeben."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Keine"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Standard"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Strikt"
+        "message": "Versteckt öffentliche IP-Adressen und nicht-NetBird-Domains in Logs."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Systeminformationen einschließen"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Sie können dies deaktivieren, aber zum erneuten Aktivieren sind {actor} erforderlich:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Sie können dies aktivieren, aber zum erneuten Deaktivieren sind {actor} erforderlich:"
     }
 }

client/ui/i18n/locales/es/common.json

@@ -764,19 +764,7 @@
         "message": "Anonimizar información sensible"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta direcciones IP, dominios y otros valores sensibles."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "El modo predeterminado mantiene legibles las direcciones IPv4 internas y los nombres de los peers para el soporte. El modo estricto anonimiza además las direcciones IP privadas (RFC 1918), CGNAT y de enlace local, los nombres de los peers y las claves públicas de WireGuard. Los valores recurrentes se asignan al mismo marcador de posición, por lo que los peers siguen siendo distinguibles. Use el modo estricto cuando comparta el paquete de diagnóstico fuera de su organización."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Ninguno"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Predeterminado"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Estricto"
+        "message": "Oculta las direcciones IP públicas y los dominios ajenos a NetBird de los registros."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir información del sistema"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "La operación falló."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requiere {actor}. Ejecute esto en su lugar:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}:"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -764,19 +764,7 @@
         "message": "Anonymiser les informations sensibles"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Masque les adresses IP, les domaines et d'autres valeurs sensibles."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Le mode par défaut garde les adresses IPv4 internes et les noms des pairs lisibles pour le support. Le mode strict anonymise en plus les adresses IP privées (RFC 1918), CGNAT et de lien local, les noms des pairs et les clés publiques WireGuard. Les valeurs récurrentes reçoivent le même espace réservé, les pairs restent donc distinguables. Utilisez le mode strict lorsque vous partagez le lot de diagnostic en dehors de votre organisation."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Aucune"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Par défaut"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Strict"
+        "message": "Masque les adresses IP publiques et les domaines non-NetBird dans les journaux."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Inclure les informations système"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor} :"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor} :"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -764,19 +764,7 @@
         "message": "Érzékeny információk anonimizálása"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Elrejti az IP-címeket, a tartományokat és más érzékeny értékeket."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Az Alapértelmezett szint a belső IPv4-címeket és a peer-neveket olvashatóan hagyja a támogatás számára. A Szigorú ezen felül anonimizálja a privát (RFC 1918), CGNAT és link-local IP-címeket, a peer-neveket és a WireGuard nyilvános kulcsokat. Az ismétlődő értékek ugyanazt a helyettesítőt kapják, így a peerek megkülönböztethetők maradnak. Használja a Szigorú szintet, ha a hibakeresési csomagot a szervezetén kívül osztja meg."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Nincs"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Alapértelmezett"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Szigorú"
+        "message": "Elrejti a nyilvános IP-címeket és a nem-NetBird tartományokat a naplókban."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Rendszerinformációk beillesztése"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges:"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -764,19 +764,7 @@
         "message": "Anonimizza informazioni sensibili"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Nasconde indirizzi IP, domini e altri valori sensibili."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "La modalità predefinita mantiene leggibili gli indirizzi IPv4 interni e i nomi dei peer per il supporto. La modalità rigorosa anonimizza inoltre gli indirizzi IP privati (RFC 1918), CGNAT e link-local, i nomi dei peer e le chiavi pubbliche WireGuard. I valori ricorrenti vengono associati allo stesso segnaposto, quindi i peer restano distinguibili. Usa la modalità rigorosa quando condividi il pacchetto di debug al di fuori della tua organizzazione."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Nessuna"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Predefinito"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Rigoroso"
+        "message": "Nasconde gli indirizzi IP pubblici e i domini non NetBird dai log."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Includi informazioni di sistema"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Richiede {actor}. Esegua invece questo:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}:"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -764,19 +764,7 @@
         "message": "機密情報を匿名化"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "IP アドレス、ドメイン、その他の機密性の高い値を隠します。"
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "「デフォルト」では、サポートのために内部 IPv4 アドレスとピア名は読める状態のまま残ります。「厳格」では、さらにプライベート (RFC 1918)、CGNAT、リンクローカルの IP アドレス、ピア名、WireGuard 公開鍵も匿名化されます。繰り返し現れる値は同じプレースホルダーに置き換えられるため、ピアは区別できます。デバッグバンドルを組織外に共有する場合は「厳格」を使用してください。"
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "なし"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "デフォルト"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "厳格"
+        "message": "ログからパブリック IP アドレスと NetBird 以外のドメインを隠します。"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "システム情報を含める"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "無効にはできますが、再度有効にするには{actor}が必要です:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "有効にはできますが、再度無効にするには{actor}が必要です:"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -764,19 +764,7 @@
         "message": "Anonimizar informações sensíveis"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta endereços IP, domínios e outros valores sensíveis."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "O modo padrão mantém os endereços IPv4 internos e os nomes dos peers legíveis para o suporte. O modo estrito anonimiza também os endereços IP privados (RFC 1918), CGNAT e link-local, os nomes dos peers e as chaves públicas do WireGuard. Valores recorrentes recebem o mesmo marcador, então os peers continuam distinguíveis. Use o modo estrito ao compartilhar o pacote de depuração fora da sua organização."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Nenhum"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Padrão"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Estrito"
+        "message": "Oculta endereços IP públicos e domínios que não são do NetBird nos logs."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir informações do sistema"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requer {actor}. Execute isto em vez disso:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Você pode desativar isto, mas ativar novamente requer {actor}:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Você pode ativar isto, mas desativar novamente requer {actor}:"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -764,19 +764,7 @@
         "message": "Анонимизировать конфиденциальную информацию"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Скрывает IP-адреса, домены и другие конфиденциальные значения."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Режим «По умолчанию» оставляет внутренние IPv4-адреса и имена пиров читаемыми для поддержки. Режим «Строгий» дополнительно анонимизирует частные (RFC 1918), CGNAT и link-local IP-адреса, имена пиров и публичные ключи WireGuard. Повторяющиеся значения заменяются одним и тем же заполнителем, поэтому пиры остаются различимыми. Используйте режим «Строгий», когда передаёте отладочный пакет за пределы вашей организации."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "Нет"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "По умолчанию"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Строгий"
+        "message": "Скрывает публичные IP-адреса и сторонние (не относящиеся к NetBird) домены в журналах."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Включить сведения о системе"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Требуются {actor}. Выполните вместо этого:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Отключить можно, но чтобы включить снова, нужны {actor}:"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Включить можно, но чтобы отключить снова, нужны {actor}:"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -764,19 +764,7 @@
         "message": "匿名化敏感信息"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "隐藏 IP 地址、域名和其他敏感值。"
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "默认级别保留内部 IPv4 地址和对等节点名称，便于支持人员阅读。严格级别还会匿名化私有 (RFC 1918)、CGNAT 和链路本地 IP 地址、对等节点名称以及 WireGuard 公钥。相同的值会映射到相同的占位符，因此对等节点仍可区分。向组织外部分享调试包时请使用严格级别。"
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "无"
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "默认"
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "严格"
+        "message": "从日志中隐藏公共 IP 地址和非 NetBird 域名。"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "包含系统信息"
@@ -1350,14 +1338,5 @@
     },
     "error.unknown": {
         "message": "操作失败。"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "需要{actor}。请改为运行："
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "您可以关闭此项，但重新开启需要{actor}："
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "您可以开启此项，但再次关闭需要{actor}："
     }
 }

client/wasm/cmd/main.go

@@ -56,7 +56,8 @@ func startClient(ctx context.Context, nbClient *netbird.Client) error {
 // parseClientOptions extracts NetBird options from JavaScript object
 func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 	options := netbird.Options{
-		LogLevel: defaultLogLevel,
+		DeviceName: "dashboard-client",
+		LogLevel:   defaultLogLevel,
 	}
 
 	if jwtToken := jsOptions.Get("jwtToken"); !jwtToken.IsNull() && !jwtToken.IsUndefined() {
@@ -86,41 +87,13 @@ func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 		options.DeviceName = deviceName.String()
 	}
 
-	disableIPv6, err := boolOption(jsOptions, "disableIPv6")
-	if err != nil {
-		return options, err
+	if disableIPv6 := jsOptions.Get("disableIPv6"); !disableIPv6.IsNull() && !disableIPv6.IsUndefined() {
+		options.DisableIPv6 = disableIPv6.Bool()
 	}
-	if disableIPv6 != nil {
-		options.DisableIPv6 = *disableIPv6
-	}
-
-	// The caller decides whether this client uses lazy connections; left unset it
-	// defers to the management feature flag. A short-lived, interactive caller
-	// turns it off so its sessions reach the few peers their grant covers eagerly,
-	// instead of the first request waiting for the connection to be established.
-	lazyConnectionEnabled, err := boolOption(jsOptions, "lazyConnectionEnabled")
-	if err != nil {
-		return options, err
-	}
-	options.LazyConnectionEnabled = lazyConnectionEnabled
 
 	return options, nil
 }
 
-// boolOption reads a boolean option, returning nil when the caller left it out.
-// js.Value.Bool panics on any other type, so a wrong type is reported instead.
-func boolOption(jsOptions js.Value, name string) (*bool, error) {
-	v := jsOptions.Get(name)
-	if v.IsNull() || v.IsUndefined() {
-		return nil, nil
-	}
-	if v.Type() != js.TypeBoolean {
-		return nil, fmt.Errorf("option %s must be a boolean, got %s", name, v.Type())
-	}
-	b := v.Bool()
-	return &b, nil
-}
-
 // createStartMethod creates the start method for the client
 func createStartMethod(client *netbird.Client) js.Func {
 	return js.FuncOf(func(this js.Value, args []js.Value) any {

client/wasm/cmd/main_test.go

@@ -1,64 +0,0 @@
-//go:build js
-
-package main
-
-import (
-	"syscall/js"
-	"testing"
-)
-
-// TestParseClientOptionsBooleans covers the boolean options against the value
-// kinds a JS caller can pass: js.Value.Bool panics on anything but a boolean,
-// so a wrong type has to be rejected before it reaches the client.
-func TestParseClientOptionsBooleans(t *testing.T) {
-	t.Run("unset leaves the lazy override empty", func(t *testing.T) {
-		options, err := parseClientOptions(js.Global().Get("Object").New())
-		if err != nil {
-			t.Fatalf("parse options: %v", err)
-		}
-		if options.LazyConnectionEnabled != nil {
-			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
-		}
-		if options.DisableIPv6 {
-			t.Error("disableIPv6 should default to false")
-		}
-	})
-
-	t.Run("null defers to the management flag", func(t *testing.T) {
-		jsOptions := js.Global().Get("Object").New()
-		jsOptions.Set("lazyConnectionEnabled", js.Null())
-		options, err := parseClientOptions(jsOptions)
-		if err != nil {
-			t.Fatalf("parse options: %v", err)
-		}
-		if options.LazyConnectionEnabled != nil {
-			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
-		}
-	})
-
-	t.Run("booleans are carried through", func(t *testing.T) {
-		jsOptions := js.Global().Get("Object").New()
-		jsOptions.Set("lazyConnectionEnabled", false)
-		jsOptions.Set("disableIPv6", true)
-		options, err := parseClientOptions(jsOptions)
-		if err != nil {
-			t.Fatalf("parse options: %v", err)
-		}
-		if options.LazyConnectionEnabled == nil || *options.LazyConnectionEnabled {
-			t.Errorf("lazy override should be false, got %v", options.LazyConnectionEnabled)
-		}
-		if !options.DisableIPv6 {
-			t.Error("disableIPv6 should be true")
-		}
-	})
-
-	t.Run("a non-boolean is rejected", func(t *testing.T) {
-		for _, value := range []any{"true", 1, js.Global().Get("Object").New()} {
-			jsOptions := js.Global().Get("Object").New()
-			jsOptions.Set("lazyConnectionEnabled", value)
-			if _, err := parseClientOptions(jsOptions); err == nil {
-				t.Errorf("value %v should be rejected", value)
-			}
-		}
-	})
-}